Moscow oblast

The accident was the consequence of the activation and simultaneous operation of the protections of the fly-by-wire system for maximum airspeed and angle of attack. The activation of the airspeed protection function became possible after the crew exceeded the indicated airspeed limit due to uncertainty caused by an abnormal in-flight situation. This situation was characterized by the absence of the expected response of the aircraft to crew control inputs, excessively high angles of attack not consistent with the indicated airspeed, and the absence of operational recommendations for flight crews in the event of a fly-by-wire (FBW) system failure (since such a scenario was not included in the RRJ-95 Abnormal Procedures Checklist). The angle-of-attack (AoA) protection function was triggered because the consolidated angle-of-attack value reached the threshold for its activation, as a result of erroneous (excessively high) readings from the angle-of-attack sensors of the two primary air data systems. The erroneous angle-of-attack indications were caused by the mix-up of the covers of the left and right angle-of-attack sensors during their removal/installation, resulting from violations of the RRJ-95 Maintenance Manual requirements during maintenance at the aircraft repair facility.

The accident occurred during takeoff, in daytime (06:15 local time), under visual meteorological conditions, as a result of the aircraft striking a flock of seagulls immediately after liftoff, at an altitude of 0.6–1.2 m (2–4 ft). Some of the birds had an individual mass exceeding 1.13 kg (2.5 lbs), which corresponds to the certification category of a “large bird.” The bird strike caused mechanical damage to both engines, reducing their combined available thrust to a level below that of a single functioning engine operating at FLEX 49 (the takeoff setting used). This made it impossible to continue the flight in the aircraft’s actual configuration (landing gear not yet retracted), resulting in a forced landing outside the airport. In terms of available engine thrust, the situation exceeded the operational conditions anticipated during the aircraft type certification. Given the extent of the engine damage, even maintaining the limited available thrust could not be guaranteed had the crew attempted to continue the flight. Taking into account that the situation exceeded expected operational conditions—meaning there were no standard operating procedures for such circumstances—and considering the aircraft manufacturer’s position during the investigation that the ability to safely continue the flight would have depended critically on extremely precise pilot handling (control inputs during maneuvering, turns, etc.) and external factors (wind gusts, turbulence), it is not possible to unambiguously classify the hazards identified in the investigation as contributing factors. However, because these hazards pose clear risks to flight safety and require risk-reduction measures, they are listed below:
- Non-compliance of the main regulatory document in force at the time of the accident (ROOP GA-89, governing wildlife hazard management at civil aerodromes of the Russian Federation) with ICAO documentation, best international practice, and modern ornithological knowledge. This document was declared invalid by the Russian Ministry of Transport on 04.12.2020 (Order No. 541). No replacement document defining the procedure for airport wildlife hazard management has been issued, creating unacceptable risks given the complex bird-strike environment at many Russian aerodromes.
- The presence of a significant number of bird-attracting features (bodies of water, landfills, agricultural fields, etc.) in close proximity to the aerodrome, and landfills located in violation of the requirements of the Ramenskoye Airport Wildlife Hazard Management Instruction.
- Deficiencies in the organization of wildlife hazard management at Ramenskoye Airport, including ecological-ornithological assessment, implementation of bird-scaring measures, and runway inspections.
- A widespread practice (not only at Ramenskoye) of routinely informing crews about “bird movements” regardless of the actual threat level, which caused the warnings to lose their alerting value and become mere background noise.
- Lack of regulatory provisions and/or standard operating procedures describing required crew actions when the presence of birds on or near the runway is suspected (but cannot be visually confirmed) that could pose a risk to flight safety.
- Limited ability of airlines to assess avian-hazard risks due to the lack of reliable data sources on the bird environment at the aerodrome, resulting in insufficient information provided to flight crews about ornithological hazards at Ramenskoye.
- A discrepancy between the actual in-flight situation and scenarios practiced in simulators, caused by a false momentary indication of an “open thrust-reverser door” on the left engine triggered by the bird strike. This contributed to a psychophysiological surge (stress spike) and temporary disorganization of the crew’s actions during the continued takeoff procedure, including the omission of landing gear retraction.

The air accident to the RRJ-95B RA-89098 aircraft was caused by the uncoordinated control inputs by the PIC at the flare, landing and through the several repeated bounces of the aircraft off the RWY (the porpoising), having manifested in the several disproportionate alternating sidestick inputs in pitch with keeping the sidestick retained against each stop. The indicated control inputs had resulted in three hard touchdowns of the aircraft, as a consequence at the second and third touchdowns the absorbed energy significantly exceeded the maximum values, for which the structural integrity had been evaluated at the aircraft type certification, which led to the destruction of the airframe structural elements, the fuel tanks with the fuel spillage and the fire onset.
The contributing factors to the accident were:
- The ineffectiveness of the RRJ-95 flight personnel approved training programs as for the actions into the major failure condition//abnormal situation at the FBWCS reversion to DIRECT MODE and, consequently, the insufficient knowledge and skills at the flight crew members to operate the airplane in this mode. The training programs met the minimum requirements, determined by FAR, but did not account for the specific nature of a particular emergency;
- The ineffectiveness of the airline SMS in terms of the monitoring of the piloting sustainable skills development at the pilots, which prevented the identification and elimination of the PIC’s common systematic errors at the sidestick pitch control at the stage of landing, including these, associated with its forward inputs beyond neutral (to nose down) into the flare;
- The failure to identify the biases (hazards) in the airline flight crews’ piloting technique as far the previous events of the FBWCS reversion to DIRECT MODE are concerned and thus the failure to implement preventive measures;
- The aircraft operational documentation unclear wording in terms of the piloting peculiarities at flare and the correction of the deviations at the landing (counteracting the consecutive aircraft separations off the RWY);
- The failure of the crew to comply to the FAR and OM requirements at the flight preparation and performance at the actual and forecast thunderstorm activity, as well as at the availability to observe these zones on the weather radar display, which had resulted in the aircraft encounter the atmospheric electricity, the EIUs reboot and the FBWCS reversion to DIRECT MODE. As per the certification results the FBWCS reversion to DIRECT MODE had been assessed as «the major failure condition», the in-flight onset of «the major failure condition» at the lightning or static electricity exposure does not contradict the applicable certification requirements;
- The dramatic increase of the psycho emotional stress at the PIC because of the aircraft exposure to atmospheric electricity and the failure within a long time to ensure the acceptable piloting precision at the FBWCS in DIRECT MODE, which led to the psychological dominant mindset formation to perform immediate landing together with the lack of readiness to initiate go around (not go-around minded);
- Psychological personality traits of the flight crew members that determine their behavior in the stress environment, as well as the PIC’s insufficient training in human factor/performance and threat and error management approach, which prevented the objective assessment of his psycho emotional condition and the ability to control the airplane, to choose the optimal strategy to proceed the flight, as well as to establish the required interaction and CRM;
- The failure of the PIC to ensure the aircraft pitch trim under the manual control, including at the glideslope descent;
- The incorrect assessment of the situation by the crew at the Predictive Windshear warning (GO AROUND WINDSHEAR AHEAD) trigger at the flight on glideslope and, consequently, the non-initiation of a go-around maneuver, that resulted in the aircraft encounter the wind microburst at the early flare and affected the aircraft flight path. The documentation by the aircraft designer and the airline allows the crew to ignore the subject warning activation, if it made sure there is «no windshear threat», still the operational documentation and the OM do not integrate the respective clear criteria of «no threat»;
- The purposeful ducking under the glideslope by the PIC at the final approach (after passing DH);
- The difference between the airline OM provisions as for the crew actions at the glideslope warning activation (the excessive deviation off the glideslope equisignal zone) and the similar provisions in the aircraft designer documentation. Subject to the provisions of the aircraft designer documentation the crew should have performed go-around;
- The unjustified extension by the airline of the approach «stabilized condition» criteria as for the acceptable deviations range off the target speed, which at the actual IAS of 15 kt higher against the target one and the FBWCS in DIRECT MODE resulted in the unexpected for the PIC increased aircraft response to the sidestick input in pitch;
- The failure by the crew to carry out the SOP on the manual speed brakes deployment at the aircraft touchdown. The operational documentation unclear wording and the monitoring algorithms of the landing configuration, used at the aircraft that require to arm the speedbrakes for the automatic deployment, including at FBWCS in DIRECT MODE, in which the automatic deployment is disabled, degrade the crew’s situational awareness as for this aspect.
- The TR actuation after the first bounce off the RWY, which had made the subsequent go-around impossible. As per the results of the forensic medical examination the death of 40 out of 41 fatally injured people had been caused by the exposure to open flame, accompanied with the burns of the upper respiratory tract through the inhalation of hot air. The fire erupted after the aircraft third touchdown due to the disintegration of the wing fuel tanks and the fuel spillage. The fuel spillage occurred as due to the destruction at the landing gear retraction/extension actuating cylinders attachment points, as well as due to the destruction of the other wing parts. The landing gear structure had been damaged at the second touchdown that is at the third touchdown functioned beyond the expected operational conditions and had not been able to bear the applied landing loads as designed. The operation (destruction) of the landing gear fuse pins («weak links») at the second touchdown had been consistent with the design integrated logic. With that the loads, actually accomplished, had been less of those in use to demonstrate compliance to AR-25 item 25.721 at the aircraft type certification, which prevented the MLG legs to completely separate off the airplane structure (it is only the Attachment A fuse pins that had been destructed). No correlation between the certification requirements for the structure, including MLG legs structure, and the conditions for demonstrating their safe separation off results in actual significant risks of the fuel tanks disintegration and the fuel spillage even in case of compliance demonstration to every single of these requirements. At its very onset the fire by its nature had been the deflagration flash, which had been accompanied with an intense smoke release with the onset of a steady burning in two seconds. By the point of the evacuation initiation the fire had been propagated inside the cabin through a row of cabin windows at the rear fuselage along the right and left sides, with that the airworthiness standards do not set up the requirements for the cabin windows as to the external fire protection. That situation had been beyond the expected operational conditions as there had been no time margin (90 sec), at which the crew and passengers’ emergency evacuation is demonstrated at the type certification.
Most probably the following factors had contributed to the increase in the severity of the consequences:
- The running engines of the aircraft, having been not timely shut down by the crew;
- Large amount of fuel, spilling out of both wing panels, which penetrated the area of the exhaust-mixing nozzles, exposed directly to their jet streams;
- The inability to evacuate through both of the rear emergency exits;
- The manifestation of the flashover effect at the rear passenger cabin;
- The crush and panic among the passengers;
- The efforts by a number of passengers to pick up their carry-on luggage at the evacuation;
- The CFA’s error in operating the PACIS, and consequently the decline in the passengers’ situational awareness as for the evacuation procedure.

The reason for the accident with the Gulfstream G200 4K-AZ88 was the stowing of the right-engine reverser by the pilot KVS from maximum thrust reversal while maintaining maximum thrust reversal on the left engine, which led to the appearance of a significant turning moment to the left. The aircraft turning to the left in the presence of a cross wind to the right, as well as turbulence of the airflow near the rudder due to the open thrust reversal mechanism of the left engine and possible ice deposition on the outer surfaces of the aircraft, which led to the development of a significant swing moment on the rudder. The development of a significant articulated moment on the rudder, in the absence of power steering in the rudder control system, led to its deviation to the leftmost position despite significant (up to 82 kg or 180 pounds) forces exerted by the crew on the pedals. The deviation of the rudder (pedals) to the left also led to the deviation of the nose wheel to the left. The total moment from the running reverse of the left engine, from the right engine in direct draft mode, and from the rudder and nose wheel deflection to the left, led to the aircraft rolling out of the runway and its damage. Separate braking applied by the crew could not prevent the aircraft from rolling out.

The following contributing factors were identified:
- The crew did not take into account the provisions of the AOM about the possible "destabilizing" effect of the thrust reverse when landing with a cross wind on the runway with a reduced braking coefficient;
- Increased psycho-emotional tension of the crew members due to long dissatisfaction and emotional discussion of instructions and actions of ATC controllers. At the same time, the instructions and actions of the ATC service controllers were in line with established procedures.

The accident was the consequence of erroneous actions on part of the crew while climbing in instrument meteorological conditions at unreliable readings of instrument speed caused by icing (blockage with ice) of all three Pitot tubes. This caused the aircraft to become uncontrollable, enter a dive and eventually collide with the ground. The accident was then considered as a loss of control in flight (LOC-I). The investigation revealed systemic weaknesses in the identification of hazards and risk control, the inoperability of the airline's flight safety management system and the lack of control over the level of training of crew members by aviation authorities at all levels, which led to the issuance of certificates of aviation personnel and the admission to the flights of the crew, which did not fully meet the qualification requirements. The following contributing factors were reported:
- Hurry of the crew in preparation for the flight due to the late arrival of the aircraft from the previous flight and attempts to "catch up" with the time,
- Skipping by the crew of the operation to switch on the Pitot tube heating before takeoff and failing to comply with the section of the check list "BEFORE TAKE-OFF", which provides for the control of this action,
- Design features of the An-148 aircraft in terms of the restrictions on the duration of Pitot tube heating operation on the ground, which led to the need to carry out operations to control the inclusion of Pitot tube heating and compliance with the principle of "dark cockpit" in a separate section of the "BEFORE THE FLIGHT" check list, which is performed immediately before the start of the takeoff run, which creates additional risks of missing these operations. These actions are provided in the section "ON THE RUNWAY START",
- Systematic failure of the airline's crews to comply with the "dark cockpit" principle and the requirements of the radar, which contributed to "getting used" to the takeoff with the presence of emergency and warning messages on the Integrated system and alarm indicator (KISS) and did not allow to identify the fact that the Pitot tube heating was not included. In the accident flight before takeoff, six warning messages were displayed on the KISS, including three messages about the absence of Pitot tube heating,
- Design features of the An-148 aircraft, connected with the impossibility to disable the display of a number of warning messages on the KISS even when performing the whole range of works provided for by the MMEL while ensuring the flight with delayed defects,
- Low safety culture in the airline, which was manifested in: systematic failure to record in the flight log the failures detected during the flight, as well as in the performance of flights with the failures not eliminated and/or not included in the list of delayed failures, accompanied by the corresponding messages on the KISS,
- Failure to take necessary measures in case of detection of previous facts of untimely activation of Pitot tube heating by crews based on the results of express analysis of flight information,
- Unreadiness of the crew to take actions in case of triggering the alarm "Speed of Emergency" due to the lack of appropriate theoretical training in the airline and the impossibility to work out this special situation on the flight simulation device and / or during airfield training and, as a consequence, failure to comply with the procedures provided for after triggering of this alarm,
- Absence of federal aviation regulations for certification of flight simulators, the development of which is provided for by the Air Code of the Russian Federation,
- Approval for the existing AN-148 flight simulators of the IFC Training LLC and the CTC of the Saint-Petersburg State University of Civil Aviation without taking into account their actual capabilities to reproduce special flight cases, as well as the provisions of FAR-128,
- Absence of specific values of flight parameters (engine operation mode, pitch and roll angles, etc.) in the aircraft's flight manual, which must be maintained by the crew of the airspeed alarm system, as well as absence of the situation with unreliable instrument speed readings (Unreliable Airspeed Procedure) in the list of special flight cases,
- Increased psycho-emotional tension of crew members at the final stage of the flight due to inability to understand the causes of speed fluctuations and, as a consequence, the captain falling under the influence of the "tunnel effect" with the formation of the dominating factor of speed control according to the "own" (left) airspeed indicator without a comprehensive assessment of flight parameters,
- Insufficient training of pilots in the field of human factor, methods of threat and error control and management of crew resources,
- Individual psychological peculiarities of pilots (for the captain - reduction of intellectual and behavioral flexibility, fixation on their own position with the inability (impossibility) to "hear" prompts from the second pilot; for the second pilot - violation of the organization and sequence of actions), which in a stressful situation in the absence of proper level of management of the crew resources came to the fore; loss of the captain's psychological performance (psychological stupor, psychological incapacitation), which resulted in complete loss of spatial orientation and did not allow reacting to correct prompts and actions of the co-pilot, including when triggering the PULL UP warning of the EGPWS system,
- Absence of psychological incapacitation criteria in the airline's AFM, which prevented the second pilot from taking more drastic measures,
- High annual leave arrears for special conditions, which could lead to fatigue and negatively affect the performance of the captain,
- Operation of the aircraft control system in the longitudinal channel in the reconfiguration mode with unreliable signals of instrument speed, not described in the operational documentation, related to a double increase in the transfer coefficient from the hand wheel to the steering wheel in the flight configuration and constant deviation of the steering wheel for diving (without deviation of the steering wheel) for about 60 seconds, which reduced the time required for the crew to recognize the situation.

The most likely cause of the crash of the An-2 RA-35171 was the failure of the PIC to pilot the An-2 aircraft at high flight speeds (an increase in the time required for the aircraft to leave the bank due to the decrease in the angles of the aileron deflection due to the pulling of the cable line due to a significant increase in forces in the transverse of the control channel at speeds of 270-300 km/h), which did not allow the aircraft to arrest the descent when maneuvering with large angles of bank at an extremely low flight altitude.
The contributing factors were:
- Piloting the aircraft at modes beyond the limits set by the AFM of the An-2 aircraft;
- Maneuvering at an altitude less than that established for performing a demonstration flight over the aerodrome.

The accident occurred at nighttime under foggy conditions while it was taking off after cleared by the controller due to collision with the snowplow that executed runway incursion and stopped on the runway. Most probably, the accident was caused by the combination of the following contributing factors:
- lack of guidance on loss of control over an airdrome vehicle and/or situational awareness on the airfield in pertinent documents defining the duties of airdrome service personnel (airdrome shift supervisor and vehicle drivers);
- insufficient efficiency of risk mitigation measures to prevent runway incursions in terms of airdrome peculiarilies that is two intersecling runways;
- lack of proper supervision from the airdrome service shift supervisor, alcohol detected in his organism, over the airfield operations: no report to the ATM or request to the snowplow driver as he lost visual contact with the snowplow;
- violation by the airdrome service shift supervisor of the procedure for airdrome vehicles operations, their entering the runway (RWY 2) out of operation (closed for takeoff and landing operations) without requesting and receiving clearance from the ground controller;
- violations by the medical personnel of Vnukovo AP of vehicle driver medical check requirements by performing formally (only exterior assessment) the mandatory medical check of drivers after the duty, which significantly increased the risk of drivers consuning alcohol during the duty. The measures and controls applied at Vnukovo Airport to mitigate the risk of airdrome drivers doing their duties under the influence of alcohol were not effective enough;
- no possibility for the snowplow drivers engaged in airfield operations (due to lack of pertinent equipment on the airdrome vehicles) to continuously listen to the radio exchange at the Departure Control frequency, which does not comply with the Interaction Procedure of the Airdrome Service with Vnukovo ATC Center.
- loss of situational awareness by the snowplow driver, alcohol detected in his organism, while perfonning airfield operations that led to runway incursion and stop on the runway in use.
His failure to contact the airdrome service shift supervisor or ATC controllers after situational awareness was lost;
- ineffective procedures that resulted in insufficiently trained personnel using the airfield surveillance and control subsystem A3000 of A-SMGCS at the Vnukovo ATC Center, for air traffic management;
- no recommendation in the SOP of ATM personnel of Vnukovo ATC Center on how to set up the airfield surveillance and control subsystem A3000, including activation and deactivation of the Reserved Lines and alerts (as a result, all alerts were de-activated at the departure controller and ground controller's working positions) as well as how to operate the system including attention allocation techniques during aircraft takeoff and actions to deal with the subsystem messages and alerts;
- the porting of the screen second input of the A3000 A-SMGCS at the ATC shift supervisor WP for the display of the weather information that is not envisaged by the operational manual of the airfield surveillance and control subsystem. When weather information is selected to be displayed the radar data and the light alerts (which were present during the accident takeoff) become un available for the specialist that occupies the ATC shift supervisor's working position;
- the ATC shift supervisor's decision to join the sectors at working positions of Ground and Departure Control without considering the actual level of personnel training and possibilities for them to use the information of the airfield surveillance and control system (the criteria for joining of sectors are not defined in the Job Description of ATC shift supervisor, in particular it does not take into account the technical impossibility to change settings of the airfield surveillance and control system);
- failure by the ground controller to comply with the SOPs, by not taking actions to prevent the incursion of RWY 2 that was closed for takeoff and landing operations by the vehicles though having radar information and alert on the screen of the airfield surveillance and control system;
- failure by the out of staff instructor controller and trainee controller (providing ATM under the supervision of the instructor controller) to detect two runway incursions by the snowplow on the runway in use, including after the aircrew had been cleared to take off (as the clearance was given, the runway was clear), provided there was pertinent radar information on the screen of the airfield surveillance and control subsystem and as a result failure to inform the crew about the obstacle on the runway;
- lack of recommendations at the time of the accident in the Operator's (Unijet) FOM for flight crews on actions when external threats appear (e.g. foreign objects on the runway) during the takeoff;
- the crew failing to take measures to reject takeoff as soon as the Captain mentioned «the car crossing the road». No decision to abort takeoff might have been caused by probable nonoptimal psycho-emotional status of the crew (the long wait for the departure at an unfamiliar airport and their desire to fly home as soon as possible), which might have made it difficult for them to assess the actual threat level as they noticed the snowplow after they had started the takeoff run;
- the design peculiarity of the Falcon 50EX aircraft (the nose wheel steering can only be controlled from the LH seat) resulting in necessity to transfer aircraft control at a high workload phase of the takeoff roll when the FO (seated right) performs the takeoff.