Flying the Unflyable Plane: The near crash of Air Astana flight 1388
On the 11th of November 2018, three pilots prepared to ferry a regional jet belonging to Kazakh flag carrier Air Astana back home from a round of heavy maintenance in Portugal. But almost as soon as the Embraer ERJ-190 took off from Lisbon, the pilots found themselves thrown into a nightmarish emergency unlike anything that they had ever imagined. Their plane had become uncontrollable, rolling wildly in seemingly random directions, turning inverted, diving toward the ground at tremendous speed, only to pull out and start the same rollercoaster ride all over again. Faced with a near-certain catastrophe, the pilots made a chilling request: that they be given vectors over the ocean, so that people on the ground would not be endangered.
And yet, even as they struggled to steer their plane back away from populated areas, the crew put their minds together and slowly but surely began to make sense of the madness. By learning the vagaries of their profoundly broken airplane, they managed to regain control, and after two hours and two failed approaches, Air Astana flight 1388 landed in one piece on the runway in Beja, Portugal, saving the lives of all six people on board. It was a legendary piece of flying, one which will likely be remembered for decades. But what had caused the plane to fly so wildly out of control? In the end, Portuguese investigators would uncover a series of design flaws, poor decisions, and procedural errors which caused the plane to depart for Kazakhstan with its ailerons hooked up the wrong way around.
◊◊◊
In 2003, with the country’s second flag carrier since independence once again on the verge of bankruptcy, Kazakhstan decided to try a new approach, partnering with British defense contractor BAE Systems to start a new airline under new management. Ownership of the new carrier, christened Air Astana, was split between Kazakhstan’s sovereign wealth fund, which owned a controlling stake of 51%, and BAE Systems, which owned the rest; similarly, its upper management consisted of a mixture of Kazakh and British nationals. Despite its unusual origins, however, Air Astana had positioned itself as Kazakhstan’s de facto flag carrier by 2005, and today it is one of the most profitable airlines in the world. It’s also among the safest: it has never had a fatal accident, and for the first 13 years of its existence it was the only Kazakh airline allowed to fly to the European Union.
Between 2011 and 2020, Air Astana operated nine Brazilian-made Embraer E190 regional jets, capable of carrying up to 97 passengers on shorter domestic routes. These short-range jets did not normally fly to Europe, except when they required major maintenance. Air Astana does not have its own repair shop capable of carrying out heavy maintenance on Embraer jets, and neither does any other company in Kazakhstan, so this work was and still is contracted out to certified maintenance companies in the European Union.
In the fall of 2018, one of Air Astana’s E190s, known as P4-KCJ — registered in the Dutch Caribbean island of Aruba for tax purposes — came due for a scheduled C-check, a round of heavy maintenance and inspections which every airplane must undergo approximately once a year. For this purpose, Air Astana had in place a long-term contract with an established Portuguese maintenance company called OGMA Indústria de Portugal S.A., or OGMA for short, which possessed European Aviation Safety Agency approval to perform heavy maintenance and inspections on Embraer aircraft.
On October 2nd, 2018, P4-KCJ was ferried to Alverca do Ribatejo airbase near Lisbon, Portugal, a military airfield which also hosts several civilian maintenance companies, including OGMA. According to the contract between Air Astana and OGMA, it would remain there until October 24th while technicians conducted the C-check and brought the airplane into compliance with the latest service bulletins issued by the manufacturer.
Service bulletins are an aircraft manufacturer’s primary means of disseminating updates and design changes directly to operators. Some service bulletins are optional; others may be required, depending on the stance of the relevant regulatory authorities, but it is considered good practice to comply with all of them whether they’re required or not, and that was Air Astana’s intention.
Among the service bulletins to be implemented on P4-KCJ were SB-190–57–0038R2 and SB-190–27–0037R1, which concerned the Embraer E190’s aileron control system.
The E190’s ailerons, which control roll, are operated by a traditional system of cables and pulleys which transmit pilot inputs directly to the hydraulic actuators. The first of the two service bulletins addressed reports of excessive cable friction around a supporting pulley, by directing that the pulley be replaced by a non-contact support, as shown above. The second bulletin directed that the stainless steel aileron cables be replaced by carbon steel cables, which are more wear-resistant.
Because of the design of the new non-contact cable support, which featured a closed loop, the only way to complete the service bulletin was to disconnect both aileron cables, install the support, and then string both cables back through it. Having done the first two steps, however, the technicians found that putting the cables back was nowhere near as simple as it sounds.
◊◊◊
The way ailerons induce roll is by increasing lift on one wing while simultaneously spoiling the lift on the other. To accomplish this, the aileron on the “up” wing hinges down, increasing lift, while the aileron on the “down” wing hinges up, decreasing lift. Therefore, each aileron has two cables: one which moves it up, and one which moves it down, with the direction of motion depending on which cable is in tension.
The issue with reassembling the E190’s aileron control system was that the “up” and “down” cables in each wing were identical, and their routing was unusually complex. In the outermost section of the cable run in the wings, the orientation of the cables relative to one another changed twice, from vertical — one cable above the other — to horizontal — one cable next to the other — and back to vertical again, as shown in the above diagram, which is pulled from the Embraer maintenance manual. If you think the diagram is unclear, you would not be alone. Although it was just one of many diagrams related to the aileron control system, most of the others were no less ambiguous about the exact orientation and position of the cables, and the only definitive explanation was contained in the text, which was written in technical English. And perhaps most critically, it did not explain that despite the change from vertical to horizontal and back to vertical again, the cables should not cross over one another — the cable which was on top at the start must remain on top at the end, even though which one is “on top” is unclear in the middle, where they run side by side.
It was here that the critical error occurred: during reinstallation on October 11th, the technicians inadvertently crossed the cables in both wings, connecting the “up” cables to the “down” fittings on the hydraulic power control units, and vice versa. There were no markings on the cables which would have distinguished them, nor was there any design difference that would have prevented them from being fitted the wrong way around. According to Embraer, the main assurance against swapping the cables was the fact that no procedure ever called for them to be removed at the same time, ensuring that there was only ever one way to put a removed cable back in. But Embraer’s own service bulletin SB-190–57–0038R2 could not be accomplished without removing both cables simultaneously, so this basic design principle was violated, with the predictable result that the OGMA technicians installed the cables the wrong way around.
On October 17th, technicians completed the replacement of the cables with carbon steel versions. Following proper procedure, they replaced each cable one at a time, ensuring that the existing configuration was maintained — only, that configuration was wrong, and nobody noticed.
According to the service bulletin, the cable replacement should have been followed by an immediate operational test of the aileron control system. However, the test required the plane to be powered on, which was not possible at that time due to ongoing work on its electrical system. As a result, the operational checks were pushed to the end of the maintenance period, which was originally scheduled for October 24th, but had since been renegotiated to October 31st.
On October 25th, the plane was powered on, and operational testing of the aileron system commenced. To accomplish the test, maintenance technicians entered the cockpit and used the computerized Engine Information and Crew Alerting System, or EICAS, to bring up the “flight control synoptic” page. This page includes the steps required to conduct a full control check of all the control systems, and features a visual representation of the airplane and all its control surfaces, which appear as green boxes when fully deflected, as shown above.
However, the primary purpose of this page is to show that full deflection is possible, and it does not directly warn the user if a control surface is not deflecting in the commanded direction. In fact, the green boxes would appear whenever full deflection is reached, no matter the direction — the user was simply expected to know what response they were looking for.
To understand what the technicians would have seen on the synoptic page and why it was significant, we must take a brief tangent into the design of the E190’s control system as a whole. For the most part, the E190 is a fly-by-wire aircraft, with most control inputs transmitted to computers which modify those inputs according to airspeed, flap position, and other parameters before actuating the control surfaces. Originally pioneered by Airbus in the 1980s, a fly-by-wire system carries benefits such as improved handling, a more comfortable ride, fewer mechanical failures, and a decreased likelihood of dangerous pilot inputs. However, the E190 is not fully fly-by-wire: as mentioned earlier, its ailerons are still actuated by cables and pulleys connected directly to the pilots’ control wheels. Computer moderation of roll inputs is therefore accomplished not via the ailerons, but through the E190’s multifunction spoilers.
The multifunction spoilers are panels which can deploy to reduce lift on a particular wing. On the E190, they can be used to press the plane into the ground after touchdown (“ground spoilers”), to increase the rate of descent on approach (“speed brakes”), or to assist in turning the airplane (“roll spoilers”). When functioning as roll spoilers, the spoiler panels increase roll performance by automatically deploying only on the “down” wing, resulting in a greater loss of lift on that side, and thus a higher roll rate. As a result, when moving the ailerons, the roll spoilers should pop up on the wing whose aileron is also pointing up, and should remain stowed on the wing whose aileron is pointing down, as seen in the previous diagram of the synoptic page.
The spoilers are part of the fly-by-wire system and are controlled by a computer based on readings from electromechanical position sensors on the pilots’ control wheels. That means that the motion of the roll spoilers will always correspond to the commanded aileron position, even if the reversed cables cause the ailerons to move opposite to the commanded position. In such a scenario, the spoilers would deploy on the “up” wing instead of the “down” wing, a fact which was both visible from outside the plane and displayed on the synoptic page, as shown above. Despite the incorrect configuration, however, the boxes on the synoptic page would still turn green when the ailerons and spoilers reached full deflection. Furthermore, the maintenance manual did not clearly explain that the presence of green boxes was not enough on its own to indicate that the operational test had passed. As stated earlier, the user was expected to know and recognize when the ailerons and spoilers were out of sync. But while we might rightfully assume that qualified E190 technicians would know which way the ailerons and spoilers are supposed to move, in this case we would be mistaken. Between October 25th and October 31st, the operational checks were in fact conducted twice by two separate groups of people, and neither of them noticed the problem.
Nevertheless, the sequence of events was far from over, because later on October 31st, during the final run-up tests before returning the plane to Air Astana, the EICAS threw out a major warning message: “FLT CTR NO DISPATCH.”
As you may have already guessed, this message meant that there was a problem with the flight control systems which would preclude the dispatch of the airplane. Counterintuitively, however, its activation was a coincidence — reversed aileron cables are not one of the warning’s trigger conditions. In fact, OGMA technicians had done some structural work which involved temporarily removing numerous systems from the avionics bay, including the Flight Control Modules (FCMs), the computers which process flight control inputs for the fly-by-wire system. As a result, a number of errors had been introduced, such as improperly seated connector pins, which collectively triggered the FLT CTR NO DISPATCH warning. Therefore, before the plane could be returned to the airline, the technicians resolved to find the cause or causes of the warning and fix them.
Every time they tracked down and corrected an error, the technicians needed to run a “return to service,” or RTS procedure in order to make the warning go away. The warning message state is stored in the non-volatile memory of the four FCMs, and the only way to clear it is to complete the RTS procedure, which includes a full operational check of the flight controls. As the pilots move the controls during this check, the FCMs perform what are known as Continuous Built-in Tests, or CBITs, to verify the integrity of the system. But each time the technicians performed the operational checks, the CBITs would fail, and the FLT CTR NO DISPATCH warning would remain, forcing them back to the drawing board.
After several days of troubleshooting this issue, and with the plane now overdue to be returned to Air Astana, the technicians ran out of leads. They had inspected and tested every inch of the avionics compartment and corrected all the issues which could have generated the FLT CTR NO DISPATCH warning, but every time they carried out the RTS procedure, the CBITs would fail and the warning would refuse to clear. After making absolutely certain that there were no more glitches that could conceivably be triggering the warning, they began to suspect that its failure to clear was a glitch in and of itself.
In reality, the answer was much simpler: the built-in tests (CBITs) required that the controls move in the correct direction in order to pass, and since the ailerons were hooked up backwards, the tests would always fail, preventing the warning from being expunged from the non-volatile memory of the FCMs. And yet, despite days of troubleshooting and numerous return to service tests, no one noticed or understood that the ailerons were moving the wrong way.
By this point the technicians had run through every troubleshooting procedure in the maintenance manual — although checking the installation of the aileron cables wasn’t one of them — so they decided to seek help from the manufacturer. In response, Embraer sent down a technical representative from Amsterdam, who arrived on November 6th to add his expertise to the troubleshooting efforts.
Once again, one would think that an Embraer engineer would notice that the ailerons were moving backwards, but somehow, he didn’t. Instead, convinced that they were dealing with a software problem, the engineer and the OGMA technicians set about testing the theory that one of the four Flight Control Modules was faulty and was failing to clear the warning message from its memory properly. A possible defect was spotted with FCM1, but replacing that FCM didn’t solve the problem. FCM2 was then exchanged for an FCM from another aircraft, FCM 3 was replaced, and the positions of FCMs 1 and 4 were swapped, but this didn’t solve the problem either. Finally, on November 9th, FCM 4 was also replaced — and the message went away.
Of course, the reason the FLT CTR NO DISPATCH warning disappeared is because it had been stored in the non-volatile memory of the original four FCMs, and once all of the FCMs had been replaced, it was no longer there. The discrepancies which originally triggered the warning had all been fixed, so there was no cause for it to reappear. Instead, the technicians had simply found a loophole which allowed them to clear the message without successfully running any of the built-in tests intended to verify the integrity of the control system. These tests continued to fail even after the replacement of the FCMs, and in fact on the synoptic page six red dots indicated that the CBITs had failed in three of the four FCMs (the fourth not being connected to the aileron control system), but there was nothing in the manual that said the plane couldn’t be dispatched in that condition, as long as the NO DISPATCH warning was gone. As far as they were concerned, then, their work was done.
◊◊◊
Meanwhile in Kazakhstan, Air Astana Captain Vyacheslav Aushev had just completed a routine flight when he was given a surprise assignment. The original captain who was supposed to fly P4-KCJ back home from Portugal was no longer available due to the delay, and Aushev had been selected to take his place on November 11th. Joining Aushev for the trip from Lisbon to Almaty via Minsk would be the original supporting crewmembers, including First Officer Bauyrzhan Karasholakov and a safety pilot, First Officer Sergey Sokolov. None of them were new to the E190, and Sokolov in particular was known for his extensive systems knowledge.
Captain Aushev arrived in Lisbon on November 10th, helped the first officers sign off on the C-check paperwork, and organized the flight plan before spending the night in a hotel. The next day, he was back at it, making the final preparations to return the plane to scheduled service with Air Astana. After engine start, two more minor faults were found, which OGMA technicians quickly fixed. The pilots started the engines again, ran through the pre-flight checklists, and conducted a control check. The controls moved with full freedom in all directions, and the crew declared the checks complete. Perhaps due to haste or inattention — but certainly not due to lack of knowledge — they too failed to notice that the ailerons were moving the wrong way.
Finally, sometime after noon, Air Astana flight 1388 was ready to depart for the first leg of the flight to Minsk, Belarus. The three pilots took up their positions, and three Air Astana technicians who had been monitoring the progress of the C-check also boarded the plane, where they sat together in the passenger cabin. Unaware that their aircraft was dangerously unairworthy, the pilots taxied to the runway and took off normally at 13:31, climbing away into the dense rainclouds which blanketed the airport. They had no idea that they were about to be thrust into one of the most dramatic and lengthy in-flight emergencies in recent memory.
For about 10 seconds after takeoff, everything seemed to be normal. But then, slowly at first but growing in amplitude, the plane began to sway from side to side. As they ascended into the cloud layer, the pilots tried to correct this swaying with the ailerons and rudder, but the oscillations kept increasing. Something was clearly wrong, but what? There were no warning lights, no failure messages on the EICAS, no sign of any malfunction. Captain Aushev tried to engage the autopilot, but it failed to activate, throwing out an error message.
Within two minutes, the situation had escalated into a full-blown emergency. The plane started to roll to the left, and this time they couldn’t bring it level. Shuddering violently, the plane turned over into an extreme left bank, causing the wings to lose lift; the nose fell through and the plane began to descend. In a matter of seconds it plunged 1,000 feet, before the wings rolled level and Captain Aushev was able to pull out of the dive. At this point, First Officer Karasholakov issued a desperate mayday call, informing Lisbon ATC that Air Astana flight 1388 was out of control.
Unsure what was causing the problem, the pilots fell back on their training: as they had been taught to do in the event of a flight control failure, they decided to gain as much altitude as possible to provide a cushion in case of a loss of control, and then start troubleshooting. But gaining altitude proved to be a nerve-wracking experience. The plane was completely uncontrollable in roll and would frequently assume extreme bank angles, resulting in a rapid loss of altitude. But if Captain Aushev attempted to pull the nose up while they were effectively sideways, he would put the plane into a spiral dive, from which there could be no recovery. Instead, he had to wait for the plane to roll level, seemingly on its own, then pull up suddenly, trying to gain as much altitude as possible before the same thing happened again.
Indeed, the plane was rolling wildly in various directions, albeit with a bias to the left, and none of their control inputs seemed to have any comprehensible effect on the bank angle. In fact, while the ailerons were clearly not responding normally, the pilots’ control inputs weren’t totally reversed either, because of the influence of the fly-by-wire roll spoilers, which were still working correctly, in opposition to the inverted ailerons.
Although the roll spoilers deploy roughly proportionally with the ailerons, there is a “dead band” near zero degrees of control wheel movement where only the ailerons will move, without the roll spoilers kicking in. While moving the wheel within this dead band, the pilots’ roll inputs were perfectly mirrored — turning the wheel slightly to the left would cause the plane to roll slightly to the right, and vice versa. However, if one of the pilots turned their control wheel past the dead band, the roll spoilers would kick in and start fighting against the ailerons in an attempt to push the wings in the commanded direction. This resulted in significant vibrations and unpredictable roll outcomes. However, if the pilots turned their wheels far enough to fully deploy the roll spoilers, the spoilers would begin to overpower the ailerons, slowly turning the plane back in the desired direction.
To make matters even more confusing, the exact points at which these reversals would occur were initially in flux. With the fly-by-wire system in normal mode, the exact size of the “dead band” depended heavily on airspeed and flap setting, which were continuously changing as the pilots fought to control the plane. After the first few minutes, however, the pilots switched the flight controls to direct mode, which slightly simplified matters by removing any computer modification of their inputs. This caused the dead band to stabilize at a consistent 5.5 degrees of control wheel movement in either direction. However, the pilots were still unable to make sense of the plane’s behavior, a problem which was exacerbated by the lack of outside visual references, forcing them to rely on their instruments alone.
As the pilots struggled to understand the plane’s completely unpredictable responses to their inputs, flight 1388 embarked on a rollercoaster trajectory which simply refused to end. After initially climbing to about 10,000 feet, at 13:38 the plane suddenly rolled over into an extreme dive, plunging 5,000 feet in a matter of moments. The descent rate briefly reached -20,000 feet per minute, and the occupants were subjected to a bone-crushing five G’s during the recovery, approaching the ultimate structural limits of the aircraft — the pilots were lucky that the E190 was bendy enough to take it, because they came alarmingly close to ripping the wings off. Following this terrifying dive, the plane oscillated wildly between 5,000 and 7,000 feet for several minutes. Nevertheless, by 13:45, the pilots managed to get it back above 10,000 feet — only to dive again, losing around 4,000 feet and pulling 3.5 G’s, again exceeding the design limit load. But still the plane held together, and the pilots put it back into a climb, struggling back up to about 16,000 feet with only one relatively minor altitude loss along the way.
Having gained a reasonable altitude cushion, the pilots began some serious troubleshooting. Working together to keep everyone on the same page, they tried different flap settings and assessed them each for controllability. Some marked differences between them were noted, and eventually they settled on flap position 1, just short of fully retracted. Next, they tried disconnecting the pitch, roll, and yaw channels of the flight control computer. One at a time, safety pilot Sergey Sokolov called out the channel he was about to disconnect, making sure that Captain Aushev and First Officer Karasholakov were ready. But no matter which channel Sokolov disconnected, the pilots couldn’t feel any difference — the plane was still nigh uncontrollable.
Suddenly, after spending several minutes seesawing about at 14–16,000 feet, at 14:03 the flight experienced its most dramatic upset yet. The plane rolled completely upside down and entered an inverted dive, its rate of descent exceeding -20,000 feet per minute as it plunged like a lawn dart toward the Portuguese countryside. The plane shuddered violently, and the altimeters unwound so fast the pilots couldn’t even read them. The airspeed approached 350 knots, and the ground proximity warning system began to scream, “WHOOP WHOOP, PULL UP! WHOOP WHOOP, PULL UP!” The pilots complied, but if they pulled up too forcefully, they would overstress the airframe and the jet would break apart in midair, while if they did so too slowly, they would strike the ground. It was a delicate balance, but the pilots managed to hit the bullseye. After losing more than 10,000 feet of altitude in substantially less than a minute, flight 1388 started to level off.
Shaken by the sudden plunge, the pilots understood that they were flying on borrowed time — sooner or later their luck would surely run out. Fearing that they could crash at any moment, their thoughts turned to people on the ground. Now, over the Lisbon ATC frequency, they made an extraordinary request: that they be given a heading over the ocean in order to ditch at sea, where they would be less likely to kill innocent bystanders if they lost control again.
The Lisbon controller ultimately provided them with headings toward the ocean several times, but to the pilots’ immense frustration, they were unable to follow the controller’s instructions. Captain Aushev would later quip that the plane could only hold a steady heading for about one second — which is to say, not at all. The map below, which depicts the plane’s flight path, should give some indication of what he meant.
Even as the plane continued to careen up and down and from side to side, the pilots kept troubleshooting. They considered the possibility of disconnecting each of the two control wheels to see if one of them was generating incorrect inputs, but this idea was rejected, because the combined strength of both pilots was required to maintain some semblance of control. (Although they didn’t realize it yet, this was because having multiple pilots handling controls made it easier to fully deploy the roll spoilers, which would then overpower the ailerons and roll the plane in the correct direction.) They also tried switching the flight controls several times between normal and direct mode, but this made no difference, and they eventually stuck with direct mode.
According to the pilots’ account of events, it was at around this point that they got the bright idea to contact the three Air Astana technicians in the cabin to see if they knew anything about what exactly had been done to the plane during the C-check. This proved to be the silver bullet which ultimately saved their lives. As it turned out, the technicians had with them the comprehensive paperwork describing everything that had been done, and at the pilots’ direction, they began to look through it until they found the smoking gun: an entry in the log which said “Aileron cables changed.”
For the first time, the pilots considered the possibility that their ailerons had been hooked up the wrong way around. If they had been, it would explain almost everything that was happening. In order to test their theory, the pilots instructed the technicians to watch the movement of the ailerons and roll spoilers from the passenger cabin as various test inputs were made. This proved to be a fraught affair, as the cockpit door kept swinging closed by itself every time the plane rolled to the left, and one of the technicians was thrown violently against the wall while trying to keep it open, spraining his ankle in the process. But despite these difficulties, the technicians were able to confirm what the pilots now suspected: that the ailerons were moving in the direction opposite to their commands, but the roll spoilers were working normally. The pilots also verified this observation using the flight control synoptic page.
Now armed with a full understanding of the nature of the problem, the pilots were able to fine tune their inputs to avoid major departures from controlled flight. The moment they figured it out can be pinned at about 14:38, because after that, the flight parameters begin to mellow out noticeably. It was also around this time that the plane emerged from the area of clouds and into visual conditions, helping the pilots get their bearings.
By this point, they had been careening around central Portugal for over an hour, and the pilots had little idea of where they were or where they were going. The controller suggested that they land at Beja Airbase, a military airfield close to their position with good weather and a long runway. In order to help them find it, two F-16s of the Portuguese Air Force were sent to intercept the plane, reaching it sometime after 14:45.
Under direction from the F-16s, the pilots were able to maneuver the plane onto a straight-in approach to runway 19R at Beja Airbase. But as they approached the airport, the plane once again began swaying from side to side, its course wobbling like a fishtailing trailer on the highway. Most likely, the pilots were unconsciously reverting to normal roll inputs during the high-stress approach, causing the plane to turn off course repeatedly, although it took them some time to realize this. It was clear, however, that they would not be able to land in this condition, so as the plane approached the threshold, Captain Aushev called for a go-around, and flight 1388 climbed away for a second attempt.
This proved to be the end of the road for First Officer Karasholakov. The youngest and least experienced member of the crew, he had been severely traumatized by the events of the flight, and was feeling so sick that he could not continue to perform his duties as copilot. Recognizing that Karasholakov was genuinely incapacitated, Captain Aushev agreed to let him swap places with the safety pilot Sokolov, who took over the right seat for the second approach.
Despite Sokolov’s help, however, the second approach failed for the same reason as the first. As they climbed away once again, Captain Aushev decided to lay down the law: this time, no one was going to touch the ailerons at all, and they would steer using the rudder only. At first, this technique seemed to be working, and the third approach appeared to be on track to succeed. But at the last moment, the plane started to veer to the left, drifting away from the runway heading less than a minute from landing. Thinking quickly, Aushev announced a change of plans: they would simply land on the parallel runway 19L instead of runway 19R. Moments from touchdown, the pilots managed to straighten out in line with runway 19L, and just like that, victory was upon them. At 15:27, flight 1388 touched down with a shudder of joy, and although the plane almost veered off the left side of the runway, crushing several edge lights in the process, the pilots managed to keep it under control. Finally, after nearly two hours in the air, P4-KCJ came to a stop right side up and in one piece — despite great adversity, they had beaten the odds.
◊◊◊
By the time flight 1388 landed, investigators from Portugal’s Office for the Investigation and Prevention of Accidents in Civil Aviation and Rail, or GPIAAF, were already on their way to Beja. The agency had been notified while the plane was still in the air, during the period when it was clearly out of control and appeared certain to crash. Although pleasantly surprised that the plane had landed intact, investigators knew that flight 1388 could very easily have ended in disaster, and a thorough investigation would be needed. Indeed, an inspection of the airplane showed just how close they came to catastrophe: after repeatedly exceeding the design limit load, the wings, skin panels, and fuselage structure had all been irreversibly warped, and numerous measurements were found to be out of tolerances. In many locations the skin had become visibly wavy, and the wings had been permanently bent upward toward the tips. The damage was so extensive that the plane was declared a total loss, and it never flew again.
As for the crew, they were damaged in their own way. In addition to the sprained ankle suffered by one of the technicians, several occupants were treated for acute nausea induced by the plane’s wild maneuvering, including First Officer Karasholakov, who was the worst affected. In addition, all three pilots were affected psychologically by the period of prolonged stress in the face of near certain death, and all were granted indefinite leave until such time as they felt comfortable returning to the cockpit — which all three eventually did.
Meanwhile in Beja, one of the first things the investigators looked at was the aileron control cables. Lo and behold, the “up” and “down” cables in both wings had been reversed near where the non-contact structural supports were installed during the recent maintenance. Although plenty of testing and simulations would later be performed, it was fairly obvious that this was the cause of the pilots’ difficulties.
The GPIAAF eventually determined that technicians at OGMA had installed the cables backwards while attempting to follow confusing instructions in Embraer’s maintenance manual. Once this mistake was made, their ability to detect it was compromised for three main reasons. First of all, when an independent inspector looked over the work, it would have been difficult to discern that the cables had been crossed, due to the unusual changes in the cables’ relative orientation in the area where the mistake occurred. Second, the synoptic page used during the operational tests highlighted the controls in green to indicate that the test conditions had been met, not necessarily that the test had passed, a fact which was explicitly stated in the flight operations manual but not in the maintenance manual. And third, none of the technicians possessed the aeronautical knowledge required to understand which way the ailerons and spoilers were supposed to move, and although this was explained in the maintenance manual, it does not appear that they had properly comprehended the relevant section.
The fact that this lack of knowledge was so widespread led investigators to conclude that the problem likely began on an organizational level. Although OGMA had been around for many years, it had recently begun to suffer from excessive staff turnover, resulting in a hemorrhaging of institutional experience. This effect was compounded by a lack of effective competency testing which could prove technicians’ breadth of knowledge. In addition to these, the GPIAAF also criticized OGMA for sloppy bookkeeping, with inconsistencies observed in inspection paperwork and work cards, suggesting an insufficiently rigorous adherence to proper procedures.
The GPIAAF also criticized Embraer for producing confusing maintenance diagrams, and for issuing a service bulletin which undermined the certification basis of the aileron control system. In fact, European Union regulations require that a cable-based control system feature cables which cannot be swapped, or, if this is not possible, cables which are so clearly marked as to make their reversal improbable. Embraer demonstrated compliance with this rule by unorthodox means — namely, by claiming that the cables would never be removed simultaneously, ensuring that they could only be reinstalled in the same positions they came from. But by issuing a service bulletin which required the concurrent removal of both cables, Embraer violated the system’s certification basis. Although not explicitly stated in the GPIAAF’s report, this made the service bulletin, as written, illegal.
In this author’s opinion — one which was echoed by Air Astana in its comments on the final report — there are a number of other areas, not clearly mentioned by the GPIAAF, where the design of the E190 and its accompanying documentation were lacking. Foremost among them was the fact that reversed aileron cables would not trigger a FLT CTR NO DISPATCH warning, which meant that if no other incidental faults had occurred, it would have been possible to immediately dispatch the plane in this state, at which point the thoroughness of the pilots’ control checks would be the only safeguard against disaster. Although in this case additional steps were required to clear the warning before the plane was dispatched, in theory it could have gone straight from maintenance to takeoff without any obvious indication that something was wrong. The only negative indication in such a case would be the failure of the Continuous Built-in Tests to complete during the return to service check, but according to the flight manual, correct completion of the CBITs was not required in order to dispatch the airplane, so this indication was meaningless.
In addition to these issues, it is also worth noting that the fault isolation manual did not list reversed aileron cables as a potential reason for a failure to clear a FLT CTR NO DISPATCH warning; the maintenance manual did not explain that the green boxes around the flight controls on the synoptic page do not mean that the control checks have passed; the official control check procedure did not ask the pilots to identify the direction of control surface movement; and the maintenance manual’s explanation of proper aileron and spoiler movement used the abbreviations “CW” and “CCW” for “clockwise” and “counterclockwise” without explaining what the abbreviations meant, something which could have tripped up non-native English speakers.
◊◊◊
At this point it should be noted that the GPIAAF produced a final report which looked very slick and modern, but which was at times confusing and lacking in detail. The description of the events of the flight itself, as related in this article, had to be gleaned from a number of different, sometimes contradictory sources, so the exact order and timing of events should be taken with a grain of salt. Furthermore, most of the information about the maneuvers made by the airplane had to be inferred from a single, blurry chart reproduced in the report without context, so all stated altitudes, speeds, and descent rates come with significant error bars. This is information that one would normally find in a final report, but it was conspicuously absent.
Furthermore, the final report did not describe the exact sequence of events on the workshop floor which led to the reversal of the aileron cables; made claims about the quality of OGMA’s organization and safety culture without backing them up with specific examples; and exhibited numerous instances of ambiguous or improper English translation. Most of these issues were explicitly called out by Air Astana in its comments on the report, only for the airline’s suggestions to be rejected. In fact, despite the GPIAAF’s insistence that its report contained sufficient detail, this article was only able to achieve its present level of clarity thanks to additional information contained in Air Astana’s comments.
OGMA also added comments which included some useful information, particularly regarding the “green boxes” on the synoptic page, but by and large the company’s response came across as aggressive and unrepentant. OGMA was clearly unwilling to accept any responsibility for the incident, going so far as to claim that knowledge of proper aileron and spoiler movement was “irrelevant” as long as its technicians followed the manual, which it claimed they did. The company also sought to blame the pilots for the non-detection of the screwup, writing that the dispatch of the plane in an airworthy state was ultimately their responsibility, and that it should have been obvious to them that the ailerons were not responding correctly. OGMA in fact argued that the pilots probably didn’t perform the pre-flight control checks at all, and accused them of negligence. For its part, the GPIAAF argued that the control checks had likely become rote, leading to inattention and automatic behavior which led them to miss the fact that the synoptic page, which should have been open, showed the ailerons moving the wrong way. In any case, it was hard to believe that the pilots deserved much blame for an event which was made possible by Embraer’s poor design and OGMA’s poor maintenance practices.
◊◊◊
As a result of the incident, safety actions were taken by all of the parties involved. Air Astana increased its oversight of its maintenance contractors; introduced special procedures for pilots performing maintenance acceptance flights, including the provision of information about what systems were worked on; and changed its standard operating procedures to require pilots to call out the direction of control surface movement during the pre-flight control checks. Embraer improved the quality of its maintenance manuals and illustrations; reworked the service bulletin so as not to require simultaneous removal of both aileron cables; and started working on a new alert message which would explicitly warn the crew if the aileron cables were installed incorrectly. (It should be noted that the GPIAAF wanted more concrete design changes, which Embraer rejected.) And OGMA initiated an overhaul of its quality control and inspections, contracted an external company to improve its safety management system, and took steps to improve its competency assessments.
At this point I would like to reassure the reader of the fact that most airliners have control cables that cannot be accidentally swapped. The design of the E190 was uniquely poor in this regard, but it is not clear that Embraer’s actions have totally eliminated the possibility of a similar incident happening again. Fortunately, however, that’s something only pilots will have to worry about, because the first flight after heavy maintenance is never conducted with passengers on board.
Let us conclude, then, with a word of congratulations to pilots Vyacheslav Aushev, Bauyrzhan Karasholakov, and Sergey Sokolov for their display of incredible airmanship, which ensured a safe outcome for a flight that could very easily have ended in a fiery crater. Although faced with a daunting emergency, they adhered to their training, stayed calm, and worked together to find a solution. Decisions were made by mutual agreement, everyone’s input was respected, and each pilot ensured that the others were aware of what they were doing. It was textbook crew resource management, a triumph of modern pilot training. And while most emergencies are stabilized quickly, this one was not, and yet the pilots managed to keep it together for more than an hour of near-uncontrolled flight, maintaining their composure in the face of what must have seemed like impossible odds. So next time you fly Air Astana, rest assured — if something goes wrong, you could hardly be in better hands.
_________________________________________________________________
Join the discussion of this article on Reddit!
Visit r/admiralcloudberg to read and discuss over 220 similar articles.
You can also support me on Patreon.
