Lightning Strike and Loss of Control: AAIB special report
With the loss of AirAsia flight QZ8501, a lot of attention has been focused on thunderstorms and their effects. I was quoted on the BBC talking about storms shortly after the accident.
But it’s very rare for the weather alone to cause airliners to crash, experts say. Instead, how pilots and crew operate the plane mostly determines whether an incident will end up being a fatal accident, says Sylvia Wrigley, a light aircraft pilot and author of Why Planes Crash.
“I can’t think of an accident where weather was the sole cause of the problem,” she says. “But there can be a situation where the weather puts the aircraft at a higher risk of going wrong.”
The AAIB have just released a special bulletin that shows just badly things can go wrong without the storm being the real danger.
The incident took place in a Saab 200, a twin-engined turboprop with fly-by-wire elevator and rudder control system. The operator was Loganair, a Scottish regional airline which operates scheduled services under a Flybe franchise.
This video shows the aircraft arriving at Glasgow a year ago:
The flight consisted of three crew and thirty passengers. The captain had logged 5,800 flight hours but only 143 hours on type.
On the 15th of December in 2014, the Saab 2000 was flying from Aberdeen to Sumburgh.
Sumburgh Airport serves as the main airport of the Shetlands, situated on Mainland, which rather confusingly is the main island of Shetland. Flybe run scheduled services to Sumburgh Airport from Aberdeen, Edinburgh, Glasgow, Inverness, and Kirkwall (Orkney).
The weather forecasts were bad, predicting thunderstorms with rain, snow, hail and winds gusting up to 60 knots.
As they approached Sumburgh, the first officer checked the Automatic Terminal Information Service (ATIS) and confirmed that Runway 27 was in use, the wind was from 290° at 34 kt, gusting to 47 kt. Visibility was 4,700 metres (three miles) in heavy rain and snow. They accepted vectors for an ILS approach on runway 27.
On the base leg, shortly before final, the air traffic approach controller told them that the visibility had dropped to 3,300 metres (two miles) in moderate rain and snow and that the runway was wet.
The flight crew descended to 2,000 feet nine miles east of the airport. The weather radar on the aircraft showed a “convective cloud cell” as a red patch immediately west of the airport: a thunderstorm.
The captain immediately decided to abort. At that point, the autopilot was engaged with heading select and altitude tracking modes selected. This means that the flight crew can control the aircraft’s direction with the heading while the autopilot maintains the altitude selected.
The captain told the controller that they were discontinuing the approach and turned the aircraft onto a southerly heading.
A luminous sphere of “ball lightning” appeared briefly in the forward cabin. Then, just as the aircraft rolled out on the new southerly heading, lightning struck. The lightning entered the airframe at the radome (a weatherproof blister or enclosure that protects the radar antenna) and exited at the auxiliary power unit exhaust in the tail.
The captain called out that he had control. He pitched the nose up but the aircraft didn’t seem to respond. He pitched up harder and also used the elevator trim to pitch the nose up. The first officer made a MAYDAY call to air traffic control.
The aircraft finally began to climb in response to the captain’s increasingly aggressive inputs on the control column. The first officer also pulled back on the controls and applied pitch trim inputs. The pilots believed they may have lost control of the aircraft. The primary flight displays showed pitch and roll mis-trim indications.
The both thought that the lightning strike might have broken the fly-by-wire elevator controls.
The captain asked the first officer to use the elevator emergency trim switch on the flight deck panel. It had no effect. Their slow climb continued.
Then, as the aircraft reached 4,000 feet, the aircraft pitched nose-down by 19°.
The aircraft began descending at a rate of up to 9,500 feet per minute. The speed increased and soon they were going 80 knots indicated airspeed faster than the maximum operating speed.
Both pilots continued to try to bring the nose up. The Ground Proximity Warning System sounded with SINK RATE, PULL UP warnings. The captain applied full power and pulled back.
At just 1,100 feet above sea level, the aircraft finally began to climb.
The elevator control response still did not feel right to the captain and he asked the first officer to select the pitch control disconnect. This disconnects the two elevator control systems from each other, so that each pilot’s control column remains connected to the elevator on his side.
The first officer queried this request, because he said, the pitch control didn’t appear to be jammed. The captain disconnected the pitch control himself.
The climb continued. The flight crew tested pitch inputs on both control columns which worked perfectly. After those frightening few minutes, they were now clearly in control of the aircraft. They diverted to Aberdeen and landed safely.
So what happened? The flight data recorder showed that the autopilot was engaged throughout the failed climb and the descent.
The pilots were pulling back on the yoke and through sheer force, they managed to pitch the nose up. The autopilot was set to track the altitude and when the control inputs no longer allowed it to maintain the altitude, the autopilot used the pitch trim function to correct their unexpected climb. Thus, the pilots pulling back on the controls was countered by the autopilot making a prolonged nose-down pitch trim input.
The aircraft is fitted with a Rockwell Collins FCC-4003 autopilot system. This system controls the aircraft in pitch by mechanically moving the control column via an electric servo, and by sending pitch trim signals to the digital control system to move the elevator to offload the servo and allow the column to centralise in trimmed flight. When the autopilot is engaged the letters AP are displayed on the primary flight displays and the autopilot engage lever is in the engaged position.
The autopilot can be disengaged in the following ways:
- pressing the disengage button on either control yoke
- moving the autopilot lever on the centre pedestal to disengaged
- moving the standby trim switches on the centre pedestal
- pushing the power lever go-around palm switches
The point the report is making here is that the Saab 2000’s autopilot doesn’t disconnect when control column inputs are made, unlike many other aircraft. Neither does it disengage if the electric trim is adjusted manually, which seems a bit odd.
The captain and the first officer were attempting to fly the aircraft manually but because they never disengaged the autopilot, it continued to try to keep the aircraft at the selected altitude.
When the captain pulled the control column back, he felt a higher resistance than he expected. He was able to force the control column back but the autopilot retaliated by using the trim to pitch the aircraft nose-down and regain the selected altitude. The harder the pilot tried to climb, the greater the autopilot trim inputs were made to counteract him. The captain must have been disoriented because it would seem instinctive to hit the disconnect button for the autopilot when not receiving the expected response. However, he was clearly completely convinced that the autopilot was disengaged: of all the configuration changes he made, pressing the disengage button on his control column was not one of them.
The autopilot finally disengaged as the result of invalid system data during the frightening dive, with the pitch trim set to almost fully nose-down.
The lightning strike had done minor damage to the radome and the Auxiliary Power Unit exhaust. But the elevator control system and the autopilot were not affected and had no faults. The aircraft is now back in service and has not shown any flight control or autopilot problems.
As a response, Saab 2002 published an operator’s newsletter which highlighted the incident and clarified the operation of the autopilot.
Manual control inputs will not cause the autopilot to disengage and the main trim switches are disabled when the autopilot is engaged. Consequently, operation of the main pitch trim switches will not have any effect on aircraft trim nor cause the autopilot to disengage.
In addition, Loganair released a Notice to Aircrew advising them to ensure that the autopilot is disconnected if the flight crew experience control abnormalities. Their type rating training now includes a simulation of the situation.
The special bulletin is online here: AAIB Special Bulletin on Saab 2000, G-LGNO – News stories – GOV.UK. The final report is obviously still in progress although the AAIB have made it clear where their focus will be.
The AAIB investigation has not identified any technical malfunction which might account for the incident. The investigation continues; exploring crew training, autopilot design requirements, the human-machine interface, including the autopilot system and other human factors of relevance to the incident.
It’s easy to say that the pilots should have known better but the AAIB excels at investigating how to stop such errors being made. The additional training to expose pilots to the symptoms is already a step in the right direction. I wouldn’t be surprised if one recommendation in the report will be to have automatic systems work more predictably across a wide range of aircraft. Even if the control inputs didn’t disconnect the autopilot, it sure seems like manual interactions with the trim should have.