Two cargo pilots on a routine cargo flight from Jersey to Guernsey, a twenty-minute flight, ended up in quite a muddle including auto-pilot issues, a go around and elevator control problems before making a safe landing back in Jersey, where they started. The incident took place on the approach to Guernsey on the 26th of January 2016.

The aircraft was a British Aerospace ATP (BAe ATP) built in 1990, registered in the UK as G-BUUR. The ATP is derived from the Hawker Siddeley 748 and designed for short-range, low-noise, fuel-efficient transport. The low-wing turboprop has two Pratt and Whitney PW126 engines mounted above the wings. Only 65 of them were ever produced.

The elevators in the BAe ATP are operated directly from the control columns through a system of cables, rods and levers . These pass under the floor and along the left side of the fuselage where a series of rods and bell cranks connect to the control systems. Normally, the elevators are controlled as a single unit but there is a solenoid-operated elevator release unit, fitted between the two elevators which, if energised, allows the elevators to operate independently.

It is possible for the controls to jam, in which case the pilots need to break the interconnection by applying a differential of 100 pounds between the control columns. The pilots can also physically separate the control columns by pulling a force relief handle in the cockpit.

The autopilot drives the elevator through a servomotor containing a gearbox. Each autopilot has an independent motor with which to drive the gearbox. The autopilot control of the elevators can be overpowered if the force applied at the control column exceeds 50 pounds.

The Elevator Standby Control System (SCS) operates independently of the autopilot and continuously monitors the position of the flying control. If a control cable breaks, the direct connection between the control columns and the elevators is lost. If the Elevator Standby Control System senses that the position of the right control column and the right elevator control surface do not match (exceeds 25%) then the system drives the elevators electrically. Both pilots retain control of the elevators via their control columns.

If there is a jam in the elevator system, the pilots will find that the control columns become resistant to movement. By exerting over 100 pounds, the control column on the side that isn’t jammed will “break out”, which then energises the elevator release unit, separating the elevators. In this case, an amber caption illuminates on the control panel along with an audible warning. The SPLIT caption illuminates on the standby controls panel on the overhead panel on the flight deck.

This is all for redundancy in order to maintain elevator control in the event of a mechanical failure affecting the connection between the control columns and the elevators.

The captain of the flight had significant experience as a light aircraft instructor and 1,300 hours as an ATP co-pilot when he began his command training, a little over a year before the flight. Since the completion of his training, he had 207 hours on type. His simulator instructor reported that he demonstrated good Crew Resource Management (CRM) although in his training it was reported that he had been overly reliant on the Pilot Not Flying (Pilot Monitoring) when under pressure.

The first officer had completed the BAe ATP training course, which was his first commercial aircraft type, the month before. He had 380 hours of flying experience, with 74 hours on type. His records showed that he’d demonstrated good piloting and had been complimented on his crosswind landing technique.

The weather forecast wasn’t great: strong southerly wind across the two islands, with a possibility of severe turbulence and windshear. However, the first officer had experienced similar weather during his training and was happy to take on the role of Pilot Flying for the short flight with the captain as Pilot Monitoring.

Before they departed, the first officer briefed the captain about the expected approach to Guernsey’s runway 27. His briefing included the route required for a missed approach but he did not discuss the actions required of each pilot if they should have to go around.

They departed Jersey and engaged the autopilot as they climbed through 1,000 feet. At 2,000 feet, they levelled out for the short hop to the other island. The weather was better than predicted and Guernsey’s runway 27 quickly came into view. The reported wind was 200° at 20 knots, within the operator’s advisory limits for a crosswind landing. Once established on the ILS, they descended to 1,000 feet. The approach speed was 113 knots and the crew agreed to add a five knot buffer, approaching at 118 knots to help counteract the gusty conditions and possible windshear.

As the aircraft descended through 470 feet above the aerodrome level, the flight crew selected 20° flap. The pitch of the aircraft varied but on average it was nose-down by 3°. The airspeed was generally steady at around 115 knots. The engine torques were at 34%. The captain, as Pilot Monitoring, called out that the approach was stable with the gear extended and flaps set to 20°.

The first officer decided he would disengage the autopilot just above the decision height of 200 feet above the runway. The flight data shows that the airspeed changed just above decision altitude followed by an adjustment of power. As the aircraft descended through 335 feet, engine number one reduced to 22% and engine number two to 20%. The airspeed reduced to 111 knots. Additional power was applied but slightly asymmetric: Number one received power faster, settling at 50% and number two settled at 40%. The airspeed increased to 119 knots. This was likely the first officer responding to the windy weather and shows that there was a significant workload in the final stage of the approach. Up to this point, the left and right elevators moved in unison and the pitch trim was controlled by the autopilot.

The first officer had the runway in sight at 220 feet above Guernsey’s elevation when he pressed the switch to disengage. However, he didn’t hear the alert which signalled that the autopilot was disengaged. At that moment, the captain recommended that the first officer disengage the autopilot.

The BAe ATP has two independent autopilots. An autopilot controller is on the console between the two pilots, which allows both pilots to access the autopilot selection (system 1 or system 2) and the autopilot functions.

To engage the autopilot, the pilot presses the AP switch for about a second. If there are no errors, then a cyan AP display will appear above the switch to show that it is engaged. Both Pilot Flight Displays have a display which shows which autopilot is engaged, AP1 or AP2. The display shows as green for the side that it is considered connected to. If AP1 is selected, then the display AP1 will appear in green for the captain’s side and in white for the first officer’s side. If AP2 is engaged, then it appears in white on the captain’s side and in green on the first officer’s side. Further, the navigation modes selected are displayed.

The autopilot can be disengaged by pressing the red button (the autopilot disengage switch) on either pilot’s control wheel. When the autopilot is disengaged the cyan AP display disappears and the light (green or white) on the Pilot Flight Display are extinguished. This is accompanied by an triple audio sound (called “cavalry charge” for reasons I have not been able to discern) to alert the crew to the fact that the auto-pilot has been disengaged.

If the autopilot does not disengage when the switch is pressed, then the pilot can overpower it by applying a force in excess of 50 lbs. The autopilot will continue to try to control the aircraft but the pilot’s inputs will overcome the slipping clutch.

If the pilot flying is in the left seat, the situation will continue until the autopilot is successfully disengaged. If the Pilot Flying is in the right seat, as was the case in this flight, the pilot needs to apply a force in excess of 100 pounds, which will overcome the control column detent and thus operate the elevator release unit.

An amber STANDBY CONTROLS caption will illuminate on the CWP and the SPLIT caption will illuminate on the standby controls panel. The right elevator will remain under autopilot control until the autopilot is disengaged.

The first officer pressed the autopilot disengage switch again, and then a third time. He attempted to move the control column but it felt extremely stiff, as if the autopilot were still engaged. The captain saw the first officer frantically pressing the disengage button and asked what was happening.

“It won’t disconnect,” said the first officer. The captain pressed the autopilot disengage switch on his column. At the same time, he hit the pitch trim switch, which should also disengage the autopilot. Still, no alert sounded.

He could not remember if he’d checked his Primary Flight Display to see if the AP light was still illuminated.

He asked the first officer if he had control and the first officer responded that he was not sure. He attempted to move the control column again. It felt very stiff, still as if the autopilot were engaged.

The airspeed slowly decayed to around 112 knots and the pitch attitude increased to about 2° nose-up. The aircraft started to deviate to above the glideslope. The first officer tried to pitch the nose down while reducing power. The airspeed decayed to 102 knots. The aircraft pitched nose-down by 2° then, as the engine torques reduced to 15%, the aircraft pitched down further to 5.7° before settling at 5° nose-down. The airspeed recovered back up to 119 knots. The flight data recorder also showed that activity on the elevators had increased since 220 feet, where, according to the data, the autopilot had switched off.

The captain came to the decision that the approach was unstable and they were too close to the runway to recover. He instructed the first officer to go around. He said later that by the time he had appreciated the difficulty his first officer was having trying to disengage autopilot, he didn’t think that it was appropriate to take control, as they were close to the ground in a strong cross-wind. His decision was to go around and then re-assess the control problem.

In response to the captain’s instruction, the first officer advanced the power levers and pressed the go-around button on the right power lever, using his left hand. One of the effects of pressing this button is to disengage the autopilot. The first officer saw no change and there was no audible alert. He pressed the go-around button again. Again, no response and he believed that the flight director had not commanded a pitch-up as they should have done. However, his right hand had been applying rearwards force on the control column and the aircraft began to pitch nose-up. The controls still felt stiff but he said later that he didn’t have to use excessive force; certainly he was able to initiate the pitch up with one hand. He called for go-around power, for the flaps to be set to 15 and for the autopilot and flight director to be set to HDG and PSA modes, respectively.

The captain concentrating on setting the power and the flaps for the go around. At an altitude “approximately equivalent ot the elevation of Guernsey’s runway” the flight data recorder registered a rapid increase of torque from 4% to 95% in engine 1 and to 90% for engine 2.

He couldn’t recall setting the flight director or checking the flight director bars on the his Pilot Flight Display. It’s possible that so close to the ground and with a high workload, the flight director bars did move and the first officer did not register the change.

As the power increased, the first officer felt that the aircraft was pitching up too steeply and that the speed was decelerating. He responded with “an unusually large amount of forward force” on the control column.

The captain also noticed the aircraft pitching up, possibly as much as 15-20°; however he did not see this on the instruments. He assisted the first officer by pressing forward on his control column using the palms of his hands.

According to the flight data recorder, once the pitch-up was initiated, the power increased quickly and the pitch attitude increased a little over 5° nose up, close to what the flight director would have (possibly did) command. A nose-up attitude of 15° can be normal during a go-around in an ATP with both engines operating. However, that’s substantially greater than a go-around with one engine out, which is what both crew had practised in the simulator. It is also possible that both pilots felt that the aircraft was pitching up to extreme levels was part of a somatogravic illusion as the aircraft accelerated.

At any rate, both pilots pushed on the control column.

At 420 feet above sea level, the recorder registered a nose-down demand on both elevators at the same time as a nose-up deflection in pitch trim. The Central Warning Panel sounded with a caution and the STANDBY CONTROLS annunciator lit up.

At 475 feet above the sea, the flaps were retracted to 15° with an airspeed between 125 and 130 knots and the aircraft in a 12.6° nose up attitude. Both autopilots briefly showed as engaged. Twenty-four seconds later, the aircraft reached 1,620 feet above sea level with a pitch attitude between 8° and 12° nose-up and an airspeed averaging 118 knots.

During discussions after the event, neither pilot thought they had been trying to move the elevator in opposing directions when the control split occurred. The Pilot Flying’s recollection was that the STANDBY CONTROLS caution illuminated at approximately 600 feet above mean sea level.

They both agreed that they had been distracted from following the standard go-around procedure and that the gear had been raised later than normal. Both pilots were unsure of when exactly the gear had been raised as their focus had been on achieving a safe flight path. The first officer was sure that he made no pitch trim inputs during the initial part of the go-around. Neither pilot had any recollection of trying to change the autopilot status while the aircraft was climbing.

It’s standard operating procedure for go-arounds in the ATP to be flown with the autopilot disengaged. The operator’s fleet manager stated that the aircraft does not tend to pitch nose-up during go arounds.

At around 2,000 feet, travelling at an an airspeed of 120 knots, the pitch attitude was reduced to 4° nose-up and the engines reduced to 70% torque. The engine power reduced (48% on engine number 1 and 40% on engine number 2) and the aircraft descended to about 1,870 feet above sea level with a pitch of 2.5° nose-down. The pitch then increased to 7° nose-up with a power increase to 60% torque as the aircraft climbed back up to 2,040 feet.

The flight crew finished retracting the flaps and levelled out. The elevator SPLIT indicator on the overhead console was illuminated. Both agreed that the autopilot was not engaged at this point and so they re-engaged the autopilot. During this period of time, significant elevator activity was recorded until AP2 was re-engaged.

The flight crew did not discuss the warning messages but they did check the Quick Reference Handbook for the procedure in the case of a STANDBY CONTROLS warning. The autopilot in use on the approach had been AP2 so, following the checklist, they engaged AP1 and when that appeared to be working correctly, they re-engaged AP2 (which would dis-engage AP1). Then they disengaged AP2 and re-engaged it. Both agreed that the autopilot was now disengaging and re-engaging properly with a clear audio alert every time they disengaged it.

They agreed that they would not attempt another cross-wind landing at Guernsey but instead return using the longer runway at Jersey, which meant that they could submit the aircraft directly for maintenance. The captain took over as Pilot Flying with the first officer as Pilot Monitoring. As Pilot Flying, the captain switched the autopilot from AP2 to AP1.

On the approach to Guernsey, the captain disengaged the autopilot early. It disengaged normally. At 600 feet, the Enhanced Ground Proximity Warning System sounded a TERRAIN alert. The crew disregarded it, as they were visual with the runway and the approach, this time, was stable. The captain said later that terrain warnings were not uncommon at Jersey and Guernsey.

After landing, they noticed that the elevator ENGAGED light was lit on the overhead panel. Neither was sure whether it had been lit during the flight. The amber ENGAGED caption illuminates when the Elevator Standby Control System has engaged in order to deal with a control cable which has severed or jammed in the control system.

The captain told the engineering staff about the flight and made an entry in the technical log to say that the autopilot failed to disconnect on approach, and then the elevators split and the standby controls engaged during the go around.

The following day, he wrote an incident report for his employer and that evening the AAIB was notified. By then, the Cockpit Voice Recorder had been overwritten by maintenance activity; the recording consisted of on-the-ground troubleshooting but it confirmed that the aural autopilot disengagement alert sounded as expected.

The Flight Data Recorder had 25 hours of data which was successfully downloaded. The recorded flight data showed that the autopilot had disengaged at 220 feet during the approach to Guernsey. No technical defects were found with the aircraft. With no reference to the CVR, it was impossible to know whether the alert that the autopilot is disengaged actually sounded or not.

The AAIB’s preliminary report noted that “Some human factors were identified which may have contributed to the incident” and recommended pilot training.

Three weeks after the incident, the operator’s fleet manager joined the first officer in the ATP training simulator for go-around manoeuvres. The simulator was configured for landing with the autopilot engaged. When the first officer attempted to move the control column, he said the feedback forces were similar to what he had noticed on that approach before the go-around. He then initiated a go-around on command but he did not press the go-around button, which would have disengaged the autopilot. Instead, he pulled back on the control column to overcome the autopilot. He needed both hands on the control column to pitch the nose up and the STANDBY CONTROLS caution and the elevator split indicator on the overhead panel illuminated before the aircraft began to climb.

The BAe ATP did not show any faults in the weeks after the incident. The autopilot disengaged whenever it was asked to disengaged, accompanied by an audible alert. The elevator flying control system did not show any signs of damage. Multiple components related to the autopilot and the Elevator Standby Control System were removed and tested but no flights were found.

In the time between the incident and the release of the final report, the aircraft flew an additional 79 hours (110 cycles) with no recurrence of the issues.

From the conclusion of the report:

During the resultant go-around, the co-pilot recalled having to overcome a strong pitch-up force after power was set, which he then struggled to overcome. The data indicated the aircraft was trimmed nose-up after power was set, so this may have been the cause of the pitch-up force and the co-pilot’s opposition to this force may have led to the elevator control split. It is also possible the pilots briefly made opposing inputs on the control column and this caused the elevator split and activation of the SCS.

However, it was not possible to exclude the possibility that there was an intermittent fault within the autopilot system that then caused the system to oppose the co-pilot’s inputs and lead to the control split. The recorded data shows two brief recordings of autopilot engagement during the event which the investigation could not explain.

Once the elevators had split the pilots completed the go-around but deviated from SOPs while struggling with a stressful and disorientating situation. They re-engaged the autopilot without discussing any potential threats from this action and they did not use CRM principles designed to help deal with problem solving and decision making. The operator has since reviewed and updated its training of crews as a result of the findings from this incident.

All pilots at the operator were given further training and pilot training procedures were updated. The pilots and the engineers were given guidance on deactivation of the flight recorder and CVRs. The level of acceptable cross-wind component for newly qualified pilots was reduced. And finally, a new requirement was added to check autopilot disengagement switches before every flight.