Description

On 27 December 1991, an MCDONNELL DOUGLAS MD-81 (OY-KHO) being operated by Scandinavian Airlines System (SAS) on a scheduled international passenger flight from Stockholm Arlanda to Copenhagen as SK751 experienced total engine failure in day IMC a few minutes after taking off from Arlanda. The flight crew were subsequently able to successfully crash land it on open ground just over four minutes after take-off after emerging from cloud at about 900 feet agl. The aircraft was destroyed but all occupants survived. Serious injuries were sustained by 8 of the 129 occupants and minor injuries by another 84 but the remaining 37 were uninjured.

Investigation

An Investigation was carried out by the Swedish Board of Accident Investigation (SHK). The DFDR, QAR and 30 minute CVR were recovered from the wreckage and most of their data were successfully downloaded. ATC recordings were available and could be synchronised with the CVR data.

The 44 year-old Captain had accumulated a total of 8,020 total flying hours which included 590 hours on type. He had completed type conversion 16 months prior to the accident after 6 years as a Fokker F27 pilot. The 34 year-old First Officer had accumulated a total of 3,015 total flying hours which included 76 hours on type. He had completed type conversion a year prior to the accident and almost all hours on type had been flown in the 90 days prior to it. During the flight, a positioning 47 year-old SAS MD80 series Captain with 920 hours on type was able to assist the operating crew.

What Happened

It was established that the aircraft had been operating the first flight of the day after overnight parking outside in air temperatures which were around 0°C. The aircraft had arrived at Arlanda the previous evening with approximately two thirds of the fuel required for the next morning's departure already on board. As the aircraft departure time approached, there was intermittent light snow and the air temperature, which had thus far been just above zero, fell very slightly to -0 °C. The Captain relied on SAS Line Maintenance personnel to inspect the airframe and as a result the ground de icing treatment with heated Type 1 fluid specifically included the underside of the wings where frost had been seen. Prior to de icing, the upper wing surface had been inspected by an engineer who found some slush there but no ice. There was no discussion between the Captain and the engineers about clear ice either before or after de icing.

The aircraft took about 2½ minutes to taxi to the departure runway and with take-off clearance given, a rolling take-off was performed with the Captain as PF and the A/T engaged. The Captain subsequently reported that as he had rotated the aircraft, he had heard an abnormal noise which he could not identify. This was recorded on the CVR as a "low hum" and coincided with three passengers' reports of seeing ice coming off the upper wing surface.

After about 25 seconds, as the aircraft was climbing in cloud through a recorded 1,124 feet QNH with the AP not yet engaged, "bangs, vibrations and jerks were perceived inside the aircraft", the latter being described as "like heavy braking". The pilots recognised that the source was the right engine and suspected a compressor stall and reported that the vibrations had made it difficult to read the EFIS screen presentation of the engine instrument. Passing approximately 2,000 feet QNH, a slight (10%) reduction in right engine thrust was made but the vibrations persisted. DFDR/QAR data showed by the time this change was made, throttle control had changed to an automatic mode unknown to the pilots (Automatic Thrust Restoration - ATR, see further on this later) in which thrust had already been increased by about 7% above take-off thrust on both engines without the pilots noticing.

About 40 seconds after the right engine had begun to malfunction, recorded data showed a first surge on the left engine which had gone unnoticed by the pilots. The right engine failed approximately ten seconds later followed by the left engine two seconds later with the aircraft at 3,206 feet QNH and after continuing to climb just over 100 feet more, a descent began. As the engines failed, the EFIS screens blanked and the Captain continued by reference to the SBY electro-mechanical ADI. The First Officer noticed that the engine temperatures had remained high after their failure and when the left engine fire warning was annunciated, he operated the corresponding fire extinguisher and the warning ceased after 26 seconds.

A uniformed SAS Captain seated near the front of the cabin realised that the crew were having problems and went forward to ask if he could be of any help. In response, "the First Officer gave him the Emergency / Malfunction Checklist and the Captain instructed him to start the APU". The assisting Captain's voice was subsequently recorded several times urging the Captain to "look straight ahead". The Captain maintained a shallow descent in cloud onto a northerly heading whilst the First Officer declared an emergency to ATC who in response to his request cleared the aircraft to turn back and land. The Captain announced several times "prepare for on ground emergency" and on being advised by the assisting Captain, the senior cabin crew made a corresponding announcement on the PA. With the aircraft still in cloud on a northerly heading and descending through 1,380 feet QNH, the assisting Captain began progressively extending the flaps, completing this in 30 seconds as the aircraft passed 980 feet QNH. About this time, the aircraft emerged from cloud and flight by visual reference to the terrain below became possible. The captain selected a field in the direction of travel for an emergency landing attempt, making a small heading change to avoid some houses. The First Officer asked if the gear should be selected down and, on being so instructed by the assisting Captain, did so. ATC were advised of imminent terrain impact and approximately 4 minutes after take-off, trees were struck and most of the right wing detached causing a bank to the right. The aircraft hit gently downward-sloping frozen ground tail first and the fuselage broke in two places but slid as one object for about 110 metres before stopping. There was no fire and all but four of the occupants were able to exit the wreckage unaided, about half of them via the openings caused by the break up of the fuselage. An annotated reconstruction of the flight path was made during the Investigation and is reproduced below.

The Engine Failures

No evidence was found that the two engines which failed had been other than fully functional as the flight began take-off. A detailed examination of recorded flight data, what remained of the subsequently removed engines and around 500 engine parts which had been ejected as the engines failed was made. It was found that the engine damage caused by the aerodynamic and mechanical stresses created by the ice-induced surging had begun with failure of the stage 1 stators and debris from them had then moved aft causing further damage and additional debris which circulated within the engines or was ejected. Much of the ground engine debris was found below the position where FDR data showed that engine failure had occurred.

It was noted by the Investigation that "normally, repeated surges cease if the power setting is reduced sufficiently" and also that "engine surging entails very great thermal and mechanical strains" which can cause significant engine damage. It also noted that the surge margins on the engines fitted to MD 80 series aircraft were little changed from those on the earlier DC9 from which the MD80 series had been developed.

FDR data showed that the Automatic Thrust Restoration (ATR) system, which is automatically armed once the height after take-off exceeds 350 feet agl unless engine thrust is already at 'Go Around', had activated automatically when the right engine began surging 25 seconds after lift off. After 10 seconds, the ATR activated as per system design which cancelled the A/T take-off setting and increased both engine thrust settings to 'Go Around'. This would have moved both thrust levers forward and provided confirmation of this through changed indications on both the FMA (from CLMP to EPR G/A) and on the EPR selector Panel (from T/O to GA). This increase had "contributed to the fact that the surging continued and intensified" until the engine finally broke up after 51 seconds of surging. The increased thrust led to surging beginning in the left engine 12 seconds before the right engine failed and because thrust was now higher, this engine failed after just 14 seconds of surging.

It was noted that there was no evidence that either engine had any other damage when surging started other than limited damage that had occurred to the fan stages when the aircraft lifted off. It was considered that this damage "was probably not so extensive as to prevent surging in the right engine from stopping if power had been reduced sufficiently" and it could then have been used at reduced thrust. It was further considered that surging would probably not have occurred at all in the left engine had take-off thrust not been automatically increased by activation of the ATR system. On that basis, it was concluded that "with sufficiently reduced thrust on the right engine and maintained thrust on the left, the engines would probably not have failed (and) the aircraft would then have been able to return (to Arlanda) for a landing".

The fact that the crew did not reduce thrust so as to stop the surging and prevent the rapid destruction of both engines was attributed to two things:

• The Investigation found that at the time of the accident, "there was no knowledge of ATR within SAS" and their MD80 pilots were therefore not trained on it nor was there any reference to it in their Operations Manual. Yet the system was covered in both the AFM and the McDonnell Douglas FCOM which it was considered were "manuals which every operator is obliged to know". Had the pilots been aware of the ATR system, they would have been more likely to recognise the automatic increase in engine thrust that accelerated the destruction of both engines and nullified the Captain's attempt to reduce thrust on the right hand engine. It was concluded that this failure by SAS represented "a serious deficiency in flight safety".
• Despite the fact that the Emergency Checklist procedure for Engine Surging could end in engine shutdown, no part of it was identified in the Checklist as a memory recall procedure.

The formation and undetected presence of Clear Ice

The accident aircraft had been parked in the open overnight prior to the accident flight in air temperatures around 0°C with 2,550kg of cold-soaked fuel in each wing tank which represented 60 % of tank capacity. The Captain, aware of the potential effect of this on the lower wing surfaces, had taken steps to satisfy himself that they were ice-free but had shown no similar concern in respect of the most vulnerable part of the wing upper surfaces.

The risk of clear ice ingestion by rear-mounted engines was already recognised prior to the accident and there was a history of related incidents which included SAS-operated aircraft and others in northern Europe - a 1985 report on the subject by Finnair who also had a large fleet of aircraft with rear-mounted engines was noted by the Investigation as having "described undiscovered, un-removed clear ice as the most difficult systemic threat to flight safety today". Two months prior to the accident, SAS had distributed their usual pre-winter season Bulletin to pilots reminding them that it was the aircraft commander's responsibility to check the aircraft for any ice or snow which may affect aircraft performance. This Bulletin explicitly highlighted the clear ice risk, remarking that "although awareness within line maintenance is mostly good", the aircraft commander was responsible for ensuring that "the aircraft is physically checked by means of a hands-on check on the upper side of the wing" and that "a visual check from a ladder or when standing on the ground is not enough". However, it was noted that the accident aircraft crew did not follow this guidance and line maintenance did not use the directed technique on the crew's behalf. It was noted that neither the MD80 Pilot Study Guide, self-administered CBT or the instructions in the Operations Manual on the pre-flight external inspection included any information on "the clear ice problem". Guidance for Line Maintenance personnel extant at the time of the accident was found to be similarly deficient, in particular but not only by not requiring a check both before and after a de icing treatment. This meant that since the engineer who had inspected the wings before de icing started and failed to detect any clear ice on the upper wing "had no reason […] to check this again after de icing".

It was noted that the risk of clear ice formation on the upper surface of the wing near the wing root on MD80 series aircraft was greater than on their DC-9 predecessors in that the centre fuel tank, from which fuel is used first, was extended into the wing root with the consequence that the innermost parts of the wing tanks, which with dihedral wings will almost always contain cold unused fuel, were thereby aligned with the intakes of the rear-mounted engines. This meant that clear ice could readily form on this part of the upper wing surface due to fuel in contact with that surface when such contact and any resulting clear ice would normally only be found on the lower wing surface.

It was also noted that an effective inspection of the upper wing for the presence of clear ice before or after de icing would have required the person carrying out such an inspection "to have gone out onto the wing, which was slippery".

Other Matters of Concern

The Investigation found a number of other areas of concern including:

• In respect of the survival of all occupants, it was noted that this must be attributed not only to the way in which the forced landing was accomplished but also to a series of "fortunate circumstances". The presence on emergence from cloud of a possible landing site in a generally forested area, the opportunities for escape from the wreckage provided by the breakup of the fuselage into three parts which more than made up for the fact that not all of the emergency exits were useable and most crucial of all the absence of a post crash fire despite the large quantity of fuel spread over the crash site were cited. It was calculated that occupants in the front part of the aircraft would have experienced "stresses (which) were near the limit beyond which serious injury is inevitable".
• Whilst the overhead stowage bins in the passenger cabin met certification requirements and were not overloaded, many fell from their mountings and the doors of many others opened allowing baggage to fall out. This was considered to indicate that certification requirements were inadequate.
• There were significant concerns about two aspects of aircraft type certification:
  • No account was taken in the relevant FAA regulations of the risk of FOD damage to rear-mounted engines from airframe ice.
  • The Grandfather Rights which had enabled MD80 series aircraft certification in 1980 to rely on the original 1965 type certification was considered to be inherently undesirable since the substantially re-designed MD80 series aircraft did not need to automatically comply with airworthiness regulations which had been introduced between 1965 and 1980.
• Cabin safety concerns included the inability of cabin crew seated at their respective stations to reach their emergency instructions without leaving their seats, the requirements for securing loose galley equipment and the central location of one of the rear cabin crew seats which, whilst enabling a view forward along the aisle, also obstructed the rear emergency exit when in use.
• Various "shortcomings" were identified in respect of the rescue operation, most of which it was considered could be attributed "almost exclusively" to the fact that personnel from the various participating agencies had not undertaken sufficient joint training.

A 'Near Miss' on the same day?

The Investigation found that there had been a very similar occurrence on the same day as the investigated accident which had fortuitously not prevented another MD81 from safely completing its flight from Stockholm Arlanda to Oslo. This aircraft had taken off 18 minutes after the accident aircraft also after overnight parking outside and de icing by the same personnel. It was established that "after landing in Oslo, a passenger informed the Captain that he (had) heard abnormal noises on take-off and observed clear ice on the wings". When the wings had then been inspected, it was found that "about 20% of the left wing and 30% of the right wing were covered with clear ice, starting approximately 1.5 metres from the fuselage". After the engine air intakes had been inspected and the airframe de-iced, the aircraft was flown back to Stockholm Arlanda where, when the engines were properly inspected, five of the ten fan blades on the left engine were found to be damaged and required replacement prior to further flight.

The formally-documented statement of Cause was as follows:

"The accident was caused by SAS' instructions and routines being inadequate to ensure that clear ice was removed from the wings of the aircraft prior to take-off. Hence the aircraft took off with clear ice on the wings. In connection with lift-off, the clear ice was loosened and was ingested by the engines. The ice caused damage to the engine fan stages, which led to engine surges. The surges destroyed the engines."

Two Contributory Factors were also identified as:

• The pilots were not trained to identify and eliminate engine surging.
• Automatic Thrust Restoration (ATR) - which was unknown within SAS - was activated and increased engine thrust without the pilots' knowledge.

A total of 15 Safety Recommendations were made as a result of the Investigation as follows:

1. That the Swedish Civil Aviation Administration should, in respect of aircraft of the DC-9-80 series arrange that airline companies have instructions and procedures to ensure that the aircraft for which they are technically responsible do not take off with clear ice on their wings.
2. That the Swedish Civil Aviation Administration should, in respect of aircraft of the DC-9-80 series, seek the introduction of a means of de-activating Automatic Thrust Restoration (ATR).
3. That the Swedish Civil Aviation Administration should, in respect of aircraft of the DC-9-80 series, seek the inclusion in the emergency / malfunction checklist of initial actions in case of engine surging as (memory) items, to be regularly practised in the simulator.
4. That the Swedish Civil Aviation Administration should, in respect of aircraft of the DC-9-80 series, seek the addition to the emergency / malfunction checklist of instructions for emergency landing in the case of loss of thrust from both engines.
5. That the Swedish Civil Aviation Administration should, in respect of aircraft of the DC-9-80 series, seek to make it possible for cabin crew members to reach their emergency checklists from their emergency positions.
6. That the Swedish Civil Aviation Administration should, in respect of aircraft of the DC-9-80 series, consider increasing the stringency of the requirements for the fixing of loose galley equipment.
7. That the Swedish Civil Aviation Administration should, in respect of aircraft of the DC-9-80 series, consider the need (for) a prohibition on the cockpit door being open during take-off and landing.
8. That the Swedish Civil Aviation Administration should ensure that SAS possesses a well-functioning system of quality assurance.
9. That the Swedish Civil Aviation Administration should seek, in international cooperation between civil aviation authorities, the supplementation of current design regulations with regard to the risk of FOD damage to rear-mounted engines caused by ice forming on the aircraft.
10. That the Swedish Civil Aviation Administration should seek, in international cooperation between civil aviation authorities, a limitation of the possibilities of certifying new versions of older aircraft models without new type certification.
11. That the Swedish Civil Aviation Administration should seek, in international cooperation between civil aviation authorities, to achieve the application of new safety requirements earlier in the production run.
12. That the Swedish Civil Aviation Administration should seek to ensure that safety information in aircraft operated in international traffic by Scandinavian airline companies is also given in one of the Scandinavian languages.
13. That the Swedish Civil Aviation Administration should seek the development of better routines for making passenger lists available in the event of accidents.
14. That the Swedish National Rescue Services Board should ensure that the planning for rescue operations following air accidents in the vicinity of major airports be improved and encourage regular practical training for such operations.
15. That the National Police Board improve methods and training concerning the registration of persons in the event of major accidents.

The Final Report of the Investigation was released on 20 October 1993.

Related Articles

• Loss of Control
• Clear ice
• Aircraft and In Flight Icing Risks
• Ice Formation on Aircraft
• Aircraft Ground De/Anti-Icing
• Thrust
• Certification of Aircraft, Design and Production
• Grandfather Rights