Challenger 300 upset after autopilot disconnect, San Francisco, 2022

Final reportPitch trimSerious injury

The short version

Seconds after the autopilot went in on the climb out of San Francisco, the crew got an AP STAB TRIM FAIL caution and then AP HOLDING NOSE DOWN. About four minutes later, just after the captain took control, the autopilot disconnected and the jet pitched up hard, with load factor swinging between +2.2 g and -0.4 g. The cabin attendant was out of her seat and was seriously injured.

What happened

  1. At 1230:51 N557XJ departs runway 28R at San Francisco on a positioning flight to Page, Arizona. Two pilots and one cabin attendant are on board.

  2. At 1232:19 the autopilot is engaged at 4,265 ft pressure altitude and 220 kt.

  3. At 1232:24 the master caution comes on. The NTSB places the AP STAB TRIM FAIL message about 5 seconds after engagement. The crew acknowledge it 5 seconds later.

  4. At 1232:38 the master caution comes on again. AP HOLDING NOSE DOWN posts 14 seconds after the first message, and the crew acknowledge it about 6 seconds later.

  5. Over the next four minutes the captain starts the QRH checklist and takes control from the first officer after a positive exchange of controls. The autopilot stays engaged.

  6. At 1236:39 the FDR records an abnormal autopilot disconnect. In less than a second, vertical acceleration rises from 0.985 g to 2.221 g.

  7. At 1236:40 the autopilot state changes to disengaged. Load factor reaches -0.426 g in that second. At 1236:41 it is 2.096 g, falling to 0.176 g within the second. The first officer described "several hard oscillations" before the captain got the aircraft straight and level.

  8. At 1302:12, after hand flying back, the crew land on runway 28R at San Francisco without further incident.

All times are local (Pacific daylight time), from the flight data recorder.

In the minute after the disconnect, the FDR shows pilot or copilot manual trim used seven times, each time trimming the stabilizer nose down. The captain did not want to re-engage the autopilot and hand flew the return.1

The cabin attendant crawled forward to the cockpit and said she was hurt. She had been briefed to stay seated and belted until 10,000 ft. Company policy let cabin crew move about above that altitude. She said she had unbelted to work in the aft cabin. She remembered the BELTS light on for departure but not whether it went off. The FDR does not record that light.1

The report says only that the airplane was above 10,000 ft at the time of the upset. The captain recalled the first caution climbing through 20,000 ft. The FDR places it about 5 seconds after the autopilot went in at 4,265 ft. The report does not reconcile the two.1

Why it happened

  1. The NTSB gives the probable cause as an inflight upset that seriously injured the cabin attendant, following an autopilot disconnect for reasons that could not be determined from the available information.1

  2. No data showed that the autopilot disengaged because of a malfunction or failure. Postaccident tests of the autopilot, pitch trim and flight guidance computers found no anomalies. Bombardier test flights could not reproduce either caution.1

  3. The NTSB considered it likely that an inadvertent control input by one of the pilots disconnected the autopilot. It could not say which pilot or what input.1

  4. The maintenance data showed both flight guidance computers flagging pitch trim inoperative at the same time, with no recorded cause. Bombardier's most likely explanation was a monitor trip after the autopilot was engaged out of trim.1

  5. The cockpit voice recorder had been overwritten, so the NTSB could not tell how far the crew read the QRH warnings or completed the checklist items.1

  6. The QRH for both cautions warns of an abrupt change in control force or an out of trim condition when the autopilot is disconnected, and tells the crew to hold the flight controls firmly. The checklist also calls for the seatbelt sign on. No crew member told the cabin attendant to stay in or return to her seat. The report says that would have been prudent before an expected abrupt change in control forces.1

  7. The findings list pitch control not attained or maintained, and incomplete action by the pilot and by the copilot.1

  8. Bombardier's reference material in the report says a firm grip on the column stops the elevator moving back to neutral when the autopilot releases it, which prevents or reduces pitch oscillations. The autopilot can be disengaged safely when a HOLDING NOSE DOWN or NOSE UP caution posts. If disengagement is delayed and the aircraft keeps getting more out of trim, the oscillations at the eventual disconnect can be large.1

The report contains no safety recommendations.1

What a crew can take from it

  1. Hold the column before the autopilot lets go. Both cautions in this event carry the same QRH warning and the same first step: hold the flight controls firmly. Here, both pilots said the autopilot dropped out just after the control exchange, and the jet pitched up at once. The load went from 1 g to 2.2 g in under a second. A firm grip keeps the elevator where the autopilot left it.

  2. Do not let the autopilot carry an out of trim load for long. The first caution posted about 5 seconds after engagement. The disconnect came a little over four minutes later. Bombardier's guidance in the report says a disconnect at the HOLDING caution gives minimal control forces, and a late one can give large oscillations. The QRH steps for both cautions are to hold the flight controls firmly and then disconnect with the control wheel master switch.

  3. Many pilot actions disconnect the autopilot. The NTSB thought an inadvertent control input by one of the pilots was the likely trigger, though it could not say which pilot or what input. Bombardier's description in the report lists the master disconnect switches, manual trim and several other pilot actions that all disengage the autopilot.

  4. Get the cabin seated before you handle a pitch trim caution. The QRH calls for the seatbelt sign on. The cabin attendant was up and working in the aft cabin, as company policy allowed, and nobody told her to sit down. She was the only person hurt. The NTSB said telling her to sit down would have been prudent before an expected abrupt change in control forces.

  5. Think about the recorders after an event. The flight went on for about 26 minutes after the upset, and the CVR overwrote it. That left the NTSB unable to tell what the crew read and did. Know what your operator's procedure says about preserving the CVR once the aircraft is on the ground.

Study it on the course

Sources

  1. National Transportation Safety Board. Aviation Investigation Final Report WPR22LA284, Bombardier BD-100-1A10 N557XJ, San Francisco, California, 27 July 2022. Published 8 July 2025.
  2. Aviation Safety Network, occurrence 281448.

Last updated 22 October 2026

For study only. Always use the approved AFM, QRH and operator procedures.