Cessna 421C N700EM

The private pilot departed about 90 minutes after sunset in the high-performance multiengine airplane on the cross-country flight. The climb and level off at cruise altitude were uneventful and, based on the radar data, appeared to have been accomplished with the use of the autopilot. The cruise altitude of 27,000 feet was the highest the airplane had been flown in recent history, and the highest altitude it had been operated at with the pilot flying. The pilot made a routine radio exchange with air traffic control personnel shortly after levelling for cruise. Five minutes later, the airplane, with no further radio transmissions, rolled to the right and rapidly descended 10,000 feet, where it subsequently broke apart. Both wings, along with the horizontal stabilizer and elevators, separated during the breakup sequence. Analysis of their fracture surfaces, along with the debris field distribution and radar data, revealed that the breakup sequence was most likely inadvertently induced by the pilot, as he attempted to recover control of the airplane during the dive. The airplane sustained extensive thermal damage after ground impact, and examination of the engine components, surviving primary airframe components, the cabin heater, and the autopilot system remnants did not reveal any mechanical malfunctions or failures that would have precluded normal operation. There was no evidence of bird strike, inflight fire, or that the engine fire extinguisher system had been activated. The airplane was flying toward an uninhabited mountain range and a largely unpopulated desert area at the time of the upset. The moon had set, and the pilot would have had limited reliable external visual cues should the airplane have experienced a failure of either the flight instruments or autopilot. The pilot was instrument rated, however the majority of his flight experience was garnered in aircraft equipped with modern "glass cockpit" avionics, as opposed to the traditional flight instruments installed in the accident airplane (which he had recently purchased). The airplane was equipped with a dual vacuum pump system, which drove the primary flight instruments and, in turn, the autopilot. One of the vacuum pumps had failed on the previous flight, and the pilot was unable to get it repaired in time for the accident flight. The dual nature of the vacuum system allowed for flight with a single failed pump, however failure of the remaining pump or associated vacuum system components would have left the pilot to hand fly the airplane, using backup flight instruments, at an altitude perilously close to the limit of the airplane's flight envelope (the maximum altitude was 30,200 feet). Examination revealed that the second pump was most likely operational; however, fire damage precluded an accurate assessment of the operability of the remaining vacuum system components. Although operation of the airplane did not require adherence to a minimum equipment list, the airplane's FAA Master Minimum Equipment List stated that one of the vacuum pumps can be inoperative, provided the airplane is operated under VFR and not operated at night. Given the pilot's overwhelming experience with "glass cockpit" instruments, as opposed to the traditional type in the accident airplane, along with the failure of one of the vacuum pumps, he should have reconsidered making the flight, particularly during night conditions. The airplane had experienced multiple anomalies with the autopilot and vacuum system prior to the accident flight. Maintenance records indicated that these discrepancies had been resolved; however, damage to the airplane precluded a substantive confirmation of their operation. Additionally, an oversight by an avionics repair facility 1 week before the accident resulted in the airplane's pitot/static system being inadvertently tested and certified to 20,000 feet, rather than the airplane's service ceiling of 30,200 feet. The relevance of this finding, if any, could not be determined. The airplane was equipped with a supplemental oxygen system; however, maintenance records indicated that the pilot's mask, while operational, had degraded. Additionally, the mask had been relocated to a position behind the pilot's seat, which would have been hard to reach in the event of a rapid decompression. Ultimately, the NTSB was unable to determine the cause of the rapid descent because of the postcrash damage to the airplane systems and components.

Quoted verbatim from the NTSB record.