Drama in the Snow: The crash of Scandinavian Airlines flight 751
On the 27th of December 1991, a Scandinavian Airlines MD-81 lost power in both engines just one minute after takeoff from Stockholm, forcing the pilots to make a desperate and unenviable choice: where to land their stricken airliner? With only moments to decide, and the snowbound forests outside Sweden’s capital city rising beneath them, they went for the biggest clear area they could find. They just barely made it, shaving off trees on the way in, before the MD-81 crashed to earth in a field and broke into three pieces, sliding to a halt upright if not quite intact. And as the passengers and crew filed out through the breaks in the fuselage, they reached a startling conclusion: despite several serious injuries, all 129 people on board had survived.
The proximate cause of the crash turned out to be relatively simple: large chunks of ice, liberated from the wings during liftoff, fell back and were ingested into the MD-81’s rear-mounted engines. But the potential for this exact type of accident was well known in the industry and even within Scandinavian Airlines, so why did it happen anyway? Investigators would ultimately reveal several factors that led to the preventable accident, including poor communication within SAS, insufficient training for pilots and de-icing crews, and perhaps most surprisingly, a software system installed quietly by McDonnell Douglas that may have caused the plane’s second engine to fail moments after the first.
◊◊◊
Founded in 1946 by the union of three smaller airlines, Scandinavian Airlines System, better known by its acronym SAS, is the joint flag carrier of Denmark, Norway, and Sweden, uniting air travel in the three Nordic countries under the banner of international cooperation. The combined airline has a good safety record, as do most Nordic airlines, but a few accidents nevertheless mar its history. Ironically, the most famous of these — and the one for which SAS bore the greatest responsibility — is one in which nobody died.
The story in question began at Stockholm Arlanda Airport in Stockholm, Sweden, where a Scandinavian Airlines McDonnell Douglas MD-81 nicknamed “Dana Viking” arrived from Zürich, Switzerland on the night of the 26th of December, 1991. Although the weather was poor, the flight passed without incident, and after the last passengers disembarked, the plane was secured for the night sometime around 23:00.
The conditions that night were dismal, but not extreme: the temperature was 1˚C, and a light drizzle was falling over Arlanda Airport, trying and failing to transition to snow. For the passengers on Dana Viking’s last normal flight, it was nothing more than classically dank Swedish winter weather — but it was actually the first link in a very nearly deadly chain of events.
The issue began with the plane’s fuel — 5,100 kilograms of it, to be precise, split evenly between the MD-81’s two wing fuel tanks, leaving them each about 60% full. This fuel had been uplifted in Zürich and was carried to Stockholm at the flight’s cruising altitude, where the outside air temperature reached a bone-chilling -62˚C. The freezing point of aviation fuel is much lower than that of water, so these temperatures don’t pose a safety risk from a fuel standpoint, but they do lead to a phenomenon known as “cold-soaking,” wherein prolonged exposure to extremely low temperatures at altitude chills the fuel, allowing it to remain much colder than the ambient air temperature after the plane has landed.
Because the fuel in the tanks of “Dana Viking” had been cold-soaked on the flight over from Zürich, its temperature remained far below freezing for many hours after the plane landed. Furthermore, because the wing fuel tanks in the MD-81 are structurally integral — that is to say, the wall of the fuel tank and the skin of the wing are one and the same sheet of metal — the upper surface of the wings remained colder than the outside temperature as well. This effect was particularly pronounced in the inboard aft corner of each wing tank, which was the lowest part of the tank and hence where the fuel tended to pool. The fact that this area would be especially cold was so well known it even had a name — the “cold corner.”
Therefore, as near-freezing rain fell over Arlanda Airport, the droplets came into contact with the chilled surface of the wings, where they froze, forming a layer of ice, especially near the cold corners. Later, however, the temperature dropped to 0˚C and the rain turned to snow, causing slush to start accumulating instead. At around 2:00 that morning, a mechanic observed nearly invisible clear ice on the wings of Dana Viking, while slush had built up around the landing gear, but his shift ended hours later, and no report of his discovery was ever passed on (nor was it required to be).
At 7:30, with the temperature still hovering around 0˚C, preparations began for Dana Viking’s next trip, the routine flight 751 to Copenhagen, Denmark. Six crewmembers had been rostered for the flight, including four flight attendants and a two-pilot crew consisting of 44-year-old Captain Stefan Rasmussen and 34-year-old First Officer Ulf Cedermark, who had a combined 11,000 hours of flying time. Neither was particularly experienced on the MD-81, although Captain Rasmussen’s 600 hours still dwarfed the total accumulated by the recently transferred Cedermark, who had only 76.
As 123 passengers prepared to board the plane, ground crews again inspected the wings for ice and snow. Using a ladder, a mechanic leaned out across the leading edge of the wing and scraped away slush, but found no clear ice. Of course the ice hadn’t gone anywhere: he just wasn’t looking in the right place. Because ice tends to build up near the “cold corner” first, this is the most critical location that should be checked, but it was out of reach of where the mechanic had set up his ladder. Furthermore, as the name implies, clear ice is difficult to detect with the naked eye, especially when hidden under a layer of slush, so the only reliable way to ensure its absence is to physically touch the contaminated wing surface. Therefore, the best practice for ice detection is to touch the cold corner, but unfortunately this advice was not followed.
Meanwhile, Captain Rasmussen ordered the plane’s fuel tanks topped up, then turned his attention to de-icing. A mechanic had reported that there was frost on the underside of the wings, which he wanted removed, as it could negatively affect the plane’s aerodynamics. He consequently ordered the plane de-iced, and ground crews sprayed down the wings with a heated solution of glycol and water.
When the mechanic reported that de-icing was finished, Rasmussen double checked, asking, “And they’ve got it good and clean under the wings?”
“Yes, there was a lot of ice and snow, now it’s fine, it’s perfect now,” the mechanic explained.
“That sounds fine, then, thanks,” Rasmussen replied.
As far as standard operating procedures are concerned, Rasmussen had done his job. The mechanic had confirmed that all the ice had been dealt with, and since no one had reported clear ice on the wings, there was no requirement to check whether the de-icing had actually removed it. As far as anyone knew, then, flight 751 was fit to depart.
Unfortunately, however, the de-icing process had not been completely effective. The glycol solution did remove the slush, but the de-icing technician had stopped spraying the top of the wings once all the slush was gone. A more intensive de-icing of the underside of the wings was then done at Rasmussen’s request, but the clear ice remained on the top, in the vicinity of the cold corner. Its presence was in fact implied by the status of the plane’s ice indication tufts — a set of loose tufts, four on each wing, that will freeze in place when ice is present. When not frozen in place, the tufts will visibly move when sprayed, proving that the wing is ice free. The de-icing technician would later recall that he saw at least one of the tufts move while spraying the wing, but a passenger seated over the wing reported that the tufts he could see remained stationary. If the passenger’s testimony was accurate, then an opportunity to detect the ice unfortunately might have been missed.
Minutes later, at approximately 8:47 a.m., flight 751 sped away down the runway, her pilots unaware that anything was wrong. The takeoff roll progressed normally, and once the proper speed had been reached, First Officer Cedermark called out “rotate.” Captain Rasmussen pulled back, and the plane lifted off the runway, ascending toward the cloud ceiling some 1,000 feet above.
The illusion of normalcy did not last long. As the plane lifted off, its weight was transferred from the landing gear to the wings, causing the wings to flex up and down. This shattered the layer of clear ice, which then sloughed off the wings and slid back in the slipstream — directly into the MD-81’s two rear-mounted engines.
As large chunks of ice shot into the rapidly spinning fans, heavy impacts damaged several of the fan blades in both engines. The smooth flow of air over the fan blades is critical to the stability of the entire compression and combustion process, and even though none of the fan blades outright broke, the deformations caused by the ice were sufficient to disrupt the delicate balance of pressures inside the right engine — at this stage, the left engine held on.
Inside a jet engine, air is compressed before being mixed with fuel and ignited in the combustion chamber to spin the turbine and produce thrust. This compression occurs in two stages, as air first passes through the low pressure compressor, followed by the high pressure compressor, which compresses it further before it ignites in the combustion chamber. The ignition process involves considerable pressure, so the compression of the air to a high pressure before it enters the combustion chamber is essential to ensure that the combustion process directs air aft into the turbine and not forward toward the intake where it entered. However, if the airflow into the compressors is disrupted, they will be unable to compress the air to the pressure required to prevent this from occurring, at which point air will explosively erupt forward from the combustion chamber and into the compressors, against the normal direction of travel. This is known variously as a “compressor stall” or a “surge.”
Because a high power setting results in greater pressure in the combustion chamber, less airflow disruption is needed to initiate a surge as engine thrust increases. With flight 751’s engines at takeoff power, the damage to the right engine disrupted airflow sufficiently to initiate surging, which began to occur 25 seconds after takeoff. A low rumbling sound was heard, followed by a sharp bang as the first surge ripped through the engine. First Officer Cedermark made an inaudible comment, which was followed seconds later by another loud bang, and then a third, as the right engine surged again and again.
“Believe it is… compressor stall,” Cedermark said, correctly identifying the problem.
At this stage, the right engine was not fatally damaged. But if the surges were allowed to continue, the repeated pressure spikes would eventually overload the compressor blades and airflow guide vanes, causing them to fail, at which point all would be lost. The pilots did not have much time to get it right.
As the engine continued to surge in the background, Captain Rasmussen attempted to engage the autopilot, but it failed to connect, and an electronic warning voice began calling out, “AUTOPILOT!” He then glanced at his instruments to identify the source of the problem, and although he had some trouble reading the digital gauges amid the heavy vibrations and wildly fluctuating indications, he realized that the problem lay with the right engine. Immediately, he reduced power on this engine slightly in an attempt to clear the surge.
Reducing power is an effective response to a surge because it decreases the pressure in the combustion chamber, but the size of the decrease that is needed may vary, which is why the official procedure calls for the pilot to move the affected thrust lever all the way to flight idle, the lowest in-flight power setting. But nobody had yet retrieved the compressor stall checklist to consult the procedure, and Rasmussen only reduced power by about 10%, which was insufficient to stop the engine from surging.
What Rasmussen did not know, and could not possibly have known, was that a software system was in fact hard at work reversing his attempts to save the engine.
◊◊◊
The McDonnell Douglas MD-80 series has long had something called ARTS, or the Automatic Reserve Thrust System, which was likely well known to the crew. The inclusion of ARTS is a condition of the MD-81’s approval to take off with less than maximum takeoff power, which reduces wear and tear on the engines. Its sole job is to ensure that, in the event of an engine failure after takeoff, the remaining engine is producing maximum takeoff power, or MTO, because the MD-81 may not have sufficient power to climb on one engine at the required gradient if the thrust on that engine is lower than MTO. Its activation threshold is met when the fan rotation speed, or N1, of the two engines differs by more than 30.2% for at least 0.05 seconds during climb.
However, after the MD-80 series entered service, the US Federal Aviation Administration became aware that this system had a significant shortcoming. The problem was that some airlines were using noise abatement procedures that involved reducing power in both engines after takeoff, leaving the plane with less available power than certification rules assumed. If an engine failure were to occur while the engines were rolled back for noise abatement, ARTS would not be able to prevent the plane from being left with less thrust than required. The FAA therefore asked McDonnell Douglas to correct this issue, as a result of which the company designed a system that it would later call Automatic Thrust Restoration, or ATR.
The main difference between ATR and ARTS was that ATR had a more sensitive activation threshold. Although it had several activation criteria that were not significant to this particular case, the most important fact was that it required a difference of only 7% N1 between the two engines, combined with a difference in engine pressure ratio, or EPR (a facsimile for thrust output), of 0.25 or more.
ATR was not a particularly sophisticated system. It did not distinguish which engine was losing thrust; instead it simply increased power on both engines by moving the thrust levers forward, under the assumption that only the “good” engine would respond. It stopped only when one engine reached go-around power, the highest power setting normally used during flight, and it did not activate any kind of special alarm or indication. The thrust levers moving forward and the engine mode selection changing to “G/A” (go-around) were the main indicators of its activation, and the only way to override it was by disconnecting the autothrottle system entirely.
As flight 751 climbed out after takeoff, the surges in the right engine caused a decrease in N1 and EPR relative to the left engine, which met the activation threshold for ATR but not ARTS. Consequently, the ATR system began moving both thrust levers forward toward go-around power. Captain Rasmussen, being quite preoccupied with the loud noises and fluctuating engine parameters, was unaware that ATR had already advanced the thrust levers by 7% when he moved to reduce power in the right engine, so his 10% reduction was actually only a 3% reduction relative to the thrust level at the time the surging began. Needless to say, a 3% decrease was not enough to stop the surges, which continued. However, it’s not known whether a 10% reduction would have been sufficient either.
The real kicker was yet to come, however: 41 seconds after the surging on the right engine began, the left engine started surging as well. The left engine fan blades were not as badly damaged as those on the right engine, and the airflow disruption was initially insufficient to cause surging at the takeoff power setting. But when ATR advanced the thrust lever to go-around power, the pressure in the combustion chamber increased sufficiently for surging to take place, and now that engine also began to tear itself apart.
Twelve seconds later, before anyone could realize what was happening, the right engine failed catastrophically, spewing burning debris into the forests nearly 3,000 feet below. Two seconds after that, the left engine followed suit, having been destroyed quickly due to its higher power setting and thus greater available energy when the surging began. Both engines rapidly spooled down, causing the generators to begin dying; the plane started losing electrical equipment, and the pilots’ primary displays went dark. Their altitude peaked at 3,318 feet, and then the powerless plane began to descend.
◊◊◊
Among the 123 passengers aboard flight 751 were at least two Scandinavian Airlines captains, one of whom was deadheading in uniform. When the emergency began, one of the captains informed a flight attendant that the engines appeared to be surging, and the flight attendant attempted to call the cockpit about 10 seconds before the engines failed, but understandably, no one picked up — nor would the information have been helpful at that stage. Moments after that, the uniformed captain, 47-year-old Per Holmberg, concluded that the crew were in desperate need of assistance. A highly experienced pilot who had been flying since the age of 17, he had 920 hours on the MD-81 — more than either cockpit crewmember — and he could see through the open cockpit door that the situation was not under control. At that moment, he decided it was time to intervene.
Up front, in disbelief at the sudden failure of both his engines, Captain Rasmussen ordered, “Engine relight, engine relight!”
A fire warning suddenly sounded, informing the crew that the left engine was ablaze.
“Should I shut it down?” First Officer Cedermark asked. “Is the left engine responding?” Before waiting for a response, he jumped on the radio and said, “Arlanda, Stockholm, SK seven four… seven five one!”
“Ja godmorgon,” the controller said, greeting the crew in Swedish, before switching to English. “SK seven five one, climb to flight level one eight zero, no speed restriction.”
Needless to say, climbing was out of the question. “We have problems with our engines, please… we need to go back to, to go back to Arlanda,” Cedermark explained.
“Do we have a restart procedure?” Captain Rasmussen asked.
“Seven five one, roger, turn right heading one eight — ” the controller started to say, before a power interruption momentarily cut out the cockpit voice recorder.
At that moment, Captain Holmberg arrived at the cockpit and pressed the entry bell, triggering a double chime, before entering. First Officer Cedermark immediately handed him an emergency checklist and told him to start the auxiliary power unit, which would provide backup electrical power. Holmberg complied, but his immediate concern was that they keep flying straight and level to avoid losing control of the powerless plane, so he urged Rasmussen to “Look straight ahead.”
“Yes,” said Captain Rasmussen, who was flying by hand, steering what had become little more than an enormous glider.
“Yes,” Holmberg repeated. “Look straight ahead.”
Turning back to the cabin crew, Captain Rasmussen said through the open cockpit door, “Prepare for emergency!”
“Yes, look straight, look straight ahead, look straight ahead!” Holmberg repeated.
“Yes!” said Rasmussen.
“SK seven five one, are you able to turn right heading zero nine zero, radar vectoring for zero one — ” the controller said, before again being cut off by a power interruption.
“Roger, we are maintaining heading right now, but we are trying to make a restart of the engines and make a slow turn to the left,” First Officer Cedermark replied.
“Engine restart checklist,” Rasmussen ordered again.
“Roger, you can maintain two thousand feet also,” said the controller.
The pilots began running through the engine restart checklist for the right engine, turning on continuous ignition, but it was damaged beyond repair. Given the fire warning, it was self-evident that the left engine was in the same condition.
“Look straight ahead, look straight ahead,” Holmberg repeated. Captain Rasmussen was making a slow turn to the left, perhaps to circle back toward the airport, but they were descending back into a dense cloud layer, and he was flying using only the tiny backup instruments on the center panel.
“We are not able to maintain two thousand feet, we are descending, we are now at one thousand six hundred descending,” First Officer Cedermark said to air traffic control.
“Prepare for on ground emergency!” Captain Rasmussen repeated to the cabin crew.
Holmberg didn’t seem to like that Rasmussen was taking his eyes off the windscreen. “Yes, look straight ahead, look straight ahead,” he repeated again.
“Prepare for on ground emergency,” Rasmussen again said.
Holmberg shouted the order back into the cabin this time, and the flight attendants began hurriedly preparing the cabin for a crash landing, which was now inevitable. There was no way to turn back to Arlanda from such a low altitude — their only hope was to find a safe spot to put the plane down.
As they descended in and out of the clouds, Holmberg continued to urge Rasmussen to “look straight ahead.” Still worried that they could lose speed and stall, he also began incrementally extending the flaps in order to enable lower speed flight, which is part of the dual engine failure procedure. By 900 feet above the ground, the flaps were fully extended.
“Flaps, eh,” said Rasmussen.
“Yes, we have flaps, we have flaps, look straight ahead, look straight ahead!” Holmberg said. “No, you fly, you fly!”
Breaking through the clouds completely, their limited options suddenly became clear. Amid dense snow-covered forests interspersed with occasional buildings, Captain Rasmussen spotted a large field far to their right, but immediately judged it to be out of reach. Instead, he chose a smaller field that was almost dead ahead. But if they continued straight, Holmberg realized that they could impact houses near the field, so he said, “Choose a spot, right, right, right, right, right, steer right, steer right!”
Rasmussen corrected their course 25 degrees to the right, keeping the plane in line with the field but not the houses. In the background, a flight attendant could be heard announcing, “Keep your seat belts fastened! Keep calm!”
“Yes, straight ahead there, straight ahead there, straight ahead, straight ahead towards the forest,” Holmberg said.
“TOO LOW, GEAR,” an automated warning system blared.
“Yes, straight toward the forest,” Holmberg repeated, as Rasmussen continued steering away from the houses.
“TOO LOW, GEAR,” the automated voice repeated.
“Shall we get the wheels down?” First Officer Cedermark asked.
“Bend down, hold your knees,” a flight attendant announced in the background, instructing the passengers to assume the brace position.
“Yes, gear down, gear down,” said Holmberg.
“WHOOP WHOOP, PULL UP,” blared the ground proximity warning system. “WHOOP WHOOP, PULL UP! SINK RATE! SINK RATE!”
Cedermark extended the landing gear, which barely had time to lock in place before the trees rose up to meet them.
“Steer straight ahead,” Holmberg said, one last time.
Keying his mic, First Officer Cedermark made a final, deadpan transmission: “And Stockholm, SK seven five one, we are crashing into the ground now,” he said.
Two more “SINK RATE” alarms sounded, and then finally, the plane began to hit trees.
Just short of the field Rasmussen had selected, flight 751 descended into a dense pine forest, rocking the plane with a series of heavy blows. Trees battered the fuselage and ripped off the right wing, spilling fuel across the snow; the plane began to turn over onto its right side, but before it could tilt more than 20 degrees, it slammed hard into the frozen ground. The nose section took the heaviest blow, but the entire aircraft continued forward, its back broken, its fuselage splitting into three pieces as it slid across the snow-covered field. And moments later, still standing upright, the MD-81 ground to a halt, bent in two places and missing a wing, but otherwise intact.
On board, the heavy impact brought overhead bins crashing down from the ceiling and spilled baggage into the aisles, but the seats held, and as soon as the plane came to a stop it became apparent that the forced landing had been successful in almost every respect. Many of the passengers found themselves utterly unharmed, and although several people were seriously injured — particularly in the front right part of the cabin — it did not appear that anyone had died. Stunned by their good fortune, the passengers made an orderly exit using several doors and the breaks in the fuselage, while the crew attempted to help those who were hurt, including the deadheading captain, Per Holmberg. Although he was standing at the moment of impact, Holmberg had managed to brace himself against a bulkhead, only to be knocked unconscious as he was thrown head-first into it during the crash. The pilots found him lying senseless on the floor in the back of the cockpit, so Captain Rasmussen physically carried him from the plane and placed him on top of a detached emergency slide, where he regained consciousness some 20 minutes after the crash.
Immediately after the accident, air traffic controllers notified emergency services of the missing aircraft, but its location was unknown until some 15 minutes after the crash, when a survivor managed to place a call from a nearby cabin. Rescue teams rushed to the scene with helicopters and ambulances, where they initiated triage, airlifting several of the most seriously injured survivors to area hospitals. First responders also used specialized equipment to extract a man who was trapped in the wreckage, discovering that he was totally unhurt despite having been wedged in such a way as to impede his escape. He was the last to leave the plane, while the remainder of the passengers and crew congregated inside the cabin to escape the cold and wait for a headcount. It ultimately took several hours for the airline to produce a correct manifest and for first responders to verify the number of passengers, but when all was said and done, they were pleased to confirm that nobody was missing and no one had died in the crash.
Although several people suffered life-altering injuries, including one who was left paralyzed, the survival of everyone on board captivated the press and swiftly launched all three pilots to stardom. Swedish media dubbed the accident the “Miracle at Gottröra,” after a nearby village, and the crash has been known by that name ever since. Indeed, the term feels appropriate — given the extent of the damage to the aircraft and the limited number of landing sites, the outcome could easily have been different.
◊◊◊
The task of investigating the near-disaster outside Stockholm fell to the independent Swedish Accident Investigation Board, known by its Swedish acronym SHK.
The fact that flight 751 lost both engines due to ice ingestion was proven at an early stage of the investigation. The fan blades showed damage consistent with ice impacts, and passengers recalled seeing ice slough off the wings during takeoff. All other damage to the engines appeared to have followed the initial ingestion of ice, as disrupted airflow through the core triggered continuous surging that eventually ripped both engines apart. Over 500 engine parts were collected from underneath flight 751’s flight path, which together amounted to a mere 30% of the missing material, underscoring the catastrophic nature of the engines’ final disintegration.
Once the engines failed, the crew had very few options. Although an attempt to relight an engine may have been attempted, this never had any hope of success. Instead, the only choice was to make a forced landing in a clear area, which the pilots managed to do, working as a team with off-duty Captain Per Holmberg. The decision to adjust course to avoid houses, the decision not to return to the airport, the selection of the landing site, the progressive extension of the flaps, and the final deployment of the landing gear were all correct decisions, consistent with the forced landing procedures and with good judgment, that contributed directly to the safe outcome.
However, investigators necessarily wondered whether the dual engine failure could have been avoided. After all, an engine surge is not normally a fatal event; even with damaged fan blades, an engine can continue to run as long as the power is reduced below the surge threshold quickly. The surge threshold for the right engine was unknown, but the flight data recorder showed that Captain Rasmussen only reduced power by 10%, and did not decrease power further, even though the engine surge checklist calls for power to be reduced all the way to flight idle. Furthermore, it was obvious from the flight data that the left engine functioned normally at first, only to begin surging when power was advanced some 41 seconds after the ice ingestion. Therefore, the threshold at which the damaged left engine would surge lay above the takeoff setting, and if power had not been increased, it might have been possible to continue the flight. This raised two key questions: first, why didn’t Captain Rasmussen react correctly to the surge, and second, why did power increase in the left engine?
For the first question, Rasmussen provided a clear answer: he simply hadn’t been trained on how to react to a surge. As opposed to an outright failure, the response to an engine surge was not practiced in training at SAS, nor was it required to be, and although the steps were described in the quick reference handbook of abnormal procedures, in the event there was not enough time to retrieve it. Had the engine surge checklist been used, it would have called for an immediate reduction in power on the affected engine to flight idle, followed — if the surging stops — by a slow advancement of the thrust lever until the highest stable thrust setting is found. This might have allowed the right engine to recover, but it’s impossible to know for sure.
Investigators noted that during simulated engine surge events, most pilots took too long to retrieve the abnormal checklist, and by the time they did so, the engine had often been surging for long enough to cause fatal damage. This underscored the need for the surge response to be a “memory item” — a procedure that pilots must commit to memory and perform immediately without reference to a checklist. The fact that this was not already the case caught investigators by surprise, and in their final report the SHK called it “remarkable.” Indeed, it should go without saying that highly time sensitive emergency procedures be committed to memory, especially ones as simple as “reduce affected power lever to flight idle, then advance slowly.”
In the event, Captain Rasmussen did not reduce power to idle, and a chance to save the right engine might have been lost. Even so, however, the plane should have been able to continue climbing using the left engine, which made understanding its failure all the more important.
Only by studying the flight data in detail and conferring with McDonnell Douglas were investigators able to discover that the course of events was dramatically altered by the Automatic Thrust Restoration system, or ATR. At the time of the accident, ATR was so obscure that it didn’t even have a name — it got the name “ATR” only as a result of its importance to the crash of flight 751. The system had existed since 1983, but its existence was referenced in the manufacturer’s official flight manual only in the section on noise abatement procedures. Although SAS did not use noise abatement procedures, ATR was installed on all new MD-80 series aircraft built after 1983 regardless of which airline was to receive them, and the crashed MD-81 “Dana Viking” was equipped with the system when it was delivered new to SAS earlier in 1991. Nevertheless, SAS claimed that none of its personnel had knowledge of the system’s existence, since the update was not disseminated through other channels. Indeed, the crew of flight 751 were unaware of the existence of ATR until it was revealed during the investigation.
The role that ATR played in the accident was probably decisive. Before Captain Rasmussen began reducing power in the right engine, ATR had already advanced both thrust levers by 7% without his knowledge, turning his 10% reduction into a 3% reduction relative to the thrust level when surging began. It’s not known whether a 10% net reduction would have saved the right engine, but the possibility could not be ruled out. More critically, however, ATR was responsible for the movement of the left thrust lever into the go-around position, which caused the left engine to begin surging as well. Had this not occurred, the flight might have landed safely on one engine, provided that the pilots did not unnecessarily increase power.
In its response to the SHK report, the United States National Transportation Safety Board, or NTSB, which participated in the investigation on behalf of the state of aircraft manufacture, added to and in some cases questioned the SHK’s conclusions surrounding both the flight crew’s behavior and the knowledge of ATR within SAS. The NTSB representative on the investigation team wrote that he was “surprised” to read that SAS pilots were not trained to respond to engine surges, given that First Officer Cedermark, Captain Per Holmberg, and another captain in the passenger cabin all recognized the surging for what it was, and Rasmussen seemed to know that reducing power was the proper response. In the NTSB’s view, these facts indicated that the pilots were trained to respond to surges, and that Rasmussen’s insufficient reduction in power was potentially a contributing factor to the accident. However, I would suggest that the positions of the NTSB and the SHK on this matter are not mutually exclusive — in fact, it’s entirely possible that the pilots were aware of surging in principle due to institutional knowledge or self-study of the emergency checklists, even if they were not required to memorize the procedure or undergo examination in the simulator. In either case, as someone with no direct knowledge of SAS’s training program at the time, I have to trust the SHK’s assertion that reducing power to idle in response to a surge was not a memory item.
The NTSB also questioned SAS’s claim that it didn’t know about ATR, leveling more pointed criticism at the airline than the SHK did. In the NTSB’s view, the fact that the system was mentioned in the flight manual should have been detected even though it was in a section describing procedures SAS did not use. The NTSB representative wrote that it’s simply good practice to carefully read every portion of the manual, regardless of whether airline personnel believe one section or another is inapplicable or unimportant. The airline’s apparent failure to analyze the section on noise abatement procedures was therefore suggestive of insufficient diligence, regardless of whether McDonnell Douglas should have been more direct, an issue the NTSB representative did not address.
Ironically, however, the party most critical of the crew was a crewmember himself — the deadheading captain Per Holmberg. In a statement to Swedish tabloid Expressen years after the accident, Holmberg took credit for the outcome: “I was the one who found the field we landed on,” he said. “Those poor guys up front had no idea what they were doing. I was the one who made sure we got down.” In another account of the crash, Holmberg provided other unflattering details, including an allegation that Rasmussen dropped the public address microphone moments before impact and that Holmberg had to stop him from rooting around trying to find it instead of flying the airplane. He also stated that he was continually worried that Rasmussen would lose focus and stall the airplane, which was why he kept saying “look straight ahead,” and why he extended the flaps without being told. However, he also admitted that the situation was difficult, writing that “The information flow during that short flight was tremendous, exceeding many times the amount of information that even an experienced pilot can assimilate.” For his part, Rasmussen has responded to Holmberg’s statements dismissively, writing that he would rather not address allegations that are in his view not based in fact.
From the admittedly bare-bones cockpit voice recorder transcript, it’s difficult to say whether Holmberg’s version of events holds any water. It’s not possible to know from words on paper what the atmosphere in the cockpit was like, or who took certain decisions. While it’s true that Rasmussen did not say much of substance during the four-minute flight, he comes across in interviews as a man of few words. It’s therefore possible, and I would like to believe, that Holmberg is simply sharing how the situation looked from his point of view, and that Rasmussen was preoccupied with equally important considerations. This view was endorsed by the SHK, which issued a thinly veiled rebuttal of any attempt by one crewmember to claim individual credit for the outcome: “In the Board’s opinion,” they wrote, “there is nothing to show otherwise than that the three pilots separately and jointly contributed to the successful emergency landing.”
All of the above having been said, one crucial question remained: why was the plane allowed to depart with clear ice on its wings in the first place?
In theory, Captain Rasmussen was ultimately responsible for ensuring that the plane was ice free on departure. However, in practice this usually means receiving verbal confirmation from the de-icing technicians that all ice has been removed, and unless ice is still obviously visible from the cockpit, pilots are likely to take the technicians at their word. Indeed, Rasmussen double checked with the mechanic that all the ice had been removed, as he should have done.
The departure of the plane with ice on the wings in fact came down to the failure of Scandinavian Airlines’ de-icing procedures. The SAS mechanic who spotted clear ice during the night was not required to report this to the next shift; technicians were not provided with the equipment necessary to reach the “cold corners” where ice was most likely to form; and when the day shift mechanic checked the wings for ice and did not find any, procedures did not require a follow-up inspection after de-icing. These practices failed to ensure that the clear ice was detected, even though the conditions prior to the accident were ideal for its formation.
The fact that SAS procedures were inadequate in this area was especially concerning in light of the fact that clear ice on the MD-80 series was a known threat within the aviation industry. Indeed, cases of clear ice breaking off the wings and falling into the engines had been occurring ever since the release of the DC-9–51, a stretched version of the original DC-9 that helped form the basis for the updated MD-80 series. On the DC-9–51 and subsequent MD-80 models, the airplane’s fuel capacity was increased by extending the center fuel tank out into both wing roots, while the wing fuel tanks were pushed farther out into the redesigned aircraft’s new, larger wingtips. This meant that the cold corners of the wing fuel tanks now lined up with the engine intakes, whereas on previous DC-9s they had not.
The potential for problems as a result of this configuration was recognized early on, and manifested most dramatically in 1981, when a Finnair DC-9–51 ingested ice into both engines, causing serious damage to one and minor damage to the other. (Incidentally, the difference in outcomes between the Finnair case and the crash of flight 751 could have been because the Finnair DC-9 was not equipped with ATR.) The flight was able to land safely, but the problem persisted, as Finnair personnel continued finding clear ice on their DC-9s even after they were de-iced, prompting the airline to declare in 1985 that unremoved clear ice was the most difficult systemic threat facing the company’s operations.
In May 1989, the issue reared its head at SAS when a Scandinavian Airlines flight to Helsinki again ingested ice into both engines. As a result of the incident, the joint Danish-Swedish-Norwegian Scandinavian Civil Aviation Supervisory Authority, or STK, sent a letter to SAS requesting corrective action on the clear ice issue, prompting the airline to begin researching solutions. Airline representatives attended an “MD-80 Ice Foreign Object Damage (FOD) Conference” in Zürich in November 1989, on the basis of which they drafted new de-icing guidelines for the winter of 1991/1992 that included a re-inspection after de-icing if clear ice had previously been found. The airline also sent out a bulletin to SAS pilots just three weeks before the accident warning of the risk of clear ice being ingested into the engines, and advising that ice on the bottom of the wings was an indicator that there was also ice on the top. But the guidelines did not address shortcomings that made it more difficult for ground crews to detect clear ice in the first place, a fact that was apparently missed by the STK, which had expressed confidence that SAS was handling the clear ice problem. This assumption was made despite the fact that the STK was not actively verifying, through observation of the actual de-icing process, that the airline’s procedures were effective.
The problem with undetected clear ice on SAS planes was in fact so pervasive that flight 483 to Oslo, another SAS MD-81 that departed Arlanda Airport 18 minutes after flight 751, also took off with clear ice on its wings. During the takeoff roll, a passenger spotted the ice and heard abnormal noises from the engines, prompting an inspection after the plane landed. Clear ice was found still adhered to 25% of the total wing area, and an engine examination discovered minor fan blade damage in the left engine. Therefore, had things turned out a little bit differently, SAS could have had not one forced landing that day, but two!
◊◊◊
In the end, the SHK concluded that the accident was the result of several systemic and operational failures, including poor ground crew procedures and pilot training at SAS and poor design and documentation of the ATR system by McDonnell Douglas. As a result of its findings, the SHK issued 15 recommendations, including that McDonnell Douglas provide a way for airlines deactivate ATR; that crashworthiness requirements for overhead bins be improved; and that the Swedish Civil Aviation Administration ensure SAS improved its quality assurance program. Before the completion of the report, McDonnell Douglas published numerous letters to operators and held several conferences in order to raise awareness of the clear ice threat to MD-80 series aircraft, and SAS immediately changed its procedures to require a tactile check of the upper wing surface after de-icing, including examination of the ice indication tufts, regardless of whether clear ice had previously been detected. The airline also revised its procedures for initial clear ice checks and procured the proper equipment, and established a procedure for moving fuel from the wing tanks to the center tank prior to parking overnight in order to prevent clear ice from forming. Finally, the US Federal Aviation Administration mandated that language about ATR be included in the Airplane Flight Manual, including a statement about the risk that ATR could worsen engine surging; the first item on the checklist for an engine surge after takeoff was changed to call for disengagement of the autothrottle, inhibiting the ATR system; and all MD-80s were required to be fitted with electronic ice detectors.
Thanks to these measures, and the three pilots’ decision-making under pressure, the industry was able to learn about the danger of ice ingestion on the MD-80 series without loss of life. No similar accidents have occurred since, and that record is likely to hold, as the majority of MD-80 series aircraft have been withdrawn from service since production ended in 1999. In fact, rear-engine jets as a class have largely fallen out of favor, and the jets with wing-mounted engines that now dominate the world’s airways are not at risk of ingesting wing ice.
Unfortunately, Captain Rasmussen was never able to experience these changes firsthand. Although many survivors consider him a hero, he suffered emotional trauma from the accident that left him unable to return to the cockpit, and he never flew passenger jets again. It was also unfortunate that the crewmembers who worked together to save the plane ceased to get along once the brief flight was over. But in the end, 129 lives were saved, and as much as we might bicker about responsibility and hypotheticals, sometimes that’s all that matters.
_______________________________________________________________
Join the discussion of this article on Reddit
Support me on Patreon (Note: I do not earn money from views on Medium!)
Visit r/admiralcloudberg to read and discuss over 240 similar articles
_______________________________________________________________
Note: this accident was previously featured in episode 51 of the plane crash series on August 25th, 2018, prior to the series’ arrival on Medium. This article is written without reference to and supersedes the original.
