Trial by Fire: The crash of Aeroflot flight 1492
admiralcloudberg.medium.com
admiralcloudberg.medium.com
80% - Pilot error. Poor adherence to procedures and checklists. Poor choices all around. Poor piloting in manual mode and botched touchdown. Part of the blame for this rests with Aeroflot, for putting such a pilot in the air.
15% - People retrieving their luggage slowed down the evacuation and increased death toll.
5% - Aircraft design. Could be improved in some areas, but no really serious bloopers.
~0% - Delayed emergency response. Not good, but partly caused by incorrect communication from pilot. Also, fire spread so fast, it's not likely they could have changed anything.
As pointed out in the article, if the pilot was so incompetent, why didn't they receive further training, or if truly untrainable, fired? The airline and regulator have the responsibility for doing so, and ending the investigation at "pilot error" guarantees that another incompetent pilot will crash another plane.
It reminds me of the parable of the junior developer who wipes the production database: one person may have pushed the button, but a lot of things had to go wrong to get there
It is very tempting to say "pilot error" but if you drive a car and the way the steering wheel responds to your input drastically changes in an instant, without you having experienced that way of the steering wheel reacting - is it your "error"?
Looking at my training, I had about 7-8 hours of dual training - landing, takeoff, radio/tower, spins/stalls (w00t) - before I flew solo. From there, my world slowly expanded to not getting lost, staying out of clouds, and other more advanced topics and areas further from home. Suspect it was another 40'ish hours of learning about crashing. :)
> I know as a matter of personal experience that there are many people in Russia who are genuinely dedicated to doing things right, and I have no doubt that many of them work in the aviation industry. Granted, many of the best have left since 2022, but plenty remain. The problem is that apathy has been enshrined on an institutional level, trapping the people who care under the weight of those who do not, or who choose not to for purposes of survival. Such a culture is not easily rooted out.
As the US gradually starts to resemble its former nemesis and we become numbed to the daily outrage, I can feel myself becoming increasingly resigned and so this passage touched a nerve. I worry what happens when we have driven out those in public service who were committed to doing what's right. Which becomes further dispiriting.
If you watch some traffic landing videos, Russian planes sometimes land on the front wheels, exactly because of overspeed. The belief that you need to land slightly faster than the speed in the manual, is very frequent. Some companies did change this recently, though.
And the plane in the OP was switched to "direct control mode". The default mode is like Airbus fly-by-wire where the yoke sets vertical speed. The direct control mode is like Boeing's. The pilots were not prepared for this kind of change.
Because humans are fallible. They will always make mistakes, especially under stress. The only way to achieve real safety is to build a system that works despite humans making mistakes. Pinning blame on individuals is how you avoid the hard work of actually improving safety.
You mentioned that they ignored the storm. There are multiple systemic ways to prevent that: clear rules that make it mandatory to avoid storms. Empowering the first officer to question unsafe decisions from the captain. A pre-takeoff checklist that requires the pilots to check weather conditions and discuss how to handle them. And of course training and certification procedures that ensure these things are actually done.
Yes, the pilot made grave errors. But not for the first time. It was the airline's job to notice that, put him into more intense training and if he really proves unable to improve, put him in a non-flying position. They completely failed to do any of that.
And the insidious thing is that if training and enforcement of safety procedures are lax, it creates an atmosphere where unsafe behavior is normalized and spreads, where people who know better are hesitant to point it out for fear of being seen as troublemakers.
Circumstances do matter, but they do not constitute a general license to dismiss personal responsibility, especially in occupations known to come with very high responsibility.
Hard landing by pilot error/poor training is probably the biggest factor. But "people retrieving their luggage" points to inadequate crew training and emergency response more than anything. I don't believe it's fair to principally blame the pax (over the crew) for the disaster. Perhaps in conjunction with the crew, who ought to undergo scrutiny first.
Wrt the pax taking luggage, fta "one of the flight attendants attempted to make a public address system announcement, “Seat belts off, leave everything, get out!” But she forgot to press the PA button and this command was broadcast to the cockpit via the interphone instead. Only a few passengers at the front heard the command to “leave everything.”"
If I read the article correctly, only three people from the rows behind those reported trying to take their luggage with them survived. It's not in the mentioned whether the people that caused the plug have themselves perished or survived; and tempting as is the speculation when one looks at the seating plan, suffice to say that if those people are still alive, they very probably will be forever haunted by their guilt.
Its revelation of how deeply flawed the systems, agencies, companies, and people involved in this accident carries a stark unsaid warning for the direction the United States is heading. Accountability, objectivity, expertise, and transparency are critical in so many aspects, and much like Chernobyl, this article reveals how hardly perceptible erosions of these values build up to untenable states of affairs. Ignoring the warning signs brings down empires.
Side note: The author even included a little nugget for the HN crowd:
> Aeroflot’s dissenting opinion was typed up in a Microsoft Word document, or similar, with default settings. I don’t know why but I find that vaguely amusing.
One thing that is very noticeable is that since 2022, incidents in Russia largely no longer show up on avherald. I'm not sure if this is because the website no longer reports them, or because reports are not made in Russia, but it makes me feel a lot less comfortable.
In general it has become incredibly hard to judge the safety of Russia's aviation from the west.
But we already know aviation safety in Russia is on a downward spiral, because the sanctions make it very difficult to get spare parts and, as the article notes, even notionally Russian aircraft like the SSJ-100 still rely on numerous Western parts.
I know, but last time I was looking they were all sourced from some telegram channels and none of had official data associated with it.
Can't they get such western parts thru China?
Also, the west can't just sanction China. The US just raised tariffs on China, and it already had bad consequences. Outright sanctioning it would be even worse.
AFAIK most stuff is smuggled through countries in Central Asia and the Caucasus (with no negative consequences for those countries; the opposite really..)
Sanctions really don't work in aviation either. Iran has faced harsh sanctions through the 2000's, yet they've kept flying Western made planes, lately even newer models. Similar story with Cuba, somehow they operated ATR turboprops for decades, and those certainly do have American made parts.
If you have the money, somebody will supply you the parts.
The crash described in the article is from 2019, so before meaningful sanctions against Russia were implemented. Also, the article makes a pretty good job at mentioning other factors that also contribute to Russia's bad aviation safety:
> The MAK’s final report contains 49 recommendations to improve everything from simulator record-keeping to the location of the SSJ’s on-board megaphones. Many of these recommendations directly address the deficiencies described throughout this article. But despite the passage of more than 6 years since the crash, the section of the report listing safety actions taken to date contains only one entry, concerning an update to Russia’s USSR-era airport fire rescue standards. This is an abysmally inadequate response. Where is the outrage? Where is the commitment to “never again”?
One of the patterns I try to follow in designing our operations is that the tasks we need to follow in an emergency should be as close to routine as we can make them. We don't have a manual override to deploy into production in case of emergency, we make sure that our normal deploy process is suitable for emergency use. Which means we won't make the emergency worse by messing up a manual deploy.
Similarly, my car has some fancy drive-by-wire features -- the steering is dynamic, and the throttle balances the electric motor and petrol engine seamlessly. But the manufacturer didn't change anything fundamental about the controls, and if the power steering fails (or the cruise control stops working, or the radar can't track the vehicle in front) I lose some affordances and some safety systems but I can still drive the car.
It is true that the non-normal modes are supposed to only very infrequently activate, but with that in mind it should surely be more important to not drop users into a totally different control regime?
Hoping someone has some more insight. I don't have anything to do with avionics in general, and the day job isn't safety-critical, but I'm always keen to learn and I've definitely learned a lot over the years that I can apply to the day job by reading about how people design systems to stay safe when a failure means loss of life.
I am similarly confused at the lack of sustained training in direct law/mode flight. The primary reason for the difference in operation is convenience and smoothness of flight achieved by intentional control stick movements as opposed to direct aerodynamic surface control, but like the article said pilots should have a comprehensive mental operating model of what the "normal" law/mode is producing at the control surfaces.
There's really no comparison to an emergency fallback mode on an airliner.
In this case, if your IMU or airspeed data looks bad, your attitude estimate can’t be relied on and you can’t be certain that any derived values you’re controlling to are valid or stable. Current designs assume the best course of action in those cases is to hand control over to the pilot.
Airbus's Normal Law sounds more akin to a car that maintains its current speed and rate of turn if no inputs are given, so if you lift your foot off the accelerator then the car doesn't slow down and if you let go of the steering wheel then it doesn't wobble or re-centre. It might be easier to drive when the assistance is working, but it's not going to be easy to transition to regular brake, accelerator, and steering functions if the assistance needs to switch off.
I think really the biggest difference between the two systems is that ADAS does not abstract away nearly so many actions. Once direct mode is activated, obviously you suddenly have to start doing all the low-frequency yoke movement, but then you also need to work rudders to coordinate your turns, trim control surfaces, etc., etc., and if you are unaware that the mode has changed then it is not going to go well.
That is shocking, but not that shocking if you're familiar with how things are done in those parts.
So SSJ doesn't implement Alternate Law (mode) only Direct Law, but Sukhoi inserted Alternate Law descriptions from Airbus into the manual anyway. Just yolo copy-paste basically.
> UAC calculated that the probability of a Direct Mode reversion should be approximately 1 per 1.64 million flight hours [...] In 2015 alone, there were three such events, even though the entire SSJ fleet had accumulated just 81,000 flying hours
Heh "Our SLA is still in play, we just extended the time we'll average it by to 100 years"
The article later points out that the many Direct Mode reversions probably have something to do with the Electronic Interface Units (EIUs) which are responsible for making sure the various off-the-shelf Western components (which were apparently not customized due to cost reasons) could talk to each other. So the only Russian-made (and thus technologically not so advanced) component in your design is also a single point of failure. What could go wrong?
Agree, that's probably what happened, yeah. It was probably a planned feature they had to cut at the last minute.
I'm always astounded by the self-centeredness humans are capable of.
> In one sense, this blame is constructive insofar as shame is an effective motivator for people who might otherwise try to get their luggage during a future evacuation. However, research has shown that when untrained civilians are unexpectedly placed into an emergency aboard an aircraft, many people’s brains revert to what they already know, which is to stand up, grab their bags, and walk to the exit, as though nothing is wrong. This behavioral tendency can be short-circuited if the flight attendants loudly and assertively order passengers to leave their bags behind and exit immediately. But on flight 1492, the order to leave bags behind was not heard by the majority of the passengers because the senior flight attendant forgot to press the PA button before making the announcement.
In this instance I'm sorry but this is the wrong take. The fantastic article directly addresses that in fact, and it jives with what I was taught as part of first responder and mountain rescue training in the US, as well as have heard from EMTs and volunteer firefighters I know:
>"However, research has shown that when untrained civilians are unexpectedly placed into an emergency aboard an aircraft, many people’s brains revert to what they already know, which is to stand up, grab their bags, and walk to the exit, as though nothing is wrong. This behavioral tendency can be short-circuited if the flight attendants loudly and assertively order passengers to leave their bags behind and exit immediately. But on flight 1492, the order to leave bags behind was not heard by the majority of the passengers because the senior flight attendant forgot to press the PA button before making the announcement."
Again, this jives with everything from military to emergency response of all sorts: in high stress maximal flight/fight rapid response sorts of situations, humans tend to (a) revert to whatever "muscle memory" or drilled in training they've got, if any, or else whatever basic instinct/patterns they've developed, (b) follow authoritative instructions, if available and simply/rapidly understandable, (c) panic, or (d) freeze up. Just as with everything else with safety, humans must be recognized as humans and be part of an overall systemic approach if we wish to improve outcomes as much as possible.
So if you're dealing with untrained random civilians who have no particular "muscle memory" to draw on beyond the typical, then crew procedures, aircraft design etc have to account for that. That's just part of the responsibility of running a civilian facing service involving life/safety. Better training for the cabin crew might have helped here just as better training could have prevented the situation happening at all, and identically better mechanical designs might also have helped and be worth considering in principle if this was frequent enough. This could range from how PA systems work (perhaps when an emergency landing is triggered, PA should automatically go to open mode and stay that way, or perhaps the evac warning including "LEAVE ALL BAGS BEHIND, EVACUATE NOW OR DIE" should be fully automated and just start broadcasting once emergency slides are deployed) to having overhead bins automatically seal and be impossible to open so somebody could at most spend a few seconds trying before realizing they can't (this would require actual study and cost/benefit tradeoff investigation of course). But the take away in disasters should not be any sort of moral one liner. These are massive systems with large numbers of people being forced to deal with a (literally here) by-the-second lethal scenario. Safety is a systemic issue.
But I was already expecting it rather sooner than later, and his retirement is certainly well deserved. I hope he enjoys it, and maybe his face comes up again some time.
Also, pretty low volume but also low sensationalism the Australian regulator, ATSB, posts report summaries on YouTube.
(Dan Gryder is, IMO, on the opposite end of the spectrum from Juan.)
VASAviation has a bunch of radar recreations, but if you’re new to aviation safety and never flown under ATC, you might not get as much from it as you would from a more commentary-based treatment: https://youtube.com/@vasaviation?si=__ZSdYSR1YgTOpge
543653347
Short answer: Pilot training deficiency was the major contributing factor, Aeroflot the party responsible, but other factors contributed:
- After the accident, the MAK sought to verify how much time was actually spent flying in Direct Mode during initial and recurrent training at Aeroflot, but they ran up against a brick wall of silence.
- The MAK acquired data from seven Direct Mode reversion events between 2015 and 2018, including six from Aeroflot and one from another Russian airline, and the results painted a dismal picture of Russian pilots’ ability to handle this type of emergency.
"Manufacturer was not blameless either"
- at the time of the accident the flight crew operations manual (FCOM, a Sukhoi product) contained descriptions of Airbus controls laws instead of SSJ control laws...
- UAC calculated that the probability of a Direct Mode reversion should be approximately 1 per 1.64 million flight hours... By 2022, the number of known Direct Mode reversions had risen to 21, for a rate of 1 per 63,000 flight hours
"Notable pilot errors"
- once he initiated a descent, the original trim setting became wildly inappropriate for the flight conditions...
Pilots ignored “GO AROUND, WINDSHEAR AHEAD" warning
- pitch angle -1.7 ...when the plane touched down on the runway. But instead of applying the recovery maneuver described in the FCOM, Yevdokimov suddenly reversed his input from full nose up to full nose down.
"Stress factors aggravated situation"
- Yevdokimov beginning to speak before pressing the push-to-talk button, and releasing the button before he was done — a known sign of elevated stress.
"Random factors were not on their side either"
- In an unfortunate coincidence, Yevdokimov’s request overlapped with a transmission from another aircraft on the standard frequency and the controller never heard it..
- The SSJ’s landing gear, which was designed and produced by French company Safran. As it turns out, the second impact fell into a gray area where the load was sufficient to break the fuse pins attaching the forward end of the landing gear crossarm to the wing box rear spar, but not the fuse pins for the drag brace or crossbeam.
"Some desperate heroics prevented the worst-case scenario like in Saudia Flight 163"
- Exercising her prerogative, Senior Flight Attendant Kseniya Fogel’ stood up from her seat as soon as the aircraft stopped and opened the R1 door without waiting for a command by the pilots. By 18:30:46, just eight seconds after the plane came to a stop, the door opened and the slide began deploying...
- Video evidence showed that within one second of the first passenger leaving the plane, and possibly even earlier, the fire breached the fuselage and began spreading into the cabin itself....
- Also still on the airplane was the passenger from seat 12A, who encountered First Officer Kuznetsov just outside the cockpit and decided to stay to help more passengers
"Final words and predictable aftermath"
- In its final report, the MAK reserved its harshest words for Aeroflot.
- The MAK’s final report contains 49 recommendations to improve everything. But despite the passage of more than 6 years since the crash, the section of the report listing safety actions taken to date contains only one entry, concerning an update to Russia’s USSR-era airport fire rescue standards
It feels like we’ve optimized for normal conditions, but when things go sideways, we rely on the pilot to do the impossible — often without the tools, training, or time.