Aircraft

The aircraft involved was a Saab 2000, registered G-LGNO, which made its maiden flight in March 1995.^[2] Equipped with two Rolls-Royce AE 2100A turboprop engines, it had a total of 26,672 flight hours and 25,357 flight cycles at the time of the accident. The Saab 2000 is a twin-engine turboprop that can carry up to 53 passengers. It was certified in 1994 and manufactured until 1999 with 63 planes built. The aircraft has a maximum operating speed (V_MO) of 270 knots (500 km/h) above 11,000 feet (3,400 m), and 250 knots (460 km/h) below 9,000 feet (2,700 m). The maximum speed reached during flight testing was 318 knots (589 km/h).^[3]: 9

Loganair had a franchise agreement with another British regional airline, Flybe until August 2017.^[4] Therefore, at the time of the accident the aircraft was operating under a Flybe livery.^[3]: 9

Crew

The captain was a 42-year-old who had been employed by Loganair since 2005. He had a total of 5,780 flight hours, including 4,640 hours on the Saab 340 and 143 hours on the Saab 2000. The captain originally flew the Saab 340, but had transitioned to the Saab 2000 in August 2014. When the captain flew the Saab 340, he received a training exercise in which a lightning strike caused a generator failure and resulted in the autopilot becoming disengaged.^[3]: 7–9

The co-pilot was a 35-year-old who had been employed by Loganair since early 2014. She had a total of 1,054 flight hours, including 260 hours on the Saab 2000. She was qualified to fly Saab 2000 in May 2014.^[3]: 7–9

Preparation

No abnormalities were reported on the aircraft before takeoff. The weather in Aberdeen was good, but the forecast for Sumburgh called for thunderstorms with rain, snow, hail, and winds of up to 60 knots (110 km/h).^[3]: 3

The two pilots completed an uneventful rotation from Aberdeen to Sumburgh and back, then prepared for the second rotation with the captain as the pilot in command.

Although the hour-long flight to Sumburgh required 1,826 kilograms of fuel, the pilots opted to fill the tanks in Aberdeen in order to take advantage of lower prices. This resulted in a fuel load of 3,000 kilograms.^[3]: 3

Approach

Flight 6780 was vectored for an instrument landing system (ILS) approach to Runway 27 at Sumburgh Airport. The aircraft descended to 2,000 feet (610 m) and captured the localizer 9 nautical miles east of the airport. During the approach, the captain decided to go-around because of a heavy thunderstorm displayed on the weather radar.^[5] As the aircraft turned south, it was struck by lightning, which entered the airframe at the radome directly in front of the cockpit, and exited at the auxiliary power unit (APU) exhaust in the tail. Ball lightning appeared briefly in the cabin just before the strike.^[6] The captain, in the middle of a radio exchange, ceased his transmission and immediately took control of the aircraft, where he began to make pitch-up inputs on the flight controls. During this time, the co-pilot declared a mayday, and the air traffic controller offered all options to the crew for an approach or diversion.^{[3]: 3–4 [7]}

Pitch and roll mistrim warnings displayed on the PFD

The autopilot, sensing that the aircraft was above the selected altitude of 2,000 ft amsl, began applying nose-down pitch to reach the selected altitude. Because the autopilot was still engaged, the control forces the commander experienced (opposing his inputs) were higher than usual for a given column displacement, and he identified that the aircraft did not feel normal. The co-pilot also applied nose-up inputs, but also perceived that the aircraft was not responding as expected. The primary flight display (PFD) displayed pitch and roll mistrim warnings, which were not acted upon. These were accompanied with audible chimes as well as captions on the EICAS, neither of which the commander recalled noticing. The captain instructed the co-pilot to activate the elevator emergency trim switch, but since the elevator control system had not malfunctioned, the emergency trim function did not activate when the switch was turned on.^[3]: 4

Flight 6780 had climbed to around 4,000 feet (1,200 m) when the attitude turned nose-down and the aircraft began to descend. The aircraft began to plunge at a peak descent rate of 9,500 feet (2,900 m) per minute, during which time invalid data from one of the air data computers (ADCs) caused the autopilot to disengage while the pitch trim was almost fully nose-down. The pitch angle reached 19° nose-down and the speed reached 330 knots (610 km/h), 80 knots (150 km/h) above the V_MO. During this time, the controller continued to occasionally inform the pilots about their altitude.^[3]: 4–5

The pilots maintained the nose-up pitch inputs and the aircraft began pitching up. The ground proximity warning system (EGPWS) generated "SINK RATE" and "PULL UP" alarms near the minimum height reached of 1,100 feet (340 m).^[8] The captain applied full power and the aircraft began to climb.^[9] Flight 6780 then continued to climb to 24,000 feet (7,300 m) and diverted to Aberdeen Airport, where it landed safely.^{[3]: 5 [10][11]}

Preliminary data

A detailed inspection of the aircraft was carried out. Some small soot marks and damage was seen on the surface of the radome, and although there was heat damage inside, there were no holes. The APU exhaust was damaged with sections of molten metal, but no further damage to the aircraft was revealed. Tests and inspections of the elevator and autopilot control systems did not reveal any abnormalities.^[3]: 20

Examination of meteorological information revealed that the aircraft had been struck by triggered lightning, a phenomenon in which an aircraft accumulating a negative charge during flight triggers a strike when approaching a positively charged region in a thunderstorm cell.^[12] The Met Office’s lightning detection system observed a lightning strike at the aircraft’s recorded position at 19:10:20.^{[3]: 21–22}

Pilot behavior

Immediately after the lightning strike, the pilots performed nose-up inputs on the flight controls in order to continue the go-around, which along with small increases in engine power caused the aircraft to climb. On the other hand, the autopilot began moving the pitch trim to the nose-down position to maintain the selected altitude of 2,000 feet (610 m), requiring the pilots to pull the control column with a force of 24 pounds (11 kg). For two and a half minutes after the lightning strike, the pilots and autopilot continued to make conflicting inputs. The aircraft continued to climb in stages up to 4,000 feet (1,200 m).^[3]: 23

To maintain altitude, the pilots were pulling the control column fully aft with a force of 80 pounds (36 kg). Flight 6780 maintained 4,000 feet (1,200 m) for about 10 seconds, but the nose gradually lowered as the autopilot continued to move the pitch trim to the nose-down position (pitch trim having more elevator authority than the control column at high speeds).^[3]: 24

Uncontrolled descent

Eventually the pitch trim stopped close to 9° (out of a maximum of 10°) and Flight 6780 began to descend at a rate of 1,500 feet per minute. The aircraft continued to descend and accelerate as the engine output was gradually reduced and moved to flight idle. Six seconds later, the autopilot disengaged as Flight 6780 was passing 3,600 feet (1,100 m) at a descent rate of 4,250 feet (1,300 m) per minute and increasing.^[3]: 24 When the autopilot disengaged, it left the aircraft with pitch trim that was almost fully nose-down and that made the control column ineffective. Thus the aircraft continued its descent.^[13] The pilots maintained nose-up pitch inputs and applied full power, and the aircraft began to pitch up just as the EGPWS issued a “SINK RATE” alarm. This was followed by a “PULL UP” alarm as the aircraft reached its peak descent rate of 9,500 feet (2,900 m) per minute at 1,600 feet (490 m).^[3]: 27 The pilots succeeded in recovering the aircraft 7 seconds before hitting the ground.^[14]

Autopilot behaviour

FDR data from Flight 6780

The autopilot sensed that the aircraft was climbing above the selected altitude of 2,000 feet (610 m) and began applying nose-down trim to regain that altitude. Even if the captain pulled the control column with excessive forces and operated the pitch trim switch, the autopilot was designed not to disengage. The captain felt that the force required on the control column was higher than usual, due to the autopilot opposing his inputs. He may have mistakenly attributed this to a flight control malfunction caused by the lightning strike.^[3]: 43 After that, the autopilot disengaged while the aircraft was at a nose-down attitude of 10°, due to a malfunction of the ADC. If this had not happened, the autopilot would have disengaged when the aircraft reached its nose-down pitch limit of 17°.^[3]: 41

Flight data recorder (FDR) analysis revealed that one of the flight control computers (FCCs) did not receive data or received invalid data from the ADC for at least 99 milliseconds. This disengaged the autopilot at 19:13. The ADC was not removed for further investigation because no ADC malfunction was seen after the accident.^[3]: 41

Conclusions

In September 2016, the AAIB issued its final report, stating:^[3]: 51

The commander’s actions following the lightning strike were to make manual inputs on the flying controls, which appear to have been instinctive and may have been based on his assumption that the autopilot would disconnect when lightning struck. However, the autopilot did not disconnect and was attempting to maintain a target altitude of 2,000 ft AMSL by trimming nose-down while the commander was making nose-up pitch inputs. The control forces felt by the commander were higher than normal because the autopilot was opposing his inputs and he may have attributed this to a flight control malfunction caused by the lightning strike. He did not recall having seen or heard any of the aural or visual mistrim cautions which were a cue that the autopilot was still engaged. This was probably the result of cognitive tunnelling.

In addition, the report stated:^[3]: 51

The commander applied and maintained full aft control column (nose-up elevator) input; however, the autopilot’s nose-down elevator trim authority exceeded the commander’s elevator nose-up authority and the aircraft pitched nose-down and descended, reaching a peak descent rate of 9,500 ft/min. The autopilot then disengaged due to an ADC fault and this allowed the commander’s nose-up pitch trim inputs to become effective. The aircraft started to pitch up just before reaching a minimum height of 1,100 ft above sea level.

Out of 22 aircraft types surveyed, only the Saab 2000 had an autopilot with the following three attributes:^{[3]: 51–52}

• Applying an override force to the column will move the elevator but will not cause the autopilot to disengage
• The autopilot can trim in the opposite direction to the pilot applied control column input
• Pressing the main pitch trim switches has no effect and will not cause the autopilot to disengage

Previously, the Airbus A300, Fokker 70, and Fokker 100 autopilots had similar characteristics, but, in the wake of multiple accidents and serious incidents, the autopilot was redesigned.^[3]: 52 In addition, the Saab 340 had the same characteristics as the Saab 2000 in that the autopilot was not disengaged even if the pilot operated the control column, but it was designed to disengage when the pilot operated the pitch trim.^[3]: 33

The AAIB also concluded that the greater authority of the pitch trim than the control column during high-speed flight contributed to the accident. Even when the control column was pulled to the limit, the pilots could not prevent the nose from dropping. The autopilot was designed to automatically disengage when the pitch or bank exceeds a certain angle, but it is not designed to prevent overspeeding, even if the speed exceeds V_MO (during the incident, the autopilot continued to trim nose down even though the VMO had been exceeded).^[3]: 46

Startle effect

The European Union Aviation Safety Agency (EASA) said in a 2018 report on the startle effect that "this is an interesting case in which the severity of the accident was not defined by the cause of the startle (in this case the lightning strike) but in the sequence of events after this." The EASA further described the accident as follows:^[15]

In effect, after the lightning strike, the aircraft was fully functional and a simple autopilot-disengage would have been sufficient for the pilots to manoeuvre the aircraft in any way they would like. However, the effects of the startle, likely coupled with the pre-startle stress, reduced the PIC’s cognitive frame of mind to make immediate manual inputs, ignoring other control modes. Of course the alternative hypothesis is that the PIC (thinking that the autopilot had disengaged due to the lightning strike) may have assumed that his manual control system was impaired, and instigated his tunnelling in that direction. Unfortunately, if the pilots had refrained from an instant manual reaction, it may have been possible that the secondary problem of fighting the autopilot would be prevented altogether, and led to a much safer flight.

Recommendations

The AAIB issued five safety recommendations to the EASA and the Federal Aviation Administration (FAA) to prevent a loss of control due to the autopilot.^[1] The safety advisory recommends reviewing the autopilot design of aircraft certified by the rules of Part 25 and equivalent regulations, including the Saab 2000, and require modification if necessary to ensure that pilots do not pose potential danger when applying forces that conflict with the autopilot.^{[3]: 52–53 [16][17]}