AAIB: Human Factors and the Identification of Saab 2000 Flight Control Malfunctions
The aircraft was inbound to land on Runway 27 at Sumburgh when the pilots discontinued the approach because of weather to the west of the airport. As the aircraft established on a southerly heading, it was struck by lightning. When the commander made nose-up pitch inputs the aircraft did not respond as he expected.
After reaching 4,000 ft amsl the aircraft pitched to a minimum of 19° nose down and exceeded the applicable maximum operating speed (VMO) by 80 kt, with a peak descent rate of 9,500 ft/min.
The aircraft started to climb after reaching a minimum height of 1,100 ft above sea level.
Recorded data showed that the autopilot had remained engaged, contrary to the pilots’ understanding, and the pilots’ nose-up pitch inputs were countered by the autopilot pitch trim function, which made a nose-down pitch trim input in order to regain the selected altitude.
What the investigators found was that out of 22 airliner types examined, only the Saab 2000 had an autopilot which, when engaged:
- Applies an override force to the control column that will move the elevator but will not cause the autopilot to disengage
- Can trim in the opposite direction to the pilot applied control column input
- Has main pitch trim switches that will not cause the autopilot to disengage
While the whole report is worthy of study but the AAIB discuss the identification of flight control malfunctions in a section that we feel is worth highlighting:
In an aircraft with purely mechanical flying controls, a jammed flight control can be identified by resistance to movement of the control wheel or column. Failure of a control linkage will be apparent as the control will move without the usual resistance. In either case, the absence of the usual aircraft response to an input will be apparent. In this control system, the ‘loop’ from pilot input, to response felt through the controls, to aircraft response, is complete. In an aircraft with powered or fly-by-wire controls, and without any physical feedback, it may be harder to determine a malfunction because effect of control inputs can only be assessed from aircraft response. In manoeuvring flight or turbulence, this assessment may be more difficult.
In the Saab 2000, the forces required to achieve particular control column displacement are greater when the autopilot is engaged, but this is not a usual mode of operation and pilots are unlikely to be familiar with it. A pilot feeling abnormal control resistance may not readily determine that the reason for the unusual forces is that the autopilot is engaged. Mental models are developed by experience and/or training, and more experience leads to more detailed mental models. Mental models guide interaction with systems: an accurate mental model can facilitate good performance, but poor mental models can lead to misunderstanding of system functioning, increasing the risk of error.
AAIB note that:
Designers can promote good mental models by optimising feedback, for example by providing indicators of system status and performance which are easily assimilated, even under stress. Automation surprise* can occur if the autopilot does not behave as expected, for example if the system remains engaged when the flight crew believes it is not. Clear feedback of the system’s status can help to prevent this inconsistency. Stress, which might be experienced in the moments after a lightning strike, leads to an increase in physiological arousal. This may lead to ‘cognitive tunnelling’, in which individuals exhibit a tendency to focus on a small number of the most salient or expected information, and only information that supports the prevailing understanding of the situation may be processed. Cognitive tunnelling not only affects perception of visual signals, it can also affect auditory processing at times of high cognitive load; this is ‘inattentional deafness’.
* On automation surprise the AAIB reference: Sarter, N. B., & Woods, D. D. (1995). How in the world did we ever get into that mode? Mode error and awareness in supervisory control. Human Factors, 37(1), 5-19. See also this NASApresentation.
Clear and prominent status indicators can assist. The results from a study on ‘inattentional deafness’ in pilots in a cockpit environment were published in a paper entitled ‘Failure to Detect Critical Auditory Alerts in the Cockpit: Evidence for Inattentional Deafness’**. In this study 28 pilots of different experience levels were placed in a . They were given time to practise landings and then told to expect one of 5 different events to occur including an antiskid failure, an engine failure, a ground proximity warning and a landing gear failure. The aural warnings and visual indications associated with these conditions were shown to them. All the pilots were then given the landing gear failure scenario. Half the pilots were also given a windshear scenario (to simulate high workload) and the other half were not (to simulate normal workload). Of the pilots who were given the windshear scenario 57% failed to detect the aural gear failure warning. Of the pilots who were given the non-windshear scenario all of them detected the aural gear failure warning.
** Dehais, Causse, Vachon, Regis, Menant & Tremblay (2013). Failure to Detect Critical Auditory Alerts in the Cockpit: Evidence for Inattentional Deafness. Human Factors: The Journal of the Human Factors and Ergonomics Society (published online 11 November 2013).
In the case of this serious incident the AAIB made 5 recommendations. The Swedish AIB, the SHK, however have commented that changes to the Saab 2000 autopilot would be ‘disproportionate’ in their view.
The autopilot must not create an unsafe condition when the flight crew applies an override force to the flight controls.
This was supplemented by extra supporting AMC text.
Though BAE Systems has received no reports of BAe146 pilots attempting to override the autopilot, the architecture of the autopilot system is such that with the autopilot engaged, the autopilot does not automatically disconnect in response to pilot application of a pitch input or when the electric pitch trim switch on either pilot control wheel is operated.
In order to address the safety concerns of Safety Recommendation 2016-051, BAE Systems have issued All Operator Message 20-027V-1 and Flight Operations Support Information Leaflet 20-016 to inform BAe 146 operators of this potential unsafe condition and recommend pilots check the autopilot status before applying manual inputs. In addition, Service Bulletin (SB) 22-072-36262A, initial issue dated 14 September 2021, has been published to introduce a modification to the autopilot disconnect logic to ensure disconnection when the electric pitch trim switch on either pilot control wheel is operated and thus prevent the potential unsafe condition.
Aerossurance has previously written about automation, including:
- The ‘Automation Problem’ – A Discussion
- B737 Speed Decay, Automation and Distraction
- Boeing 737 Automation Related Descent Below Cleared Altitude – ATSB Report
- AAIB Report on 2013 Sumburgh Helicopter Accident
- Technology Friend or Foe – Automation in Offshore Helicopter Operations
- Commanders: Flying or Monitoring?
- UK CAA Release CRM Videos
- UPDATE 29 December 2016: CRJ-200 LOC-I Sweden 6 Jan 2016: SHK Investigation Results
- UPDATE 22 January 2017: Confusion of Compelling, But Erroneous, PC-12 Synthetic Vision Display
- UPDATE 5 August 2018: Improvised Troubleshooting After Cascading A330 Avionics Problems
- UPDATE 13 January 2019: Human Factors of the Selection of Parking Brake Instead of Speed Brake During a Hectic Approach (ERJ145 at Runway Excursion at Bristol)
- UPDATE 17 March 2019: Easyjet A320 Flap / Landing Gear Mis-selections
- UPDATE 4 April 2021: Fatal 2019 DC-3 Turbo Prop Accident, Positioning for FAA Flight Test: Power Loss Plus Failure to Feather
UPDATE 9 January 2017: HeliOffshore have released a HeliOffshore Automation Guidance document and six videos to demonstrate the offshore helicopter industry’s recommended practice for the use of automation.
UPDATE 19 April 2017: Aerossurance is pleased to sponsor the 2017 European Society of Air Safety Investigators (ESASI) 8th Regional Seminar in Ljubljana, Slovenia. The seminar featured a presentation on this investigation. ESASI is the European chapter of the International Society of Air Safety Investigators (ISASI).