Lightning Strike and Loss of Control: AAIB special report
With the loss of AirAsia flight QZ8501, a lot of attention has been focused on thunderstorms and their effects. I was quoted on the BBC talking about storms shortly after the accident.
BBC News – AirAsia QZ8501: Does bad weather cause plane crashes?
But it’s very rare for the weather alone to cause airliners to crash, experts say. Instead, how pilots and crew operate the plane mostly determines whether an incident will end up being a fatal accident, says Sylvia Wrigley, a light aircraft pilot and author of Why Planes Crash.
“I can’t think of an accident where weather was the sole cause of the problem,” she says. “But there can be a situation where the weather puts the aircraft at a higher risk of going wrong.”
The AAIB have just released a special bulletin that shows just badly things can go wrong without the storm being the real danger.
The incident took place in a Saab 200, a twin-engined turboprop with fly-by-wire elevator and rudder control system. The operator was Loganair, a Scottish regional airline which operates scheduled services under a Flybe franchise.
This video shows the aircraft arriving at Glasgow a year ago:
The flight consisted of three crew and thirty passengers. The captain had logged 5,800 flight hours but only 143 hours on type.
On the 15th of December in 2014, the Saab 2000 was flying from Aberdeen to Sumburgh.
Sumburgh Airport serves as the main airport of the Shetlands, situated on Mainland, which rather confusingly is the main island of Shetland. Flybe run scheduled services to Sumburgh Airport from Aberdeen, Edinburgh, Glasgow, Inverness, and Kirkwall (Orkney).
The weather forecasts were bad, predicting thunderstorms with rain, snow, hail and winds gusting up to 60 knots.
As they approached Sumburgh, the first officer checked the Automatic Terminal Information Service (ATIS) and confirmed that Runway 27 was in use, the wind was from 290° at 34 kt, gusting to 47 kt. Visibility was 4,700 metres (three miles) in heavy rain and snow. They accepted vectors for an ILS approach on runway 27.
On the base leg, shortly before final, the air traffic approach controller told them that the visibility had dropped to 3,300 metres (two miles) in moderate rain and snow and that the runway was wet.
The flight crew descended to 2,000 feet nine miles east of the airport. The weather radar on the aircraft showed a “convective cloud cell” as a red patch immediately west of the airport: a thunderstorm.
The captain immediately decided to abort. At that point, the autopilot was engaged with heading select and altitude tracking modes selected. This means that the flight crew can control the aircraft’s direction with the heading while the autopilot maintains the altitude selected.
The captain told the controller that they were discontinuing the approach and turned the aircraft onto a southerly heading.
A luminous sphere of “ball lightning” appeared briefly in the forward cabin. Then, just as the aircraft rolled out on the new southerly heading, lightning struck. The lightning entered the airframe at the radome (a weatherproof blister or enclosure that protects the radar antenna) and exited at the auxiliary power unit exhaust in the tail.
The captain called out that he had control. He pitched the nose up but the aircraft didn’t seem to respond. He pitched up harder and also used the elevator trim to pitch the nose up. The first officer made a MAYDAY call to air traffic control.
The aircraft finally began to climb in response to the captain’s increasingly aggressive inputs on the control column. The first officer also pulled back on the controls and applied pitch trim inputs. The pilots believed they may have lost control of the aircraft. The primary flight displays showed pitch and roll mis-trim indications.
The both thought that the lightning strike might have broken the fly-by-wire elevator controls.
The captain asked the first officer to use the elevator emergency trim switch on the flight deck panel. It had no effect. Their slow climb continued.
Then, as the aircraft reached 4,000 feet, the aircraft pitched nose-down by 19°.
The aircraft began descending at a rate of up to 9,500 feet per minute. The speed increased and soon they were going 80 knots indicated airspeed faster than the maximum operating speed.
Both pilots continued to try to bring the nose up. The Ground Proximity Warning System sounded with SINK RATE, PULL UP warnings. The captain applied full power and pulled back.
At just 1,100 feet above sea level, the aircraft finally began to climb.
The elevator control response still did not feel right to the captain and he asked the first officer to select the pitch control disconnect. This disconnects the two elevator control systems from each other, so that each pilot’s control column remains connected to the elevator on his side.
The first officer queried this request, because he said, the pitch control didn’t appear to be jammed. The captain disconnected the pitch control himself.
The climb continued. The flight crew tested pitch inputs on both control columns which worked perfectly. After those frightening few minutes, they were now clearly in control of the aircraft. They diverted to Aberdeen and landed safely.
So what happened? The flight data recorder showed that the autopilot was engaged throughout the failed climb and the descent.
The pilots were pulling back on the yoke and through sheer force, they managed to pitch the nose up. The autopilot was set to track the altitude and when the control inputs no longer allowed it to maintain the altitude, the autopilot used the pitch trim function to correct their unexpected climb. Thus, the pilots pulling back on the controls was countered by the autopilot making a prolonged nose-down pitch trim input.
The aircraft is fitted with a Rockwell Collins FCC-4003 autopilot system. This system controls the aircraft in pitch by mechanically moving the control column via an electric servo, and by sending pitch trim signals to the digital control system to move the elevator to offload the servo and allow the column to centralise in trimmed flight. When the autopilot is engaged the letters AP are displayed on the primary flight displays and the autopilot engage lever is in the engaged position.
The autopilot can be disengaged in the following ways:
- pressing the disengage button on either control yoke
- moving the autopilot lever on the centre pedestal to disengaged
- moving the standby trim switches on the centre pedestal
- pushing the power lever go-around palm switches
The point the report is making here is that the Saab 2000’s autopilot doesn’t disconnect when control column inputs are made, unlike many other aircraft. Neither does it disengage if the electric trim is adjusted manually, which seems a bit odd.
The captain and the first officer were attempting to fly the aircraft manually but because they never disengaged the autopilot, it continued to try to keep the aircraft at the selected altitude.
When the captain pulled the control column back, he felt a higher resistance than he expected. He was able to force the control column back but the autopilot retaliated by using the trim to pitch the aircraft nose-down and regain the selected altitude. The harder the pilot tried to climb, the greater the autopilot trim inputs were made to counteract him. The captain must have been disoriented because it would seem instinctive to hit the disconnect button for the autopilot when not receiving the expected response. However, he was clearly completely convinced that the autopilot was disengaged: of all the configuration changes he made, pressing the disengage button on his control column was not one of them.
The autopilot finally disengaged as the result of invalid system data during the frightening dive, with the pitch trim set to almost fully nose-down.
The lightning strike had done minor damage to the radome and the Auxiliary Power Unit exhaust. But the elevator control system and the autopilot were not affected and had no faults. The aircraft is now back in service and has not shown any flight control or autopilot problems.
As a response, Saab 2002 published an operator’s newsletter which highlighted the incident and clarified the operation of the autopilot.
Manual control inputs will not cause the autopilot to disengage and the main trim switches are disabled when the autopilot is engaged. Consequently, operation of the main pitch trim switches will not have any effect on aircraft trim nor cause the autopilot to disengage.
In addition, Loganair released a Notice to Aircrew advising them to ensure that the autopilot is disconnected if the flight crew experience control abnormalities. Their type rating training now includes a simulation of the situation.
The special bulletin is online here: AAIB Special Bulletin on Saab 2000, G-LGNO – News stories – GOV.UK. The final report is obviously still in progress although the AAIB have made it clear where their focus will be.
Further investigation
The AAIB investigation has not identified any technical malfunction which might account for the incident. The investigation continues; exploring crew training, autopilot design requirements, the human-machine interface, including the autopilot system and other human factors of relevance to the incident.
It’s easy to say that the pilots should have known better but the AAIB excels at investigating how to stop such errors being made. The additional training to expose pilots to the symptoms is already a step in the right direction. I wouldn’t be surprised if one recommendation in the report will be to have automatic systems work more predictably across a wide range of aircraft. Even if the control inputs didn’t disconnect the autopilot, it sure seems like manual interactions with the trim should have.
A very interesting article. Fortunately, I use the word “interesting” because it had a happy ending.
Sylvia, your comment at the beginning of the article: “I can’t think of an accident where weather was the sole cause of the problem” is a bit akin to kicking in an already open door. The 1970’s NLM F28 crash was caused because the aircraft flew through an embedded tornado. Twisters are very rare in the Netherlands. This aircraft had the misfortune to fly right through one and it broke up in mid-air.
Of course, weather was the cause but in any accident there is always the added factor of a crew who decided to get airborne.
When I read your article – and as always well researched, my earlier remark was a bit tongue-in-cheek – a few things strike me:
The captain was experienced but obviously had only recently been transferred to the SAAB 2000.
I have not flown this model, but it was (is) a high performance turbo-prop. At the time Crossair (renamed Swiss) called it “Concordino”. It may well be that the captain had moved up from, e.g. the Shorts 3-60. I am only speculating here, but I know of more pilots who made similar moves – including myself at the time from Cessna 310 to SN601 Corvette – and the transition does require a lot of mental adaptation.
Most autopilot systems that I am familiar with would disconnect if the crew exceeded a certain force on the controls.
It would seem that the captain was fully aware of the weather situation. First of all: the main wind direction was already 20 degrees off the runway centreline. In gusts this could have been another 40 as gusts tend to veer from the mean wind direction. 34 kts is a strong wind. Gusts up to 47 kts might well have compromised the maximum crosswind component. Adding to this there was an active thunderstorm in the immediate vicinity of the airport. The possibility of precipitation including snow would have complicated the situation further. The captain made the correct decision: divert.
The aircraft turned south, away from the cell which showed on the radar west of the airport.
Now you mention a ball lightning inside the aircraft.
Experts still are not entirely certain what a ball lightning is. But it most certainly would have attracted the attention of everyone on board and would have broken the concentration of the flight crew. As if that was not enough, the aircraft was struck by lightning.
Sylvia, you describe an autopilot system that appears to have differences from those installed in many other aircraft. This could have had significant implications in a situation of a captain new to the aircraft and in a suddenly high-stress situation.
It is not in itself unusual for the autopilot to remain engaged during a diversion. In fact, often the autopilot would be coupled to the nav-mode as soon as the crew had selected the correct procedure on the FMS. But in this case the captain had selected an altitude and heading mode. That should have been enough to bring the aircraft in an area away from the thunderstorm. And in a situation where the crew could assess and decide on further action. But then, under the stress of the situation, the captain decided to take manual control without disconnecting the autopilot. Which very nearly caused a fatal accident.
But even when the crew did use the emergency trim, the autopilot remained engaged.
Also: from what I read here, the autopilot counteracted the crew’s manual attempts to control the aircraft – which must at all times be possible, it is a certification requirement that human force (I forgot the exact specified amount of force) must be able to override the A/P.
The crew inputs and actions did not disconnect the autopilot. I do not quite understand why the system did not return and try to level off at the selected altitude. This seems to me, without knowledge of the particular system, to be a bit of a design flaw.
Where I must commend the crew is that even in a situation of increasing stress and confusion they kept working to figure out what the problem was.
SAD SAD SAD.
On the news we heard that a German A320 has crashed with the loss of all on board.
According to the reports it seems that the crew did have time to declare an emergency. It would seem that the aircraft suffered a loss of pressurization.
That in itself is not the cause of a crash. Any well-trained crew will be able to handle it. It has happened twice to me, once at FL 370 the second time at FL 390 (39.000 feet !).
For us, the pilots, it was a non-event. Not so for the passengers who were clutching their masks whilst the aircraft descended at about 8000 fpm to a safe altitude and the cabin filled with fog.
So what happened ? My early guess (totally unsupported by evidence) is that the aircraft suffered some form of structural damage. Was there a bomb on board? Or did an aerosol can in a passenger’s luggage explode ? Even that should not have led to catastrophic damage.
Sylvia,
You will soon no doubt post a better informed entry.
I am still in a state of shocked disbelieve about the German Wings crash.
Journalists give their often misinformed reaction.
Fortunately there were also some real experts on the news.
As a pilot, judging from my own first-hand experience, I can nearly discount decompression as the (only) cause of the accident. Any reasonably competent crew can easily deal with it. The big, red master caution is difficult to ignore. And I rate Lufthansa / German Wing pilots as very well trained.
Sensor (pitot and/or static port) icing ? Unlikely. On a short-haul flight the captain will be in his or her seat, not in a bunk trying to catch up with missed sleep. An experienced pilot will know to recover if the ASI goes haywire and the aircraft suddenly starts an uncommanded dive.
A total, catastrophic failure of the fly-by-wire system? I have not flown the A320 but my guess is that there will be a lot of redundancy to prevent it from becoming totally uncontrollable.
The rate of descent, although high, was not in fact abnormally high. According to the news, it was in the order of 4000 fpm. When I had my loss of pressure and did an emergency descent, we were doing over 6000 fpm.
And why did the aircraft not level off once below 11.000 feet ? It seems to have continued more or less in a straight line in a steady descent until it hit the mountains. I have crossed that area many times in Cessna 310 and it is not overly high. Low enough to fly safely at an altitude where the air is breathable.
A mid-air break-up? The news showed a crash site, the bits and pieces scattered over a few acres. More or less together as compatible with the impact suggesting that the entire aircraft hit at high speed.
Had there been a mid-air collision ? A missile gone off-course ? Unlikely.
A lot of waffle about the age of the aircraft. The essential parts and components will have been tested, overhauled and replaced during the lifetime of the aircraft. The early Comets suffered from metal fatigue. This is now well-known and understood. A hull is constantly tested to maximum differential pressure (in a tank with water !) 24/7,365/12. The Aloha B 737 fell outside the parameters of structural testing because it had been exposed to very short-haul sectors in a corrosive environment. And, don’t forget: That one survived with only, regrettably, the loss of one life.
No there is no short and easy answer yet but the CVR and FDR will hopefully give the answer soon.
Sylvia
Your thoughts on the German Wings disaster, certainly based on facts, is eagerly awaited.
I was right on all counts although I could not imagine any airline pilot committing deliberate suicide by flying his aircraft into terrain. “CFIT” as a means of a deliberate act to take one’s own life, and 150 innocent ones with it, is something we associate with deranged fanatics, not with a professional pilot working for a major European airline.
As this crash shows, a new procedure aimed at preventing terrorists to gain control of an aircraft has the potential of being the cause of a disaster.
Two people in the cockpit? It does increase the time that a cockpit door will be open and with it vulnerability to a hijack.
This crash was caused by the co-pilot. Who can guarantee that the person who takes the jumpseat during a toilet break of one of the pilots is not waiting for his or her chance? The cockpit door will be locked. Most aircraft that I flew had an axe in the cockpit, intended to clear an escape route in case of an accident. If the “watchdog” is suicidal, who is to say that this is not the very person to grab the axe, attack the cockpit crew member still in his or her seat, disconnect the autopilot and force the aircraft into a steep dive?
Perhaps the only solution will be an emergency potty in the cockpit with a screen for some privacy?
Some experts now believe that there is a distinct possibility that the disappearance of flight MH370 was also due to suicide of one of the pilots.
Rudy,
Guess who thought she could go out of town for a week without mentioning it! Not great timing, I admit. I’ll make up for it with tomorrow’s post.