Incident | |
---|---|
Date | 15 December 2014 |
Summary | Lightning strike, subsequent pilot error leading to near dive into ocean |
Site | Sumburgh, Shetland Islands 59°52′56″N001°05′07″W / 59.88222°N 1.08528°W |
Aircraft | |
Aircraft type | Saab 2000 |
Aircraft name | Spirit of Aberdeen |
Operator | Loganair under Flybe banner |
Registration | G-LGNO |
Flight origin | Aberdeen Airport |
Destination | Sumburgh Airport |
Occupants | 33 |
Passengers | 30 |
Crew | 3 |
Fatalities | 0 |
Survivors | 33 |
Loganair Flight 6780 was a scheduled domestic flight from Aberdeen Airport to Sumburgh Airport in the Shetland Islands, Scotland. On 15 December 2014, the Saab 2000 operating the flight was struck by lightning during the approach, and then plunged faster than the aircraft's maximum operating speed. The aircraft came within 1,100 feet (340 m) of the North Sea before the pilots recovered and returned to Aberdeen. All 33 passengers and crew were unharmed. [1]
Recorded data showed that the autopilot remained engaged after the lightning strike, contrary to what the pilots had believed, and the nose-up pitch inputs to the flight controls made by the pilots were countered by the autopilot's pitch trim function, which made nose-down inputs to regain the selected altitude of 2,000 feet (610 m).
In response to the accident, the Air Accidents Investigation Branch (AAIB) issued five safety recommendations regarding changes to the autopilot system.
The aircraft involved, manufactured in 1995, was a Saab 2000 registered as G-LGNO with serial number 2000-013. It was equipped with two Allison AE 2100A turboprop engines. The aircraft had accumulated a total of 26,672 flight hours and 25,357 flight cycles at the time of the accident. [2] : 9 The Saab 2000 is a twin-engine turboprop that can carry up to 53 passengers according to the Type-certificate Data Sheet issued by EASA. [3] It was certified in 1994 and manufactured until 1999 with 63 planes built. The aircraft has a maximum operating speed (VMO) of 270 knots (500 km/h) above 11,000 feet (3,400 m), and 250 knots (460 km/h) below 9,000 feet (2,700 m). The maximum speed reached during flight testing was 318 knots (589 km/h). [2] : 9
Loganair had a franchise agreement with another British regional airline, Flybe until August 2017. [4] Therefore, at the time of the accident the aircraft was operating under a Flybe livery. [2] : 9
The captain was a 42-year-old who had been employed by Loganair since 2005. He had a total of 5,780 flight hours, including 4,640 hours on the Saab 340 and 143 hours on the Saab 2000. The captain originally flew the Saab 340, but had transitioned to the Saab 2000 in August 2014. When the captain flew the Saab 340, he received a training exercise in which a lightning strike caused a generator failure and resulted in the autopilot becoming disengaged. [2] : 7–9
The co-pilot was a 35-year-old who had been employed by Loganair since early 2014. She had a total of 1,054 flight hours, including 260 hours on the Saab 2000. She was qualified to fly Saab 2000 in May 2014. [2] : 7–9
No abnormalities were reported on the aircraft before takeoff. The weather in Aberdeen was good, but the forecast for Sumburgh called for thunderstorms with rain, snow, hail, and winds of up to 60 knots (110 km/h). [2] : 3
The two pilots completed an uneventful rotation from Aberdeen to Sumburgh and back, then prepared for the second rotation with the captain as the pilot in command.
Although the hour-long flight to Sumburgh required 1,826 kilograms of fuel, the pilots opted to fill the tanks in Aberdeen in order to take advantage of lower prices. This resulted in a fuel load of 3,000 kilograms. [2] : 3
Flight 6780 was vectored for an instrument landing system (ILS) approach to Runway 27 at Sumburgh Airport. The aircraft descended to 2,000 feet (610 m) and captured the localizer 9 nautical miles east of the airport. During the approach, the captain decided to go-around because of a heavy thunderstorm displayed on the weather radar. [5] As the aircraft turned south, it was struck by lightning, which entered the airframe at the radome directly in front of the cockpit, and exited at the auxiliary power unit (APU) exhaust in the tail. Ball lightning appeared briefly in the cabin just before the strike. [6] The captain, in the middle of a radio exchange, ceased his transmission and immediately took control of the aircraft, where he began to make pitch-up inputs on the flight controls. During this time, the co-pilot declared a mayday, and the air traffic controller offered all options to the crew for an approach or diversion. [2] : 3–4 [7]
The autopilot, sensing that the aircraft was above the selected altitude of 2,000 ft amsl, began applying nose-down pitch to reach the selected altitude. Because the autopilot was still engaged, the control forces the commander experienced (opposing his inputs) were higher than usual for a given column displacement, and he identified that the aircraft did not feel normal. The co-pilot also applied nose-up inputs, but also perceived that the aircraft was not responding as expected. The primary flight display (PFD) displayed pitch and roll mistrim warnings, which were not acted upon. These were accompanied with audible chimes as well as captions on the EICAS, neither of which the commander recalled noticing. The captain instructed the co-pilot to activate the elevator emergency trim switch, but since the elevator control system had not malfunctioned, the emergency trim function did not activate when the switch was turned on. [2] : 4
Flight 6780 had climbed to around 4,000 feet (1,200 m) when the attitude turned nose-down and the aircraft began to descend. The aircraft began to plunge at a peak descent rate of 9,500 feet (2,900 m) per minute, during which time invalid data from one of the air data computers (ADCs) caused the autopilot to disengage while the pitch trim was almost fully nose-down. The pitch angle reached 19° nose-down and the speed reached 330 knots (610 km/h), 80 knots (150 km/h) above the VMO. During this time, the controller continued to occasionally inform the pilots about their altitude. [2] : 4–5
The pilots maintained the nose-up pitch inputs and the aircraft began pitching up. The ground proximity warning system (EGPWS) generated "SINK RATE" and "PULL UP" alarms near the minimum height reached of 1,100 feet (340 m). [8] The captain applied full power and the aircraft began to climb. [9] Flight 6780 then continued to climb to 24,000 feet (7,300 m) and diverted to Aberdeen Airport, where it landed safely. [2] : 5 [10] [11]
The Air Accidents Investigation Branch (AAIB) opened an investigation into the incident.
A detailed inspection of the aircraft was carried out. Some small soot marks and damage was seen on the surface of the radome, and although there was heat damage inside, there were no holes. The APU exhaust was damaged with sections of molten metal, but no further damage to the aircraft was revealed. Tests and inspections of the elevator and autopilot control systems did not reveal any abnormalities. [2] : 20
Examination of meteorological information revealed that the aircraft had been struck by triggered lightning, a phenomenon in which an aircraft accumulating a negative charge during flight triggers a strike when approaching a positively charged region in a thunderstorm cell. [12] The Met Office’s lightning detection system observed a lightning strike at the aircraft’s recorded position at 19:10:20. [2] : 21–22
Immediately after the lightning strike, the pilots performed nose-up inputs on the flight controls in order to continue the go-around, which along with small increases in engine power caused the aircraft to climb. On the other hand, the autopilot began moving the pitch trim to the nose-down position to maintain the selected altitude of 2,000 feet (610 m), requiring the pilots to pull the control column with a force of 24 pounds (11 kg). For two and a half minutes after the lightning strike, the pilots and autopilot continued to make conflicting inputs. The aircraft continued to climb in stages up to 4,000 feet (1,200 m). [2] : 23
To maintain altitude, the pilots were pulling the control column fully aft with a force of 80 pounds (36 kg). Flight 6780 maintained 4,000 feet (1,200 m) for about 10 seconds, but the nose gradually lowered as the autopilot continued to move the pitch trim to the nose-down position (pitch trim having more elevator authority than the control column at high speeds). [2] : 24
Eventually the pitch trim stopped close to 9° (out of a maximum of 10°) and Flight 6780 began to descend at a rate of 1,500 feet per minute. The aircraft continued to descend and accelerate as the engine output was gradually reduced and moved to flight idle. Six seconds later, the autopilot disengaged as Flight 6780 was passing 3,600 feet (1,100 m) at a descent rate of 4,250 feet (1,300 m) per minute and increasing. [2] : 24 When the autopilot disengaged, it left the aircraft with pitch trim that was almost fully nose-down and that made the control column ineffective. Thus the aircraft continued its descent. [2] The pilots maintained nose-up pitch inputs and applied full power, and the aircraft began to pitch up just as the EGPWS issued a “SINK RATE” alarm. This was followed by a “PULL UP” alarm as the aircraft reached its peak descent rate of 9,500 feet (2,900 m) per minute at 1,600 feet (490 m). [2] : 27 The pilots succeeded in recovering the aircraft 7 seconds before hitting the ground. [13]
The autopilot sensed that the aircraft was climbing above the selected altitude of 2,000 feet (610 m) and began applying nose-down trim to regain that altitude. Even if the captain pulled the control column with excessive forces and operated the pitch trim switch, the autopilot was designed not to disengage. The captain felt that the force required on the control column was higher than usual, due to the autopilot opposing his inputs. He may have mistakenly attributed this to a flight control malfunction caused by the lightning strike. [2] : 43 After that, the autopilot disengaged while the aircraft was at a nose-down attitude of 10°, due to a malfunction of the ADC. If this had not happened, the autopilot would have disengaged when the aircraft reached its nose-down pitch limit of 17°. [2] : 41
Flight data recorder (FDR) analysis revealed that one of the flight control computers (FCCs) did not receive data or received invalid data from the ADC for at least 99 milliseconds. This disengaged the autopilot at 19:13. The ADC was not removed for further investigation because no ADC malfunction was seen after the accident. [2] : 41
In September 2016, the AAIB issued its final report, stating: [2] : 51
The commander’s actions following the lightning strike were to make manual inputs on the flying controls, which appear to have been instinctive and may have been based on his assumption that the autopilot would disconnect when lightning struck. However, the autopilot did not disconnect and was attempting to maintain a target altitude of 2,000 ft AMSL by trimming nose-down while the commander was making nose-up pitch inputs. The control forces felt by the commander were higher than normal because the autopilot was opposing his inputs and he may have attributed this to a flight control malfunction caused by the lightning strike. He did not recall having seen or heard any of the aural or visual mistrim cautions which were a cue that the autopilot was still engaged. This was probably the result of cognitive tunnelling.
In addition, the report stated: [2] : 51
The commander applied and maintained full aft control column (nose-up elevator) input; however, the autopilot’s nose-down elevator trim authority exceeded the commander’s elevator nose-up authority and the aircraft pitched nose-down and descended, reaching a peak descent rate of 9,500 ft/min. The autopilot then disengaged due to an ADC fault and this allowed the commander’s nose-up pitch trim inputs to become effective. The aircraft started to pitch up just before reaching a minimum height of 1,100 ft above sea level.
Out of 22 aircraft types surveyed, only the Saab 2000 had an autopilot with the following three attributes: [2] : 51–52
Previously, the Airbus A300, Fokker 70, and Fokker 100 autopilots had similar characteristics, but, in the wake of multiple accidents and serious incidents, the autopilot was redesigned. [2] : 52 In addition, the Saab 340 had the same characteristics as the Saab 2000 in that the autopilot was not disengaged even if the pilot operated the control column, but it was designed to disengage when the pilot operated the pitch trim. [2] : 33
The AAIB also concluded that the greater authority of the pitch trim than the control column during high-speed flight contributed to the accident. Even when the control column was pulled to the limit, the pilots could not prevent the nose from dropping. The autopilot was designed to automatically disengage when the pitch or bank exceeds a certain angle, but it is not designed to prevent overspeeding, even if the speed exceeds VMO (during the incident, the autopilot continued to trim nose down even though the VMO had been exceeded). [2] : 46
The European Union Aviation Safety Agency (EASA) said in a 2018 report on the startle effect that "this is an interesting case in which the severity of the accident was not defined by the cause of the startle (in this case the lightning strike) but in the sequence of events after this." The EASA further described the accident as follows: [14]
In effect, after the lightning strike, the aircraft was fully functional and a simple autopilot-disengage would have been sufficient for the pilots to manoeuvre the aircraft in any way they would like. However, the effects of the startle, likely coupled with the pre-startle stress, reduced the PIC’s cognitive frame of mind to make immediate manual inputs, ignoring other control modes. Of course the alternative hypothesis is that the PIC (thinking that the autopilot had disengaged due to the lightning strike) may have assumed that his manual control system was impaired, and instigated his tunnelling in that direction. Unfortunately, if the pilots had refrained from an instant manual reaction, it may have been possible that the secondary problem of fighting the autopilot would be prevented altogether, and led to a much safer flight.
The AAIB issued five safety recommendations to the EASA and the Federal Aviation Administration (FAA) to prevent a loss of control due to the autopilot. [1] The safety advisory recommends reviewing the autopilot design of aircraft certified by the rules of Part 25 and equivalent regulations, including the Saab 2000, and require modification if necessary to ensure that pilots do not pose potential danger when applying forces that conflict with the autopilot. [2] : 52–53 [15] [16]
Other safety actions to be taken, as mentioned in AAIB’s report, include publishing Operations Newsletter No.6 by the aircraft manufacturer, which informs Saab 2000 operators of the circumstances of this serious incident, and clarifies the operation of the autopilot; [2] : 54 putting "Notice to Aircrew (NOTAC 123/14)" in place; [2] : 55 and revising the Autopilot Standard Operating Procedures. [2] : 56
The accident is featured in the first episode of Season 21 of Mayday, also known as Air Crash Investigation. The episode is titled "North Sea Nightmare". [17]
The Saab 2000 is a twin-engined high-speed turboprop airliner built by Swedish aircraft manufacturer Saab. It is designed to carry 50–58 passengers and able to cruise at a maximum speed of 685 km/h (370 kn). Production took place in Linköping, Sweden. It first flew in March 1992 and was certified in 1994. The last aircraft was delivered in April 1999, a total of 63 aircraft were built. As of October 2024, a total of 31 Saab 2000s are either in airline or military service.
Loganair is a Scottish regional airline headquartered at Glasgow Airport in Paisley, Renfrewshire, Scotland. The airline primarily operates domestic flights within the United Kingdom. It is the largest regional airline in Scotland by passenger numbers and fleet size.
A yoke, alternatively known as a control wheel or a control column, is a device used for piloting some fixed-wing aircraft.
Trim tabs are small surfaces connected to the trailing edge of a larger control surface on a boat or aircraft, used to control the trim of the controls, i.e. to counteract hydro- or aerodynamic forces and stabilise the boat or aircraft in a particular desired attitude without the need for the operator to constantly apply a control force. This is done by adjusting the angle of the tab relative to the larger surface.
Sumburgh Airport is the main airport serving Shetland in Scotland. It is located on the southern tip of the mainland, in the parish of Dunrossness, 17 NM south of Lerwick. The airport is owned by Highlands and Islands Airports Limited (HIAL) and served by Loganair.
American Eagle Flight 4184, officially operating as Simmons Airlines Flight 4184, was a scheduled domestic passenger flight from Indianapolis, Indiana, to Chicago, Illinois, United States. On October 31, 1994, the ATR 72 performing this route flew into severe icing conditions, lost control and crashed into a field, killing all 68 people on board in the high-speed impact.
Aeroflot Flight 593 was a passenger flight from Sheremetyevo International Airport, Moscow, Russia, to Kai Tak Airport in Hong Kong. On 23 March 1994, the aircraft operating the route, an Airbus A310-304 flown by Aeroflot, crashed into the Kuznetsk Alatau mountain range in Kemerovo Oblast, killing all 63 passengers and 12 crew members on board.
Aircraft upset is an unacceptable condition, in aircraft operations, in which the aircraft flight attitude or airspeed is outside the normally intended limits. This may result in the loss of control (LOC) of the aircraft, and sometimes the total loss of the aircraft itself. Loss of control may be due to excessive altitude for the airplane's weight, turbulent weather, pilot disorientation, or a system failure.
Armavia Flight 967 was a scheduled international passenger flight operated by Armavia from Zvartnots International Airport, Zvartnots in Armenia to Sochi, a Black Sea coastal resort city in Russia. On 3 May 2006, the aircraft operating the route, an Airbus A320-200, crashed into the sea while attempting a go-around following its first approach to Sochi airport; all 113 aboard were killed. The accident was the first major commercial airline crash in 2006. It was Armavia's only fatal accident during the airline's existence.
China Eastern Airlines Flight 583 was a commercial passenger flight from Shanghai, China, to Los Angeles, United States, operated by China Eastern Airlines. On April 6, 1993, the McDonnell Douglas MD-11 operating the flight experienced an in-flight upset due to a flight crew member inadvertently deploying the slats of the aircraft while the plane was cruising near the Aleutian Islands. The accident resulted in the death of two passengers and 156 injuries.
EgyptAir Flight 990 (MSR990) was a scheduled flight from Los Angeles International Airport to Cairo International Airport, with a stop at John F. Kennedy International Airport, New York City. On October 31, 1999, the Boeing 767-300ER operating the route crashed into the Atlantic Ocean about 60 miles (100 km) south of Nantucket Island, Massachusetts, killing all 217 passengers and crew on board, making it the deadliest aviation disaster for EgyptAir, and also the second-deadliest aviation accident involving a Boeing 767 aircraft, behind Lauda Air Flight 004. Since the crash occurred in international waters, it was investigated by the Ministry of Civil Aviation's Egyptian Civil Aviation Agency (ECAA) and the American National Transportation Safety Board (NTSB) under International Civil Aviation Organization rules. As the ECAA lacked the resources of the NTSB, the Egyptian government asked the American government to have the NTSB handle the investigation.
Colgan Air Flight 9446 was a repositioning flight operated by Colgan Air for US Airways Express. On August 26, 2003, the Beechcraft 1900D crashed into water 300 feet (91 m) offshore from Yarmouth, Massachusetts, shortly after taking off from Barnstable Municipal Airport in Hyannis. Both pilots were killed.
A flight control mode or flight control law is a computer software algorithm that transforms the movement of the yoke or joystick, made by an aircraft pilot, into movements of the aircraft control surfaces. The control surface movements depend on which of several modes the flight computer is in. In aircraft in which the flight control system is fly-by-wire, the movements the pilot makes to the yoke or joystick in the cockpit, to control the flight, are converted to electronic signals, which are transmitted to the flight control computers that determine how to move each control surface to provide the aircraft movement the pilot ordered.
Pan Am Flight 115 was a commercial flight from Paris via London to New York City. At 22:05 GMT on February 3, 1959 it was involved in one of the most significant jet upset incidents of the jet airliner age, over the North Atlantic near Newfoundland. This was one of three notable aviation incidents to occur on this date; the other two were the crash of American Airlines Flight 320 in New York City, and the death of rock and roll artists Buddy Holly, Ritchie Valens, and "The Big Bopper" J.P. Richardson.
Air Algérie Flight 5017 was a scheduled international passenger flight from Ouagadougou, Burkina Faso, to Algiers, Algeria, which crashed near Gossi, Mali, on 24 July 2014. The McDonnell Douglas MD-83 twinjet was operated by Swiftair for Air Algérie, disappeared from radar about fifty minutes after take-off. All 110 passengers and 6 crew members on board died.
On 15 March 2005, a Britten-Norman Islander air ambulance, operated by Loganair, crashed off the coast of Scotland, killing both people on board.
Atlas Air Flight 3591 was a scheduled domestic cargo flight under the Amazon Air banner between Miami International Airport and George Bush Intercontinental Airport in Houston. On February 23, 2019, the Boeing 767-375ER(BCF) used for this flight crashed into Trinity Bay during approach into Houston, killing the two crew members and a single passenger on board. The accident occurred near Anahuac, Texas, east of Houston, shortly before 12:45 CST (18:45 UTC). This was the first fatal crash of a Boeing 767 freighter.
Total Linhas Aéreas Flight 5561 was a domestic cargo flight from São Paulo, Brazil to Londrina, Brazil that crashed near Paranapanema 47 minutes after take off on 14 September 2002. The crew of the ATR 42 regional turboprop lost control of the aircraft's pitch and were both killed in the accident.
The Maneuvering Characteristics Augmentation System (MCAS) is a flight stabilizing feature developed by Boeing that became notorious for its role in two fatal accidents of the 737 MAX in 2018 and 2019, which killed all 346 passengers and crew among both flights.
TWA Flight 742 was a multi-leg Trans World Airlines flight from Bangkok to San Francisco. On August 28, 1973, near the end of its penultimate leg from Honolulu to Los Angeles, during the descent over the Pacific Ocean, the Boeing 707 entered severe porpoising oscillations, resulting in injuries to two crew members and three passengers; one critically injured passenger died two days later.