The U.K. AAIB recommends EASA to review the autopilot system designs of passenger aircraft following a serious incident involving a Saab 2000 in which the flight crew tried to override the autopilot which the did not realise, was still engaged.
The serious incident occurred on 15 December 2014 while on a regular flight between Aberdeen, Scotland and Sumburgh on the Shetland Islands. Prior to flight, the aircraft was serviceable with no relevant deferred defects. Although weather conditions in Aberdeen were pleasant, forecasts for Sumburgh predicted thunderstorms with rain, snow and hail, and winds gusting up to 60 kt during the afternoon and early evening. The flight crew briefed for their flying duties and discussed the weather conditions which they expected to encounter.
The aircraft and crew operated an uneventful rotation from Aberdeen to Sumburgh and back, then departed for the second rotation with the commander as pilot flying. The flight plan showed that 1,828 kg of fuel was required. The actual fuel load was 3,000 kg, to take advantage of the lower price of fuel in Aberdeen.
As the aircraft flew towards Sumburgh, ATC advised the flight crew that the ATIS at Sumburgh was not functioning because the antenna had been struck by lightning. However, the co-pilot tuned the frequency and found it was transmitting; ATIS information Tango was obtained, which stated that runway 27 was in use, the wind was from 290° at 34 kt, gusting to 47 kt, visibility was 4,700 m in heavy rain and snow, and the lowest cloud was one or two oktas at 700 ft aal (well above the decision altitude on the ILS approach); the QNH was 991 hPa.
During the descent, the commander briefed the co-pilot on actions to mitigate the risk associated with a possible lightning strike at night. When interviewed, he recalled that his briefing had included the need for cockpit lighting to be turned up, the locations of torches in the flight deck, and the elevator emergency trim switch. He also set up the radio tuning unit (RTU) on the left side of the flight deck to be available as an ILS display.
The commander reduced speed to turbulent air penetration speed, VA (205 KIAS). Ice protection systems were switched on, though no ice accretion was apparent.
The aircraft was vectored towards an ILS approach to runway 27. As it established on the base leg, the approach controller informed the flight crew that the visibility at Sumburgh was now 3,300 m in moderate rain and snow, and that the runway was wet. The aircraft, in clean configuration, descended to 2,000 ft amsl and established on the localiser approximately 9 nm east of the airport. The aircraft’s weather radar showed a convective cloud cell, ‘painting’ red, immediately west of the airport, and the commander decided to discontinue the approach. He informed the controller, and selected a southerly heading on the mode control panel. The autopilot remained engaged; the modes were heading select and altitude tracking. The aircraft experienced turbulence but not to the degree that the crew had difficulty seeing flight deck instruments and displays.
As the aircraft rolled out on the heading, it was struck by lightning, which entered the airframe at the radome and exited at the APU exhaust (in the tail). ‘Ball lightning’ appeared briefly in the forward cabin immediately before the lightning strike. The commander was making a radio transmission to ATC about his intentions at the time, but when the lightning struck, he uttered an expletive and stopped transmitting.
The commander recalled that he informed the co-pilot that he (the commander) had control of the aircraft and began making nose-up pitch inputs, which he augmented with nose-up pitch trim inputs using the pitch trim switches on the control wheel. The co-pilot transmitted a MAYDAY to ATC, and the controller offered “all options” to the flight crew for an approach or diversion.
The aircraft climbed, but the commander perceived that his increasingly purposeful pitch control inputs did not appear to be having the expected effect. The co-pilot also applied nose-up pitch inputs and pitch trim inputs, but similarly perceived that the aircraft was not responding as expected. Pitch and roll mistrim indications were presented on the primary flight displays (PFDs) in the form of a flashing ‘P’ and an ‘R’ for the respective condition and autopilot pitch and roll mistrim cautions were presented. The commander instructed the co-pilot to select the elevator emergency trim switch on the flight deck overhead panel. This was done, and both pilots then made further inputs on the control-wheel-mounted pitch trim switches4. However, these had no effect, as the system had not detected the failure condition necessary to arm the emergency switch. The co-pilot asked the controller to read out the aircraft’s altitude as displayed on radar, which he did.
As the aircraft reached 4,000 ft amsl, the pitch attitude tended towards nose-down and a descent began. Invalid data from one of the air data computers then caused the autopilot to disengage. The pitch trim was, by this time, almost fully nose-down, and the aircraft continued to pitch nose-down and descend; full aft control column inputs were made. The peak rate of descent was 9,500 ft/min at 1,600 ft amsl. The pitch attitude reached 19° nose down, and speed reached 330 KIAS, which exceeded the applicable maximum operating speed (Vmo) by 80 KIAS. The controller continued to give an occasional commentary of the displayed altitude to the crew throughout this time.
The pilots maintained nose-up pitch inputs and the aircraft began pitching nose-up. Nearing the minimum height achieved (1,100 ft above sea level) the ground proximity warning system fitted to the aircraft generated ‘sink rate’ and ‘pull up’ alerts. At some stage, the co-pilot announced “speed”. The commander applied full power, and the aircraft began climbing. He was still under the impression that elevator control response was not normal, or had been lost altogether, and he instructed the co-pilot to select the pitch control disconnect. The co-pilot queried this instruction, because the pitch control did not appear to be jammed, and the commander selected the disconnect himself. This disconnected the two elevator control systems from each other; each control column remained connected to its respective (on-side) elevator.
The climb continued and the aircraft diverted to Aberdeen, cruising at FL240. During the diversion, the commander briefed the cabin crew member for a normal landing and made a public address announcement to the passengers, reassuring them that all was well. The flight crew ascertained that the aircraft responded to pitch inputs made on either or both control columns. The flight crew prepared for an ‘elevator split’ landing, which the commander carried out without incident. The APU was not started after landing, because the flight crew were aware that the lightning strike might have caused damage in the tail area.
During the approach phase of a routine flight the aircraft was struck by triggered lightning. Procedures intended to prevent flight in areas where lightning may be encountered do not protect against triggered strikes. The lightning caused only minor damage to the aircraft’s radome and APU exhaust. Functional tests after the flight, and inspections of the elevator control system and autopilot system, did not reveal any faults.
Evidence from the manufacturer’s simulation work indicated that the aircraft had responded as expected to the recorded control deflections.
The commander’s actions following the lightning strike were to make manual inputs on the flying controls, which appear to have been instinctive and may have been based on his assumption that the autopilot would disconnect when lightning struck. However, the autopilot did not disconnect and was attempting to maintain a target altitude of 2,000 ft amsl by trimming nose-down while the commander was making nose-up pitch inputs. The control forces felt by the commander were higher than normal because the autopilot was opposing his inputs and he may have attributed this to a flight control malfunction caused by the lightning strike. He did not recall having seen or heard any of the aural or visual mistrim cautions which were a cue that the autopilot was still engaged. This was probably the result of cognitive tunnelling.
The commander applied and maintained full aft control column (nose-up elevator) input; however, the autopilot’s nose-down elevator trim authority exceeded the commander’s elevator nose-up authority and the aircraft pitched nose-down and descended, reaching a peak descent rate of 9,500 ft/min. The autopilot then disengaged due to an ADC fault and this allowed the commander’s nose-up pitch trim inputs to become effective. The aircraft started to pitch up just before reaching a minimum height of 1,100 ft above sea level. If the autopilot system had been designed to sense pilot applied control forces and to disengage when it sensed a significant force (about 25 lbf according to FAA AC 25.1329-1C), the autopilot would have disengaged shortly after the aircraft climbed above 2,000 ft, in response to the aft column inputs applied by the commander. This would have prevented the subsequent loss of control.
If the autopilot system had been designed such that operating the pitch trim switches resulted in autopilot disengagement, the autopilot would also have disengaged early in the sequence of events.
Of 22 airliner types surveyed, the Saab 2000 was the only type that had an autopilot which, when engaged, had the following three attributes:
1. Applying an override force to the column will move the elevator but will not cause the autopilot to disengage
2. The autopilot can trim in the opposite direction to the pilot applied control column input
3. Pressing the main pitch trim switches has no effect and will not cause the autopilot to disengage
The Airbus A300 and Fokker 70/100 aircraft previously had such attributes, and suffered one accident (A300) and several incidents (Fokker 70/100) due to pilots overriding the autopilot; these resulted in autopilot redesigns on both aircraft types.
In order to help prevent a similar recurrence of a loss of control due to autopilot override on the Saab 2000 and other aircraft types, five Safety Recommendations are made.
Official accident investigation report