BOMBARDIER INC BD-100-1A10

Full Narrative

HISTORY OF FLIGHTOn March 3, 2023, about 1600 eastern standard time, a Bombardier BD-100-1A10 (Challenger 300) airplane, N300ER, was involved in an accident near Windsor Locks, Connecticut. One passenger was fatally injured. The two airline transport pilots and two other passengers were not injured. The airplane incurred minor damage. The airplane was operated as a Title 14 Code of Federal Regulations (CFR) Part 91 personal flight.
The flight crew reported that they completed a flight from Leesburg Executive Airport (JYO), Leesburg, Virginia, to Dillant/Hopkins Airport (EEN), Keene, New Hampshire, with the accident passengers the day before the accident. The accident flight was the return flight to JYO and the first flight of the day.
The SIC conducted an exterior preflight inspection of the airplane. His inspection was interrupted when he stopped to assist an employee of the fixed base operator who had brought ice to the airplane. After assisting the lineman, he resumed the preflight inspection where he thought he had stopped; however, he inadvertently left the non-streamer pitot cover on the right pitot probe. The PIC also did not observe the pitot probe cover and reported that the SIC had completed the exterior preflight checklist. The passengers arrived about 1500 boarded the airplane, and the pilots conducted an uneventful engine start and taxi.
During the takeoff roll on runway 2, the SIC reported that the airplane accelerated normally; however, he observed that the right primary flight display (PFD) airspeed indicator failed to show an acceleration above 40 knots (kts), while the left airspeed indicator showed a normal acceleration. The crew rejected the takeoff, and the PIC slowed the airplane without issue and exited the runway onto a taxiway.
According to data recovered from the flight data recorder (FDR), the takeoff was initiated at 1526:11 and was subsequently aborted about 16 seconds later. The airplane reached a maximum speed of 104 kts, as indicated by the left PFD; however, the data for the right PFD airspeed indicator was consistent with the probe remaining covered.
Following the rejected takeoff and exit from runway 2, the left engine was shut down on the taxiway, and the SIC opened the main cabin door and walked to the front of the airplane, where he subsequently observed that the red pitot probe cover remained installed on the right side pitot probe. The SIC removed the cover, did not see any damage to the probe, and returned to the cockpit.
While the SIC was retrieving the pitot probe cover, the PIC observed a Crew Alerting System (CAS) cyan advisory “RUDDER LIMITER FAULT” message. The PIC reported that he attempted two avionics stall tests (STALL/ RUD LIM test) to clear the message, as he had received this advisory message on previous flights in environments where the airplane was cold soaked; however, the tests did not clear the annunciation.
The cockpit voice recorder (CVR) captured the flight crew discussing the Rudder Limiter Fault message and that the flight director was in pitch mode. After the SIC observed the Rudder Limiter Fault CAS message, he stated, “I’ll call ‘em,” and the PIC responded with, “who you calling?” The SIC stated, “do you want to take off with a rudder limiter fault?” The PIC responded with “it’s advisory only.” Their discussions continued briefly and eventually both agreed to continue the flight with the advisory message displayed.
The crew again taxied for takeoff, entered runway 2, and began the takeoff roll. According to the PIC, the flight director command bars on the attitude pitch indicator would not appear after pressing the takeoff button, but he elected to continue with the takeoff. According to the SIC, about 80 kts, he noticed that there were no V-speed bugs displayed on the airspeed indicator, but he remembered from their previous takeoff attempt that the V1 (decision) speed was 116 kts. The SIC announced “V1” about 116 knots, followed by “rotate.” The airplane became airborne at 1535:27.
The PIC reported that the autopilot was engaged during the initial climb and the turn onto course, and the crew continued a climb to 6,000 ft mean sea level (msl).
During the climb, the flight crew observed multiple CAS caution messages. The crew recalled messages of “MACH TRIM FAIL,” “AP STAB TRIM FAIL” [Autopilot Stabilizer Trim Failure], and “AP HOLDING NOSE DOWN.” Neither crewmember could recall exactly what order the CAS messages were presented throughout the climb, or whether other messages were displayed.
About 1536:11, the flight was cleared by air traffic control to climb to FL230 (23,000 ft msl).
According to the CVR, at 1536:28, the SIC asked the PIC if he wanted a lower altitude, and the PIC responded with, “no … get the checklist.” The SIC subsequently attempted to re-input the V-speeds into the flight management system (FMS) and stated, “I think it’s a configuration issue from the beginning.” At 1536:52, the sound of a cavalry charge, consistent with an autopilot disconnect, was heard. The SIC questioned the PIC whether the autopilot had failed or whether the PIC disconnected it, to which the PIC stated, “I did that.”
According to the FDR, following the initial disconnect at 15:36:52, the autopilot was reengaged two additional times during the climb. With each engagement, the CAS displayed multiple caution messages. During the postaccident interview, the PIC could not recall engaging and reengaging the autopilot multiple times. Coincident with each autopilot disconnect was the manual adjustment of the horizontal stabilizer trim.
According to the CVR, at 1537:58, the SIC stated, “I’d just leave the autopilot off,” and the PIC responded with, “all right,” and “get the checklist going.” The SIC subsequently continued to mention the V-speed selections and questioned the captain on how to program the FMS. For about 4 additional minutes, the crew continued to discuss FMS programming and V-speeds, and at 1542:49, the SIC stated that, “okay there we go … they took those” to which the PIC responded, “aright… run the checklist.”
The SIC, via an electronic flight bag (EFB), located the quick reference card and the PRI STAB TRIM FAIL [Primary Stabilizer Trim Failure] checklist. The SIC reported in a postaccident interview that he selected the PRI STAB TRIM FAIL checklist because, “…it’s the only trim fail checklist in the quick reference [card] and it seemed to be the root cause of our problem.”
The SIC reported that he visually showed the PIC the checklist on the EFB, and they agreed to execute the checklist. The first action on the checklist was to move the stabilizer trim switch (STAB TRIM), located on the center console, from “PRI” (Primary) to “OFF.” The SIC read the checklist item aloud and subsequently moved the switch to the off position.
As soon as the switch position was moved, the autopilot disconnected, and with the autopilot no longer holding nose-down force on the elevator control surface, the elevator rapidly moved to neutral. Subsequently, the airplane rapidly pitched up, the PIC input nose-down column force, and the airplane pitched back down. The airplane pitched up again and the stall protection system activated. The PIC described during postaccident interviews that, “I did not expect it to pitch as rapidly as it did in either direction.” The PIC also reported that, immediately before the pitch oscillations, his left hand was on the flight controls and his right hand was guarding the right side of the flight controls.
The PIC reported that, preceding the rapid pitch event, the autopilot was on, and he expected that once the stabilizer trim switch was turned off, the autopilot would disconnect, which it did. The SIC reported that he believed the autopilot was off as they were completing the checklist.
During the oscillations, the CVR recorded that, at 1544:08, the SIC announced, “stab trim off” and the autopilot disconnect sound was immediately heard. Sounds consistent with items moving in the flight deck were heard and about four seconds after the upset began, the PIC stated, “turn it on… turn it on!” and an electronic voice announced “stall” multiple times. At 1544:26, after control of the airplane had been regained, the SIC stated, “we shouldn’t have had the autopilot on” and the PIC responded with, “yeah.”
Moments after the in-flight upset, the flight crew were alerted by one of the passengers that another passenger had been seriously injured. The SIC exited the flight deck to check on the passenger and to provide medical attention. He subsequently returned to his seat and informed the PIC that there was a medical emergency and that they needed to land.
The PIC reported that he had no problem manually flying the airplane after the in-flight upset, nor did he experience any abnormalities trimming the airplane using the manual pitch trim switch, located on the control wheel, at any point during the flight.
The flight crew informed air traffic control of the medical emergency and began a diversion to Bradley International Airport (BDL), Windsor Locks, Connecticut. The PIC did not reengage the autopilot for the remainder of the flight and landed about 17 minutes after the in-flight upset. After landing, the airplane taxied to the ramp, where an ambulance was waiting. Paramedics entered the airplane and subsequently transported the injured passenger to a nearby hospital, where she succumbed to her injuries later in the day.
Flight Data Recorder and Non-Volatile Memory Information
Takeoff and Climb
According to data recovered from the airplane’s FDR, no significant difference in airspeed between the left and right PFD airspeed indicators was observed in the data following the SIC’s removal of the pitot probe cover. Throughout the initial climb, multiple pilot-commanded pitch trim inputs and corresponding movements from the horizontal stabilizer were observed outside of the time the autopilot was engaged. 
During the climb, the FDR data showed that the autopilot had been engaged and disengaged three separate instances. With each autopilot engagement, an immediate master caution was annunciated (Note: the FDR did not record specific CAS caution messages. Refer to the Flight Testing section for additional information).
The autopilot disconnected in the first two instances after the pilot pitch trim rocker switch was activated and small pitch oscillations were observed after the disengagement. The autopilot was reengaged for the final time at 6,230 ft msl and remained on until reaching 22,780 ft msl. The airplane’s airspeed increased from 238 kts to 274 kts in this segment of the climb.
In-Flight Upset
The FDR recorded that, immediately preceding the in-flight upset, the autopilot was disengaged, which resulted in the autopilot releasing the holding force on the flight controls. The timing of this FDR parameter was consistent with the flight crew's report that the stabilizer trim switch was moved from Primary (“PRI”) to “OFF.”
A National Transportation Safety Board Performance Study utilized FDR and ADS-B data to evaluate the airplane’s performance and configuration during the in-flight upset.
The study found that before the autopilot disengagement, the autopilot was holding an elevator deflection of 5.3° airplane nose-down to balance the airplane’s pitching moments and acceleration due to the nose-up horizontal stabilizer position. Following the autopilot disengagement, the elevators rapidly moved to neutral, and the airplane, which had been in a 3° nose-up pitch attitude, rapidly increased pitch to 11° nose-up in one second, and the normal acceleration increased to 4g. The control column was subsequently pushed forward by the PIC with at least 90 lbs of force, the airplane pitched down to a near nose-level attitude, and the normal acceleration was reduced to -2.3g. The control column was then pulled back through neutral, and the airplane again rapidly pitched to over 20° nose up and more than 4g of normal acceleration. The FDR then stopped recording, as the inertial g switch was triggered by the loading. As a result, the full extent of the pitch event was not recorded. Figure 1 provides an overview of the airplane pitch, column position, and elevator deflection, versus time and normal acceleration for the event. The dots on each respective line trace each sample of the FDR channel.

Figure 1: Airplane pitch, column position, and elevator deflection versus time and normal acceleration for event. The dots on each trace show each sample of the FDR channel.
The ADS-B data recorded that the airplane continued to climb to 26,100 ft until 1544:30 while losing 50 kts of groundspeed. The airplane then began to descend and gained over 100 kts of groundspeed in the next two minutes before slowing and descending toward BDL.
The FDR and CVR were equipped with inertial g switches. The CVR continued to record for an additional 10 minutes after the in-flight upset, as it was equipped with a back-up power supply; however, the CVR also stopped recording data prior to landing at BDL.
Horizontal Stabilizer Trim Electronic Control Unit (HSTECU) Information
The horizontal stabilizer trim electronic control unit (HSTECU) was removed from the airplane and shipped to the manufacturer (Moog). On March 16, 2023, the NTSB Systems Group and representatives of Moog convened to download the HSTECU non-volatile memory (NVM) and to test the unit.
Review of the FDR data revealed that, during the rejected takeoff, the mismatch between Air Data Computer 1 (ADC1) and ADC2 speeds were above 20 knots for more than 5 seconds.
This scenario caused several key faults to be recorded in the HSTECU. A review of the logic for these fault messages showed the HSTECU latched an "ADC1/ADC2 Miscompare," indicating an airspeed data mismatch between ADC1 and ADC2, and resulting in the HSTECU posting a "RUDDER LIMITER FAULT" advisory message in the flight deck.
In addition, “Confirmed Mach Valid” latched to FALSE, which resulted in:
o “MACH TRIM FAIL” caution message in the flight deck
o Loss of Mach Trim
o HSTECU inhibit of autopilot trim function of the stabilizer
o Manual trim operating at a reduced rate of 0.2 deg/s
The series of faults introduced into the HSTECU following the rejected takeoff resulted in the crew receiving the CAS caution message of “AP STAB TRIM FAIL” upon autopilot engagement, due to the HSTECU inhibiting the autopilot trim function of the stabilizer. With the autopilot engaged and the trim function inhibited, the autopilot subsequently alerted the flight crew to “AP HOLDING NOSE DOWN” upon acceleration, which was meant to alert the crew to the out-of-trim condition.
A review of the “MACH TRIM FAIL” caution message revealed that it was inhibited (not displayed) by the airplane’s avionics system while on the ground. The system was designed to not display the message to the flight crew on the CAS until the airplane was in the air (weight off wheels) and above 400 ft radio altitude.
The HSTECU latched faults could have been cleared if the unit, via the circuit breaker or the entire airplane, was powered down and then back on before takeoff.
The data found no evidence of a system malfunction with the HSTECU other than that related to the ADC1 and ADC2 issue as a result of the rejected takeoff. Additionally, there were no faults that would have produced a CAS message of “PRI STAB TRIM FAIL.”
Passenger Seating Configuration
Figure 2 shows the reported seating location for each passenger; the fatally injured passenger was No. 3. The cockpit is to the left in the figure, with the lavatory and aft section of the airplane to the right, annotated as “LAV.”

Figure 2: Seating Configuration with passenger seating locations annotated.
The No. 1 passenger reported that he was seated in the forward area club seating on the left side, facing forward during takeoff. He reported that the No. 2 passenger, also seated on the left side, facing rearward, had his seat reclined.
The No. 1 passenger did not recall any significant turbulence during the climb. He described that the in-flight upset occurred without any warning. He explained that it felt like the airplane was breaking apart and that the event was unlike anything he had ever experienced in his numerous years of flying in airplanes as a passenger.
The No. 1 passenger recalled that he was seated and that his seatbelt was buckled during the in-flight upset. After the event ended, he turned around and got up from his seat to see the No. 2 passenger lying on the ground next to his seat. He then saw the No. 3 passenger lying near the lavatory in the aisle of the airplane at its most rearward cabin area. The No. 1 passenger believed that, at some point during the climb, the No. 3 passenger had gotten up from the seat to use the lavatory.
The No. 1 passenger recalled that there were no passenger announcements made from the flight crew before the upset. He could not recall noticing the seat belt sign.
The PIC reported in an interview that the seatbelt sign was on for the entire flight, and that it is his “normal operation” as the PIC to “never turn it off throughout the flight.” He further reported that he and the SIC frequently flew with this group of passengers. PERSONNEL INFORMATIONAccording to Federal Aviation Administration (FAA) airman records, the PIC held an airline transport pilot certificate and held a PIC type rating in the accident airplane make and model, in addition to other type ratings. Executive Flight Services (EFS) reported that the PIC had accumulated 5,061 total hours of flight experience, and of those, 88 hours were in the accident airplane make and model.
The SIC held an airline transport pilot certificate and held a PIC type rating in the accident airplane make and model, in addition to other type ratings. EFS reported that the SIC had accumulated 8,025 total hours of flight experience, and of those, 78 hours were in the accident airplane make and model.
In October 2022, both pilots completed initial ground and simulator training and earned their PIC type ratings in the Challenger 300.
CAE Training Curriculum
According to the Simulator Instructor (S.I.) #5 “300/350 Instructor Guidance” for the “Initial Type Rating” provided by CAE, “AP STAB TRIM FAIL,” in addition to several other emergency and non-normal procedures, were listed in the topics to be covered outside of the simulator. There were no task items that required “AP STAB TRIM FAIL” or “AP HOLDING NOSE DOWN” to be experienced or examined in the simulator.
According to the PIC’s interview, he stated, “I do not recall doing any training as far as autopilot stab trim fail or autopilot holding nose up or autopilot holding nose down.” The SIC did not recall that either of those CAS messages were presented to him during training.
Simulator Testing
The NTSB conducted simulator testing at CAE in Dallas, Texas, where the accident flight crew received their initial type ratings. The testing attempted to evaluate the accident scenario, to include a rejected takeoff with a failed right side airspeed indicator, followed by a takeoff with known faults on the airplane. The testing determined that the simulator was incapable of producing similar indications to that which the accident flight crew received without a considerable amount of human interaction and abnormal simulator settings not commonly used in training scenarios. AIRCRAFT INFORMATIONOwner/Operator
Executive Flight Services (EFS), LLC. held a 14 CFR Part 135 air operator certificate and also offered whole aircraft management services. A representative of EFS reported that they managed the accident airplane and employed the flight crew. EFS reported that the flight was operated as a non-revenue 14 CFR Part 91 flight by the owner of the airplane, Conexon LLC. According to their website, Conexon was a broadband network design and construction firm based in Kansas City, Missouri.
Airplane
The airplane was a Bombardier BD-100-1A10 Challenger 300. It was powered by two Honeywell HTF7000 engines, each capable of producing 6,944 lbs of thrust.
According to the aircraft maintenance record, on February 2, 2023, the airplane had accumulated 2,307.6 total hours. On October 31, 2022, the airplane was inspected and complied with 14 CFR Part 135 inspection requirements, and at that time, had a recorded total time of 2,249.0 hours and 1,229 landing cycles. At the time of the accident, the airplane had accumulated 2,321 total hours.
The airplane was configured with 9 passenger seats and 2 flight crew seats. It did not require a cabin attendant due to the number of seats. The minimum flight crew complement was a pilot and copilot.
Within the limitations section of the Bombardier Challenger 300 Flight Crew Operating Manual (FCOM), the maneuvering load factors with flaps retracted were +2.6 g to -1.0 g.
According to the FCOM, Chapter 1, “General,” the airplane was equipped with an Engine Indication and Crew Alerting System (EICAS). The EICAS system was designed to show system status with specified colors. The “Crew Alerting System” portion of the EICAS displayed indications within the CAS window, which was in the upper right portion of the same display (see Figure 3).

Figure 3: View of the cockpit in the accident airplane with the CAS location annotated (Source of Photo: Aircraft.com)
Final Aircraft Walk-Around Procedure
The EFS General Operations Manual, revision 42, provided, in part, the following guidance about the “Final Aircraft Walk-Around Procedure”:
Prior to closing the aircraft door with the intent of flight, the PIC shall ensure a final walk- around of the aircraft has been completed on each leg. This procedure will provide a “last chance” to review the exterior of the aircraft to ensure the aircraft is in an airworthy condition and to verify the surroundings of the aircraft.
Pitot Probe Cover
The aircraft was equipped with three pitot probes. Two of the pitot probes were located on the left side and the other was located on the right side, below the pilots’ side windows.
Figure 4 contains photographs that were taken postaccident, which show the right pitot probe cover in place as it would have been on the day of the accident, in addition to a closer view of the red-colored cover.

Figure 4: View of the right side forward area of the airplane showing the covered pitot probe.
Rudder Limiter Fault Troubleshooting
The Bombardier Quick Reference handbook (QRH) revision 71, Volume 2, was available to pilots in both electronic form via their EFB and via a paper copy that was stowed in the flight deck. The QRH non-normal advisory message section provided guidance on CAS advisory messages. Depending on the message that was displayed on the CAS, the QRH would provide Minimum Equipment List (MEL) relief, or be listed as a “GO” or “NO GO” item. Review of the list revealed that a “RUDDER LIMITER FAULT” CAS message was a “NO GO” item (see Figure 5.)

Figure 5: Go/No Go QRH Guidance [Excerpt] with rudder limiter fault message annotated by red box.
The PIC reported that he did not refer to the QRH Go/ No-Go Guide due to his past experience in receiving the advisory message, which he recalled that it was described in the QRH as a “redundancy” and that the advisory “can stay on for up to 10 landing without removing aircraft power.” The SIC, when asked about the Go/No-Go guide, stated that, “It’s an advisory, we understood it as an advisory and it didn’t lead us to looking in the …go/no-go guide.” when asked if there were paper manuals in the airplane, including the QRH, the SIC stated “No.” A paper QRH was located in the airplane during postaccident examination.
According to the EFS Director of Operations (DO), the operator had a 24/7 maintenance control service available to all aircraft owned or managed by EFS. The DO was asked to explain what the accident crew would have been instructed to do had they called maintenance control regarding the Rudder Limiter Fault message. He reported that the crew would likely have been instructed to shut down both engines, depower the airplane, and start everything back up. The reset procedure was aimed at clearing computer-driven faults and anomalies. If that reset had not cleared the fault message, control would have determined if any MEL relief was available; if not available, the airplane would have been grounded until maintenance personnel could diagnose the issue.
Autopilot/Flight Director Mode Confirmation
The EFS, General Operations Manual, revision 42, “Autopilot/Flight Director Mode Confirmation” provided, in part, the following guidance on announcing the engagement or disengagement of the autopilot:
Knowing the status of the autopilot system is critical to CRM and any changes to the autopilot status must be communicated and confirmed.
When in manual flight, all changes to the autopilot are accomplished by the PM including turning it on. The PF may activate it if the PM is unable to due to a high workload. If the PF turns on the autopilot he shall announce “Autopilot On.”
The QRH Volume 2, “INTRO-1” described, in part, the purpose and use of the manual:

The QRH Vol. 2 contains procedures that are associated with Non-Normal operations. It serves a tactical purpose providing the crew with rapid access to critical information at time of need, and has been optimized for efficient flight compartment operation. It also contains other pertinent information (visual symbols, system schematics...), aimed at supporting the crew decision making process and understanding of the procedures in relation to the situation being encountered.
The manual described multiple EICAS message types, including the two noted below:
Caution messages - Are associated with serious system malfunctions that require immediate crew awareness and subsequent action when time and conditions permit.
Advisory messages - Are associated with a loss of system redundancy that requires crew awareness and where subsequent action may be needed.
According to the Bombardier QRH, the Quick Reference Card (QRC) was described in part as:

Procedures that contain Immediate Action Items, are shown within a box with a red-dashed boarder, and are also provided on the Quick Reference Card (QRC). The QRC can be used by the crew to more efficiently perform the Immediate Action Items without relying solely on memory, thus reducing the possibility of omission or commission errors. The QRC contains only the Immediate Action Items from the QRH, it does not contain the entire procedure.

The SIC located the PRI STAB TRIM FAIL checklist within the QRC via his EFB. The QRC provided immediate action items on seven items within the flight control portion of the QRH. The “Flight Controls” section, with PRI STAB TRIM FAIL denoted in amber (yellow) contained one action item of, “STAB TRIM ……. OFF.” This was the checklist utilized by the flight crew.

The Bombardier Challenger 300 “CSP 100-15- QRH Vol. 2”, section 2, “Avionics,” provides for the procedure for the “AP STAB TRIM FAIL” message. At the time of the accident, Bombardier had a temporary revision (TR) in effect for the procedure, which was TR-39-1, dated June 15, 2022 (see Figure 6.) That TR was printed on yellow cardstock and was also located in front of or facing the “AP STAB TRIM FAIL” checklist within the QRH both electronically and in the paper copy, located within the accident airplane, respectively.


Figure 6: Temporary revision for AP STAB TRIM FAIL.
The TR included an additional step noted as item 5 within the checklist and reordered items 3 and 4. The TR also included the addition of “Trim Malfunction procedures” and “STAB TRIM FAULT (A) procedures.”

Figure 7 below contains an excerpt from the Bombardier Challenger 300 “CSP 100-15- QRH Vol. 2”, section 2 “Avionics,” for an “AP HOLDING LWD” or “AP HOLDING RWD” or “AP HOLDING NOSE DOWN” or “AP HOLDING NOSE UP” caution message:


Figure 7: Autopilot Holding Left/Right Wing Down and Nose Up/Down Checklist. METEOROLOGICAL INFORMATIONReview of weather conditions along the route of flight revealed found no evidence of convective activity, nor any evidence of significant turbulence (reported or forecast).
The flight crew reported that they did not experience any remarkable turbulence during the flight, or during the time immediately surrounding the in-flight upset. AIRPORT INFORMATIONOwner/Operator
Executive Flight Services (EFS), LLC. held a 14 CFR Part 135 air operator certificate and also offered whole aircraft management services. A representative of EFS reported that they managed the accident airplane and employed the flight crew. EFS reported that the flight was operated as a non-revenue 14 CFR Part 91 flight by the owner of the airplane, Conexon LLC. According to their website, Conexon was a broadband network design and construction firm based in Kansas City, Missouri.
Airplane
The airplane was a Bombardier BD-100-1A10 Challenger 300. It was powered by two Honeywell HTF7000 engines, each capable of producing 6,944 lbs of thrust.
According to the aircraft maintenance record, on February 2, 2023, the airplane had accumulated 2,307.6 total hours. On October 31, 2022, the airplane was inspected and complied with 14 CFR Part 135 inspection requirements, and at that time, had a recorded total time of 2,249.0 hours and 1,229 landing cycles. At the time of the accident, the airplane had accumulated 2,321 total hours.
The airplane was configured with 9 passenger seats and 2 flight crew seats. It did not require a cabin attendant due to the number of seats. The minimum flight crew complement was a pilot and copilot.
Within the limitations section of the Bombardier Challenger 300 Flight Crew Operating Manual (FCOM), the maneuvering load factors with flaps retracted were +2.6 g to -1.0 g.
According to the FCOM, Chapter 1, “General,” the airplane was equipped with an Engine Indication and Crew Alerting System (EICAS). The EICAS system was designed to show system status with specified colors. The “Crew Alerting System” portion of the EICAS displayed indications within the CAS window, which was in the upper right portion of the same display (see Figure 3).

Figure 3: View of the cockpit in the accident airplane with the CAS location annotated (Source of Photo: Aircraft.com)
Final Aircraft Walk-Around Procedure
The EFS General Operations Manual, revision 42, provided, in part, the following guidance about the “Final Aircraft Walk-Around Procedure”:
Prior to closing the aircraft door with the intent of flight, the PIC shall ensure a final walk- around of the aircraft has been completed on each leg. This procedure will provide a “last chance” to review the exterior of the aircraft to ensure the aircraft is in an airworthy condition and to verify the surroundings of the aircraft.
Pitot Probe Cover
The aircraft was equipped with three pitot probes. Two of the pitot probes were located on the left side and the other was located on the right side, below the pilots’ side windows.
Figure 4 contains photographs that were taken postaccident, which show the right pitot probe cover in place as it would have been on the day of the accident, in addition to a closer view of the red-colored cover.

Figure 4: View of the right side forward area of the airplane showing the covered pitot probe.
Rudder Limiter Fault Troubleshooting
The Bombardier Quick Reference handbook (QRH) revision 71, Volume 2, was available to pilots in both electronic form via their EFB and via a paper copy that was stowed in the flight deck. The QRH non-normal advisory message section provided guidance on CAS advisory messages. Depending on the message that was displayed on the CAS, the QRH would provide Minimum Equipment List (MEL) relief, or be listed as a “GO” or “NO GO” item. Review of the list revealed that a “RUDDER LIMITER FAULT” CAS message was a “NO GO” item (see Figure 5.)

Figure 5: Go/No Go QRH Guidance [Excerpt] with rudder limiter fault message annotated by red box.
The PIC reported that he did not refer to the QRH Go/ No-Go Guide due to his past experience in receiving the advisory message, which he recalled that it was described in the QRH as a “redundancy” and that the advisory “can stay on for up to 10 landing without removing aircraft power.” The SIC, when asked about the Go/No-Go guide, stated that, “It’s an advisory, we understood it as an advisory and it didn’t lead us to looking in the …go/no-go guide.” when asked if there were paper manuals in the airplane, including the QRH, the SIC stated “No.” A paper QRH was located in the airplane during postaccident examination.
According to the EFS Director of Operations (DO), the operator had a 24/7 maintenance control service available to all aircraft owned or managed by EFS. The DO was asked to explain what the accident crew would have been instructed to do had they called maintenance control regarding the Rudder Limiter Fault message. He reported that the crew would likely have been instructed to shut down both engines, depower the airplane, and start everything back up. The reset procedure was aimed at clearing computer-driven faults and anomalies. If that reset had not cleared the fault message, control would have determined if any MEL relief was available; if not available, the airplane would have been grounded until maintenance personnel could diagnose the issue.
Autopilot/Flight Director Mode Confirmation
The EFS, General Operations Manual, revision 42, “Autopilot/Flight Director Mode Confirmation” provided, in part, the following guidance on announcing the engagement or disengagement of the autopilot:
Knowing the status of the autopilot system is critical to CRM and any changes to the autopilot status must be communicated and confirmed.
When in manual flight, all changes to the autopilot are accomplished by the PM including turning it on. The PF may activate it if the PM is unable to due to a high workload. If the PF turns on the autopilot he shall announce “Autopilot On.”
The QRH Volume 2, “INTRO-1” described, in part, the purpose and use of the manual:

The QRH Vol. 2 contains procedures that are associated with Non-Normal operations. It serves a tactical purpose providing the crew with rapid access to critical information at time of need, and has been optimized for efficient flight compartment operation. It also contains other pertinent information (visual symbols, system schematics...), aimed at supporting the crew decision making process and understanding of the procedures in relation to the situation being encountered.
The manual described multiple EICAS message types, including the two noted below:
Caution messages - Are associated with serious system malfunctions that require immediate crew awareness and subsequent action when time and conditions permit.
Advisory messages - Are associated with a loss of system redundancy that requires crew awareness and where subsequent action may be needed.
According to the Bombardier QRH, the Quick Reference Card (QRC) was described in part as:

Procedures that contain Immediate Action Items, are shown within a box with a red-dashed boarder, and are also provided on the Quick Reference Card (QRC). The QRC can be used by the crew to more efficiently perform the Immediate Action Items without relying solely on memory, thus reducing the possibility of omission or commission errors. The QRC contains only the Immediate Action Items from the QRH, it does not contain the entire procedure.

The SIC located the PRI STAB TRIM FAIL checklist within the QRC via his EFB. The QRC provided immediate action items on seven items within the flight control portion of the QRH. The “Flight Controls” section, with PRI STAB TRIM FAIL denoted in amber (yellow) contained one action item of, “STAB TRIM ……. OFF.” This was the checklist utilized by the flight crew.

The Bombardier Challenger 300 “CSP 100-15- QRH Vol. 2”, section 2, “Avionics,” provides for the procedure for the “AP STAB TRIM FAIL” message. At the time of the accident, Bombardier had a temporary revision (TR) in effect for the procedure, which was TR-39-1, dated June 15, 2022 (see Figure 6.) That TR was printed on yellow cardstock and was also located in front of or facing the “AP STAB TRIM FAIL” checklist within the QRH both electronically and in the paper copy, located within the accident airplane, respectively.


Figure 6: Temporary revision for AP STAB TRIM FAIL.
The TR included an additional step noted as item 5 within the checklist and reordered items 3 and 4. The TR also included the addition of “Trim Malfunction procedures” and “STAB TRIM FAULT (A) procedures.”

Figure 7 below contains an excerpt from the Bombardier Challenger 300 “CSP 100-15- QRH Vol. 2”, section 2 “Avionics,” for an “AP HOLDING LWD” or “AP HOLDING RWD” or “AP HOLDING NOSE DOWN” or “AP HOLDING NOSE UP” caution message:


Figure 7: Autopilot Holding Left/Right Wing Down and Nose Up/Down Checklist. WRECKAGE AND IMPACT INFORMATIONThe airplane landed without further incident at BDL airport following the in-flight upset event.
The Federal Bureau of Investigations Evidence Response Team sent an agent to the airplane the day of the accident. Photographs showed loose items scattered about the cabin. Some cabin shelving had broken inside of storage cabinets. Above the location of the No. 2 passenger, a part of the curved wood paneling and padded ceiling was cracked and displayed evidence of denting. Additional ceiling dents were located near the last row of seats and aft area of the cabin. Multiple oxygen masks had deployed from the ceiling. There was no evidence of any seat belts breaking free from their attachment points.
An exterior inspection following the accident found no visible damage to any flight control surface or airplane structure. Due to the g loads sustained during the event, the airplane underwent several hidden damage and structural tests following its release from the investigation to determine its future airworthiness. MEDICAL AND PATHOLOGICAL INFORMATIONAccording to the State of Connecticut, Office of the Chief Medical Examiner, the passenger’s cause of death was blunt injuries of head, neck, torso, and extremities, and the manner of death was stated as, “Accident (unbelted on plane in flight).” TESTS AND RESEARCHFlight Testing
On November 1, 2023, flight testing was performed at Bombardier in Wichita, Kansas. The purpose of the flight testing was to perform a rejected takeoff (RTO) with a cover installed on the right side pitot probe, repeat the actions observed by the flight crew, and then observe the airplane systems’ behavior during flight.
The flight test vehicle was compared to the equipment installed on the accident airplane and it was found to be a valid comparison make and model. In addition, the flight test vehicle was flown in a similar weight and balance configuration.
The flight test purposely did not allow the airplane to enter a severely out-of-trim condition as that experienced during the accident flight.
The flight testing found that, following the rejected takeoff, the cyan (blue) advisory CAS message, “RUDDER LIMITER FAULT” posted and persisted for the entire flight, despite multiple ground avionics stall tests (STALL/ RUD LIM test).
During the initial climb, the amber caution message, “MACH TRIM FAIL,” annunciated about 400 ft radio altitude and persisted for the remainder of the flight. The autopilot was engaged in the climb, at a similar time compared to the accident flight. Immediately following the autopilot engagement, the caution message “AP STAB TRIM FAIL” annunciated. When the autopilot was disconnected, the “AP STAB TRIM FAIL” message cleared from the CAS. Following the autopilot reengagement, the message immediately re-posted to the CAS.
The autopilot was reengaged at 162 kts and 5,750 ft msl. The flight test vehicle was accelerated at a rate of about one knot per second. Upon reaching 182 kts, the “AP HOLDING NOSE DOWN” caution message posted. When speed was reduced below 182 kts, the “AP HOLDING NOSE DOWN” message cleared. The flight test vehicle flight crew subsequently executed the “AP STAB TRIM FAIL” checklist, which included turning the autopilot off, and returned to land without incident. Figure 8 shows the PFD and CAS displaying the series of caution messages observed with the autopilot on and with the airplane having accelerated into an out of trim condition.

Figure 8: View of the flight test vehicle in-flight with the CAS displaying a series of caution messages and advisory messages.
Following the flight test, the HSTECU was removed from the airplane and shipped to the manufacturer for download. The data showed the same latched faults as those present in the download from the accident airplane. The flight testing confirmed that, given the accident circumstances, there were no conditions identified in the HSTECU, nor displayed in the EICAS, that would have enabled the “PRI STAB TRIM FAIL” message to display.