Description

On 17 February 2024, an Airbus A321 (D-AISO) operated by Lufthansa on a scheduled international passenger flight from Frankfurt to Seville as LH1140 was en route over northeast Spain when the captain left the flight deck to use the toilet. When he initially tried to re-enter the flight deck eight minutes later, multiple attempts using the correct code failed and there was no response from the flight deck to an intercom call. The captain then used the emergency access code but before it expired, the first officer opened the door manually. On entering after the first officer had been alone in the flight deck for eleven minutes, the captain discovered that the first officer had become incapacitated and appeared ill. The captain declared an emergency, the first officer was removed from the flight deck, and the aircraft diverted to Madrid. The first officer was hospitalised.

Investigation

An investigation was carried out by the Spanish Commission for the Investigation of Accidents and Incidents (CIAIAC). Both the cockpit voice recorder (CVR) and the digital flight data recorder (DFDR) were removed from the aircraft and were downloaded by the German Federal Bureau of Aircraft Investigation. Important information on the consequences of the incapacitation was obtained from the data of both recorders. Data from the quick-access recorder (QAR) and relevant recorded ATC communications were also available.

The 43-year-old captain was accompanied by a 38-year-old first officer. No information on the flying experience of either pilot was recorded. However, it was noted that the first officer had obtained his only professional pilots licence - a multi-crew pilot license (MPL) - in June 2019 and that his most recent medical had been on 24 May 2023, valid until 1 June 2024 with no medical restrictions.

What Happened

The flight duty during the event was the fourth day of a four-day paired rotation for the two pilots. The captain remarked that during the previous three days, the first officer “had displayed a consistently high level of motivation." The captain also confirmed that before leaving the flight deck to go the forward toilet whilst the aircraft was en route over northeastern Spain, he had had a conversation about the weather conditions and the operation of the aircraft during which the first officer had “appeared to be able and alert."

Thirty-six seconds after the captain left the flight deck, the CVR began recording sounds consistent with the first officer “experiencing a sudden and severe incapacitation” and over the next 46 seconds, the following sequence of events was recorded (the illustration below indicates the position of the controls and switches operated):

1. The disconnection of one of the Spoiler Elevator Computers which required a pushbutton on the right side overhead panel to be pressed. This computer is one of seven flight control computers in this aircraft type and such action automatically triggered a master caution and electronic centralised aircraft monitor (ECAM) fault warning along with the disabling of other two spoiler elevator computers.
2. A sudden increase in force on the right rudder pedal, which reached 50kg and generated the ‘STOP RUDDER INPUT’ warning and an ‘ WX+’ to ‘TURB’.
3. The morse code identification of the VOR ‘BAN’ began to be heard which required the corresponding reception knob on the central pedestal to be pressed.
4. The ‘ATC MSG’ light and its associated audible alert were activated.

The location of the first officer’s involuntary actions whilst incapacitated. [Reproduced from the Official Report]

Whilst this was happening, the DFDR data showed that the autopilot (AP) and the autothrust (A/THR) had remained engaged. This allowed the AP to compensate for the 5° roll and 2° heading change caused by the rudder pedal input. To disengage the AP with rudder pedal input would have required a much higher force than was exerted. The intended route was followed making the required track changes at the relevant positions.

On his return to the flight deck eight minutes later, the captain used the standard method to obtain re-entry by entering an access code on a numeric keypad near the door. This action triggers an audible chime in the flight deck to alert the pilot(s) inside of a request to enter. This request can then be met by unlocking the door using a switch on the pedestal. In an emergency, the door can be unlocked by entering an emergency code on the same keypad, which triggers a more noticeable sound in the flight deck. The flight crew can prevent automatic unlocking of the cockpit door by setting a toggle switch to 'LOCK.'

As the captain’s first request for entry was not successful, he tried again, “assuming that either he had entered the code incorrectly the first time or that the first officer was busy with flight duties." He made three further requests for entry using the normal code without response, and when one of the cabin crew called the flight deck on the intercom, this also did not elicit any response. At this point, the captain entered the emergency access code but before the automatic unlock time had been reached, the first officer opened the flight deck door manually. The captain entered the flight deck and having observed that the first officer was “pale, sweating and moving strangely” he took control of the aircraft and called for assistance from the cabin crew.

First aid was given by the cabin crew and a doctor, who was travelling as a passenger and diagnosed a possible heart condition. The captain declared a medical emergency and decided to divert to the nearest suitable airport. This was Madrid Barajas Airport, which they had just passed and a landing there was made approximately 20 minutes later. An ambulance was waiting, and the first officer was transferred to it and taken to hospital.

During an interview as part of the investigation, the first officer stated that “he had lost consciousness and that he couldn't remember when." He added that “before that, he remembered flying over Zaragoza and, the next thing, he was being attended to by the cabin crew and a doctor, who was travelling on the aircraft as a passenger." He also advised that “the loss of consciousness was so sudden that he was unable to warn the other crew members of his incapacitation."

Regarding the Lufthansa flight deck procedures, it was noted that having previously required that two authorised persons (flight crew or cabin crew) be present on the flight deck at all times, the company had “changed its procedure over time." By the time the event occurred, only one pilot was required on the flight deck (and seated at the controls) if this situation was necessary to allow the other pilot to temporarily leave the flight deck en route if their “absence is necessary to perform duties in connection with the operation of the aircraft or for their physiological needs." 

The flight route with the points where (1) the captain left the flight deck, (2) the first officer’s incapacitation began and (3) the captain was finally able to re-enter the flight deck. [Reproduced from the official report]

A Review of the Event

The investigation considered the event in the context of such incapacitations generally, the first officer’s medical condition, and the available barriers that assist in mitigating the consequences of such incapacitations:

• Pilot Incapacitation Generally

The CIAIAC found that “30 cases of pilot incapacitation had been recorded in the Spanish Occurrence Reporting System over the last ten years” and noted that 287 such cases had been recorded in the European Central Repository over the period 2019-2024. Cases within the latter included three in-flight events in which one of the pilots on the flight deck suddenly became incapacitated and “involuntarily acted on the flight controls, disconnecting the autopilot in two of those events." However, in all three of these cases, “both pilots were present on the flight deck” which allowed the unaffected pilot to immediately take control thereby mitigating the consequences of the incapacitation.

• The First Officer’s Medical Condition

It emerged that his sudden incapacitation was caused by a previously undetected neurological condition. Expert medical opinion was that his medical condition would not have been detectable in either initial or recurrent medical examinations “unless the illness was symptomatic at the time of the medical examination or the pilot had experienced the symptoms previously," neither of which applied. The pilot stated that “he could not recall any similar episode or noteworthy medical condition that would have alerted him to a potential issue (and that) he was in good health and was not taking any medication." Relevant research was found to indicate that the rate of occurrence of “neurological conditions” amongst pilots in flight would be of the order of 0.25 seizures per year. It was therefore recognised that “designing safety barriers to prevent this type of in-flight incapacitation is difficult."

• Mitigation of the consequences of pilot incapacitation

Both regulatory requirements and airline procedures permitted a single pilot to be alone in a locked flight deck during cruise for (undefined) short periods for the purpose of “duties in connection with the operation of the aircraft or for their physiological need." When Lufthansa had reduced the requirement for the minimum number of “authorised persons” on the flight deck to “one pilot seated at the controls," it had done so because “it was deemed that (continuing to) require two authorised persons to be on the (locked) flight deck at all times.....would not enhance operational safety." However, it was considered that “this event has highlighted the benefit of having another authorised person (usually a member of the cabin crew) on the flight deck when one of the two pilots leaves the flight deck for physiological or operational reasons." It was obvious that had another authorised person been present on the flight deck in this event “they could have quickly identified the first officer’s incapacitation, alerted the rest of the crew and opened the flight deck security door so that the captain could swiftly take control of the aircraft."

The Cause of serious incident was formally documented as “the first officer's incapacitation was the manifestation of a symptom of a condition that had not previously been detected either by the pilot himself or during the aeronautical medical examination."

One Safety Recommendation was made as a result of the Investigation as follows:

• that the European Union Aviation Safety Agency (EASA) informs operators about this event so that they may take it into account and reassess, from an operational safety and security point of view, the risks associated with one pilot remaining alone on the flight deck when the other pilot leaves for physiological or operational reasons. REC 02/25

The Final Report of the investigation was approved on 27 November 2024 and subsequently published simultaneously in both the definitive Spanish language version and in an English language translation on 14 May 2025.

Related Articles

• Pilot Incapacitation
• Medical Emergencies - Guidance for Flight Crew
• Pilot Fitness to Fly