The full picture
What happened
The Airbus A310 flew from Moscow to Hong Kong. During the cruise flight, the commander allowed his daughter, then his son, into the pilot's seat. When the teenager held the wheel, a prolonged effort led to the shutdown of the autopilot channel responsible for the roll, while maintaining other automation channels.
The change was not accompanied by the loud and unambiguous warning that the untrained observer would have expected. The aircraft began to slowly build up the roll. When the unusual situation became apparent, centrifugal overload made it difficult for pilots to return to the controls.
The crew almost restored the aircraft after a steep decline, but subsequent actions led to a new exit to the dangerous angle of attack. The A310 collided with land in the Kemerovo region. 75 people were killed.
Context and mechanisms
Detailed account
Background, technical details and decisions are examined separately to avoid reducing a complex event to a single explanation.
A new type in a time of great change
Airbus A310-304 F-OGQS was a relatively new wide-body aircraft for Russian civil aviation. It differed from the usual Soviet liners not only by the layout of the cabin, but also by the logic of automatic control, the indication of modes and the distribution of duties between the two pilots. The transition to such a technique required not simply relearning the buttons, but the formation of a new model of human interaction with automation.
Flight 593 was en route from Moscow to Hong Kong's Kaitak Airport. There were 63 passengers and 12 crew on board. The night flight was carried out with a reinforced crew of pilots, so the commanders replaced each other in the seats. At the time of the development of the event, the control bodies had a replacement crew, and one of the commanders stood behind the left armchair.
The flight was on the echelon of about 10,100 meters and externally remained regular. The autopilot led the plane along the route, the weather did not create a critical threat, there were no technical failures before the intervention in the control. It was the tranquility of the stage that became the background on which the professional border of the cabin was violated: the commander’s children were invited to it.
First, my daughter sat in the left chair. The commander changed the course by means of automation, giving the impression that the child turns the plane. Then my son took the place. This time he made a long effort. For a person without training, the steering wheel remained a symbol of complete control, but in the A310 its movement could only change a separate channel of the automatic system.
Partial shutdown, which was not expected
Autopilot A310 controlled the aircraft through several channels. If the pilot applied enough force to the helm, the coupling of the roll channel could disconnect, allowing the person to control the ailerons. At the same time, automatic control of the pitch was not necessarily turned off. The aircraft was in a mixed state: it no longer held the roll, but continued to perform some of the previous automatic functions.
Such a transition was not accompanied by a general audible signal of a complete shutdown of the autopilot. The information was displayed visually, but people's attention was focused on the child and the conversation, not the modebar. The slow start of the roll also did not look like a sudden accident. Within tens of seconds, the slight deviation became large as the crew tried to understand why the route line on the navigation display was shifting.
As the roll grew, the autopilot on the pitch sought to maintain altitude and increased the angle of attack. But in a steep turn, much more lifting power is required to maintain altitude. The plane began to lose speed and altitude, overload increased. This is an example of a dangerous interaction: each function of automation worked logically separately, but in the changed configuration, the overall result became less and less safe.
The meaning of the concept of mode awareness is to constantly know not just “autopilot included”, but which modes and channels are active, what goals they hold and who actually controls each axis. Flight 593 showed that the binary view of “automated or not working” is not enough. Partial transmission of control to a person requires as clear an indication and as quick a reaction as complete failure.
Two critical phases instead of one
By the time the unusual roll was recognized, the angle had reached a value at which people were pressed by overload. The commander behind the chair could not immediately take a normal position. The plane went into a steep turn with a decrease. The crew simultaneously tried to regain access to the controls, determine the position of the devices and understand the state of automation.
In the first phase, the A310 was in a spiral decline. The large roll created a high overload and quickly increased the rate of decline. To recover, it was first necessary to reduce the roll, then control the pitch and prevent excessive overload. The crew was able to stop the rotation and get the aircraft out of the steepest position, which shows that the control was not completely lost due to technical failure.
However, the energy of the aircraft was unstable. After leaving the nose was high, the speed began to fall, and there was a second pile. At this point, the commands and control actions again did not match the required sequence. Attempting to gain altitude immediately after a speed drop is understandable psychologically, but a safe recovery requires first stabilizing the angle of attack and speed.
Recording parameters shows a complex trajectory with large heel angles, pitch, and overloads. At a separate moment, the aircraft approached the restoration of normal flight, but the height was already not enough. A few minutes after the start of the deviation, the A310 collided with a forested slope near Mezhdurechensk. The structure was destroyed and everyone on board was killed.
Why the story does not end with the violation of the commander
The admission of children to the authorities was an obvious and gross violation. But a security investigation should not stop at a moral assessment. It is necessary to understand why the discipline of the cockpit depended only on the self-control of one person, why the other pilots did not stop the situation and why the change in the automation mode was not noticeable enough for immediate recognition.
Organizational culture determines whether a crew member can object to the senior officer. If the presence of the commander’s family is perceived as a private matter, the formal procedure does not work as a barrier. CRM requires security to take precedence over hierarchy: any deviation from the rules must be named, confirmed and terminated regardless of the status of the initiator.
The technical lesson is about the interface. The system can be designed correctly and still create a trap if its mode is difficult to see in a real working environment. After such events, the industry has increased its focus on annunciation - how the plane reports regime change - and on training, where automation behaves unexpectedly, but in accordance with its internal logic.
The third lesson is preparation for upset recovery. The pilot must first determine the position, reduce the angle of attack at the threat of stalling, remove excessive roll, and then smoothly restore the trajectory. This sequence is specially trained, because the natural desire to “pull off the ground” with a low nose can cause a secondary pileup and finally exhaust the height margin.
Sequence
Event timeline
Rather than isolated episodes, this was an unfolding system: each stage inherited the constraints of the one before it.
- 01
Outsiders in management
The commander's children were in the cabin. The admission of a person without preparation for the controls violated the basic security barrier even before the appearance of a technically significant event.
- 02
Partial autopilot shutdown
The thrust on the steering wheel overpowered the servo on the roll. The autopilot stopped holding the specified roll, but continued to work through other channels - it was the partiality of the change that made recognition more difficult.
- 03
Roll increases
The aircraft deviated smoothly from its intended position. The crew discussed the trajectory, but did not immediately link it to the new automation mode.
- 04
Cool Turn and Decline
The roll and overload quickly increased. It became physically more difficult for pilots to occupy a working position and perform precise control actions.
- 05
Nearly Restored Flight
The plane came out of a spiral decline, but a large angle of pitch and a drop in speed created a new stall. The subsequent stock of height was not enough.
- 06
Collision with the Earth
A310 crashed in the area of Mezhdurechensk. There were no survivors.
More than one cause
Chain of contributing factors
An incident develops when several weaknesses come together along the same path.
Breach of discipline
The presence and participation of untrained people in the management destroyed the protection that a sterile and professional cabin should provide.
Complex logic of automation
Not the entire autopilot, but one of its channels. Without a clear understanding of the modes, the crew continued to believe that the aircraft was holding the trajectory.
Weak indication of change
The signal of channel overflow on the roll was not sufficiently noticeable in a specific work situation.
Delayed recovery
When the deviation was recognized, roll, overload and lack of time already dramatically increased the difficulty of piloting.
From the flight deck
Decisions and constraints
Decisions are assessed against the information, altitude, time and aircraft condition at that moment, rather than what became known later.
What was meant by “partial disconnection”
Automation has not completely disappeared: some functions remained active. Because of this, the behavior of the aircraft did not coincide with the usual automatic flight, nor with the expected completely manual control.
Why did the crew see the roll late?
A slow start, night flight and attention not directed to the devices allowed the deviation to accumulate. In aviation, such quiet changes are often more dangerous than a sharp refusal.
Why One Correction is Not Enough
Exiting the spiral brought the plane back to the horizon, but did not complete the energy control. The big pitch quickly paid off the speed and created a second critical situation.
Summary
Investigation findings
- The control effect led to the resilling and disconnection of the autopilot channel along the roll.
- The crew did not recognize the change in the mode and the growth of the roll in time.
- The admission of an outsider to the management bodies was the initial unacceptable condition of the chain.
- After the first attempt at recovery, the aircraft again entered a dangerous mode, from which it was not possible to bring it to the ground.
After the investigation
What aviation learned
A lesson becomes useful when it leads to a procedure, training, a design change or a new safety barrier.
Mode awareness
Learning to work with automation began to pay more attention not only to the inclusion of systems, but also a clear answer to the question: what channel is really driving the aircraft now.
Discipline of the cabin
Access rules and cabin behaviour are seen as a technical safety barrier, not a matter of etiquette.
Recovery from an unusual situation
Training develops a sequence: recognize the position, remove the dangerous roll, control the angle of attack and only then restore the height.
Its relevance today
Automation requires a constant response: who manages?
Flight 593 entered the training materials as an example of mode confusion - discrepancies between what the system does and what the crew believes it does. Modern training forces the pilot to confirm the active mode aloud, monitor the announcer and check the real movement of the aircraft, and not trust only the selected button.
History also shows that cabin rules are part of the safety design. The untrained person needs to be banned from the workplace not because any contact is immediately dangerous, but because he transfers the system to a state for which there is no distribution of roles, a common model and guaranteed control.
The most important lesson is recovery. After an unusual position, you can not rush to return the height at the price of the angle of attack. First reduce the threat of stalling, then roll, then speed and only then the trajectory. This sequence contradicts the natural fear of decline, so it is fixed by repeated practice.