I try to make these posts as stand-alone as possible but this time I just couldn’t do it. In order to make sense of this post, you need to read Part One of the Christmas Miracle here.

So when we left off, the aircraft had been in the air for under a minute and the right engine was surging. The captain had reacted correctly, reducing the power for the right engine, but it had no effect due to a new system that the flight crew didn’t know about.

At the time, various US airlines had implemented noise abatement procedures referred to as “thrust cutback”; using reduced power during the initial climb. This was not commonly used in Europe but, in the US, aircraft often depart using less thrust in order to keep the noise levels down as they climbed away from airports. If there were an engine failure during this time, the power settings would not be enough to keep that aircraft climbing. There were reasonable concerns that this added yet another task to a pilot during a time of high workload and, as a response to this issue, the Automatic Thrust Restoration System was developed. 

In the event of an engine failure, the Automatic Thrust Restoration System (ATRS) would kick in, increasing the thrust to the levels that they would have been before the thrust cutbacks, which would be enough to keep the aircraft from descending. In the MD-80 type, which has an autothrottle single-clutch configuration, both thrust levers are advanced to take-off/go-around (TO/GA) thrust level. The engine throttle levers are automatically moved forward until the thrust of one engine reaches the engine pressure ratio for going around. This results in the same effect as pressing the TO/GA button or advancing the thrust levers to the TO/GA position. This system does exactly what is needed for an engine failure after take-off: it moves the throttle lever forward to ensure that the good engine can maintain the climb, while having no effect on the failed engine.

In the MD-81, the criteria for arming the Automatic Thrust Restoration System are as follows:

• The Flight Director pitch axis is set for takeoff (the aircraft is climbing)
• The aircraft’s height above the ground is more than 350 feet (let’s not mess with a plane too close to the ground)
• The Engine Pressure Ratio of the engines is below the go-around thrust Engine Pressure Ratio (insufficient power being delivered for take-off/go-around)

As it happens, SAS didn’t use thrust cutback for noise abatement and so had no interest in Automatic Thrust Restoration. It was included as standard in every MD-81 but the SAS operational documentation had no reference to it and there seemed to be no understanding of the system at any level of SAS.

The system was originally developed for use in special procedures not applied by SAS, but a careful study of the manuals should have led SAS noting the system and training its pilots in its function.

But, from an SAS point of view, the initial climb would already happen at take-off/go-around power and so the ATRS would not kick in even if there was an engine failure. Although it was included in the MD-81 operational information, at no point was it mentioned to airlines who weren’t using the thrust cutback procedures. The fact is that in the almost ten years since the system had been certified, no one thought of the possibility that an engine stall might be affected by the increased fuel flow to both engines of the MD-80 type, thus continuing the stall. 

Going back to that morning over Gottröra, the pilot responded to the right engine surge correctly, by pulling the right engine throttle lever back by 10%. However, as they climbed through 350 feet, the three criteria for Automatic Thrust Restoration had been met and, when the captain released the throttle lever, the throttle increased again. The right engine continued to surge. A “discreet indication” on the instrument panel showed that the throttle setting had been increased automatically. Neither pilot saw it. 

About 22 seconds after the first engine surge, the first officer made an inquisitive sound, apparently asking the captain about the emergency/malfunction checklist. He took it out but didn’t have a chance to start working through it.

Engine surges are not unusual but they can rapidly lead to further damage, so the critical action here is to stop the surges. But engine surging during take-off was not mentioned in the FAA Approved Flight Manual. There were no memory items in regards to responding to engine surging in regards to the checklists by the manufacturer or SAS. The situation was not trained for during type training or covered in the simulator.

As the crew had no time to make it through the emergency/malfunction checklist, each section of which contained at least one or two actions, the captain presumably didn’t know or think to continue the initial throttle-back on the right engine, although the MD-81 was still jerking and vibrating. As the engine was still stalling, he should have been looking to shut it down. The report mentions that perhaps the captain was even thinking about the British Midland flight 92 accident known as the Kegworth air disaster (two years earlier), in which the flight crew shut down the wrong engine during an engine malfunction and crashed into the motorway. Certainly at the time, as a direct result of the Kegworth disaster, pilots had been warned not to do anything in haste. The Automatic Thrust Restoration System continued to increase the throttle for both engines as the aircraft continued the climb.

Meanwhile, in the back of a cabin was a pilot travelling privately who recognised the sounds. He approached a cabin crew member in the cabin rear jump seat to tell her that the right engine was surging. She tried to use the intercom to alert the captain about this but couldn’t get through — he was, of course, already trying to deal with the situation and didn’t have time to chat about it. She passed the message to the Senior Cabin Crew Member who went to the cockpit to inform the captain that the right engine was surging.

A uniformed SAS captain was seated in 2C. After hearing multiple surges, he rushed to the cockpit to see if he could be of any help. He wrote about the incident for AeroSafetyWorld in 2012.

About 25 seconds after rotation, I heard an engine surge, an appalling sound similar to a cannon firing. I counted four or five more surges and started to get worried. 

Looking through the open cockpit door, I saw a lot of warnings on the overhead annunciation panel but had the impression that nothing was happening between the two pilots… I also had the feeling that the passengers were looking at me, wondering why I was sitting there, doing nothing.

The first officer had handed me the emergency checklist when I entered the cockpit. He had begun to look for the procedure for engine surge but could not readily find it because it was so far back in the book. 

Thirty seconds after that first surge, the right engine banged again and then failed completely. At this stage, they needed to declare an emergency and return to the airport on the working engine. Thrust loss in one engine should not, under normal circumstances, affect the other engine.

Just a few seconds after the right engine failed, the left engine surged.

The Automatic Thrust Restoration had been steadily increasing the throttle, resulting in more surges with increased intensity. 

From the report:

It was a serious deficiency in flight safety that the pilots lacked knowledge of ATR and its function. ATR is activated without special indication and in such a way that it can escape the pilots’ notice. Increased throttle on both engines now took place without the pilots’ knowing.

The left engine failed almost immediately.

The ice ingested into the right engine damaged the fan blades at the tips, while the left engine fan blades had their greatest damage nearer the centre, which is why the surging started later on the left engine. Once the left engine started surging, it surged with greater force, because the engine was working at higher power, which is why the engine broke up after only 14 seconds.

Both engines were subjected to the same treatment and thus both engines failed.

The initial damage was not so extensive that the engines would have failed: the right engine could have continued to provide reduced thrust and if the original power had been maintained, the left engine might not have surged at all. The aircraft could have then returned to the airport for landing with both engines operative (although one with reduced thrust).

Instead, the MD-81 was now a glider. 

The assisting pilot wrote:

I tossed the checklist aside because the situation we were in required no checklist. With both engines out, half the flight instruments blacked out and the aircraft in clouds, the only things that were required were good airmanship, a hunch about what the landing configuration should be, and of course, some luck. 

It may seem odd that the checklist was so readily dismissed by the pilots but, in this case, the checklist was not very helpful. There’s no simulator or other training to practise dealing with an engine surge. When the situation was recreated in a simulator, investigators found that getting to the first action in the checklist took the same amount of time that had taken place between the start of the surging and both engines breaking up. It happens too fast for the checklist to be of any use.

For the same reason, it was pointless for the pilot in the back to try to relay a message via the cabin crew. The crew member’s call to the cockpit, which went unanswered, was just ten seconds before the engines failed. 

Spread over two posts like this, I worry that it’s hard to imagine how quickly everything happened. At this point, the aircraft had been in flight for only 78 seconds.

The crew never made a distress call but instead prepared for an emergency landing. At around 1,400 feet above the ground, while still in cloud and travelling at about 165 knots, the assisting pilot started gently extending the flaps. As they reached 1,100 feet, the captain said “Flaps…” and the assisting pilot responded with “Yes, we have flaps, we have flaps, look straight ahead, look straight ahead!” The flaps were fully extended as they reached 1,000 feet above the ground, before the assisting pilot finished his sentence.

The assisting pilot explained why he kept repeating his instruction.

I told the captain, who was flying manually, to look straight ahead. I repeated that at least 20 times during the rest of the flight. Why? Flying a 50,000 kg aircraft is a full-time job, especially when you don’t have any engine power. I wanted the captain to do nothing else but fly the aircraft with exact control of speed and attitude. 

The MD-81 broke free of the cloud at around 900 feet above the ground. The captain saw and dismissed a large field to the right as being too far for them to reach. He chose another field in the direction of flight, correcting his heading by about 25° to avoid a populated area which was on his approach path. He glided the aircraft in a gentle left turn until he was heading north. The first officer contacted Stockholm control that they had engine troubles and needed to return to the airport. The air traffic controller instructed them to make a right turn to bring the aircraft back for landing on runway 01. However, the captain continued the northerly glide and simply called out one simple instruction.

Prepare for on ground emergency.

Procedure was that one minute before an emergency landing, the captain should turn the “fasten seat belts” signs on and off, the signal for “brace for impact”. The captain didn’t do this, instead calling “Prepare for on ground emergency” repeatedly. But it worked. The assisting pilot repeated his words. Cabin crew at the front of the aircraft and the passengers in the first rows heard the call. The senior cabin crew member passed on the announcement using the loudspeaker system, asking passengers to keep their seat belts fastened and to keep calm. Twenty seconds before impact, the senior cabin crew member called out a final instruction: Bend down, hold your knees. The rest of the cabin crew repeated the instruction in English and in Swedish. Most of the passengers followed the instructions and adopted the brace position, which is one reason why there were so few injuries.

The first officer called out, “Shall we get the wheels down?” The assisting pilot answered with “Yes, gear down, gear down.”

 Eight seconds later, 200 feet above the ground, the first officer called Stockholm control.

Stockholm, SK 751, we are crashing to the ground now. 

As the landing gear extended and locked, the aircraft crashed into the trees travelling at a speed of 121 knots. Most of the right wing was torn off, forcing the aircraft into a right bank. The path of broken trees was 125 metres long (400 feet). The tail of the aircraft struck the ground first then the fuselage broke into three pieces on impact. 3,600 litres of aviation fuel poured out of the right wing tank over the trees. The same amount again spilt from the left wing at the point of impact. 

The overhead bins opened and many broke off their mountings. Hand baggage fell out of the bins onto passengers and blocked access to one of the emergency exits. Another emergency exit was blocked by the galley oven and stowed items. A third was damaged on impact and would not open. 

The assisting pilot wrote:

When I saw the trees starting to hammer the aircraft, I had rushed from the cockpit and braced myself against the forward cabin wall, knowing that I did not have the time to return to my seat, fasten the seat belt and brace for impact. I felt the aircraft bank right as I left the cockpit and reached the wall, which was carpeted and relatively soft, just as the aircraft hit the ground. I was knocked unconscious.

The impact forces in the forward part of the aircraft reached +30 g (that is, 30 times standard gravitational acceleration). It is unbelievable that so many passengers survived relatively unharmed. I was unconscious for approximately 20 minutes. My left shoulder must have taken most of the impact, because it was dislocated.

The captain dragged me to the forward cabin door, where I was taken care of by some passengers. The slide did not inflate when the crew opened the door because the distance to the ground was too small. Later, the crew removed the slide and inflated it. I sat on that slide for a long time, maybe an hour. It was cold, my shoulder hurt, and I had only one shoe. 

The passengers evacuated through the remaining emergency exits and the openings left by the broken fuselage.

Meanwhile, back at Stockholm/Arlanda, Air Traffic Control had raised the alarm for Risk of accident at 08:50, about a minute before impact. When radar contact was lost, they updated this to Accident or presumed accident at unknown location. About 15 minutes later, a passenger phoned from a nearby cottage and was able to pass on a location. 

As I said at the start, I’m not a fan of good piloting being described as a miracle, with the implication that the whole thing was in the hand of fate. But in this case, the good piloting and strong CRM was supported by a number of favourable factors. There was a good location for an emergency landing directly ahead and within reach of the descending aircraft, which had had slowed to a suitable speed for landing, possibly helped by the landing gear snapping off as they flew through the trees. The way the fuselage broke up meant that there was an easy means to evacuate the aircraft, which was important as only five of the eight emergency exits could be used. There was no fire even though the aircraft was carrying enough fuel for the full flight and the wing tanks broke open on impact, spreading fuel everywhere.

However, the passengers were left to wait outdoors in the chilly December weather for quite some time. When the duty fire engineer arrived, he found that only a few people were injured. He knew that a number of helicopters, ambulances and buses were on their way and so he did not order heated tents on the accident site and he did not set up a management team, presuming that the would clear the crash site quickly. The first inventory of the injured was completed in about an hour and the most seriously injured were taken or prepared for transport.

There were a number of communication issues which led to the buses for transporting the passengers remaining by the church rather than continuing to the accident location. The police took great pains to register everyone on site, checking them against the passenger list to ensure that no one was missing. However, they did not get the passenger list until 14:00, over half an hour hours after the accident (see Leif’s comment below). Some of the uninjured and slightly injured passengers had made their way to the cottage, which meant that the police were unable to account for all the passengers and required additional resources to search for those who were presumed missing. 

In the end, everyone was accounted for and, despite the crash and the cold and the wait, it was clear that something close to the miraculous had happened: only one member of the crew and eleven passengers were injured. Of those, only one was serious.

3.2 Causes of the accident

The accident was caused by SAS’ instructions and routines being inadequate to ensure that clear ice was removed from the wings of the aircraft prior to takeoff. Hence the aircraft took off with clear ice on the wings. In connection with liftoff, the clear ice loosened and was ingested by the engines. The ice caused damage to the engine fan stages, which led to engine surges. The surges destroyed the engines.

Contributory Causes

The pilots were not trained to identify and eliminate engine surging.

ATR – which was unknown within SAS – was activated and increased the engine power without the pilots’ knowledge.

I find it interesting that there’s seemingly no emphasis made on the design of the aircraft, which led to the ingestion of clear ice in a way not seen in other aircraft. The issue was clear, however. Just a week after the accident, the FAA made it obligatory to install four warning triangles with indication tufts on the upper surface of the wings of all MD-80 aircraft. Staff at Stockholm/Arlanda were retrained and a stronger emphasis put on pilot training to deal with clear ice and engine surges, including amending the checklist to include memory items. And the manuals were redesigned to ensure that pilots were aware of the Auto Throttle System and the Automatic Thrust Restoration and, more importantly, knew how to disable it in the case of engine surging.

Still, a happy ending and a lesson learned. Can’t ask for much better than that.