Loganair SB20 near Shetland Islands on Dec 15th 2014, loss of elevator control due to lightning strike

Last Update: September 6, 2016 / 14:35:06 GMT/Zulu time

Bookmark this article
Incident Facts

Date of incident
Dec 15, 2014

Classification
Accident

Airline
Loganair

Flight number
BE-6780

Aircraft Registration
G-LGNO

Aircraft Type
SAAB 2000

ICAO Type Designator
SB20

A Loganair Saab 2000 on behalf of Flybe, registration G-LGNO performing flight BE-6780 from Aberdeen,SC to Shetland Islands,SC (UK) with 30 passengers and 3 crew, was descending towards Shetland Islands' Sumburgh Airport when the aircraft received a lightning strike disabling elevator control. The crew decided to return to Aberdeen, climbed the aircraft to about FL240, the aircraft flying between FL237 and FL245, and performed a safe landing at Aberdeen about 35 minutes later.

The occurrence aircraft resumed service on Dec 26th 2014.

On Feb 3rd 2015 the NTSB reported the AAIB rated the occurrence an accident and opened an investigation confirming elevator control was lost as result of a lighting strike.

On Mar 2nd 2015 the AAIB released a special bulletin reporting that the commander (42, ATPL, 5,780 hours total, 143 hours on type) decided to discontinue the ILS approach to Sumburgh Airport's runway 27 at about 2000 feet MSL due to weather ahead, a cell just west of the aerodrome painted red on the aircraft's weather radar, and turned the aircraft onto a southerly heading. While heading southerly the aircraft was struck by lightning. The commander made nose up pitch inputs but perceived that the aircraft was not properly responding. After the aircraft had reached 4000 feet MSL the aircraft pitched down reacing 19 degrees nose down, the vertical rate reached 9500 fpm descent and Vmo was exceeded by 80 knots. The aircraft descended to 1100 feet MSL before it began to climb again.

The AAIB stated: "Recorded data showed that the autopilot had remained engaged, and the pilots’ nose-up pitch inputs were countered by the autopilot pitch trim function, which made a prolonged nose-down pitch trim input in an attempt to maintain its altitude-tracking function."

The AAIB reported that the autopilot, following the aborted approach, was engaged in heading select and altitude tracking. The aircraft turned onto a southerly heading, while rolling out of that turn the aircraft was hit by lightning that entered the aircraft at the radome and exited through the APU exhaust, ball lightning briefly appeared in the forward cabin just prior to the lightning strike.

The commander applied nose up inputs on the control column and nose up trim inputs. The AAIB wrote: "The aircraft climbed, but the commander perceived that his increasingly aggressive control column inputs did not appear to be having the expected effect. The co-pilot also applied nose-up pitch inputs and pitch trim inputs, but similarly perceived that the aircraft was not responding as expected. Pitch and roll mis-trim indications were presented on the primary flight displays (PFDs) in the form of a ‘p’ and an ‘r’ for the respective condition. Both pilots considered the possibility that they had lost control of the aircraft, perhaps because of a failure of the fly-by-wire elevator controls following the lightning strike. The commander instructed the co-pilot to select the elevator emergency trim switch on the flight deck overhead panel. This was done, but had no effect, as the system had not detected the failure condition necessary to arm the switch."

The AAIB continued: "As the aircraft reached 4,000 ft amsl, the pitch attitude tended towards nose-down and a descent began. Invalid data from one of the air data computers then caused the autopilot to disengage. The pitch trim was, by this time, almost fully nose-down, and the aircraft continued to pitch nose-down and descend; full aft control column inputs were made. The peak rate of descent was 9,500 feet per minute at 1,600 ft amsl, pitch attitude reached 19° nose down, and the highest recorded speed was 330 KIAS. The pilots maintained nose-up pitch inputs and the aircraft began pitching nose-up. Nearing the minimum height achieved of 1,100 ft amsl, the ground proximity warning system fitted to the aircraft generated ‘sink rate’ and ‘pull up’ warnings. The commander applied full power, and the aircraft began climbing. He was still under the impression that elevator control response was not normal, and instructed the co-pilot to select the pitch control disconnect. The co-pilot queried this instruction, because the pitch control did not appear to be jammed, and the commander selected the disconnect himself. This disconnected the two elevator control systems from each other; each control column remained connected to its respective (on-side) elevator."

The crew subsequently verified that the aircraft was responding to pitch inputs made by either control column and diverted to Aberdeen.

The AAIB annotated: "The pitch trim switches on the control yoke are inhibited when the autopilot is engaged and moving these switches will not cause the autopilot to disengage. If the pilot tries to move the control column while the autopilot is engaged the pilot can overpower the autopilot servo, but the autopilot remains engaged and opposing elevator trim may result."

The AAIB reported that the aircraft sustained minor damage to the radome and APU exhaust, but remained otherwise undamaged. The AAIB analysed: "Analysis of the meteorological data showed that the aircraft was struck by triggered lightning which caused only minor damage. Although the pilots’ actions suggested that they were under the impression the autopilot had disengaged at the moment of the lightning strike, recorded data showed that it had remained engaged. The pilots’ nose-up pitch inputs were countered by the autopilot pitch trim function, which made a prolonged nose-down pitch trim input in an attempt to maintain its altitude tracking function until it disengaged. This accounted for the perception that the control response was not normal."

A number of safety actions by the aircraft manufacturer and the operator have already been taken as result of the occurrence.

On Sep 6th 2016 the AAIB released their final report concluding the probable causes of the serious incident were:

During the approach phase of a routine flight the aircraft was struck by triggered lightning. Procedures intended to prevent flight in areas where lightning may be encountered do not protect against triggered strikes. The lightning caused only minor damage to the aircraft’s radome and APU exhaust. Functional tests after the flight, and inspections of the elevator control system and autopilot system, did not reveal any faults.

Evidence from the manufacturer’s simulation work indicated that the aircraft had responded as expected to the recorded control deflections.

The commander’s actions following the lightning strike were to make manual inputs on the flying controls, which appear to have been instinctive and may have been based on his assumption that the autopilot would disconnect when lightning struck. However, the autopilot did not disconnect and was attempting to maintain a target altitude of 2,000 ft amsl by trimming nose-down while the commander was making nose-up pitch inputs. The control forces felt by the commander were higher than normal because the autopilot was opposing his inputs and he may have attributed this to a flight control malfunction caused by the lightning strike. He did not recall having seen or heard any of the aural or visual mistrim cautions which were a cue that the autopilot was still engaged. This was probably the result of cognitive tunnelling.

The commander applied and maintained full aft control column (nose-up elevator) input; however, the autopilot’s nose-down elevator trim authority exceeded the commander’s elevator nose-up authority and the aircraft pitched nose-down and descended, reaching a peak descent rate of 9,500 ft/min. The autopilot then disengaged due to an ADC fault and this allowed the commander’s nose‑up pitch trim inputs to become effective. The aircraft started to pitch up just before reaching a minimum height of 1,100 ft above sea level.

If the autopilot system had been designed to sense pilot applied control forces and to disengage when it sensed a significant force (about 25 lbf according to FAA AC 25.1329-1C), the autopilot would have disengaged shortly after the aircraft climbed above 2,000 ft, in response to the aft column inputs applied by the commander. This would have prevented the subsequent loss of control. If the autopilot system had been designed such that operating the pitch trim switches resulted in autopilot disengagement, the autopilot would also have disengaged early in the sequence of events.

Of 22 airliner types surveyed, the Saab 2000 was the only type that had an autopilot which, when engaged, had the following three attributes:

1. Applying an override force to the column will move the elevator but will not cause the autopilot to disengage

2. The autopilot can trim in the opposite direction to the pilot applied control column input

3. Pressing the main pitch trim switches has no effect and will not cause the autopilot to disengage

The Airbus A300 and Fokker 70/100 aircraft previously had such attributes, and suffered one accident (A300) and several incidents (Fokker 70/100) due to pilots overriding the autopilot; these resulted in autopilot redesigns on both aircraft types.

The AAIB released five safety recommendations to the European Aviation Safety Agency (EASA) and Federal Aviation Agency (FAA) recommending to "review the design of the Saab 2000 autopilot system and require modification to ensure that the autopilot does not create a potential hazard when the flight crew applies an override force to the flight controls", review other aircraft types for similiar autopilot designs and redesign those. In addition the AAIB recommended to EASA to ensure that criteria of the aircraft certification specifications can only be met if "if the autopilot automatically disengages when the flight crew applies a significant override force to the flight controls and the auto-trim system does not oppose the flight crew’s inputs."

The AAIB analysed:

The aircraft was struck by lightning that caused only minor damage to the radome and APU exhaust. Functional tests, and inspections of the elevator control system and autopilot system, did not reveal any faults. Evidence from the manufacturer’s simulation work indicated that the aircraft had responded as expected to the recorded control deflections. The reason for the high control forces experienced by the commander was a combination of the additional 25 lbf and 50 lbf required to override the autopilot pitch and roll servos respectively, and the additional aft column deflections required to counter the autopilot’s nose-down pitch trim inputs.

A download of the fault history, confirmed by FDR data, revealed that FCC 2 had caused the autopilot to disengage at 1913 hrs. The autopilot had disengaged because FCC 2 had missed data or received bad data from ADC 2 for a period of at least 99 ms. There were no subsequent in-flight ADC faults to March 2015 so ADC 2 was not removed for further investigation.

No technical faults occurred during the incident other than the brief ADC fault.

With respect to aircraft responses the AAIB analysed:

As the control column was relaxed the aircraft pitched nose-down into a brief descent because the pitch trim was able to overcome the column inputs. Shortly after reaching 4,000 ft amsl the control column was fully aft while the pitch trim was almost fully nose-down. The airspeed also increased and the pitch trim authority became greater than the authority from fully-aft control column causing the aircraft to pitch nose‑down and enter a steep descent which could not be arrested. However, when the autopilot automatically disengaged due to the ADC 2 fault, the nose-down pitch trim stopped and the commander’s subsequent pitch trim switch inputs started to reduce the nose-down pitch trim causing the aircraft to start pitching up.

With respect to the operation of the aircraft the AAIB analysed:

Although both pilots were qualified on type, they did not have extensive experience of the Saab 2000. However, they were not ‘inexperienced’ in the context of the requirements in the operator’s operations manual, and nothing prohibited them flying together.

...

The information that the Sumburgh ATIS antenna had been struck by lightning provided a reminder to the flight crew that lightning might be encountered. The commander expected that a lightning strike would likely cause momentary loss of the engine-driven generators and that this would result in loss of the autopilot.

...

Notwithstanding the additional stress under which the commander was operating, and a possibly elevated level of stress in the case of the co-pilot, the flight crew were behaving normally prior to the lightning strike. Their cognitive functioning appeared to be intact, they were responsive to cues presented to them, and they were communicating and comparing their respective mental models. Thus the behaviour that followed, and in particular their response to the lightning strike itself, also appears consistent with normal human performance.

The lightning strike caused the commander to utter an expletive and cease transmitting to ATC, which accords with the unpleasant and surprising nature of lightning strike events. His next action, to begin making manual inputs on the flying controls, appears to have been instinctive and may have been based on his previous assumption that the autopilot would disconnect when lightning struck. The next events were a consequence of his inputs and their interaction with the aircraft’s systems.

Neither the manual pitch inputs, nor action on the pitch trim switches, caused the autopilot to disengage. The autopilot, sensing that the aircraft was now above the selected altitude of 2,000 ft amsl, began applying nose-down pitch to regain that altitude. Because the autopilot was still engaged, the control forces the commander experienced (opposing his inputs) were higher than usual for a given column displacement, and he identified that the aircraft did not feel normal. He may have attributed this to a flight control malfunction caused by the lightning strike.

Once the discrepancy between the commander’s control inputs and their apparent consequences was identified, the co-pilot’s inputs added a further influence to the feedback which the commander was experiencing through his controls. The co-pilot’s own experience, sensing the control response as inputs were made, would also not have been in line with expectations.

The AP pitch and roll mistrim indications, presented on the PFDs, were not acted upon. The commander was not aware of the meaning of these presentations, and the co-pilot was not certain, retrospectively, whether the familiar ‘P’ and ‘R’ annunciations or other similar captions had been seen.

Pilots who are experiencing difficulty simply in achieving the desired flight path may accord lower priorities to non-handling tasks, at least until the flight path is under control. Their ability to seek and process information, and then analyse it and diagnose the root cause of their difficulty may be impaired. There is uncertainty over the effectiveness of simulator training in altering the fundamental behaviour exhibited by pilots under such stress.

Previous regulatory action, which required modification of other aircraft types to address similarly confusing and stressful conditions, is consistent with this conclusion.

Mistrim indications on the PFDs were accompanied by repeated cautions, including audible chimes and captions on the EICAS, neither of which the commander recalled noticing.

If regulations allow hazards to be mitigated by the provision of alerts, it follows that those alerts must reliably be recognised and acted upon, for the hazard to be contained. Although, in this case, the alerts were presented, the flight crew neither recognised them nor acted upon them. The absence of action demonstrates that alerting the flight crew was not a reliable means of addressing this potentially hazardous situation.

As the trim system progressively applied increasing nose-down elevator, the magnitude of the pilots’ control inputs increased. Higher physical forces were applied against higher contrary forces. This probably further increased the pilots’ stress.

The commander’s instruction to the co-pilot to select the elevator emergency trim switch did not reflect the status of the elevator control system, which had not malfunctioned - the switch is armed when multiple failures have been detected and annunciated, in the absence of which its position has no function.

Throughout this period, the commander made adjustments to the power applied by re-positioning the power levers.

With respect to the Saab 2000 autopilot system the AAIB analysed:

The pilot is expected to press the autopilot disengage button on the control wheel before moving the controls, and the designers of the system probably expected that pilots would almost always do this. If the pilot forgot to disengage the autopilot first or was under the impression that the autopilot was already disengaged, it was probably expected that the additional force on the controls would be a cue to the pilot that the autopilot was still engaged or, failing that, that the ‘P’ and ‘R’ captions and subsequent pitch and roll mistrim captions, with an associated aural caution, would alert the pilot. In this incident none of these cues alerted the flight crew that the autopilot was still engaged. Furthermore, the autopilot engage lever was not within the pilots’ forward field of view. The letters ‘AP’ are presented on the PFD when the autopilot is both engaged and disengaged – only the colour of the letters ‘AP’ changes.

If the autopilot system had been designed to sense pilot-applied control forces and to disengage when it sensed a significant force (approximately 25 lbf according to FAA AC 25.1329-1C), it would have disengaged, about 20 seconds after the lightning strike, when the aircraft was climbing slowly through 2,200 ft, due to the aft column inputs applied by the commander. This would have prevented the subsequent loss of control. Additionally, if the autopilot system had been designed such that operating the pitch trim switches caused the autopilot to disengage, the autopilot would have disengaged early in the incident if, as he reported, the commander had been pressing the pitch trim switches to try to reduce the high control forces he was feeling.
Incident Facts

Date of incident
Dec 15, 2014

Classification
Accident

Airline
Loganair

Flight number
BE-6780

Aircraft Registration
G-LGNO

Aircraft Type
SAAB 2000

ICAO Type Designator
SB20

This article is published under license from Avherald.com. © of text by Avherald.com.
Article source

You can read 2 more free articles without a subscription.

Subscribe now and continue reading without any limits!

Are you a subscriber? Login
Subscribe

Read unlimited articles and receive our daily update briefing. Gain better insights into what is happening in commercial aviation safety.

Send tip

Support AeroInside by sending a small tip amount.

Related articles

Newest articles

Subscribe today

Are you researching aviation incidents? Get access to AeroInside Insights, unlimited read access and receive the daily newsletter.

Pick your plan and subscribe

Partner

Blockaviation logo

A new way to document and demonstrate airworthiness compliance and aircraft value. Find out more.

ELITE Logo

ELITE Simulation Solutions is a leading global provider of Flight Simulation Training Devices, IFR training software as well as flight controls and related services. Find out more.

Blue Altitude Logo

Your regulation partner, specialists in aviation safety and compliance; providing training, auditing, and consultancy services. Find out more.

AeroInside Blog
Popular aircraft
Airbus A320
Boeing 737-800
Boeing 737-800 MAX
Popular airlines
American Airlines
United
Delta
Air Canada
Lufthansa
British Airways