An Acceptable Danger: The crash of Atlantic Airways flight 670
On the 10th of October 2006, a Faroese airliner carrying natural gas engineers to a small island airport in Norway overran the runway on landing, sending the jet tumbling down a cliff toward the sea below. The plane came to rest on a steep slope and caught fire, triggering a desperate rush to escape before flames consumed the cabin. The passengers fought for their lives against jammed doors and toxic smoke, while the pilots mounted a heroic struggle to save those trapped inside. In the end, twelve people escaped, while four perished in the inferno — a miraculous outcome, at least in the eyes of the first responders, who believed all the passengers had been killed. But why did the British Aerospace 146 fail to stop when it should have had plenty of room? Investigators would eventually discover a confluence of environmental factors and mechanical failures that thrust the pilots of Atlantic Airways flight 670 into a terrifying fight to slow down — and that a safety system designed to help slow the plane actually sent it to its doom.
Atlantic Airways is a state-owned airline* belonging to the government of the Faroe Islands, an autonomous territory of Denmark located between Scotland and Iceland. The airline has at various times provided services between the Faroe Islands and the UK, Norway, and Denmark, as well as some connecting flights within those countries. A small fleet of helicopters served routes within the Faroe Islands themselves. Atlantic Airways has also offered helicopter and fixed-wing charter services, and in the early 2000s, the Norwegian engineering company Aker Kværner regularly hired Atlantic Airways to fly its employees from its base in Stavanger to the town of Molde, where it provided support for a natural gas extraction operation. The flight usually made an intermediate stop at Stord Airport on the island of Stord, less than 60 kilometers from Stavanger, in order to pick up more passengers.
*Note: The year after the accident, the airline was partially privatized.
Operating this charter flight on the 10th of October 2006 was a British Aerospace (BAe) 146, a four-engine short-range jet designed for short takeoffs and landings. Built in the United Kingdom between 1983 and 2002, the BAe 146 had a good safety record, and several hundred were in service around the world. In command of the flight that day were two well-regarded Faroese pilots: Captain Niklas Djurhuus, 34, and First Officer Jakob Evald, 38, both of whom had perfect records and plenty of experience flying to small island airports. They were joined on the first leg by two flight attendants and 12 passengers, who spread themselves throughout the cabin, leaving most of the seats empty.
After taking on fuel and passengers, Atlantic Airways flight 670 departed Stavanger Airport at 7:15 a.m., shortly before dawn. Eight minutes later, First Officer Evald opened radio communication with the approach controller, based in a facility in Bergen, and arranged to land on runway 15 at Stord. Although the wind at the time favored runway 15, the pilots soon changed their minds. Because they were approaching from the south, they would need to overshoot the airport and make a 180 degree turn to come into runway 15 from the north; it would make more sense to go straight into runway 33, the same runway from the opposite direction, as the tailwind was only 5 knots (9 km/h), well within limits. The approach controller then handed over the flight to the Aerodrome Flight Information Service (AFIS) officer at Stord Airport — a position similar to a controller, but without the authority to give orders to aircraft. The crew of flight 670 informed the AFIS officer that they would land on runway 33, and the pilots began to configure for final approach. It had been raining earlier that morning, but now the weather was clear, and although some water remained on the runway, it wasn’t enough to truly call it “wet,” and braking action was expected to be good.
Stord Airport is a small airfield serving communities in the southern part of Norway’s Hordaland County, between the cities of Bergen and Stavanger. It hosts only limited scheduled services using relatively small aircraft, and the BAe 146 used by Atlantic Airways was the largest airplane that normally landed there. The Airport is perched on a hilltop above the Stokksundet Strait, a narrow channel between the islands of Bømlo and Stord, surrounded by steep, rocky slopes that descend straight into the sea. Both ends of the runway feature significant drop-offs with no room for error, and caution must be exercised when attempting to land there in a BAe 146, especially with a tailwind. But Atlantic Airways flew to many such airports, including Vágar Airport, its home base in the Faroe Islands, which sits on similarly precarious terrain, and pilots Djurhuus and Evald were well aware of the risk.
The final approach proceeded smoothly, as the pilots carefully ensured that they flew at the correct speed and angle; all checklists were completed on time and the plane was properly aligned with the runway. At 7:32, flight 670 touched down just a few meters from the ideal touchdown spot, and the pilots began the series of steps needed to bring the plane to a stop. The very first step after touchdown is to deploy the lift spoilers — the set of panels on the wings that literally “spoil” their ability to produce lift, allowing the weight of the aircraft to shift onto the wheels and making the brakes more effective.
As soon as the wheels touched the runway, First Officer Evald called out, “And… spoilers.”
Captain Djurhuus pulled the spoiler lever to engage the spoilers, making sure it clicked into the proper detent, while Evald monitored the spoiler lights on the instrument panel to ensure that they deployed correctly. But to his surprise, the lights didn’t illuminate. “No spoilers,” he said, using the callout he had been trained to provide. It was immediately apparent that this was no false alarm: for some reason, the spoilers had failed to deploy!
On the BAe 146, the spoilers are critical to bringing the plane to a stop safely. Among large aircraft, the 146 is unique in that it does not have the capability to generate reverse thrust, which means that it relies more heavily on the wheel brakes in order to slow down. The brakes in turn rely on the correct operation of the spoilers. If the spoilers don’t deploy, the weight of the plane won’t shift onto the wheels as quickly, reducing brake effectiveness by up to 60%. So when Captain Djurhuus stomped on the brakes to try to slow down, he didn’t receive the feedback he expected. Only a second or two had passed since First Officer Evald called out “no spoilers,” and he hadn’t yet had time to make the connection between the lack of spoilers and the inability of the brakes to slow the plane. Apparently believing that the brakes were also malfunctioning, he flipped the brake selector switch to change which hydraulic system powered the brake actuators, but this failed to solve the problem. After a further three seconds, already greatly alarmed by the plane’s excessive speed, Captain Djurhuus tried the last solution he could think of: he activated the emergency brake.
One side effect of activating the emergency brake on the BAe 146 is that it bypasses the plane’s anti-skid system. Normally, sensors in the landing gear detect whether the wheels are turning properly and automatically reduce brake pressure if a skid develops, so that the wheel can start turning again and brake pressure can be gradually reapplied. This prevents the wheels from locking and ensures that braking power is used effectively. But when Captain Djurhuus activated the emergency brake, the anti-skid system automatically turned off, because a failure of this system could be the reason for using the emergency brake in the first place. Without the anti-skid system regulating brake pressure, the wheels locked almost immediately, and the plane started to skid. The sound of screeching tires turned heads all over the airport, and numerous witnesses watched with growing concern as flight 670 hurtled toward the end of the runway.
When flight 670’s wheels locked, they experienced a rare phenomenon called reverted rubber hydroplaning. In normal hydroplaning, a large quantity of standing water lifts the plane’s wheels off the runway and prevents the brakes from slowing the plane. In contrast, reverted rubber hydroplaning can occur even on a runway that is merely damp. As the tire slides across the runway surface, friction generates heat, which causes the tire to revert to its original fluid-like uncured state. The friction also heats up the water on the runway until it turns to steam. The reverted rubber forms a seal that traps the steam, causing it to lift the tire partially off the surface. This causes the plane to slide along on a cushion of steam, rendering the brakes almost entirely useless, and the phenomenon can persist down to speeds as low as 20 knots (37 km/h). As soon as flight 670 began to experience reverted rubber hydroplaning, there was nothing the pilots could do to stop the plane in time — they were headed off the end no matter what.
With the end of the runway rapidly approaching, Captain Djurhuus became ever more desperate to stop the plane. As passengers held on for dear life, he swerved to the right, then to the left, then right again, and finally back to the left, putting the plane into a slide in an attempt to bleed off speed. But it wasn’t enough: still traveling at 15–20 knots (28–37 km/h), flight 670 skidded off the end of the runway. The plane teetered on the brink and then fell over the edge, plunging down the steep, forested slope; rocks battered the fuselage, and the number four engine was ripped off the wing. Finally, the plane slammed into a rock outcropping and ground to a halt. The right wing tore out of the fuselage on impact, leaving a hole in the roof through which the passengers were showered with jet fuel. A raging fire immediately erupted by the severed wing, growing to considerable size within seconds of the crash. Inside the plane, all 16 passengers and crew had survived — but their ordeal had only just begun.
Inside the cockpit, Captain Djurhuus immediately shut off fuel flow to the engines and pulled the fire extinguisher handles, but the connection to the number two engine had been severed and it refused to shut down. Unable to stop it, Djurhuus and Evald changed their focus to getting the passengers off the burning plane. But they received no response when they tried to contact the flight attendants via the cabin interphone, and the cockpit door was jammed into its frame and would not open, preventing them from reaching the passengers. Thinking quickly, Djurhuus opened the captain’s side window, and both pilots climbed out through it, jumping 2–3 meters down to the ground. Djurhuus scrambled over to the front right exit door and tried to open it from the outside, but this door had also jammed, and he was unable to enter.
Meanwhile in the cabin, passengers rushed to find a usable exit as flames consumed the right side of the plane. Both exits on the right side were blocked by fire, and the front left exit wouldn’t open, leaving only the rear left exit available. The rear flight attendant hurried to get this door open, but found it extremely difficult to keep it that way, as it opened uphill and kept trying to swing closed. Because the plane was sitting on a 30-degree slope, passengers in the front of the plane had to scramble up the aisle using the seats like a staircase to reach the tail, where they found themselves caught in a queue of people trying to get through the exit that refused to stay open. One passenger opened the right rear door, saw flames outside, and immediately closed it again.
As passengers began to jump 3–4 meters down from the exit door, flames and smoke surged into the cabin. Someone screamed, “OUT, OUT,” and people poured through the door, landing on top of each other on the uneven ground. Down at the nose, Captain Djurhuus gave up on trying to open the front left door and instead climbed back in through the window to try the cockpit door again. This time he attempted to remove the pins physically holding the door into its frame, but this too failed; he was also unable to kick in the door because it had been reinforced following the terror attacks of September 11th, 2001. With flames encroaching on the cockpit, he was forced to flee through the window once more, whereupon he concluded that there was nothing more he could do. First Officer Evald had been injured in the crash and was unable to walk, but in a heroic feat of strength, Djurhuus physically picked him up and carried him away from the plane. At around the same time, the last passengers and the rear flight attendant escaped through the exit door, some suffering severe burns in the process, as the fire spread under the plane and erupted out the left side as well. Looking back, they knew that not everyone had escaped, but the plane was completely consumed in flames, and there was nothing they could do to help them.
While the passengers and crew fled for their lives, fire crews — who had witnessed the crash — rushed to the end of the runway to extinguish the flames. But the fire was located at the limit of the range of their hoses, and the jet blasts from the still-running number two engine created a headwind that blew the water away from the plane. As a result, they struggled to bring the fire under control, and because they could only reach the right side of the plane, they didn’t know that anyone had escaped. In fact, almost all of the passengers went downhill toward the seashore after leaving the plane, where two were rescued by a passing boat, while the others eventually looped around and climbed back up to the runway at a different location. Survivors gathered behind the fire trucks, where the firefighters, believing that no one had escaped, mistook them for passengers from another Atlantic Airways plane that had landed a few minutes earlier. As late as 20 minutes after the crash, rescuers were still reporting no signs of survivors, even though the survivors were standing just a few meters away. Eventually, the misunderstanding was reconciled, and those with injuries were rushed to hospital, including both pilots, who had suffered significant burns while trying to save people from the passenger cabin. But they were the lucky ones. In all, three passengers and the forward flight attendant perished in the flames, at least two of them while trying to open one or both of the jammed doors at the front of the plane. To his eternal regret, Captain Djurhuus had been unable to save them.
With the rescue concluded and the fire extinguished, investigators from the Accident Investigation Board of Norway (AIBN) began to arrive at the scene. Although the crash occurred in Norway, it made bigger news in the Faroe Islands, where the tightly knit community was shocked by the first ever fatal crash of a Faroese airliner, and by the death of one of the Faroese flight attendants. But while the islanders (who depended on Atlantic Airways to connect to the outside world) clamored for answers, Norwegian investigators soon discovered that finding the cause of the crash might be impossible. Both black boxes had suffered from prolonged exposure to fire, and their protective casings had been compromised. The flight data recorder was an almost total loss, with only small sections of the tape yielding any readable information. The cockpit voice recorder was a solid state model, but it too had been badly damaged, and it had to be sent to the US-based manufacturer before the data could be extracted. The pilots’ conversations revealed that the spoilers had failed to deploy, even though investigators could hear the distinctive sound of the spoiler lever moving into the “deployed” position. An examination of the spoiler actuators recovered from the wreckage confirmed that they were stowed. It was apparent that some kind of mechanical failure had occurred, but the trail ended there — most of the wreckage had been burned to ash, and without the data recorder, there was nothing else that could point to a cause.
The failure of the spoilers was only half the story, however. Even without functional spoilers, the plane could theoretically have stopped in time. But physical evidence left on the runway and a tire that survived the blaze showed that the plane had experienced reverted rubber hydroplaning, a rare and dangerous phenomenon that prevented it from slowing down normally. Reverted rubber hydroplaning was only possible for two reasons. First, the runway was damp, providing a source of water to turn into steam. The pilots were unaware that the runway was damp because the “damp runway” designation had been phased out; for all practical purposes, a damp runway behaved the same as a dry runway, and the absence of a transmission about a wet runway would have informed the crew that it was dry. However, the abandonment of the term “damp” had not taken into account the fact that reverted rubber hydroplaning can occur even on a runway that is merely damp and does not have any standing water.
The second factor leading to reverted rubber hydroplaning was the deactivation of the anti-skid protection, which occurred due to the engagement of the emergency brake. Investigators were disturbed to discover that using the emergency brake had in fact increased the required stopping distance by a significant margin, directly leading to the accident. The pilots, who knew nothing about reverted rubber hydroplaning, thought that using the emergency brake would cause them to stop faster, a completely reasonable assumption that in this case turned out to be wrong. Of course, there was technically no need to activate it, since their brakes were working correctly; but with only seconds to determine what was wrong, it was understandable that Captain Djurhuus would reach for the emergency brake when the plane did not slow down normally.
Investigators also noted that the crash resulted in injuries and fatalities because the terrain beyond the end of the runway was highly unforgiving. The airport in fact did not meet International Civil Aviation Organization (ICAO) guidelines that stipulated a paved runway end safety area of at least 180 meters (Stord Airport only had 130, and Norwegian rules required 300), and that the slope beyond the end of the runway not exceed 20 degrees (flight 670 fell down a slope in excess of 30 degrees). Both the airport and Norway’s Civil Aviation Authority (CAA) were well aware of this problem, and in fact CAA Norway had made Stord Airport’s 2006 license renewal contingent on an agreement to bring its runway end safety areas into compliance by October 2008. However, the terrain made it all but impossible to fully comply, and at the time of the accident, work on improvements had not broken ground.
While some investigators looked into operational aspects, others focused on trying to find out why the spoilers didn’t deploy. They ran a complex fault tree analysis, examining all the ways in which various systems interact, and eventually narrowed it down to two possibilities. Because the spoilers rely on two different hydraulic systems and all have independent actuators, there are very few failures that will affect all of the spoilers, as occurred on flight 670. One possibility was a failure of the mechanical linkage connecting the spoiler lever to the switches that send a signal to the spoiler actuators. Although there was no record of this linkage ever failing on a BAe 146, this scenario would explain the accident. The other possibility was a failure of the two switches that detect the throttle position. Because the spoilers are only allowed to extend if thrust is at flight idle or lower, there are two redundant switches that make contact when the thrust levers are moved to flight idle, allowing the “deploy” signal to be transmitted from the spoiler lever to the actuators. These microswitches had failed before, and as a result they had to be inspected every 625 flight hours; however, if one switch failed, it would not be noticed until this inspection. Therefore, one switch could have been broken for some time, then when the second one also broke, the spoilers would fail to deploy — as long as both microswitches stopped working after the last inspection and before the next one. The AIBN noted that both of these possible failures are extremely unlikely in principle, but having ruled out all other possibilities, one of them must have occurred; however, they could not say which one. The final report, published six years after the crash, stated that investigators could not determine why the spoilers failed to deploy.
However, the AIBN did have much to say about the concept of latent risk. In analyzing the crash of flight 670, it became apparent that landing a BAe 146 at Stord was relatively risky, and that this was known to local authorities. Earlier in 2006, Stord Airport conducted a study which found that the risk of an accident for a BAe 146 landing at Stord was approximately 2.24x10(-7), or one in 4.5 million, more than twice ICAO’s suggested maximum of 1 in 10 million. This was in part due to the fact that the BAe 146 was reliant on functional spoilers, and that if they did not deploy, due to mechanical failure or human error, the plane could run off the end of the runway and fall down the slope. Surprisingly, this study had identified the exact scenario that led to the crash of flight 670! But the airport only provided Atlantic Airways with the figure of 2.24x10(-7) without including a breakdown of how that number was derived. This abstract number is difficult to conceptualize on its own, and the airline apparently did nothing with it; on this matter, investigators wrote, “There are few companies that have the knowledge or capacity to relate to risk figures of this type and what they mean in practice.” Had Atlantic Airways instead been provided with the specific risk factors that made that number so high — such as the vulnerability of the BAe 146 to spoiler failures — then the airline might have taken action to mitigate this risk. In reality, it did nothing — in fact, earlier in 2006 an application from Atlantic Airways to CAA Norway to use a longer maximum landing distance for the BAe 146 at Stord (in order to land at higher gross weights) was rejected because the airline had not undertaken any analysis of the risk that might be involved.
Part of the problem was that knowledge of those risk factors was spread out over three different agencies, none of which had a complete picture of the situation. Atlantic Airways’ operations were approved by the Danish CAA, the airport was approved by the Norwegian CAA, and the design of the aircraft was approved by the British CAA. Each of them saw only one part of the whole — the marginal nature of landing a BAe 146 on such a short runway, the lack of safeguards around Stord Airport, and the plane’s reliance on functioning spoilers — and determined that these were, in isolation, acceptable. There was no one who could look at all three and realize that when taken together, there might have been an unacceptable level of risk.
As a result of the accident, Atlantic Airways made several voluntary changes, including the introduction of a rule requiring pilots to check the status of the spoilers before takeoff. The airline also discontinued flights to Stord Airport and stated that it would avoid landing the BAe 146 on runways less than 1,300 meters in length wherever possible.
Stord Airport made changes as well. It soon found that extending the runway would not be feasible, but it managed to find another solution to bring its runway end safety areas into compliance. Instead of extending the safety areas outward, it extended them inward, increasing the length of the safety areas while simultaneously decreasing the length of the runway. By extending the safety areas to 190 meters, the runway length was reduced to 1,199 meters; above 1,200 meters, Norwegian law required 300-meter runway end safety areas, but below this length, only 180 meters were required, thus bringing the airport into compliance. This move was deemed safe because the decrease below 1,200 meters also entailed a reduction in the maximum weight of aircraft allowed to land at the airport. In order to ensure that rescuers could respond more quickly to future runway overruns, the airport also built new access paths and purchased a boat that could rescue people and tackle blazes directly from the sea. The AIBN also suggested that the airport install an Engineered Materials Arrestor System — much like a runaway truck ramp for planes — to force speeding aircraft to stop before they can fall over the edge. However, as of 2020, no such system has been installed.
In its final report, the AIBN issued two additional recommendations. First, it recommended that when CAA Norway requires airports to make safety upgrades, that it also require them to put in place measures to mitigate the risk caused by those non-compliances, until such time as they are corrected. Second, it noted that the crew believed their brakes had failed even though reduced brake effectiveness was a normal side effect of the failure of the spoilers. This was probably because they had never been trained on what to do in the event a spoiler failure, and had they known this, they might not have pulled the emergency brake. Procedures also called for a go-around if the spoilers don’t deploy on touchdown, but again, without the topic being covered in training, they were unlikely to have remembered this. As a result, the AIBN recommended that British Aerospace ensure that all operators of the BAe 146 are aware of the dangers of spoiler failures and implement training programs to help pilots respond. Regarding the spoiler failure itself, the AIBN did not issue any recommendations because it did not determine the cause, because no similar failures were known to have occurred previously, and because usage of the aircraft type was declining, making it unlikely that a similar failure would occur in the future.
As a result of their actions in the immediate aftermath of the crash, which helped save many lives, flight attendants Maibritt Magnussen and Guðrun Joensen (deceased) were selected by readers of the Faroe Islands’ main newspaper as the Faroese persons of the year. Although he was unsuccessful in his attempts to save his passengers, Captain Niklas Djurhuus also performed several selfless acts of heroism for which he too should be commended. As his plane burned around him, he risked his own life to climb back on board to render assistance, a level of bravery that went above and beyond the call of duty.
The accident itself should serve as a lesson about the nature of risk. The list of risk factors that day was rather long: the BAe 146 didn’t have reverse thrust; the runway was short; the airport had poor safety margins; the flight was landing with a tailwind; and the runway surface was damp. In hindsight, we can look back and understand why a crash happened that day, but when events play out in real time, the big picture becomes much harder to see. First Officer Evald told the AIBN that they probably only needed 10 more meters to stop safely — if he was right, then even the choice to land with the tailwind proved decisive. Whether you’re flying a plane or driving a car, it never hurts to think about what factors might be adding risk to your trip. If we can mitigate known risks, then we might avoid being rudely awakened by the unknown risks that silently accompany us on every journey, as happened to the passengers and crew of Atlantic Airways flight 670.
____________________________________________________________
Join the discussion of this article on Reddit!
Visit r/admiralcloudberg to read over 140 similar articles.
You can also support me on Patreon.
