The Weekly Reflektion 19/2021

Sometimes when things fail, we just get lucky. While it is a relief when the situation is saved by lady luck, it’s not something we want to rely on.

Do your automatic systems behave as your people expect them to behave?

Loganair flight BE-6780, a SAAB 2000 turboprop, was preparing to land at Sumburgh Airport in the Shetlands on 15thDecember 2015. The aircraft was a scheduled flight from Aberdeen. When the captain started the approach, the aircraft was hit by lightning. The captain reported that he had lost elevator control on the plane and that due to the worsening weather conditions he was returning to Aberdeen. 

The captain made nose up pitch inputs to regain height for the flight to Aberdeen but experienced that the aircraft was not responding as expected. When the aircraft had reached 4000 feet the aircraft pitched down reaching 19 degrees nose down, the vertical rate reached 9500 feet per minute descent. The captain and the first officer fought against the control system by pulling back on the control column. The first officer cried out for more power and just then the plane started to climb again. The aircraft had fallen to 1100 feet and was seconds from disaster.

Before the lightning strike the aircraft was on autopilot and set to 2000 ft. When the lightning struck the captain assumed that the autopilot had disconnected and that he had control. The display of the autopilot status was not clear on the control panel and the captain did not notice that the display was indicating autopilot on. Recorded data showed that the autopilot had remained engaged, and the pilots’ nose-up pitch inputs were countered by the autopilot pitch trim function, which made a prolonged nose-down pitch trim input tomaintain its altitude at the pre-set value of 2000 feet. The aircraft dived below 2000 ft although the autopilot was still set at 2000 because the pilot had the elevator in a full pitch up condition while the autopilot had the elevator trim in full pitch down to counteract the captains input causing the plane to enter an uncontrolled dive. The autopilot was not configured to respond to the resulting situation. 

The captain’s training on coping with lightning strikes was based on manual control of the aircraft and he had not experienced a situation where the autopilot had remained engaged. The SAAB 2000 is one of the few aircraft that does not automatically disengage the autopilot when the pilot pulls severely on the control column or operates the trim switches. The captain and first officer were unaware of this. There was an audible alarm that sounded to indicate the autopilot was still engaged but the crew did not perceive the connection between alarm and the autopilot status.

People have expectations to the way that automatic systems will behave and sometimes these expectations are not considered in the system design. Do you involve the users and in particular the operators, in the design of systems with automatic control?

And what about lady luck then? Well, a few seconds before disaster the autopilot developed a fault, possibly related to the lightning strike, and disconnected itself. That is how the crew regained control and pulled out of the dive. ‘There but for the grace of god go I.’