Crucible of the Cascade: The crash of Gazpromavia flight 9608
On the 12th of July 2024, a Sukhoi Superjet 100 operating for Russian state oil company Gazprom lost control and plunged into a forest just five minutes after takeoff on what should have been a brief repositioning flight. The weather was perfect, the crew were well rested, and the airplane had just been released from a thorough round of inspections — so what went wrong? The answer, it turns out, is both technically complex and viscerally horrifying.
One year after the accident, the release of the final report has revealed a scarcely believable sequence of events that began with a colossal maintenance mix-up enabled by suboptimal aircraft design. Unaware that their airplane had been rendered grossly unairworthy, the pilots attempted to reposition it for its next scheduled flight, only to find themselves barraged with a series of confusing indications, followed by a terrifying and ultimately unsuccessful fight for control as the fly-by-wire SSJ-100 seemingly tried to fly itself into the ground. Minute variations in parameters and apparently minor crew decisions triggered a complex automation “cascade,” culminating in a catastrophic coupling of two different flight envelope protections that should never activate simultaneously.
The pilots spent their final moments hauling back on their side sticks in a desperate effort to climb, unable to overcome a computer governed by the inexorable logic of its programming. From the drawing boards of the United Aircraft Company to the final actions of the doomed crew, this is the story of how it happened.
◊◊◊
Hello readers! At the end of July, the final report on this accident report was released, in Russian only. (Annex 13 to the Chicago Convention on Civil Aviation, to which Russia is a signatory, requires that accident investigation reports be published in English to facilitate global distribution and awareness). Since I have a master’s degree in Slavic Studies with a focus on Russian language, I took it upon myself to translate the entire 263-page report, which occupied me throughout the month of August. As a courtesy, I’m releasing my translation to the public alongside this article, and you can read it here.
◊◊◊
Part 1: Just a Short Flight
If, for some reason, you were to find yourself searching for flights to Russia’s far northern gas-producing towns of Nadym and Novy Urengoy, you may discover the option to purchase tickets on a highly unusual airline called Gazpromavia.
As the largest company in Russia and the world’s top producer of natural gas, the state-owned Gazprom wields immense power over Russia’s economy and society, with hundreds of subsidiaries across many industries, including a bank, a media holding company with 38 television channels, and even a private mercenary army that actively participates in the invasion of Ukraine. As a vertically integrated company, Gazprom also owns every element of its gas production process, from exploration to extraction to refining to distribution. This includes air transportation of personnel and equipment, often to remote destinations in the Arctic and Siberia, for which its dedicated subsidiary Gazpromavia operates a fleet of more than 30 fixed wing aircraft and over 100 helicopters. Most of these are directly engaged in gas extraction support roles, as well as charter operations, but a few aircraft are used for scheduled passenger flights, just like any other airline. In fact, you can go online right now and purchase tickets on Gazpromavia flights between Moscow, Ufa, Tyumen, Nadym, and Novy Urengoy, not that I recommend giving Gazprom your hard-earned money. Other destinations might also be available, but a full accounting of the company’s scheduled network was difficult to find.
Gazpromavia’s base of operations is at Vnukovo International Airport, located on the southwestern outskirts of Moscow. In 2024, the airline’s Vnukovo-based fleet consisted of 9 Sukhoi Superjet 100 (SSJ-100) short-to-medium-range jets configured with 90 passenger seats each.
That same year, Gazpromavia began contracting routine maintenance and heavy inspections to the Civil Aircraft Maintenance and Overhaul Center, or MOC, at the P. A. Voronin Lukhovitsy Aircraft Plant in the town of Lukhovitsy, located 120 kilometers southeast of Moscow.
The Lukhovitsy Aircraft Plant and the attached Tretyakovo Airport have been owned and operated for decades by Russian aircraft manufacturer Mikoyan and Guryevich, or RAC MiG, which built and maintained notable warplanes at Lukhovitsy, including the MiG-29. Like all other Russian aircraft manufacturers, MiG is now part of the United Aircraft Company, or UAC, as are the factory and the airport.
MiG has not designed and produced a new aircraft type since the fall of the Soviet Union, instead subsisting mainly on continuing maintenance revenue from the existing fleet of MiG warplanes. However, this is a finite and declining revenue source. In 2015, for instance, a fighter expert told the Moscow Times that MiG’s maintenance and upgrade business “will disappear as export customers retire, store, scrap and replace their MiG-29s.” Although at the time UAC disputed the notion that MiG was in trouble, in 2022 the company was merged with Sukhoi Aircraft, another UAC subsidiary and the manufacturer of the SSJ-100 regional airliner. As part of this process, in 2021 UAC opened the Civil Aircraft Maintenance and Overhaul Center at the Lukhovitsy Aircraft Plant in order to maintain SSJ-100 aircraft using the plant’s existing MiG technical staff.
Three Gazpromavia SSJ-100s underwent maintenance and inspections at the Lukhovitsy MOC in 2024, including an aircraft with registration number RA-89049.
On the 12th of July 2024, that aircraft was released from maintenance, and a Gazpromavia flight crew was sent to Tretyakovo Airport in order pick it up and reposition it to the airline’s operating base at Vnukovo. After completing all pre-flight checks, the crew established contact with the Tretyakovo Air Traffic Manager — the equivalent of an air traffic controller at the privately owned, non-public airport — and received permission to taxi at 14:48 local time. Takeoff clearance was granted five minutes later.
The flight to Vnukovo Airport was not expected to be a long one. The two airports are only 136 km apart, and the crew of RA-89049 didn’t expect to climb any higher than 10,000 feet before beginning their descent. The airplane was light and responsive with no passengers or baggage on board, and the weather was perfect, with unlimited visibility and few clouds throughout the wider Moscow region.
Following takeoff from runway 10, the flight executed a left turn to a heading of 004 degrees, after which the crew used their second radio to contact Domodedovo Radar, the air traffic control division responsible for mid-level airspace around Moscow’s Domodedovo International Airport. After coordinating with the Tretyakovo tower, the controller cleared them for a further left turn to heading 260, the direction of Vnukovo Airport, with an unrestricted climb to 10,000 feet. Using the flight’s callsign, the Domodedovo radar controller asked, “Gazprom 9608, and tell me if you’re ready to follow on to Vnukovo? And what altitude will you need?”
“Yes, we’re ready for Vnukovo immediately, but we don’t have any need for higher than ten [thousand], 9608,” the captain replied.
Some 30 seconds later, the Domodedovo Radar controller glanced back at his display and noticed that flight 9608 had not begun climbing to 10,000 feet — in fact, it was at 5,000 feet and descending. Assuming there had been some misunderstanding, he addressed the flight: “Gazprom 9608, confirm climb to ten thousand feet?” But there was no reply.
At Tretyakovo Airport, the air traffic manager heard flight 9608 reporting “unreliable airspeed,” but the Domodedovo controller did not hear the transmission and continued to inquire with mounting alarm. But he would not hear from the flight again. Instead, he watched helplessly as the aircraft’s descent steepened and its speed increased, its altitude ticking down toward zero, until at time 14:59 and 16 seconds, it vanished from radar.
At the Tretyakovo tower, the air traffic manager observed a column of black smoke bursting abruptly from a distant forest, testifying to the violent end of RA-89049. He immediately activated the crash alarm, and at Domodedovo Airport, the control center supervisor did the same.
Reports of an airliner down spread quickly to multiple emergency agencies, which collectively sent 381 personnel and 120 vehicles to the site of the crash to contain the fire, search for survivors, and provide site access. But when they got there, they found little more than a smoldering hole in the broadleaf forest, where the burning remnants of what had once been an SSJ-100 lay strewn across the forest floor for a distance of nearly 400 meters. Within this colossal scar, they discovered the bodies of two pilots and a flight attendant, who had been the only people on board. There were no survivors.
◊◊◊
In accordance with Russian law, responsibility for the investigation lay with the Interstate Aviation Committee, or MAK, an independent multinational aviation organization headquartered in Moscow and active in several former Soviet republics. The MAK is a recurring character in my articles, but if you’re not familiar with them, then it suffices to say that the MAK is one of the last civil organizations in Russia to have largely escaped cooption by Russian state interests, at least for now. You can read more about my thoughts on the agency and its history here, here, and here.
The MAK isn’t known for publishing reports quickly — the final report on the crash of Aeroflot flight 1492 infamously took nearly six years to come out — but it seems that the crash of Gazpromavia flight 9608 bucked that trend. Despite conducting extensive experiments involving complex mathematical models, the MAK published its final report after just one year. The text of the report reveals much about what happened that day, and reading between the lines reveals a little bit more — and not all of it is pretty.
◊◊◊
Part 2: The Gazprom Bucket Brigade
The Sukhoi Superjet 100 is the most successful Russian airliner designed and built since 1991, but it does not have stiff competition. Around 235 have been built (Wikipedia says “Citation needed”), and airlines in several countries previously flew them, but most dropped the type quickly due to lower-than-advertised reliability and a shortage of spare parts. Today, several dozen are in service with the Russian government and various Russian airlines, but as of 2025 the only remaining operator outside of Russia is the Kazakh border patrol.
The SSJ-100 started life as an international project born of a partnership between the United Aircraft Company and several western aerospace companies. The engines are a collaboration between France’s Safran and Russia’s NPO Saturn; the avionics are from France’s Thales Aerospace; the flight control systems are made by Germany’s Liebherr; the auxiliary power unit is manufactured by America’s Honeywell; and the electrical system is from Hamilton Sundstrand. Most of the fuselage and wings are manufactured in Russia, but almost everything else comes from abroad, much of it consisting of off-the-shelf components.
Where once these Western suppliers were marketed as a benefit, they are now a liability. Sanctions imposed on Russia following the 2022 invasion of Ukraine have cut off the supply of spare parts and technical support from suppliers in the US and Europe, forcing Russian airlines to seek alternative supply chains, including but not limited to the black market. Some have also grounded aircraft in order to strip them for parts.
Even before the invasion, UAC had been seeking to “Russify” the SSJ-100 by replacing foreign-made components with Russian equivalents, a process known as import substitution. As part of this process, the SSJ-100 type certificate was handed to Yakovlev — formerly known as Irkut — which renamed the project to the SJ-100 or “Superjet New.” Despite lofty promises, as of this writing no import-substituted SJ-100 has been delivered to any airline and it is unclear when or even whether this will occur. According to various sources, the CEO of Yakovlev was removed from his post in late 2024 due to the lack of progress, but it could hardly be considered his fault: at present, Russia is struggling to find the technical and manufacturing expertise needed to replace Western systems without large efficiency losses that could make the planes uneconomical to fly.
In the meantime, airlines wait and make do.
◊◊◊
On 20 March 2024, Gazpromavia SSJ-100 RA-89029 arrived at the Maintenance and Overhaul Center at the Lukhovitsy Aircraft Plant in order to undergo a series of standardized heavy inspections and preventative maintenance. These inspections could be described as a C-check, although this was not technically the case. Most airliners have a standardized inspection regime consisting of A, B, C, and D checks, each of which involves increasing thoroughness and complexity and an increased time interval between checks. Typically, a C-check happens about once every two years, but this will depend somewhat on the aircraft type and operating style. On the other hand, UAC doesn’t provide a strictly consolidated inspection regime; instead, it defines the maximum acceptable inspection interval for each system and allows airlines to organize the individual inspection items into packages at their convenience, so long as no maximum intervals are exceeded. Therefore, RA-89029 was not in fact undergoing a C-check, but rather a “1C+5C-check,” as defined by Gazpromavia, consisting of elements to be inspected and serviced every two years, combined with elements to be inspected and serviced every ten years. On most aircraft types this would be considered a combined C and D-check, but SSJ-100 operators are free to call it whatever they want; for instance, in 2023, the Lukhovitsy MOC performed routine inspections and servicing on a Yamal Airlines SSJ-100 according to what that airline termed a “2920DY+1460DY+730DY+7500FH+ADD” check (presumably consisting of combined 7,500 flight hour inspection items, 2-year inspection items, 4-year inspection items, 8-year inspection items, and whatever ADD means).
This misbegotten story begins with the 5C-check on RA-89029. The exact scope of this check is not described in the final report, but what’s important is that Gazpromavia had apparently requested that the Lukhovitsy MOC replace the aircraft’s two primary angle of attack sensors while the airplane was down for inspection.
The angle of attack is the angle between the lifting surfaces and the oncoming airflow. Generally, this can be expressed as the pitch angle minus the flight path angle. For instance, an aircraft that is pitched 10 degrees up but climbing on a 7 degree slope has an angle of attack of 3 degrees, at least in theory (assume spherical cow, etc, etc).
The angle of attack, or AOA, is crucial for flight because it’s a key component of the lift equation, and thus a higher angle of attack results in more lift, up to a point. Above that point, the air stops flowing smoothly over the upper wing surface, lift decreases dramatically, and a stall occurs, causing the airplane to fall from the sky. Therefore, the first angle of attack sensors were developed primarily with the intention to warn the flight crew if that point is approaching. On some conventional airliners, especially very old, less computerized ones, this remains the main purpose of the AOA sensor — to feed angle of attack information to the stall warning system. Although most aircraft also have AOA indicators for the flight crew, these are not usually considered a primary or essential instrument.
On the other hand, heavily computerized aircraft — and fly-by-wire aircraft in particular — rely much more heavily on angle of attack data. The SSJ-100 is a fly-by-wire aircraft, meaning that the pilots’ side sticks are not directly connected to the flight control surfaces. Instead, moving the side stick sends a pitch or roll command to an array of flight computers that interpret how the control surfaces should move in order to achieve the aircraft state commanded by the crew, taking into account airspeed, configuration, and a whole host of other parameters, including flight envelope limitations, stability characteristics, and so on. How exactly this process works will be covered in more detail in Part 3. For now, it suffices to understand that the angle of attack data is used for two main purposes that are relevant to this story: first, to apply a correction to the measured ambient (or static) pressure, used in calculating altitude and airspeed, in order to account for differences in airflow across the static pressure sensors at different angles of attack; and second, to inform the fly-by-wire system’s flight envelope protections, so that they can act to prevent the angle of attack from ever reaching the stall threshold.
In order to supply vast quantities of verified and trustworthy data to the fly-by-wire system, the SSJ-100 has three redundant air data systems, or ADSs, each of which collects raw information from sensors, including static pressure sensors, dynamic pressure sensors (pitot tubes), angle of attack sensors, temperature sensors, and so on; processes the data into a usable format; checks it for validity; and distributes it to aircraft systems, including the fly-by-wire system. The captain’s instruments by default use air data from ADS 1; the first officer’s from ADS 2; and the standby or backup instruments from ADS 3, while the fly-by-wire system uses consolidated parameters derived from all three ADSs in order to ensure the highest level of parametrical integrity.
This redundancy is possible because each ADS has its own set of sensors. In the case of AOA, ADS 1 receives angle of attack data from the №1 AOA sensor on the left side of the aircraft, while ADS 2 receives data from the №2 AOA sensor on the right side. These two AOA sensors are considered the “primary” sensors because their data is directly incorporated into the instrument indications normally used by the flight crew. However, ADS 3 — the standby system — has not one but two AOA sensors, one on each side of the airplane, bringing the total to four.
Each individual AOA sensor consists of a vane attached to a rotating shaft with a range of motion of approximately ±40 degrees. As the airplane flies through the air, the vane rotates to align with the local airflow. The position of the vane is measured by a resolver and transmitted to the corresponding air data computer (ADC), which applies a correction algorithm to convert the vane position into the actual aircraft AOA.
The AOA sensor shaft rotates inside a set of bearings, which are contained within a housing. The housing, the shaft, the bearings, and the vane collectively make up the single unit that is the AOA sensor. If a problem with an AOA indication is identified, technicians can simply remove the faulty unit and replace it with a correctly functioning unit.
Each AOA sensor fits into a prefabricated opening in the associated fuselage skin panel. The nature of this attachment is spatially complex, but it’s also beyond critical to this story, so bear with me here.
The element that fixes the AOA sensor in place within this opening is a part called the “overlay” (Ru: накладка). The overlay is a circular piece of metal, slightly wider than the fuselage opening, with a small circular cutout in the center to accommodate the protruding vane. Around the inner circumference of the overlay, five holes are drilled to accommodate five screws that affix the overlay to the housing, while allowing the shaft and vane to rotate freely. At the same time, the outer circumference of the overlay features 15 holes, spaced 24 degrees apart, that correspond to 15 equally spaced holes around the outside of the opening in the fuselage skin. The AOA sensor and overlay are therefore inserted together into the opening, with the holes in the overlay aligned with the holes in the fuselage skin, and affixed in place by 15 screws. A cover, also featuring a center cutout for the AOA vane, is then placed over the entire area and secured by 6 bolts, corresponding to 6 bolt holes on the fuselage skin. The diagram below shows all these parts and their relationships to one another, identified by numbers that match to the key in the image caption.
It must be noted that while the fuselage skin, the cover, and the overlay are all manufactured by UAC, the AOA sensor itself — like all the SSJ-100’s avionics — is an off-the-shelf Thales product. Therefore, UAC had to decide at the design stage how to incorporate the Thales AOA sensors in a manner that would support proper functioning of the sensor, comply with safety regulations, and permit replacement of the unit by maintenance personnel.
Perhaps the earliest link in the chain of events leading to the accident was UAC’s decision not to establish specific guidelines for where the first of the 15 attachment holes on the fuselage panel should be drilled. As a result, the exact positions of the attachment holes were different on every individual fuselage, even though the number of holes and the spacing between them was always the same. But that meant that the corresponding holes on the overlays couldn’t be drilled systematically either. After the five attachment holes for the sensor housing were drilled into the overlay, the 15 outer attachment holes had to be drilled in such a way that when they were lined up with the 15 corresponding holes on the fuselage, the AOA sensor housing would also be aligned with the aircraft’s “structural horizontal.” This is because tilting the unit even slightly off its intended axis will introduce a systematic error across all measured angle of attack values. Since the angle of attack is (in simplified terms*) the angle of the airflow relative to the aircraft’s horizontal axis, the “zero point” of the vane’s range of motion must be aligned with that axis or else the vane will measure against the wrong baseline.
*Technically, wing angle of attack and fuselage angle of attack are slightly different things. But for the purposes of this explanation, we don’t need to get into that.
Considering the fact that the attachment holes were aligned slightly differently on every fuselage, while the AOA sensors had to be installed at the exact same angle every time, UAC ended up having to make custom overlays not only for each aircraft, but for each installation location on each aircraft as well. UAC did this by drilling the 15 attachment holes around the edge of the overlay first, then screwing the overlay into place on the fuselage. Then, once the overlay was in place, an optical guide device was used to determine where to drill two small holes designed to accommodate a pair of “guide pins” on the sensor housing. The purpose of the guide pins is to ensure that there is only one possible way to attach the overlay to the sensor. Using the optical guide device, the machinists had to ensure that the axis formed by the two guide pin holes would be offset from the aircraft’s vertical axis by exactly 8˚42’ (±6’) counterclockwise on the left side of the plane and clockwise on the right side. Only with the guide pin axis at this angle will the AOA sensor read zero when the angle of attack is zero degrees.
Once the guide pin holes were drilled, the optical guide device was used again to the drill the five attachment holes for the sensor housing in the correct positions relative to the guide pin holes.
Of course, if the positions of the attachment holes on the fuselage had been standardized from the start, then the overlays could have been mass-produced. Instead, this process ensured that no two overlays had exactly the same relative alignment between the sensor housing attachment holes and the fuselage attachment holes.
This might not have been the most optimal manufacturing technique, but it shouldn’t have presented any maintenance or supply issues per se. The overlay is a static part that should last many times longer than the aircraft itself, so there should be no need for maintenance personnel to ever replace it. However, the process of replacing the AOA sensor necessarily involves removing the overlay and then reinstalling it later, which is where things start to get problematic.
At some point during the design process, it must have been realized that while the guide pin holes ensure that there is only one way to attach the overlay to the sensor, there are still 15 different ways to attach the overlay-sensor assembly to the fuselage. If you put the overlay up against the fuselage and line up the holes, that means nothing, because if you rotate it 24 degrees left or right, the holes will line up again, and after a further 24 degrees they line up yet again, and so on and so forth, all the way around the circumference of the assembly. The most reliable solution to this problem would be to design some kind of asymmetry in the pattern of attachment holes, such that the holes would only line up with the overlay in the correct orientation. But that was not done in this case. Instead, UAC’s solution was to add a step in the maintenance manual procedure for removing the sensor, calling for the technician to draw a mark across the overlay and the adjacent fuselage skin with a permanent marker prior to removing the overlay (as seen below). That way, whoever reinstalled the overlay could install it in its original orientation simply by lining up the two halves of the mark.
In 2013, after producing about 20 aircraft, UAC began applying this mark during the manufacturing stage. The maintenance procedure was concurrently revised to require technicians to re-draw the mark, even if it was already present, in order to prevent it from fading.
Although this was a crude solution to the problem, it proved fairly effective in practice simply because the instructions were easy to follow and it was obvious whether the two halves of the mark were aligned or not. But the question necessarily arises: what would happen if someone tried to install an overlay onto the wrong aircraft, or the wrong position on the right aircraft?
Because the overlays are unique to each installation location, installing them in another location where the orientation of the attachment holes is slightly different usually makes it impossible to line up the AOA sensor with the aircraft’s horizontal axis.
After the accident, the MAK carried out extensive testing on several SSJ-100s in order to determine what would happen if technicians swapped the left and right overlays, installing the left overlay on the right side and vice versa. They found, first of all, that it was possible to swap the overlays in this manner without causing the AOA sensor to obviously point the wrong way, simply by rotating the overlay 180 degrees before attaching the AOA sensor to it. Subsequently, the sensor-overlay assembly could be installed into the fuselage with the vane pointing in generally the right direction, but with an offset equal to the number of degrees difference between the attachment hole positions on the overlay’s intended location and its actual installation location. This could be anywhere from zero to 24 degrees and was unique on each aircraft. Furthermore, the difference in the size of the offset between the left and right sides was never more than about 3 degrees.
On some aircraft, this kind of mismatch was highly improbable because the marks couldn’t be aligned without rotating the AOA sensor too far from the correct position. If the vane is pointing in completely the wrong direction, most technicians will immediately recognize that something is wrong. And on some aircraft, the marks could not be aligned at all with the overlay in any orientation. But the MAK discovered that on certain aircraft, it was possible to align the marks and the attachment holes at the same time with the AOA sensor oriented close to the normal position. Whether this was the case entirely depended on where the marks on each side had been arbitrarily drawn by whoever first applied them.
In the process, the MAK also discovered that similar results could be achieved by installing an overlay face down instead of face up. The inner face of the overlay is covered with gray enamel while the outer face is covered with yellow primer and black sealant, providing a distinctive clue about the correct orientation, but there was nothing physically stopping someone from installing it the wrong way around. A technician attempting to install it this way will discover that there is no mark on the overlay to align with the mark on the fuselage. Attempting to install the overlay anyway will offset the sensor from the aircraft’s horizontal axis because the overlay is asymmetrical.
In order to exclude the possibility of installing the overlays on the wrong side of the aircraft, the maintenance manual carried a warning: “ATTENTION: Reinstall the overlay only onto the location on the fuselage skin from which it was taken.” However, this procedure couldn’t prevent technicians from installing the overlay inside-out. And as you’re probably guessing, it was fallible in other ways as well.
During research for this article, I sought to answer a question not posed by the MAK’s report: namely, whether the design of the AOA sensor installation complies with certification requirements. Since the FAA, EASA, and Russia’s Federal Air Transport Agency all have virtually identical regulations, I used the publicly accessible databases of the FAA and EASA in order to find out — keeping in mind that EASA certified the SSJ-100 in 2012 and revoked that certification in 2022.
FAA and EASA regulations both contain the following language: “Each element of each flight control system must be designed, or distinctively and permanently marked, to minimize the probability of incorrect assembly that could result in failure or malfunctioning of the system. The applicant may use distinctive and permanent marking only where design means are impractical.” (FAR 25.671)
As someone not trained in aircraft certification, I can’t be certain whether the angle of attack sensors on a fly-by-wire aircraft count as part of the flight control system. However, it is true that they provide data that forms part of the aggregated command signal sent to the flight control surfaces by the fly-by-wire system. Furthermore, the current FAA advisory circular describing how to comply with FAR 25.671 states that compliance for fly-by-wire aircraft includes an “evaluation of command signal integrity.” The circular lists factors that can adversely affect that integrity, including “corrupted sensor signals” and “frozen or erroneous values.” Therefore, in my unprofessional opinion, it seems plausible that regulators may consider the AOA sensors to be a flight control system element subject to FAR 25.671, and that measures to “minimize the probability of incorrect assembly” must be taken if that incorrect assembly “could result in a… malfunctioning of the system.”
If compliance with FAR 25.671 was required, then the preferred method of compliance was a design solution. However, there was no design element preventing incorrect assembly. Instead, UAC used markings, but it’s debatable whether these markings were “distinctive” or “permanent.” These markings did reduce the probability of incorrect assembly, but did they “minimize” it? I would argue that marking the overlays with the words “left,” “right,” and “this side down” would have been a lot better.
Most likely, UAC’s strongest argument for compliance was that the maintenance manual warning (“reinstall the overlay only onto the location on the fuselage skin from which it was taken”) effectively minimized the probability of incorrect assembly when implemented in combination with the marking system. But it turns out that under the conditions of modern Russian aviation, the assumptions underpinning that assessment were starting to erode.
Let’s resume the story on 20 March 2024, when RA-89029 was brought in for the 1C+5C check. For reasons that are left unstated in the report, Gazpromavia wanted to remove the two primary AOA sensors from this aircraft. Perhaps there was a problem with the sensors and they needed to be removed from service — we don’t really know. All we do know is that the sensors were given back to Gazpromavia and were never reinstalled on an aircraft.
Under normal conditions, maintenance technicians would retrieve two new AOA sensors from the stores, then replace the existing sensors one at a time. This ensures that the overlays are always put back where they came from, because there is only one spot to put them at any given moment.
But in this case, there was a complication: according to the MAK report, neither Gazpromavia nor the MOC had any spare AOA sensors for the SSJ-100 in stock. The reason for this shortage is left unstated, but the truth is written between the lines. Most likely, neither company was able to acquire surplus supply of a part that that was manufactured in France and was forbidden for export to Russia due to EU sanctions.
Without any new AOA sensors available to replace those removed from RA-89029, Gazpromavia and/or the Lukhovitsy MOC devised a scheme to keep the work on schedule. (It’s not entirely clear from the report whose idea this was, or whether it was an agreement between both companies.) The plan was to retain RA-89029 at the MOC until the next airplane came in for routine inspections, at which point technicians would remove the AOA sensors from that airplane and install them on RA-89029, allowing the latter to return to service. The second airplane, RA-89049, would then undergo the planned inspection and servicing, until the arrival of the next airplane, RA-89018. The sensors would then be removed from RA-89018 and installed on RA-89049, allowing it to depart as well. In other words, they arranged a bucket brigade, only with airplanes instead of firefighters and AOA sensors instead of buckets.
It’s not clear from the report whether Gazpromavia intended for this bucket brigade to continue beyond RA-89018. However, my interpretation is that they always planned for it to end there. At the time the report was published in July 2025, RA-89018 was still parked at the MOC, suggesting that this aircraft has been withdrawn from service and is possibly being stripped for parts. Furthermore, current sources list only 7 aircraft in Gazpromavia’s SSJ-100 fleet, as opposed to 9 aircraft before the accident.
The events that occurred during this “bucket brigade” involved a cast of five characters. These individuals are identified in this article as follows:
· Technician 1: A 28-year-old level 4 technician who had been working for RAC MiG since the age of 16, except for a year in the armed forces.
· Technician 2: A 49-year-old level 6 technician, who originally qualified in 1994 and briefly worked as a technician, left for two decades, and returned in 2015 to work for RAC MiG.
· Technician 3: A 36-year-old level 4 technician who had been working at RAC MiG since 2007.
· Technician 4: A 27-year-old level 4 technician who had worked for RAC MiG since 2016.
· The Section Foreman: A 30-year-old who had worked for RAC MiG since 2012, except for a year in the armed forces.
Between 20 March and 22 March 2024, Technician 1 removed one AOA sensor from RA-89029 under the supervision of Technician 2, who was qualified to provide oversight. Later, the other AOA sensor was removed by Technician 3 under the supervision of the Section Foreman.
On 02 May, after RA-89049 arrived at the MOC, Technician 4 removed both AOA sensors from that aircraft, under supervision of the Section Foreman, and transferred them to stores. The overlays were presumably placed in stores at that time as well. Because both sensors were needed for installation on RA-89029, and RA-89018 hadn’t arrived yet, the usual practice of only removing one overlay at a time could not be followed.
On 04 May, Technician 2, under supervision of the Section Foreman, installed both AOA sensors from RA-89049 onto RA-89029. The installation would have involved retrieving the AOA sensors from stores; mating each one to the correct overlay; applying paste to the attachment screws; greasing the washers; re-applying primer, enamel, and sealant; hooking up the electrical connection; attaching the overlay to the fuselage; applying more sealant; and installing the cover. The full procedure from the maintenance manual is shown below.
On 06 May, RA-89029 was declared fit for service, and two pilots arrived to reposition it to Vnukovo. But data later showed that as the aircraft sped down the runway, the angle of attack provided to the №1 air data system by the left AOA sensor suddenly spiked to values as high as 7.2˚. This was obviously impossible, because during the takeoff roll prior to rotation, the pitch angle and the flight path angle are both zero, and therefore the angle of attack should be zero as well. In fact, investigators would later determine that the AOA values provided by ADS 1 were systematically too high throughout the entire flight.
During the climb, several fault messages appeared on the Electronic Warning Display (EWD) in the cockpit, including NAV ADS 1 FAULT, NAV BARO REF DISAGREE, and NAV ALT DISAGREE.
While each individual set of instruments receives data from a single air data system, the fly-by-wire system uses parameters consolidated from all three systems in order to ensure redundancy. The flight computers constantly compare the outputs of the three data sources, and if one system produces parameters that differ considerably from the other two, then the faulty ADS will be isolated from the fly-by-wire system to contain the erroneous data. Rejection of an ADS in this manner generates a NAV ADS (1)(2)(3) FAULT on the EWD. The exact rejection criteria for airspeed and angle of attack will be discussed in Part 3.
On RA-89029, the erroneously high AOA reading from ADS 1 resulted in an improper correction being applied to the №1 static pressure, which in turn caused a difference in the barometric altitude data being provided by ADS 1. This resulted in the additional alert messages “NAV BARO REF DISAGREE” and “NAV ALT DISAGREE.”
As soon as the difference in AOA or altitude between ADS 1 and the average of all three ADSs exceeded a threshold value, ADS 1 was rejected by the flight computer and its data were no longer used to develop control surface commands. In response to the alert messages, the crew used the captain’s air data source selector to change the air data source for his instruments from ADS 1 to ADS 3, and then turned ADS 1 off. No further problems were encountered and the flight was continued to its destination.
After the aircraft arrived at Vnukovo, technicians carried out diagnostic maintenance. According to the records of this maintenance, the failure did not reappear after rebooting the computers. However, the MAK found that the angle of attack data from ADS 1 had a systematic error throughout the entire flight of approximately +8.2 to +8.3 degrees, which is more likely the result of an installation error than a computer error. When investigators examined the airplane, they found all the AOA sensors installed correctly — but while testing possible scenarios, they discovered that if the left AOA sensor overlay from this aircraft was installed face down instead of face up, the sensor vane would be displaced from the aircraft’s horizontal axis by +17 degrees. After the correction algorithms were applied, the total angle of attack error with the sensor in this position would come out to about 8.5˚ ±0.2˚. (See previous diagram.)
The MAK also noted that the manner of sealant application on the left and right primary AOA sensors on RA-89029 was very different, despite the fact that both were officially installed by Technician 2. On this basis, the MAK speculated that the left sensor may in fact have been installed by someone else whose role was not documented. The report doesn’t say whether this means that a person other than Technician 2 mistakenly installed the overlay face down, or whether the removal and reinstallation process was repeated during the troubleshooting at Vnukovo. My assumption is the latter, because the overlay must have been removed and then reinstalled correctly before the next flight, or the problem would have reoccurred. The technicians who did so might not have even realized anything was wrong, because simply following the procedure in the maintenance manual for removal and reinstallation of the sensor would have solved the problem even if they were unaware of it. The procedure also includes applying new sealant, which could explain why the sealant on the left overlay seemed to have been applied by a different person. For whatever reason, this work was not recorded in the troubleshooting log, and rebooting the computers was listed as the corrective action. The incorrect installation was not identified or reported.
Following the 06 May departure of RA-89029, its sister ship RA-89049 underwent a battery of checks, designated 2A+4A+1C+2C+5C. During this time, it sat there with no primary AOA sensors and both overlays removed.
Records from the part stores showed that on 06 July, Technician 2 went to the stores and retrieved two “AOA sensor hatches.” Officially this refers to the sensor covers, which were presumably removed from RA-89049 back in May, alongside the overlays. There was no record of anyone retrieving the overlays themselves. Also, the separate parts catalog stated that the covers were kept in stores until 08 July, two days after Technician 2 supposedly retrieved them. This discrepancy was not resolved.
On 07 July, after the arrival of RA-89018, Technician 1 removed both AOA sensors from that aircraft under the supervision of Technician 2 and took them to stores.
On 08 July, records showed that Technician 1 obtained the work order pertaining to the installation of two AOA sensors on RA-89049. Documentation also showed that Technician 2 went to the stores and retrieved the two AOA sensors removed from RA-89018 the previous day. However, only one AOA sensor was ever signed for.
Technician 1 stated that he installed only the left AOA sensor on RA-89049 on that day, under supervision of Technician 2. He stated that the marks lined up and he had no difficulty installing the overlay.
An attachment to the work order stated that both AOA sensors were installed that day, but this was false. A further breach of protocol occurred as neither technician returned the second AOA sensor nor any of the tools to stores at the end of the work day.
On 09 July, Technician 1 was absent from work. Even though the work order listed Technician 1 as the responsible party, Technician 2 decided to finish the work himself. After obtaining the required parts, he applied sealant to the left AOA sensor, then attempted to install the right sensor. However, he stated that he had difficulty installing the overlay because there were multiple marks in different colors, and it wasn’t obvious which marks he was supposed to line up. Eventually he was able to align two black marks, after which he completed the installation successfully.
The MAK would later discover that Technicians 1 and 2 installed the left and right overlays on the wrong sides of the aircraft. The inherent fallibility of the marking procedure allowed them to align the marks even though the overlays were not in the correct positions. However, the investigators were unable to determine where and when the mix-up occurred — whether it was before the overlays were submitted to the stores, while in storage, or after they were retrieved. Apparently no information about the storage of the overlays was ever written down, nor is there any evidence that steps were taken to ensure that each overlay was reinstalled in the same position from which it was taken, as required by the maintenance manual.
On 10 July, Technician 1 returned to work to find that Technician 2 had completed the installation. It doesn’t appear that Technician 2 was supervised by anyone, nor was he officially recorded as the performer of the work.
The MOC’s official standards document stated that any “installation and adjustment work” should be subject to a post-work quality inspection. However, the associated task card was never filled out and no inspection was ever performed. The inspection procedure is not described in the MAK report, but if it included a check of the sensor installation angle — which I should hope it does — then the mistake would have been detected.
One topic that the MAK report doesn’t cover is the training received by the technicians. The report points out that out of four AOA sensors installed by this team in 2024, three were installed incorrectly. Nevertheless, investigators found no record of any previous cases of systematically erroneous angle of attack indications on the SSJ-100, which suggests that these installation errors had never been made prior to RA-89029. Furthermore, RA-89049 was only the 25th aircraft ever to undergo servicing at the Lukhovitsy MOC. All of these facts raise questions about how the maintenance staff were retrained when the facility began maintaining SSJ-100s in 2021, but as of this writing, none of those questions have adequate answers.
In any case, unaware that they had made a potentially catastrophic error, the maintenance crew finished preparing the aircraft on 11 July, and the following day it was released for service. Despite the technicians’ successful attempts to align the markings, the left AOA vane was in fact offset from the aircraft’s structural horizontal by +9 degrees, while the right AOA vane was offset by +11–12 degrees, resulting in a true angle of attack error of approximately +4–5 and +5–7 degrees respectively.
With the covers placed over the overlays, it would have been all but impossible to notice that the AOA sensors were installed incorrectly. The MAK even tracked down a photograph of RA-89049, taken on the 12th of July 2024, but when they tried to test whether the AOA sensor installation angle could be determined from the photo, they found that this was impossible. Because the AOA vanes can rotate freely into any position in their ±40 degree operating range during pushback and taxi, the position of the vane as viewed by an outside observer has no detectable relationship to the sensor installation angle. In other words, there was no way for anyone to catch the mistake until the airplane started moving.
And so the stage was set for an epic battle between man and machine — one in which neither would emerge the winner.
◊◊◊
Part 3: The Men and the Machine
Around midday on 12 July, an unsuspecting flight crew arrived at Tretyakovo Airport to reposition RA-89049 to Vnukovo Airport.
In command was 53-year-old Captain Yevgeniy Bulavko, an experienced pilot who had risen from the rank of navigator, accumulating 13,220 flight hours in the process, including over 5,000 on the SSJ-100.
His first officer that day was 53-year-old Vladislav Kharlamov, whose 12,518 total hours and 4,000 on the SSJ-100 made him almost as experienced as Captain Bulavko. Neither pilot had any record of training difficulties, and they had both successfully completed many emergency drills involving unreliable air data during recurrent training. There was no evidence of any discrepancies in Gazpromavia’s training program or in the pilots’ career progression.
Also on board was a third individual, identified as flight attendant Maksim Lukmanov. Why he was on this flight is not stated in the final report nor in any news reports that I was able to locate. I’m sure there was a good reason; I just don’t know what it was.
The three men boarded the aircraft at around 14:15, after which the pilots completed all pre-flight checks in accordance with standard operating procedures. The crew also obtained the latest weather information, conducted a detailed pre-flight briefing, started the engines, and ran through the full battery of control checks. All control surfaces responded normally and no instrument indications suggested any abnormality.
At 14:48, RA-89049 departed the stand, operating as flight 9608. The crew taxied to the head of the southeast-facing runway 10, where they set the stabilizer to the correct takeoff position and entered the calculated takeoff speeds into the flight management system. An initial climb altitude of 5,000 feet was also set.
At 14:52:58, the Tretyakovo air traffic manager cleared them for takeoff. Captain Bulavko handed control to First Officer Kharlamov, who acknowledged. He then set engine thrust to the calculated takeoff setting and engaged the autothrottle. “Flexible takeoff thrust 86% set,” Bulavko called out.
As the airplane accelerated down the runway, the airspeed indicators came alive, followed by the angle of attack indicators at 60 knots. But where the AOA should have read zero, the left AOA spiked to 3.8˚, while the right jumped to 4.8˚. These values increased to 4.2˚ and 5.9˚, respectively, as the airplane accelerated. However, monitoring the angle of attack indications isn’t part of the normal takeoff instrument scan, nor are the indications particularly eye-catching, so neither pilot noticed.
At 100 knots, Captain Bulavko called out their airspeed, followed five seconds later by “V1, rotate.” First Officer Kharlamov pulled back on his side stick and the nose rose into the air, followed by the main wheels. “Positive climb,” Bulavko declared.
“Gear up,” Kharlamov replied.
“Gear up,” Bulavko acknowledged, retracting the landing gear.
Eleven seconds after liftoff, at a height of 445 ft, Kharlamov called for the autopilot, and Bulavko flicked it on, calling out, “Autopilot engaged, check.”
Although they didn’t know it yet, the flight was about to experience a rapidly cascading sequence of events that requires considerable technical background to understand. Within 5 minutes, it would all be over — but first, we need to meet the math behind the machine.
◊◊◊
The SSJ-100 fly-by-wire system works in much the same way as the standard Airbus fly-by-wire system. My article on Aeroflot 1492 goes into more detail about how fly-by-wire systems work in general; for this article, I’ll briefly describe the concept before getting into the details relevant to this story.
When the pilot of the SSJ-100 deflects the side stick left or right, for instance, they are commanding a particular roll rate. The flight computers then calculate how to deflect the ailerons in order to achieve that rate under the current conditions. If the airspeed is high, less aileron deflection is needed; conversely, more is needed if the speed is low — but the pilot doesn’t have to worry about this, because the computers ensure that the response of the aircraft to a given input is always about the same.
Deflecting the side stick forward or aft commands a particular load factor. When a moving vehicle changes direction suddenly, you feel a pull, which is a “load,” often expressed in terms of G-force equivalent. In straight and level flight, the load factor is 1, or 1 G — normal earth gravity. When an airplane transitions to a climb, the load factor increases, which the occupants experience as a force pressing them down into their seats. The faster the transition, the higher the load factor. Therefore, if the pilot deflects the side stick aft and holds it there, the airplane will pitch upward continuously in order to maintain a constant load factor greater than 1. When the pilot relaxes the side stick, the pitch will stop changing. If they now want to reduce the pitch, the pilot should push forward on the side stick to command a negative load factor. The larger the side stick deflection, the larger the load factor, and the larger the pitch rate.
The system also incorporates flight envelope protections that include both soft and hard limits on airspeed, angle of attack, pitch angle, bank angle, and load factor. For example, if the pilot holds the side stick all the way to the left, the bank angle will increase up to a hard limit, but no further. If the pilot relaxes the side stick, the bank angle will decrease and stabilize at a lower soft limit. Active deflection of the side stick is required to achieve bank angles above the soft limit and below the hard limit.
By contrast, the high airspeed limiting function doesn’t have a soft limit. Instead, if the airspeed increases above the maximum operating speed of 308 knots, or VMO, the system will intervene by automatically deploying the speed brakes, which pop up from the wings to increase drag and reduce speed.
The angle of attack limiting function is more complex. As the angle of attack increases, the function activates in stages corresponding to certain thresholds, called “alpha linear,” “alpha prot,” “alpha floor,” and “alpha limit.”
Alpha linear is the AOA above which the derivative of the lift coefficient becomes non-linear. You don’t need to know what that means, but it is worth noting as the point where an angle-of-attack-related coefficient begins to be applied to the pitch command signal for purposes of stability augmentation only.
Alpha prot, short for “protection,” is the point at which the angle of attack limiting function kicks in. This function applies a reducing coefficient to the pitch command in order to prevent the angle of attack from reaching the hard limit, which is alpha limit. The size of the coefficient is whatever the function needs it to be in order to accomplish that goal, taking into account factors such as pitch rate.
Alpha limit, as I just said, is the absolute maximum, equivalent to “alpha max” on the Airbus A320. The pilot can theoretically achieve alpha limit only by holding the side stick fully aft, and no matter how long they hold it there, the angle of attack limiting function will not allow the AOA to increase any further. Releasing the side stick will cause the angle of attack to reduce to alpha prot.
Alpha limit is defined as one degree below the angle at which the stall warning will activate, which is itself some distance below the actual stall angle of attack. The value of alpha limit changes depending on the flap setting and Mach number (speed expressed as a percentage of the local speed of sound), with the lowest values of alpha limit occurring with flaps retracted and a high Mach number. This is because these two factors reduce the stall AOA.
Now, you might have noticed that I said alpha limit can only be reached “theoretically.” That’s because the actual limit value used by the angle of attack limiting function is not actually alpha limit. According to the MAK report, a margin exists between the actual highest allowable angle of attack and alpha limit, depending on certain dynamic factors not enumerated therein. Presumably this is to prevent the AOA from exceeding alpha limit in case of rapid aircraft movements that exceed the response capabilities of the limiting function.
Lastly, alpha floor is an angle of attack between alpha prot and alpha limit where a separate function automatically commands an increase in engine thrust. The purpose of this function is to increase the aircraft’s energy state, helping reduce the AOA required to maintain lift. However, this function doesn’t play a direct role in this story.
The authority of the flight envelope protections is incontrovertible when the fly-by-wire system is in Normal Mode; the pilot cannot override them. If the data that the fly-by-wire system uses to support these functions becomes invalid or unavailable, then the system may switch to Direct Mode, either automatically or by manual selection. In Direct Mode, the flight envelope protections are unavailable and a direct relationship is established between side stick deflection and control surface deflection. Switching to Direct Mode is generally considered an option of last resort as it makes the aircraft considerably more difficult to fly.
◊◊◊
I also want to discuss how the pitch command signal is assembled in Normal Mode. By pitch command signal I mean the electronic signal that actually gets sent to the actuator control units to tell them how much to deflect the elevators. The components of this signal include but are not limited to:
· A coefficient (positive or negative) derived from the side stick position;
· The load factor commanded by the side stick;
· Positional feedback, in order to make the command proportionate to the existing load factor and pitch rate;
· Angle of attack feedback when the angle of attack is above alpha prot, in order to prevent the AOA from reaching alpha limit;
· And pitch feedback from the high pitch limiting function.
Collectively, the signal components ensure that the airplane reacts to the pilot’s inputs in the desired manner, without overshooting or undershooting, and without exceeding any flight envelope limitations.
The above components are only those involved in deflecting the elevators. Pitch control is also effectuated by the trimmable horizontal stabilizer, which determines the pitch and speed combination at which the airplane is stable when no control inputs are being applied. A separate algorithm causes the stabilizer to “follow” the elevators using a so-called integral loop in order to ensure that the airplane remains at the last commanded pitch when the pilot relaxes the side stick.
The fly-by-wire system on an aircraft like the SSJ-100 doesn’t rely on a single sensor, like Boeing’s infamous MCAS did. Instead, as I mentioned earlier, it integrates parameters from all three air data systems. In the case of angle of attack, the system uses a “consolidated AOA” equal to the average of the AOA outputs from ADS 1, 2, and 3. The value of each individual output is then compared to the median value, and if the difference exceeds a certain threshold, the data source is rejected as faulty, a NAV ADS (1)(2)(3) FAULT message appears on the EWD, and the fly-by-wire system continues to operate using a consolidated AOA equal to the average of the remaining two data sources. The exact rejection threshold decreases as airspeed increases, from 7.5 degrees at 100 kts to 3.0 degrees at the maximum operating speed (VMO). This rather large allowable variance is necessary in order to account for local angle of attack differences that can occur while maneuvering; for example, if the aircraft is in a sideslip.
Similarly, the fly-by-wire system uses a consolidated airspeed value equal to the average of the airspeed values provided by the three air data systems. If the difference between any two airspeed values exceeds 10 knots, then one of two things can happen.
If, say, ADS 1 is providing an airspeed more than 10 kts different from both ADS 2 and ADS 3, then ADS 1 is identified as faulty, its data are rejected, a NAV ADS 1 FAULT message appears on the EWD, and the fly-by-wire system switches to using the average of the two remaining airspeeds. This is what happened on RA-89029, and it’s called an “unambiguous fault.” But if, say, ADS 1 is more than 10 kts different from ADS 3, but ADS 2 is within 10 kts of both ADS 1 and ADS 3, then this is considered an “ambiguous fault” because the fly-by-wire system doesn’t know which ADS is faulty. In that scenario, a NAV ADS DISAGREE message appears on the EWD, prompting the crew to apply the “unreliable airspeed” procedure, which provides them with tools to determine which ADS, if any, is faulty.
Because this is really important, I’ll provide a more concrete example (courtesy of the MAK): if the outputs of ADS 1, 2, and 3 are 200 kts, 212 kts, and 215 kts respectively, then that’s an unambiguous fault with ADS 1. And if the outputs are 200 kts, 209 kts, and 211 kts, respectively, then that’s an ambiguous fault and flight crew action is required to identify the culprit.
There is also a special logic that kicks in if none of the three ADS airspeeds are within 10 kts of any of the others, but that’s outside the scope of this article.
◊◊◊
Returning to flight 9608, at 14:53:49 the autopilot was engaged. The autopilot has lateral and vertical channels that run separate modes, some of which are coupled to the autothrottle. At the moment of engagement, the autopilot’s lateral channel was in LNAV mode, which commands the airplane to follow the track programmed into the flight management system — in this case, the RILPO 1B Standard Instrument Departure. Seconds later, the vertical mode was set to Climb (CLB), which is a speed-on-pitch mode, meaning that the autopilot will maintain the airspeed selected by the crew by increasing pitch to slow down and decreasing pitch to speed up, while thrust remains constant. In Climb mode, the autothrottle automatically enters thrust hold mode (THR) with the engines at climb power.
It should be noted that the SSJ-100, like modern Airbus models, has thrust levers that act as engine operating regime selectors when the autothrottle is engaged. The flight crew simply places the levers into the desired regime — idle, cruise, climb, flex takeoff, max climb, takeoff/go-around (TOGA), or max thrust* — and the autothrottle determines how much thrust is needed, within the boundaries of the selected regime.
*Note: This regime is unique to the SSJ-100 and does not appear on any Airbus.
Moments before engaging CLB mode, Captain Bulavko said, “We agreed to reduce the vertical speed, Vlad.”
“Ah, got it, right now,” First Officer Kharlamov replied.
“Well, switch to climb and rein in the speed,” said Bulavko.
“Climb,” Kharlamov called out as he set climb mode. Seconds later, he added, “Speed.”
“Selected,” Bulavko announced, setting an airspeed of 148 knots using the flight control panel.
“Speed, climb,” Kharlamov repeated.
“Put 1,500, vertical speed,” said Bulavko.
“Vertical 1,500 set,” said Kharlamov. He reached over and switched the autopilot’s vertical mode from Climb to Vertical Speed (V/S).
In Vertical Speed mode, the autopilot pitches up or down to maintain a selected climb or descent rate — in this case, 1,500 feet per minute — while the autothrottle switches to speed hold mode (SPD) and modifies engine thrust as required to achieve the selected airspeed.
“Oh, perfect, and what are we climbing to?” Bulavko asked.
At that moment, a chime sounded, and a message appeared on the EWD: “DOORS FWD (L) HATCH NOT CLOSED.” The procedure associated with this message, according to the pilots’ Quick Reference Handbook (QRH), is to check whether the airplane is pressurizing properly, and if it is, to disregard the message.
“Left door hatch(er) not closed,” Bulavko said in English.
“Check,” said Kharlamov.
“What the hell do we have here?” Bulavko mused.
A few lines of unintelligible dialogue followed, after which the crew dismissed the alert. The airplane was pressurizing normally, so the caution was evidently erroneous. The cause of the false door open caution is not explained in the MAK report, but small glitches like this are not uncommon after major maintenance.
As the aircraft proceeded through its left turn after takeoff, Captain Bulavko told First Officer Kharlamov to switch the autopilot’s lateral channel to Heading mode (HDG) in anticipation of instructions from air traffic control. Kharlamov engaged heading mode and selected a heading of 004 degrees. A short time later, he reduced the selected vertical speed to about 1,000 feet per minute in order to begin accelerating so they could retract the flaps. Moments later, at 14:54:56, Kharlamov called, “Flaps 1.”
“Flaps 1,” Bulavko repeated as he moved the flap lever from the FLAPS 2 position, used for takeoff, to the intermediate FLAPS 1 position. Moments later, he instructed Kharlamov to hold the speed at 180 kts, which he did.
At 14:55:17, the flaps finished retracting into the FLAPS 1 position. At that exact moment, a chime sounded in the cockpit, and the message NAV ADS DISAGREE briefly appeared on the EWD.
Up until this point, the erroneous angle of attack values from ADS 1 and 2 had not materially affected the flight because the difference between the three AOA readings was below the rejection threshold. However, because an AOA-based correction is used when computing airspeed, ADS 1 and 2 were also providing airspeed and altitude data that was slightly too low, with ADS 2 being slightly more severely affected. Meanwhile, ADS 3 was providing accurate data. But as the airspeed increased, the difference between ADS 3 and ADS 2 also increased until the discrepancy reached 10 kts. However, the difference between ADS 3 and ADS 1 was still less than 10 kts, leading to an “ambiguous fault” scenario. As a result, none of the ADSs were rejected, and the crew was prompted to begin troubleshooting by the appearance of a NAV ADS DISAGREE message.
Because the airplane was now maintaining the selected airspeed of 180 knots, it did not continue to accelerate, and the airspeed discrepancy remained right at the 10 kt threshold. As a result, very tiny variations in airspeed caused the difference to rise and fall randomly above and below 10 kts, repeatedly removing and then re-establishing the NAV ADS DISAGREE condition. Each time the conditions were met, the NAV ADS DISAGREE message appeared and a chime sounded, while each time the conditions stopped being met, the message changed from amber to white for five seconds, indicating the fault was no longer present, before disappearing. Each activation lasted about 1 to 4 seconds.
As this was occurring, Captain Bulavko called Domodedovo Radar control and secured authorization to turn left to heading 260 and climb to 10,000 feet, provided that approval from the Tretyakovo tower was also acquired. This conversation lasted 34 seconds, during which the NAV ADS DISAGREE message appeared 12 separate times.
As Bulavko signed off with Domodedovo, Kharlamov said, “So, heading 260 set.”
“Check,” Bulavko replied.
“Vertical speed one thousand,” Kharlamov continued, carefully ensuring that all flight parameters were correct.
“Check,” said Bulavko.
“Ah, speed 180,” said Kharlamov.
But instead of replying with “check,” Bulavko’s attention was suddenly drawn to the intermittent NAV ADS DISAGREE message. “NAV ADS disagree, what the hell is that?” he asked.
The Quick Reference Handbook (QRH) procedure for a NAV ADS DISAGREE condition calls for the crew to cross-check airspeed and altitude on both pilots’ primary flight displays (PFDs) and the standby display, which receive data from ADS 1, 2, and 3 respectively, in order to identify which indication is faulty. If the faulty ADS can be identified, the procedure is simply to turn it off and select a new data source for the affected instruments. But if it can’t be identified, then the pilots are directed to complete the “Unreliable Airspeed” procedure. Notably, the NAV ADS DISAGREE procedure does not call for the crew to check the angle of attack indications.
The unreliable airspeed procedure calls for the crew to first turn off the autopilot and autothrottle, then stabilize the flight path by setting a particular pitch attitude and engine thrust. During the intermediate climb phase, these values are 10 degrees pitch and Climb thrust. After stabilizing, they should level off and begin troubleshooting. The pilots are expected to execute the procedure from memory up to this point.
After leveling off, the procedure calls for the crew to reference a table of pitch, thrust, and angle of attack values (henceforth, the pitch/AOA/thrust table) in order to determine the actual airspeed. The idea is that the pilot will set a pitch, AOA, and thrust combination indicated on the chart, then cross-reference with their weight, configuration, and altitude to determine what the airspeed should be. That airspeed can then be cross-checked against the airspeed indicators to determine which one is most accurate. The procedure then provides numerous ways to troubleshoot a faulty airspeed or altitude, but it does not explain how to identify faulty AOA values or what to do if the AOA is incorrect.
Instead, the procedure instructs the pilots to maintain the desired “pitch/AOA,” under the assumption that in level flight the pitch angle and AOA are equal (AOA = pitch angle minus flight path angle; flight path angle = 0, therefore pitch = AOA). It then says to stabilize the speed, cross-check all speed indications, and if necessary reference the GPS or GLONASS speed and altitude as well. If an ADS is deemed reliable, the instruments should be configured to use it and any other ADSs should be turned off. But if the faulty ADS still cannot be identified, the crew should turn off all three ADSs in order to revert the flight control system to Direct Mode. The pitch/AOA/thrust tables and the radio and GPS altitudes can then be used to fly and land the aircraft with no airspeed or barometric altitude indications.
Although he didn’t call for the QRH procedure, First Officer Kharlamov evidently knew it already, as he began cross-checking the airspeed indications. “Disagree… eh, mine is 180. You have how much? 180… some caution is going on and off.”
“Hundred ninet…” Bulavko started to read off the standby display.
“190, 180,” Kharlamov said.
The indications were only 10 knots apart, exactly equal to the maximum allowable divergence, and the odd one out was the standby indicator. Furthermore, the intermittent nature of the NAV ADS DISAGREE message was not envisioned by the QRH procedure and would have struck them as odd. The MAK determined that at this point the flight crew most likely felt that the warning itself was erroneous, just like the open door indication they received just two minutes earlier. Therefore, they elected not to perform the unreliable airspeed procedure — at least, not yet.
Instead, with the airplane now level at 5,000 feet, Captain Bulavko proceeded to coordinate the climb to 10,000 feet on heading 260 with the Tretyakovo air traffic manager as they had planned. During this conversation, the NAV ADS DISAGREE message disappeared from the display, seemingly confirming the decision not to continue the procedure.
“89049, at 5,000 in your area of responsibility,” Bulavko reported. “We agreed to heading 260, further climb to 10,000 feet.”
“Roger, Moscow takes over, right?” Tretyakovo asked.
“No, Moscow takes over with your permission, if we start the climb in your sector and Moscow will take us,” said Bulavko.
“I have no objection, have a good flight and a smooth landing,” Tretyakovo replied. “Gazprom 9608, QNH pressure 1019.”
First Officer Kharlamov jumped on the radio to say, “Roger, all the best, goodbye,” while Bulavko simultaneously signed off with, “1019, Gazpromavia 9608.”
In the cockpit, Bulavko told off his first officer. “Don’t talk to them, you’re always doing that,” he said. As the pilot flying, it was not Kharlamov’s job to talk to air traffic control.
Bulavko then called Domodedovo and said, “Domodedovo, Gazprom 9608, the tower doesn’t object. On heading 260, continuing to… further climb 10,000.”
“Ah, why? Ah well, there — ” Kharlamov started to say, in response to Bulavko’s admonishment.
“Vlad, fly the plane,” Bulavko ordered.
“Got it,” said Kharlamov.
“Gazprom 9608, roger, on current heading with agreement from the tower, climb to 10,000 feet, QNH pressure 1019,” said Domodedovo.
“Climbing 10,000 feet, QNH pressure 1019, Gazprom 9608,” Bulavko acknowledged. To Kharlamov, he said, “Increase speed,” and Kharlamov set the selected airspeed to 230 knots. In response, the autothrottle increased engine thrust, and the airplane began to accelerate.
“Gazprom 9608, and tell me if you’re ready to immediately follow on to Vnukovo? And what altitude will you need?” Domodedovo asked.
“Yes, we’re ready for Vnukovo immediately, but we don’t have any need for higher than 10,” Bulavko explained.
During this conversation, the NAV ADS DISAGREE message appeared another eight times, ending at 14:57:12. After that, the message was never triggered again.
With everything apparently normal, Captain Bulavko set the flap handle to the flaps 0 position (fully retracted) and instructed the first officer to climb. Kharlamov then used the flight control panel to select an altitude of 9,000 feet and selected Climb mode in the autopilot’s vertical channel. He then reset the selected airspeed to 253 knots.
No one could possibly have predicted that in just 100 seconds, nothing of flight 9608 would remain but a smoking crater in a forest. What follows is a moment-by-moment account of those 100 seconds of confusion and terror.
◊◊◊
Part 4: Cascade
Up until approximately time 14:57:30, the erroneously high angle of attack values had had almost no material impact on the flight, other than skewing the airspeed and altitude slightly downward. The error of +4–5 degrees in ADS 1 and +5–7 in ADS 2 was insufficient to raise the consolidated AOA above the threshold of alpha prot, and the difference between the three AOA indications also did not exceed the threshold for rejecting any air data systems.
However, as you hopefully recall, the maximum permissible difference between the three AOA values decreases as airspeed increases.
When the pilots selected an airspeed of 230 knots, the autothrottle increased engine thrust to begin accelerating. During this time, the three angle of attack values were 9.05˚ in ADS 1, 10.46˚ in ADS 2, and 3.8˚ in ADS 3. At 206 knots, the maximum permissible AOA discrepancy is 5.22˚, decreasing to 5.11˚ at 211 knots. Therefore, somewhere between these two speeds, the threshold value decreased below the actual difference between ADS 3 and the median value, which was ADS 1. The system therefore rejected ADS 3 — the only air data system that was providing accurate information.
With ADS 3 rejected, it was dropped from the consolidated AOA, which became the average of ADS 1 and 2. Since the AOA from ADS 3 was much lower than ADS 1 and 2, this resulted in a sudden, massive increase in the consolidated AOA value being provided to the fly-by-wire system.
At the same time, the values of alpha prot and alpha limit were decreasing due to the retraction of the flaps. Between approximately 14:57:31 and 14:57:48, the value of alpha limit decreased from 13.8 degrees to about 9 degrees, and the other threshold AOAs — alpha floor, alpha prot, alpha linear — decreased proportionally. As this decrease was beginning, the consolidated AOA jumped to a value between 9 and 10 degrees due to the rejection of ADS 3, causing the AOA to instantly surpass alpha prot. In theory, and according to the manual, exceedance of alpha prot should disconnect the autopilot, but this actually occurs at a slightly higher value that coincidentally was not reached at that moment.
As soon as the AOA exceeded alpha prot, the angle of attack limiting function kicked in to prevent the AOA from reaching alpha limit. Since the value of alpha limit was actively decreasing as the flaps retracted, the limiting function began to apply angle of attack feedback to the elevator command signal in order to reduce the AOA and keep it below the rapidly shrinking alpha limit, causing the elevators to deflect in the nose down direction. As it is designed to do, the stabilizer followed this deflection, automatically moving from 3.2˚ nose up to 0˚.
As this was occurring, First Officer Kharlamov engaged Climb mode with a selected altitude of 9,000 feet, which should cause the airplane to pitch up and climb. But the autopilot was unable to deflect the elevators nose up because the AOA was already above alpha prot; the autopilot lacks the authority to increase it further. As a result, the autopilot entered Climb mode, and the autothrottle switched to thrust hold mode in the “max climb” (MCL) regime, but the aircraft didn’t climb — instead, it pitched over and began to descend while accelerating rapidly.
This autopilot behavior took the pilots completely by surprise. There had been no prior sign of trouble with the autopilot, and now suddenly it was doing the opposite of what they had commanded. There is no procedure in the QRH for this situation, nor would the pilots have encountered anything like it in training. They were in uncharted territory.
As the plane started to descend from 5,000 feet, First Officer Kharlamov’s first instinct was that he had selected the wrong mode, so he read off the flight control panel: “Wait, something, thrust, climb… Where is it going? Look!”
Since the autopilot appeared to be malfunctioning, he grabbed his side stick and pulled it fully aft in an attempt to counter the sudden descent. The aircraft correctly interpreted that he wanted to take control, and the autopilot automatically disconnected, accompanied by a loud alarm. Recognizing that Kharlamov was having difficulty flying the plane, Captain Bulavko immediately called out, “I have control” and pressed his sidestick priority button to transfer control to himself. He then deflected his side stick fully aft as well.
“You have control,” Kharlamov acknowledged, letting go of his side stick. “Look, our altitude is going somewhere,” he added. “Four… 4,500…”
As their airspeed rapidly increased, Captain Bulavko pulled the thrust levers back to idle to stop the acceleration, causing the autothrottle to disconnect. By this point the indicated airspeed was 280 knots, well above the selected value of 253 knots.
In response to Bulavko’s full nose up inputs, the elevators deflected slightly nose up, overcoming alpha prot and bringing the plane out of the descent. Since the pilot is allowed to increase the AOA up to a value near alpha limit using the side stick, the consolidated angle of attack was able to increase above alpha prot (about 7 degrees), but did not reach alpha floor (about 8 degrees). The actual AOA, calculated after the fact by the MAK, was never significantly above 3 degrees after this point. Nevertheless, this was sufficient to level the airplane.
At 14:58:00, eight seconds after taking control, Bulavko concluded that the airspeed must be unreliable and that this was somehow affecting the autopilot, so he called out, “Airspeed unreliable, Vlad.”
“Unreliable airspeed,” Kharlamov repeated.
“Tell [him] unreliable airspeed,” Bulavko instructed.
Kharlamov attempted to report unreliable airspeed to the Domodedovo controller, but amid the high stress of the situation, he forgot to switch radios, and he broadcast his call to Tretyakovo instead. In the background, Domodedovo called them repeatedly, receiving no answer.
At this time, Bulavko was performing the unreliable airspeed memory items. He had ensured that the autopilot and autothrottle were disconnected, he had gained control of the flight path, and now he increased thrust to the Climb regime while attempting to set 10 degrees of pitch. So far he was doing everything by the book, except that with his seemingly reasonable side stick inputs, he wasn’t able to achieve 10 degrees pitch. In fact, he could barely get the nose to come above the horizon. The unreliable airspeed procedure didn’t provide any guidance for the crew to follow if these actions failed to stabilize the flight path.
Unreliable airspeed was not in fact the problem, but given the previous airspeed discrepancy and the NAV ADS DISAGREE messages, it was a relatively reasonable assumption. His assumption was further supported by the sudden appearance of a NAV ADS 3 FAULT message on the EWD, triggered by the rejection of ADS 3. The pilots didn’t attempt to perform the procedure associated with this message, but it would have been a waste of time anyway — the procedure was just to turn the faulty ADS off.
“Look at the vert…” Kharlamov started to say. “Look! Ah, look, we have…”
“Need to increase the angle of attack,” Bulavko astutely observed.
This finally prompted Kharlamov to glance at the tiny angle of attack indicator on his display. This instrument isn’t normally used except in situations like this one, so it’s unsurprising that nobody thought to check it until now. But when he did check it, he realized to his surprise that it was showing a high AOA. “Look, look what the angle of attack is!” he exclaimed.
According to the Unreliable Airspeed QRH procedure, the pilot should increase thrust and maintain altitude if the AOA is higher than commanded. Captain Bulavko faithfully acted upon this recommendation, increasing thrust even further.
At this point, armchair pilots might start pointing out that with the pitch close to the horizon and the airplane in level flight, a high AOA is impossible, and that Bulavko should have recognized this. However, I think prior events and the procedures themselves had biased him to assume that it was the airspeed that was unreliable. Nothing in his training had led him to believe that an unreliable AOA from more than one ADS at the same time was even possible, nor did the procedures available to him account for such a possibility. As such, in a highly stressful situation, it makes sense that his first instinct was to attempt to apply the procedure he knew. This also explains why he didn’t attempt to use his full side stick authority to achieve 10 degrees pitch.
Of course, increasing engine power above Climb in a nearly empty aircraft in horizontal flight will cause the airspeed to run away very rapidly. Indeed, within seconds of his thrust increase, the airspeed accelerated through 300 knots and reached VMO, triggering the SSJ-100’s high airspeed protection. At 14:58:22, the speed brakes started deploying automatically, and a robotic voice began calling out, “OVERSPEED!”
Captain Bulavko immediately responded by decreasing thrust, stopping the acceleration. The airspeed fell back below VMO, the speed brakes retracted, and the aircraft entered a very shallow climb, thanks to Bulavko’s sustained nose up inputs.
Still trying to figure out what was going on, First Officer Kharlamov again called out, “Look, we have a high angle of attack.”
Bulavko again responded by increasing engine thrust, in accordance with the unreliable airspeed procedure. At the same time, he racked his brain for some kind of answer. “Mayb — [unintelligible], because the mode is correct, so…”
“So, uh, look, this is…” Kharlamov started to say.
Suddenly, the answer hit Bulavko like a ton of bricks. “Is the angle of attack sensor not working or something?” he asked.
“Yeah and generally not [unintelligible]…” said Kharlamov.
At that exact moment, the airspeed again exceeded VMO due to Bulavko’s thrust increase, triggering the high speed protections again. The OVERSPEED callout started blaring and the speed brakes began to extend. However, the airplane did not slow down, causing the high speed protection to command more and more speed brake deflection. Within seconds, the speed brakes fully deployed, massively disrupting airflow over both wings. The MAK would later calculate that the lift produced by the wings was reduced by 67 to 68%.
Predictably, this massive loss of lift caused the plane to enter a descent. Captain Bulavko immediately responded by deflecting his side stick fully aft again, but the airplane did not respond.
The reasons for this were two-fold. The first is that the speed brakes produce a nose up moment as they extend, which the high speed protection counters by adding a pitch reduction component to the elevator command signal. This partially countermanded Bulavko’s pitch up input, but it was a transient factor.
The second reason was more insidious. The fact is that the flight path angle was now decreasing — and since angle of attack equals pitch angle minus flight path angle, the angle of attack necessarily increased, even though the pitch angle didn’t change. At the same time, the value of alpha limit was decreasing from 9 degrees to about 8.5 due to the plane’s increasing Mach number. Furthermore, as I mentioned in Part 3, the SSJ-100’s angle of attack protection function doesn’t always let the AOA actually reach alpha limit, with the exact margin depending on certain unspecified dynamic conditions. The result of all these factors was that the erroneous AOA increased to a value of 7 to 7.4 degrees, then stopped dead. Not only did the angle of attack limiting function block the AOA from reaching alpha limit, it didn’t even let it reach alpha floor. However, even if the AOA had reached alpha limit, this wouldn’t have been sufficient to stop the descent.
With the erroneous AOA already pinned at the max allowable value, Captain Bulavko’s full nose up input on the side stick was blocked by the AOA limiting function and had no effect whatsoever. The plane just kept pitching farther and farther forward, chasing its own flight path in a deadly, unstoppable feedback loop.
As flight 9608 accelerated toward the ground, Captain Bulavko yanked the thrust levers back to idle, but this had no effect, so he pushed them forward to TOGA. The overspeed warning sounded continuously, and the airspeed kept increasing far beyond VMO. Within seconds he returned the thrust levers to idle, but his panicked efforts were useless. Descending through 3,400 feet, the ground proximity warning system began to blare: “TERRAIN AHEAD! TERRAIN AHEAD! PULL UP! AVOID TERRAIN! WHOOP WHOOP, PULL UP!”
“Pull up! Pull up, pull up!” Kharlamov shouted.
“Pull up, Vlad!” Bulavko yelled. “What the hell is this!?”
Kharlamov frantically pulled his own side stick fully nose up, but this had no effect.
Trapped aboard a plane that had turned into a killing machine, the pilots saw the face of death rising before them. Death was not a hooded figure with a scythe, but a patchwork of fields and forests. Death was in the leaves and the branches and the meadows, and her hand was reaching out, pushing the plane inexorably downward, crushing their desperate attempts to pull away. It is difficult to comprehend the terror one must feel, to see the ground approaching, to pull up with all one’s might, only to receive no response from the airplane, as if locked in a bad dream. But it wasn’t a dream.
At 14:59 and 16 seconds, Gazpromavia flight 9608 slammed into a forest just west of the village of Apraksino, traveling at a speed of 365 knots, pitched 25 degrees nose down and banked 25 degrees to the right. The plane clipped the tops of several trees, sliced downward through the foliage, and plowed into the ground with tremendous force. Tiny pieces of what had seconds earlier been an SSJ-100 exploded outward, tumbling through the burning woods, consumed in flame.
All three occupants were killed instantly on impact.
◊◊◊
Part 5: After the Fall
Over the course of its year-long investigation, the MAK reconstructed the real AOA, airspeed, and altitude throughout the flight; tested numerous AOA sensor overlay installation scenarios; interviewed dozens of people; developed a mathematical model of the flight; carried out simulated flights on a UAC test bed; studied the responses of real pilots; and much more besides. They concluded that the probable cause of the accident was the violation of the maintenance manual procedures for installing the AOA sensors, leading to similar erroneous AOA values from two out of three air data systems, which in turn led to the simultaneous activation of the AOA limiting function and the high airspeed protection function, a scenario that was never intended to occur in flight. The actions of the flight crew were found to be reasonable; they flew by the book, followed procedures, and communicated clearly with one another.
Investigators recovered a portion of the right AOA sensor overlay still attached to a piece of the left side of the fuselage, with the marks on the overlay and fuselage still aligned, proving not only that the overlays had been swapped, but also confirming the technicians’ insistence that they had aligned the markings.
The MAK noted that the accident could have been prevented if the MOC had properly documented and labeled the overlays to ensure they were reinstalled in the correct locations, and if they had ordered inspections after the work was complete. Numerous discrepancies were identified in the facility’s record-keeping and operations, suggesting that standards were slipping.
The MAK largely avoided criticizing the design of the overlays, except insofar as drily pointing out the possibility of incorrect installation constitutes criticism. The investigation did also recommend that all operators implement a service bulletin, published by UAC after the accident, that outlines changes to the overlay design to preclude incorrect installation. However, I’m still left asking: how hard could it have been to design the overlays such that they wouldn’t fit anywhere other than the intended installation location? I think that at some point during the design process, a failure of imagination occurred, but we might never know where or why.
As for whether the flight crew could have prevented the accident, the answer was “yes, but actually no.” In general, it was found that the plane would remain controllable as long as the airspeed did not exceed VMO and the high speed protection function was not activated. However, that was easier said than done.
Tests conducted using the mathematical model of the flight, as well as test flights by trained test pilots and instructors on UAC’s test bed, revealed the following:
· If, at the moment Captain Bulavko said “airspeed unreliable” at 14:58:00, the crew had applied the unreliable airspeed memory items for this phase of flight, which were to establish a pitch of 10˚ with the thrust levers in the Climb regime, then the aircraft would have entered a climb without exceeding VMO. A pitch of 10˚ was achievable via full aft side stick deflection for 8 seconds, although this was way more than would normally be needed, and in the actual event Bulavko never achieved this. This scenario requires the pilots not to follow the recommendation to increase thrust if the AOA is too high.
· If, at 14:58:00, the crew had attempted to stabilize the flight path using the pitch/AOA/thrust table in the QRH, which at their configuration, weight, and altitude, called for 63% thrust and side stick inputs as required to stabilize the altitude, then the aircraft would have remained in level flight or a slight climb without exceeding VMO. This scenario also requires the pilots not to follow the recommendation to increase thrust if the AOA is too high.
· If, from time 14:58:02, the pilots had left the engine thrust alone and made the same pitch inputs as in reality, resulting in the thrust levers remaining at low power, the aircraft would have entered a climb and would not have exceeded VMO. The alpha floor would eventually activate to increase thrust. However, this scenario is purely demonstrative and doesn’t represent an action that the pilots would be likely to take.
· If, from time 14:58:22, when the overspeed warning sounded, both thrust levers were reduced to idle with control inputs as required to avoid exceeding VMO, the aircraft would eventually maintain straight and level flight very close to but not above VMO. This scenario again requires the pilots not to follow the recommendation to increase thrust if the AOA is too high. It also assumes that the pilots view the airspeed as reliable.
· If, after the autopilot failed to climb, the pilots had switched to Direct Mode by turning off all ADSs, the aircraft would have remained controllable and horizontal flight could have been maintained. However, no procedure called for them to switch to Direct Mode so early.
· If, after achieving flaps 0, the pilots had controlled thrust so as to avoid exceeding VMO in horizontal flight, it was possible to maintain level flight only with continuous aft side stick deflection.
· After the autopilot disconnected, while Bulavko was holding the side stick fully aft, if he had instructed Kharlamov to switch the flight control system to Direct Mode, the aircraft would have pitched up with a load factor of 6 G’s, resulting in structural failure. This is because in Direct mode the side stick is directly tied to the control surfaces without force feedback and there is no high load factor protection. If the pilots had wanted to switch to Direct Mode at any point during the final 80 seconds of the flight, they would have had to relax the side stick while making the switch, allowing the plane to enter a dive, before recovering in Direct Mode.
All of these were possible outcomes; most were good, some were better than others, one was catastrophic. But the problem with these outcomes is that they were flown by experienced test pilots and instructors with prior knowledge of the accident scenario. The question of what a real flight crew would do is answered, I think, by Bulavko and Kharlamov themselves. Throughout the flight, their actions were based on their training and the contents of the unreliable airspeed procedure, which their training and the QRH had biased them to believe was appropriate. Test pilots who flew the scenario agreed that most flight crews would interpret the abnormal situation as an unreliable airspeed event and would take actions based on that assumption. They felt that many crews would eventually increase engine power, leading to an exceedance of VMO, activation of the high speed protection, and an unrecoverable descent.
Just to prove a point, the MAK conducted tests on a flight simulator using regular airline pilots from SSJ-100 operators across Russia. The simulator wasn’t capable of simulating the failure of two AOA sensors, so the MAK set up a failure of two airspeed sensors instead, then measured how long it took for the pilots to complete the unreliable airspeed procedure and switch to Direct Mode. They found that on average, this took more than 7 minutes from the time the pilots first identified the unreliable airspeed issue. The entire flight of RA-89049, from takeoff to impact, lasted less than 6 minutes.
On flight 9608, the pilots didn’t have an opportunity to properly troubleshoot because they were unable to stabilize the flight path. During the brief flight, they experienced 22 intermittent NAV ADS DISAGREE alerts, a failure of the autopilot to respond to flight control panel inputs, a lack of normal aircraft response to side stick inputs, and AOA and airspeed values that did not match one another. These features were not covered in an any single procedure. By the time the pilots realized something was seriously wrong, they had less than a minute to identify the nature of a situation they had never previously encountered, independently develop a possible solution, and execute that solution before the situation became unrecoverable. In fact, despite the complete lack of relevant training or procedures, the pilots did identify an angle of attack sensor issue as the cause of their difficulties just 55 seconds after Kharlamov’s first call that something was amiss. Unfortunately, by then it was already too late.
Flight 9608 is far from the only example of a complex systems “cascade” unfolding faster than the pilot can reasonably interpret what’s going on. The normal solution is to develop reliable indicators of the onset of the emergency and a procedure containing corrective actions. But in cases like this, that’s not really a viable answer.
During the design of the SSJ-100, and I assume every other transport aircraft ever made, the simultaneous and symmetrical failure of two AOA sensors, in such a way as to provide consistently false AOA data to the fly-by-wire system, was judged to be “extremely improbable,” with a likelihood of less than 1 in 1 billion per flight hour. As a result, UAC was not required to create a procedure for flight crews to identify or respond to such a failure. Furthermore, doing so would be impractical because small differences in the nature of the instigating event, whether it’s incorrect installation or something else, can have drastically different and unpredictable effects on the development of the situation — the “cascade.”
It is worth noting that these types of assessments don’t normally consider the possibility of maintenance errors. The probability of a mechanic swapping the overlays by accident was considerably greater than 1 in 1 billion, and the result was that the supposedly impossible happened. I covered another case of simultaneous symmetrical erroneous AOA values, also caused by a maintenance error, in my article on XL Airways Germany flight 888T; in that case, a painting crew violated the maintenance manual and sprayed an A320 with a fire hose to wash off dust, causing water to enter the AOA sensors, which then froze upon reaching cruise altitude, locking both primary AOA vanes in the neutral position. On flight 888T, the fly-by-wire system also rejected the only air data system that was providing correct information.
In any case, returning to the topic of how to handle cascading failures on a complex, modern aircraft, experts at the forefront of aviation safety are tackling that issue as we speak. There isn’t an easy catch-all solution, for the reasons I’ve already explained. One technique teaches pilots to turn off some or all automation, up to and including the flight computers and air data computers if needed, and revert to pure stick-and-rudder handling. This is sometimes effective, but not always, as illustrated by the MAK’s hypothetical scenario in which the flight crew switches to Direct Mode and instantly disintegrates the aircraft.
I think the following quotation from a 2021 Wired article by accident investigator and airline captain Shem Malmquist* illustrates the issue quite well:
“Hundreds of other unforeseen [automation]-related challenges could be out there that cannot be anticipated using traditional risk-analysis methods…. An effective solution needs to go beyond the limitations of aircraft designers who are unable to create the perfect fail-safe jet. As Captain Chesley Sullenberger points out, automation will never be a panacea for novel situations unanticipated in training.”
*Note: Malmquist’s full article is useful for putting this accident in perspective; you can read it here: https://www.wired.com/preview/story/60819540c42707093e4968c1?status=draft&t=1619210609701
Malmquist goes on to point out that pilots today often report knowing less about how their aircraft work than they did in the past. This restricts pilots’ ability to think of possible reasons for abnormal system behavior and develop possible solutions for scenarios that are not described in any checklist. In Malmquist’s opinion, the best way to reduce the occurrence of these types of accidents is to ensure that pilots have deeper and broader knowledge of the automated systems that control modern aircraft — not just what is traditionally considered “automation,” such as autopilots and autothrottles, but also the systems that work in the background, like the air data consolidation logic and elevator command signal components. All the crew of flight 9608 needed was the ability to recognize an angle of attack sensor problem 20 seconds earlier, and they might have successfully emerged from the crucible of the cascade.
◊◊◊
Ultimately, the crash of Gazpromavia flight 9608 was a complex accident caused by multiple interlocking issues. Changing the design of the SSJ-100’s AOA sensor overlay was a helpful and necessary step, one that would have prevented this particular accident, but the story is about much more than just the design of the airplane. It’s a case study that highlights the need to rethink some of the current assumptions about how pilots are trained to interact with automated systems. After all, the only failures were two faulty data points; other than that, all aircraft systems operated as designed, and the flight crew followed the procedures they had been trained to follow, but the airplane still crashed because there was a mismatch between the scope of the available procedures and the true range of possible problems. As I’ve already emphasized, there is no purely procedural solution to this issue. How the aviation industry will continue to adapt to the risks posed by the ever-increasing complexity of highly automated aircraft remains to be seen.
From a completely unrelated perspective, the accident also highlights how sanctions have increased the background level of risk across Russia’s aviation industry. Sanctions did not cause this accident, but they increased the probability of a maintenance error by making it impossible to follow the practices that would normally have been used to ensure that AOA sensor overlays were always reinstalled in the same location they were taken from. The bucket brigade approach used by the MOC and Gazpromavia required the maintenance team to take additional risk mitigation actions, such as labeling the overlays after removing them from the aircraft. But the technicians didn’t appreciate the potential consequences of their managers’ “solution” to the spare parts shortage, and these precautions were not taken.
This accident scenario also includes unique aspects that might be new to some pilots. One of several reasons I spent a month and a half translating the accident report and writing this article was to increase awareness of what happened that day over Russia, not because I think the exact same thing will happen again, but because studying it is thought-provoking and potentially useful. I know there are some pilots reading this, and I would be more than honored if they asked themselves — what would I do in this situation, knowing only what Bulavko and Kharlamov did? My airline pilot friends ask themselves these sorts of questions all the time, and I think this one holds value.
There is, I believe, a particular cohort of readers who might balk at the idea that pilots should have to think about this at all, simply because the supposed root cause was UAC’s failure to design an AOA sensor installation that adequately complied with the spirit of the applicable regulations. However, as Malmquist points out, the probabilistic risk analyses that manufacturers use to estimate the safety factor on each aircraft system are not even close to 100% effective at capturing all possible failure scenarios; not only because the analysis methods are designed by humans who make errors, but because the existing methods cannot always capture the “cascade.” And that’s before we even consider the fact that for a well-traveled aircraft type, the probability that a 1 in 1 billion event will eventually occur is fairly high — take, for instance, the A320 fleet, whose 330 million-plus total flight hours mean that the probability of a given 1 in 1 billion-per-flight-hour event having already occurred somewhere on the fleet is theoretically about 1 in 3.
The point is that these events do occasionally happen, and will continue to happen, even as some manufacturers prove more scrupulous than others. And for pilots who must fly modern airplanes day in and day out, there’s understandable interest in learning about these events in order to brainstorm new techniques and strategies, if only out of a sense of professional obligation, or even self-preservation.
I’m not a pilot, just a very obsessive storyteller who knows a lot of pilots, so in the end what they do with this story is up to them. As for everyone else, I hope you found this story as fascinating as I did. Gazpromavia flight 9608 was not an accident that was widely covered in global media, no passengers were hurt, and it involved an aircraft type built and operated by Russian companies to carry primarily Russians. But the cascade transcends such boundaries. It is an outgrowth of all complex systems, visible only once it has been carefully organized into a series of second-by-second time stamps, revealing the processes that plunged the crew into unimaginable terror and confusion. No two such events are ever exactly the same, and not all of them will try as hard to kill the occupants as this one did — but some of them will, and those are the stories that stay with us long after the flames are extinguished.
_______________________________________________________________
Dear readers — I couldn’t have written this story and translated this report without your support on Patreon. Everything I produce is given to the world for free, and all of you help keep it that way.
— Kyra
_______________________________________________________________
Don’t forget to listen to Controlled Pod Into Terrain, my podcast (with slides!), where I discuss aerospace disasters with my cohosts Ariadne and J! Check out our channel here, and listen to our latest episode about a titanic battle between a BAC 1–11 and some wind. Alternatively, download audio-only versions via RSS.com, or look us up on Spotify!
You can also see my work on Petter Hornfeldt’s YouTube channel “Mentour Pilot,” where I’m employed as a script writer and researcher.
_______________________________________________________________
Join the discussion of this article on Reddit
Support me on Patreon (Note: I do not earn money from views on Medium!)
Visit r/admiralcloudberg to read and discuss over 260 similar articles
