Bill Scott was a flight test engineer on the Canadair Challenger program (now under Bombardier).
"A week ago, I visited the crash site of Challenger No. 1, the aircraft I bailed from on 3 April 1980. First time I’d been to the actual site. We found a LOT of small debris from the aircraft."
The story is based on the April 3, 1980, crash of the first Challenger prototype (CL-600, registration C-GCGR-X) during stall testing near Mojave, California. The accident involved a deep stall triggered by a stuck angle-of-attack vane, failed spin chute release mechanisms, and other factors. Test pilot Norm Ronaasen was killed; co-pilot Dave Gollings and flight test engineer Bill Scott survived by parachuting out.
Imagine pushing an experimental aircraft to its limits in the name of certification—only to watch everything go catastrophically wrong in under two minutes. That's exactly what happened on April 3, 1980, when the first Canadair Challenger prototype entered an unrecoverable deep stall over the Mojave Desert. I was there in the back as one of the flight test engineers, and this is the story of how three of us fought for our lives—and why one didn't make it.
The Canadair Challenger was groundbreaking: the first wide-body business jet, developed by the Canadian company Canadair (later acquired by Bombardier). With its T-tail design, spacious cabin, and advanced aerodynamics, it promised to redefine executive travel. But T-tails come with a known risk—deep stall, where the wing blankets the tail surfaces at extreme angles of attack, rendering elevators ineffective and leaving the nose pinned high.
To certify the aircraft, we had to demonstrate safe stall behavior. A single Canadian Department of Transport official insisted on purely aerodynamic stalls—no electronic stick shakers or pushers allowed, unlike what the FAA and Europeans required for T-tail jets. This forced us into hazardous, hands-on testing. We installed a small triangular stall strip on one wing to induce a controlled roll-off, tweaking its position by fractions of an inch between flights.
The test aircraft was heavily instrumented: a long pitot boom on the nose carried side-slip and angle-of-attack vanes feeding data to the cockpit. We had water ballast tanks to shift center of gravity, a tape recorder, and a spin recovery parachute packed in a blue canister on the tail. That chute was our last resort—if deployed, it would drag the tail up and force the nose down to break the stall.
The Ominous Precursor: Flight 353
The day before the accident—April 2, 1980—during stall tests (Flight 353), the crew heard a loud banging noise. Concerned about structural damage, they aborted immediately and returned to Mojave. Mechanics disassembled much of the aircraft but found nothing obvious.
Pressure mounted. The program manager visited flight ops three times that afternoon, urging lead test pilot Norm Ronnison to resume. Norm pushed back, demanding checks on potential causes. Late that day, just Norm and I remained. I asked him if he ever got that gut feeling something wasn't right. He admitted he did—and this was one of those times. After a long pause, he said, "Let's go home. I'll see you tomorrow."
The Fatal Flight: April 3, 1980 (Flight 354)
We briefed early. If the banging returned, we'd try to isolate it. Norm was in the left seat, Dave Gollings co-pilot on the right, me as flight test engineer in back. Hazardous tests meant helmets and parachutes.
In flight, we verified the spin chute system worked. We progressed through the test card. The banging appeared only in one flap/gear configuration. We pressed on, then Norm decided to return to that setup at higher altitude for a repeat—holding a steady angle of attack where the noise occurred so I could scan the cabin for loose items or damage.
Norm pulled back slowly, increasing angle of attack. Dave called readings: 14°, 17°, 17°... then suddenly, "30! More than 34!" The gauge pegged. We were deep stalled.
Both pilots shoved yokes full forward—no response. From my station, I saw only sky, then slowly a horizon. The nose refused to drop.
Norm called for the spin chute. Dave activated it. We felt a yank, pulsing drag. The nose pitched down. Relief washed over us—"All right, we're going home."
Norm ordered chute release. Dave hit the hydraulic button—nothing. He recycled it—still nothing. Switched to explosive bolts—nothing. The chute stayed attached.
We plummeted belly-down at around 50,000 feet per minute. I watched the altimeter unwind frantically. At 6,000 feet indicated (roughly 4,000 above ground), Norm ordered bailout.
I unstrapped, hit the lap belt, stood ready. Norm transmitted what I misheard as "Got it made"—actually "Mayday, Mayday, Mayday, Challenger 1 is bailing out."
I raced to the rear baggage door (rigged as an escape hatch with a hydraulic ram). Activated it—the door sucked in. Crouched in the opening, sagebrush whipped by terrifyingly close. No time for hesitation. I rolled shoulder-first into 180-knot wind. Shut my eyes (to save contacts—priorities in panic). Counted "one thousand one," pulled ripcord. Sharp opening shock—I briefly feared the spin chute hit me.
Canopy good. I spotted Dave's red-and-white chute collapsing—he'd landed hard. The aircraft descended steeply, right wing down. A dark shape ejected left side—Norm—but no chute. Seconds later, the plane impacted, exploding into a massive orange-black fireball. The shockwave thumped my chest.
In semi-shock, my mind screamed to rewind. But reality pressed: ground rushing up. First jump ever—eyes on horizon, feet together, toes down, hands high on risers. I hit, rolled properly, unstrapped fast before wind dragged me.
I ran to Dave—he'd broken his leg in three places from a marginal chute opening. We stayed clear as explosions continued at the site. Dave thought Norm hadn't escaped; I'd seen him exit without chute.
A helicopter from Edwards AFB arrived, stabilized Dave, flew us to Lancaster.
What Went Wrong:
The Chain of Failures
Radar plots showed the deep stall at 16,000 feet MSL (14,000 AGL). Bailout around 1,000–1,500 feet AGL. Crash in ~90 seconds total.Post-crash analysis revealed:
- The angle-of-attack vane stuck due to missing O-ring from the manufacturer. Sand from Mojave winds scored it, jamming at the critical moment we held constant AoA.
- Both spin chute release systems failed:
- Hydraulic: Seal incompatible with Skydrol fluid, deteriorated, couldn't hold pressure.
- Explosive bolts: Likely a failed push-on/push-off switch (light may have illuminated falsely). Bolts fired in lab tests but not in flight.
- The banging? Right-engine compressor stalls (like backfiring) at high AoA caused thrust pulses, shifting the engine on its pylon against stops—vibration transmitted as banging. Heard mildly at altitude before, but pronounced low.
Contributing issues included thin engineering support (one propulsion engineer overwhelmed, couldn't analyze data between flights), pressure to fly hours equating to progress, no telemetry (data lost in crash), and the insistence on no electronic protection.
A heroic note:
Mechanic Gary Childress spotted a fluid puddle under the escape system pre-flight, checked/refilled it thoroughly. Without that, the hatch might not have opened—Dave and I likely wouldn't have survived.
Lessons That Saved Future Flights
We resumed stalls with Challenger #2 featuring:
- Redesigned, redundant anti-spin chute system.
- Real-time telemetry to ground station—an engineer could monitor parameters and call "push, push, push" to break off tests instantly.
Broader takeaways:
- Managers must empower anyone to halt if safety feels compromised—break accident chains.
- Monitor for eroding safety margins ("zero margin" danger zone).
- Watch instrumentation closely—it can kill as surely as airframe flaws.
The Challenger earned Canadian certification August 1980, FAA later. It evolved into a successful line of business jets and regional aircraft—still flying worldwide today.
Nothing was inherently wrong with the Challenger design itself. The tragedy stemmed from flight test instrumentation defects and procedural pressures.
This isn't just a crash story—it's a reminder of risks in pushing boundaries, the cost of one life, and why aviation safety evolves from hard lessons.FAQs
- What caused the deep stall?
A stuck angle-of-attack vane (missing O-ring, contaminated by sand) falsely indicated stable AoA while it climbed beyond recovery. - Why couldn't they release the spin chute?
Hydraulic seal failed (incompatible with fluid); explosive bolts likely didn't trigger due to switch issue. - What was the banging noise?
Right-engine compressor stalls causing thrust pulses, banging the engine against pylon stops. - How many survived?
Two: co-pilot Dave Gollings (broken leg) and flight test engineer Bill Scott (uninjured). Pilot Norm Ronnison perished without chute deployment. - Did the accident delay certification?
No—Transport Canada certified in August 1980 despite the loss. - Was electronic stall protection added later?
Yes, production Challengers included stick shakers/pushers, aligning with international standards. - What became of the Challenger program?
It succeeded, spawning multiple models and regional jets—proving the design sound beyond test-phase flaws.
