What Happened
On the morning of March 3, 2009, a commercial pilot climbed into his experimental amateur-built Stephenson Zodiac 601XL, registration N3683X, at Tooele, Utah, and pointed the nose north. The destination was Bountiful, Utah, roughly 40 miles away. The flight was a personal pleasure flight, VFR, no flight plan filed. Conditions looked reasonable: visibility 10 miles, a few clouds at 7,000 feet, surface winds from the south at around 14 knots gusting to 20. The pilot, 37 years old, held a commercial certificate with single-engine, multi-engine land, and instrument ratings. He had logged approximately 371 total hours. Nine point one of those hours were in this exact airplane, which he had flown for the first time just four months earlier, in November 2008. That November 8th entry in his logbook noted it as the airplane’s maiden flight.
The Zodiac 601XL was a kit-built, all-metal, low-wing two-place airplane assembled by the owner from a kit manufactured by Zenith Aircraft out of Mexico, Missouri. It was powered by a 120-horsepower Jabiru six-cylinder engine. A designated airworthiness representative had issued the airplane its special airworthiness certificate on November 3, 2008, just five days before that first flight. At the time of the accident, the airplane had completed exactly nine flights totaling 9.1 hours, and the pilot was still working through phase one flight testing, the period where builders evaluate the airplane’s airworthiness before opening it up to normal operations.
FAA radar tracked the airplane departing Tooele and heading steadily northward toward Antelope Island, a 28,000-acre landmass sitting in the Great Salt Lake about 12 miles southwest of Syracuse. Altitude data wasn’t available from the radar returns, but a performance study combining radar and meteorological data showed the flight moving at 113 knots calibrated airspeed on a consistent northerly course. Then, at 0838, the final radar return appeared approximately 0.5 miles south of where the wreckage would later be found. The airplane never reached Bountiful. It never reached much of anything beyond a ridgeline on the western side of Antelope Island.
Family members alerted the FAA that the airplane was overdue. An alert notice was issued. Search and rescue personnel discovered the wreckage later that evening, on sloping terrain roughly 1,600 feet below a ridgeline. The commercial pilot, the sole occupant, was killed. All of the airplane’s structural components and flight control surfaces were at the main impact site. The airplane had not scattered pieces across miles of terrain. It had come apart in the air, and then come down in one place.
Investigation Findings
NTSB investigators examined the wreckage carefully, and what they found in the metal told a specific story. The left wing had buckled upward and folded over the cockpit. The upper spar cap was bent forward about 3 feet from the wing-to-fuselage attachment point. Multiple rivet heads along the forward spar had sheared. The lower spar caps at the wing root had fractured in tensile static overload roughly 2 inches outboard of the attachment point. The rear spar web had fractured in an upward and outboard direction at the attachment hole. What was left of it was bent and wrapped around the head of the rear spar attachment bolt. The left wing had effectively broken free of the airplane and folded back over the cockpit.
The right wing told a different but related story. It remained attached at the forward spar caps, but the rear spar web had fractured at the attachment hole in a forward direction. The upper and lower rear spar caps near the aileron-flap junction showed compression buckling in both directions, upward and downward. The wing skins had ballooned outward and separated from the ribs. The damage pattern on the rear spars of both wings showed bending in opposite directions simultaneously, which is not what you see when a wing simply bends too far in one direction from aerodynamic overload. That kind of opposite-direction compression buckling is what you see when a surface is oscillating rapidly up and down. The investigators also found that the left aileron had been driven to full trailing-edge-down deflection and the right aileron to full trailing-edge-up deflection, consistent with the aileron system reaching its travel limits during a violent oscillation event. Both ailerons showed evidence of over-travel at the access holes in the rear spars where the push rods passed through.
Investigators confirmed there was no evidence of excessive airspeed or aggressive maneuvering that would explain a straightforward structural overload. There was no pre-impact fire. All fracture surfaces examined showed static overload features with no metal fatigue or material weakness present. Toxicology came back clean: no ethanol, no drugs. The engine had produced power right up to impact. Both propeller blades were sheared at the hub, consistent with the engine running when the airplane hit the ground. The weather included some reported turbulence in the area, but investigators did not believe it was severe enough to have caused the wing failures. The structures study pointed to one mechanism: aerodynamic flutter. And this wasn’t the first time investigators had seen exactly this on a Zodiac 601XL. There had been three other 601XL in-flight breakups before this one, in Oakdale, California in 2006, Yuba City, California in 2006, and Polk City, Florida in 2008. The fatal accident rate for 601XLs excluding breakups was already 5 to 11 times higher than general aviation as a whole. The in-flight breakup rate was 200 to 500 times higher than general aviation. And in most of those 601XL breakup cases, investigators found distinct evidence of flutter without any indication that the airplane had first departed controlled flight.
The design of the Zodiac 601XL ailerons relied on high control cable tension as the primary defense against flutter. The idea was that high cable tension would stiffen the dynamic interaction between the wing and the aileron, making flutter less likely. The cable tensions had been set before the first flight in accordance with Zenith Aircraft instructions, then rechecked about 6 flight hours before the accident with no change noted. But the ailerons had no mass counterbalances. Counterbalances, small weights positioned ahead of the aileron hinge line, are a more direct mechanical solution to flutter because they shift the aileron’s center of mass forward, changing the dynamics of how the surface responds to aerodynamic excitation. Without them, the flexible-skin ailerons on the 601XL depended entirely on cable tension to stay in front of a flutter event. After multiple accidents in Europe, the UK Light Aircraft Association had designed and flight-tested counterbalanced ailerons for the type and confirmed they provided substantially better protection. That solution hadn’t been incorporated into the accident airplane’s build.
NTSB Probable Cause
The in-flight failure of both wings due to aileron flutter. The aileron flutter was the result of inadequate wing stiffness and the lack of aileron counterbalances.
Safety Lessons
This accident, and the pattern of 601XL breakups that surrounded it, produced some of the most pointed NTSB safety recommendations in light sport and experimental aviation in years. A few things stand out for any pilot flying or building an experimental airplane.
- Phase one flight testing is not routine flying. The pilot was still in phase one, the period specifically set aside to discover whether a newly built airplane is airworthy. Flying a phase-one experimental airplane over mountainous terrain at cruise speed, away from an accessible landing area, compresses the margin for discovering a problem and surviving it. Phase one restrictions exist for a reason: keep the airplane over flat, open terrain within gliding distance of a runway, and build hours incrementally before expanding the envelope.
- Understand how your specific aircraft design manages flutter. The 601XL’s flutter protection depended on control cable tension alone, without the redundancy of mass-balanced ailerons. Before flying any experimental or light sport design, a pilot should understand what specific flutter mitigation the design uses, whether those mitigations have been tested and validated, and what the known failure modes look like across the fleet. In the case of the 601XL, three in-flight breakups had already occurred before this accident. That information was publicly available. The NTSB issued an urgent recommendation following this accident asking the FAA to ground the type until flutter protection could be verified.
- Comply with safety directives even when compliance is optional. Experimental amateur-built aircraft are not required to comply with airworthiness directives or safety alerts in the same way certificated aircraft are. After this accident and the one that followed in November 2009 in Agnos, Arkansas, the FAA issued SAIB CE-10-08 and the manufacturer issued a safety alert recommending structural modifications and aileron counterbalance installation. Experimental builders could still legally fly without those modifications. That distinction between legally permissible and physically safe matters a great deal when the failure mode is catastrophic and offers no recovery time.
Frequently Asked Questions
Q: What caused the Zodiac 601XL wings to fail in flight?
A: The NTSB determined the wings failed due to aerodynamic flutter of the ailerons. The 601XL design used high control cable tension as its primary flutter defense, but the ailerons lacked mass counterbalances, which provide more direct protection. When flutter developed, the wings began oscillating rapidly up and down, generating loads that exceeded the structure’s capacity. Both wings failed before the airplane could recover.
Q: How many Zodiac 601XL airplanes experienced in-flight breakups?
A: The NTSB identified at least five 601XL breakup accidents investigated before and including this one, with another following in November 2009 in Agnos, Arkansas. The agency calculated the 601XL in-flight breakup rate at 200 to 500 times the rate for general aviation as a whole, calling it a distinct pattern linked to the design’s flutter vulnerability.
Q: What is aileron flutter and why is it dangerous?
A: Aileron flutter is a self-reinforcing oscillation where aerodynamic forces cause the aileron to vibrate rapidly up and down at increasing amplitude. Once flutter starts, it feeds on itself. Without a mechanism to damp it, the oscillation grows until the structure fails. It can develop quickly at cruise speeds and gives the pilot essentially no time to respond. Mass-balanced ailerons shift the control surface’s center of gravity forward of the hinge line, which changes the aerodynamic dynamics and interrupts the feedback loop that drives flutter.
Q: Was the Zodiac 601XL grounded after this accident?
A: The NTSB issued an urgent recommendation in April 2009 asking the FAA to prohibit further flight of all 601XL variants until flutter protection could be verified. After another breakup in November 2009, the FAA issued Special Airworthiness Information Bulletin CE-10-08 and the manufacturer issued a safety alert and directive requiring structural modifications and aileron counterbalance installation for SLSA-certificated aircraft. Experimental amateur-built 601XL owners were strongly recommended but not legally required to comply.
Q: How fast was the airplane flying when it broke up?
A: Radar data and the associated performance study showed the airplane moving at 113 knots calibrated airspeed on a steady northerly course toward Antelope Island. Investigators found no evidence of excessive airspeed beyond that or aggressive maneuvering prior to the structural failure.
