Trial by Fire: The crash of Aeroflot flight 1492
On the 5th of May 2019, travelers at Moscow’s biggest international airport were greeted by the astonishing sight of a passenger plane skidding down the runway in flames, its tail section engulfed by a conflagration of biblical proportions. As the crippled jet slid to a stop, the doors opened, the slides deployed, and passengers ran for their lives — but for many, the evacuation was over before it even began. In the back of the plane, the fire ripped into the cabin so quickly that some passengers perished without so much as a chance to stand up from their seats, while others collapsed in the aisle, enveloped in a cloud of toxic smoke from which they would never emerge. By the time the fire was out, half the plane stood intact, while half lay in ruins; and in a chilling mirror image of the vessel that carried them, 37 people walked away, while 41 others never came home.
The crash of a Russian-built Sukhoi Superjet 100, at a Russian airport, while flying for Russia’s flag carrier, set off a circular firing squad of accusations, as observers and stakeholders alike sought to determine whether fault lay with the airline, the airplane, the flight crew, or even the passengers, some of whom stopped to retrieve their carry-on bags while their countrymen burned. But the crash of Aeroflot flight 1492 isn’t a simple story. It ended in a wall of fire, but it began with a thunderstorm, a lightning strike, and a malfunction of the fly-by-wire control system, followed by a desperate return to the airport, an unstable descent and approach, and a botched landing attempt that slammed the plane into the runway over and over until it broke. The sequence of events was so long, raising so many complex questions, that it took investigators from the independent Interstate Aviation Committee nearly six years to reach firm conclusions and publish their report, which stretches to almost 600 pages and includes two dissenting opinions. The vast quantity of primary evidence, experimental data, and expert analysis contained in this new report finally permits a reasonably objective recounting of what actually happened on that blustery day in Moscow, in the process revealing a story that is colossal in breadth, mind-bendingly technical, and yet also at times frustratingly banal.
This is that story.
◊◊◊
Part 1: Red Alarm
To be an airport firefighter requires acceptance of the principle that anticipation is more enjoyable than gratification. Yes, once in a while a fire erupts in a trash can or a piece of luggage, or someone spills some hydraulic fluid, but a great deal of time is spent either training for or standing ready for a career-defining catastrophe that most will never see. There is a certain frustration associated with the absence of a reason to put those skills to use, albeit one that is usually dispelled as soon as such a reason actually arises.
At Sheremetyevo International Airport, the world’s gateway to Moscow, the airport firefighting service is much like any other. Although Russia has a spotty aviation safety record, Sheremetyevo had long been spared, and by May of 2019 the greatest excitement within living memory for the airport firefighting service was a 2014 blaze aboard a mothballed Il-96. In an official statement, the airport declared that the soon-to-be-scrapped airliner was destroyed as a result of “spontaneous combustion.”
The 5th of May 2019 was a turbulent spring day, with thunderstorms bubbling up across the Moscow region. At Sheremetyevo Airport, the temperature by late afternoon had reached a pleasant 15˚C, with variable winds gusting up to 54 km/h amid intermittent light rain showers. Although Russia’s meteorological service had issued SIGMET thunderstorm warnings for the area, traffic at Sheremetyevo was no less heavy than usual. Throughout the afternoon, a flight took off every two minutes, climbing into the onrushing wind before turning sharply away toward clearer skies.
Unknown to the firefighters, one of those planes was coming back.
At 18:30 local time, a tremendous bang rang out over the airport, turning heads in the terminals and on the ramp toward Sheremetyevo’s runway 24 Left. And there they saw a plane, a little silver regional jet — or rather, just half of one, because the other half was lost somewhere in a firestorm of such tremendous size that witnesses could not believe it had only just now ignited, and yet it had. Flames and smoke billowing behind its wings and tail, the aircraft rolled down the runway at low speed with its nose gear extended but its belly dragging across the ground like a wounded dog. Within seconds, it began to slew to the left, its nose pivoting to face the terminal, whereupon it briefly appeared to travel sideways before it finally ground to a halt somewhere in the vicinity of taxiway Alpha 2.
Atop a lookout tower at Sheremetyevo’s Fire Station #1, the firefighter on observation duty did not know that an aircraft had declared PAN-PAN, one step short of MAYDAY, that its crew had reported flight control problems, or that it was coming in for an emergency landing. Normally he would have this information, but today, he didn’t. He too knew only that an aircraft had burst into flames before his very eyes. Before it had even stopped moving, he pressed the alarm button and transmitted on the airport’s fire rescue channel, “Emergency! Aircraft on runway!” A brief pause followed as the burning aircraft continued down the runway in his direction, and then he repeated, “Emergency, did you copy!? Fourth runway, an aircraft is burning on the runway!”*
*Although the MAK published an English translation of its report, all quotations in this article are my own translations from the Russian language report.
At the terminal, cameras swiveled to focus on the burning airplane, its nose pointed right of frame, greedy tongues of fire curling around its fuselage and tail. Within seconds, the two forward exit doors opened, the slides deployed, and people began to pour down them, but behind the wings, flames were already bursting forth from the cabin windows, rippling and churning in the jet blast of the still-running engines. Burning fuel carpeted the ground in fire, silhouetting the passengers as they ran.
On the rescue frequency, the Rescue Response Supervisor announced, “Declaring alarm! To all vehicles, all firefighting vehicles are called to 24 Left immediately!” Another voice jumped in: “Attention! The alarm is declared to the emergency and rescue teams, code red! Superjet, Aeroflot airline, upon landing due to technical reasons is on taxiway Alpha, catching fire.” In response to the red alarm, the on-duty rescue teams jumped into their vehicles and peeled out of the stations with sirens blaring. But an airport is a vast place, and their arrival would not be instant.
At the aircraft, two flight attendants dressed in Aeroflot’s bright red uniform fled the cabin, one after the other. Somewhere amid the heaving smoke, the empennage burned through and collapsed to the ground.
For a moment, no more passengers came. And then a woman threw herself down the slide and collapsed unmoving to the ground. A man followed headfirst out the door, stood up, and walked away. Behind him, another person toppled down the slide, stopped at the bottom, and rose only with difficulty. A ground handling worker, by coincidence the first airport employee to reach the scene, attempted to render assistance.
As the first fire truck approached the aircraft, it was obvious that a major disaster was unfolding. “Sirena — Strela-8, proceeding to the site,” its driver reported. “Heavy smoke in sight, black smoke, and flames. How do you copy, over? Call for additional garrison forces and an ambulance!”
The crew opened fire with the water cannon as the vehicle was still moving, throwing water onto the sizzling tail section. A dazed passenger watched, alone, from the taxiway.
Moments later, another man jumped to safety, and then a pilot appeared in the doorway, hesitating at the top of the slide, glancing back into the cabin. The other pilot opened the right-hand cockpit window and stuck his head into the fresh air as dark gray smoke poured out behind him, whipping up and over the cockpit roof. The ground handler appeared to shout at them to leave, but they did not. A second fire truck arrived and began pouring foam onto the plane, while a single firefighter tried but failed to climb up the emergency slide and enter the cabin.
Forced out by the smoke and flames, the first officer deployed the emergency escape rope and climbed down from the cockpit window. Firefighters and ramp personnel helped him to the ground, and then he ran around to the slide and stared up at the smoky darkness within the cabin, seemingly unsure what to do.
As more and more fire trucks arrived on the scene, the flames started to wither under their assault. The first officer then attempted to climb up the slide, fell, and was boosted by a ground handler. The captain appeared at the door and dragged him back aboard, no doubt to the consternation of the firefighters who were at that moment desperately attempting to save him. Seconds later, he threw his flight bag and another object down the slide, then jumped down after them, surrounded by a half a dozen white arcs of firefighting foam.
For some time, firefighters and ground personnel milled about, watching the flames die down, waiting for the captain to abandon ship. After a minute, someone brought a ladder, and a man with no protective gear climbed up it, entered the cabin, reconsidered his decision, and threw himself back out the door to the ground. A better equipped firefighter followed, shouted for the captain to leave, and then backed away to give him room. Finally, the captain, too, jumped to safety. He would be the last to leave the plane alive.
◊◊◊
As medical and airport personnel gathered the passengers at the terminal, prepared the wounded for transport to hospital, and set up an information center, Aeroflot employees retrieved the manifest and conducted a headcount. A preliminary statement put out by the airline vaguely stated that “Passengers left the aircraft via the emergency exits” but did not confirm the seriousness of the accident. Russia’s Emergency Ministry even released a statement claiming that all passengers had escaped. But at that point the rescue teams already knew that a flight attendant was missing, because the captain had told them as much before he left the plane. As for the passengers, the captain had no information. And at the terminal, company personnel discovered, to their horror, that only 33 of the 73 passengers could be accounted for.
Within minutes, the fire was put out, and rescue teams entered the aircraft. There was little hope of finding anyone alive. But no one could possibly have been prepared to find so many people dead.
Initially, the regional transportation office reported one official fatality, the aft flight attendant, who was found lying on the ground outside the 2L door. But over the next few hours, the official toll rose to 10, then 13. At the airport, rumors swirled. Officials told the media that they could confirm the whereabouts of only 37 out of the 78 passengers and crew. Early the following day, Aeroflot published a list of 37 names belonging to known survivors, with an attached note. “The list is incomplete,” it read. “As of now information regarding other passengers on the flight is being confirmed.” But no more names would ever be added.
Out on the concrete expanse of the airport, recovery crews pulled 41 bodies from the charred wreckage. They belonged to 40 passengers and one crewmember; 40 Russians and one American. As news broke of the true toll, Aeroflot put out a press release. “Aeroflot extends its deepest condolences to the family and loved ones of those who lost their lives on flight SU1492 Moscow-Murmansk,” the note said. “The crew did everything in its power to save passenger lives and provide emergency assistance to those involved. Tragically, they were unable to save all of those aboard.”
Whether the crew actually did everything in their power was beside the point; it was what they were expected to say. As for the truth, reality is rarely romantic.
◊◊◊
Part 2: The First Six Minutes
The following sections are based on the official report published by the Interstate Aviation Committee, or MAK (Russian: Межгосударственный авиационный комитет). The MAK is an independent, extra-governmental organization headquartered in Moscow that carries out aviation-related duties in several former USSR member states, including accident investigation. Although the MAK is not free of conflicts of interest, attempts by the Russian government to control the organization and influence its findings have historically been unsuccessful. It is one of the last remaining civil organizations in Russia that operates with a degree of intellectual freedom.
Aeroflot flight SU1492 was a regularly scheduled domestic flight from Moscow to the northern city of Murmansk, located on the Kola Peninsula two degrees north of the Arctic Circle. Murmansk has many claims to fame, including the title of largest city in the Arctic, home of the world’s northernmost trolley system, and other such epithets. But the story of this flight ignores Murmansk hereinafter, because the aircraft never left the confines of Moscow Oblast.
A total of 73 passengers were booked on flight 1492, the majority of whom lived in Murmansk and were returning home from the May 1 holidays. They included doctors, civil servants, and two children aged 11 and 12. Only one was a foreigner, 22-year-old recent college graduate Jeremy Brooks, an accomplished fly fisher from the US state of New Mexico, who had landed a coveted job as a tour guide in Russia’s northwestern Arctic.
The aircraft rostered for the flight was a Sukhoi Superjet 100 that rolled off the assembly line in August 2017 at the assembly plant of Russia’s United Aircraft Company, located in the far eastern city of Komsomolsk-on-Amur. The small jet could carry up to 87 passengers and was designed for short to medium haul regional flights with a crew complement of either four or five.
The three-member cabin crew consisted of 27-year-old Senior Flight Attendant Kseniya Fogel’, who was seated in the front alongside 34-year-old flight attendant Tatyana Kasatkina; and alone in the back sat the most junior crewmember, 21-year-old flight attendant Maksim Moiseev. Up in the cockpit, the second in command was 36-year-old First Officer Maksim Kuznetsov, a relatively new pilot who had joined Aeroflot with no previous experience and had since accumulated 765 hours, almost all on the SSJ-100, over 11 months with the airline. And in command was 42-year-old Captain Denis Yevdokimov, a moderately experienced pilot with about 6,800 flying hours, including more than 1,500 on the SSJ-100, which he had flown for Aeroflot since 2016. Before that, he had flown the Let L-410, Yakovlev Yak-52, and Ilyushin Il-76 for the Russian Federal Security Service, followed by a stint in the Boeing 737 at independent airline Transaero, until he was dismissed following that airline’s bankruptcy. Aeroflot picked him up a month later.
Well prior to the flight’s scheduled departure at 17:50, the flight crew went to the dispatch office at Sheremetyevo to receive their pre-flight briefing and accept the paperwork. This included discussion of the latest weather reports.
At that time, the weather in the Moscow area was unsettled, with thunderstorms beginning to move through the region from southwest to northeast. As mentioned earlier, a SIGMET, short for significant meteorological information, was in effect for the Moscow Flight Information Region due to thunderstorm activity, and a separate bulletin warned that rapid changes in wind speed and direction, known as windshear, would be present at Sheremetyevo between 16:00 and 20:00. The terminal aerodrome forecast for that same period called for winds out of the south at 15 knots, gusting to 29 knots, with 10 kilometers visibility and sporadic thunderstorms. The latest actual weather observation was in line with the forecast, with winds out of the southwest at 15–29 knots, visibility 7 km, light rain showers, broken cumulonimbus clouds with a base at 1,590 meters, temperature +15˚C, and a wet runway.
After the accident, Captain Yevdokimov stated that during the briefing, he identified no significant weather requiring special discussion, despite the fact that all of the above information was included in the paperwork. Given the existence of an active SIGMET, his assertion seems far-fetched. If there was no discussion of the SIGMET, then the briefing certainly fell far short of what was expected and required. However, the official opinion of the Interstate Aviation Committee is that Yevdokimov most likely knew about the thunderstorms all along.
At 17:16, the crew boarded the aircraft at the gate to begin preparing it for flight. They reviewed the technical log and found that no outstanding defects had been reported. Later analysis showed that the fuel tank inerting system,* which is designed to prevent the formation of an explosive fuel-air mixture in partially full or empty fuel tanks, was not working. The system had been repeatedly found inoperative on this aircraft throughout 2018 and 2019, and it was legal to fly without it for up to 7 days. That being said, this flaw turned out to have nothing to do with the fate of flight 1492.
*See my article on TWA flight 800.
At 17:25, the pilots tuned in to the Automated Terminal Information System, or ATIS, to hear the latest weather observations. The ATIS showed there had been an improvement since the weather briefing. However, at that very moment, the Terminal Doppler Weather Radar (TDWR) at Moscow’s Vnukovo Airport was picking up a band of thunderstorms about 40 km southwest of Sheremetyevo, moving northeast at 30 knots, with multiple red-colored cells indicating intense precipitation. Color images from the Vnukovo TDWR were available at the Sheremetyevo meteorological office, but they weren’t provided to the crew. Nevertheless, they had plenty of textual information suggesting that a thunderstorm encounter was possible during departure.
As the crew set up the aircraft, the Sheremetyevo clearance delivery controller relayed the route they could expect to take after takeoff, which in this case was the KN 24E Standard Instrument Departure, or SID. This SID featured a westbound heading after takeoff from runway 24 Center to a point 15 km west of the airport, followed by a sweeping right turn onto a northeasterly heading to the KN radio beacon. From there, they could proceed in the direction of Murmansk.
Evaluating the assigned SID, Captain Yevdokimov said, “It’s all the same, to the right, it’s just that some kind of buildup is back there. So it will be even faster for us.” Most likely he was observing that the SID would take them close to the thunderstorms southwest of the airport, and that a quick right turn might help avoid them. In his interview, Yevdokimov explained that he made these comments after visually noticing clouds in the takeoff direction, because he hadn’t turned on the weather radar yet. However, the flight data recorder captured him adjusting the range setting on the weather radar between 5 and 40 nautical miles at this time, suggesting that the radar was in fact turned on, and that he probably saw the thunderstorm buildups on it.
As the pilots finished up their pre-flight checks and the passengers boarded, they briefly discussed their clearances, and then Captain Yevdokimov gave a passenger announcement. “Good day ladies and gentlemen, this is the aircraft commander speaking, my name is Denis, I welcome you aboard this aircraft belonging to Aeroflot, one of the oldest and most famous airlines in the world. In March of 2019 Aeroflot turned 96 years old. Our fleet is one of the newest in the world. Today we’re flying the route Moscow Sheremetyevo to Murmansk. Get ready for a pleasant journey, the en route time will be 2 hours exactly. I’m sure you will enjoy your journey with Aeroflot, thank you for choosing us. I wish you a pleasant flight.”
Up in the cockpit, Captain Yevdokimov’s actual mood wasn’t quite so cheery, as he expressed frustration with delays at the airport. The flight finally received clearance to taxi at 17:50, its original departure time, and they taxied to the back of the line of aircraft waiting for takeoff. While waiting, Yevdokimov flicked his weather radar’s range setting back and forth between 5 and 20 nautical miles, prompting him to ask, “The buildup, can you see it en route?” But the report does not mention any response from the first officer.
Moments later, at 18:02, flight 1492 was cleared to take off, 12 minutes behind schedule. As they sped down the runway, Yevdokimov’s weather radar was set to 5 NM, while First Officer Kuznetsov had his set to 10 NM, neither of which was far enough to see the thunderstorms in their path. In fact, the flight crew training manual urges pilots to avoid red precipitation cells by at least 20 NM due to the possible presence within such cells of severe turbulence, lightning, hail, and other hazardous phenomena. Avoiding a cell by more than 20 NM self-evidently requires a range setting above 20 NM, and it was unclear why the pilots would use a range setting too short to effectively support thunderstorm avoidance. Furthermore, despite twice commenting on the buildups, neither crewmember articulated a plan to avoid them.
Flight 1492 lifted off normally and began climbing toward their initial cleared altitude of 1,200 meters above airport level, following the SID to the letter.* But both ahead and behind them, other flights were not doing the same. Between 17:57 and 18:08, three Aeroflot flights and one Czech Airlines flight departing in the same direction as flight 1492 all requested hard right turns off of the SID to avoid the approaching thunderstorms, although the crew of flight 1492 were unaware of this. Strictly speaking, it would have been proper for the controllers to ask whether flight 1492 intended to deviate too, but they did not. Even so, the crew should have independently asked to initiate the right turn to the KN beacon early, instead of flying so far outbound in the direction of the storm cells. But in the cockpit, there was no discussion of this matter at all.
*Unlike most of the world, Russian aviation uses meters for altitude, and height above airport level instead of height above sea level, during low-altitude flight.
After initially leveling off at 4,600 feet, the airport radar controller cleared flight 1492 onward to 7,000 feet and handed them over to Moscow Approach. While climbing to this new altitude, Captain Yevdokimov used the autopilot heading select knob to initiate the right turn, only about 1.5 kilometers earlier than called for the in the SID, without requesting a deviation. By now it was already too late to avoid cutting through the advancing northeastern edge of an intense thunderstorm cell.
After the accident, Captain Yevdokimov insisted that at no point before or after departure was he aware of any red-colored, high-intensity cells on his weather radar. In fact, he asserted that the radar showed only green-colored, low-intensity returns in the vicinity of the SID. Further, he explained that his slightly early right turn was intended to stay away from a green-colored cell in order to spare the passengers some light turbulence, with no need to request a full deviation from air traffic control. However, the Interstate Aviation Committee believes that these statements were false, as the weather radar was found to be functioning normally and would have displayed the red cells also seen by the Vnukovo TDWR. Additionally, the range setting at several points was long enough for the cells to show up, and the flight crew’s discussion of “buildups” suggests that they did observe these cells.
The time at which flight 1492 began to turn right corresponded quite closely to the moment at which the red cells would have become visible on the captain’s weather radar display with the 5 NM range setting. But by the time he started the turn, it would have been evident that an encounter with the severe weather was unavoidable. In fact, at 18:07, Yevdokimov said, “It’s going to get bumpy now,” to which First Officer Kuznetsov exclaimed, “Crap.”
“It will be fine,” Yevdokimov assured him. But a few seconds later, at 18:08, one of the pilots activated continuous ignition for both engines, consistent with the procedure for flying in heavy precipitation. Using continuous ignition makes the engines more resilient against flameouts caused by heavy rain or hail. This decision confirms that the crew knew they had flown into an intense thunderstorm cell.
The question of why they failed to take evasive action before reaching the storm is one that no doubt haunted the MAK throughout its investigation; and with the pilots refusing to cough up the truth, there isn’t an easy answer. My suspicion is that the driving factor was complacency, that quirk of human cognition that makes us think, “Those buildups are far away, we can complete the SID before they get here, asking for a deviation is annoying, everything will turn out fine.” But that’s the kind of thinking that airmanship is supposed to overcome. Tragically, in this case it did not.
Of course, pilots are trained to avoid thunderstorms for a reason. The hazards lurking within them are multifarious and unpredictable. Captain Yevdokimov and First Officer Kuznetsov knew that, as all pilots do, but apparently they needed a reminder. And at time 18:08 and 9.7 seconds, they got one.
At that precise instant, passengers and crew heard a sharp bang and perceived a blinding flash of light as a bolt of lightning surged through the aircraft, for a split second uniting the Superjet, the cloud, and the ground along a white-hot river of electrons. And then, all hell broke loose.
◊◊◊
Part 3: The Post-Industrial Plane
In the 1990s, the collapse of the Soviet Union and the privatization of air travel decimated Russia’s aviation industry, as demand for air travel dropped by nearly 80% and state spending on research and development essentially disappeared. By the time Russia’s economic ship started to right itself, almost no progress had been made on the next generation of Russian airliners. To make matters worse, the capabilities of Russia’s high-tech manufacturing sector were at least 20 years behind the United States and Europe, and were falling further behind with each passing year. Previously, Russian aircraft manufacturers didn’t have to worry about competing with their Western counterparts, and now that they did, they found that no Russian suppliers were capable of producing the advanced equipment needed to match their rivals’ performance, particularly in the realm of engines and avionics. Russian airlines flocked to the sales desks of Airbus and Boeing and mothballed their Tupolevs and Ilyushins. Sales of existing Russian-built aircraft fell to dire levels. In 2000, Russian companies managed to build just four commercial airplanes.
During the early 2000s, the Russian government sought to reverse the fortunes of its moribund aircraft manufacturing industry by uniting all of Russia’s major aircraft manufacturers, including Ilyushin, Tupolev, Yakovlev, and Sukhoi, into the United Aircraft Corporation. UAC mostly produced, and still primarily produces, military aircraft. But the long-term goal was always to revive the design and manufacture of civilian airliners. The first of those models, and to date the only one that has actually entered service, was the Sukhoi Superjet 100.
The Superjet, or SSJ for short, was envisioned as a medium-range regional jet with five abreast seating and a passenger capacity similar to Brazil’s Embraer ERJ series, without competing directly against the larger Airbus and Boeing models that dominated Russia’s airlines. The SSJ was designed with a sidestick-operated fly-by-wire control system, similar to Airbus, although contrary to popular belief it was not the first fly-by-wire Russian airliner; that title belongs to the commercially unsuccessful Tupolev Tu-204, which entered production in 1990, shortly before the collapse of the Soviet Union.
UAC hoped to gain enough of the regional jet market to produce several hundred aircraft, and in order to have any hope of competing, it would have to seek help from the West. In the 2000s and early 2010s, relations between Russia and the West were cordial enough; the former Cold War rivals certainly were not friends, but the political landscape was much friendlier than it is today. As a result, UAC was able to contract extensive advisory services from Boeing, while the engines were designed and produced by a partnership between French manufacturer Safran and the Russian firm NPO Saturn. The avionics were largely designed and built by aerospace companies Thales (of France) and Honeywell (of the United States), while Safran constructed the landing gear, Liebherr (of Germany) built the flight controls, and B/E Aerospace (of the United States) provided the cabin furnishings and doors. Russian suppliers built the fuselage and wings. Foreign parts were imported to Russia and final assembly took place at UAC’s assembly plant in Komsomolsk-on-Amur.
The final design of the SSJ bears some resemblance to an Airbus aircraft, but perhaps not quite as much as is sometimes suggested. Although the individual suppliers were also major suppliers of Airbus and Boeing, the design specifications for the SSJ were drafted primarily by UAC, with only advice from foreign manufacturers, and as a result the designs of its key systems differ from their Airbus counterparts in some ways that are of significance to this story. The details of those systems will be discussed later in this Part.
The SSJ-100 first flew in 2008, and after passing certification by the Russian Federal Air Transport Agency (FATA, popularly known as Rosaviatsiya), the European Aviation Safety Agency (EASA), and the Interstate Aviation Committee’s aircraft certification division,* the type entered service with Armenian flag carrier Armavia in 2011. The celebration was short-lived, however, as Armavia cancelled its remaining orders and sent its two SSJs back to the manufacturer in 2012, citing a high rate of technical failures and the high cost of spare parts. Also in 2012, an SSJ carrying airline executives on a demonstration flight in Indonesia crashed into a mountain, killing all 45 people on board. No Indonesian airlines ordered the SSJ, even though the crash was found to have been caused by a series of errors by the Sukhoi test pilots.
*One of the MAK’s inherent conflicts of interest as an investigating body is its secondary role as the guarantor of aircraft type certificates in its member states. The MAK has not held this responsibility in Russia since 2016 and was not responsible for the SSJ-100 type certificate during the investigation into flight 1492, but it was responsible at the time the SSJ-100 was originally certificated. The validity of the MAK’s conclusions regarding certification issues during the Aeroflot 1492 investigation is discussed in Parts 6 and 8 of this article. For more information on the history of the MAK, its potential conflicts of interest, and why its certification roles were taken away, see this paper I wrote in 2021 on the demise of Transaero.
The aircraft’s unreliability seriously harmed sales, and the second customer, Russian flag carrier Aeroflot, had to be plied with steep discounts and free support packages before agreeing to order a final total of 50 SSJ-100s. Aeroflot executives reported in 2012 that the planes were achieving less than half their expected utilization, measured in terms of flight hours per day, due to a combination of frequent mechanical failures and slow delivery of spare parts. The exact reasons for these issues are subject to debate among the parties involved, but importing spare parts to Russia has always been difficult due to extensive red tape, which at the very least exacerbated the issue, given that so many aircraft systems were manufactured abroad. But red tape couldn’t have been the only reason, because some of the few foreign airlines who gave the SSJ a try, including Ireland’s CityJet and Mexico’s Interjet, encountered the same problems. In fact, the serviceability rate of the SSJ-100 still has not caught up with newly released Airbus aircraft even after 14 years in service.
I’m planning to take a closer look at the SSJ’s design, development, and service history in an eventual episode of my podcast, Controlled Pod Into Terrain. But for the purposes of this article, I want to focus on one particular manifestation of the type’s unreliability, and for that we need to take a look at its fly-by-wire system.
◊◊◊
The term “fly-by-wire” refers to a control system that transmits pilot inputs to the control surfaces by electronic means. Fly-by-wire systems have a number of advantages over conventional control systems that utilize physical cables, including reduced pilot workload, decreased weight and complexity, high capacity to tune out undesirable control characteristics, and the ability to impose limitations on the flight envelope. The design philosophy was pioneered by various military aircraft, as well as Concorde, and was first used in a mass-produced airliner when Airbus introduced the A320 in 1988. Since then, the concept has spread throughout the industry, and most newly designed passenger jets today incorporate at least some fly-by-wire elements.
In basic terms, a fly-by-wire control system relies on a network of sensors that measure speed, pressure, temperature, attitude, angle of attack, and a host of other parameters. These raw data are fed to several sets of double- and triple-redundant computers that check it for validity, calculate secondary parameters, and distribute them to the computers that interpret pilot control inputs and translate them into actual control surface movement.
An important issue that differs between conventional and fly-by-wire aircraft is the variation in control surface response at different airspeeds. Due to faster airflow over the control surface, the same control deflection will result in a larger aircraft response at high airspeed, and a smaller response at low airspeed. Without feedback, this would cause the pilot to overcontrol the aircraft at high speeds. In a purely cable-operated aircraft, this problem solves itself because the increased aerodynamic load at high speeds makes it harder to deflect the controls. In a conventional aircraft with hydraulically boosted controls, an artificial feedback device mimics that extra load. But on the fly-by-wire Airbus and SSJ-100, there’s no force feedback at all — instead, computers adjust the ratio of sidestick travel to control surface deflection in real time with respect to airspeed so that the aircraft response is always the same for a given sidestick input, no matter how fast the airplane is traveling.
On a conventional aircraft, the parameter directly controlled by the pilot’s yoke is control surface deflection. But on the Airbus and the SSJ, the answer varies depending on the control axis. In the roll axis, the sidestick commands a roll rate, and the ailerons deflect in the manner required to achieve that roll rate. The maximum roll rate is limited by the computers to a safe value, as is the maximum allowable bank angle.
Meanwhile in the pitch axis, sidestick movement commands a particular load factor, expressed in terms of G force. At rest, the load factor is 1; that is to say, 1G, normal gravity. Pulling the sidestick back causes the load factor to increase, while pushing it forward causes the load factor to decrease. Let’s say you pull the sidestick back far enough to command a load factor of 1.2 — in that case, the airplane will pitch up at a rate that the occupants experience as a G-force 20% above normal gravity. The longer you hold the stick in that position, the more the plane will pitch up, because the pitch has to be actively increasing in order to induce a load factor above 1. When you release the sidestick back to neutral, the pitch will stop changing and will remain at its current value, causing the load factor to return to 1.0. The computers also impose a maximum and minimum pitch angle, a maximum angle of attack, and a maximum and minimum load factor, all of which will limit how much and how quickly the pilot can change the airplane’s pitch.
Some people who know very little about airplanes assume that to make the airplane climb or descend, one simply points the airplane up or down and then releases the controls. That’s how it works in some video games, like Grand Theft Auto. Those who know a little bit more about airplanes understand that that isn’t the case — if you push forward on the controls, the plane will start descending, yes, but when you let go, it will actually level off again by itself due to its inherent pitch stability. But if you study even further, you’ll learn that for many fly-by-wire aircraft, including the Airbus and SSJ-100, the Grand Theft Auto players are actually right. If you pull back on the stick in an A320 or SSJ until the plane is climbing with a 5-degree nose up attitude, then let go of the controls, the plane will keep climbing in a 5-degree nose up attitude until you tell it to do something else. After all, changing the pitch changes the load factor — but when the sidestick is at neutral, the load factor is always precisely 1, so the pitch can’t change if you’re not moving the sidestick. But how is that accomplished exactly?
A conventional aircraft returns to level flight when you let go of the controls because of the influence of the trimmable horizontal stabilizer. The position of the horizontal stabilizer determines the pitch angle at which the plane is stable — the angle it will naturally return to when you’re not making control inputs, the angle where all the forces acting on the aircraft are perfectly balanced, as all things should be. Move the stabilizer down, and the plane will be happiest at a higher pitch. Move it up, and the plane will prefer lower. On a conventional airplane, the pilot or autopilot adjusts, or trims, the stabilizer whenever the aerodynamic forces are no longer balanced. If you want to hold a pitch of 5 degrees up but the plane wants to rest at only 2 degrees up, then you trim the stabilizer nose up until the plane sits most happily at 5 degrees.* Pilots of these aircraft types are taught that if they have to apply force to achieve the desired flight path, then they should re-trim the stabilizer until they no longer have to.
*Actually when you get down to it on a conventional aircraft the stabilizer determines what SPEED the aircraft is at rest, but for the purposes of this explanation, bear with me.
Fly-by-wire aircraft aren’t magic, so they also have a trimmable horizontal stabilizer. The difference is that on most Airbuses and the SSJ, the pilot never has to touch it. Instead, on these aircraft a system called autotrim constantly adjusts the stabilizer in the background in order to ensure that the aircraft’s stable pitch angle is always equal to whatever pitch angle the pilot last commanded using the sidestick. So if you pull back on the sidestick, wait for the pitch to reach 5 degrees nose up, and then let go, the plane will stay at 5 degrees nose up because the autotrim has helpfully re-trimmed the stabilizer to maintain a +5˚ pitch. If you want to return to nose level, you just push forward until the nose is level, then let go, and voila.
While all of these features make fly-by-wire aircraft easier to fly and potentially safer, these systems also rely on a constant flow of accurate sensor data. If sensors become blocked, malfunction, or lose connection, then it may not be possible for the fly-by-wire computers to support their normal functions. Similarly, if the computers that process and distribute that sensor data malfunction or lose power, then these functions also won’t work. And this issue brings us to the topic of control laws.
Readers who are familiar with certain infamous Airbus accidents like Air France flight 447 should be familiar with the concept of control laws. Up until this point, everything I’ve said about the Airbus and SSJ fly-by-wire systems applies to the control system in “normal law,” which is the default configuration when everything is working properly. But the way the control laws change under certain failure conditions is one of the major differences between the Airbus and SSJ fly-by-wire systems.
On the Airbus, certain combinations of sensor, computer and system failures can cause the control system to revert to Alternate Law. This control law has a couple of different sub-laws with different characteristics, but broadly speaking, Alternate Law removes support for most flight envelope protections (such as high speed protection, high angle of attack protection, and so on). Sidestick movement on the pitch axis still commands a load factor, and load factor protection remains, but depending on the applicable sub-law, control surface deflection may not be adjusted for airspeed (which is what occurred on Air France flight 447 when all three sources of airspeed data were lost; see my previous article on that accident, linked above). In the roll axis, the sidestick ceases to command a roll rate and a direct relationship between sidestick deflection and aileron deflection is established instead. Autotrim continues to function normally.
If certain very serious combinations of failures occur, the control system may revert to Direct Law instead of Alternate Law. According to SkyBrary, an Airbus will enter direct law “if there is failure of all three inertial reference units or all three primary flight computers, faults in both elevators, or flame out of both engines concurrent with loss of [primary flight computer] 1.” Additionally, Direct Law will also engage on some Airbuses if the aircraft is already in Alternate Law and the pilot extends the landing gear.
In Direct Law, sidestick deflection is directly related to control surface deflection in all control axes. Autotrim is lost and all flight envelope protections are removed. In the yaw axis, automatic turn coordination (deflection of the rudder during a turn to prevent development of a sideslip) will also be lost, as will the yaw damper (which suppresses the airplane’s natural tendency to gently weave from side to side).
There is one last level below this, called Mechanical Backup, which relies entirely on backup cables connecting the pilot’s controls to the horizontal stabilizer and rudder, without the use of the elevators or ailerons. This law comes into play only in the event of a complete loss of electrical power, mostly to cover the few seconds in between a total power loss and the automatic deployment of the ram air turbine, which provides emergency electrical power. As far as I know, there has only been one noteworthy case of an Airbus entering Mechanical Backup, which you can read about here.
All of that may be familiar to frequent readers of my work, but the SSJ works a little bit differently. The Superjet doesn’t have an equivalent of Airbus’s Alternate Law; instead, most failures that would cause an Alternate Law reversion on the Airbus cause the SSJ to enter Direct Mode* instead. The SSJ does have an in-between category called the “simplified regime” (Ru: упрощенный режим), but it should not be mistaken for Alternate Law. There is no unified logic underpinning the simplified regime; rather, it’s a collection of minor defects that affect the fly-by-wire logic in some way, with the exact consequences dependent on the individual failures. For example, the loss of the stabilizer position signal will result in the loss of autotrim functions, while the rest of the system continues to operate as normal. The effects of each failure and the required crew actions are displayed to the pilots on the Crew Alerting System, an electronic warning display almost identical to Airbus’s ECAM (“electronic centralized aircraft monitor”).
*In SSJ documentation, the control regimes are referred to as “modes” rather than “laws.”
According to the SSJ-100 flight crew operations manual (FCOM), the control system will enter Direct Mode in the event of a loss of signal from all three air data computers (ADCs), all three inertial reference systems (IRSes), or all three primary flight control units (PFCUs). Much like on the Airbus, the system will reject the data from one or more ADCs or IRSes if the data does not pass certain validity and sanity checks. Practically speaking, this means that if all sources of a particular crucial parameter are lost, let’s say airspeed, then all three ADCs will flag this data as invalid and stop providing it to other systems. This is considered a loss of signal from all three ADCs, and a reversion to Direct Mode occurs. That’s because many fly-by-wire functions require valid airspeed data, and the SSJ has no Alternate Law that nixes those functions while preserving the rest. In fact, if Air France flight 447 was an SSJ, it would have reverted to Direct Mode.
Direct Mode on the SSJ is basically the same as Direct Law on the Airbus. Sidestick deflection has a direct relationship with control surface deflection, there’s no autotrim, no turn coordination, no automatic deployment of the ground spoilers on touchdown, no yaw damping, and so on. And because many conditions that would send an Airbus into Alternate Law will send an SSJ into Direct Mode, this control law is much more likely to activate on an SSJ than it is on an Airbus. I don’t claim to know why Sukhoi’s engineers decided to design it this way, but if I had to guess, it was probably just because it was simpler — less code to write, fewer sub-states to learn. However, it also comes with some drawbacks, because flying the aircraft is harder in Direct Mode than it is in Airbus’s Alternate Law, and consequently demands more skillful piloting. It’s also unclear how well Sukhoi understood its own control system laws, because according to a footnote in the MAK report, at the time of the accident the flight crew operations manual (FCOM, a Sukhoi product) contained descriptions of Airbus controls laws instead of SSJ control laws. The reasons for this darkly hilarious mix-up are not elucidated in the report.
◊◊◊
The probability of certain failures and their effects on crew workload and aircraft controllability are assessed in detail during the design and certification process. Potential failure scenarios are classified according to four main categories, called “minor,” “major,” “hazardous,” and “catastrophic.” A “catastrophic” failure means that preventing fatalities is “practically impossible,” while a hazardous failure is a “significant” degradation that requires the pilot to exercise a high level of skill and judgment. A “major” failure is a “noticeable” degradation that causes difficulty, while a “minor” failure is a “slight” degradation that only marginally affects the pilot’s workload. The category of a failure influences how many redundant systems must be in place to prevent it, as well as the maximum failure rate that is considered acceptable.
During certification of the SSJ, a reversion to Direct Mode was classified as a “major” failure during a non-precision approach or go-around, and a “minor” failure during other phases of flight. Because all pilots learn to fly a conventional aircraft before flying the SSJ, it was believed that pilots would already possess most of the basic skills required to fly in Direct Mode, such as manual trim, manual turn coordination, and use of direct linked controls. The lack of force feedback would present some difficulty, especially during complex maneuvers like a go-around, although the emergency procedure for a Direct Mode reversion imposed a low maximum permissible speed in order to reduce the risk of pilots overcontrolling the airplane at high speeds. It was also possible that pilots could become too accustomed to the fly-by-wire system and “unlearn” some of those basic airmanship skills, but this was not enough for the Direct Mode reversion to be classified as “hazardous.”
Before the SSJ entered service, UAC calculated that the probability of a Direct Mode reversion should be approximately 1 per 1.64 million flight hours. However, when SSJ deliveries started ramping up in 2014 and 2015, cases of Direct Mode reversions quickly began to occur. In 2015 alone, there were three such events, even though the entire SSJ fleet had accumulated just 81,000 flying hours. By 2022, the number of known Direct Mode reversions had risen to 21, for a rate of 1 per 63,000 flight hours — almost 26 times higher than the rate calculated by the manufacturer. Even worse, there wasn’t one single reason behind the massively elevated failure rate. A pair of software updates in 2017 and 2022 addressed the causes of 11 of these incidents, but no common cause for the remaining 10 has been identified to my knowledge. The MAK report states that by 2022, the SSJ-100 fleet had collectively flown 1.32 million flight hours, meaning that the expected number of Direct Mode reversions as of that date should have been about one, two if we’re being generous. Clearly this is a problem that as of 2022 had still not been resolved.
UAC did not call on airlines to provide more training on Direct Mode even in light of these events. But in 2015, after the first few incidents proved that Direct Mode reversions were more common than previously thought, a meeting was held at a high level within Aeroflot, during which it was determined that the amount of training on flight in Direct Mode should be increased. It is unclear exactly what changes were made.
According to the training program envisioned by UAC and implemented by Aeroflot at the time of the accident, a pilot undergoing initial training on the SSJ would complete a single simulator exercise involving flight in Direct Mode during descent, instrument landing system approaches, go-arounds, circle-to-land maneuvers, crosswind landings, and stalls.
After completing their type rating and joining the line, pilots continue to undergo extensive emergency drills simulating a wide variety of failures, repeated every 6 months to 3 years at recurrent training. The Sukhoi Superjet 100 training program specifies no less than 450 failures to be practiced at recurrent training on either 7 month or 3 year intervals — about the same number as the A320, for the record. However, because it’s not practical to review so many different failures individually during each pilot’s limited available simulator time, it’s common practice to combine several related failures into a single scenario exercise instead. In the case of Aeroflot’s SSJ-100 training program, flight in Direct Mode was not considered a hazardous failure requiring its own scenario, so the requirement to practice Direct Mode flight was incorporated into the simulator scenario for unreliable airspeed, because a loss of valid airspeed data will cause a reversion to Direct Mode. However, this approach can be risky because the focus is on the trainee’s handling of the primary failure, and the need for more training on secondary issues like flight in Direct Mode might be overlooked.
After the accident, the MAK sought to verify how much time was actually spent flying in Direct Mode during initial and recurrent training at Aeroflot, but they ran up against a brick wall of silence. Aeroflot didn’t keep detailed records of what exercises were practiced at each simulator session or how much time was spent on each one. In some cases, the training form had not even been filled out and the checkbox indicating completion of the Direct Mode module was empty. And when the MAK tried reaching out to the instructors who supervised Captain Yevdokimov and First Officer Kuznetsov during their initial and recurrent Direct Mode exercises, the instructors either didn’t answer or submitted pro-forma responses containing no useful information.
The MAK found numerous other discrepancies in both pilots’ training histories. During the captain’s initial training on the SSJ, 30 hours of briefings and debriefings had been improperly logged as simulator time, as a result of which he only spent 58 hours in the simulator out of a required 88. The type rating course required what Aeroflot called an “Aerodrome drill,” which was a check of piloting skill during several approaches in the real aircraft; Yevdokimov received his type rating endorsement without completing the drill or receiving the required instructor’s mark. Meanwhile, First Officer Kuznetsov was supposed to have undergone a psychological evaluation before beginning his type rating course, but this was not done until after the course had been completed. In several cases, both pilots were advanced to the next stage of training before completion of the paperwork certifying that they had passed the previous stage.
One of the more significant issues in the eyes of the investigation was a lack of consistent instructor assignments during both pilots’ initial training, and especially First Officer Kuznetsov’s. In Russia, it has traditionally been understood that the best training outcomes are achieved by assigning a trainee to a single instructor throughout the entire training period so that the instructor can gain an intimate knowledge of the trainee’s strengths and weaknesses. A consistent instructor will deliver a consistent training style and will more effectively identify and correct the areas where a trainee might struggle. But records showed that Kuznetsov was shuttled back and forth between numerous instructors throughout his initial training; for instance, just during the period from 8 August to 1 October 2018, he was assigned to no less than nine different instructors. And after he graduated to the rank of probationary first officer, the normal practice would have been to assign him to a regular captain until he had accumulated a certain number of hours, but Kuznetsov’s assigned captain was changed no less than four times.
It must be noted that changing instructors is not always a problem, and can even be beneficial because different instructors may identify deficiencies that others missed or provide useful alternate perspectives. This holds true as long as there is a consistent standard for assessing a trainee’s progress that can be passed from one instructor to the next. Most likely, the MAK did not believe such a standard existed, considering the generally poor record-keeping at Aeroflot’s training department, which explains why the investigators pointed to the constant instructor changes as a possible contributor to the pilots’ failure to fully develop their piloting skills.
Data from previous incidents showed that the crew of flight 1492 were not the only pilots who had been failed by both Aeroflot’s Direct Mode training and the airline’s training program as a whole. The MAK acquired data from seven Direct Mode reversion events between 2015 and 2018, including six from Aeroflot and one from another Russian airline, and the results painted a dismal picture of Russian pilots’ ability to handle this type of emergency. In six out of seven cases, the pilot made high amplitude, oscillatory sidestick inputs in close proximity to the ground; in five cases, the pilot made nose down sidestick inputs when they should have been raising the nose for touchdown (or “flaring,” which will be discussed extensively in Part 5); in four cases, the aircraft crossed the runway threshold well below the correct height of 50 feet; and various cases featured long landings, bounced landings with multiple touchdowns, and other issues. But most notably, in all seven cases the crew failed to re-trim the horizontal stabilizer to match the desired path angle and speed, forcing the pilot to make continuous pitch inputs using the sidestick in order to maintain the glide path during approach. The technical term for this condition is “out of trim.” In fact, the more out-of-trim the stabilizer was, the greater the amplitude of the pilot’s oscillatory control inputs. These incidents contradicted UAC’s assumption that pilots would draw on their prior experience in conventional aircraft in order to correctly trim the stabilizer in Direct Mode.
An investigation into this pattern of incidents would have revealed that UAC’s assumptions were faulty and that a reversion to Direct Mode would manifest as a more serious failure than originally anticipated. Such an investigation could also have led to recommendations that would improve pilot training and potentially even aircraft design. However, out of the aforementioned seven incidents, two were not subject to any formal investigation at all. The remaining five incidents were investigated by the Russian Federal Air Transport Agency, Rosaviatsiya; the MAK only becomes involved if authorities categorize the event as an “accident.” But in none of these investigations did Rosaviatsiya mention any procedural violations by the flight crew, nor was there any analysis whatsoever of the pilots’ handling difficulties, and no relevant recommendations were made. In its own report, the MAK harshly denigrated these investigations, writing that they possessed “insufficient quality and depth.”
One of these incidents is worth covering in more detail in order to make a point about both the seriousness of the problem and the stark inadequacy of Russia’s investigations. This incident took place on September 5, 2015 on board RA-89046, an Aeroflot SSJ-100; the flight number, route, and number of passengers were not disclosed. According to flight data reviewed by the MAK, the aircraft was in cruise flight at 34,000 feet when an unspecified malfunction occurred and the control system suddenly reverted to Direct Mode. The pilots’ initial reaction was disorganized and they did not take manual control until after the plane had lost 500 feet of altitude. Thereafter, they focused mainly on trying to maintain altitude using the sidestick. They reset the stabilizer to 1.8˚ nose up in an attempt to re-trim the aircraft, but this value was too high, causing an out of trim situation that persisted throughout most of the flight. Because of the high trim setting, the aircraft wanted to pitch up, so the pilot countered this tendency by pushing forward on the sidestick to lower the nose, as they would in Normal Mode. But because the trim had not been reset, the tendency to pitch up simply returned as soon as the pilot released the sidestick to neutral, and the cycle would repeat, over and over and over.
As the flight crew attempted to approach an airport for an emergency landing, the pilot’s battle against the incorrect trim setting and against their own exaggerated inputs escalated into a dangerous rollercoaster ride. The pitch angle varied between 6.7˚ nose up and 4.4˚ nose down, with bank angles oscillating between 20˚ left and 37˚ right. The aircraft deviated from the approach centerline and fell below the glidepath, triggering an aural “GLIDESLOPE” warning from the ground proximity warning system, or GPWS. At multiple points, the “DUAL INPUT” warning also sounded, indicating that both pilots were attempting to move their sidesticks at the same time.
At 380 feet above the ground, the plane was sinking so quickly that the GPWS called out, “PULL UP.” The pilots responded by initiating a go-around. But during the go-around they temporarily lost control of the airplane, dropping from 750 to 500 feet while the GPWS frantically called out “DON’T SINK” and “PULL UP.”
After recovering from this heart-stopping plunge, the pilots lined the plane up for a second approach, which was also wildly unstable with large changes in pitch and bank angle, much like the first. Serious deviations from both the approach centerline and the glide path were observed, and the DUAL INPUT warning sounded repeatedly. On touchdown, the plane landed hard and bounced off the runway twice, but the pilots regained control after deploying the ground spoilers to break up the lift from the wings, and the aircraft rolled safely to a stop.
Despite the seriousness of the event, Rosaviatsiya did not categorize it as an incident and no investigation was conducted. No analysis of the incident is known to have taken place until after the crash of flight 1492, when the MAK asked Aeroflot to hand over flight data from previous Direct Mode reversion events. I want to go on the record to say that failing to investigate an event of this caliber is completely unacceptable and represents not only an abject failure to safeguard the flying public, but also a missed opportunity to make safety improvements that may very well have prevented the crash of Aeroflot flight 1492.
◊◊◊
Against the background of these incidents, and the still unaddressed problem of frequent Direct Mode reversions, the future pilots of flight 1492 progressed unsteadily through their training. I’ve already explained why the training itself was seriously flawed, but this isn’t a story of two perfectly competent pilots who were failed by the system. On the contrary, their piloting skills — especially Yevdokimov’s — were rather weak from the start, and the training program did not adequately address this.
First Officer Kuznetsov was, on balance, probably an average pilot for his experience level. Instructors had left various comments on his record to indicate what areas needed improvement, including maintaining the glide path, crosswind landings, windshear encounters, flaring and touchdown, and some others. But the same comment was never repeated twice, which is a good sign — it means that the trainee is learning and that weaknesses are being corrected as soon as they’re identified. Because Kuznetsov was shunted around to so many different instructors, it’s hard to be 100% sure that this record represented constant improvement, but there’s certainly no indication that he struggled to incorporate the techniques he was taught.
By contrast, Captain Yevdokimov’s records contained multiple comments about failure to maintain airspeed on approach, loss of airspeed at flare, lack of attention to approach stabilization, lack of attention to wind, poorly timed or improperly conducted briefings, late detection of windshear, making decisions without consulting the first officer, failure to make standard callouts, and various other instances of procedural non-compliance. Many of these issues were mentioned multiple times throughout his record, indicating a lack of improvement as the training program progressed. In fact, records show that he had to undergo extra training: on two occasions, he was switched to a more comprehensive track meant for less experienced pilots, and he was given exercises above and beyond the minimum required. Nevertheless, his difficulties persisted all the way through his release onto the line. He was subsequently selected for training to become an instructor despite these deficiencies.
A properly functioning safety management system, or SMS, should have flagged Yevdokimov’s difficulties and applied more training resources until his deficiencies were verifiably corrected. Because that didn’t happen, the MAK called into question the effectiveness of Aeroflot’s SMS.
In fact, the SMS was proving actively detrimental in some areas. For instance, the flight data monitoring system had been set up to generate a report if a pilot failed to apply at least 50% forward sidestick during the takeoff roll to keep the nose on the ground until reaching rotation speed, because insufficient forward pressure could cause the nose to rise before the plane has built up enough speed to lift off, extending the takeoff roll. Pilots knew about this limitation, but because they had no way to accurately determine whether the sidestick was at, say, 49% of travel vs. 51%, they had developed a practice of pushing the sidestick fully forward to the stop during the takeoff roll just to be safe. This habit led to increased wear and tear on the nose gear and could cause unfavorable pilot-induced oscillations (see Part 5) if the plane hit a pothole. But Aeroflot did nothing to correct this issue, nor did they assess why their SMS design was promoting negative habits among SSJ pilots.
◊◊◊
By now, I’ve painted a stark picture of the situation as it stood immediately before the ill-fated flight. An aircraft plagued by technical issues was experiencing dozens of times more reversions to Direct Mode than predicted. UAC did not take adequate action to resolve the recurring faults, and Aeroflot did not provide adequate training on flight Direct Mode. Deficiencies in Aeroflot’s overall training program failed to ensure that pilots developed the basic piloting skills they would need to handle this type of emergency. In-service events showed that pilots were struggling to control the SSJ-100 in Direct Mode, but Russian authorities failed to investigate these occurrences and issue appropriate safety recommendations. And then, against this background, Aeroflot flight 1492 flew into a thunderstorm with a below average captain in charge and an inexperienced first officer at the controls. What happened next was in some respects extraordinary, but for the most part, it was utterly predictable.
◊◊◊
Part 4: Chaos in the Air
Lightning is a threat that aerospace engineers take extremely seriously, but which may be overestimated by the average member of the flying public. Airliners are exceptionally well hardened against lightning effects, and have been since a handful of accidents in the 1960s and 1970s in which lightning strikes ignited fuel vapors inside half-empty fuel tanks, causing the aircraft to explode. Thanks to those early developments, lightning today is practically a non-issue. The average airplane will be hit by lightning numerous times during its service life, and only in vanishingly rare instances does a lightning strike cause damage sufficient to warrant even a precautionary landing.
Certification regulations require that any safety-critical electrical and electronic components be resistant to lightning effects. In practice, most components that don’t fall under this regulation are also designed with some degree of lightning resistance too. Even so, these design requirements are largely precautionary, as lightning should pass harmlessly through the metal airframe in almost all cases. That’s exactly what happened in all previous known SSJ-100 lightning encounters.
But the 5th of May 2019 was that one-in-ten-thousand case.
As Aeroflot flight 1492 was climbing through 8,645 feet inside the leading edge of the thunderstorm, lightning struck the plane with an immense but brief burst of electrical energy. Among many other components, this energy passed through №1 VHF radio antenna, frying it instantly. Traces of lightning exposure were also found on the traffic collision avoidance system antenna, the right temperature sensor, and the right ice detector. But more importantly, it also somehow affected the plane’s two Electronic Interface Units, or EIUs.
As far as I have been able to tell, the Electronic Interface Units — erroneously referred to as Engine Interface Units in the official English translation of the SSJ FCOM — are an obscure pair of computers that translate data between formats on behalf of a wide variety of aircraft systems. These systems include the fly-by-wire system, for which it reformats data from the air data computers (ADCs) into a protocol that the primary flight controls units (PFCUs) and other aircraft systems can actually use. I wasn’t able to find any equivalent device in the Airbus fly-by-wire system, so I assume that on Airbus aircraft this function is either performed by the air data inertial reference units (ADIRUs, equivalent to the combined ADCs and IRSes on the SSJ) or it’s distributed between multiple computers. Anyway, the point is that these devices, and the fly-by-wire system as a whole, were not merely copy-pasted from Airbus, and new vulnerabilities may have been introduced in the process. This issue is discussed more extensively in Part 8.
The MAK was unable to identify the exact mechanism by which the lightning strike affected the EIUs. Lightning strikes are unpredictable; every one is different and they’re hard to study in a lab. But according to the devices’ own memory, at about 18:08 and 10 seconds the “A” channels on both independent EIUs rebooted into alternate flash memory partitions at exactly the same time. This could have been caused by transient power failures at the input points of both channels, but how this happened is essentially a mystery. The Ulyanovsk Instrument Design Bureau, which manufactured the EIUs, stated that a simultaneous reboot of both “A” channels was not a scenario they had ever envisioned or tested.
Since the EIU “A” channels are responsible for the actual conversion of data into the required output format, the ADCs were unable to transmit data to the PFCUs, and after half a second all three PFCUs detected the absence of any valid data from any of the three ADCs. Loss of signal from all three ADCs is a failure condition requiring reversion to Direct Mode, which is exactly what happened. As the fly-by-wire system transitioned into direct mode, a direct connection was established between the sidestick position sensors and the Actuator Control Electronics (ACE) units that command the control surface hydraulic actuators, bypassing the PFCUs. The reversion to direct mode also caused the loss of autotrim, yaw damping, automatic turn coordination, auto-spoilers, and autopilot, as designed.
Within the space of a few seconds, a large number of warning, caution, and advisory messages appeared on the screen of the crew alerting system, including “autopilot off,” “flight controls — Direct Mode,” “cabin pressure automatic mode fault,” “flap/slat protection fault,” “angle of attack and G load protections degraded,” “auto speed brake fault,” “Cat 1 & Cat 2 approach faults,” and “flight director fault.” The flight data recorder temporarily recorded a wide range of completely false parameters, and the autopilot disconnect alarm started blaring in the cockpit. One of the flight crew uttered an interjection best translated as “wow” or “oh man.”
First Officer Kuznetsov’s immediate reaction was to announce “You have control,” to which Yevdokimov replied, “I have control.” He grasped his sidestick and began making small inputs, probably in an attempt to maintain what he perceived to be the current flight path.
“Shall we request a return?” Kuznetsov asked.
Yevdokimov instinctively replied, “No,” but it only took one second for him to change his mind. “Yes, we will return,” he said.
Seconds later, the EIUs finished the reboot process, and all parameters became valid again. The only system on the airplane that was actually damaged was VHF radio 1. But, UAC had designed the SSJ without the capability to restore the flight control system to Normal Mode in the air (more on that in Part 8). Initializing the flight control system in Normal Mode would require the plane to maintain a very steady speed and attitude, more steady than could be reasonably expected, so UAC didn’t provide any mechanism to attempt an in-flight restoration. Such a mechanism could theoretically be designed, and in fact my research suggests that Airbus aircraft are capable of returning from Direct Law to at least Alternate Law, and separately from Alternate Law to Normal Law, in some cases, if the original failure condition is cleared, depending on the nature of the failure. However, flight 1492 was stuck in Direct Law no matter what.
At Yevdokimov’s instruction, Kuznetsov attempted to declare PAN-PAN, one step short of MAYDAY, but he received no reply. The attempt was made using the inoperative VHF radio 1, which had been tuned to the current ATC sector frequency. The SSJ had two more redundant radios, of which VHF 2 was tuned to the universal emergency frequency 121.5, while VHF 3 was configured to send and receive ACARS (Aircraft Communications Addressing and Reporting Systems) messages. Both of these radios were still working, but the pilots were not yet aware that VHF 1 had been damaged.
In the absence of a reply from ATC, Captain Yevdokimov kept the plane in a climbing right turn to follow the SID, which was a reasonable decision because it kept their movements predictable while out of radio contact. But after a second attempt to declare PAN-PAN was met with silence, Yevdokimov commented, “It looks like the radio has been lost as well,” and Kuznetsov replied that he would try again on the emergency frequency. Switching to the still functional VHF radio 2, Kuznetsov announced, “Sheremetyevo Tower, Aeroflot 1492, how do you read?”
This transmission was heard by the controller, but several frequencies were simultaneously tuned at his station and he didn’t check what frequency had been used to call him. He attempted to give the crew the frequency for the next ATC sector, but he transmitted on the Approach Control frequency, which flight 1492 couldn’t hear because it was tuned in the faulty VHF 1. This same sequence of callbacks then took place again, after which the crew decided to set their transponder code to 7600, the universal signal for “radio failure.”
Seconds later, however, Kuznetsov declared PAN-PAN over the emergency frequency, which finally prompted the controller to respond on 121.5, where the crew of flight 1492 was able to hear him. Kuznetsov explained that they had lost radios and that the flight controls had reverted to Direct Mode, to which the controller replied with a clearance to begin descending to 8,000 feet for a return to the airport. Captain Yevdokimov manually put the plane into a descent and set his target altitude and speed as a guide; moments later, their altitude peaked at 10,600 feet.
When the flight controls entered Direct Mode, the horizontal stabilizer was trimmed slightly nose up for cruise flight at a speed of 250 knots with the engines at climb power. This setting was initially fairly close to the desired setting as Captain Yevdokimov continued to fly the SID, but once he initiated a descent, the original trim setting became wildly inappropriate for the flight conditions. Pilots of conventional aircraft are taught that the trim should be adjusted every time there is a significant change in airspeed, flight path angle, or configuration, and with the autotrim function unavailable, this was now Yevdokimov’s responsibility. But at no point in the minutes after the initial reversion did he adjust the trim setting. Instead, he kept trying to use his sidestick to point the nose in the direction he wanted to go, before releasing it to neutral. The incorrect trim setting would then force the nose back the other way, prompting him to make another corrective input, over and over and over — exactly like the previous case of RA-89046.
Yevdokimov’s control over the bank angle displayed similar oscillations for similar reasons. In Normal Mode, he could establish the plane in a continuous 20˚ right bank by holding his sidestick to the right until he bank angle reached 20, then letting go. But in Direct Mode, he needed to hold the sidestick to the right continuously, because if he let go, the ailerons would return to neutral and the plane would try to level out. And yet that’s exactly what he did, over and over.
It must be noted that the flight crew’s performance was negatively affected by several factors. The lightning strike and cascade of warnings were extremely startling and probably rather scary, which would have sharply increased the flight crew’s stress levels. Elevated stress tends to result in more frequent errors and procedural deviations, which was now observed not only in Yevdokimov’s failure to adjust the trim, but also in his failure to call out speed and altitude changes, engine power adjustments, and so on, whereas before the emergency he had followed these procedures almost perfectly. Similarly, as they began the descent, the controller asked whether they could use the standard frequency, but instead of tuning the Approach frequency on VHF radio 2, they simply tried again, unsuccessfully, using VHF radio 1 — a lack of creativity that may be a symptom of elevated stress.
Another symptom of high stress was a tendency by both pilots to clip transmissions, beginning in the minutes after the emergency. When Captain Yevdokimov used the interphone to inform the cabin crew that they were returning to the airport, the flight attendants had a hard time understanding him because the beginning and end of his transmissions were cut short. The crewmembers later reported that the interphone may have been malfunctioning, but the MAK found that this was actually caused by Yevdokimov beginning to speak before pressing the push-to-talk button, and releasing the button before he was done — a known sign of elevated stress.
At the same time, many of First Officer Kuznetsov’s transmissions to ATC were similarly clipped or even entirely absent after the first word. When the controller failed to hear them, the pilots took this is evidence that none of their radios were operating normally. But what had actually happened was that Kuznetsov was not using his push-to-talk button because it was located on his sidestick and he didn’t want to make inadvertent inputs while Yevdokimov was flying manually. Instead, he was using the INT/RAD switch on the radio control panel. This spring-loaded switch defaults to the INT setting, for intercom, which causes the pilots’ own voices to be broadcast through each other’s headsets to ease communication in the noisy cockpit. The pilot can also move this switch to the RAD setting to transmit over the radio without using the push-to-talk button, but the switch must be held in the RAD position throughout the entire transmission or it will spring back into the INT position and the message will be cut short. The MAK determined that the actual reason for Kuznetsov’s clipped transmissions was that, in a state of elevated stress, he kept forgetting to hold the switch down while he was talking.
Between the perceived difficulties with VHF radio 2 and Captain Yevdokimov’s difficulty maintaining the desired flight path, the pilots began to get the impression that the emergency was much more serious than it actually was. This perception would soon begin to exert a negative influence on the pilots’ decision-making.
As Yevdokimov steered the plane into a descending right turn to position himself for approach, he instructed Kuznetsov to read the Quick Reference Handbook (QRH) section on Direct Mode. Noting that the “autopilot off” warning held a higher priority on the crew alerting system display, he decided to start with the QRH checklist for an uncommanded autopilot disconnect instead, which simply called for him to test whether the autopilot could be re-engaged. He immediately discovered that it would not.
At that moment the controller called to ask if they needed assistance from emergency services after landing, to which the crew replied, “No, so far everything is fine.” On the basis of this transmission, controllers decided not to instruct fire crews to pre-position the fire trucks. This decision belied the danger that the crew actually felt they were in.
Captain Yevdokimov now again ordered Kuznetsov to perform the Direct Mode QRH checklist, which he began to do. But he was repeatedly interrupted by transmissions from air traffic control, which Yevdokimov ordered him to answer. This dynamic represented rather poor crew resource management, or CRM. Pilots are taught that in an emergency, the flying pilot should assume responsibility for radio communications so that the non-flying pilot can complete the emergency checklists in a timely and thorough manner. Unfortunately, that was not what happened, and the pilots’ understanding of the checklist was degraded as a result. In fact, when he finally got a chance, Kuznetsov simply read the words on the page as fast as he could:
“ Autothrottle do not use, maneuver with care. Trim manually. Speed brake, use no more than 1/2. For landing use Flaps 3. TAWS, landing gear, Flaps 3 on. Approach speed, V reference plus 10. Landing distance multiply by 1.34. Speed brake set manually FULL at landing. Go-around thrust levers set manually NTO.”
His tone of voice betrayed no interest in the contents of what he was reading, and the pilots never discussed any of the items. It was as though the checklist was a formality to get out of the way. And despite the checklist’s reminder to “trim manually,” Yevdokimov continued to leave the trim setting right where it had been ever since the lightning strike.
Before Kuznetsov could read any more of the checklist, the controller instructed them to fly heading 210 to intercept the localizer for runway 24 Left. The localizer is part of the instrument landing system, or ILS; it helps the pilot or autopilot keep the plane aligned with the runway centerline. But it was too early to maneuver for the approach at this point, because their altitude was too high and they weren’t done with all the emergency checklists. So Yevdokimov said, “We should go into a circuit. We are not ready for approach.” Kuznetsov requested as much from the controller, who gave them a heading that would reverse their course. Yevdokimov then had a better idea, prompting him to jump on radio himself, where he asked, “Aeroflot 1492, a holding pattern over Kilo November, if possible.”
This decision was one of the best Yevdokimov had made so far. The aircraft was not in danger and there was no point rushing into an approach without preparing for it. The crew could have circled in a holding pattern while they figured out what was wrong with their plane, why it was flying funny, and how they would stabilize the approach. But sadly, that isn’t what happened. In an unfortunate coincidence, Yevdokimov’s request overlapped with a transmission from another aircraft on the standard frequency and the controller never heard it. Despite this, Yevdokimov never repeated his request for a holding pattern around the KN radio beacon, and the flight never entered a proper hold, completing only a single 360-degree orbit.
As Yevdokimov hand-flew the plane into the orbit, he struggled to maintain a stable flight path. Their bank angle varied significantly, reaching values as high as 40 degrees to the right — above the normal maximum — and he was unable to maintain their cleared altitude of 600 meters (2,000 ft). The altitude alerting system kept going off to warn that they were deviating from the crew-selected target altitude by more than 200 ft (60 m), prompting Yevdokimov to explain, “What’s wrong? Plus, minus 200 feet?” But he didn’t interrogate why he was unable to hold a steady altitude.
In fact, every time he leveled the wings, he pitched up too much, causing the plane to climb, and every time he turned, he didn’t pitch up enough to compensate for the decreased lift in a high bank angle, causing the plane to descend. In other words, every time he tried to focus on bank, he would lose control of pitch, and vice versa. One of the reasons for this difficulty, other than the incorrect trim setting, was the lack of automatic turn coordination and Yevdokimov’s failure to coordinate his turns manually using the rudder, which caused a significant drag-inducing sideslip every time he tried to bank.
While Yevdokimov muddled his way through the orbit, Kuznetsov observed that they would land over their maximum landing weight due to their nearly full fuel load, and asked whether they should complete the overweight landing checklist. Yevdokimov instructed him to do so, but neither pilot proposed holding for a while to burn off fuel, which would have been safer, as the SSJ — like almost all narrow body jets — does not have fuel dumping capability.
Coming around the back of the orbit, the crew began to configure for landing, starting with extending the flaps to position 1. As the flaps came out, remarkably, Yevdokimov manually repositioned the trim nose up to compensate — the first time he had done so in the 13 minutes and 30 seconds since the reversion to Direct Mode. In the MAK’s view, somewhere during his training Yevdokimov most likely received the false impression that in Direct Mode he only needed to re-trim the aircraft during a configuration change, when actually any significant change to airspeed or flight path angle also requires a corresponding adjustment. But because Aeroflot’s instructor staff stonewalled the MAK, the cause of such a mistaken impression could not be confirmed. All we know for sure is that he flew the aircraft out of trim for a considerable period, requiring constant sidestick inputs, but didn’t attempt to trim until the flaps were extended — which almost certainly wasn’t a coincidence.
Over the next minute, the controller provided them with vectors to intercept the localizer, while the pilots began reducing their airspeed, set the flaps to position 2, and extended the landing gear. Captain Yevdokimov then adjusted the trim one more time, to 3.5˚ nose up; this would be the last time he touched it.
By this point, an intriguing feature of Yevdokimov’s flying had clearly presented itself — namely, a bizarre tendency to press the sidestick priority button for no obvious reason. The purpose of this button is to lock out the opposite sidestick in case it jams or malfunctions. But flight data showed that at no point did the first officer’s sidestick move; in fact, Kuznetsov took care not to touch it. So why was he doing this? In the MAK’s opinion, the answer lay in Yevdokimov’s previous experience on the Boeing 737 and Ilyushin Il-76, both of which require manual trim when the autopilot is off. On those aircraft, the trim switches on the captain’s side are located on the left-hand part of the yoke and can be easily actuated using the left thumb — coincidentally, the exact same location and motion as the sidestick priority button on the captain’s left-mounted sidestick. It was therefore quite possible that when he perceived that the aircraft was fighting his pitch inputs, Yevdokimov’s muscle memory from his previous aircraft kicked in. That’s not to say that he genuinely thought he was trimming the aircraft by pressing the sidestick priority button; in fact, he clearly knew where the trim switches were because he used them four times while the flaps were being extended. Rather, in a moment of elevated stress, his body reacted in the way it remembered without his brain necessarily being in the loop.
It’s also worth mentioning that on the SSJ, the manual trim control switches are located on a separate control panel, requiring the pilot to remove their hand from the thrust levers, find the switches — which might never be used in an SSJ pilot’s career, outside of training — and then depress them. This helps explain why Yevdokimov only adjusted the trim when prompted to do so by a conscious configuration change. On a conventional aircraft, most trimming is instinctive in response to feedback forces without any need to engage executive function.
In his post-accident interview, Yevdokimov told the MAK that the nose kept dipping despite his attempts to re-trim the stabilizer. Most probably this statement was made to explain the flight data, which was already known to him by the time of the interview, rather than a genuine recounting of what he felt during the flight. It does not appear that he consciously connected the trim setting to his control difficulties at any point prior to the accident.
◊◊◊
At 18:24, flight 1492 began its turn onto final approach. At that time, the pilots set the spoiler handle to “ground spoilers armed,” which is a normal part of the approach configuration. In Normal Mode, this setting will cause the spoilers to deploy automatically on touchdown, spoiling the lift from the wings and pushing the plane into the runway. This improves braking action and prevents the plane from bouncing off the runway surface. But in Direct Mode, automatic spoiler deployment is unavailable, so why did they arm the spoilers anyway? In their interviews, the pilots explained that they armed the spoilers to prevent an automated alert from being generated at 1,000 feet on approach if they were not in the landing configuration. While this logic is valid, arming the spoilers for an automatic deployment that can’t happen is potentially misleading, in that it degrades the pilots’ awareness of the need to deploy the spoilers manually, an activity that they never have to perform during normal flight. The crew should have compensated by briefing who would deploy the spoilers and when, but they did not. This issue would ultimately have serious consequences for the outcome of flight 1492.
In any case, the primary task now facing the pilots was to fly an ILS approach to runway 24 Left at Sheremetyevo without the use of the autopilot or flight director. Normally, the autopilot automatically tracks the localizer signal to align with the runway and the glideslope signal to achieve the correct descent gradient. Alternatively, if the autopilot is off, the flight director will display the real-time control inputs required to follow those signals. But in Direct Mode, neither of these features was available, forcing the crew to fly the approach by what’s known as “raw data.”* In a raw data ILS approach, the pilot refers to crude deviation indicators that display the aircraft’s position relative to the localizer and glideslope in terms of “dots.” The more dots there are between the aircraft position indicator and the line representing the signal, the greater the actual distance between them. Following the ILS using these dots is harder than following a flight director and is not normally done during routine operations.
*It is worth noting that on the Airbus, the flight director is available in Alternate Law. This is one of the drawbacks of the SSJ’s lack of an equivalent to Alternate law.
When Captain Yevdokimov first attempted to roll out onto the localizer, he discovered that he was much too far to the right, prompting him to correct. The deviation was large enough that the Approach controller noticed too, and he transmitted, “Aeroflot 1492, if you are planning to capture the localizer, you should proceed to the left about 20 degrees.” Kuznetsov acknowledged, although Yevdokimov was already trying to correct, and the aircraft was slowly converging with the localizer. Kuznetsov then set the flaps to position 3, which was the prescribed landing position in Direct Mode.
At 18:26, the approach controller handed flight 1492 over to the tower controller. At the same time, the pilots changed their transponder code from 7600 (“radio failure”) to 7700 (“general emergency”) without informing the controller. The controller didn’t notice this change because flight 1492 was already highlighted as an emergency aircraft on his radar display. Had the controller noticed this change, or had the flight crew reported an emergency, the fire trucks would have been pre-positioned for the landing. But this never happened, and in fact the pilots never informed the cabin crew or passengers to brace for an emergency landing either.
Moments later, at 18:27, flight 1492 intercepted the glideslope and Yevdokimov initiated the final descent. This was done without completing the approach checklist or the approach briefing, eliminating an opportunity for the crew to review the differences between a normal approach and a Direct Mode approach. Given that the pilots totally glazed over the instructions for Direct Mode flight in the QRH, it’s unlikely that they fully understood what was required of them. The decision to approach without having completed these items represented poor judgment, as well as poor crew resource management. In fact, Yevdokimov had decided they were ready for an approach without asking Kuznetsov — who was in charge of reading the checklists — whether he was ready too. For his part, Kuznetsov did not challenge Yevdokimov’s decision.
In hindsight, it’s very likely that Yevdokimov began the approach as quickly as possible because he felt that the airplane was not flying normally. This is the correct course of action when a dangerous situation exists, but the pilots had not attempted to diagnose the cause of their difficulties. Had they done so, they would have understood that the flight was not in danger, and they might not have rushed unprepared into a challenging approach that required multiple non-standard actions.
It’s also highly noteworthy that the flight crew never set the go-around altitude on their altimeters to provide an easy reference point in the event of a go-around. This step is part of the approach checklist that was not completed. Its omission further testifies to Yevdokimov’s strong and growing desire to land without making a risk assessment or establishing a contingency plan.
During the descent, the airspeed was kept quite close to the 155-knot approach speed calculated and set by the crew, but the aircraft was almost continuously half a dot below the glideslope. Furthermore, the aircraft was not trimmed for a descent in the landing configuration, and Yevdokimov had to apply continuous back pressure using the sidestick to prevent the nose from dropping too low. And yet no attempt to adjust the trim setting was made.
To make matters worse, the thunderstorms were by now approaching the airport vicinity, and flight 1492 was fighting a 30-knot wind out of the south-southwest, resulting in a crosswind component that had to be counteracted with an 8-degree left sideslip. But when the tower controller called them just before 18:28 to issue landing clearance, he also informed the crew that the wind over the runway was out of the south-southeast at 13 to 19 knots. The difference between the reported wind over the runway and the wind they were encountering on approach implied that the flight would encounter windshear during the final part of the descent. As the approach was aligned along a southwesterly heading of 240˚, a wind shift from strong southwesterly to weaker southeasterly would decrease the headwind component and cause a noticeable reduction in aircraft performance. A headwind tends to increase airspeed, so if the headwind goes away, airspeed will decrease, which means that lift will also decrease and the plane will descend faster — not what you want in close proximity to the ground.
Indeed, just 30 seconds later, as flight 1492 descended through 1,100 feet above airport level, the on-board weather radar detected an impending change in wind speed and direction and triggered an automated warning callout: “GO AROUND, WINDSHEAR AHEAD.”
According to the QRH, the pilots must react to this warning by executing a go-around immediately, unless it can be clearly established that windshear is not a threat. Captain Yevdokimov later stated that he chose to ignore the warning on this basis. Notably, the QRH did not provide any criteria to be used when making this determination, which the MAK identified as a problem. But a bigger problem was that with a thunderstorm approaching the airport, the pilots had every reason to believe that the windshear warning was genuine, and in fact it was. Yevdokimov’s kneejerk reaction to continue represented further evidence that he was “tunneling in” on the goal of landing, causing him to instinctively disregard information that supported a different course of action.
Even more worrying, though, was Yevdokimov’s stated justification for determining that the windshear was not a threat. In his mind, he told the MAK, it was permissible to continue because the aircraft met the stabilized approach criteria: landing configuration, aligned with localizer and glideslope, at the correct speed, with the correct thrust lever position, and no major inputs required to land in the touchdown zone. Therefore, he said, the plane was not encountering windshear. But that’s a misunderstanding of how the predictive windshear warning works — it doesn’t say “you’re in windshear right now,” it says “windshear AHEAD.” The fact that the approach is stabilized now has absolutely no bearing on whether there is windshear ahead.
If there was any question about where Yevdokimov got this dangerously mistaken impression, it was dispelled in Aeroflot’s dissenting opinion, attached to the MAK report. Incomprehensibly, Aeroflot took Yevdokimov’s side on this issue and wrote that he was within his rights to ignore a predictive windshear warning if the aircraft was not presently experiencing windshear effects. This is, without exaggeration, the stupidest stand I’ve ever seen an airline make during a crash investigation. Aeroflot’s position on this issue isn’t merely wrong, it’s wildly unsafe and recklessly endangers lives for no justifiable reason.
In any case, right as the windshear warning ceased, the aircraft descended through 1,000 feet above airport level, where Aeroflot procedures required that the aircraft be stabilized for approach. Since all the stabilization criteria were technically met, other than the persistent half-dot deviation below the glideslope, Yevdokimov announced that they would continue. Kuznetsov acknowledged, then reminded Yevdokimov that the maximum vertical speed at touchdown in their overweight condition was 360 feet per minute.
At 18:29, at a height of 270 feet, Kuznetsov called out that they were at minimums, and Yevdokimov announced “runway in sight.” But at almost that same moment, the plane entered the windshear zone, and the headwind component started decreasing toward zero. As this occurred, the plane rapidly fell even farther below the glideslope, triggering a synthetic “GLIDESLOPE” callout from the ground proximity warning system. But as Yevdokimov later explained, he descended below the glideslope on purpose in order to get down early, assume a shallower approach angle, and soften the touchdown. This is a somewhat common airman’s myth that I’ve seen before — this idea that flying below the glideslope just before landing can prevent a hard touchdown or increase the usable runway length. The truth is that adhering to the stabilized approach criteria already provides adequate protection against these issues, even if the airplane is overweight.
In response to the GLIDESLOPE warning, Yevdokimov called out “Informative,” citing the Aeroflot operations manual, which stated that below decision height, with the runway in sight, a GLIDESLOPE warning is purely informative and does not require the crew to execute a go-around. This provision was not in line with Sukhoi’s FCOM, which stated that any warning or failure, other than engine failure, between 1,000 and 100 feet on final approach requires a go-around. However, the QRH — also a Sukhoi product — states that the correct response to a GLIDESLOPE warning is to re-establish the plane on the glideslope. These contradictory provisions may have caused Aeroflot crews to habitually ignore GPWS glideslope callouts.
After the GLIDESLOPE warning, First Officer Kuznetsov started rapidly calling out their vertical speed, which at that point was slightly high. To make their descent profile shallower, as he had intended, Yevdokimov increased engine power, causing their speed to increase substantially above the approach reference speed of 155 knots. But this didn’t arrest their sink rate as much as it should have because of the ongoing windshear, and the plane continued to descend at a rate of up to 800 feet per minute as it neared the runway threshold. Moments later, flight 1492 crossed the runway threshold at a height of 33 feet, well below the normal 50 feet, and dropping fast.
It was here, in this critical moment, that a rapid sequence of events took place that would turn this story into a tragedy.
◊◊◊
Part 5: A Flare for Drama
The seconds immediately before, during, and after touchdown require more raw piloting skill than any other phase of flight. Causing an aircraft weighing dozens or hundreds of tons and traveling at over 150 km/h to contact the ground in a controlled and comfortable manner isn’t easy and doesn’t come naturally. Pilots practice extensively in order to learn how to get the touchdown just right, and for any given aircraft type you’ll find experienced pilots espousing various techniques without complete agreement.
The first stage of this process is to “flare” the aircraft by raising the nose. This reduces the descent rate, ideally to near zero right at the moment of touchdown, while positioning the plane to land on its main landing gear first. The exact height at which the pilot must begin the flare depends on who you ask, but generally this occurs within the last five seconds before touchdown. Starting the flare too early can cause the plane to float down the runway or not touch down at all, while flaring too late can lead to a hard landing. The aircraft’s airspeed over the threshold can also influence the optimal flare initiation point, as will the descent rate. Some advanced autopilots can flare the aircraft automatically, but on most aircraft types this is done manually even if automatic landing is available. The SSJ-100 FCOM advised pilots to initiate the flare with one continuous motion, hold the sidestick “in the required position,” and do not permit “forward sidestick movement” after the flare has begun.
On Airbus aircraft, there is a Normal Law sub-mode called Flare Law that kicks in when the aircraft descends below 50 feet radio height in the landing configuration in order to make the plane feel more like a conventional aircraft. Normally, the constant readjustment of the stabilizer trim to match the commanded pitch angle would make it too easy to overcontrol the aircraft during this sensitive phase of flight, so in Flare Law the trim is frozen at its last position before the pilot initiates the flare. At the same time, Flare Law commands a slight nose down pitch, about -2˚, which together with the frozen trim setting prevents the nose up moment from becoming excessive by essentially mimicking the force feedback from a conventional aircraft.
The SSJ doesn’t have a Flare Law, although it does still freeze the trim setting at 50 feet, just like the Airbus, and modifies the relationship between the sidestick and the elevators to reduce the risk of overcontrol. The differences between these features and a fully-fledged Flare Law seem to be mostly semantic rather than practical. However, it’s worth pointing out that there’s relatively little difference in pitch behavior below 50 feet, whether the SSJ is in Normal Mode or Direct Mode. In both modes, the trim is not automatically adjusted and elevator deflection is at least relatively proportional to sidestick deflection. However, certain systematic differences between the two modes do come into play.
Before we can understand what happened during the last moments of flight 1492, we have to talk about some of those differences, as well as the way Captain Yevdokimov perceived them. In his interviews, Yevdokimov stated that the controls were less responsive than normal and the plane seemed slow to react to his inputs. However, the control response in Direct Mode is actually about a tenth of a second faster than in Normal Mode because the signal doesn’t have to be processed by the PFCUs. In fact, the MAK verified that the control response on flight 1492 was in line with the manufacturer’s model and was not slower than in Normal Mode. There were two reasons Yevdokimov developed this false impression: first, due to the lack of control adjustment for airspeed in Direct Mode, larger inputs would have been needed to produce the same aircraft response as the plane slowed for landing; and second, because the airplane was out of trim, his inputs had to overcome the force of the incorrect trim setting before the desired attitude could be achieved.
Because of these factors, Yevdokimov slowly taught himself to make larger and larger inputs over the course of the flight, and displayed less and less hesitation in doing so. But as his inputs got bigger and faster, he ran up against the fact that the elevator control actuators can only move so fast. With no direct cable connection between the sidestick and the controls, and no force feedback, it’s possible to jerk the sidestick faster than the elevators can respond. Normally this isn’t an issue because moving the sidestick so far, so quickly is crazy outside of certain extreme emergencies. But it now became an issue because whenever Yevdokimov rapidly moved the sidestick, the elevator deflection was limited by the rate of actuator travel, creating a perception that further inputs were needed. The aircraft would then catch up to his inputs, and because he was commanding the maximum elevator travel rate, the rate of pitch change would increase more rapidly than he was expecting. This is also at least partly because Normal Mode has an artificial pitch rate limit, whereas in Direct Mode the limit is mechanical. Furthermore, due to the lack of damping, the maximum deflection available is slightly higher than in Normal Mode. Due to these factors, Yevdokimov would respond to the high pitch rate with an opposite input proportional to the perceived excess, causing the cycle to reverse direction. This is a phenomenon known as “pilot-induced oscillation,” or PIO.
If a PIO event becomes divergent, with the magnitude of each input exceeding the previous, then devastating results can follow. A divergent PIO event is also known as “adverse aircraft-pilot coupling,” or APC, in which pilot inputs quickly reach the mechanical control limits. Such a situation can arise when some aircraft parameter crosses a threshold value and provokes a large pilot reaction due to a difference between actual and expected aircraft response.
Pilot-induced oscillations can occur on any aircraft in any control law, but they are somewhat more common on fly-by-wire aircraft without force feedback, especially when there is a direct relationship between sidestick position and control surface deflection. Similar oscillations were observed in all of the previous Direct Mode reversion events analyzed by the MAK, especially during final approach. There appears to have been a systemic failure to train SSJ pilots on strategies to avoid PIOs in Direct Mode. However, this was a problem that extended to Normal Mode as well, as evidenced by recovered data from Captain Yevdokimov’s last 37 landings before the accident. In each of these landings, he made oscillatory pitch inputs at low altitude, and during flare he pulled up excessively, in some cases using nearly full nose up sidestick travel. Sometimes this resulted in over-flaring and a long or floated landing; other times, he made a nose down input to correct for his own excessive pitch up, causing touchdown to occur with a significant nose down pitch rate. In some cases this resulted in a bounce off the runway, which is undesirable, for reasons we’ll get into shortly.
Data from flight 1492 show that an oscillation was occurring during the last minutes of flight 1492, as Yevdokimov moved the sidestick rapidly forward and back with a periodicity of about two seconds. He was not consciously aware that his inputs were self-oscillatory; rather, he believed that he was doing his best to keep the plane on the desired trajectory, and that something was interfering with his ability to do so. At this stage the oscillations were not divergent; that is to say, each was about the same size as the last, and full control authority was not used. But that was about to change.
As flight 1492 crossed the threshold, Captain Yevdokimov’s substantial increase in engine power caused a large increase in airspeed, reaching a peak of 173 knots, 18 knots above the approach reference speed. At most airlines, a speed greater than ten knots above the approach reference speed indicates an unstable approach and may warrant a go-around. However, Aeroflot’s stabilized approach criteria allowed a deviation up to +20 knots above the reference speed, which the MAK pointed out is unusual, unsafe, and may encourage pilots to continue flawed approaches. This likely played no direct role in Yevdokimov’s decision-making because he was committed to landing no matter what, but it certainly wasn’t helping to foster a cautious attitude.
Regardless of why Yevdokimov allowed this high speed to develop, its primary effect was to increase the responsiveness of the aircraft to pilot inputs. At the same time, their descent rate was increasing due to the windshear, but the pitch angle was higher than usual because Yevdokimov was deliberately approaching the threshold with a shallower flight path angle. At the moment of the flare, these factors combined to turn what had been a stable oscillation into a divergent one.
After crossing the runway threshold, Yevdokimov reduced thrust to idle at a height of 17 feet, then initiated the flare by pulling the sidestick back to 8.8˚ — about 65% of full travel, which is 13.7˚ in each direction. This input was similar to the inputs he had used to start the flare on previous approaches in Normal Mode. But this time, due to their high speed and higher starting pitch, the airplane responded to this input more rapidly than he was expecting. In less than one second, he attempted to slow the nose-up pitch rate by pushing forward — exactly what the FCOM says not to do. All that was needed was to return the sidestick to neutral, because the trim hadn’t been reset upward and the airplane would desire to pitch down all by itself. But instead, he pushed the sidestick to 5.8˚ forward, causing the actual pitch angle to peak at 3.8˚ before starting to reverse. As he felt the onset of this reversal, he instinctively judged that it was too large, especially with the ground rapidly approaching, so he pulled back sharply — too sharply, in fact, as the sidestick deflection reached 13.2˚ back, just short of the maximum. This caused the pitch angular rate trend to reverse again, and the pitch angle bottomed out at 1.8˚ before rapidly rising. This rise again caught Yevdokimov by surprise, and within one second he pushed the sidestick from nearly full back to a full 13.7˚ forward. Once again, the pitch attitude peaked, this time at 6.3˚ nose up, before starting to decrease rapidly. And like clockwork, as he sensed the nose about to drop, he hauled back on the sidestick so fast that it went from the forward stop to the aft stop in a quarter of a second. The elevators physically could not respond fast enough to reflect this, and for the next second the airplane continued to pitch down, dropping through neutral to -1.7˚.
Yevdokimov was now in the grip of a divergent PIO event. However, because the sidestick has a nearly direct relationship with elevator position in Normal Mode below 50 feet anyway, the fact that the controls were in Direct Mode played almost no direct role in the events described in the above paragraph. Rather, if Direct Mode had any influence on these events at all, it was to accustom Yevdokimov to making excessive control inputs, as I discussed earlier. This explains why the magnitude of his inputs was so much larger on flight 1492 than on previous flights, even though the active pitch philosophy below 50 feet was essentially the same.
In any case, the pitch angle had only just begun to rise above its nadir of -1.7˚ when the plane touched down on the runway with all three landing gears almost simultaneously. The descent rate at touchdown was around 630 feet per minute (3.2 m/s), well above the desired value, due to the windshear and the low pitch attitude. Instead of easing onto the runway in a nice, almost asymptotic curve, the plane simply bounced off like a hurled stone, pulling 2.55 G’s in the process.
◊◊◊
All airline pilots are taught strategies for avoiding, and recovering from, a bounced landing; in fact, such training is mandatory in Russia. That’s because bounced landings draw pilots into a psychological trap that worsens their consequences. After a plane bounces back into the air, the pilot’s instinct is to plant it back on the runway, which often results in nose-down inputs in very close proximity to the ground. These in turn cause the plane to impact a second time nose-gear-first and with a significant descent rate. The nose gear then bounces off again, pivoting the nose up and the tail down, at which point the main landing gear impacts the ground again, harder and faster this time, which in turn causes the plane to bounce even higher. In some cases, this cycle repeats until the landing gear breaks and the plane crashes. I previously wrote about a series of such accidents involving the McDonnell Douglas MD-11, which you can read about here.
According to the SSJ FCOM, the appropriate reaction to a small bounce of less than 5 feet is to reduce thrust to idle and retain the sidestick in the position it was in at first touchdown as a strategy to counteract the desire to push forward. This should cause the plane to touch down more gently the second time. Alternatively, if the bounce is higher than five feet, the correct response is to increase power and go around. But while these procedures are alright in theory, the MAK points out that it’s not always clear to the pilot whether a bounce is higher or lower than 5 feet, or whether the situation is recoverable, and in fact no airplane has procedures that clearly address this problem.
An added complication is the role of the spoilers. In Normal Mode, the spoilers will automatically extend at first ground contact, which tends to dampen the plane’s desire to bounce. But in Direct Mode, the pilot must remember to deploy the spoilers manually as soon as the gear first touches down. In previous Direct Mode reversion events involving the SSJ, the pilots did not immediately do so, and some of these flights continued to bounce off the runway repeatedly until the pilots finally deployed the spoilers.
Unfortunately, the crew of flight 1492 did not remember to manually deploy the spoilers during the first touchdown, missing an opportunity to dampen the bounce. Yevdokimov did attempt to deploy the thrust reversers, but the reverser doors did not open because a positive weight-on-wheels signal is required to move them, and the plane was already airborne again. This first bounce was nevertheless recoverable, because the plane did not reach a height of five feet. But instead of applying the recovery maneuver described in the FCOM, Yevdokimov suddenly reversed his input from full nose up to full nose down in reaction to the large nose up moment generated by his previous input and the effect of the bounce. His new full nose down input then caused the pitch angle to peak at 4˚ before falling rapidly through neutral and into a nose down position. This prompted him to reverse his input to full nose up yet again, but it was too late. Flight 1492 now impacted the runway a second time, pitched 4.2 degrees nose down, with a vertical speed of -830 feet per minute (4.2 m/s). On impact the nose gear bounced up off the runway, the airplane pivoted about its center of mass, and the main landing gear slammed into the ground with a bone-shattering force of 5.85 G’s.
During the investigation, simulations were undertaken to determine what factors contributed to this devastating second bounce and how it might have been avoided. The findings included the following:
1. If, at the moment of touchdown, Yevdokimov had deployed the spoilers, relaxed the sidestick to neutral, and reduced thrust to idle, they would have bounced then landed hard again, pulling 3.8 G’s, but there would have been no second bounce and the plane would not have been damaged.
2. If Yevdokimov had kept the sidestick in neutral instead of pulling back sharply at 17 feet, the plane would not have bounced off the runway at all.
3. Without the effects of the windshear, the aircraft would have touched down farther along the runway, but three seconds sooner, with a slightly positive pitch angle, and a bounce still would have occurred. But because the pilot’s actions were largely reactive to the perceived aircraft state, it was impossible to say whether this would have prompted him to make inputs that might avoid further bounces.
4. If the windshear was present, the spoilers still did not deploy, and Yevdokimov made all the same inputs, but the control law was in Normal Mode, the plane would have touched down hard a second time, pulling 3.6 G’s, but would not have bounced again. This was because of the slightly slower control response and increased damping in Normal Mode, which would have coincidentally resulted in a less extreme nose down attitude during the second touchdown.
Sadly, while the simulations showed it was possible to avert the tragedy during the first bounce, it would have been very difficult for Yevdokimov to escape from the pilot-induced oscillation he was now experiencing. To quickly escape from such an event requires the mental clarity to understand the relationship between one’s own inputs and the response of the airplane, but someone who has that mental clarity is unlikely to get into a PIO in the first place. Most such events end only when the pilot gives up fighting, or in some rare and unfortunate cases, when the airplane breaks in some way. In this case, because the PIO took place so close to the ground, serious damage to the aircraft was almost inevitable.
As flight 1492 careened off the runway a second time, the combination of Yevdokimov’s ongoing full nose up input and the huge force of the bounce sent the pitch angle skyrocketing to 10 degrees nose up in the space of one second. The rate of upward pitch angle change was almost off the charts when Yevdokimov slammed his sidestick fully forward yet again. By then, the airplane was 15 feet in the air, almost back to the height where Yevdokimov initiated the flare in the first place. But almost immediately after pushing down, he felt the nose start to drop out from under him, so he pulled the sidestick back once again to full nose up. However, at that moment he must have realized that the bounce was too high to recover safely. In a spur-of-the-moment attempt to go around, he kept the stick fully aft and slammed the thrust levers as far forward as they would go, past the takeoff/go-around setting and into the MAX thrust position, a feature unique to the SSJ that provides 10% more thrust than TO/GA power in an emergency. Finally, it seemed he had broken out of the PIO, and if things had gone slightly differently, he might have saved the plane — but alas, it was not to be.
In one last tragic twist, because the reverser levers were already set to the reverse thrust position during the first bounce, the reverser doors automatically deployed during the second touchdown when the weight-on-wheels sensors detected that the plane was on the ground. The system is designed not to open the doors or produce reverse thrust if the plane is airborne, as a safety feature. Although the plane became airborne again before reverse thrust could actually be generated, the reverser doors were still open when Yevdokimov commanded max forward thrust. The safety system then prevented thrust from actually increasing before the reverser doors had closed, in order to prevent reverse thrust from being generated in the air. As a result, Yevdokimov’s last, desperate attempt to apply power elicited no response from the engines.
In the end, Yevdokimov could do nothing to stop the plane from crashing back to earth. A split second later, as the reverser doors swung closed, flight 1492 touched down a third time. This time the pitch was slightly nose up, with a vertical speed of 1,220 feet per minute (6.2 m/s), resulting in an impact force of at least 5.0 G’s, but probably higher. The landing gear instantly collapsed, a cloud of white fuel gushed out of the shattered fuel tanks, and the aircraft erupted in flames.
◊◊◊
The events of this Part, from the start of the flare to the ignition of the fire, took place in just 13 seconds.
◊◊◊
Part 6: The Landing Gear Question
One of the most persistent public questions about flight 1492 was why the landing gear collapsed during the third touchdown, and why this collapse was able to breach the fuel tanks, triggering a catastrophic fire. This question is especially significant because European, American, and Russian certification regulations all require that the landing gear be designed so as to avoid this exact scenario. For instance, EASA regulation 25.721 states the following:
“The main landing gear system must be designed so that if it fails due to overloads during takeoff and landing (assuming the overloads to act in the upward and aft directions), the failure mode is not likely to cause… the spillage of enough fuel from any part of the fuel system to constitute a fire hazard.”
The Russian equivalent regulation, AR 25.271, contains identical wording.
Therefore, to understand why flight 1492 burst into flames on Sheremetyevo’s Runway 24 Left, we need to examine how the landing gear was designed and how it was tested.
Like most similar airplanes, the SSJ-100 main landing gear folds inward toward the fuselage, hinging about a cylindrical, longitudinally-oriented beam called the crossarm. The main landing gear leg descends from the crossarm. The leg is also braced by two diagonal, folding elements, of which the forward element is known as the drag brace and the aft element is known as the side brace.
The forward end of the crossarm and the drag brace are both attached to the aft face of the wing box rear spar, a massive structural beam that runs from wing root to wing tip and forms the aft edge of the wing’s internal box structure. Meanwhile, the aft end of the crossarm and the side brace are attached to the landing gear crossbeam, which angles aft and inboard from the wing box rear spar to the fuselage.
The significance of this information is that the rear spar also forms part of the wall of the fuel tank, which means that the tank could be breached if the crossarm and drag brace are ripped out of their attachment points. This is a vulnerability of essentially every transport aircraft, simply because this is the easiest and most efficient way to configure the fuel tank, the spar, and the landing gear. Therefore, every airliner is designed such that if the landing gear is subjected to a sufficiently large force, the aforementioned elements will separate in a sequence that prevents damage to the fuel tanks.
The SSJ’s landing gear, which was designed and produced by French company Safran, incorporates a set of “weak links,” or fuse pins, which are designed to fail under a slightly lower load than the rest of the landing gear. Four of these fuse pins attach the forward end of the crossarm to the rear spar, and four more attach the drag brace. Therefore, during a heavy impact the crossarm should cleanly separate from the rear spar without breaching the fuel tank, followed by the drag brace. The entire landing gear assembly should then rotate aft about the remaining attachment points, and the crossbeam should detach from the wing, causing the gear to separate in a rearward direction, away from the fuel tank. This is essentially the same design solution as every other similar aircraft.
When aerospace engineers design an aircraft component that will be subject to loading, they think in terms of two different load values: the design limit load, and the ultimate load. The design limit load is the size of the load that the component is expected to experience in service; or more specifically, the probability of a larger load is less than n per flight hour. Certification regulations typically require that the component be designed to withstand at least 1.5 times the design limit load before actually breaking, so engineers add a large safety factor. After accounting for this safety factor, the load at which the component will actually break is known as the ultimate load.
Certification regulations state that the design limit load may be incurred during a touchdown at maximum landing weight* with a vertical rate of at least 600 feet per minute (3.05 m/s), while the ultimate load may be incurred with a vertical rate at touchdown of 736 feet per minute (3.74 m/s). Because the impact force increases with the square of the velocity, this represents the required minimum safety margin of 1.5. The actual safety margin of most of the SSJ’s landing gear components, according to Safran, is above 2.0. The safety margin of the fuse pins, which were designed by UAC, was not provided to the investigation team, although it is by definition lower. However, based on the vertical velocity of flight 1492 during the second touchdown, and the effects thereof, I can say that it’s not more than 1.9.
*Because the actual weight of flight 1492 at touchdown was very close to max landing weight, the accident scenario bears an acceptable resemblance to the certification scenario without adjusting the numbers to account for the weight of the aircraft.
European, American, and Russian regulations provide some criteria against which manufacturers should test for the safe separation of the landing gear during a load application exceeding the ultimate load. For instance, EASA’s relevant regulation states the following:
“Failure of the landing gear under overload should be considered, assuming the overloads to act in any reasonable combination of vertical and drag loads, in combination with side loads acting both inboard and outboard up to 20% of the vertical load or 20% of the drag load, whichever is greater. It should be shown that at the time of separation the fuel tank itself is not ruptured at or near the landing gear attachments. The assessment of secondary impacts of the airframe with the ground following landing gear separation is not required. If the subsequent trajectory of a separated landing gear would likely puncture an adjacent fuel tank, design precautions should be taken to minimize the risk of fuel leakage.”
There are a couple things that have to be noted about this regulation. First of all, neither EASA nor any other regulatory body has established an exact definition of “reasonableness” when it comes to the combination of vertical and drag loads used by the manufacturer. Furthermore, the regulation doesn’t say how big the test load should be relative to the calculated ultimate load.
When UAC tested the landing gear separation sequence, they applied a rapidly and infinitely increasing load to the gear assembly until it separated. This test confirmed that the desired separation sequence would indeed occur, with the forward attachment point fuse pins failing first, followed by rearward rotation of the gear and finally separation of the aft attachment points. No damage to the fuel tanks was noted. The results of the test were accepted by EASA and the SSJ was certified as compliant.
But when the MAK examined the impact loads sustained by flight 1492, they found a key difference from the certification scenario. During the second touchdown, the vertical rate of the main landing gear at impact was -830 feet per minute, which exceeded Safran’s calculated ultimate load. But the landing gear didn’t separate — in fact, it didn’t appear to have been damaged at all, because no parts of the aircraft were found on the runway near the point of the second touchdown. So what actually happened?
As it turns out, the second impact fell into a gray area where the load was sufficient to break the fuse pins attaching the forward end of the landing gear crossarm to the wing box rear spar, but not the fuse pins for the drag brace or crossbeam. The ultimate load of the drag brace and crossbeam attachments is slightly higher than the crossarm forward attachment because the safest separation is achieved if the crossarm detaches from the spar first. But there was no requirement to test what would happen in the event of a marginal exceedance of the ultimate load that shears the crossarm fuse pins but not the rest. In fact, neither UAC nor Safran had any idea what would happen in this scenario because the tests involved a load that increased infinitely until the gear actually separated.
In theory, if the force of the second impact had been just a little bit higher, both main landing gears would have separated as designed, the aircraft would have crashed down onto its belly instead of bouncing, and the fuel tanks might not have been breached. In that case all occupants would have survived.
Instead, what happened was something far outside of the certification assumptions. Carrying the landing gear back into the air, intact except for the broken crossarm fuse pins, the aircraft bounced, then plunged back to earth with enormous force. Although the force of the third impact was measured as “at least 5.0 G’s,” against the second impact’s 5.85, in all likelihood the third impact was the more severe of the two. It would certainly have sheared the landing gear if the landing gear was intact, but it wasn’t. And because the expected failure sequence was no longer possible, the load path through the landing gear components was different than in the certification tests. Consequently, the landing gear actuating cylinder mounting brackets pulled out of the wing box rear spars, breaching both fuel tanks simultaneously and by an identical mechanism.
Ultimately, the MAK was unable to assess the consequences of the third touchdown in terms of the certification requirements for two main reasons. The first is that the regulations explicitly do not require the manufacturer to consider the consequences of further impacts after an initial impact exceeding the ultimate load. And second, the vertical rate during the third impact was so large that the force exceeded the ultimate load of the wing structure itself. EASA certification requirements state that the airplane must not rupture in a manner catastrophic to safety during an impact without landing gear at a vertical rate up to 300 feet per minute. However, the actual vertical rate during the third touchdown was much greater than this, and extensive airframe damage was noted as a result, including the partial separation of the wing box forward spar from the fuselage. Therefore, no assurance against a catastrophic fuel tank breach existed even if the landing gear had separated normally.
But while the MAK concluded that the SSJ’s landing gear behaved in accordance with its certification basis during the crash, they reserved considerable criticism for the regulations themselves. The investigators pointed out that there was a lack of correlation between the regulations governing the maximum load the gear must withstand, and the regulations circumscribing the landing gear separation tests, which resulted in an intermediate area where the effects of a given load were not known. In this case, because the testing criteria were not required to resemble reality, the landing gear was subjected during testing to an infinitely increasing load, instead of a specific, finite load, as occurs in an actual accident. As a result, the testing criteria were insufficient to confirm that the design actually minimized the risk of catastrophic fuel spillage in a real world accident.
The MAK also argued that the lack of a requirement to examine the consequences of additional impacts should be reconsidered. The final report discusses five previous incidents in which multiple large loads in quick succession caused an unexpected landing gear failure sequence, out of which three cases resulted in fuel spillage sufficient to constitute a fire hazard, although none resulted in fatalities. These three cases included British Airways flight 38, a B777 which landed short of the runway in London in 2008, and Yakutia Airlines flight 414, another SSJ that overran a runway in 2018. In both cases, investigators recommended enhancing the certificating test requirements to include multiple touchdown scenarios, but these recommendations were rejected by the European and Russian regulators respectively.
In theory, an analysis of the landing gear behavior during a second impact exceeding the ultimate load following a first such impact could be possible. Because the landing gear is designed to separate in a controlled way with a predictable failure sequence, the condition of the gear at the time of a second impact could be calculated. And while I am not in a position to say with certainty whether such testing would result in practical design improvements that might prevent a tragedy like Aeroflot flight 1492, the MAK and I share a belief that regulators should explore the possibility.
Unfortunately, for those who found themselves aboard flight 1492, all of this discussion comes too late.
◊◊◊
Part 7: Hell
As flight 1492 crashed back to earth for the final time, the fuel tanks split open, and a torrential blast of jet fuel poured directly onto the hot engine exhaust nozzles, causing a deflagration of the entire fuel-air mixture. Bright flames billowed out of the fuel cloud, streaming behind the aircraft as it slid down the runway.
On board the aircraft, Captain Yevdokimov moved the thrust levers back to max reverse, but no reverse thrust was generated because the weight-on-wheels switches had been destroyed. First Officer Kuznetsov called out that they had no reverse thrust or spoilers. The wheel brakes were also out of commission, but the plane was still slowing down due to friction alone.
Decelerating through 100 knots, the intense smoke and fire behind the aircraft triggered a rear baggage compartment smoke alarm. From the cabin, passengers could see flames pouring from both wings, and video footage recorded from inside the plane captured the sound of panicked screaming.
At 80 knots, decreasing rudder authority began to interfere with Yevdokimov’s ability to keep the nose pointed straight ahead, and the plane started to fishtail like a car with no rear tires. Flight 1492 veered hard to the left, as though the tail was trying to overtake the nose, until the plane was sliding sideways down the runway, leaving a trail of towering flames and smoke in its fuel-soaked wake. It was only at this point that the flight crew caught sight of the flames and realized they were on fire. At almost the same time, the senior flight attendant called the cockpit via the interphone and exclaimed, “Fire on board! Fire!”
As the aircraft slid off the left side of the runway and screeched to a halt, the fire expanded rapidly, enveloping everything aft of the wings in an angry, billowing tempest of pure flame. Every surface behind the fuel tanks had been sprayed with aerosolized fuel, which was then blown directly against the right side of the fuselage as the plane slid sideways across the runway. Even worse, as the plane became stationary, all the fuel escaping from the tanks pooled underneath the fuselage, intensifying the inferno, which was then further stoked by the hot exhaust blasts shooting from the still-running engines.
By the time the plane stopped, the fire had been burning for 30 seconds. In the cabin, the passengers did not need 30 seconds to determine that they were in mortal danger, and many began to get up from their seats while the plane was still moving. Others screamed, some attempted to call loved ones, and many simply sat there in shock.
Up front, the two forward flight attendants realized during the landing roll that the plane was on fire. There had been no request from the crew to be ready for an evacuation, nor had there been a call to brace for impact, but it was immediately obvious to the cabin crew that the evacuation would need to take place without delay. Exercising her prerogative, Senior Flight Attendant Kseniya Fogel’ stood up from her seat as soon as the aircraft stopped and opened the R1 door without waiting for a command by the pilots. By 18:30:46, just eight seconds after the plane came to a stop, the door opened and the slide began deploying.
Meanwhile in the cockpit, at the moment the plane stopped, First Officer Kuznetsov called “Attention crew! On station. Attention crew! On station,” the standard call for the cabin crew to prepare for an evacuation, but he forgot to depress the interphone button and broadcast this using VHF radio 2 instead. Air traffic control did not hear the call because the VHF 2 antenna had already been destroyed by the fire. Instead, Kuznetsov turned and shouted “Evacuation,” and one of the flight attendants yelled, “We are on fire!”
As the R1 slide was deploying, one of the flight attendants attempted to make a public address system announcement, “Seat belts off, leave everything, get out!” But she forgot to press the PA button and this command was broadcast to the cockpit via the interphone instead. Only a few passengers at the front heard the command to “leave everything.” Farther back, this command would have been useful, because some passengers in the traffic jam in the aisle were opening the overhead bins to retrieve various items, making the jam even worse.
Up front, Captain Yevdokimov called for the emergency evacuation checklist, and Kuznetsov scrambled around trying to find the QRH, which had fallen under his seat during the crash. After laying his hands on it, he tried again to call for the evacuation, but his voice was not heard in the cabin for unknown reasons. Regardless, by then the evacuation had already started, as passengers began to jump down the R1 slide, about 7 or 8 seconds after the door was opened. One of the flight attendants then crossed the galley and opened the L1 door too. A split second after that, the cockpit voice recorder ceased recording as the fire destroyed the cables connecting it to the microphones.
By the time the first passengers hit the bottom of the slide at 18:30 and 54 seconds, the situation in the back of the plane was already apocalyptic. Video evidence showed that within one second of the first passenger leaving the plane, and possibly even earlier, the fire breached the fuselage and began spreading into the cabin itself — with all of the passengers still inside. The intense heat of the blaze caused the cabin windows to shrink and fall out of their frames, creating multiple entry points all along the last few rows no later than 49 seconds after the start of the fire. Before the evacuation even began, the entire back of the plane filled up with dense smoke as far forward as row 9,* which according to survivors was so toxic that two to three breaths were enough to incapacitate a person.
*With the business class configuration on flight 1492, there were no rows 4–5, so row 9 was actually the 7th row, out of 18 total (ending in row 20).
The rearmost person on flight 1492 was 21-year-old flight attendant Maksim Moiseev. None of the survivors reported seeing him, and what he did in the few seconds available to him will never be fully known. Surrounded by choking smoke and unable to see, he somehow managed to open the 2L door, but because this door was inside the seat of the fire, the resulting blast of heat most likely killed him instantly. His body was later discovered on the ground just outside the open door, the only victim found outside the plane. Although opening this door could in theory have enhanced the spread of the fire into the cabin, the windows had already failed by this point and simulations showed that opening the door made no difference.
Twenty-one passengers were seated in rows 16 to 20 at the back of the plane, of whom only the passenger in seat 18A lived to speak of what took place there. By his recollection, a serious jam formed in the aisle, akin to a crowd crush, as panicked passengers tried to push forward before the aircraft had stopped moving, and therefore before those ahead had a chance to get out of the way. Black smoke quickly enveloped the crowd and he could hear people calling out to him, but there was nothing he could do for them. Crawling on all fours to stay below the worst of the smoke, he encountered the jam in the aisle, but managed to get around it by holding his breath and climbing over the seat backs. By the time he reached the nose section it was clear of people — so what was causing the blockage?
The only survivor out of nine people seated in rows 14 and 15 was the passenger in seat 15C. She reported that after seeing fire during the landing roll, she undid her seat belt and got up while the plane was still moving, but when she tried to move forward, a traffic jam developed because people were trying to retrieve luggage from the overhead bins. Everything behind her row was consumed by thick smoke and it quickly became difficult to breathe. Struggling forward, she saw a man who had stopped to grab his luggage and was blocking people from moving, although she didn’t say whether he was ahead of or behind her, or how she got around him.
The passenger in business class seat 3A said that he stayed in his seat for 30 seconds to let people who were advancing from the back escape first, until the smoke enveloped him too. He joined the line of people moving forward and managed to escape, but before he left the aircraft he saw people getting their bags from the overhead bins, including some very large bags that in his opinion definitely impeded the evacuation.
In the cockpit, the pilots tried to complete the evacuation checklist, which included steps like setting the parking brake and shutting down the engines. Physical evidence confirms that they made it to at least step 6, and step 9 might have been accomplished as well, but the checklist was never completed. The engines weren’t shut down until 18:31 and 34 seconds, almost a minute after the plane came to a stop. Given that the pilots could have shut down the engines in mere seconds using the master switches, the MAK wrote that this was an unreasonably long time to leave them running. Furthermore, the jet blasts significantly contributed to the size and speed of the fire, reducing the amount of time for the passengers to escape. Publicly available videos of the evacuation clearly show that the fire became less energetic as soon as the engines were shut off, testifying to their influence.
At around the time the engines were shut down, flight attendants Fogel’ and Kasatkina were still standing by the exits, shoving passengers down the slides. But after evacuating a little over two dozen people, no more passengers emerged from the smoke-filled cabin. Since the fire and smoke were still getting worse with every passing second, both flight attendants elected to abandon ship.
But back in the pall of darkness, several passengers were still trying desperately to leave. A total of four passengers eventually left the aircraft after the flight attendants, escaping from the very margin of the inferno. The first of these was the passenger from seat 15C, who jumped through the door to safety after suffering burns to 15% of her body. Also still on the airplane was the passenger from seat 12A, who encountered First Officer Kuznetsov just outside the cockpit and decided to stay to help more passengers. Together, this passenger and Kuznetsov dragged a nearly unconscious woman out of the aisle and pushed her down the slide, followed by the man from seat 18A, who beat the odds by making it just far enough forward for the angels at the doorway to spot his arms sticking out of the smoke. After being flung bodily down the slide, he came to his senses, got up, and walked away.
At this point the passenger from seat 12A told Kuznetsov that they should find portable breathing equipment and try to enter the cabin to search for more people. Kuznetsov tried to shine a flashlight into the haze to get a better sense of the conditions, but the beam was unable to penetrate the dense fumes. Concluding that there was nothing more they could do, Kuznetsov declared, “It’s over, let’s go,” and passenger 12A reluctantly fled the burning plane. He was the last surviving passenger to leave, 106 seconds after the start of the evacuation. Out of all the survivors, only he and passenger 18A saw the flames inside the cabin and lived to speak of them. All others close enough to see that eerie sight did not survive.
After passenger 12A departed the plane, First Officer Kuznetsov returned to the cockpit, then exited via the window 35 seconds later. But after less than a minute on the ground, he bizarrely climbed back in through the escape slide and threw his flight bag and raincoat out of the plane, before following them down the slide. The MAK wrote that they were unable to “reliably identify the purpose” of these actions by Kuznetsov, and in fact the report contains no testimony from him at all, suggesting that Aeroflot did not make him available for an interview.
Captain Yevdokimov was the last person to leave the plane alive, at time 18:36 and 12 seconds, over five minutes after the start of the evacuation and after the fire had already been partially extinguished by responding fire crews.
By the time fire crews entered the aircraft with smoke protection equipment and hand lines, there was no chance of survival for anyone still inside. The MAK did note that prepositioning the fire trucks could have cut the first vehicle’s response time by 40 to 45 seconds, resulting in its arrival only 20 seconds after the plane stopped. However, this probably wouldn’t have saved any lives because the fire had already penetrated the cabin interior by that point. Investigators speculated that if one or more crewmembers had donned protective breathing equipment and entered the forward cabin, a couple more people might have been saved, but this would have been far outside any pilot or flight attendant’s job description.
◊◊◊
In total, 41 out of the 78 passengers and crew did not escape the burning jet. But there is more to be said about how they died, and how their deaths might or might not have been prevented.
In most aircraft accidents involving large numbers of fire deaths, the killer of most or all of the victims is smoke inhalation. Smoke generated by burning plastics and hydrocarbons contains deadly chemicals such as carbon monoxide and hydrogen cyanide that can quickly reach fatal concentrations in a smoke-filled cabin. As perhaps the most well-known example, in the 1985 Manchester runway disaster, out of 55 people who died trying to escape the burning 737, only 6 died directly due to the fire; the rest were killed by the smoke.
But in the case of Aeroflot 1492, the usual logic didn’t hold. Autopsies determined that while most passengers had breathed in at least some toxic smoke before dying, the cause of death in 40 out of 41 cases was direct thermal assault. Calculations showed that once the windows failed, the temperature at head height in the aft part of the cabin would have very quickly exceeded 600˚C, causing the passengers in this area to burn to death before they had a chance to succumb to the fumes. At least two passengers in row 17 were found still belted into their assigned seats, indicating that they were overcome almost instantly. One of these, the passenger in seat 17E, was found to have died by cardiac arrest, perhaps due to shock; he was the only victim whose cause of death was not listed as “burning.”
Most of the victims were found very close to their seats in the aft cabin, indicating that they didn’t have a chance to get very far. Out of 46 people seated in rows 11 to 20, only six survived, all whom started moving toward the exit before the plane had come to a stop; those who waited or became stuck ran out of time. That being said, if you ever find yourself in a situation requiring an emergency evacuation, you should not attempt to get up before the airplane comes to a stop, because 99 times out of 100 this will just make the evacuation more chaotic. Flight 1492 was a special case with few parallels in history.
Given the speed with which the fire overran the cabin, it was impossible to save everyone. However, an unknown number of passengers — the report simply states “several” — were found piled up between rows 6 and 10. At the same time, all but one of the passengers originally seated in this area survived, indicating that these victims had made their way from further back. A pile in this location is consistent with witness reports of a traffic jam behind one or more passengers who were retrieving baggage from the overhead bins. The passenger in seat 15C confirmed seeing a man grabbing baggage shortly before she left, as well as several people attempting to move forward behind her, of whom only two escaped. Furthermore, these victims had already left the fire zone by the time they collapsed; in fact, the autopsies showed that they were incapacitated by toxic fumes while trying to leave, and were killed by the fire while unconscious on the floor. Given this information, it’s entirely possible that some of these passengers, likely a number in the low single digits, may have survived if other passengers had not tried to retrieve their luggage from the overhead bins. In the end the MAK determined that this behavior by passengers did contribute to the high death toll.
In the aftermath of the accident, many people were quick to blame these passengers. In one sense, this blame is constructive insofar as shame is an effective motivator for people who might otherwise try to get their luggage during a future evacuation. However, research has shown that when untrained civilians are unexpectedly placed into an emergency aboard an aircraft, many people’s brains revert to what they already know, which is to stand up, grab their bags, and walk to the exit, as though nothing is wrong. This behavioral tendency can be short-circuited if the flight attendants loudly and assertively order passengers to leave their bags behind and exit immediately. But on flight 1492, the order to leave bags behind was not heard by the majority of the passengers because the senior flight attendant forgot to press the PA button before making the announcement.
In the MAK’s opinion, this omission could have occurred because the cabin crew were type rated on multiple aircraft at once, but each recurrent performance check took place on one aircraft type only. As a result, two out of the three flight attendants on flight 1492 hadn’t been checked out on an SSJ in over a year, which can result in a degradation of emergency skills.
If, god forbid, you ever find yourself in a similar situation, my hope is that this story will come to mind. There is nothing in your carry-on bag that’s worth more than human lives. If you have important items with you, like ID or medications, keep them in a small bag or personal item that can stay with you at your seat; this will reduce the temptation to retrieve your carry-on. Backing up the contents of electronic devices like laptops before flying can also help ease the decision to leave them behind. But most of all, my advice is to remember the victims of flight 1492, and learn from their fate.
◊◊◊
In the end, the MAK concluded that the primary causes of the fire’s severity were the large amount of fuel involved and the blowtorching effect of the engines, which created a fire scenario that would have quickly overwhelmed even the most robust protections. Contributing to the number of deaths were the lack of usable exits at the rear; a crowd crush caused by panic in the tail section; and passengers stopping in the aisle to retrieve baggage.
The MAK report does not trade in matters of blame or praise, but I do want to independently praise the actions of the flight attendants, First Officer Kuznetsov, and passenger 12A (identified as Sergei Kuznetsov, no relation to the first officer), who helped save lives by pushing people out the exits and then dragging additional people to safety. But out of all the crewmembers, my sympathy is extended most of all to Maksim Moiseev, who had no time to act and no chance of survival. If he had been given just one minute more to live, he no doubt would have done all he could to save his passengers, but the universe does not always grant us that privilege.
◊◊◊
Part 8: The Truth Is Always More Complicated
Almost every fatal air disaster begets a blame game — a circle of pointing fingers, a flurry of lawsuits, an interpretation and reinterpretation of investigative findings. But few accidents have devolved so deeply into this cycle of mutual accusation as has Aeroflot flight 1492. From the very first days, speculation abounded. Some suggested that the crash was caused by a flaw with the much-maligned SSJ-100; others pointed out what they felt were obvious flight crew errors; many brought up Aeroflot’s sordid safety record and reputation for negligent behavior; and quite a few focused their ire on the passengers who stopped to grab their carry-on bags.
The MAK’s job was to find the factors that caused or contributed to the accident, while staying above the mudslinging — not an easy task, as it turns out. Their job was complicated at every step by various actors. Less than 24 hours after the crash, Captain Yevdokimov was giving public interviews to the media, even though proper protocol is to isolate crewmembers until investigators have had a chance to speak to them. In the end, the MAK was not able to interview Yevdokimov until after he had been briefed on the contents of the black boxes, which contaminated his account of events and made it difficult to tell what was his actual impression at the time, and what was an invention to explain the data.
It certainly didn’t help that under Russian law, a parallel criminal inquiry is automatically opened into any air accident even if no firm evidence of a crime has been uncovered. The fact that he could be charged by this inquiry almost certainly colored Yevdokimov’s statements to the MAK and impeded the investigators’ ability to determine what he was actually thinking during the flight. Unfortunately, Yevdokimov’s fears proved well-founded, and the Investigative Committee of Russia charged him with “violating flight safety rules” on October 2nd, 2019. Although the Investigative Committee possessed wide latitude to charge anyone found to have acted inappropriately, Yevdokimov was the only person accused.
The practice of criminally prosecuting pilots who make mistakes that contribute to fatal accidents has been widely criticized by both legal and aviation experts around the world, because it complicates the work of safety investigators — as seen in this case — and because it often results in scapegoating of an individual who may have been failed by an airline’s training program. The practice also raises ethical concerns when the threat of prison becomes involved, given that the accused individual almost never presents a danger to others. Unfortunately, Russia has a long history of ignoring these concerns and prosecuting the people who were directly involved in an accident while ignoring the people and institutions who systemically degraded the safety environment.
In 2023, the court found Yevdokimov guilty on all charges. In addition to suspension of his license, he was fined 2.5 million rubles (about US$30,000) and sentenced to 6 years in a prison colony. It is unclear to me who was supposed to be satisfied by this ruling. With his license suspended, there was no way for him to cause additional accidents, and none of the survivors or next of kin publicly lodged any accusations against him.
Forced to defend himself in court, Yevdokimov argued that the aircraft did not respond normally to his inputs and was almost impossible to control, suggesting that the manufacturer had designed the fly-by-wire system improperly and without adequate protection against lightning. His lawyers also argued that the landing gear was not adequately designed to prevent fuel spillage in a crash landing, and — quite distastefully — blamed the large number of victims on the late flight attendant Maksim Moiseev for opening the rear door, despite the MAK’s finding that this had little effect on the spread of the fire.
On the other hand, when the MAK published its final report on March 28, 2025, Russian media mostly wrote that the report blamed the pilot, without much discussion of the contents. Over the course of this article, I’ve already explained most of what the MAK found, but I now want to go over the actual takeaways that should be gleaned from those findings, as well as the areas where safety improvements are needed. This following section will be broken into three subParts: (1) The Aircraft, (2) The Pilot, and (3) The Airline.
Part 8.1: The Aircraft
During its investigation, the MAK did not find evidence that the SSJ-100 fell short of its own certification basis. The forces imparted to the landing gear were outside those envisioned by regulatory requirements, and testing showed that the aircraft’s reactions to the pilot’s control inputs corresponded very closely to the manufacturer’s model. Furthermore, flight testing by EASA and MAK experts in Italy allowed investigators and safety officials to determine through first-hand experience that the aircraft’s behavior in Direct Mode is controllable using conventional piloting skills and does not necessarily constitute a danger in and of itself. As for the failure of both EIUs during the lightning strike, the MAK was not able to establish a cause.
However, the narrow conclusion that the SSJ met certification requirements does not exonerate the design. As I discussed in Part 6, the MAK criticized the regulations themselves for providing inadequate assurance against a catastrophic rupture of the fuel tanks during a real-world crash landing. But in addition to that, the MAK pointed out a few areas where the design of the aircraft could have been better, despite technically meeting requirements, and I want to add a few points of my own to that list as well. In fact, after all my research into flight 1492, I came to believe that design decisions by UAC significantly contributed to the accident.
Although the MAK didn’t discuss it at all, in my opinion one of the most significant issues with the SSJ’s fly-by-wire philosophy was its lack of an equivalent to Alternate Law, as I discussed in Part 3. According to official SSJ training documents, a reversion to Direct Mode can occur “if parameters from ADS [the air data system] or IRS [the inertial reference system] are not available,” a condition that would cause an Airbus to enter Alternate Law. To reiterate, this makes a Direct Mode reversion much more likely on the SSJ than on any other fly-by-wire aircraft. Now, to be clear, my research suggests that if the flight control computers temporarily stopped receiving any data from the entire air data and inertial reference system, as happened in this case, even an Airbus would have entered Direct Law. However, this comparison is misleading because the Airbus doesn’t appear to have a 1:1 equivalent of the Electronic Interface Units.
In order to better understand what the EIUs do and why they exist, I dived into hundreds of pages of SSJ-100 documentation, and in the process I got more than I bargained for. As I stated earlier in this article, the purpose of the EIUs is to reformat data into the configuration demanded by the recipient computers. What actually happens is something called protocol adaptation, which is pretty far outside my wheelhouse, but you can think of it as a translation between two ways of organizing information, which could be feet vs. meters or morse code vs. signal flags or apples vs. oranges, it doesn’t matter. In any case, according to the SSJ documentation, the EIUs “perform a similar function to the data concentration system,” and one of the functions of the data concentration system is to “perform protocol adaptation to enable off the shelf equipment to communicate together.” Further, the documentation shows that the EIUs provide protocol adaptation of analog, discrete, and digital inputs for practically every aircraft system, from the primary flight control computers to the full-authority digital engine control to the brakes to the auxiliary power unit to the air conditioning to the cockpit window heaters. In the case of the flight controls, the documentation shows that the EIUs translate data from an unspecified original digital protocol(s) to another digital protocol called ARINC-429, which I don’t understand and you don’t need to either.
As far as I have been able to tell, on Airbus aircraft this function of the flight control system, when or if it’s even necessary, is performed at each individual connection between a data source and the data recipient (such as an air data computer and a flight control computer). There certainly isn’t a centralized unit that does protocol adaptation for every single aircraft system. So why does the SSJ have one?
The most likely answer, as the above quotations imply, is that sensors, computers, flight controls, instruments, and so on come from a variety of suppliers, and most of these components are off the shelf, rather than being custom-made for the SSJ. In the case of the fly-by-wire system, the air data and inertial reference computers appear to have been designed by Thales in France, while the PFCUs were designed by Liebherr in Germany. Now, this isn’t always a problem, but for UAC it was, because the company was unlikely to sell enough SSJs to make it economical for suppliers to customize their components for the SSJ. And without that customization, off the shelf avionics aren’t necessarily capable of talking to one another. For instance, on the Airbus (and correct me if I’m wrong), the air data computers are made by Thales but the flight control computers are made by Safran, so when a new Airbus is being designed those two companies sit down and work out how they’re going to make their devices talk to each other. At the same time, Liebherr produces flight control systems for the Embraer E-series, which are designed to connect to computers made for the E-series by BAE Systems. So my guess is that when UAC ordered Thales air data computers but Liebherr flight control computers, they didn’t have a common digital protocol, and something was needed to translate between them. And in fact, this was probably the case for a wide variety of systems that had mix-matched components. Therefore, UAC resolved the resulting tangle of different protocols by routing everything through the EIUs, because they couldn’t get the individual suppliers to customize their products for the SSJ. The only things that were custom made were the EIUs themselves, which explains why they were among the only avionics on the entire aircraft to be designed and built in Russia.
However, the decision to route everything through the EIUs de-compartmentalized a large number of aircraft systems by shoving everything through this one pair of computers. Furthermore, it negated the redundancy provided by having three ADCs (air data computers), three IRSes, and three PFCUs (primary flight control units) by processing the ADC and IRS signals through only two EIUs. Unlike the Airbus, alternate routes for certain parameters were not available.
Wrapping back around to where I started this argument, a failure of all protocol adaptation for the flight control system isn’t something that’s realistic on the Airbus but could happen on the SSJ. The two EIUs, being identical, were equally vulnerable to environmental effects such as lightning. This goes for any group of redundant computers that are structurally identical, but in this case there was some common flaw that allowed lightning to affect the power supply to both units by the same mechanism, which was not anticipated by the manufacturer. What’s significant is that this flaw, whatever it was, involved the one computer that was tied to almost everything, the lynchpin of the SSJ’s network of automated functions. It’s worth pointing out here that this type of event is avoidable, as evidenced by my failure to find any record of an Airbus suffering a flight control law reversion due to a lightning strike, despite the Airbus fleet having accrued several orders of magnitude more flight time. This fact certainly raises questions about whether the EIU manufacturer, Ulyanovsk Instrument Bureau, is capable of designing avionics that meet modern expectations of reliability. Remember what I said about Russia’s high-tech aerospace industry being 20 years behind?
This particular issue is likely just one of many that are collectively responsible for the SSJ’s high rate of flight control law reversions. Some of those reversions may have been less severe if the SSJ had an Alternate Law, but at first glance it seems that flight 1492 still would have entered Direct Mode even if Alternate Law had existed, because all air data was interrupted when the EIUs rebooted. But on the Airbus, it’s sometimes possible to upgrade from Direct Law to Alternate Law if the original failure goes away, depending on the nature of the failure. That’s because there are many fly-by-wire functions that can be restored in flight without pilot action, and Alternate Law’s several sub-states allow for selective loss or restoration of functions. Because the original failure on flight 1492 entirely went away after less than 18 seconds, a hypothetical SSJ with Airbus flight control laws could have jumped from Direct Law back to Alternate Law as soon as the PFCUs started receiving valid data from the ADCs again, which would have restored normal sidestick operation and autotrim. Any systems requiring complex pilot action to restore could have remained off with their associated functions inoperative. But without these capabilities, flight 1492 became stuck in Direct Mode even though all aircraft systems except VHF radio 1 were completely serviceable.
Because of this problem, the MAK recommended that UAC explore the feasibility of enabling a return from Direct Mode to Normal Mode in flight.
◊◊◊
Another issue I want to highlight is that pilots have to keep their conventional flying skills sharp in order to handle Direct Mode/Law reversions, no matter whether they’re flying an SSJ or an Airbus. But because the SSJ is so much more likely to enter Direct Mode than an Airbus is by design, even before accounting for the unexpectedly high failure rate, the relative importance of this issue is much higher on the SSJ. Even with consistent training, a pilot’s instinctive use of the trim atrophies when flying a fly-by-wire aircraft, not to mention that flying with no control modulation for airspeed and no force feedback is just plain hard.
Here I want to highlight a different type of fly-by-wire philosophy that is used on the Boeing 777 and the Airbus A220 (which began life as a Bombardier product). On those aircraft, the autotrim adjusts the stabilizer to maintain an invisible “trim reference speed.” The trim reference speed is set by the pilot using trim switches on the yoke, which in a conventional aircraft would move the trim itself. Using the flight controls to deviate from the trim reference speed generates artificial force feedback on the yoke. So if the trim reference speed is set to 200 knots, and the pilot wants to slow to 180 knots, the pilot can pull back to raise the nose, which will cause the speed to drop, but the pilot will feel resistance. This resistance is removed by adjusting the trim reference speed using the trim switches until the reference speed matches the desired speed. The autotrim will then maintain the new reference speed until the pilot changes it — nose up to slow down, nose down to speed up. For the pilot, this entire sequence feels very similar to trimming a conventional aircraft where the trim switches directly move the stabilizer, but instead of reacting to speed changes by trimming, the pilot proactively trims in order to initiate speed changes, while the autotrim keeps the speed stable when the pilot isn’t making inputs.
One of the advantages of this design is that if the system reverts to Direct Mode, the trim switches on the yoke (or on the A220, the sidestick) become directly connected to the trim. Then, if the pilot encounters resistance when maintaining the desired speed or flight path, they can simply use the same trim switches in exactly the same way as they would in Normal Mode to re-trim the aircraft. This makes flight in Direct Mode on the 777 and A220 much easier than in the A320 or the SSJ. The downside of this design relative to the A320/SSJ system is that it’s possible to be out of trim in Normal Mode, which can significantly increase pilot confusion during an in-flight upset, as well as increasing the standard workload.
On the SSJ, with no Alternate Law and a comparatively high likelihood of reverting to Direct Mode, a Boeing-style trim system would have significantly reduced the inherent risk associated with a reversion. Airbus aircraft (excluding the A220) can get away with a control law philosophy that requires very different flying techniques in Direct Law because these aircraft almost never enter Direct Law to begin with,* thanks to the existence of Alternate Law. The SSJ doesn’t have that luxury. As a result, it’s safe to say that the SSJ’s fly-by-wire philosophy is inferior to both the Airbus and Boeing variants from a safety standpoint.
*Except during Alternate Law reversions after extending the landing gear on the A320. However, this should take place after all major maneuvers are complete.
◊◊◊
Part 8.2: The Pilot
The data from Denis Yevdokimov’s last 37 flights before the accident demonstrate that he never developed a correct flare and landing technique. He had a dangerous tendency to pitch up too far during the flare then correct by pitching down, which may have been exacerbated by the SSJ’s lack of a Flare Law, but ultimately comes down to individual technique. But proper technique is something that should be drilled into a pilot by the training program, so I’m going to discuss that aspect in Part 8.3. What I want to highlight here instead is the issue of judgment.
Although there were a few points during the flight where Captain Yevdokimov displayed good judgment, such as following the SID when he lost radio contact, most of the flight was marked by a series of poor judgment calls.
Before the flight, he demonstrated a cavalier attitude toward thunderstorms in the area, even though every pilot knows these storms can contain severe or even catastrophic hazards. Most other pilots departing Sheremetyevo that day requested a deviation from the SID to avoid the storms, but Yevdokimov didn’t even try, and that bothers me. Pilots need to actively estimate the threat posed by factors outside their control, such as weather, and they need to modify their plans to account for them. Flying into the thunderstorm without even trying to steer clear was simply careless.
After the lightning strike, Yevdokimov did not attempt to systematically diagnose the cause of the problems with the plane or establish what actions were required to return safely to the airport. Much as he did when confronted with bad weather, he displayed a general incuriosity toward flight safety hazards. That’s not to say he was unaware that his difficulty controlling the plane represented a hazard, but rather that he reacted by attempting to exit the situation as quickly as possible without attempting to understand it. This occurred despite the fact that the consequences of a Direct Mode reversion were clearly spelled out in the QRH. But First Officer Kuznetsov displayed similar incuriosity when he sped through the QRH section on Direct Mode in a robotic and disinterested manner, as though he was just going through the motions of reading. It’s disturbing that the pilots engaged in no discussion of the contents of this section despite having unanswered questions about what the plane was doing.
This lack of understanding caused Yevdokimov to believe that the situation was more serious than it actually was, which in turn caused him to start rushing without sufficient forethought. He initiated the approach without checking with Kuznetsov and without circling to assess the condition of the airplane, even though he wanted to do so, as evidenced by his abortive request for a holding pattern. Then once the approach began, he again displayed poor judgment when he decided to continue to touchdown despite windshear and glideslope warnings.
All of the above decisions reflect poorly on Yevdokimov’s attitude. To explain these personal deficiencies, the MAK report cites certain psychological factors identified in his psychological exam, but this section was redacted from the report due to Russian privacy laws.
The series of hard landings were primarily caused by poor piloting skill, with the captain’s poor understanding of Direct Mode as a contributing factor. However, I view these issues as primarily training-related and will discuss them in part 8.3. Before concluding this section, I want to mention that Yevdokimov correctly decided to go around after the second bounce, but was thwarted because he had already deployed the thrust reversers. Going around after deploying the reversers is a violation of standard operating procedures for precisely this reason. Considering the above, Yevdokimov was in a situation where the bounced landing procedures required him to go around, but the reverser deployment rule required the opposite. The answer to this contradiction is to avoid selecting reverse thrust until after the spoilers have deployed, which should prevent the plane from bouncing. In Normal Mode, this happens automatically, but in Direct Mode the pilot has to remember to deploy the spoilers, which Yevdokimov didn’t. As a result, the MAK recommended that UAC enable automatic spoiler deployment in Direct Mode.
◊◊◊
Part 8.3: The Airline
In its final report, the MAK reserved its harshest words for Aeroflot. The investigation identified major issues with Aeroflot’s training program, many of which stemmed from what the MAK considered to be a “bare minimum” attitude among Aeroflot’s training and management staff. In their view, following the letter of the regulations is not that helpful unless the airline also follows the spirit — specifically, by evaluating where the training program could better prepare pilots for actual operations, even if all the required elements are already present. Further, the MAK wrote, “The flight crew training programs contained a number of provisions that allowed for ambiguous interpretations. Under such conditions, the airline’s management flight personnel, who were responsible for organizing initial and recurrent pilot training, ‘interpreted’ all ambiguities in the direction requiring less training.”
In the MAK’s opinion, Aeroflot’s training program should have identified and corrected Captain Yevdokimov’s flawed flare and landing techniques as a matter of course. It did not do so because of multiple serious problems, including high instructor turnover, which the MAK felt was the result of Aeroflot’s excessively rapid expansion of its SSJ-100 fleet. A poorly functioning safety management system also contributed.
Pitch down inputs during the flare can be a sign that the pilot lacks theoretical knowledge of the aircraft-sidestick control loop. With such understanding, a pilot can predict that a nose down pitch input at such a low altitude will cause an increase in descent rate that they will not have time to arrest before the plane hits the ground. An airline’s training program should not produce pilots who regularly and predictably make this kind of basic skill error.
In addition to issues of general piloting skill, the MAK strongly criticized Aeroflot’s training on flight in Direct Mode. I discussed many of the issues with this training back in Part 3, but the problems boiled down to the following:
- Despite frequent Direct Mode reversion incidents, Direct Mode was not taught as a standalone emergency during recurrent training, but rather as a secondary part of an unreliable airspeed emergency.
- During the accident flight, Captain Yevdokimov persistently left the aircraft out of trim, made dynamic/oscillatory sidestick inputs, and failed to manually deploy the spoilers, all of which are signs of poor theoretical and practical knowledge of flight in Direct Mode. And yet there were no comments on his training record from instructors regarding similar behavior during simulator sessions, indicating insufficient monitoring of his performance.
- In six other Direct Mode reversion incidents involving Aeroflot SSJ-100s, the pilots made similar basic handling mistakes, clearly indicating a systemic lack of preparation.
- Yevdokimov only reset the trim when he made a configuration change, suggesting that this was the only time he had been taught to trim, when in fact he needed to re-trim every time there was a significant change in airspeed or flight path angle.
In a dissenting opinion appended to the final report, Aeroflot hit back at many of these accusations. The airline argued that it was unfair to criticize the scope of its training program because it contained all the required items, which is horribly shortsighted and demonstrates exactly the type of problematic attitude described by the MAK. Aeroflot also stated that there was no evidence that there were any problems with Yevdokimov’s landing technique on previous flights, despite data demonstrating otherwise, and further argued that a pilot’s technique should be judged by the outcome, and because there were no exceedances of key parameters during his previous landings, clearly nothing was wrong. Once again, this is a shortsighted and naïve position.
In addition to their incomprehensible statements about predictive windshear warnings, mentioned in Part 4, Aeroflot also defended its lax stabilized approach criteria and the policy of allowing pilots to ignore glideslope warnings after decision height, both of which the MAK considered unsafe. And regarding the spoilers, Aeroflot argued that the spoilers shouldn’t be deployed at first touchdown in Direct Mode because they impart a nose up moment that makes it hard to bring the nose gear down — despite the fact that the spoilers simultaneously help avert the much more serious risk of a bounce.
On the matter of weather, Aeroflot dismissed the notion that the pilots knowingly flew too close to a thunderstorm because the Vnukovo TDWR and the on-board weather radar weren’t calibrated to a common standard, and thus the MAK could not prove that the pilots saw red cells on their radar — even though the MAK tested this and found that the on-board weather radar display was more conservative than the TDWR and tended to show more red, not less.
After deflecting all blame from itself, Aeroflot decided to throw its fellow state-owned corporation UAC under the bus instead. Echoing Yevdokimov’s own statements, Aeroflot wrote that a reversion to Direct Mode should have been considered a “hazardous” rather than “major” failure because the degradation of performance is “significant” rather than “noticeable.” The airline argued that flying in Direct Mode is much harder for regular pilots than the MAK and the EASA test pilots believed, which is not a bad point, because as I stated in part 8.1, it’s relatively difficult to train a fly-by-wire pilot to transition flawlessly into Direct Mode. A “hazardous” designation would have required more redundancy to prevent an occurrence.
One other point made by Aeroflot that I do agree with is that the location of the trim switches is unergonomic, which ties into my argument about how the SSJ might have been better off with a Boeing-style trim system.
Lastly, Aeroflot blamed “the aircraft type design” for the collapse of the landing gear and ignition of the fire. In their view, the requirement to avoid “fuel spillage sufficient to constitute a fire hazard” could not be met using the testing criteria selected by UAC, even though those testing criteria met their own, separate set of requirements. Although I’m inclined to take the MAK’s position that this is more so a problem with the regulations themselves, it’s an argument that merits some consideration.
Overall, though, Aeroflot did itself a disservice with its dissenting opinion. The airline staked out several positions that are contrary to well-established best practices and failed to defend its flawed training process.
In its response to the dissenting opinion, the MAK revealed that it had spent a large portion of 2023 and 2024 carrying out additional tests at Aeroflot’s insistence, extending the investigation significantly, only for Aeroflot to reiterate the same tired concerns in its dissent. The MAK’s one page response went on to excoriate Aeroflot’s position on the causes of the accident, using the type of bureaucratic sarcasm that has always made the MAK stand out from the crowd. I’ll let the following quotation stand for itself.
“The author of the Dissenting Opinion proposes to exclude from the Conclusion section virtually all contributing factors associated with the organization of the flight operations and the establishment of the SMS at the airline, as well as with the crew’s adherence to standard operating procedures during the accident flight.
“Essentially, if one takes the Dissenting Opinion author’s point of view, it turns out that a crew trained in accordance with all applicable documents and standards, who had been debriefed in a proactive manner on all previous occurrences of Direct Mode reversion at the airline and trained in a simulator on these specific in-flight emergencies, pursuant to all effective FAR, OM, and SOP provisions, accidentally entered an area of thunderstorm activity, which resulted in the aircraft’s exposure to lightning and the reversion of the FBWCS to Direct Mode, and performed an approach without experiencing any issues with piloting or trim operation, during which they reasonably disregarded windshear and glideslope warnings, only to fail, at the moment of flare and landing, to control the aircraft and correct the deviations at touchdown, solely as the result of deficient aircraft stability and controllability properties in DIRECT MODE that were not identified in a timely manner during testing, as well as deficiencies in the manufacturer’s documentation.
“In fact, the author of the Dissenting Opinion suggests that the Commission should conclude that it identified no deficiencies causal to the accident in the organization of flight operations or the functioning of the SMS at the airline, nor in the flight crew actions. The Commission observes that the aforementioned stand by the author of the Dissenting Opinion is totally contrary to the established hard evidence presented in various sections of the Final Report, as well as to the results of the analysis conducted by the Commission, and is an overt defense of the esprit de corps of the interested party, represented by the author of the Dissenting Opinion.”
◊◊◊
Although MAK reports are notorious for including lengthy dissenting opinions from Rosaviatsiya and equally lengthy counter-opinions from the investigation commission, this accident was largely an exception. Rosaviatsiya did submit a dissenting opinion, as always, but it was only one page long and surprisingly bland compared to its past submissions. Despite the MAK’s heavy criticism of Rosaviatsiya’s failure to investigate several previous Direct Mode reversion incidents, the Rosaviatsiya representative didn’t attempt to defend against these accusations in their dissent. Instead, they only argued that the MAK should not conclude that the training program was inadequate to prepare the crew if it met the minimum regulatory requirements; and that the contents of the Rosaviatsiya-approved training program were not the cause of the pilots’ handling difficulties, for which they blamed Aeroflot’s failure to instill basic pilot competencies. In its response, the MAK dismissed these arguments but accepted Rosaviatsiya’s proposed recommendation that aircraft manufacturers clearly establish which types of emergencies must be practiced individually instead of in concert with another emergency.
◊◊◊
What I wanted to convey in this final chapter is that despite widespread reductive speculation, the accident was not solely caused by the pilot, the airline, or the airplane. Instead, the accident was the result of a convergence of numerous deficiencies associated with all three, none of which were causal by themselves, but were causal in concert. Furthermore, the breadth and depth of the deficiencies identified in this investigation was such that it calls into question the safety of Russia’s entire aviation sector. The issue isn’t really that rules were being violated; in fact, relatively few causal or contributory factors were the result of overt regulatory violations. Instead, the issue is that Russian civil aviation is afflicted by an attitude problem — a lack of curiosity, a lack of willpower, and a lack of interest in the goal of safety itself. Every involved party, from the pilots to Aeroflot to UAC to Rosaviatsiya, at least vaguely tried to follow some of the rules, but no one expressed any ambition. Most people were just going through the motions.
I know as a matter of personal experience that there are many people in Russia who are genuinely dedicated to doing things right, and I have no doubt that many of them work in the aviation industry. Granted, many of the best have left since 2022, but plenty remain. The problem is that apathy has been enshrined on an institutional level, trapping the people who care under the weight of those who do not, or who choose not to for purposes of survival. Such a culture is not easily rooted out.
The MAK’s final report contains 49 recommendations to improve everything from simulator record-keeping to the location of the SSJ’s on-board megaphones. Many of these recommendations directly address the deficiencies described throughout this article. But despite the passage of more than 6 years since the crash, the section of the report listing safety actions taken to date contains only one entry, concerning an update to Russia’s USSR-era airport fire rescue standards. This is an abysmally inadequate response. Where is the outrage? Where is the commitment to “never again”? How many times will I have to write about people perishing in a Russian aircraft because nobody cared about doing it right? How long will airlines and manufacturers and Rosaviatsiya keep up their circular finger-pointing exercise, just to maintain the illusion that it’s the other guy who needs to change? Until the next accident I suppose — and what then?
In an increasingly isolated Russia, my words as a foreigner mean less than nothing. And from the other side, a few might criticize me for caring about Russian airline safety at all. But I still think this is a story that should be told, because it was a real thing that happened to real people in a real place, and even if that story disappears into Russia’s apathetic churn, perhaps we can make something of it here.
_______________________________________________________________
Dear readers — I couldn’t have conducted this far-reaching, at times exhausting research and writing project without your support on Patreon. This article took countless hours of work, a lot of late nights, and an unhealthy amount of sour gummy candies to finish. I probably cried at least a couple times; I’ve lost track. My gratitude to all of you is endless. — Kyra
_______________________________________________________________
Don’t forget to listen to Controlled Pod Into Terrain, my podcast (with slides!), where I discuss aerospace disasters with my cohosts Ariadne and J! Check out our channel here, and listen to our latest episode about a titanic battle between a BAC 1–11 and some wind. Alternatively, download audio-only versions via RSS.com, or look us up on Spotify!
_______________________________________________________________
Join the discussion of this article on Reddit
Support me on Patreon (Note: I do not earn money from views on Medium!)
Visit r/admiralcloudberg to read and discuss over 260 similar articles
