Yevdokimov was now in the grip of a divergent PIO event. However, because the sidestick has a nearly direct relationship with elevator position in Normal Mode below 50 feet anyway, the fact that the controls were in Direct Mode played almost no direct role in the events described in the above paragraph. Rather, if Direct Mode had any influence on these events at all, it was to accustom Yevdokimov to making excessive control inputs, as I discussed earlier. This explains why the magnitude of his inputs was so much larger on flight 1492 than on previous flights, even though the active pitch philosophy below 50 feet was essentially the same.
In any case, the pitch angle had only just begun to rise above its nadir of -1.7˚ when the plane touched down on the runway with all three landing gears almost simultaneously. The descent rate at touchdown was around 630 feet per minute (3.2 m/s), well above the desired value, due to the windshear and the low pitch attitude. Instead of easing onto the runway in a nice, almost asymptotic curve, the plane simply bounced off like a hurled stone, pulling 2.55 G’s in the process.
◊◊◊
All airline pilots are taught strategies for avoiding, and recovering from, a bounced landing; in fact, such training is mandatory in Russia. That’s because bounced landings draw pilots into a psychological trap that worsens their consequences. After a plane bounces back into the air, the pilot’s instinct is to plant it back on the runway, which often results in nose-down inputs in very close proximity to the ground. These in turn cause the plane to impact a second time nose-gear-first and with a significant descent rate. The nose gear then bounces off again, pivoting the nose up and the tail down, at which point the main landing gear impacts the ground again, harder and faster this time, which in turn causes the plane to bounce even higher. In some cases, this cycle repeats until the landing gear breaks and the plane crashes. I previously wrote about a series of such accidents involving the McDonnell Douglas MD-11, which you can read about here.
According to the SSJ FCOM, the appropriate reaction to a small bounce of less than 5 feet is to reduce thrust to idle and retain the sidestick in the position it was in at first touchdown as a strategy to counteract the desire to push forward. This should cause the plane to touch down more gently the second time. Alternatively, if the bounce is higher than five feet, the correct response is to increase power and go around. But while these procedures are alright in theory, the MAK points out that it’s not always clear to the pilot whether a bounce is higher or lower than 5 feet, or whether the situation is recoverable, and in fact no airplane has procedures that clearly address this problem.
An added complication is the role of the spoilers. In Normal Mode, the spoilers will automatically extend at first ground contact, which tends to dampen the plane’s desire to bounce. But in Direct Mode, the pilot must remember to deploy the spoilers manually as soon as the gear first touches down. In previous Direct Mode reversion events involving the SSJ, the pilots did not immediately do so, and some of these flights continued to bounce off the runway repeatedly until the pilots finally deployed the spoilers.
Unfortunately, the crew of flight 1492 did not remember to manually deploy the spoilers during the first touchdown, missing an opportunity to dampen the bounce. Yevdokimov did attempt to deploy the thrust reversers, but the reverser doors did not open because a positive weight-on-wheels signal is required to move them, and the plane was already airborne again. This first bounce was nevertheless recoverable, because the plane did not reach a height of five feet. But instead of applying the recovery maneuver described in the FCOM, Yevdokimov suddenly reversed his input from full nose up to full nose down in reaction to the large nose up moment generated by his previous input and the effect of the bounce. His new full nose down input then caused the pitch angle to peak at 4˚ before falling rapidly through neutral and into a nose down position. This prompting him to reverse his input to full nose up yet again, but it was too late. Flight 1492 now impacted the runway a second time, pitched 4.2 degrees nose down, with a vertical speed of -830 feet per minute (4.2 m/s). On impact the nose gear bounced up off the runway, the airplane pivoted about its center of mass, and the main landing gear slammed into the ground with a bone-shattering force of 5.85 G’s.
During the investigation, simulations were undertaken to determine what factors contributed to this devastating second bounce and how it might have been avoided. The findings included the following:
1. If, at the moment of touchdown, Yevdokimov had deployed the spoilers, relaxed the sidestick to neutral, and reduced thrust to idle, they would have bounced then landed hard again, pulling 3.8 G’s, but there would have been no second bounce and the plane would not have been damaged.
2. If Yevdokimov had kept the sidestick in neutral instead of pulling back sharply at 17 feet, the plane would not have bounced off the runway at all.
3. Without the effects of the windshear, the aircraft would have touched down farther along the runway, but three seconds sooner, with a slightly positive pitch angle, and a bounce still would have occurred. But because the pilot’s actions were largely reactive to the perceived aircraft state, it was impossible to say whether this would have prompted him to make inputs that might avoid further bounces.
4. If the windshear was present, the spoilers still did not deploy, and Yevdokimov made all the same inputs, but the control law was in Normal Mode, the plane would have touched down hard a second time, pulling 3.6 G’s, but would not have bounced again. This was because of the slightly slower control response and increased damping in Normal Mode, which would have coincidentally resulted in a less extreme nose down attitude during the second touchdown.
Sadly, while the simulations showed it was possible to avert the tragedy during the first bounce, it would have been very difficult for Yevdokimov to escape from the pilot-induced oscillation he was now experiencing. To quickly escape from such an event requires the mental clarity to understand the relationship between one’s own inputs and the response of the airplane, but someone who has that mental clarity is unlikely to get into a PIO in the first place. Most such events end only when the pilot gives up fighting, or in some rare and unfortunate cases, when the airplane breaks in some way. In this case, because the PIO took place so close to the ground, serious damage to the aircraft was almost inevitable.
As flight 1492 careened off the runway a second time, the combination of Yevdokimov’s ongoing full nose up input and the huge force of the bounce sent the pitch angle skyrocketing to 10 degrees nose up in the space of one second. The rate of upward pitch angle change was almost off the charts when Yevdokimov slammed his sidestick fully forward yet again. By then, the airplane was 15 feet in the air, almost back to the height where Yevdokimov initiated the flare in the first place. But almost immediately after pushing down, he felt the nose start to drop out from under him, so he pulled the sidestick back once again to full nose up. However, at that moment he must have realized that the bounce was too high to recover safely. In a spur-of-the-moment attempt to go around, he kept the stick fully aft and slammed the thrust levers as far forward as they would go, past the takeoff/go-around setting and into the MAX thrust position, a feature unique to the SSJ that provides 10% more thrust than TO/GA power in an emergency. Finally, it seemed he had broken out of the PIO, and if things had gone slightly differently, he might have saved the plane — but alas, it was not to be.
In one last tragic twist, because the reverser levers were already set to the reverse thrust position during the first bounce, the reverser doors automatically deployed during the second touchdown when the weight-on-wheels sensors detected that the plane was on the ground. The system is designed not to open the doors or produce reverse thrust if the plane is airborne, as a safety feature. Although the plane became airborne again before reverse thrust could actually be generated, the reverser doors were still open when Yevdokimov commanded max forward thrust. The safety system then prevented thrust from actually increasing before the reverser doors had closed, in order to prevent reverse thrust from being generated in the air. As a result, Yevdokimov’s last, desperate attempt to apply power elicited no response from the engines.
In the end, Yevdokimov could do nothing to stop the plane from crashing back to earth. A split second later, as the reverser doors swung closed, flight 1492 touched down a third time. This time the pitch was slightly nose up, with a vertical speed of 1,220 feet per minute (6.2 m/s), resulting in an impact force of at least 5.0 G’s, but probably higher. The landing gear instantly collapsed, a cloud of white fuel gushed out of the shattered fuel tanks, and the aircraft erupted in flames.
◊◊◊
The events of this Part, from the start of the flare to the ignition of the fire, took place in just 13 seconds.
◊◊◊
One of the most persistent public questions about flight 1492 was why the landing gear collapsed during the third touchdown, and why this collapse was able to breach the fuel tanks, triggering a catastrophic fire. This question is especially significant because European, American, and Russian certification regulations all require that the landing gear be designed so as to avoid this exact scenario. For instance, EASA regulation 25.721 states the following:
“The main landing gear system must be designed so that if it fails due to overloads during takeoff and landing (assuming the overloads to act in the upward and aft directions), the failure mode is not likely to cause… the spillage of enough fuel from any part of the fuel system to constitute a fire hazard.”
The Russian equivalent regulation, AR 25.271, contains identical wording.
Therefore, to understand why flight 1492 burst into flames on Sheremetyevo’s Runway 24 Left, we need to examine how the landing gear was designed and how it was tested.
Like most similar airplanes, the SSJ-100 main landing gear folds inward toward the fuselage, hinging about a cylindrical, longitudinally-oriented beam called the crossarm. The main lending gear leg descends from the crossarm. The leg is also braced by two diagonal, folding elements, of which the forward element is known as the drag brace and the aft element is known as the side brace.
The forward end of the crossarm and the drag brace are both attached to the aft face of the wing box rear spar, a massive structural beam that runs from wing root to wing tip and forms the aft edge of the wing’s internal box structure. Meanwhile, the aft end of the crossarm and the side brace are attached to the landing gear crossbeam, which angles aft and inboard from the wing box rear spar to the fuselage.
The significance of this information is that the rear spar also forms part of the wall of the fuel tank, which means that the tank could be breached if the crossarm and drag brace are ripped out of their attachment points. This is a vulnerability of essentially every transport aircraft, simply because this is the easiest and most efficient way to configure the fuel tank, the spar, and the landing gear. Therefore, every airliner is designed such that if the landing gear is subjected to a sufficiently large force, the aforementioned elements will separate in a sequence that prevents damage to the fuel tanks.
The SSJ’s landing gear, which was designed and produced by French company Safran, incorporates a set of “weak links,” or fuse pins, which are designed to fail under a slightly lower load than the rest of the landing gear. Four of these fuse pins attach the forward end of the crossarm to the rear spar, and four more attach the drag brace. Therefore, during a heavy impact the crossarm should cleanly separate from the rear spar without breaching the fuel tank, followed by the drag brace. The entire landing gear assembly should then rotate aft about the remaining attachment points, and the crossbeam should detach from the wing, causing the gear to separate in a rearward direction, away from the fuel tank. This is essentially the same design solution as every other similar aircraft.
When aerospace engineers design an aircraft component that will be subject to loading, they think in terms of two different load values: the design load, and the ultimate load. The design load is the size of the load that the component is expected to experience in service; or more specifically, the probability of a larger load is less than n per flight hour. Certification regulations typically require that the component be designed to withstand at least 1.5 times the design load before actually breaking, so engineers add a large safety factor. After accounting for this safety factor, the load at which the component will actually break is known as the ultimate load. In the case of the SSJ’s landing gear, the design load would be incurred during a touchdown at maximum landing weight* with a vertical rate of at least 600 feet per minute (3.05 m/s), while the ultimate load could be incurred with a vertical rate at touchdown of 736 feet per minute (3.74 m/s). However, it has to be noted that because the impact force increases with the square of the velocity, this actually represents a safety margin close to 2.0, well above the required 1.5.
*Because the actual weight of flight 1492 at touchdown was very close to max landing weight, the accident scenario bears an acceptable resemblance to the certification scenario without adjusting the numbers to account for the weight of the aircraft.
European, American, and Russian regulations provide some criteria against which manufacturers should test for the safe separation of the landing gear during a load application exceeding the ultimate load. For instance, EASA’s relevant regulation states the following:
“Failure of the landing gear under overload should be considered, assuming the overloads to act in any reasonable combination of vertical and drag loads, in combination with side loads acting both inboard and outboard up to 20% of the vertical load or 20% of the drag load, whichever is greater. It should be shown that at the time of separation the fuel tank itself is not ruptured at or near the landing gear attachments. The assessment of secondary impacts of the airframe with the ground following landing gear separation is not required. If the subsequent trajectory of a separated landing gear would likely puncture an adjacent fuel tank, design precautions should be taken to minimize the risk of fuel leakage.”
There are a couple things that have to be noted about this regulation. First of all, neither EASA nor any other regulatory body has established an exact definition of “reasonableness” when it comes to the combination of vertical and drag loads used by the manufacturer. Furthermore, the regulation doesn’t say how big the test load should be relative to the calculated ultimate load.
When UAC tested the landing gear separation sequence, they applied a rapidly and infinitely increasing load to the gear assembly until it separated. This test confirmed that the desired separation sequence would indeed occur, with the forward attachment point fuse pins failing first, followed by rearward rotation of the gear and finally separation of the aft attachment points. No damage to the fuel tanks was noted. The results of the test were accepted by EASA and the SSJ was certified as compliant.
But when the MAK examined the impact loads sustained by flight 1492, they found a key difference from the certification scenario. During the second touchdown, the vertical rate of the main landing gear at impact was -830 feet per minute, which exceeded Safran’s calculated ultimate load. But the landing gear didn’t separate — in fact, it didn’t appear to have been damaged at all, because no parts of the aircraft were found on the runway near the point of the second touchdown. So what actually happened?
As it turns out, the second impact fell into a gray area where the load was sufficient to break the fuse pins attaching the forward end of the landing gear crossarm to the wing box rear spar, but not the fuse pins for the drag brace or crossbeam. The ultimate load of the drag brace and crossbeam attachments is slightly higher than the crossarm forward attachment because the safest separation is achieved if the crossarm detaches from the spar first. But there was no requirement to test what would happen in the event of a marginal exceedance of the ultimate load that shears the crossarm fuse pins but not the rest. In fact, neither UAC nor Safran had any idea what would happen in this scenario because the tests involved a load that increased infinitely until the gear actually separated.
In theory, if the force of the second impact had been just a little bit higher, both main landing gears would have separated as designed, the aircraft would have crashed down onto its belly instead of bouncing, and the fuel tanks might not have been breached. In that case all occupants would have survived.
Instead, what happened was something far outside of the certification assumptions. Carrying the landing gear back into the air, intact except for the broken crossarm fuse pins, the aircraft bounced, then plunged back to earth with enormous force. Although the force of the third impact was measured as “at least 5.0 G’s,” against the second impact’s 5.85, in all likelihood the third impact was the more severe of the two. It would certainly have sheared the landing gear if the landing gear was intact, but it wasn’t. And because the expected failure sequence was no longer possible, the load path through the landing gear components was different than in the certification tests. Consequently, the landing gear actuating cylinder mounting brackets pulled out of the wing box rear spars, breaching both fuel tanks simultaneously and by an identical mechanism.
Ultimately, the MAK was unable to assess the consequences of the third touchdown in terms of the certification requirements for two main reasons. The first is that the regulations explicitly do not require the manufacturer to consider the consequences of further impacts after an initial impact exceeding the ultimate load. And second, the vertical rate during the third impact was so large that the force exceeded the ultimate load of the wing structure itself. EASA certification requirements state that the airplane must not rupture in a manner catastrophic to safety during an impact without landing gear at a vertical rate up to 300 feet per minute. However, the actual vertical rate during the third touchdown was much greater than this, and extensive airframe damage was noted as a result, including the partial separation of the wing box forward spar from the fuselage. Therefore, no assurance against a catastrophic fuel tank breach existed even if the landing gear had separated normally.
But while the MAK concluded that the SSJ’s landing gear behaved in accordance with its certification basis during the crash, they reserved considerable criticism for the regulations themselves. The investigators pointed out that there was a lack of correlation between the regulations governing the maximum load the gear must withstand, and the regulations circumscribing the landing gear separation tests, which resulted in an intermediate area where the effects of a given load were not known. In this case, because the testing criteria were not required to resemble reality, the landing gear was subjected during testing to an infinitely increasing load, instead of a specific, finite load, as occurs in an actual accident. As a result, the testing criteria were insufficient to confirm that the design actually minimized the risk of catastrophic fuel spillage in a real world accident.
The MAK also argued that the lack of a requirement to examine the consequences of additional impacts should be reconsidered. The final report discusses five previous incidents in which multiple large loads in quick succession caused an unexpected landing gear failure sequence, out of which three cases resulted in fuel spillage sufficient to constitute a fire hazard, although none resulted in fatalities. These three cases included British Airways flight 38, a B777 which landed short of the runway in London in 2008, and Yakutia Airlines flight 414, another SSJ that overran a runway in 2018. In both cases, investigators recommended enhancing the certificating test requirements to include multiple touchdown scenarios, but these recommendations were rejected by the European and Russian regulators respectively.
In theory, an analysis of the landing gear behavior during a second impact exceeding the ultimate load following a first such impact could be possible. Because the landing gear is designed to separate in a controlled way with a predictable failure sequence, the condition of the gear at the time of a second impact could be calculated. And while I am not in a position to say with certainty whether such testing would result in practical design improvements that might prevent a tragedy like Aeroflot flight 1492, the MAK and I share a belief that regulators should explore the possibility.
Unfortunately, for those who found themselves aboard flight 1492, all of this discussion comes too late.
◊◊◊
As flight 1492 crashed back to earth for the final time, the fuel tanks split open, and a torrential blast of jet fuel poured directly onto the hot engine exhaust nozzles, causing a deflagration of the entire fuel-air mixture. Bright flames billowed out of the fuel cloud, streaming behind the aircraft as it slid down the runway.
On board the aircraft, Captain Yevdokimov moved the thrust levers back to max reverse, but no reverse thrust was generated because the weight-on-wheels switches had been destroyed. First Officer Kuznetsov called out that they had no reverse thrust or spoilers. The wheel brakes were also out of commission, but the plane was still slowing down due to friction alone.
Decelerating through 100 knots, the intense smoke and fire behind the aircraft triggered a rear baggage compartment smoke alarm. From the cabin, passengers could see flames pouring from both wings, and video footage recorded from inside the plane captured the sound of panicked screaming.
At 80 knots, decreasing rudder authority started to interfere with Yevdokimov’s ability to keep the nose pointed straight ahead, as the plane started to fishtail like a car with no rear tires. Flight 1492 veered hard to the left, as though the tail was trying to overtake the nose, until the plane was sliding sideways down the runway, leaving a trail of towering flames and smoke in its fuel-soaked wake. It was only at this point that the flight crew caught sight of the flames and realized they were on fire. At almost the same time, the senior flight attendant called the cockpit via the interphone and exclaimed, “Fire on board! Fire!”
As the aircraft slid off the left side of the runway and screeched to a halt, the fire expanded rapidly, enveloping everything aft of the wings in an angry, billowing tempest of pure flame. Every surface behind the fuel tanks had been sprayed with aerosolized fuel, which was then blown directly against the right side of the fuselage as the plane slid sideways across the runway. Even worse, as the plane became stationary, all the fuel escaping from the tanks pooled underneath the fuselage, intensifying the inferno, which was then further stoked by the hot exhaust blasts shooting from the still-running engines.
By the time the plane stopped, the fire had been burning for 30 seconds. In the cabin, the passengers did not need 30 seconds to determine that they were in mortal danger, and many began to get up from their seats while the plane was still moving. Others screamed, some attempted to call loved ones, and many simply sat there in shock.
Up front, the two forward flight attendants realized during the landing roll that the plane was on fire. There had been no request from the crew to be ready for an evacuation, nor had there been a call to brace for impact, but it was immediately obvious to the cabin crew that the evacuation would need to take place without delay. Exercising her prerogative, Senior Flight Attendant Kseniya Fogel’ stood up from her seat as soon as the aircraft stopped and opened the R1 door without waiting for a command by the pilots. By 18:30:46, just eight seconds after the plane came to a stop, the door opened and the slide began deploying.
Meanwhile in the cockpit, at the moment the plane stopped, First Officer Kuznetsov called “Attention crew! On station. Attention crew! On station,” the standard call for the cabin crew to prepare for an evacuation, but he forgot to depress the interphone button and broadcast this using VHF radio 2 instead. Air traffic control did not hear the call because the VHF 2 antenna had already been destroyed by the fire. Instead, Kuznetsov turned and shouted “Evacuation,” and one of the flight attendants yelled, “We are on fire!”
As the R1 slide was deploying, one of the flight attendants attempted to make a public address system announcement, “Seat belts off, leave everything, get out!” But she forgot to press the PA button and this command was broadcast to the cockpit via the interphone instead. Only a few passengers at the front heard the command to “leave everything.” Farther back, this command would have been useful, because some passengers in the traffic jam in the aisle were opening the overhead bins to retrieve various items, making the jam even worse.
Up front, Captain Yevdokimov called for the emergency evacuation checklist, and Kuznetsov scrambled around trying to find the QRH, which had fallen under his seat during the crash. After laying his hands on it, he tried again to call for the evacuation, but his voice was not heard in the cabin for unknown reasons. Regardless, by then the evacuation had already started, as passengers began to jump down the R1 slide, about 7 or 8 seconds after the door was opened. One of the flight attendants then crossed the galley and opened the L1 door too. A split second after that, the cockpit voice recorder ceased recording as the fire destroyed the cables connecting it to the microphones.
By the time the first passengers hit the bottom of the slide at 18:30 and 54 seconds, the situation in the back of the plane was already apocalyptic. Video evidence showed that within one second of the first passenger leaving the plane, and possibly even earlier, the fire breached the fuselage and began spreading into the cabin itself — with all of the passengers still inside. The intense heat of the blaze caused the cabin windows to shrink and fall out of their frames, creating multiple entry points all along the last few rows no later than 49 seconds after the start of the fire. Before the evacuation even began, the entire back of the plane filled up with dense smoke as far forward as row 9,* which according to survivors was so toxic that two to three breaths were enough to incapacitate a person.
*With the business class configuration on flight 1492, there were no rows 4–5, so row 9 was actually the 7th row, out of 20 total.
The rearmost person on flight 1492 was 21-year-old flight attendant Maksim Moiseev. None of the survivors reported seeing him, and what he did in the few seconds available to him will never be fully known. Surrounding by choking smoke and unable to see, he somehow managed to open the 2L door, but because this door was inside the seat of the fire, the resulting blast of heat most likely killed him instantly. His body was later discovered on the ground just outside the open door, the only victim found outside the plane. Although opening this door could in theory have enhanced the spread of the fire into the cabin, the windows had already failed by this point and simulations showed that opening the door made no difference.
Twenty-one passengers were seated in rows 16 to 20 at the back of the plane, of whom only the passenger in seat 18A lived to speak of what took place there. By his recollection, a serious jam formed in the aisle, akin to a crowd crush, as panicked passengers tried to push forward before the aircraft had stopped moving, and therefore before those ahead had a chance to get out of the way. Black smoke quickly enveloped the crowd and he could hear people calling out to him, but there was nothing he could do for them. Crawling on all fours to stay below the worst of the smoke, he encountered the jam in the aisle, but managed to get around it by holding his breath and climbing over the seat backs. By the time he reached the nose section it was clear of people — so what was causing the blockage?
The only survivor out of ten people seated in rows 14 and 15 was the passenger in seat 15C. She reported that after seeing fire during the landing roll, she undid her seat belt and got up while the plane was still moving, but when she tried to move forward, a traffic jam developed because people were trying to retrieve luggage from the overhead bins. Everything behind her row was consumed by thick smoke and it quickly became difficult to breathe. Struggling forward, she saw a man who had stopped to grab his luggage and was blocking people from moving, although she didn’t say whether he was ahead of or behind her, or how she got around him.
The passenger in business class seat 3A said that he stayed in his seat for 30 seconds to let people who were advancing from the back escape first, until the smoke enveloped him too. He joined the line of people moving forward and managed to escape, but before he left the aircraft he saw people getting their bags from the overhead bins, including some very large bags that in his opinion definitely impeded the evacuation.
In the cockpit, the pilots tried to complete the evacuation checklist, which included steps like setting the parking brake and shutting down the engines. Physical evidence confirms that they made it to at least step 6, and step 9 might have been accomplished as well, but the checklist was never completed. The engines weren’t shut down until 18:31 and 34 seconds, almost a minute after the plane came to a stop. Given that the pilots could have shut down the engines in mere seconds using the master switches, the MAK wrote that this was an unreasonably long time to leave them running. Furthermore, the jet blasts significantly contributed to the size and speed of the fire, reducing the amount of time for the passengers to escape. Publicly available videos of the evacuation clearly show that the fire became less energetic as soon as the engines were shut off, testifying to their influence.
At around the time the engines were shut down, flight attendants Fogel’ and Kasatkina were still standing by the exits, shoving passengers down the slides. But after evacuating a little over two dozen people, no more passengers emerged from the smoke-filled cabin. Since the fire and smoke were still getting worse with every passing second, both flight attendants elected to abandon ship.
But back in the pall of darkness, several passengers were still trying desperately to leave. A total of four passengers eventually left the aircraft after the flight attendants, escaping from the very margin of the inferno. The first of these was the passenger from seat 15C, who jumped through the door to safety after suffering burns to 15% of her body. Also still on the airplane was the passenger from seat 12A, who encountered First Officer Kuznetsov just outside the cockpit and decided to stay to help more passengers. Together, this passenger and Kuznetsov dragged a nearly unconscious woman out of the aisle and pushed her down the slide, followed by the man from seat 18A, who beat the odds by making it just far enough forward for the angels at the doorway to spot his arms sticking out of the pall of smoke. After being flung bodily down the slide, he came to his senses, got up, and walked away.
At this point the passenger from seat 12A told Kuznetsov that they should find portable breathing equipment and try to enter the cabin to search for more people. Kuznetsov tried to shine a flashlight into the haze to get a better sense of the conditions, but the beam was unable to penetrate the dense fumes. Concluding that there was nothing more they could do, Kuznetsov declared, “It’s over, let’s go,” and passenger 12A reluctantly fled the burning plane. He was the last surviving passenger to leave, 106 seconds after the start of the evacuation. Out of all the survivors, only he and passenger 18A saw the flames inside the cabin and lived to speak of them. All others close enough to see that eerie sight did not survive.
After passenger 12A departed the plane, First Officer Kuznetsov returned to the cockpit, then exited via the window 35 seconds later. But after less than a minute on the ground, he bizarrely climbed back in through the escape slide and threw his flight bag and raincoat out of the plane, before following them down the slide. The MAK wrote that they were unable to “reliably identify the purpose” of these actions by Kuznetsov, and in fact the report contains no testimony from him at all, suggesting that Aeroflot did not make him available for an interview.
Captain Yevdokimov was the last person to leave the plane alive, at time 18:36 and 12 seconds, over five minutes after the start of the evacuation and after the fire had already been partially extinguished by responding fire crews.
By the time fire crews entered the aircraft with smoke protection equipment and hand lines, there was no chance of survival for anyone still inside. The MAK did note that prepositioning the fire trucks could have cut the first vehicle’s response time by 40 to 45 seconds, resulting in its arrival only 20 seconds after the plane stopped. However, this probably wouldn’t have saved any lives because the fire had already penetrated the cabin interior by that point. Investigators speculated that if one or more crewmembers had donned protective breathing equipment and entered the forward cabin, a couple more people might have been saved, but this would have been far outside any pilot or flight attendant’s job description.
◊◊◊
In total, 41 out of the 78 passengers and crew did not escape the burning jet. But there is more to be said about how they died, and how their deaths might or might not have been prevented.
In most aircraft accidents involving large numbers of fire deaths, the killer of most or all of the victims is smoke inhalation. Smoke generated by burning plastics and hydrocarbons contains deadly chemicals such as carbon monoxide and hydrogen cyanide that can quickly reach fatal concentrations in a smoke-filled cabin. As perhaps the most well-known example, in the 1985 Manchester runway disaster, out of 55 people who died trying to escape the burning 737, only 6 died directly due to the fire; the rest were killed by the smoke.
But in the case of Aeroflot 1492, the usual logic didn’t hold. Autopsies determined that while most passengers had breathed in at least some toxic smoke before dying, the cause of death in 40 out of 41 cases was direct thermal assault. Calculations showed that once the windows failed, the temperature at head height in the aft part of the cabin would have very quickly exceeded 600˚C, causing the passengers in this area to burn to death before they had a chance to succumb to the fumes. At least two passengers in row 17 were found still belted into their assigned seats, indicating that they were overcome almost instantly. One of these, the passenger in seat 17E, was found to have died by cardiac arrest, perhaps due to shock; he was the only victim whose cause of death was not listed as “burning.”
Most of the victims were found very close to their seats in the aft cabin, indicating that they didn’t have a chance to get very far. Out of 46 people seated in rows 11 to 20, only six survived, all whom started moving toward the exit before the plane had come to a stop; those who waited or became stuck ran out of time. That being said, if you ever find yourself in a situation requiring an emergency evacuation, you should not attempt to get up before the airplane comes to a stop, because 99 times out of 100 this will just make the evacuation more chaotic. Flight 1492 was a special case with few parallels in history.
Given the speed with which the fire overran the cabin, it was impossible to save everyone. However, an unknown number of passengers — the report simply states “several” — were found piled up between rows 6 and 10. At the same time, all but one of the passengers originally seated in this area survived, indicating that these victims had made their way from further back. A pile in this location is consistent with witness reports of a traffic jam behind one or more passengers who were retrieving baggage from the overhead bins. The passenger in seat 15C confirmed seeing a man grabbing baggage shortly before she left, as well as several people attempting to move forward behind her, of whom only two escaped. Furthermore, these victims had already left the fire zone by the time they collapsed; in fact, the autopsies showed that they were incapacitated by toxic fumes while trying to leave, and were killed by the fire while unconscious on the floor. Given this information, it’s entirely possible that some of these passengers, likely a number in the low single digits, may have survived if other passengers had not tried to retrieve their luggage from the overhead bins. In the end the MAK determined that this behavior by passengers did contribute to the high death toll.
In the aftermath of the accident, many people were quick to blame these passengers. In one sense, this blame is constructive insofar as shame is an effective motivator for people who might otherwise try to get their luggage during a future evacuation. However, research has shown that when untrained civilians are unexpectedly placed into an emergency aboard an aircraft, many people’s brains revert to what they already know, which is to stand up, grab their bags, and walk to the exit, as though nothing is wrong. This behavioral tendency can be short-circuited if the flight attendants loudly and assertively order passengers to leave their bags behind and exit immediately. But on flight 1492, the order to leave bags behind was not heard by the majority of the passengers because the senior flight attendant forgot to press the PA button before making the announcement.
In the MAK’s opinion, this omission could have occurred because the cabin crew were type rated on multiple aircraft at once, but each recurrent performance check took place on one aircraft type only. As a result, two out of the three flight attendants on flight 1492 hadn’t been checked out on an SSJ in over a year, which can result in a degradation of emergency skills.
If, god forbid, you ever find yourself in a similar situation, my hope is that this story will come to mind. There is nothing in your carry-on bag that’s worth more than human lives. If you have important items with you, like ID or medications, keep them in a small bag or personal item that can stay with you at your seat; this will reduce the temptation to retrieve your carry-on. Backing up the contents of electronic devices like laptops before flying can also help ease the decision to leave them behind. But most of all, my advice is to remember the victims of flight 1492, and learn from their fate.
◊◊◊
In the end, the MAK concluded that the primary causes of the fire’s severity were the large amount of fuel involved and the blowtorching effect of the engines, which created a fire scenario that would have quickly overwhelmed even the most robust protections. Contributing to the number of deaths were the lack of usable exits at the rear; a crowd crush caused by panic in the tail section; and passengers stopping in the aisle to retrieve baggage.
The MAK report does not trade in matters of blame or praise, but I do want to independently praise the actions of the flight attendants, First Officer Kuznetsov, and passenger 12A (identified as Sergei Kuznetsov, no relation to the first officer), who helped save lives by pushing people out the exits and then dragging additional people to safety. But out of all the crewmembers, my sympathy is extended most of all to Maksim Moiseev, who had no time to act and no chance of survival. If he had been given just one minute more to live, he no doubt would have done all he could to save his passengers, but the universe does not always grant us that privilege.
◊◊◊
Almost every fatal air disaster begets a blame game — a circle of pointing fingers, a flurry of lawsuits, an interpretation and reinterpretation of investigative findings. But few accidents have devolved so deeply into this cycle of mutual accusation as has Aeroflot flight 1492. From the very first days, speculation abounded. Some suggested that the crash was caused by a flaw with the much-maligned SSJ-100; others pointed out what they felt were obvious flight crew errors; many brought up Aeroflot’s sordid safety record and reputation for negligent behavior; and quite a few focused their ire on the passengers who stopped to grab their carry-on bags.
The MAK’s job was to find the factors that caused or contributed to the accident, while staying above the mudslinging — not an easy task, as it turns out. Their job was complicated at every step by various actors. Less than 24 hours after the crash, Captain Yevdokimov was giving public interviews to the media, even though proper protocol is to isolate crewmembers until investigators have had a chance to speak to them. In the end, the MAK was not able to interview Yevdokimov until after he had been briefed on the contents of the black boxes, which contaminated his account of events and made it difficult to tell what was his actual impression at the time, and what was an invention to explain the data.
It certainly didn’t help that under Russian law, a parallel criminal inquiry is automatically opened into any air accident even if no firm evidence of a crime has been uncovered. The fact that he could be charged by this inquiry almost certainly colored Yevdokimov’s statements to the MAK and impeded the investigators’ ability to determine what he was actually thinking during the flight. Unfortunately, Yevdokimov’s fears proved well-founded, and the Investigative Committee of Russia charged him with “violating flight safety rules” on October 2nd, 2019. Although the Investigative Committee possessed wide latitude to charge anyone found to have acted inappropriately, Yevdokimov was the only person accused.
The practice of criminally prosecuting pilots who make mistakes that contribute to fatal accidents has been widely criticized by both legal and aviation experts around the world, because it complicates the work of safety investigators — as seen in this case — and because it often results in scapegoating of an individual who may have been failed by an airline’s training program. The practice also raises ethical concerns when the threat of prison becomes involved, given that the accused individual almost never presents a danger to others. Unfortunately, Russia has a long history of ignoring these concerns and prosecuting the people who were directly involved in an accident while ignoring the people and institutions who systemically degraded the safety environment.
In 2023, the court found Yevdokimov guilty on all charges. In addition to suspension of his license, he was fined 2.5 million rubles (about US$30,000) and sentenced to 6 years in a prison colony. It is unclear to me who was supposed to be satisfied by this ruling. With his license suspended, there was no way for him to cause additional accidents, and none of the survivors or next of kin publicly lodged any accusations against him.
Forced to defend himself in court, Yevdokimov argued that the aircraft did not respond normally to his inputs and was almost impossible to control, suggesting that the manufacturer had designed the fly-by-wire system improperly and without adequate protection against lightning. His lawyers also argued that the landing gear was not adequately designed to prevent fuel spillage in a crash landing, and — quite distastefully — blamed the large number of victims on the late flight attendant Maksim Moiseev for opening the rear door, despite the MAK’s finding that this had little effect on the spread of the fire.
On the other hand, when the MAK published its final report on March 28, 2025, Russian media mostly wrote that the report blamed the pilot, without much discussion of the contents. Over the course of this article, I’ve already explained most of what the MAK found, but I now want to go over the actual takeaways that should be gleaned from those findings, as well as the areas where safety improvements are needed. This following section will be broken into three subParts: (1) The Aircraft, (2) The Pilot, and (3) The Airline.
Part 8.1: The Aircraft
During its investigation, the MAK did not find evidence that the SSJ-100 fell short of its own certification basis. The forces imparted to the landing gear were outside those envisioned by regulatory requirements, and testing showed that the aircraft’s reactions to the pilot’s control inputs corresponded very closely to the manufacturer’s model. Furthermore, flight testing by EASA and MAK experts in Italy allowed investigators and safety officials to determine through first-hand experience that the aircraft’s behavior in Direct Mode is controllable using conventional piloting skills and does not necessarily constitute a danger in and of itself. As for the failure of both EIUs during the lightning strike, the MAK was not able to establish a cause.
However, the narrow conclusion that the SSJ met certification requirements does not exonerate the design. As I discussed in Part 6, the MAK criticized the regulations themselves for providing inadequate assurance against a catastrophic rupture of the fuel tanks during a real-world crash landing. But in addition to that, the MAK pointed out a few areas where the design of the aircraft could have been better, despite technically meeting requirements, and I want to add a few points of my own to that list as well. In fact, after all my research into flight 1492, I came to believe that design decisions by UAC significantly contributed to the accident.
Although the MAK didn’t discuss it at all, in my opinion one of the most significant issues with the SSJ’s fly-by-wire philosophy was its lack of an equivalent to Alternate Law, as I discussed in Part 3. According to official SSJ training documents, a reversion to Direct Mode can occur “if parameters from ADS [the air data system] or IRS [the inertial reference system] are not available,” a condition that would cause an Airbus to enter Alternate Law. To reiterate, this makes a Direct Mode reversion much more likely on the SSJ than on any other fly-by-wire aircraft. Now, to be clear, my research suggests that if the flight control computers temporarily stopped receiving any data from the entire air data and inertial reference system, as happened in this case, even an Airbus would have entered Direct Law. However, this comparison is misleading because the Airbus doesn’t appear to have a 1:1 equivalent of the Electronic Interface Units.
In order to better understand what the EIUs do and why they exist, I dived into hundreds of pages of SSJ-100 documentation, and in the process I got more than I bargained for. As I stated earlier in this article, the purpose of the EIUs is to reformat data into the configuration demanded by the recipient computers. What actually happens is something called protocol adaptation, which is pretty far outside my wheelhouse, but you can think of it as a translation between two ways of organizing information, which could be feet vs. meters or morse code vs. signal flags or apples vs. oranges, it doesn’t matter. In any case, according to the SSJ documentation, the EIUs “perform a similar function to the data concentration system,” and one of the functions of the data concentration system is to “perform protocol adaptation to enable off the shelf equipment to communicate together.” Further, the documentation shows that the EIUs provide protocol adaptation of analog, discrete, and digital inputs for a practically every aircraft system, from the primary flight control computers to the full-authority digital engine control to the brakes to the auxiliary power unit to the air conditioning to the cockpit window heaters. In the case of the flight controls, the documentation shows that the EIUs translate data from an unspecified original digital protocol(s) to another digital protocol called ARINC-429, which I don’t understand and you don’t need to either.
As far as I have been able to tell, on Airbus aircraft this function of the flight control system, when or if it’s even necessary, is performed at each individual connection between a data source and the data recipient (such as an air data computer and a flight control computer). There certainly isn’t a centralized unit that does protocol adaptation for every single aircraft system. So why does the SSJ have one?
The most likely answer, as the above quotations imply, is that sensors, computers, flight controls, instruments, and so on come from a variety of suppliers, and most of these components are off the shelf, rather than being custom-made for the SSJ. In the case of the fly-by-wire system, the air data and inertial reference computers appear to have been designed by Thales in France, while the PFCUs were designed by Liebherr in Germany. Now, this isn’t always a problem, but for UAC it was, because the company was unlikely to sell enough SSJs to make it economical for suppliers to customize their components for the SSJ. And without that customization, off the shelf avionics aren’t necessarily capable of talking to one another. For instance, on the Airbus (and correct me if I’m wrong), the air data computers are made by Thales but the flight control computers are made by Safran, so when a new Airbus is being designed those two companies sit down and work out how they’re going to make their devices talk to each other. At the same time, Liebherr produces flight control systems for the Embraer E-series, which are designed to connect to computers made for the E-series by BAE Systems. So my guess is that when UAC ordered Thales air data computers but Liebherr flight control computers, they didn’t have a common digital protocol, and something was needed to translate between them. And in fact, this was probably the case for a wide variety of systems that had mix-matched components. Therefore, UAC resolved the resulting tangle of different protocols by routing everything through the EIUs, because they couldn’t get the individual suppliers to customize their products for the SSJ. The only things that were custom made were the EIUs themselves, which explains why they were among the only avionics on the entire aircraft to be designed and built in Russia.
However, the decision to route everything through the EIUs de-compartmentalized a large number of aircraft systems by shoving everything through this one pair of computers. Furthermore, it negated the redundancy provided by having three ADCs (air data computers), three IRSes, and three PFCUs (primary flight control units) by processing the ADC and IRS signals through only two EIUs. Unlike the Airbus, alternate routes for certain parameters were not available.
Wrapping back around to where I started this argument, a failure of all protocol adaptation for the flight control system isn’t something that’s realistic on the Airbus but could happen on the SSJ. The two EIUs, being identical, were equally vulnerable to environmental effects such as lightning. This goes for any group of redundant computers that are structurally identical, but in this case there was some common flaw that allowed lightning to affect the power supply to both units by the same mechanism, which was not anticipated by the manufacturer. What’s significant is that this flaw, whatever it was, involved the one computer that was tied to almost everything, the lynchpin of the SSJ’s network of automated functions. It’s worth pointing out here that this type of event is avoidable, as evidenced by my failure to find any record of an Airbus suffering a flight control law reversion due to a lightning strike, despite the Airbus fleet having accrued several orders of magnitude more flight time. This fact certainly raises questions about whether the EIU manufacturer, Ulyanovsk Instrument Bureau, is capable of designing avionics that meet modern expectations of reliability. Remember what I said about Russia’s high-tech aerospace industry being 20 years behind?
This particular issue is likely just one of many that are collectively responsible for the SSJ’s high rate of flight control law reversions. Some of those reversions may have been less severe if the SSJ had an Alternate Law, but at first glance it seems that flight 1492 still would have entered Direct Mode even if Alternate Law had existed, because all air data was interrupted when the EIUs rebooted. But on the Airbus, it’s sometimes possible to upgrade from Direct Law to Alternate Law if the original failure goes away, depending on the nature of the failure. That’s because there are many fly-by-wire functions that can be restored in flight without pilot action, and Alternate Law’s several sub-states allow for selective loss or restoration of functions. Because the original failure on flight 1492 entirely went away after less than 18 seconds, a hypothetical SSJ with Airbus flight control laws could have jumped from Direct Law back to Alternate Law as soon as the PFCUs started receiving valid data from the ADCs again, which would have restored normal sidestick operation and autotrim. Any systems requiring complex pilot action to restore could have remained off with their associated functions inoperative. But without these capabilities, flight 1492 became stuck in Direct Mode even though all aircraft systems except VHF radio 1 were completely serviceable.
Because of this problem, the MAK recommended that UAC explore the feasibility of enabling a return from Direct Mode to Normal Mode in flight.
◊◊◊
Another issue I want to highlight is that pilots have to keep their conventional flying skills sharp in order to handle Direct Mode/Law reversions, no matter whether they’re flying an SSJ or an Airbus. But because the SSJ is so much more likely to enter Direct Mode than an Airbus is by design, even before accounting for the unexpectedly high failure rate, the relative importance of this issue is much higher on the SSJ. Even with consistent training, a pilot’s instinctive use of the trim atrophies when flying a fly-by-wire aircraft, not to mention that flying with no control modulation for airspeed and no force feedback is just plain hard.
Here I want to highlight a different type of fly-by-wire philosophy this is used on the Boeing 777 and the Airbus A220 (which began life as Bombardier product). On those aircraft, the autotrim adjusts the stabilizer to maintain an invisible “trim reference speed.” The trim reference speed is set by the pilot using trim switches on the yoke, which in a conventional aircraft would move the trim itself. Using the flight controls to deviate from the trim reference speed generates artificial force feedback on the yoke. So if the trim reference speed is set to 200 knots, and the pilot wants to slow to 180 knots, the pilot can pull back to raise the nose, which will cause the speed to drop, but the pilot will feel resistance. This resistance is removed by adjusting the trim reference speed using the trim switches until the reference speed matches the desired speed. The autotrim will then maintain the new reference speed until the pilot changes it — nose up to slow down, nose down to speed up. For the pilot, this entire sequence feels very similar to trimming a conventional aircraft where the trim switches directly move the stabilizer, but instead of reacting to speed changes by trimming, the pilot proactively trims in order to initiate speed changes, while the autotrim keeps the speed stable when the pilot isn’t making inputs.
One of the advantages of this design is that if the system reverts to Direct Mode, the trim switches on the yoke (or on the A220, the sidestick) become directly connected to the trim. Then, if the pilot encounters resistance when maintaining the desired speed or flight path, they can simply use the same trim switches in exactly the same way as they would in Normal Mode to re-trim the aircraft. This makes flight in Direct Mode on the 777 and A220 much easier than in the A320 or the SSJ. The downside of this design relative to the A320/SSJ system is that it’s possible to be out of trim in Normal Mode, which can significantly increase pilot confusion during an in-flight upset, as well as increasing the standard workload.
On the SSJ, with no Alternate Law and a comparatively high likelihood of reverting to Direct Mode, a Boeing-style trim system would have significantly reduced the inherent risk associated with a reversion. Airbus aircraft (excluding the A220) can get away with a control law philosophy that requires very different flying techniques in Direct Law because these aircraft almost never enter Direct Law to begin with,* thanks to the existence of Alternate Law. The SSJ doesn’t have that luxury. As a result, it’s safe to say that the SSJ’s fly-by-wire philosophy is inferior to both the Airbus and Boeing variants from a safety standpoint.
*Except during Alternate Law reversions after extending the landing gear. However, this should take place after all major maneuvers are complete.
◊◊◊
Part 8.2: The Pilot
The data from Denis Yevdokimov’s last 37 flights before the accident demonstrate that he never developed a correct flare and landing technique. He had a dangerous tendency to pitch up too far during the flare then correct by pitching down, which may have been exacerbated by the SSJ’s lack of a Flare Law, but ultimately comes down to individual technique. But proper technique is something that should be drilled into a pilot by the training program, so I’m going to discuss that aspect in Part 8.3. What I want to highlight here instead is the issue of judgment.
Although there were a few points during the flight where Captain Yevdokimov displayed good judgment, such as following the SID when he lost radio contact, most of the flight was marked by a series of poor judgment calls.
Before the flight, he demonstrated a cavalier attitude toward thunderstorms in the area, even though every pilot knows these storms can contain severe or even catastrophic hazards. Most other pilots departing Sheremetyevo that day requested a deviation from the SID to avoid the storms, but Yevdokimov didn’t even try, and that bothers me. Pilots need to actively estimate the threat posed by factors outside their control, such as weather, and they need to modify their plans to account for them. Flying into the thunderstorm without even trying to steer clear was simply careless.
After the lightning strike, Yevdokimov did not attempt to systematically diagnose the cause of the problems with the plane or establish what actions were required to return safely to the airport. Much as he did when confronted with bad weather, he displayed a general incuriosity toward flight safety hazards. That’s not to say he was unaware that his difficulty controlling the plane represented a hazard, but rather that he reacted by attempting to exit the situation as quickly as possible without attempting to understand it. This occurred despite the fact that the consequences of a Direct Mode reversion were clearly spelled out in the QRH. But First Officer Kuznetsov displayed similar incuriosity when he sped through the QRH section on Direct Mode in a robotic and disinterested manner, as though he was just going through the motions of reading. It’s disturbing that the pilots engaged in no discussion of the contents of this section despite having unanswered questions about what the plane was doing.
This lack of understanding of the situation caused Yevdokimov to believe that the situation was more serious than it actually was, which in turn caused him to start rushing without sufficient forethought. He initiated the approach without checking with Kuznetsov and without circling to assess the condition of the airplane, even though he wanted to do so, as evidenced by his abortive request for a holding pattern. The once, the approach began, he again displayed poor judgment when he decided to continue to touchdown despite windshear and glideslope warnings.
All of the above decisions reflect poorly on Yevdokimov’s attitude. To explain these personal deficiencies, the MAK report cites certain psychological factors identified in his psychological exam, but this section was redacted from the report due to Russian privacy laws.
The series of hard landings were primarily caused by poor piloting skill, with the captain’s poor understanding of Direct Mode as a contributing factor. However, I view these issues as primarily training-related and will discuss them in part 8.3. Before concluding this section, I want to mention that Yevdokimov correctly decided to go around after the second bounce, but was thwarted because he had already deployed the thrust reversers. Going around after deploying the reversers is a violation of standard operating procedures for precisely this reason. Considering the above, Yevdokimov was in a situation where the bounced landing procedures required him to go around, but the reverser deployment rule required the opposite. The answer to this contradiction is to avoid selecting reverse thrust until after the spoilers have deployed, which should prevent the plane from bouncing. In Normal Mode, this happens automatically, but in Direct Mode the pilot has to remember to deploy the spoilers, which Yevdokimov didn’t. As a result, the MAK recommended that UAC enable automatic spoiler deployment in Direct Mode.
◊◊◊
Part 8.3: The Airline
In its final report, the MAK reserved its harshest words for Aeroflot. The investigation identified major issues with Aeroflot’s training program, many of which stemmed from what the MAK considered to be a “bare minimum” attitude among Aeroflot’s training and management staff. In their view, following the letter of the regulations is not that helpful unless the airline also follows the spirit — specifically, by evaluating where the training program could better prepare pilots for actual operations, even if all the required elements are already present. Further, the MAK wrote, “The flight crew training programs contained a number of provisions that allowed for ambiguous interpretations. Under such conditions, the airline’s management flight personnel, who were responsible for organizing initial and recurrent pilot training, ‘interpreted’ all ambiguities in the direction requiring less training.”
In the MAK’s opinion, Aeroflot’s training program should have identified and corrected Captain Yevdokimov’s flawed flare and landing techniques as a matter of course. It did not do so because of multiple serious problems, including high instructor turnover, which the MAK felt was the result of Aeroflot’s excessively rapid expansion of its SSJ-100 fleet. A poorly functioning safety management system also contributed.
Pitch down inputs during the flare can be a sign that the pilot lacks theoretical knowledge of the aircraft-sidestick control loop. With such understanding, a pilot can predict that a nose down pitch input at such a low altitude will cause an increase in descent rate that they will not have time to arrest before the plane hits the ground. An airline’s training program should not produce pilots who regularly and predictably make this kind of basic skill error.
In addition to issues of general piloting skill, the MAK strongly criticized Aeroflot’s training on flight in Direct Mode. I discussed many of the issues with this training back in Part 3, but the problems boiled down to the following:
- Despite frequent Direct Mode reversion incidents, Direct Mode was not taught as a standalone emergency during recurrent training, but rather as a secondary part of an unreliable airspeed emergency.
- During the accident flight, Captain Yevdokimov persistently left the aircraft out of trim, made dynamic/oscillatory sidestick inputs, and failed to manually deploy the spoilers, all of which are signs of poor theoretical and practical knowledge of flight in Direct Mode. And yet there were no comments on his training record from instructors regarding similar behavior during simulator sessions, indicating insufficient monitoring of his performance.
- In six other Direct Mode reversion incidents involving Aeroflot SSJ-100s, the pilots made similar basic handling mistakes, clearly indicating a systemic lack of preparation.
- Yevdokimov only reset the trim when he made a configuration change, suggesting that this was the only time he had been taught to trim, when in fact he needed to re-trim every time there was a significant change in airspeed or flight path angle.
In a dissenting opinion appended to the final report, Aeroflot hit back at many of these accusations. The airline argued that it was unfair to criticize the scope of its training program because it contained all the required items, which is horribly shortsighted and demonstrates exactly the type of problematic attitude described by the MAK. Aeroflot also stated that there was no evidence that there were any problems with Yevdokimov’s landing technique on previous flights, despite data demonstrating otherwise, and further argued that a pilot’s technique should be judged by the outcome, and because there were no exceedances of key parameters during his previous landings, clearly nothing was wrong. Once again, this is a shortsighted and naïve position.
In addition to their incomprehensible statements about predictive windshear warnings, mentioned in Part 4, Aeroflot also defended its lax stabilized approach criteria and the policy of allowing pilots to ignore glideslope warnings after decision height, both of which the MAK considered unsafe. And regarding the spoilers, Aeroflot argued that the spoilers shouldn’t be deployed at first touchdown in Direct Mode because they impart a nose up moment that makes it hard to bring the nose gear down — despite the fact that the spoilers simultaneously help avert the much more serious risk of a bounce.
On the matter of weather, Aeroflot dismissed the notion that the pilots knowingly flew too close to a thunderstorm because the Vnukovo TDWR and the on-board weather radar weren’t calibrated to a common standard, and thus the MAK could not prove that the pilots saw red cells on their radar — even though the MAK tested this and found that the on-board weather radar display was more conservative than the TDWR and tended to show more red, not less.
After deflecting all blame from itself, Aeroflot decided to throw its fellow state-owned corporation UAC under the bus instead. Echoing Yevdokimov’s own statements, Aeroflot wrote that a reversion to Direct Mode should have been considered a “hazardous” rather than “major” failure because the degradation of performance is “significant” rather than “noticeable.” The airline argued that flying in Direct Mode is much harder for regular pilots than the MAK and the EASA test pilots believed, which is not a bad point, because as I stated in part 8.1, it’s relatively difficult to train a fly-by-wire pilot to transition flawlessly into Direct Mode. A “hazardous” designation would have required more redundancy to prevent an occurrence.
One other point made by Aeroflot that I do agree with is that the location of the trim switches is unergonomic, which ties into my argument about how the SSJ might have been better off with a Boeing-style trim system.
Lastly, Aeroflot blamed “the aircraft type design” for the collapse of the landing gear and ignition of the fire. In their view, the requirement to avoid “fuel spillage sufficient to constitute a fire hazard” could not be met using the testing criteria selected by UAC, even though those testing criteria met their own, separate set of requirements. Although I’m inclined to take the MAK’s position that this is more so a problem with the regulations themselves, it’s an argument that merits some consideration.
Overall, though, Aeroflot did itself a disservice with its dissenting opinion. The airline staked out several positions that are contrary to well-established best practices and failed to defend its flawed training process.
In its response to the dissenting opinion, the MAK revealed that it had spent a large portion of 2023 and 2024 carrying out additional tests at Aeroflot’s insistence, extending the investigation significantly, only for Aeroflot to reiterate the same tired concerns in its dissent. The MAK’s one page response went on to excoriate Aeroflot’s position on the causes of the accident, using the type of bureaucratic sarcasm that has always made the MAK stand out from the crowd. I’ll let the following quotation stand for itself.
“The author of the Dissenting Opinion proposes to exclude from the Conclusion section virtually all contributing factors associated with the organization of the flight operations and the establishment of the SMS at the airline, as well as with the crew’s adherence to standard operating procedures during the accident flight.
“Essentially, if one takes the Dissenting Opinion author’s point of view, it turns out that a crew trained in accordance with all applicable documents and standards, who had been debriefed in a proactive manner on all previous occurrences of Direct Mode reversion at the airline and trained in a simulator on these specific in-flight emergencies, pursuant to all effective FAR, OM, and SOP provisions, accidentally entered an area of thunderstorm activity, which resulted in the aircraft’s exposure to lightning and the reversion of the FBWCS to Direct Mode, and performed an approach without experiencing any issues with piloting or trim operation, during which they reasonably disregarded windshear and glideslope warnings, only to fail, at the moment of flare and landing, to control the aircraft and correct the deviations at touchdown, solely as the result of deficient aircraft stability and controllability properties in DIRECT MODE that were not identified in a timely manner during testing, as well as deficiencies in the manufacturer’s documentation.
“In fact, the author of the Dissenting Opinion suggests that the Commission should conclude that it identified no deficiencies causal to the accident in the organization of flight operations or the functioning of the SMS at the airline, nor in the flight crew actions. The Commission observes that the aforementioned stand by the author of the Dissenting Opinion is totally contrary to the established hard evidence presented in various sections of the Final Report, as well as to the results of the analysis conducted by the Commission, and is an overt defense of the esprit de corps of the interested party, represented by the author of the Dissenting Opinion.”
◊◊◊
Although MAK reports are notorious for including lengthy dissenting opinions from Rosaviatsiya and equally lengthy counter-opinions from the investigation commission, this accident was largely an exception. Rosaviatsiya did submit a dissenting opinion, as always, but it was only one page long and surprisingly bland compared to its past submissions. Despite the MAK’s heavy criticism of Rosaviatsiya’s failure to investigate several previous Direct Mode reversion incidents, the Rosaviatsiya representative didn’t attempt to defend against these accusations in their dissent. Instead, they only argued that that the MAK should not conclude that the training program was inadequate to prepare the crew if it met the minimum regulatory requirements; and that the contents of the Rosaviatsiya-approved training program were not the cause of the pilots’ handling difficulties, for which they blamed Aeroflot’s failure to instill basic pilot competencies. In its response, the MAK dismissed these arguments but accepted Rosaviatsiya’s proposed recommendation that aircraft manufacturers clearly establish which types of emergencies must be practiced individually instead of in concert with another emergency.
◊◊◊
What I wanted to convey in this final chapter is that despite widespread reductive speculation, the accident was not solely caused by the pilot, the airline, or the airplane. Instead, the accident was the result of a convergence of numerous deficiencies associated with all three, none of which were causal by themselves, but were causal in concert. Furthermore, the breadth and depth of the deficiencies identified in this investigation was such that it calls into question the safety of Russia’s entire aviation sector. The issue isn’t really that rules were being violated; in fact, relatively few causal or contributory factors were the result of overt regulatory violations. Instead, the issue is that Russian civil aviation is afflicted by an attitude problem — a lack of curiosity, a lack of willpower, and a lack of interest in the goal of safety itself. Every involved party, from the pilots to Aeroflot to UAC to Rosaviatsiya, at least vaguely tried to follow some of the rules, but no one expressed any ambition. Most people were just going through the motions.
I know as a matter of personal experience that there are many people in Russia who are genuinely dedicated to doing things right, and I have no doubt that many of them work in the aviation industry. Granted, many of the best have left since 2022, but plenty remain. The problem is that apathy has been enshrined on an institutional level, trapping the people who care under the weight of those who do not, or who choose not to for purposes of survival. Such a culture is not easily rooted out.
The MAK’s final report contains 49 recommendations to improve everything from simulator record-keeping to the location of the SSJ’s on-board megaphones. Many of these recommendations directly address the deficiencies described throughout this article. But despite the passage of more than 6 years since the crash, the section of the report listing safety actions taken to date contains only one entry, concerning an update to Russia’s USSR-era airport fire rescue standards. This is an abysmally inadequate response. Where is the outrage? Where is the commitment to “never again”? How many times will I have to write about people perishing in a Russian aircraft because nobody cared about doing it right? How long will airlines and manufacturers and Rosaviatsiya keep up their circular finger-pointing exercise, just to maintain the illusion that it’s the other guy who needs to change? Until the next accident I suppose — and what then?
In an increasingly isolated Russia, my words as a foreigner mean less than nothing. And from the other side, a few might criticize me for caring about Russian airline safety at all. But I still think this is a story that should be told, because it was a real thing that happened to real people in a real place, and even if that story disappears into Russia’s apathetic churn, perhaps we can make something of it here.
_______________________________________________________________
Dear readers — I couldn’t have conducted this far-reaching, at times exhausting research and writing project without your support on Patreon. This article took countless hours of work, a lot of late nights, and an unhealthy amount of sour gummy candies to finish. I probably cried at least a couple times; I’ve lost track. My gratitude to all of you is endless. — Kyra
_______________________________________________________________
Don’t forget to listen to Controlled Pod Into Terrain, my podcast (with slides!), where I discuss aerospace disasters with my cohosts Ariadne and J! Check out our channel here, and listen to our latest episode about a titanic battle between a BAC 1–11 and some wind. Alternatively, download audio-only versions via RSS.com, or look us up on Spotify!
_______________________________________________________________
Join the discussion of this article on Reddit
Support me on Patreon (Note: I do not earn money from views on Medium!)
Visit r/admiralcloudberg to read and discuss over 260 similar articles