On the An-28, the electrically actuated flap system drew power from a 27-volt battery. Moving the electric flap switch to any of its various positions would complete a circuit, causing current to flow from the battery and through the flap operating solenoids in the manner corresponding to the selected position. This current would then go to ground via a terminal block called A6X1, which served as a common endpoint for a number of different wires from several circuits.
After reaching the A6X1 terminal block, the normal current path was through one of two wires, called M01 and M02 respectively, which both connected to a single “grounding screw.” This screw was in turn attached to the aircraft chassis, allowing the current to enter the chassis and return to the opposite terminal of the battery.
A feathered vs. unfeathered propeller. (SkyBrary)
However, the flaps were not the only system connected to ground via terminal block A6X1. The other major system utilizing this terminal block was the An-28’s propeller autofeather mechanism.
As I’ve discussed in many previous articles, the propellers on turboprop aircraft have adjustable blade pitch. When the edges of the blades are in line with the propeller’s plane of rotation, they don’t take any bite out of the air; they will spin freely with little resistance. Increasing the angle of the blades will cause them to start taking a bigger bite out of the air, forcing air backward to generate thrust. But if the blade angle increases so far that the edges of the blades are perpendicular to the plane of rotation, then the propeller will no longer be able to force any air backward, and thrust again drops to zero. This is known as the “feathered” position (see above).
If a turboprop engine were to fail in flight, the turbine would stop powering the propeller. If the blades are still angled to produce thrust, then instead of the blades taking a bite out of the air, the oncoming air will start to take a bite out of the blades, so to speak, driving the propeller, and thus the turbine, in reverse. This causes a lot of drag that negatively affects performance, so in order to prevent this from happening, turboprop aircraft are equipped with an autofeather system that automatically rotates the blades to the feathered position in the event of an engine failure. This can also be done by the pilots using a cockpit switch, should the need arise. Once the blades are feathered, the oncoming airflow will no longer be able to get enough leverage to drive the propeller, eliminating the excess drag.
How the current should flow through the feathering circuit during manual or automatic propeller feathering. This isn’t “normal” operation because normally no propellers should feather in flight. (AAIB, annotations mine)
On the An-28, the autofeather system could be activated by closing one or both of two switches, designated 7S19 and 7S20, respectively, one for each propeller. (Henceforth, I’ll be calling these the “feathering switches.”) The switches each had two terminals: a permanently non-energized terminal that was normally closed (i.e. making contact), and a normally open terminal, which if it were to close would energize the feathering circuits. These switches controlled power to the feathering circuits regardless of whether the feathering command was automatic or manual. Should either of these circuits be completed, power would flow from the battery, through the activated switch(es), and down a wire to the 7-K6 feathering relays, which transmitted the feather command to the blade pitch actuation system. After that, the current went to ground in one of two separate locations, one for each of the two identical circuits (depicted above).
However, when the feathering circuits are not energized, which is essentially all of the time, the normally closed ends of both feathering switches are connected via wires to the A6X1 terminal block, and thence to ground via that terminal block’s grounding screw, described previously. These wires should never under any circumstances be energized, because when the feathering system is operational the current will bypass them, and when it is not, there should be no current present. So why was it necessary to ground the normally closed side of the switches, even though there wasn’t supposed to be any current in the circuit when this side of the switch was closed? The answer, as far as I can tell, is that it’s simply good practice to ground any exposed conductor. If the normally closed side of the switch was left connected to nothing, it could serve as an entry point for electromagnetic interference, potentially resulting in uncommanded feathering of one or more propellers. You can think of that exposed conductor like a lightning rod sticking out into space, inviting random energy sources to induce a current into the feathering circuit. Grounding the normally closed side of the switch was therefore a prudent move. As for where to ground it, the A6X1 terminal block was probably chosen just because it was nearby.
All of this may be complicated to visualize, but hopefully the attached diagrams are helping. Studying them carefully should make it much easier to understand the failure that was about to occur. Now, with all this in mind, can you guess where this system had a potential single point of failure?
◊◊◊
If you guessed the grounding screw on terminal block A6X1, then congratulations, you’re better at this than whoever designed the An-28’s electrical system.
The grounding screw was, in fact, simply a screw, and like any screw mounted in a high-vibration environment, it was capable of loosening over time. And the looser it got, the less effectively it contacted the chassis. In fact, if the screw was loose enough, then the resistance between the screw and the chassis would become so great that this would no longer represent the optimal current path.
The “hair in pipe” analogy for electrical resistance. (Wikimedia user Sbyrnes321)
Electrical resistance is the opposite of conductance. The higher an object’s resistance, the harder it is to push a current through that object. The Wikipedia page on resistance and conductivity has a great metaphor for this, which I will shamelessly steal. If you have a water pipe with water flowing through it at a given rate, then that pipe becomes partially blocked with hair, a higher water pressure is required to maintain the same flow rate. Extrapolating further, if another path for the water exists that has a more favorable pressure-to-flow-rate ratio, then the majority of the water will start going that way instead. Electricity is much the same way: the electrons will flow down all available paths at a rate inversely proportional to their relative resistance.
So, if the grounding screw on the A6X1 terminal block were to pull out of the chassis, then there would be an air gap between the screw and the chassis, which has a high resistance. Furthermore, if that resistance is high enough, then the majority of the current might start flowing down a path with lower resistance instead.
Now imagine that the flap operation circuit is energized with the grounding screw no longer connected to the chassis. What’s the path of least resistance back to the battery now? What other path to ground exists?
The failure mode that caused the crash of HA-LAJ. (AAIB, annotations mine)
In fact, with the grounding screw pulled out sufficiently far, the main current will flow from the flap circuit, into terminal block A6X1, then — skipping the screw entirely — up the feathering circuit grounding wires, across the normally closed side of the feathering switches, through the feather circuit wiring, past the 7-K6 feathering relays, and out through the normal grounding points for the feathering circuits. This path is depicted above.
If the resistance between the screw and the chassis was sufficiently high, then enough current could flow down each feathering circuit to activate both 7-K6 feathering relays, causing both propellers to feather simultaneously. This is in fact what happened as the pilots of HA-LAJ retracted the flaps at 500 feet on their 13th parachuting flight.
As soon as the feathering relays were energized, a command was sent to the blade pitch controllers to feather the propellers and hold them there. Then, because the propellers provide no thrust when feathered, the An-28’s engine failure detection system detected a loss of thrust in both engines, causing a number of knock-on effects.
The An-28 has a fairly sophisticated engine failure detection system that automatically shuts off fuel to the engine when a large discrepancy is detected between the power lever position and certain engine operating parameters. Furthermore, because a failed engine on the An-28 tends to produce a large and sudden yawing moment, the system also automatically deploys the outboard wing spoiler on the opposite side from the engine failure, in order to ensure that drag on both sides is as close to equal as possible. This makes the plane easier to control with one engine inoperative. However, in this case, when the engine failure detection system registered the loss of thrust in both engines, it not only cut fuel to each engine but also deployed the outboard spoilers on both wings, because the left engine failure triggered the right spoiler, while the right engine failure triggered the left spoiler. This was consistent with the system’s operating logic but was nevertheless completely unnecessary, because deploying both spoilers simultaneously just increased drag on the airplane while providing no controllability benefits.
The pilots of HA-LAJ had no idea that any of this was about to occur. Instead, it felt almost like the flap switch had suddenly turned into a “crash airplane” button. At the same instant that the flaps were retracted, both propellers feathered, fuel was cut to both engines, and both spoilers deployed, causing a catastrophic loss of both thrust and lift. The plane began to decelerate rapidly, forcing Captain Suskin to push the aircraft into a dive in order to maintain airspeed. If he tried to reduce their descent rate, it was certain that they would lose speed and stall, leading to a devastating crash. But the other outcome didn’t look rosy either. They obviously didn’t have enough height to return to the airfield, but the terrain was littered with obstacles like trees, ditches, and roads. With only seconds to act, Suskin and his First Officer made a snap decision to turn to the right and land in a field of recently harvested corn stubble. There was no time for a brace call, but the parachutists didn’t need one — it was obvious that they were going down, and all they could do was hang on for dear life, since the plane didn’t have seat belts.
The wing attachment points failed during the ground slide but the fuselage remained intact. (AAIB)
Moments later, HA-LAJ touched down hard in the cornfield, with a considerable descent rate, a slight right bank, and a nose high attitude with a forward airspeed of 92 knots. The landing gear swiftly collapsed, causing both wings to fold downward and strike the ground, but within just a few seconds the plane slid to a stop on its belly, otherwise intact.
When the plane came to a halt, the 19 passengers and crew discovered that despite the lack of restraints, everyone had survived the crash landing, and in fact no one was even seriously injured. Furthermore, no fire broke out, and egress was trivial because of the removed rear doors. By the time the pilots had shut down the plane’s remaining systems, all the passengers were already off the airplane with no need for an evacuation call. Subsequently, the First Officer was the last person off, exiting through the cockpit window after stopping to disconnect the battery. Emergency services arrived shortly thereafter, but there was little for them to attend to.
◊◊◊
The A6X1 terminal block as it was found after the accident. (AAIB)
Because the crash was minor and occurred over a bank holiday weekend, Britain’s Air Accidents Investigation Branch didn’t begin an investigation until three days later. Nevertheless, when the investigation did get underway, it resulted in a number of fascinating findings.
Although both pilots had already returned to Russia by the time the AAIB got there, investigators were able to obtain statements from both through the Russian Department of Air Transport, in which they described how the propellers feathered, the engines shut down, and the spoilers deployed when they attempted to retract the flaps. The deployment of the spoilers and feathering of the propellers was confirmed not only by the condition of the wreckage, but by a photograph of the airplane in flight, taken shortly before impact by a nearby witness. My understanding is that this photo remains the property of the photographer and has not been released.
Because the An-28 was designed in the Soviet Union, and because Russia had inherited the USSR’s obligations, investigators from Russia participated in the inquiry, and in fact they were the first to identify a possible mechanism by which the pilots’ command to retract the flaps could have triggered the observed failures. Their suspicions were subsequently proven right when on-scene measurements by the AAIB detected elevated electrical resistance when the flap operating circuit was energized. Subsequently, the grounding screw connecting terminal block A6X1 to the chassis was found loose, having unscrewed itself slowly over time.
Another image of the airplane, taken shortly after the crash by what I assume to be one of the passengers. (Unknown author)
Meanwhile, the AAIB began to uncover a number of facts that raised questions about why HA-LAJ was allowed to fly parachutists at Weston-on-the-Green in the first place. One glaring issue was brought to light by representatives of the Antonov aircraft company — namely, that the An-28 was never intended for parachuting operations, was not approved for that purpose, and was never tested or certified to fly with the rear clamshell doors removed. Representatives of the Russian Department of Air Transport expressed the same views. This contradicted the plane’s Hungarian airworthiness certificate, which stated that HA-LAJ was approved for flight in that configuration. In fact, the operation of the aircraft without the rear doors so alarmed the representatives of Antonov that the final report on the accident describes their statements against the practice as “categorical” and “emphatic.” Elaborating further, Antonov personnel told the AAIB that the An-28 had never been tested for adverse strength, metal fatigue, or flight characteristics without the doors, and that in their view turbulence with the doors removed could result in structural damage to the airplane. However, investigators also wrote that Antonov was strongly opposed to accepting any “liability” — which does make one wonder how much of this response was out of genuine concern, and how much was an attempt to deflect responsibility for the design decisions that caused the crash, which I’ll cover in more detail in a moment.
Another issue that came up was of course the registration of the airplane in two different countries simultaneously. This lapse was accidental, but investigators noted that had Hungarian authorities informed their Russian counterparts of the new registration, as was their obligation, then they would have been required to provide information about the aircraft to the Russian Department of Air Transport. Since this agency was apparently aware that the aircraft was not approved for parachuting operations, it’s possible that they might have brought the discrepancy to the Hungarians’ attention had this required step been completed.
Lastly, and perhaps most importantly, investigators also examined the process by which HA-LAJ was granted permission to fly in the United Kingdom.
Under UK law at the time, in order to hire a foreign aircraft to perform “aerial work,” including parachuting, it was necessary to apply for explicit approval from the Department of Transportation. After demonstrating that no UK-based company could perform the work in question, the Civil Aviation Authority’s Safety Regulation Group–Operating Standards Division was required to verify, among other items, that the aircraft was currently being used for the specified type of work in its home country; that the crew were competent and qualified; and that there was a parachute operations supplement to the Flight Manual. Submission of the aircraft’s certificate of airworthiness and the certificate of the operating company were also required.
In the case of HA-LAJ, there was no question about the competence of the crew or the presence of the correct documents, and the aircraft had previously conducted parachuting flights in Hungary, so the permit was issued. However, the CAA failed to discover that the An-28 was not approved for parachuting operations, because there was no requirement to consult the manufacturer as long as HA-LAJ’s certificate of airworthiness indicated such an approval, which it did. The AAIB was therefore concerned that the verification process had become a rubber stamp, causing discrepancies to be missed. In a worst-case scenario, it might even have been possible for an applicant to hoodwink the CAA simply by inserting false approvals into the submitted documentation. As a result, the AAIB recommended that the CAA Safety Regulation Group consider checking directly with the states of design, manufacture, and registry of aircraft from the former USSR before giving them permits for aerial work in the UK, in order to verify the documentation.
◊◊◊