Crucial to the investigation into the Gazpromavia Superjet 100 crash outside Moscow is whether the pilots could have saved the aircraft after its automatic stall-protection system pushed it into a fatal dive.
Preliminary investigation indicates the Superjet, which came down in a forest on 12 July last year, was fed inaccurate data from its angle-of-attack sensors and responded by pitching the aircraft nose-down to avert a stall.
Comparisons with the Boeing 737 Max, and its controversial MCAS software, are inevitable. MCAS trimmed the Max nose-down by moving the horizontal stabiliser if the aircraft detected excessive angle-of-attack after flap retraction.
False data from a single angle-of-attack sensor, which repeatedly triggered this MCAS nose-down response, led to two 737 Max accidents – involving Lion Air and Ethiopian Airlines aircraft – in 2018 and 2019. In each case the crew had tried unsuccessfully to raise the nose by pulling the control yokes.
The Max accidents exposed fundamentally incorrect design assumptions regarding pilots’ abilities to detect, react and counter persistent MCAS activation, even though Boeing had developed cut-out procedures to override MCAS.
MCAS was particularly vulnerable because it relied on a single angle-of-attack sensor input. But the Superjet accident appears to have originated from the misalignment, during maintenance, of two such sensors.
Four angle-of-attack sensors – one pair either side of the cockpit and one pair either side of the forward passenger cabin – are linked to the Superjet’s air-data system. Each of two primary air-data computers is connected to its own sensor, while a back-up computer is connected to two, one each side of the aircraft.
Russian Interstate Aviation Committee investigators will have to determine whether the Gazpromavia Superjet pilots could have detected and understood the sensor misalignment in time to respond effectively.
While the inquiry has yet to reach conclusions, Superjet manufacturer Yakovlev has issued a bulletin to operators detailing the air-data computer logic in response to two equally-incorrect angle-of-attack sensor indications, which would make validity comparison difficult.
If the air-data computers receive identical incorrect angle-of-attack signals, it states, then retracting the flaps and increasing the Mach number can activate the stall-protection system, because the protection thresholds reduce in such circumstances.
It adds that the symmetrical deployment of spoilers as part of a speed-limiting algorithm can increase drag while adversely affecting lift.
Yakovlev has outlined indirect signs of a potential angle-of-attack sensor misalignment which could warn pilots in time for them to take preventative action.
These include indications of stable angle-of-attack values above 2° when the aircraft reaches 60kt during the take-off run, until the point of rotation, as well as a “significant” difference – more than 4° – between the pitch and the angle-of-attack in level flight.
The bulletin also cautions of “uncharacteristically large” angle-of-attack values when flying at speeds above VLS – the lowest selectable speed with the autothrust engaged – or a significant rise, more than 30kt, in the angle-of-attack protection speed during manoeuvring, with the autopilot engaged and speedbrakes retracted.
Yakovlev also says the aircraft could transition to a steady descent that “cannot be countered” by fully deflecting the sidestick backwards.
The Superjet inquiry indicates that, prior to flap retraction, the Gazpromavia aircraft detected a discrepancy in airspeed readings between the air-data systems, and that this generated warnings to the crew.
Cockpit-voice recorder information shows the crew queried the discrepancy warning, for which there is a quick-reference procedure that involves cross-checking speeds and altitudes on the primary flight displays and the standby instruments, to identify a failed air-data system and switch to the back-up.
If the failed system cannot be identified, the checklist points to a separate procedure for invalid speed indication, which includes disconnecting the autopilot and autothrottle.
In preliminary findings, the Interstate Aviation Committee says the crew checked airspeed readings on their primary displays, found they were consistent, and opted to continue the flight.
Following this decision, the crew sought to climb towards cruising altitude and – with the autopilot and autothrottle still engaged – selected a target altitude and speed, and fully retracted the flaps.
As the Superjet started to climb, its angle-of-attack protection function almost simultaneously adjusted the stabiliser to counter with nose-down attitude. In order to avoid aggravating the angle-of-attack situation, the function limited the effectiveness of the crew’s pulling back on the sidesticks.
While reacting to the unexpected descent, the pilots mentioned unreliable airspeed, although the crew “did not perform” the invalid airspeed checklist, says the inquiry. The autothrottle, however, was disconnected and, under manual thrust control, the aircraft’s speed increased to excessive levels.
The Superjet’s automatic response to overspeed generated a pitch-up tendency, exacerbating the angle-of-attack situation, and causing the to jet to dive into a forest. None of the three occupants survived.
The Interstate Aviation Committee says its final report into the accident will include an “evaluation of the implementation” of quick-reference procedures by the crew.
But Yakovlev’s bulletin states that actions “in accordance” with current quick-reference handbook procedures for incorrect speed indication and overspeed alarm “make it possible to prevent development of a catastrophic situation” and “transform” it into one which is simpler to manage.
It adds that the essential part of the incorrect speed indication procedure, performed from memory, is stabilising the aircraft’s motion in order to carry out subsequent quick-reference handbook actions.
Operators and training organisations should teach monitoring pilots to pay attention to angle-of-attack data – especially after heavy maintenance work – upon reaching 80kt during the take-off roll.
“Early detection of an error in angle-of-attack sensor installation, at speeds up to V1, will allow the crew to abort take-off, thereby preventing more serious consequences,” the bulletin adds.
