Designed to Crash: The bizarre story of Antonov An-28 HA-LAJ and its demise
On the 28th of August 1993, fire crews at RAF Weston-on-the-Green in Oxfordshire, England responded to the crash of an unusual airplane — a Soviet-designed Antonov An-28 twin turboprop, which had been chartered by a Royal Air Force parachuting club for the purpose of carrying skydivers. Shortly after takeoff with two Russian pilots and 17 parachutists on board, the crew attempted to retract the flaps, only for a bizarre malfunction to occur, as both engines failed at the very instant the flap lever was selected. With only seconds to react to the unbelievable failure, the captain managed to steer the Antonov to a safe crash landing in a cornfield nearby, saving the lives of everyone on board. Although the plane was written off, nobody was seriously injured.
The incident presented Britain’s Air Accident Investigation Branch with a rare opportunity to investigate the crash of a Soviet aircraft type on British soil, just a year and a half after the collapse of the USSR. Indeed, the story they uncovered was a strange one — from the murky chain of events that led to the An-28’s unapproved modification for parachuting, to the plane’s simultaneous registration in two different countries, to the baffling electrical fault that caused the crash. And at the root of it all was a design decision that left investigators scratching their heads, a single point of failure that made the An-28 uniquely vulnerable. How had the design ever passed muster? And why did the design seemingly change in between the original drawings and the actual production of the aircraft? Without access to the details of the design process, investigators were left to speculate, but what they wrote nevertheless provides a fascinating window into British experts’ early post-Cold War opinions on Soviet aircraft.
◊◊◊
Built in 1916 at the height of WWI, RAF Weston-on-the-Green is a grass airstrip belonging to the Royal Air Force, located near the town of Bicester in Oxfordshire, England. No aircraft are based there today, but the field has long been used as a practice drop zone by the Parachute Training School out of nearby RAF Brize Norton, the United Kingdom’s largest airbase. The airfield is also used for the same purpose by the Royal Air Force Sports Parachuting Association, or RAFSPA, which provides a framework for RAF members to engage in competitive and sport parachuting (as opposed to parachuting for military purposes). Although up-to-date information is hard to find, this was historically done using civilian aircraft either based at Weston-on-the-Green or hired from elsewhere.
In late August 1993, RAFSPA intended to host a special parachuting event at RAF Weston-on-the-Green, for which the club required the services of an aircraft capable of operating out of the grass airstrip while carrying up to 17 parachutists, who would jump from airplane in flight. For these purposes, RAFSPA hired a company called Avia Special Ltd., which was to act as a broker between the club and the operator of a qualifying aircraft. However, Avia Special was unable to find any aircraft in the United Kingdom that met RAFSPA’s requirements and were available on the specified dates. Instead, Avia Special began looking abroad, and through some sequence of events that remains unclear, they became aware of a Hungarian company called G92 Commerce that was conducting parachute jumps out of a Soviet-built Antonov An-28.
The An-28 is a high-wing, twin turboprop aircraft with a distinctive double tail, capable of carrying up to 18 passengers or 1,750 kg of cargo. In terms of niche, its closest Western equivalents are probably the DHC-6 Twin Otter and the Short Skyvan.
The origins of the An-28 date back to the 1960s, when the Kyiv-based Antonov Design Bureau first produced the An-14, which had a similar cockpit, wing, and fuselage cross-section. The An-14 first entered service in 1966, and three years later Antonov debuted the first An-28 prototype, which was essentially a stretched An-14 with better engines. However, a second prototype was not built until 1975, and in 1978 further delays were most likely incurred when it was decided to move production of the type to the PZL-Mielec factory in neighboring Poland. Mass production did not actually begin until 1983, the first Polish-built airframe didn’t fly until 1984, and the type was finally certified by the USSR for civilian use only in 1986, fully 17 years after the first flight of the prototype. Just under 200 airframes were built before the USSR collapsed five years later.
The particular An-28 that would become the star of this story was built in 1988 with the registration CCCP-28778, and was immediately transferred to the Petrozavodsk branch of the Leningrad Board of Civil Aviation, itself a branch of the Soviet state aviation company Aeroflot. It’s not possible to track everything it was used for between 1988 and 1993, but it apparently saw a wide variety of applications. Sometime in the late 1980s CCCP-28778 was transported by ship to Antarctica, where it was fitted with skis, assembled on site, and tested for use transporting people and goods between bases. Information about this endeavor is hard to find but indications are that the An-28 proved unsuitable for the Antarctic environment, possibly due to its lack of range, and it was shipped back.
Following the collapse of the USSR in 1991, there is a period of uncertainty as to the ownership of the plane. The accident report states that the certificate of registration continued to list the Leningrad Board of Civil Aviation as the sole owner through the time of the accident in 1993, but this obviously can’t be true because this entity was dissolved in 1992. Records available online indicate that it was briefly in the possession of Archangelsk Airlines, which later became Aeroflot Nord, now known as SmartAvia. However, the only change to its official registration document occurred when someone crossed out the “CCCP” identifier and hand-wrote “RA” for Russia instead.
In actuality, in May 1993 the aircraft was sub-leased with crew to a Budapest-based company called G92 Commerce, which in turn had an agreement with the Hungarian Aeronautical Association in which the latter would act as the operator. The aircraft was then re-registered in Hungary with the registration HA-LAJ, but the Russian authorities were never informed and the aircraft remained on their books as RA-28778, rendering the subsequent Hungarian registration technically invalid.
Sometime after HA-LAJ’s registration in Hungary, Avia Special contacted G92 Commerce to arrange for the use of the aircraft between August 27th and September 6th for the RAFSPA parachuting event at Weston-on-the-Green. By then the aircraft had already been modified for parachuting, by folding the passenger seats against the walls and removing the rear access doors. This pair of doors was normally used for ground boarding and opened in a clamshell format, but on HA-LAJ they had been physically removed from the airplane to facilitate the parachutists’ mid-air disembarkation.
Subsequently, on August 27th the aircraft departed Budapest under the command of two Russian pilots who were presumably employed by the aircraft’s Russian owner. In the left seat was 40-year-old Captain Sergei Suskin, who had about 9,400 flying hours including 1,200 on the An-28. I was not able to find the name of the First Officer, but he was 26 years old and had 2,310 total hours, including 510 on type.
After stopping for fuel in Maastricht, Netherlands, HA-LAJ landed in Maidenhead, UK for a customs inspection, then flew onward to Weston-on-the-Green, arriving at around 15:30 that afternoon.
The parachuting event itself got underway at 8:30 the following morning, when HA-LAJ took off from the grass field with its first load of parachutists. The seating arrangement was ad-hoc, as the parachutists sat on the floor of the cabin with no particular restraint. Some flights also included a parachute club official who observed the crew to confirm that they were following the provisions of the British Parachute Association Operations Manual. In each case, once everyone was on board, the aircraft would take off, climb out to the west, turn around, and cross back over the airfield heading north, at which time the parachutists would jump one after another through the An-28’s rear access door. The aircraft would then come back around and land on the same runway from which it took off, with a total airborne time of only about 15 minutes.
Twelve such flights, each carrying up to 17 parachutists, proceeded beautifully. It was, of course, the unlucky 13th flight on which the real story began.
With Captain Suskin at the controls and 17 people in the back — there was no observer this time — the aircraft departed the grass runway 36 as it had on each previous sortie, then began its regular climb. The after takeoff checks on the An-28 were rather simple as the aircraft does not have retractable landing gear. The only significant configuration change required was to retract the flaps, which were extended on takeoff in order to boost lift at low speeds. Although a couple of intermediate positions were available, the pilots of HA-LAJ didn’t need them; instead, at around 500 feet above the ground, Suskin normally had his First Officer move the flaps straight from the fully extended position to fully retracted, while he pitched down to increase speed.
Although most aircraft this size have a fully mechanical flap lever, on the An-28 this would have been done using an electric flap switch. Indeed, just as they had already done 12 times that day, at 500 feet Suskin called for flaps up, and the First Officer reached for the electric flap switch, cycling it three times in rapid succession to bring the flaps all the way back to the fully retracted position. It was at that moment, just as the flaps started retracting, that all hell broke loose.
◊◊◊
To understand what happened at that precise moment, we need to go back to basics, starting with electrical systems — that is, not just the An-28’s electrical system, but any battery-powered electrical system. That’s because, when you get down to it, the system that (for instance) retracts the An-28’s flaps is not fundamentally different from a basic circuit that you might build in a grade school science class. In any such setup, negatively charged electrons want to flow from the negative end of the battery to the positive end, so if you connect those two ends to one another with a conductive material — such as a wire — you will complete a circuit, through which the electrons will flow as a current. Various fun devices can then be added to this circuit in order to put the electrons to work as they pass by. A light bulb would be the classic example.
However, as the constructors of early telegraph systems discovered, when building a very large circuit it takes a lot of wire to bring the electrons all the way from the battery to the place where you want them to do work, and then all the way back again afterward. Fortunately, those early pioneers of the telegraph discovered that you don’t need the return wire as long as the end of the outbound wire and the corresponding terminal of the power source (in our case a battery) are connected to the same physical object, which for telegraph lines was the planet Earth itself. That’s why we call this technique “grounding.”
On moving vehicles, including both cars and aircraft, it’s obviously not possible to connect electrical circuits through the physical ground. Instead, circuits on such vehicles are “grounded” via the vehicle chassis. Therefore, when a particular circuit is energized, the electrons will flow from the battery, down the wire to the device in question, and thence into the chassis, through which the electrons are conducted straight back to the opposite terminal of the battery, which is also connected to the chassis.*
Should this critical connection between the wire and the chassis be disrupted, the circuit will become “ungrounded,” and the current will seek other routes back to the opposite terminal — which might be through your body if you simultaneously touch the chassis and the end of the ungrounded wire, so don’t do that.
*[Note: Technically the electrons flow the other way — from the negative terminal, through the chassis, up through the grounding point, and back down the wire to the positive terminal. But that’s pretty spooky, and it makes no practical difference, so we normally pretend that the current flows the other way.]
On the An-28, the electrically actuated flap system drew power from a 27-volt battery. Moving the electric flap switch to any of its various positions would complete a circuit, causing current to flow from the battery and through the flap operating solenoids in the manner corresponding to the selected position. This current would then go to ground via a terminal block called A6X1, which served as a common endpoint for a number of different wires from several circuits.
After reaching the A6X1 terminal block, the normal current path was through one of two wires, called M01 and M02 respectively, which both connected to a single “grounding screw.” This screw was in turn attached to the aircraft chassis, allowing the current to enter the chassis and return to the opposite terminal of the battery.
However, the flaps were not the only system connected to ground via terminal block A6X1. The other major system utilizing this terminal block was the An-28’s propeller autofeather mechanism.
As I’ve discussed in many previous articles, the propellers on turboprop aircraft have adjustable blade pitch. When the edges of the blades are in line with the propeller’s plane of rotation, they don’t take any bite out of the air; they will spin freely with little resistance. Increasing the angle of the blades will cause them to start taking a bigger bite out of the air, forcing air backward to generate thrust. But if the blade angle increases so far that the edges of the blades are perpendicular to the plane of rotation, then the propeller will no longer be able to force any air backward, and thrust again drops to zero. This is known as the “feathered” position (see above).
If a turboprop engine were to fail in flight, the turbine would stop powering the propeller. If the blades are still angled to produce thrust, then instead of the blades taking a bite out of the air, the oncoming air will start to take a bite out of the blades, so to speak, driving the propeller, and thus the turbine, in reverse. This causes a lot of drag that negatively affects performance, so in order to prevent this from happening, turboprop aircraft are equipped with an autofeather system that automatically rotates the blades to the feathered position in the event of an engine failure. This can also be done by the pilots using a cockpit switch, should the need arise. Once the blades are feathered, the oncoming airflow will no longer be able to get enough leverage to drive the propeller, eliminating the excess drag.
On the An-28, the autofeather system could be activated by closing one or both of two switches, designated 7S19 and 7S20, respectively, one for each propeller. (Henceforth, I’ll be calling these the “feathering switches.”) The switches each had two terminals: a permanently non-energized terminal that was normally closed (i.e. making contact), and a normally open terminal, which if it were to close would energize the feathering circuits. These switches controlled power to the feathering circuits regardless of whether the feathering command was automatic or manual. Should either of these circuits be completed, power would flow from the battery, through the activated switch(es), and down a wire to the 7-K6 feathering relays, which transmitted the feather command to the blade pitch actuation system. After that, the current went to ground in one of two separate locations, one for each of the two identical circuits (depicted above).
However, when the feathering circuits are not energized, which is essentially all of the time, the normally closed ends of both feathering switches are connected via wires to the A6X1 terminal block, and thence to ground via that terminal block’s grounding screw, described previously. These wires should never under any circumstances be energized, because when the feathering system is operational the current will bypass them, and when it is not, there should be no current present. So why was it necessary to ground the normally closed side of the switches, even though there wasn’t supposed to be any current in the circuit when this side of the switch was closed? The answer, as far as I can tell, is that it’s simply good practice to ground any exposed conductor. If the normally closed side of the switch was left connected to nothing, it could serve as an entry point for electromagnetic interference, potentially resulting in uncommanded feathering of one or more propellers. You can think of that exposed conductor like a lightning rod sticking out into space, inviting random energy sources to induce a current into the feathering circuit. Grounding the normally closed side of the switch was therefore a prudent move. As for where to ground it, the A6X1 terminal block was probably chosen just because it was nearby.
All of this may be complicated to visualize, but hopefully the attached diagrams are helping. Studying them carefully should make it much easier to understand the failure that was about to occur. Now, with all this in mind, can you guess where this system had a potential single point of failure?
◊◊◊
If you guessed the grounding screw on terminal block A6X1, then congratulations, you’re better at this than whoever designed the An-28’s electrical system.
The grounding screw was, in fact, simply a screw, and like any screw mounted in a high-vibration environment, it was capable of loosening over time. And the looser it got, the less effectively it contacted the chassis. In fact, if the screw was loose enough, then the resistance between the screw and the chassis would become so great that this would no longer represent the optimal current path.
Electrical resistance is the opposite of conductance. The higher an object’s resistance, the harder it is to push a current through that object. The Wikipedia page on resistance and conductivity has a great metaphor for this, which I will shamelessly steal. If you have a water pipe with water flowing through it at a given rate, then that pipe becomes partially blocked with hair, a higher water pressure is required to maintain the same flow rate. Extrapolating further, if another path for the water exists that has a more favorable pressure-to-flow-rate ratio, then the majority of the water will start going that way instead. Electricity is much the same way: the electrons will flow down all available paths at a rate inversely proportional to their relative resistance.
So, if the grounding screw on the A6X1 terminal block were to pull out of the chassis, then there would be an air gap between the screw and the chassis, which has a high resistance. Furthermore, if that resistance is high enough, then the majority of the current might start flowing down a path with lower resistance instead.
Now imagine that the flap operation circuit is energized with the grounding screw no longer connected to the chassis. What’s the path of least resistance back to the battery now? What other path to ground exists?
In fact, with the grounding screw pulled out sufficiently far, the main current will flow from the flap circuit, into terminal block A6X1, then — skipping the screw entirely — up the feathering circuit grounding wires, across the normally closed side of the feathering switches, through the feather circuit wiring, past the 7-K6 feathering relays, and out through the normal grounding points for the feathering circuits. This path is depicted above.
If the resistance between the screw and the chassis was sufficiently high, then enough current could flow down each feathering circuit to activate both 7-K6 feathering relays, causing both propellers to feather simultaneously. This is in fact what happened as the pilots of HA-LAJ retracted the flaps at 500 feet on their 13th parachuting flight.
As soon as the feathering relays were energized, a command was sent to the blade pitch controllers to feather the propellers and hold them there. Then, because the propellers provide no thrust when feathered, the An-28’s engine failure detection system detected a loss of thrust in both engines, causing a number of knock-on effects.
The An-28 has a fairly sophisticated engine failure detection system that automatically shuts off fuel to the engine when a large discrepancy is detected between the power lever position and certain engine operating parameters. Furthermore, because a failed engine on the An-28 tends to produce a large and sudden yawing moment, the system also automatically deploys the outboard wing spoiler on the opposite side from the engine failure, in order to ensure that drag on both sides is as close to equal as possible. This makes the plane easier to control with one engine inoperative. However, in this case, when the engine failure detection system registered the loss of thrust in both engines, it not only cut fuel to each engine but also deployed the outboard spoilers on both wings, because the left engine failure triggered the right spoiler, while the right engine failure triggered the left spoiler. This was consistent with the system’s operating logic but was nevertheless completely unnecessary, because deploying both spoilers simultaneously just increased drag on the airplane while providing no controllability benefits.
The pilots of HA-LAJ had no idea that any of this was about to occur. Instead, it felt almost like the flap switch had suddenly turned into a “crash airplane” button. At the same instant that the flaps were retracted, both propellers feathered, fuel was cut to both engines, and both spoilers deployed, causing a catastrophic loss of both thrust and lift. The plane began to decelerate rapidly, forcing Captain Suskin to push the aircraft into a dive in order to maintain airspeed. If he tried to reduce their descent rate, it was certain that they would lose speed and stall, leading to a devastating crash. But the other outcome didn’t look rosy either. They obviously didn’t have enough height to return to the airfield, but the terrain was littered with obstacles like trees, ditches, and roads. With only seconds to act, Suskin and his First Officer made a snap decision to turn to the right and land in a field of recently harvested corn stubble. There was no time for a brace call, but the parachutists didn’t need one — it was obvious that they were going down, and all they could do was hang on for dear life, since the plane didn’t have seat belts.
Moments later, HA-LAJ touched down hard in the cornfield, with a considerable descent rate, a slight right bank, and a nose high attitude with a forward airspeed of 92 knots. The landing gear swiftly collapsed, causing both wings to fold downward and strike the ground, but within just a few seconds the plane slid to a stop on its belly, otherwise intact.
When the plane came to a halt, the 19 passengers and crew discovered that despite the lack of restraints, everyone had survived the crash landing, and in fact no one was even seriously injured. Furthermore, no fire broke out, and egress was trivial because of the removed rear doors. By the time the pilots had shut down the plane’s remaining systems, all the passengers were already off the airplane with no need for an evacuation call. Subsequently, the First Officer was the last person off, exiting through the cockpit window after stopping to disconnect the battery. Emergency services arrived shortly thereafter, but there was little for them to attend to.
◊◊◊
Because the crash was minor and occurred over a bank holiday weekend, Britain’s Air Accidents Investigation Branch didn’t begin an investigation until three days later. Nevertheless, when the investigation did get underway, it resulted in a number of fascinating findings.
Although both pilots had already returned to Russia by the time the AAIB got there, investigators were able to obtain statements from both through the Russian Department of Air Transport, in which they described how the propellers feathered, the engines shut down, and the spoilers deployed when they attempted to retract the flaps. The deployment of the spoilers and feathering of the propellers was confirmed not only by the condition of the wreckage, but by a photograph of the airplane in flight, taken shortly before impact by a nearby witness. My understanding is that this photo remains the property of the photographer and has not been released.
Because the An-28 was designed in the Soviet Union, and because Russia had inherited the USSR’s obligations, investigators from Russia participated in the inquiry, and in fact they were the first to identify a possible mechanism by which the pilots’ command to retract the flaps could have triggered the observed failures. Their suspicions were subsequently proven right when on-scene measurements by the AAIB detected elevated electrical resistance when the flap operating circuit was energized. Subsequently, the grounding screw connecting terminal block A6X1 to the chassis was found loose, having unscrewed itself slowly over time.
Meanwhile, the AAIB began to uncover a number of facts that raised questions about why HA-LAJ was allowed to fly parachutists at Weston-on-the-Green in the first place. One glaring issue was brought to light by representatives of the Antonov aircraft company — namely, that the An-28 was never intended for parachuting operations, was not approved for that purpose, and was never tested or certified to fly with the rear clamshell doors removed. Representatives of the Russian Department of Air Transport expressed the same views. This contradicted the plane’s Hungarian airworthiness certificate, which stated that HA-LAJ was approved for flight in that configuration. In fact, the operation of the aircraft without the rear doors so alarmed the representatives of Antonov that the final report on the accident describes their statements against the practice as “categorical” and “emphatic.” Elaborating further, Antonov personnel told the AAIB that the An-28 had never been tested for adverse strength, metal fatigue, or flight characteristics without the doors, and that in their view turbulence with the doors removed could result in structural damage to the airplane. However, investigators also wrote that Antonov was strongly opposed to accepting any “liability” — which does make one wonder how much of this response was out of genuine concern, and how much was an attempt to deflect responsibility for the design decisions that caused the crash, which I’ll cover in more detail in a moment.
Another issue that came up was of course the registration of the airplane in two different countries simultaneously. This lapse was accidental, but investigators noted that had Hungarian authorities informed their Russian counterparts of the new registration, as was their obligation, then they would have been required to provide information about the aircraft to the Russian Department of Air Transport. Since this agency was apparently aware that the aircraft was not approved for parachuting operations, it’s possible that they might have brought the discrepancy to the Hungarians’ attention had this required step been completed.
Lastly, and perhaps most importantly, investigators also examined the process by which HA-LAJ was granted permission to fly in the United Kingdom.
Under UK law at the time, in order to hire a foreign aircraft to perform “aerial work,” including parachuting, it was necessary to apply for explicit approval from the Department of Transportation. After demonstrating that no UK-based company could perform the work in question, the Civil Aviation Authority’s Safety Regulation Group–Operating Standards Division was required to verify, among other items, that the aircraft was currently being used for the specified type of work in its home country; that the crew were competent and qualified; and that there was a parachute operations supplement to the Flight Manual. Submission of the aircraft’s certificate of airworthiness and the certificate of the operating company were also required.
In the case of HA-LAJ, there was no question about the competence of the crew or the presence of the correct documents, and the aircraft had previously conducted parachuting flights in Hungary, so the permit was issued. However, the CAA failed to discover that the An-28 was not approved for parachuting operations, because there was no requirement to consult the manufacturer as long as HA-LAJ’s certificate of airworthiness indicated such an approval, which it did. The AAIB was therefore concerned that the verification process had become a rubber stamp, causing discrepancies to be missed. In a worst-case scenario, it might even have been possible for an applicant to hoodwink the CAA simply by inserting false approvals into the submitted documentation. As a result, the AAIB recommended that the CAA Safety Regulation Group consider checking directly with the states of design, manufacture, and registry of aircraft from the former USSR before giving them permits for aerial work in the UK, in order to verify the documentation.
◊◊◊
However, perhaps the most interesting part of the AAIB’s report on the accident was its analysis of the design of the An-28’s electrical system.
Unsurprisingly, the AAIB wrote that the use of a common grounding point for several systems, whose failure could cause the uncommanded shutdown of both engines, was “not sound design philosophy.” Some consolidation of grounding points is desirable in order to reduce the number of stray currents flowing through the aircraft chassis, but care must be taken to ensure that single points of failure are not created. The ideal configuration would have been to isolate the safety-critical autofeather circuit from all other systems by grounding the normally closed side of the feather switches at a separate location. Alternatively, devices called reverse current diodes could have been installed on the wires connecting the normally closed sides of the feather switches to the terminal block. A reverse current diode ensures that current can only flow in one direction, which in this case would be from the switches to ground, while preventing current flow from ground to the switches. The AAIB pointed out, rather incredulously, that use of reverse current diodes on aircraft had been the standard means of protecting critical systems from stray currents since the 1950s. The accident aircraft did have some reverse current diodes in certain locations, but investigators observed that their use was not systematic.
It’s also worth mentioning an issue that I previously discussed in my article on Capital Airlines flight 20 — namely, the isolation of the autofeathering systems for each engine, so that only one propeller may feather at a time. Isolating these systems has been standard since the late 1950s, so I would presume that the An-28 had some sort of interlock that should prevent both propellers from autofeathering simultaneously. The AAIB’s diagram of the An-28’s feathering switches shows a feature that might be an interlock, although it’s not labeled. If so, then the interlock appears to function by ensuring that the remaining switch cannot activate if one switch is active already. This design would have been fine, except that in this accident scenario it was rendered useless, because the current entered the feathering circuits through the normally closed side of the switches, energizing the feathering relays without either switch ever activating.
Note: After publication, readers pointed out to me that the lack of any retention mechanism on the grounding screw was a design flaw as well. Throw it on the pile!
Although the AAIB didn’t have access to the personnel involved in the An-28’s design and manufacturing process, they were able to examine Antonov’s original design drawings, which contained interesting differences from how the plane was actually built. Whereas on the actual aircraft the two wires M01 and M02 connected the A6X1 terminal block to a common grounding screw, the original drawings depicted these wires connecting to separate grounding screws. The intention presumably was that if one screw failed, the systems attached to A6X1 would remain safely grounded via the other. However, the AAIB pointed out that while two grounding screws were better than one, this was still far from an ideal solution because there was no way to detect if one screw was no longer grounding correctly. This condition could therefore persist indefinitely until the second screw also failed, causing an accident anyway.
In its final report, the AAIB wrote that “widely used design principles for identifying common failure modes… should have revealed the potential hazard.” Investigators pointed out that common failure mode analysis techniques had been used in the West since the 1950s, and more complex fault tree analyses since the 1960s. The fact that the AAIB took the time to mention these dates underscores the investigators’ apparent confusion over how such a blatant design flaw could have made it into an aircraft that entered service only in 1986. Investigators wrote that they didn’t know what failure analysis techniques were in use in the USSR when the An-28 was designed, but that in any case such techniques evidently were not applied to the system in question — or if they were, then it was certainly before the decision to reduce the number of grounding screws on terminal block A6X1 from two to one.
The fact that the original design drawings included two separate grounding screws indicated that Antonov engineers were aware of the need for redundancy in this area, even though their solution was suboptimal. That this design was changed prior to production, apparently without any further analysis, may have been symptomatic of the way aircraft design and manufacturing were organized in the Soviet Union. Although Antonov today is an independent company that designs and builds its own aircraft, under the USSR it was a “Design Bureau,” which was responsible for the aircraft design phase only. The AAIB report mentions that once the drawings left Antonov’s headquarters in Kyiv, the design bureau “ceased to have total control over the production standard,” because the production engineering and assembly phases were handled by different organizations within a ministry-level umbrella. That meant that the engineers responsible for building Soviet aircraft often had limited communication with the engineers responsible for designing them. In contrast, a traditionally organized Western manufacturer such as Boeing has design and production engineers under the same roof. Production of many components may be outsourced, but Boeing and its suppliers sign contracts stipulating the specifications of the systems being produced, and the supplier must inform Boeing of any intent to deviate from those specifications if they want to avoid being sued. Such safeguards are obviously imperfect, but the Soviet Union lacked even these. As a result, Soviet planes were more likely to suffer from design flaws introduced at the production stage, which is a problem I previously discussed in my article on LOT Polish Airlines flights 007 and 5055. The An-28 would have been particularly vulnerable to this type of mistake due to its abnormally long and uneven development process.
◊◊◊
In 1993, the aviation industry in the West still had little knowledge of most Soviet aircraft types, and the strengths and weaknesses of those types were not widely known there. An An-28 from Hungary could not have been hired to perform work in the UK before about 1990, and neither the CAA nor the intended users knew much, if anything, about the circumstances under which it was built. Despite this, the CAA could allow such an aircraft into the UK to perform work with UK nationals on board without any particular scrutiny, because Hungary (the state of registration), Poland (the state of manufacture), and the USSR (the state of design) were all members of the International Civil Aviation Organization and were expected to uphold that organization’s minimum safety standards. Today, some countries such as the United States are able to audit the extent to which each other country is adhering to ICAO standards, but in 1993 this type of auditing was a very new concept and it doesn’t seem that the UK was doing it.
The AAIB wrote that the An-28 as built did not meet ICAO standards requiring that aircraft be designed to minimize the probability of inadvertent operation of systems affecting flight controls and powerplants. It was unclear to the investigators whether or how Antonov addressed these ICAO standards during the design process. And yet the UK CAA was required to trust that these standards were met without any direct verification. Such oversight would only be provided if the aircraft were leased to a company with a UK Air Operator Certificate, which HA-LAJ was not. As a result, the AAIB recommended that the UK CAA “develop an increased awareness of the aircraft design and manufacturing philosophies which have been, and are being used in the former Soviet Socialist Republics.”
◊◊◊
The story of the An-28 did eventually reach something like a happy ending. Starting in 1993, the PZL-Mielec aircraft plant in Poland began producing license-built An-28s with updated avionics and Canadian-made Pratt & Whitney PT6A engines, intended to meet Western safety and performance standards. Redesignated as the PZL M28 Skytruck, the revamped model sold more examples than the original and was still in production as recently as 2019. The Skytruck found plenty of users outside the traditional markets for Eastern Bloc aircraft, including, interestingly enough, in the US military. In 2012, the United States Air Force purchased around 10 M28 Skytrucks, which were given the military designation “C-145A Combat Coyote.” A brief Air Force Times article on their introduction made no mention of the plane’s Soviet pedigree, but it did quote Colonel JD Clem of the Air Force Special Operations Command, who said, “The [Skytruck] is simply to haul people around. There is nothing really cosmic about it at all.”
The C-145A served in the US Air Force for 10 years, until the last example was retired in 2022. An article posted on the Air Force Reserve Personnel website at the time quoted Master Sgt Bobby Barton of the 919th Special Operations Group, which operated the type: “There weren’t many other aircraft in the Air Force like this one,” he said. “It really stood out from the crowd.” But this article didn’t acknowledge where the design came from either. In fact, I was not able to find any that did.
As for the crash of HA-LAJ, its significance was limited at the time and has only lessened since. It was, at the end of the day, a small crash involving a small plane in an out of the way location from which everyone walked away. I only found out about it because it was listed in the “recently published reports” section of a different AAIB accident report from around the same time. And yet the more I read, the more interesting the story became, from the background of the airplane to its head-scratching design flaws to the outlandish failure that caused it to crash. From the language in their report, it’s possible to surmise that the AAIB investigators had much the same reaction. How often did they get to investigate the crash of an Antonov on British soil? Certainly not every day!
Often I end these stories with some kind of lesson, but this time I don’t think I will. “Don’t design a plane with a single point of failure that causes both engines to fail when you retract the flaps” is probably too obvious. And ultimately the reason I wrote this article is because I thought the story was worth sharing for its own sake. So I hope, having read all of this, that you agree.
_______________________________________________________________
Don’t forget to listen to Controlled Pod Into Terrain, my podcast (with slides!), where I discuss aerospace disasters with my cohosts Ariadne and J! Check out our channel here, and listen to our latest episode, about an airline composed entirely of pure, distilled crime. A bonus episode for Patreon subscribers is also out now, in which we analyze a bad Russian plane crash movie. Alternatively, download audio-only versions via RSS.com, or look us up on Spotify!
_______________________________________________________________
Join the discussion of this article on Reddit
Support me on Patreon (Note: I do not earn money from views on Medium!)
Visit r/admiralcloudberg to read and discuss over 260 similar articles
(New feature!) Bibliography
