Description

On 15 December 2014, a Saab 2000 (G-LGNO) being operated by Loganair on a Flybe-branded scheduled domestic passenger flight from Aberdeen to Sumburgh was struck by lightning shortly after discontinuing an ILS approach at destination at night in IMC. A MAYDAY was declared and acknowledged on account of the lighting strike and an interlude, during which the crew suspected that the strike had compromised aircraft pitch control, followed with loss of control and a rapid dive at high speed occurred to 1,100 feet over the sea with recovery only commenced after EGPWS 'PULL UP' and 'SINK RATE' warnings had occurred. A diversion back to Aberdeen was then flown without further event. There were no injuries to any of the 33 occupants and only superficial airframe damage consequent to the lightning strike.

Investigation

An Investigation was carried out by the UK AAIB. The FDR was successfully downloaded but the 30 minute CVR had been overwritten during the diversion back to Aberdeen. A summary of the initial factual findings was published in a Special Bulletin on 2 March 2015. This noted that at that time, the Investigation had "not identified any technical malfunction which might account for the incident" and was going to focus on finding out how and why the loss of control had occurred and the circumstances which had enabled it to be regained.

It was established that the aircraft had been level at 2,000 feet and on the ILS localiser for runway 27 at Sumburgh, when the Captain decided to discontinue the approach after observing a red-coloured convective cell on the weather radar just to the west of the intended landing runway. ATC were informed and, with the AP remaining engaged with Altitude Hold Mode set, a turn onto a southerly heading in HDG Mode was commenced. As the aircraft was about to roll out on the selected southerly heading, a lightning strike occurred, entering at the radome and exiting at the APU exhaust in the tail with "Ball Lightning" appearing briefly in the forward cabin immediately prior to the strike. Immediately after the lightning strike, the aircraft rolled wings level on the selected heading and the Captain "began making nose-up pitch inputs, which he augmented with nose-up pitch trim inputs using the pitch trim switches". The First Officer transmitted a MAYDAY to ATC.

The aircraft climbed but the Captain "perceived that his increasingly purposeful pitch control inputs did not appear to be having the expected effect". The First Officer made similar nose-up pitch inputs and also pitch trim inputs, but she also "perceived that the aircraft was not responding as expected". Pitch and roll mistrim indications were presented on both PFDs in the form of a flashing ‘P’ and a flashing ‘R’ for the respective conditions and autopilot pitch and roll mistrim cautions were presented on the EICAS. The Captain instructed the First Officer to select the elevator emergency trim switch on the overhead panel and both pilots then made further inputs on the control-column-mounted pitch trim switches. These had no effect because the system had not detected a failure condition which by design was necessary to arm the emergency switch. ATC was asked to pass the aircraft altitude as displayed on radar and did so. Then, "as the aircraft reached 4,000 ft amsl, the pitch attitude tended towards nose-down and a descent began". The pitch trim was almost fully nose-down and despite full aft control column inputs, the descent continued. The pitch attitude reached 19° nose down and speed reached 330 KIAS, 80 knots above Vmo. The rate of descent peaked at 9,500 fpm as the aircraft descended through 1,600 feet amsl. ATC continued to give intermittent readouts of the radar displayed altitude throughout this descent. Unknown to the pilots, a transitory detection of invalid data from one of the ADCs then led to the AP - which they had not appreciated had remained engaged - disengaging and as both pilots maintained their nose-up pitch inputs, the aircraft began to pitch up. As the minimum height achieved - 1,100 feet amsl - was reached, the EGPWS generated a series of 'SINK RATE' Alerts and 'PULL UP' Warnings. The Captain applied full power and the aircraft began climbing and the EGPWS PULL UP Warnings stopped.

However, still under the impression that "elevator control response was not normal, or had been lost altogether" he instructed the First Officer to select pitch control disconnect. Given that to her, the pitch control did not appear to be jammed, the First Officer queried the instruction and the commander responded by selecting pitch disconnect himself which left each control column connected to its respective (on-side) elevator. The climb then continued normally to FL 240 and a diversion back to Aberdeen was completed without further event.

The subsequent recall of the event by both pilots was extremely patchy. When interviewed, both pilots stated that "immediately the lightning struck, the autopilot disconnected and the ‘cavalry charge’ tone sounded". They did not remember any climb prior to a steep decent and stated that "the aircraft began descending immediately after the lightning struck". Both did remember "making nose-up pitch inputs in an effort to regain height". The Captain did not remember seeing or hearing any EICAS cautions or warnings during the event and the First Officer did not remember seeing any mistrim cautions or warnings presented on the EICAS. The First Officer recalled seeing ‘PB’ or ‘PR’ annunciations on her PFD and being aware that 'P' and 'R' indicated an autopilot pitch/roll mistrim but not familiar with ‘B’ annunciation, considered that it might have indicated that a 'Pre Flight Built in Test (PBIT) was in progress. The Captain recalled that during the event he had seen the slip indicator moving from its neutral position and "found it necessary to make rudder inputs" and that the aircraft had been “lurching oddly”.

It was noted that the 42 year-old aircraft commander had 5,780 total flying hours including 143 were on the aircraft type. He had joined the Operator in 2005 as a Saab 340 First Officer before gaining a command on that type, on which he accumulated 4,640 hours before converting to the Saab 2000 and gaining a type rating on it four months prior to the investigated event. He was PF during the event. The 35 year old First Officer had 1,054 hours total flying time which included 260 hours on type, obtained after joining the Operator earlier in the year. She had gained a professional licence in 2012 and initially worked on twin piston and turboprop aircraft.

Both pilots had observed elevator malfunctions being demonstrated during type conversion training and participated in an exercise involving use of the elevator emergency pitch trim system to control pitch during an approach and landing. It was found during interview that the Captain was uncertain whether the control column moved in pitch in response to autopilot action when the autopilot was engaged. He stated that the autopilot could be disengaged by operating the pitch trim switches or the autopilot disconnect buttons on each control column and would disconnect in the event of a stall being sensed by the aircraft systems. He was not aware of the meaning of the ‘P’ symbol which appeared on the PFD during the incident. He stated that a momentary loss of engine-driven generators was "a likely consequence" of a lightning strike in flight and that this would result in loss of autopilot and EFIS screen displays. He had not previously experienced an aircraft lightning strike but it was noted that when on the Saab 340 he had flown a training exercise "in which a lightning strike was assumed to be the trigger for a double generator failure, as a consequence of which the autopilot disconnected".

Examination of meteorological data indicated that the lightning strike had been triggered by the presence of the aircraft and noted that such strikes cannot be avoided by the usual means such as use of airborne weather radar. The aircraft manufacturer reviewed its records of lightning strikes to Saab 2000 aircraft and found that none of those it was aware of had resulted in the disengagement of the autopilot.

Inspection of the aircraft showed that damage caused by the strike had been minimal and fairly typical - just at entry and exit points. However, it was considered that the Captain may have attributed the control difficulties experienced to a malfunction caused by the strike. The Investigation noted that one authoritative source warns that the disconcerting effects of a lightning strike "may lead to disorientation and loss of control unless pilots are fully prepared".

Recorded data showed that the AP had remained engaged following the strike and that this had continued to be so until it disconnected automatically as the aircraft descended through 3,600 feet at a rate of descent rapidly increasing through 4,250 fpm because one of the Flight Control Computers (FCC 2) had detected bad or missing data in the feed from ADC 2 for at least 99 milliseconds during the steep descent. The consequence of the AP disconnect was that nose-down pitch trim ceased and the Captain's subsequent pitch trim switch inputs began to be effective in reducing nose-down pitch trim and, as the EGPWS alerts/warnings began soon afterwards, allowed the aircraft to begin pitching up. It was noted that the AP disconnect had occurred at a 10° nose-down pitch attitude. If the ADC fault had not occurred, an AP disconnect would have occurred when the aircraft had reached the AP pitch limit of 17° nose-down - it reached a maximum of 19° down as the 9 seconds of EGPWS 'PULL UP' Warnings started. This occurred shortly before the maximum rate of descent of 9,500 fpm and maximum airspeed of 330 knots were recorded - Vmo is 270 KIAS. The minimum recorded height taken from the two ADCs as recovery took effect was between 1,050 and 1,100 feet amsl and vertical acceleration during the recovery reached a recorded 2.3 g. As there had been no in-flight ADC faults of any sort recorded since, ADC 2 was not removed for further investigation.

Indication of AP status was noted to be available on both PFDs (a white AP annunciation when not engaged and a green AP annunciation when engaged) and by inspecting the position of the 'autopilot engage lever’ on the flight deck centre pedestal to see if it is 'engaged' or 'disengaged'. The AP can be manually disengaged by using the disengage buttons on the control columns, by moving the Disengage lever or Standby Trim switches on the centre pedestal or by pushing the go around palm switches on the Power Levers. Automatic disengagement will occur in the event of invalid system input data or bank angle exceeds 45°, pitch down exceeds 19° or pitch up exceeds 25°. Operation of the main pitch trim switches on the control columns does not disengage the AP, neither can the pilot achieve disconnection by overriding the AP with contrary manual inputs on the control column.

An attempt to move the control column while the AP is engaged will not disengage it and, depending on selected settings, the AP servo may command opposing pitch trim as happened in the investigated event. Such action will cause a flashing ‘P’ to be annunciated on the PFDs. If the pilot control column inputs are maintained continuously for at least 10 seconds, the 'P' changes to a continuous annunciation and the EICAS Caution 'AP PITCH MISTRIM' (with a corresponding Master Caution light/chime for attention-getting purposes) is generated.

Flight Crew override effects on the AP systems of the main 'western' transport aircraft types were reviewed by the Investigation and compared with the Saab 2000 case. Whilst this comparison did not include all currently in service aircraft types, it showed that the only types checked for which fore/aft force override on the control column and/or pressing of the main pitch trim switches did not disengage the AP, apart from the Saab 2000, were early versions of the Airbus A300/AIRBUS A-310 and the Fokker 70/100, both of which were modified to align with the general standard after related accidents/serious incidents, notably the loss of an A300 at Nagoya, Japan in 1994.

In terms of human factors, the Investigation noted that for an aircraft with fly-by-wire controls such as the Saab 2000 which lack any physical feedback, it may be harder to determine the existence of a flight control malfunction or abnormal status because the effect of control inputs can only be assessed from aircraft response, and the force required to move the control column is increased over that normally required. However, "this is not a usual mode of operation and pilots are unlikely to be familiar with it" so that a pilot sensing greater than usual resistance to control column movement "may not readily determine that the reason for the unusual forces is that the autopilot is engaged".

Given that indications of abnormal AP pitch and roll status "were not acted upon", it was noted that "pilots who are experiencing difficulty simply in achieving the desired flight path may accord lower priorities to non-handling tasks, at least until the flight path is under control". It was also noted that in such circumstances, pilots’ ability to seek and process relevant information and then use it to identify the root cause of their difficulty may be impaired. It was also considered that there is "an uncertainty over the effectiveness of simulator training in altering the fundamental behaviour exhibited by pilots under such stress" and that "the previous regulatory action requiring modification of the Airbus A300/A310 and Fokker 70/100 aircraft types to address confusing and stressful conditions of similar origin was consistent with such a conclusion".

It was noted that "if the autopilot system had been designed to sense pilot-applied control forces and to disengage when it sensed a significant force [...] it would have disengaged about 20 seconds after the lightning strike" and there would have been no loss of control. A similar early resolution would have applied "if the autopilot system had been designed such that operating the pitch trim switches caused the autopilot to disengage […] if, as he reported, the Captain had been pressing the pitch trim switches to try to reduce the high control forces he was feeling".

It was further noted that current type certification requirements (AC 25.1329-1C and EASA AMC 25.1329) mandate that an AP should not create a hazard (Federal Aviation Administration (FAA)) or unsafe condition (European Aviation Safety Agency (EASA)) when an override force is applied by the pilot and that this requirement can be satisfied if either override leads directly to disengagement or this can be achieved by operation of the control wheel pitch trim switch.

An additional contributory factor in the investigated loss of control was noted as having been that at high speeds, the pitch trim had more elevator authority than the control column so that "even with full aft column held, the pilot was not able to prevent the nose from dropping". Whilst the AP was designed to disengage if extreme pitch and bank angles were exceeded, "it was not designed to help prevent speed exceedances" so that the AP had in this case continued to trim nose down even though the Vmo speed of 250 KIAS had been significantly exceeded.

The Conclusions of the Investigation included the following:

• the aircraft had responded as expected to the recorded control deflections and the lightning strike caused no significant damage or system faults.
• the manual control inputs made by the Captain following the lightning strike appear to have been instinctive and may have been based on his assumption that the autopilot would disconnect when lightning struck whereas it did not.
• The Captain did not recall having seen or heard any of the aural or visual mistrim cautions which were a cue that the autopilot was still engaged. This was probably the result of cognitive tunnelling.
• During the time when control had been lost, the autopilot’s nose-down elevator trim authority exceeded the Captain's elevator nose-up authority causing the aircraft to descend at a very high rate and at increasing speed.
• Only a transient data transmission fault which did not subsequently recur and in respect of which no fault was found allowed the Captain's nose-up pitch trim inputs to become effective in time to successfully respond to the EGWS warnings of imminent sea impact.
• The design of the Saab 2000 autopilot system differs from that of 22 other transport aircraft types surveyed in that it was the only one fitted with an autopilot which, when engaged, had the following three attributes:
  1. Applying an override force to the column will move the elevator but will not cause the autopilot to disengage.
  2. The autopilot can trim in the opposite direction to the pilot applied control column input.
  3. Pressing the main pitch trim switches has no effect and will not cause the autopilot to disengage.

Five Safety Recommendations were made as a result of the Investigation as follows:

• that the European Aviation Safety Agency review the design of the Saab 2000 autopilot system and require modification to ensure that the autopilot does not create a potential hazard when the flight crew applies an override force to the flight controls. [2016-050]
• that the European Aviation Safety Agency review the autopilot system designs of aircraft certified under part 25 or equivalent regulations and require modification if necessary to ensure that the autopilot does not create a potential hazard when the flight crew applies an override force to the flight controls. [2016-051]
• that the Federal Aviation Administration review the autopilot system designs of aeroplanes certificated to Federal Aviation Regulation Part 25 and require modification if necessary to ensure that the autopilot does not create a potential hazard when the flight crew applies an override force to the flight controls. [2016-052]
• that the Federal Aviation Administration amend Advisory Circular 25.1329-1C to ensure that requirement 25.1329(l) can only be met if the autopilot automatically disengages when the flight crew applies a significant override force to the flight controls and the auto-trim system does not oppose the flight crew’s inputs. [2016-053]
• that the European Aviation Safety Agency amend the Acceptable Means of Compliance for Certification Specification 25.1329 to ensure that requirement 25.1329(l) can only be met if the autopilot automatically disengages when the flight crew applies a significant override force to the flight controls and the auto-trim system does not oppose the flight crew’s inputs. [2016-054]

The Final Report of the Investigation was published on 6 September 2016.

Similar Events on SKYbrary

• A306, vicinity Nagoya Japan, 1994 - On 26 April 1994, the crew of an Airbus A300-600 lost control of the aircraft on final approach to Nagoya and the aircraft crashed within the airport perimeter. The Investigation found that an inadvertent mode selection error had triggered control difficulties which had been ultimately founded on an apparent lack understanding by both pilots of the full nature of the interaction between the systems controlling thrust and pitch on the aircraft type which were not typical of most other contemporary types. It was also concluded that the Captain's delay in taking control from the First Officer had exacerbated the situation.

Related Articles

• Loss of Control
• Lightning
• Human Factor in Emergencies
• Emergency or Abnormal Situation
• Guidelines for Dealing with Unusual/Emergency Situations in ATC
• Type Certificate

Further Reading

• FAA AC 25.1392-1C: Approval of Flight Guidance Systems, May 2016