Crash of a Sukhoi Superjet 100-95B in Moscow: 41 killed
Date & Time:
May 5, 2019 at 1830 LT
Operator:
Registration:
RA-89098
Survivors:
Yes
Schedule:
Moscow - Murmansk
MSN:
95135
YOM:
2017
Flight number:
SU1492
Crew on board:
5
Crew fatalities:
Pax on board:
73
Pax fatalities:
Other fatalities:
Total fatalities:
41
Captain / Total hours on type:
1570.00
Copilot / Total hours on type:
624
Aircraft flight hours:
2710
Aircraft flight cycles:
1658
Circumstances:
On May 05, 2019 the Aeroflot, PJSC flight crew out of the PIC and F/O was performing the SU-1492 scheduled passenger flight en route from Sheremetyevo airport (UUEE) to Murmansk airport (ULMM) aboard the RRJ-95B RA-89098 aircraft. 3 cabin crew members were also indicated in the flight assignment. The crew arrived to the airport at about 2 hrs prior to departure. After having undergone the mandatory preflight procedures (the medical check, briefing etc) the crew took up their duties at the flight deck. The passengers boarding was proceeded through the left front door. By 14:40 all the passenger and baggage holds doors had been closed. At 14:45:30 the ATC officer approved the engines start up. At 14:50:15 the crew initiated taxiing. At 14:57:20, after having been issued the clearance, the crew lined up at RWY 24C, where held the position for about 5 min. At 15:02:23 the ATC officer issued clearance for takeoff. After takeoff at 15:03:36 at the QNH altitude of 1250 ft. (380 m), the radio altitude of 690 ft. (210 m) and the IAS of 160 kt (296 km/h) the A/P was engaged. At 15:03:56 the Sheremetyevo Radar ATC officer cleared the climb to the QFE 1200 m altitude as per the KN 24E SID. At 15:05:18 the Sheremetyevo Radar ATC officer instructed the crew to climb to FL60. At 15:05:33 the crew set QNE of 760 mm of mercury/1013 hPa. At 15:06:57 the Sheremetyevo Radar ATC officer instructed the crew to climb to FL70 and contact the Approach ATC. After having initiated the contact with the Approach ATC officer the crew was instructed to climb to FL90. Between 15:07:30 and 15:07:33 the dialogue as follows was recorded in the crew: PIC: «It is going to bump now», – F/O: «Crap», – PIC: «That's all right». At 15:07:34 the Approach ATC officer instructed to climb to FL100. At 15:08:03 the Approach ATC officer instructed to climb to FL110. After the F/O confirmed this instruction the CVR recorded the noise effect of 1.5 sec. duration, starting from 15:08:09.7. Most probably at that point the aircraft encountered the atmospheric electricity strike. At 15:08:11.9 the A/P was disconnected, accompanied by the respective sound warning, as well as by the reversion of the FBWCS to DIRECT MODE with the DIRECT MODE. DIRECT MODE synthetic voice triggered. The A/T continued to operate. The aircraft at that moment was proceeding flight in right roll of about 20°, passing FL89 (2700 m) in climb. From 15:08:16 the manual control from the left duty station was initiated. The aircraft was proceeding the right turn as per the KN 24E SID and climb. At 15:08:47 the A/T was disconnected with the «override» (the TLA was changed from ~ 29.5° to ~ 19°). The further flight was continued by a manual control at the FBWCS DIRECT MODE. At 15:09:17 the aircraft was pulled out of the right turn to a heading of about 60°. After a short discussion in the crew the PIC made the decision to return to the departure aerodrome and commanded the F/O to declare PAN–PAN (an urgency signal). After several unsuccessful attempts to establish contact with the ATC officer at the operating frequency with the use of VDR 1 (this radio unit was used for communications from the beginning of the flight), at 15:09:32, after discussion, the 7600 squawk code was set by the crew. At 15:09:35, the radio communication was resumed on the emergency frequency (121.5 MHz) with the use of VDR 2. After radio communication was restored, at 15:09:39, the F/O reported to the Approach ATC officer: «Moscow Approach, and we request return 14 -92, radio contact lost and aircraft in DIRECT MODE». The ATC officer instructed to descend to FL80. The maximum altitude the aircraft reached was 10600 ft. (3230 m) QNE. The crew replied: «Aeroflot 14-92, heading 0-57, descending 8-0». The flight further on until glideslope interception was proceeded by vectoring. At 15:24:38 to the ATC request on the approach type for landing the crew advised that it would be an ILS approach. At 15:26:30 the crew set the 7700 squawk code. The reason for setting was not reported to the ATC. At 15:27:20 the glideslope descent was initiated. At 15:27:51 the ATC officer relayed the weather information to the crew and cleared landing: «Aeroflot 14-92 surface wind 160 7, gusts 10 meters per second, runway 24L, cleared for landing». At 15:30:00 at the distance of ≈ 900 m off the RWY entry threshold and at IAS of 158 kt (293 km/h) there occurred the RWY first touchdown. The touchdown occurred practically on «three points», with the vertical acceleration of not less than 2.55G with a subsequent aircraft separation/bounce off the RWY. Another touchdown occurred in 2.2 sec. after the first one at the IAS of 155 kt (287 km/h). The touchdown occurred with the advancement on the NLG. Vertical acceleration amounted to not less than 5.85G. There occurred another aircraft bounce off the RWY. At 15:30:06 at the IAS of 140 kt (258 km/h) the third touchdown occurred with the vertical acceleration of not less than 5G. As a consequence of hard touchdowns the MLG legs and the airframe structural elements were destroyed with the fuel spillage and the subsequent onset of fire. Into the further movement of the aircraft there occurred its RWY veering off to the left. At 15:30:38 the airplane stopped. The aircraft stop occurred on the soil between TWY2 and TWY3 at the point with the reference position 55°58′06.20″ N, 37°24′07.20″ E, ∆h = 185 m, with true heading ≈ 128°. The distance off the RWY 24L entry threshold amounted to ≈ 2720 m, lateral deviation was about 110 m to the left off the RWY 24L centerline.
Probable cause:
The air accident to the RRJ-95B RA-89098 aircraft was caused by the uncoordinated control inputs by the PIC at the flare, landing and through the several repeated bounces of the aircraft off the RWY (the porpoising), having manifested in the several disproportionate alternating sidestick inputs in pitch with keeping the sidestick retained against each stop. The indicated control inputs had resulted in three hard touchdowns of the aircraft, as a consequence at the second and third touchdowns the absorbed energy significantly exceeded the maximum values, for which the structural integrity had been evaluated at the aircraft type certification, which led to the destruction of the airframe structural elements, the fuel tanks with the fuel spillage and the fire onset.
The contributing factors to the accident were:
- The ineffectiveness of the RRJ-95 flight personnel approved training programs as for the actions into the major failure condition//abnormal situation at the FBWCS reversion to DIRECT MODE and, consequently, the insufficient knowledge and skills at the flight crew members to operate the airplane in this mode. The training programs met the minimum requirements, determined by FAR, but did not account for the specific nature of a particular emergency;
- The ineffectiveness of the airline SMS in terms of the monitoring of the piloting sustainable skills development at the pilots, which prevented the identification and elimination of the PIC’s common systematic errors at the sidestick pitch control at the stage of landing, including these, associated with its forward inputs beyond neutral (to nose down) into the flare;
- The failure to identify the biases (hazards) in the airline flight crews’ piloting technique as far the previous events of the FBWCS reversion to DIRECT MODE are concerned and thus the failure to implement preventive measures;
- The aircraft operational documentation unclear wording in terms of the piloting peculiarities at flare and the correction of the deviations at the landing (counteracting the consecutive aircraft separations off the RWY);
- The failure of the crew to comply to the FAR and OM requirements at the flight preparation and performance at the actual and forecast thunderstorm activity, as well as at the availability to observe these zones on the weather radar display, which had resulted in the aircraft encounter the atmospheric electricity, the EIUs reboot and the FBWCS reversion to DIRECT MODE. As per the certification results the FBWCS reversion to DIRECT MODE had been assessed as «the major failure condition», the in-flight onset of «the major failure condition» at the lightning or static electricity exposure does not contradict the applicable certification requirements;
- The dramatic increase of the psycho emotional stress at the PIC because of the aircraft exposure to atmospheric electricity and the failure within a long time to ensure the acceptable piloting precision at the FBWCS in DIRECT MODE, which led to the psychological dominant mindset formation to perform immediate landing together with the lack of readiness to initiate go around (not go-around minded);
- Psychological personality traits of the flight crew members that determine their behavior in the stress environment, as well as the PIC’s insufficient training in human factor/performance and threat and error management approach, which prevented the objective assessment of his psycho emotional condition and the ability to control the airplane, to choose the optimal strategy to proceed the flight, as well as to establish the required interaction and CRM;
- The failure of the PIC to ensure the aircraft pitch trim under the manual control, including at the glideslope descent;
- The incorrect assessment of the situation by the crew at the Predictive Windshear warning (GO AROUND WINDSHEAR AHEAD) trigger at the flight on glideslope and, consequently, the non-initiation of a go-around maneuver, that resulted in the aircraft encounter the wind microburst at the early flare and affected the aircraft flight path. The documentation by the aircraft designer and the airline allows the crew to ignore the subject warning activation, if it made sure there is «no windshear threat», still the operational documentation and the OM do not integrate the respective clear criteria of «no threat»;
- The purposeful ducking under the glideslope by the PIC at the final approach (after passing DH);
- The difference between the airline OM provisions as for the crew actions at the glideslope warning activation (the excessive deviation off the glideslope equisignal zone) and the similar provisions in the aircraft designer documentation. Subject to the provisions of the aircraft designer documentation the crew should have performed go-around;
- The unjustified extension by the airline of the approach «stabilized condition» criteria as for the acceptable deviations range off the target speed, which at the actual IAS of 15 kt higher against the target one and the FBWCS in DIRECT MODE resulted in the unexpected for the PIC increased aircraft response to the sidestick input in pitch;
- The failure by the crew to carry out the SOP on the manual speed brakes deployment at the aircraft touchdown. The operational documentation unclear wording and the monitoring algorithms of the landing configuration, used at the aircraft that require to arm the speedbrakes for the automatic deployment, including at FBWCS in DIRECT MODE, in which the automatic deployment is disabled, degrade the crew’s situational awareness as for this aspect.
- The TR actuation after the first bounce off the RWY, which had made the subsequent go-around impossible. As per the results of the forensic medical examination the death of 40 out of 41 fatally injured people had been caused by the exposure to open flame, accompanied with the burns of the upper respiratory tract through the inhalation of hot air. The fire erupted after the aircraft third touchdown due to the disintegration of the wing fuel tanks and the fuel spillage. The fuel spillage occurred as due to the destruction at the landing gear retraction/extension actuating cylinders attachment points, as well as due to the destruction of the other wing parts. The landing gear structure had been damaged at the second touchdown that is at the third touchdown functioned beyond the expected operational conditions and had not been able to bear the applied landing loads as designed. The operation (destruction) of the landing gear fuse pins («weak links») at the second touchdown had been consistent with the design integrated logic. With that the loads, actually accomplished, had been less of those in use to demonstrate compliance to AR-25 item 25.721 at the aircraft type certification, which prevented the MLG legs to completely separate off the airplane structure (it is only the Attachment A fuse pins that had been destructed). No correlation between the certification requirements for the structure, including MLG legs structure, and the conditions for demonstrating their safe separation off results in actual significant risks of the fuel tanks disintegration and the fuel spillage even in case of compliance demonstration to every single of these requirements. At its very onset the fire by its nature had been the deflagration flash, which had been accompanied with an intense smoke release with the onset of a steady burning in two seconds. By the point of the evacuation initiation the fire had been propagated inside the cabin through a row of cabin windows at the rear fuselage along the right and left sides, with that the airworthiness standards do not set up the requirements for the cabin windows as to the external fire protection. That situation had been beyond the expected operational conditions as there had been no time margin (90 sec), at which the crew and passengers’ emergency evacuation is demonstrated at the type certification.
Most probably the following factors had contributed to the increase in the severity of the consequences:
- The running engines of the aircraft, having been not timely shut down by the crew;
- Large amount of fuel, spilling out of both wing panels, which penetrated the area of the exhaust-mixing nozzles, exposed directly to their jet streams;
- The inability to evacuate through both of the rear emergency exits;
- The manifestation of the flashover effect at the rear passenger cabin;
- The crush and panic among the passengers;
- The efforts by a number of passengers to pick up their carry-on luggage at the evacuation;
- The CFA’s error in operating the PACIS, and consequently the decline in the passengers’ situational awareness as for the evacuation procedure.
The contributing factors to the accident were:
- The ineffectiveness of the RRJ-95 flight personnel approved training programs as for the actions into the major failure condition//abnormal situation at the FBWCS reversion to DIRECT MODE and, consequently, the insufficient knowledge and skills at the flight crew members to operate the airplane in this mode. The training programs met the minimum requirements, determined by FAR, but did not account for the specific nature of a particular emergency;
- The ineffectiveness of the airline SMS in terms of the monitoring of the piloting sustainable skills development at the pilots, which prevented the identification and elimination of the PIC’s common systematic errors at the sidestick pitch control at the stage of landing, including these, associated with its forward inputs beyond neutral (to nose down) into the flare;
- The failure to identify the biases (hazards) in the airline flight crews’ piloting technique as far the previous events of the FBWCS reversion to DIRECT MODE are concerned and thus the failure to implement preventive measures;
- The aircraft operational documentation unclear wording in terms of the piloting peculiarities at flare and the correction of the deviations at the landing (counteracting the consecutive aircraft separations off the RWY);
- The failure of the crew to comply to the FAR and OM requirements at the flight preparation and performance at the actual and forecast thunderstorm activity, as well as at the availability to observe these zones on the weather radar display, which had resulted in the aircraft encounter the atmospheric electricity, the EIUs reboot and the FBWCS reversion to DIRECT MODE. As per the certification results the FBWCS reversion to DIRECT MODE had been assessed as «the major failure condition», the in-flight onset of «the major failure condition» at the lightning or static electricity exposure does not contradict the applicable certification requirements;
- The dramatic increase of the psycho emotional stress at the PIC because of the aircraft exposure to atmospheric electricity and the failure within a long time to ensure the acceptable piloting precision at the FBWCS in DIRECT MODE, which led to the psychological dominant mindset formation to perform immediate landing together with the lack of readiness to initiate go around (not go-around minded);
- Psychological personality traits of the flight crew members that determine their behavior in the stress environment, as well as the PIC’s insufficient training in human factor/performance and threat and error management approach, which prevented the objective assessment of his psycho emotional condition and the ability to control the airplane, to choose the optimal strategy to proceed the flight, as well as to establish the required interaction and CRM;
- The failure of the PIC to ensure the aircraft pitch trim under the manual control, including at the glideslope descent;
- The incorrect assessment of the situation by the crew at the Predictive Windshear warning (GO AROUND WINDSHEAR AHEAD) trigger at the flight on glideslope and, consequently, the non-initiation of a go-around maneuver, that resulted in the aircraft encounter the wind microburst at the early flare and affected the aircraft flight path. The documentation by the aircraft designer and the airline allows the crew to ignore the subject warning activation, if it made sure there is «no windshear threat», still the operational documentation and the OM do not integrate the respective clear criteria of «no threat»;
- The purposeful ducking under the glideslope by the PIC at the final approach (after passing DH);
- The difference between the airline OM provisions as for the crew actions at the glideslope warning activation (the excessive deviation off the glideslope equisignal zone) and the similar provisions in the aircraft designer documentation. Subject to the provisions of the aircraft designer documentation the crew should have performed go-around;
- The unjustified extension by the airline of the approach «stabilized condition» criteria as for the acceptable deviations range off the target speed, which at the actual IAS of 15 kt higher against the target one and the FBWCS in DIRECT MODE resulted in the unexpected for the PIC increased aircraft response to the sidestick input in pitch;
- The failure by the crew to carry out the SOP on the manual speed brakes deployment at the aircraft touchdown. The operational documentation unclear wording and the monitoring algorithms of the landing configuration, used at the aircraft that require to arm the speedbrakes for the automatic deployment, including at FBWCS in DIRECT MODE, in which the automatic deployment is disabled, degrade the crew’s situational awareness as for this aspect.
- The TR actuation after the first bounce off the RWY, which had made the subsequent go-around impossible. As per the results of the forensic medical examination the death of 40 out of 41 fatally injured people had been caused by the exposure to open flame, accompanied with the burns of the upper respiratory tract through the inhalation of hot air. The fire erupted after the aircraft third touchdown due to the disintegration of the wing fuel tanks and the fuel spillage. The fuel spillage occurred as due to the destruction at the landing gear retraction/extension actuating cylinders attachment points, as well as due to the destruction of the other wing parts. The landing gear structure had been damaged at the second touchdown that is at the third touchdown functioned beyond the expected operational conditions and had not been able to bear the applied landing loads as designed. The operation (destruction) of the landing gear fuse pins («weak links») at the second touchdown had been consistent with the design integrated logic. With that the loads, actually accomplished, had been less of those in use to demonstrate compliance to AR-25 item 25.721 at the aircraft type certification, which prevented the MLG legs to completely separate off the airplane structure (it is only the Attachment A fuse pins that had been destructed). No correlation between the certification requirements for the structure, including MLG legs structure, and the conditions for demonstrating their safe separation off results in actual significant risks of the fuel tanks disintegration and the fuel spillage even in case of compliance demonstration to every single of these requirements. At its very onset the fire by its nature had been the deflagration flash, which had been accompanied with an intense smoke release with the onset of a steady burning in two seconds. By the point of the evacuation initiation the fire had been propagated inside the cabin through a row of cabin windows at the rear fuselage along the right and left sides, with that the airworthiness standards do not set up the requirements for the cabin windows as to the external fire protection. That situation had been beyond the expected operational conditions as there had been no time margin (90 sec), at which the crew and passengers’ emergency evacuation is demonstrated at the type certification.
Most probably the following factors had contributed to the increase in the severity of the consequences:
- The running engines of the aircraft, having been not timely shut down by the crew;
- Large amount of fuel, spilling out of both wing panels, which penetrated the area of the exhaust-mixing nozzles, exposed directly to their jet streams;
- The inability to evacuate through both of the rear emergency exits;
- The manifestation of the flashover effect at the rear passenger cabin;
- The crush and panic among the passengers;
- The efforts by a number of passengers to pick up their carry-on luggage at the evacuation;
- The CFA’s error in operating the PACIS, and consequently the decline in the passengers’ situational awareness as for the evacuation procedure.
Final Report:
