The Dark Side of Logic: The near crash of SmartLynx Estonia flight 9001

On the 28th of February 2018, two pilots, four trainees, and an inspector departed Tallinn, Estonia for a routine training flight aboard an Airbus A320. But as the last student pilot carried out a touch-and-go landing, the plane was wracked by a series of confusing mechanical failures. The pilots lost all control over the elevators; the plane lost height and scraped the runway on its engines before careening back into the air. The elevators were jammed, the other flight controls were degraded, the flaps weren’t working, the right engine was on fire. Every conceivable warning blared simultaneously. Faced with impending catastrophe, the pilots used what little control they had to line up with the runway for a desperate emergency landing. On final approach both engines failed, but by squeezing out the last dregs of speed, the captain managed to nurse the plane to the very threshold of the runway, where it touched down hard and rolled out in the snow. Through nerves of steel, all aboard had been saved. But what had led to this near-disaster? The answer was a surprise to everyone: there was nothing wrong with the flight controls. The sequence of events actually began when someone used the wrong oil to lubricate an obscure piston deep inside the horizontal stabilizer — a subtle mistake which led to an escalating series of computer failures that nearly cost seven people their lives.

SmartLynx Airlines Estonia is a wholly-owned subsidiary of SmartLynx Airlines, an independent Latvian carrier specializing in charter flights from the Baltic states to holiday destinations. As the Estonian branch of the company, SmartLynx Estonia operates a fleet of three Airbus A320s based out of the country’s main airport in Tallinn, the capital city.

But SmartLynx Estonia flight 9001 was not scheduled to leave the country: in fact, it wouldn’t even get far from Tallinn. The purpose of the flight was to give student pilots working their way through the airline’s in-house A320 training program practice with takeoffs, landings, and go-arounds. During the approximately three-hour session, four trainee pilots with limited flying experience would each take off, perform a go-around, execute five touch-and-go landings, then land for real, under the supervision of an instructor. Also on board were a safety pilot, qualified to fly the A320 in case of an emergency, and an inspector from the Estonian Civil Aviation Authority, who was there to monitor SmartLynx Estonia’s training program. The plane they were flying was 18 years old, but it was new to the airline: SmartLynx had purchased it earlier that month.

Under the watchful eye of the instructor — a 63-year-old veteran pilot with over 24,000 flight hours — the first three trainees carried out their exercises without incident. There was only one small hiccup, an annoying caution message that kept coming back over and over again: “ELAC 1 PITCH FAULT.” The pilots knew this meant there was something wrong with one of the plane’s computers, but the manual said all they needed to do was turn the computer off and back on again, so that’s what they did.

The Airbus A320 is a fly-by-wire aircraft, meaning that pilot control inputs are fed to a bank of computers, which in turn augment those inputs before commanding the control surfaces to move. This allows the plane to fly more smoothly, helps the pilots extract maximum performance and efficiency from the airplane, and prevents them from making inputs that could lead to a loss of control. To ensure redundancy, each set of control surfaces is attached to a different computer, each of which has multiple backups that can kick in if the primary computer fails. Among these computers are the two ELACs, short for Elevator Aileron Computers, which transmit inputs from the pilot and autopilot to the elevators, ailerons, and horizontal stabilizer.

The ELACs are part of a multi-layered system intended to ensure the integrity of the flight controls at all times. Normally, ELAC 2 is responsible for the elevators, but if it encounters a problem, this responsibility can be transferred to ELAC 1. If both ELACs fail, still not all is lost! At this point a different pair of computers, called the Spoiler Elevator Computers or SECs, which normally control the state of the aircraft’s spoilers, can step in to control the elevators as well. Thus, to lose control over the elevators, four computers must fail at the same time. It’s easy to see why the crew of flight 9001 were not worried when the airplane kept telling them about a problem with ELAC 1.

Unknown to anyone on board, the caution message that they were getting was only the tip of the iceberg. The origin of the problem lay with the Trimmable Horizontal Stabilizer Actuator (THSA). This is the hydraulic actuator which physically moves the horizontal stabilizer, the control surface which the pilots and autopilot use to adjust the angle at which the plane is stable. As opposed to the elevators, which are meant for one-time inputs, the stabilizer trim is for longer-term adjustments that ensure the plane stays at the pitch angle where the pilots or the autopilot want it. Also unlike the elevators, the stabilizer trim is connected mechanically to the pilots’ flight controls, and can still be used even without any functioning computers.

Whenever flight 9001 came in for a touch-and-go landing, the wheels would touch the ground, and after five seconds the THSA would enter what is known as the “ground setting.” In order to make the landing rollout easier, upon entering the ground setting the ELAC trims the stabilizer in the nose down direction, assisting the pilot in planting the aircraft on the runway. But in a touch-and-go landing, where the plane will remain on the ground for only a few seconds before taking off again, this automatic adjustment to the stabilizer is undesirable. Thus, in order to assist with the imminent takeoff, the instructor would use the manual trim wheel in the cockpit to override the computer and hold the stabilizer in a nose up position for takeoff. Using the manual trim wheel disconnects the pitch trim actuator (PTA), which sends electrical signals from the computers to the THSA, and in its place connects a device called the override mechanism, which inserts itself downstream of the PTA and transfers pilot inputs to the THSA instead of computer inputs.

Meanwhile, the ELAC constantly compares the commanded stabilizer position with its actual position in order to detect any mechanical failure in the system. It accomplishes this by matching values from two data channels: the command channel, which transmits the commanded position, and the monitoring channel, which transmits the actual position. If a discrepancy between the two lasts more than one second, a fault is triggered. In its default state, this very simple function would be unable to tell the difference between a pilot overriding the autopilot using the trim wheel and failure of the horizontal stabilizer, because the computer will continue to send signals to the PTA despite the fact that it is no longer connected to the stabilizer. To rectify this, whenever the pilot applies torque to the trim wheel in the cockpit, an override piston inside the PTA moves downwards and contacts three microswitches, which transmit a signal telling the computers to stop comparing the command channel with the monitoring channel.