A Christmas Miracle

28 Dec 18 5 Comments

I am not a fan of “miracles” which dismiss the safety culture, training and skill that airline crew bring to a situation; however, in the case of the Miraklet i Gottröra, it has to be said that pilot skill was supported by a large helping of good fortune which led to this amazing happy-ending crash landing in 1991. A special thank you to Leif Hellström who pointed out this one out to me and send me plenty of material to get immersed into it. For those that like to follow along, my primary resource is the SHK (Statens haverikommission or Board of Accident Investigation) Official Accident Report released in English.

The accident happened on the 27th December 1991 in Gottröra, AB county, Sweden near the Stockholm/Arlanda airport but it started the night before, when the aircraft, operated by SAS (Scandanavian Airlines), arrived at Stockholm after a night flight from Zürich. 

Accident aircraft in June 1991 taken by Konstantin von Wedelstaedt

The aircraft was a McDonnell Douglas DC-9-81, originally known as the DC-9 Super 81 but now more generally known as the MD-81. The MD-80 series was a development of the aircraft type DC-9 and the MD-81 is the basic version of this series. A critical point is that the engines are mounted on pylons on the rear part of the fuselage rather than on the wing. The engine intake is particularly wide, with a diameter of about 1.2 metres (almost four feet). This particular MD-81, registration OY-KHO, was set up for SAS passenger services with 133 passenger seats and five seats for cabin staff.

On the night of the 26th of December, Stockholm had snow and rain which lightened to light drizzle. There was a thin layer of slush on the runway and the temperature was +1°C (34°F). The flight from Zürich to Stockholm was uneventful but, during the cruise phase of flight which lasted an hour and forty minutes, the temperatures dropped to -53°C and as low as -62°C (-80°F). The aircraft landed at 22:09 with 2,550 kg fuel in each wing tank (5,620 pounds), which had become chilled in the low temperatures of the cruise. The aircraft parked at gate 2 at the international terminal; its next flight was the scheduled passenger service to Copenhagen departing at 08:30, just before sunrise.

A technician checked over the aircraft during the night. He had to clear slush from the landing gear to be able to inspect it and, at 02:00, now the 27th of December, he noticed that clear ice had formed on the upper surfaces of the wings, chilled by the cold fuel in the tanks. He had no instructions to report this to anyone and he finished his inspection, leaving the aircraft for the mechanic to carry out the departure check the next morning.

SAS Line Maintenance Departure Check

By 06:50, the temperature had dropped to freezing again. At 07:30, the mechanic responsible to handing over the aircraft found frost (rime) on the underside of the wings, which meant a risk of clear ice on the upper surfaces of the wing. The mechanic climbed up on a ladder and, balancing with one knee on the leading edge of the left wing, felt the upper side of the wing. There was no ice there. It was cold and slippery from the rain and so he did not climb out on the wing but concluded that as he couldn’t feel any clear ice from where he stood, there wouldn’t be any further along the wing.

He was wrong.

Clear ice forms on the upper surfaces of wings when there’s high atmospheric humidity or rain in combination with greatly chilled wings. At the time of the accident, 1991, there had been a number of cases where clear ice had formed on the wings of the DC-9 type aircraft and then broken off during take-off as the wings start to flex. The problem with this type, specifically, is that the engines are to the rear and have a large intake area, so the ice is ingested by the engines and causes damage to the fan blades and the engines. In 1985, Finnair released a report on the problem, describing undiscovered clear ice as “the most difficult systematic threat to flight safety today”.

The following year, McDonnell Douglas recommended the installation of warning triangles with indication tufts on critical wing areas. These nylon tufts would not move if encased in ice, so you could touch them to confirm whether there was clear ice on the wings. SAS had these installed on their aircraft in October 1987 to help maintenance staff detect clear ice on the wing. By 1989, these tufts were standard on newly built aircraft. 

By 1991, McDonnell Douglas had offered further modifications: Ice FOD Alert system (a sensor on the upper side of each wing), Inboard Refuelling System (new, warmer fuel is mixed with stationary cold fuel in the inner part of the wing tanks) and Alternate Fuel Burn System (creates an insulating layer of air between the wing tank fuel and the upper side of the wing). These modifications were all optional and SAS had not introduced them to their aircraft with the exception of one trial aircraft. The modifications became standard on new aircraft delivered from the beginning of October 1991. 

On the 26th of October 1991, exactly two months before the accident, SAS distributed a FLIGHT DECK BULLETIN/WINTERIZATION with a special section on CLEAR ICE.

Although the awareness within Line Maintenance is mostly good, the responsibility again leans on the P-i-C that the aircraft is physically checked by means of a hands-on check on the upper side of the wing. A visual check from a ladder or when standing on the ground is not enough.

Each mechanic had a checklist which included checking for clear ice by touching the wing upper surfaces. But there was no further information as to how to verify if the wing surface was contaminated with clear ice (other than feel the wing upper surfaces with your hand), how to remove it, and how that discovery should affect the follow-up check and/or the report to the captain.

On that morning, there were 6 crew and 123 passengers on board. A further 1,400kg of fuel (3,000 pounds) was added to the aircraft tanks. The mechanic told the captain about the frost he’d seen underneath the wings and they agreed that they should get de-icing on the undersides of the wings. There was no discussion about the risk of clear ice, although that frost was a specific symptom listed in the training for both the mechanic and the flight crew.

While the aircraft was being de-iced, the pilots carried on with routine checks, including the departure procedure from Stockholm/Arlanda. The captain commented on the procedure for engine failure, saying “Engine failure follow…2,000…that’s very general.”

The man operating the spray nozzle of the de-icing truck said he saw one of the tufts move (although a passenger seated at the window never saw them move at all). After he had sprayed the upperside of the wings de-icing fluid, the mechanic requested further de-icing to make sure that the wings were clear of slush. The de-icing process used 850 litres of de-icing fluid type 1, which had been heated to 85°C (185°F).

Type 1 de-icing fluid has a low viscosity (“unthickened”) and provides only short term protection because the fluid flows off the surfaces. The fluid is sprayed hot and at high pressure to remove existing snow, ice and frost.

This differs from the other types of de-icing fluid. Type 2 de-icing fluid contains a thickening agent to keep it on the surfaces until the aircraft speed reaches around 100 knots (195 km/h or 115 mph). Type 3 is also thickened to stay on surfaces but it is used on aircraft with a slower rotation speed, as the the viscosity breaks down quicker. Type 4 is similar to Type 2 but lasts longer (so useful if the flight isn’t immediate). These types are more correctly known as anti-icing because they are used to stop icing from re-occuring after a type 1 de-icing.

As the temperature was just at freezing, only type 1 de-icing fluid was used. As the mechanic had not found any clear ice before de-icing, he didn’t see any need to check again after the de-icing had been carried out. The technician who had noticed the ice in the early hours was long gone. 

Ground crew reported to the captain that the de-icing was complete. The captain asked if they had it good and clean under the wings. The mechanic told him yes, there was a lot of ice and snow, but, he said, “it’s fine now, it’s perfect”. The captain thanked him.

On the 6th of December, 20 days before the accident, SAS issued an AOM Bulletin MD-80 which dealt with a number of issues including the risk of engine damage caused by clear ice. It said that for certain destinations (with specific airports listed in Italy and France) there was a greater risk of clear ice problems remaining undetected because the attention of the ground personnel there could not always be expected to be the best. Stockholm’s Arlanda airport, on the other hand, had a great reputation for cold-weather issues and has the distinction of having never needed to close as a result of snow.

The bulletin also specifically mentioned that the responsibility for ensuring that the aircraft is free of ice lies with the captain. It also stated directly that “rime on the underside of the wing is a good reason to believe that there is ice on the upper surface during precipitation.”

MD-80 training did not emphasis this issue and there’s no reference to clear ice in the MD-80 study guide which was used by pilots when training on type. Later, the first officer said that he had never realised the extent of the clear ice problem during his training on the MD-80. Also, the AOM walk-around inspection of the aircraft before flight had no special instruction regarding an ice check before flying. The checklist had only one reference to ice and snow which was regarding de-icing with the engines running. 

Google maps view of Stockholm/Arlanda Airport with runway 8 at the top.

The flight crew taxied the MD-81 to runway 08 for take off. The runway had been cleared of snow, with just one narrow strip of snow left by the snow clearing equipment. Both engine anti-icing systems were on and operating in the normal range. The Auto Throttle System (ATS) engaged. The captain made a rolling take-off and everything seemed normal until rotation. As the aircraft lifted off, passengers seated at the windows saw ice coming off of the wings. The captain heard an odd sound, a humming noise, which he could not identify. Then there was a loud bang and the aircraft vibrated and jerked, described by one person as if someone was slamming on the brakes repeatedly.

The aircraft was at 1,124 feet and in cloud. The flight crew attempted to switch on the autopilot to gain time for trouble-shooting but the autopilot failed. A voice warning sounded with “Autopilot” and continued to sound for the rest of the flight.

The aircraft vibrations made it difficult to read the engine instruments as the parameters fluctuated wildly. These instruments had been implicated in an accident just a few years earlier, the Kegworth accident in England, and it was already known by then that the shorter electronic hands on the modern instruments were hard to read. The first officer said “compressor stall” as the captain pulled the right engine throttle lever back.

A compressor stall, or engine surge, is when the compressor blades suffer an aerodynamic stall which results in abnormal airflow. The blades in the compressor are bound to the same principals as the wing and the propeller: if the angle of attack on the blades exceeds their critical angle, then the air is not passed smoothly along. Instead, the air flowing through the compressor is subject to turbulence and pressure fluctuations and can result in a reverse airflow. A compressor surge, or surging engine, is when the airflow through the compressor is completely disrupted. One of the most common causes of compressor stalls is foreign object damage, such as bird strikes or the ingestion of ice.

The signs of a compressor stall include an increase in engine temperature, fluctuations in engine RPM and ‘backfiring’ sounds. The compressor stall can quickly lead to engine damage and then to engine failure. The most well-known example of this is probably US Airways flight 1549, in which Captain Sully ditched into the Hudson River after flying through a flock of geese directly after take-off. 

The correct response to an engine surge is to reduce the throttle and clear the surge. The engine should recover on reduced thrust and, with any luck, the aircraft can continue safely to the airport on one full engine and one with partial thrust.

The captain reduced the right engine power by ten percent. It didn’t help. Seven seconds later, the engine surged again and then again three seconds later.

That was because there was a feature on the aircraft which the flight crew didn’t know about, which immediately increased the throttle again. The first officer said, “Think it’s a compressor stall.” By now it was clear that they were at risk of losing the engine completely.

And with that, I’m out of time, so I’m going to ask you to come back next week to find out just what happened!

Category: Accident Reports,

5 Comments

  • Do I detect a similarity between this and the recent Indonesian crash, in that both involved automated systems overruling the pilots and not !@#$%^&*!!! telling them? Was there an alert signal turned off (as in Gunnison’s comedy), or did the power in that generation of aircraft just go back to full without indication?

    • That’s exactly why I think this one is timely right now. There was an indication but it was subtle: no alarm. And by the time of this incident, it was already known that pilots struggled to read the modern style instruments which looked sleek but just weren’t as clear.

  • I have said it before and I say it again, there needs to be a big red button which chops automation and returns control to the actual pilots who can use use basic instruments and controls while they sort out the problem. Think AirFrance, the Airbus airshow crash and others.

    • The problem though is that we always hear about when automation fails, but hardly ever when automation saves the aircraft. There are situations where disabling automation would be just as fatal as the decision to NOT disable automation.

      And besides, in most of these situations, it doesn’t even occur to the crew that automation might be the problem. You can’t hit the button if you don’t even consider hitting the button.

      Automation should always have an override (I belong to the AI pessimist camp), but if the crew isn’t trained properly, practicing proper CRM, and given a properly maintained and inspected aircraft, it doesn’t matter. Automation, like most coding, tends to fail most spectacularly when presented with a situation it wasn’t programmed for, which usually means something else has failed first.

Post a comment:

Your email address will not be published. Required fields are marked *

*
*
*

This site uses Akismet to reduce spam. Learn how your comment data is processed.