Lefts, Rights, and Wrongs: The crash of British Midland flight 92, or the Kegworth Air Disaster
Note: this accident was previously featured in episode 39 of the plane crash series on June 2nd, 2018, prior to the series’ arrival on Medium. This article is written without reference to and supersedes the original.
On the 8th of January 1989, the 126 passengers and crew of British Midland flight 92 found themselves in a nightmare scenario, trapped aboard a Boeing 737 which had lost both engines at a height of just 900 feet. Within sight of the runway, but unable to reach it, the plane glided helplessly downward toward the countryside below, until with an almighty crash it slammed into an embankment alongside the M1 motorway and came immediately to a halt. Amid the shattered wreckage, the vagaries of physics decided who lived and who died, as 79 people emerged alive and 47 did not.
The puzzling thing about flight 92, in comparison to other cases of dual engine failure, was that its engines didn’t fail at the same time: instead, one gave out during the climb, and the other sputtered and died on final approach. In an effort to solve this mystery, investigators dived into the data, and came to a stunning conclusion: only one engine was ever faulty; the pilots simply shut down the wrong one. How could such an error have occurred? Could better crashworthiness have allowed more people to survive? And why did a brand new engine on a brand new airplane fail in the first place? These were the questions facing investigators — and the answers would lead to changes that have made flying safer for everyone, even as more work remains to be done.
◊◊◊
Until its absorption into British Airways in 2012, one of Britain’s largest air carriers was British Midland, which flew throughout the UK and Europe from its base at London Heathrow Airport. The airline first entered into the business of scheduled passenger flights in 1953 using a 1930s-era biplane, which was then followed by various larger propeller planes, and finally jets, from the BAC One Eleven to the Boeing 707, and eventually the Boeing 737, which first appeared in the British Midland fleet in 1986. British Midland had considerable appetite for 737s, and by the time of its demise, the airline had operated more 737s than any other jet aircraft type. The company’s three first-generation 737–200s were retired within two years, following the purchase of 13 second-generation 737–300s in 1987, and another eight 737–400s when that model became available in 1988.
Our story involves one of these brand new 737–400s, registered as G-OBME, which was assigned to perform British Midland Airways flight 92 from London Heathrow to Belfast, Northern Ireland on the 8th of January 1989. The new plane smell had hardly even worn off: G-OBME had just been delivered to British Midland two months earlier and entered service on November 4th, 1988. By January, it had only been around long enough to undergo a single scheduled inspection, and the possibility of a major malfunction was probably far from the minds of the crew.
On the evening of flight 92, that crew consisted of six flight attendants and two pilots, 43-year-old Captain Kevin Hunt and 39-year-old First Officer David McClelland. Captain Hunt had over 13,000 flying hours on an array of aircraft types, including 763 on various 737 models. McClelland was no longer a rookie, with 3,900 hours of his own, but he was new to the 737 and had less than 200 hours on type.
Every variant of the 737, from the -200 that first entered into service in 1968, to the MAX series still in production today, has a common type rating — a core training curriculum and associated certificate, which grants its holder the right to fly any Boeing 737 ever made. A pilot who has been flying one version can switch to another simply by taking a differences course, which typically lasts less than two days (sometimes much less) and need not involve a flight simulator. Both Captain Hunt and First Officer McClelland underwent just such a course on October 17th, informing them of all the important differences between the Boeing 737–300 and the new 737–400s recently acquired by British Midland.
At 19:52 on the evening of January 8th, Hunt and McClelland maneuvered their 737 onto the runway at Heathrow and took off into a clear winter sky. The 118 passengers settled in for the flight to Belfast, while the pilots ran through their usual checks, configuring the airplane and scanning the instruments for any unusual indications. Unsurprisingly, there were none.
And then, at 20:05, as the flight was climbing through 28,300 feet, the plane began to vibrate alarmingly. Every rivet and panel started to rattle, sending loose objects sliding off the passengers’ tray tables. Almost immediately, an acrid smell began to seep into the cabin, as though something was burning; loud shuddering bangs began to rock the aircraft; and passengers observed bright jets of flame shooting out of the №1 engine on the left side of the plane.
Inside the №1 engine, the outer panel of fan blade №17, part of the fan which draws air into the engine, had separated from the main body of the blade and embedded itself in the surrounding acoustic liner. Like a washing machine with a brick in it, the absence of part of a blade unbalanced the fan, causing heavy vibrations as it swayed from side to side and rubbed against the fan case. Simultaneously, the failure disrupted the delicately balanced airflow through the low and high pressure compressors, causing highly pressurized air to suddenly surge forward, against the normal direction of airflow, with a series of loud bangs. Excess fuel then ignited in the exhaust stream, triggering the bursts of flame seen by the passengers. All things considered, it was a serious malfunction, but not necessarily a fatal one — most of the engine’s internal components were not damaged, and it would still be capable of producing some power if the commanded thrust level was reduced in a timely manner.
Unaware of the exact nature of the problem, but concerned by the smell of smoke, First Officer McClelland exclaimed, “Got a fire, it’s a fire coming through.” Captain Hunt was in agreement — they might have a fire in one of their engines, and they would need to identify and correct the problem as swiftly as possible. But before they could act, they needed to answer a basic question: which engine was failing? This was obvious to some of the passengers, who could see flames coming from engine №1, but the pilots couldn’t see the engines from the cockpit, so they would have to rely on their instrument indications and systems knowledge to diagnose the problem. But amid the heavy vibrations and heightened stress of the emergency, the indications were hard to read.
“Which one is it?” Captain Hunt asked.
“It’s the le… it’s the right one,” said First Officer McClelland.
Despite McClelland’s hesitation, Hunt trusted his judgment. “Okay,” he said, “throttle it back.”
McClelland did not hesitate to disconnect the autothrottle and decrease thrust in the right engine to idle. And as he did so, the loud banging and knocking ceased, and the smell of smoke began to fade. It seemed that the problem had been solved by a textbook engine failure response. But the pilots were wrong — it was the left engine which was failing, not the right engine, and the sudden disappearance of the symptoms was nothing more than an insidious coincidence.
Behind the scenes, the plane’s automated systems were responding to the engine failure in their own, hidden ways. Foremost among them was the autothrottle, the system responsible for maintaining and modifying engine power to achieve the target parameters selected by the crew. At the moment of the failure, the autothrottle was engaged and in control of engine thrust when it detected a major drop in the №1 engine fan rotation speed relative to the commanded value. Such a drop can be, and in this case was, a symptom of a surge — a sudden reversal of the airflow through the core, usually caused by a disruption somewhere upstream that leads to an excessive buildup of pressure in the high pressure compressor relative to the adjacent low pressure compressor. If the pressure ratio between the two compressors becomes too great, air will periodically burst forward from the high pressure compressor to the low pressure compressor, triggering the surge. These surges can overstress the compressor blades, resulting in irreversible engine damage, unless the pressure ratio is reduced quickly. With this in mind, when the autothrottle detected a mismatch between the commanded thrust and the actual thrust, it was programmed to reduce the commanded thrust to match the actual thrust output, hopefully bringing the pressure ratio down below the surge threshold. On flight 92, this system worked perfectly, reducing thrust on engine №1 after about three to four surges had occurred. Coincidentally, this reduction in thrust on engine №1 occurred at the same time as First Officer McClelland rolled back power on №2, and the resulting low thrust setting on №1 was then preserved due to the disconnection of the autothrottle.
As a result of the reduction in commanded thrust from engine №1, less fuel was sent to the combustion chamber, the pressure in the high pressure compressor decreased, and the engine stopped surging. It was still fundamentally unbalanced due to the chunk which was missing from the №17 fan blade, but at this lower power setting, the airflow disruption was insufficient to prevent the engine from operating entirely. As such, it continued to generate some power, masking the damage. But most important was its effect on the pilots’ decision making: in fact, the cessation of the surges convinced them that by reducing power to engine №2, they had solved the problem. In reality, however, nothing was wrong with the right engine, and they were now being held aloft only by the mortally wounded left engine, which would rip itself apart if they tried to increase power.
Unaware that they were making a terrible mistake, the pilots carried on under the impression that the emergency was under control. First Officer McClelland called air traffic control and advised that they had an engine fire, at which point Captain Hunt told him to “Shut it down.” Seconds later, however, he changed his mind: “Seems to be running alright now,” he said. “Let’s just see if it comes in.”
With the right engine still set to idle, and not fully shut down, they could increase power on it at any time if they were to discover their mistake. That would be much harder if they shut it down entirely, but for the moment, the possibility remained open. Air traffic control now asked where they wanted to land, and McClelland replied that the closest field was East Midlands Airport in Castle Donington.
Meanwhile, Captain Hunt initiated a descent, now flying manually. In order to lose altitude, he reduced thrust on the left engine to idle, the same as the right engine. As a result, the parameters on the left engine settled down even more, although vibration levels and temperatures were both still above normal. “Seems to have stabilized,” said First Officer McClelland. “We’ve still got the smoke.” He then tried a second time to begin the “Engine Failure and Shutdown” checklist, but he was again interrupted, as Captain Hunt called British Midland operations in order inform the company of the diversion to Castle Donington.
Two minutes later, during a break in radio communications, the pilots finally hurried through the engine shutdown checklist, closing off fuel to engine №2. If they wanted to restore power to this engine, they would now have to go through a complex and time consuming relight process. But for now, the smoke had finally disappeared, everything appeared normal, and there seemed to be no question that flight 92 would soon make an uneventful landing in Castle Donington.
Just to cover his bases, Captain Hunt called the flight attendants on the interphone and asked, “Did you get smoke in the cabin back there?”
“We did, yes,” the lead flight attendant replied.
Hunt instructed the cabin crew to prepare the cabin for an emergency landing, but within a minute, the lead flight attendant was back. “Sorry to trouble you,” he said. “The passengers are very panicky.”
In order to settle them down, Hunt decided to broadcast a message over the public address system. In calm tones, he explained that “trouble with the right engine” had resulted in smoke in the cabin, but that the engine had been shut down and that they would land at Castle Donington in 10 minutes. This statement was reassuring to some, but not at all to others: in fact, numerous passengers on the left side of the plane knew that it was the left engine which had fire coming out of it, and Hunt’s comment about the right engine struck them as strange. But what did they know? The Captain was a pilot, and they weren’t. And so the pilots continued descending toward East Midlands Airport, unaware that they had made a mistake so fundamental that even the passengers noticed.
Throughout the descent, the workload was high, as Captain Hunt flew the plane manually through a series of maneuvers to approach the airport, and First Officer McClelland spoke almost continuously with air traffic control.
At 20:12, sensing a break in the communications, Captain Hunt attempted to start a review of their situation. “Now, what indications did we actually get?” he asked. “Just rapid vibrations in the aeroplane, smoke…”
But before he could get any farther, air traffic control called them with a new heading and descent clearance, and his attention was again drawn away to more immediate matters. First Officer McClelland then switched over to the single engine approach checklist, and Captain Hunt attempted to establish radio contact with the airport fire services.
Over the next several minutes, the flurry of activity continued, as they made the final turns to line up with the runway, extended the flaps, and lowered the landing gear at a height of 2,000 feet. In order to compensate for the drag caused by the flaps and gear, Hunt increased power on the left engine, and initially it seemed to respond normally. But this illusion of normalcy would be brief.
When the engine started to spool up, the vibrations from the unbalanced fan increased until the missing piece of the №17 fan blade, which had until this point remained embedded in the acoustic liner of the engine inlet, came loose and was immediately sucked straight back through the turbine. This caused catastrophic damage to the fan and both compressors, resulting in renewed surging and a massive and irreversible loss of power. The indications for the №1 engine plunged toward zero, and flames once again began to issue forth in great bursts from the exhaust. Residents in the villages of Sutton Bonnington and Kegworth, some four kilometers from the runway, heard a series of loud bangs and a sound like grinding metal, and looked up to see the plane streaking low overhead, fire pouring from its left engine as burning objects fell to earth in its wake.
In the cockpit, the pilots felt the heavy vibrations and heard the horrible sounds, prompting them to look at their instruments, where they realized to their horror that their only remaining engine was losing power. The crew informed air traffic control that they were now having trouble with their second engine, and Captain Hunt, desperate to avoid disaster, said to First Officer McClelland, “Try lighting the other one up — there’s nothing else you can do!”
At this point, the plane was only 900 feet above the ground and falling fast. The lights of the runway could be seen dead ahead, tantalizingly close, but with no engine power, they wouldn’t be able to make it. First Officer McClelland scrambled to find the engine relight procedure, but as he did so, the fire bell sounded, warning of a fire in engine №1. McClelland asked if he should shut it down, but Hunt told him not to. They would need to run it until it destroyed itself, milking it for every last bit of power.
Hunt announced that he would try to “stretch the glide,” but they were falling below the glide slope to the runway. The dispassionate voice of the ground proximity warning system began to call out “GLIDESLOPE” over and over again.
“Try opening the other one up!” said Hunt, watching the ground rise up to meet them.
“She’s not going!” McClelland frantically replied.
If they couldn’t get the right engine restarted, Hunt realized, they would plow directly into the busy M1 motorway, the biggest north-south auto corridor in central England. Again, he said, “Try opening the other one up!” But again, McClelland shouted, “She’s not going!”
Their speed was falling and both engines were dead or dying. They were out of time and out of altitude. With seconds to go until impact, Captain Hunt picked up the PA and made the announcement no pilot ever wants to give: “Prepare for crash landing!”
In the final seconds, their airspeed dropped so low that the stick shaker activated, warning that they were on the verge of stalling. And then, pitched 13 degrees nose up and traveling at a speed of about 108 knots, flight 92 struck the ground with a terrible crunch. The tail section slid across a field before the plane plowed headlong into a stand of trees, flattening them in one, massive blow. The main landing gear then struck an embankment and the plane bounced back into the air, just barely clearing the southbound lanes of the M1 as stunned motorists slammed on the brakes. In the blink of an eye, the plane cleared the median, took down a light pole, missed the northbound lanes by mere inches, and finally slammed nose-first into the embankment on the far side. The massive impact stopped the plane in its tracks and ripped the fuselage into three pieces, sending the nose sliding onward up the hillside, while the tail section turned end over end, coming to rest precariously against the roof of the center cabin.
At the airport, the firefighters, who had expected their presence to be little more than a formality, watched in disbelief as the lights of the airplane slipped below the tree line, followed seconds later by a great burst of dust. Sirens blaring, they exited onto the M1 motorway and rushed to the scene.
However, the first to reach the plane were not firefighters, but passing motorists, who had witnessed the crash sequence from beginning to end. Spotting the plane coming in low toward the M1, several drivers were said to have slowed and turned on their hazard lights to block traffic, and indeed, in an outcome which could only be considered miraculous, no cars were hit when the plane impacted one of Britain’s busiest motorways. Now, with the plane on the ground and emergency services still minutes away, many of these same motorists left their cars and rushed to the wreckage, hoping to extract survivors.
What they found was a scene of carnage. On impact, the majority of the seats had ripped out of the floor and tumbled forward with their occupants into a bloody morass at the front of the plane, where dozens of people were now trapped. Some were dead, and even more were seriously injured, suffering from traumatic head injuries and broken limbs. Things were slightly better in the center wing section and tail, where most of the seats remained attached to the floor, but even here, almost everyone was seriously injured. In the end, only 14 people were able to escape the wreckage without assistance, leaving the rest enmeshed in the debris, pleading for help — but helping them all would be a mammoth task for an army of trained rescuers, let alone a few good samaritans.
Following the arrival of the first firefighters, who quickly extinguished a small fire around the left engine, a massive rescue operation began, involving hundreds of people and vehicles from through the East Midlands. Each passenger had to be extracted individually in a complex sequence, while paramedics worked to triage the victims and identify those most in need. So many people were severely injured that it was hard to know where to draw the line. As dozens of victims were rushed to hospital, several succumbed on the way there or on the operating table. And many more, unfortunately, were already dead.
The rescue operation carried on throughout the night and into the next morning before it finally concluded. The last survivor was not extracted from the wreckage until 4:20 a.m., more than eight hours after the crash. After that, the line of ambulances streaming down the M1 carried only the dead.
In the end, 39 people died at the scene, and another 8 died in hospital, including one who succumbed nearly three weeks after the crash. That brought the final death toll to 47, while 79 people survived, including both pilots and all six flight attendants. However, the survival rate belied the severity of the crash. In fact, of the 79 survivors, 75 suffered injuries which were classified as serious, and some never fully recovered. Captain Hunt was among them: he suffered a severe spinal injury in the crash, and his legs were pinned in the wreckage for hours as rescuers worked to extract him; although he lived, he would ultimately never walk again.
◊◊◊
As the last of the victims were being carried away, investigators with Britain’s Air Accidents Investigation Branch, or AAIB, were already arriving on the scene. Some of them had only just begun a much-needed vacation after sorting through the wreckage of the Lockerbie bombing, which had taken place just three weeks earlier, when they were called out to the scene of another major crash on British soil. Their inquiry would ultimately focus on three areas: why the engines failed, whether the crew handled the failures correctly, and whether more lives could have been saved.
This lattermost topic was especially important in light of the fact that so many seats had separated from the floor and piled forward, resulting in much more severe injuries than would otherwise have occurred. Regulatory requirements for seat strength were quite stringent, with the intention to prevent exactly this sort of mass disruption of the cabin, so the fact that the seats failed in this way was concerning. But when investigators looked closer, they made an interesting discovery: the seats themselves had held up remarkably well; what failed was actually the floor to which they were attached. Numerous seat rows were pulled from the wreckage separately, but with pieces of the seat tracks from the floor still attached to their feet, as though they had been ripped out by their roots. Simulations would later show that on impact, occupied seats tended to rotate forward and downward, overloading the seat tracks to the point of failure and allowing the seat rows to pull out of the floor. This sent passengers hurtling forward head-first into a mass of debris on impact, contributing to the severe head and chest injuries suffered by the occupants, including both those who lived and those who did not. In fact, virtually everyone on board, whether they survived or not, suffered some kind of head injury from striking the seat in front of them. However, outcomes were measurably better among those who had assumed the brace position, relative to those who had not.
Meanwhile, a separate team of investigators began to pore over the wreckage in order to understand why the engines had failed. Initially, the accident had been described to the AAIB as a dual engine failure, and indeed, when investigators examined the 737’s engines, it was clear that neither was operating on impact. Furthermore, the left engine showed clear evidence of an in-flight fan blade failure followed by a localized fire. But the right engine was intact except for some relatively minor damage sustained during the impact. The core was almost totally undamaged, and there was nothing to suggest that the engine was incapable of generating power until the plane struck the ground. Further laboratory examinations confirmed that even though the right engine was not producing power on impact, it had not suffered any failure whatsoever — a disturbing finding which led the AAIB to take a deep dive into the actions of the pilots during the flight.
By interviewing the pilots and examining the contents of the black boxes, investigators were able to piece together the cues available to the pilots and analyze their reactions. Their conclusion was inescapable — the pilots had shut down the wrong engine.
In his testimony, Captain Hunt explained that he immediately suspected the right engine because he smelled smoke coming from the cabin, and he knew that air was fed into the cabin from the right engine. Already having made this connection, he was not surprised when First Officer McClelland announced that the right engine was failing, and he did not hesitate to order its shutdown. But investigators noted two main problems with this decision. First of all, on the Boeing 737–400, some cabin air comes from the left engine as well as the right — a new feature which had not been present on the previous versions which Captain Hunt was used to. This minor change had not been covered in the conversion course, and with only 23 hours on the new -400, Hunt had not had enough time to learn through experience that this assumption was no longer valid. He could hardly be blamed for this, but it wasn’t the AAIB’s only concern. The second issue was that it was hard to see how Hunt could have determined where the smoke was coming from in such a short period of time, especially without asking any of the cabin crew. Instead, investigators suggested that he probably came to this conclusion later, only for his memories of the event to become (understandably) compressed and blurred together. In their view, he most likely determined that the right engine was faulty because he trusted McClelland, and his trust was confirmed when McClelland rolled back the right thrust lever and the surging stopped.
Why McClelland originally chose the right engine, as opposed to the left, was less certain. When asked what contributed to his decision, the severely injured McClelland unfortunately did not remember. Although they put considerable effort into piecing together exactly what indications would have been displayed to him in the seconds after the engine failure, the investigators ultimately could not point to a specific item that might have misled him. However, they did find quite a few factors which could have made it more difficult to determine at a glance which engine was failing.
The first of these was the design of the engine performance gauges. Whereas previous versions of the 737 used analog gauges with traditional pointers, the 737–400 was the first to incorporate a glass cockpit featuring digital displays. This change was one of the main topics of the differences training that the pilots underwent in the previous October, but that didn’t mean that reading the digital gauges would immediately become intuitive for a pilot who had spent their entire career reading traditional instruments. One notable difference between the two was that the digital gauges featured a pointer which moved around the outside of the dial rather than emerging from the center, representing a potential source of difficulty while retraining one’s brain to read the new gauges. And to make matters worse, British Midland didn’t have a 737 simulator equipped with the new indicating system, so the pilots had never seen what a failing engine looked like on the digital displays until they encountered one in real life.
To learn more about how pilots felt about the digital engine indicating system, the AAIB sent out a survey which garnered responses from 90% of UK pilots who had experience with the system. Although British Midland pilots were somewhat more critical than average, the respondents overwhelmingly stated that the system indicated parameters clearly, and fewer than 10% reported having any difficulty adapting. However, a significant percentage of the respondents did note that the digital gauges were not as effective at drawing their attention to sudden changes in engine parameters. Unlike modern digital screens, the displays on the 737–400 in 1989 had low resolution and could only indicate a limited number of pointer locations; therefore, the digital pointers tended to jump around between fixed points, rather than moving continuously in the manner of an analog pointer. This could make movements harder for the human eye to detect, especially using peripheral vision. The effect could be compounded further if a pilot was unused to looking for the pointer outside the dial, rather than inside.
All of this meant that when the pilots glanced at their engine gauges, they might have needed to look more closely than usual in order to read them. Furthermore, the plane was vibrating heavily, making it even harder to focus and track the movements of the small digital pointers. This assumption was corroborated by Captain Hunt, who told investigators that when he glanced at the gauges after the failure, he perceived no useful information.
There was, in fact, plenty of useful information being displayed — according to the flight data recorder, the №1 engine inlet gas temperature was too high; the vibration was off the charts, pinning the pointer on the №1 vibration gauge at the maximum possible indication; and the fuel flow was fluctuating wildly. However, based on the timing of events, it was possible that McClelland first looked at the instruments in between the second and third engine surges, when some of the left engine’s parameters would have been closer to their normal values. The most consistent instrument would have been the №1 engine vibration gauge, but here too, there was a problem: the pilots didn’t put much stock in what it said. Captain Hunt in fact told investigators that he didn’t normally look at the vibration gauges because they were unreliable. Indeed, following their introduction in the 1970s, vibration gauges were actually removed from a number of aircraft types in Britain because they were insufficiently reliable, in large part because they struggled to distinguish between vibrations from the engines and those from other sources. However, by 1989, the vibration gauges installed on newer aircraft types like the 737–400 were quite reliable and were easily able to discriminate between different types of vibrations, a fact which was apparently not appreciated by most air crews at the time.
These factors collectively explained why the pilots did not see the problematic indications from the left engine, but they did not explain why McClelland changed his mind mid-sentence and decided that the right engine was failing. Unfortunately, we may never know the answer. There might not even have been any specific indication that led him to this conclusion. It is perhaps uncomfortable to admit it, but so many choices we make in life, including some highly consequential ones, are ultimately decided based on intuition, gut feelings, or what young people today would call “vibes,” and that may well have been the case here.
You might be asking how it is that a professional pilot could decide which engine is failing based on so little, but you would be surprised — it actually made plenty of sense in the moment. Due to the smell of smoke, the pilots believed that the engine could be on fire, and that they would need to act quickly. Of course, haste begets errors, and pilots are trained to be methodical even in high-stress situations — but that’s easier said in a classroom on the ground than it is in the air during a real emergency. Besides, such a decision made in haste was never meant to be final. Although proper procedure does require that the pilots identify a positive indication of which engine is failing before taking action, they rightfully assumed that if they moved the correct thrust lever to idle, the symptoms would dissipate, and that if they chose wrong, the symptoms would continue, causing them to reverse their choice. Such a reversal would hardly have been unprecedented, and would actually have been consistent with standard procedures for identifying the source of an engine vibration of unknown origin. It was only by insidious coincidence, then, that the pilots did not immediately identify their mistake.
The final nail in their coffin was the timing of the autothrottle’s reduction in thrust on the left engine, which occurred almost simultaneous with First Officer McClelland’s reduction in thrust on the right engine. When this occurred, the surging stopped, and the loud bangs and jolts ceased, forming a powerful mental correlation between McClelland’s action and the resolution of the problem. There were a few cues that the problem was still present: for example, the №1 inlet gas temperature remained elevated throughout the flight, and the №1 vibration gauge remained maxed out for the next several minutes, until power was reduced to idle for the descent. However, because the magnitude of the vibrations had decreased so much after the cessation of the violent surges, the pilots did not recognize that the plane was nevertheless still vibrating, and in fact they told investigators that as far as they knew, the vibrations stopped when McClelland reduced power on engine №2. In any case, these minor cues were clearly insufficient to overcome the correlation which had already been established.
After that point, the stage for disaster had largely been set, but there were still a few plausible chances for the pilots to have discovered their error. Probably the most salient occurred during the descent, when Captain Hunt attempted to initiate a review of the situation. Reading his words, “Now, what indications did we actually get,” it is almost possible to see a fork in the road: one timeline where the pilots sit down to go over everything and realize that they shut down the wrong engine; and the actual timeline, in which Hunt was interrupted by a transmission from ATC and never returned to his abortive attempt at a debrief. Investigators noted that while they couldn’t fault the pilots’ decision to land at the nearest available airport, given the possibility of a fire, the rushed approach did leave few opportunities for them to mull over their choices and potentially discover the problem. In the event, they didn’t even manage to finish the applicable checklists, removing additional opportunities to cross-check their actions.
Another potential point of intervention was when Captain Hunt mentioned trouble with the right engine during his cabin announcement. As was discussed earlier, some passengers who had seen flames coming from the left engine wondered whether the Captain had made a mistake, but none were self-confident enough to speak up. The flight attendants might have been in a better position to point out the discrepancy, but by chance, none of them heard Hunt mention the right engine, probably because they were too busy preparing the cabin for the emergency landing. Although it is rare for passengers to possess safety critical information that the crew does not, it can occasionally happen, and British Midland flight 92 isn’t the only such case. With this in mind, passengers should follow the rule of “if you see something, say something:” while chances are high that the crew does in fact know more than you, there is nothing to be lost by politely asking a flight attendant to weigh in if you think something looks wrong.
With these opportunities having been missed, the flight was all but doomed. When Captain Hunt increased engine power on final approach, the damaged №1 engine destroyed itself, leaving the plane without enough thrust to maintain altitude. Only 54 seconds passed between the final engine failure and the moment of impact. With engine №2 having been fully shut down several minutes earlier, the only way to get it going again was to perform a complicated relight procedure.
One way to relight an engine is to perform a windmill restart, using airflow to kickstart rotation of the core; however, this requires a high airspeed in order to be effective. Flying low and slow on approach, flight 92 was not going fast enough to attempt a windmill restart, and they were too close to the ground to gain speed by diving.
Another way to restart an engine is by using bleed air pressure from the other engine to initiate core rotation. However, the №1 engine was too far gone to provide the required pressure. The only way to perform such a restart would have been to launch the auxiliary power unit (or APU, the backup generator in the tail), connect it to the bleed air manifold, switch off both air conditioning packs, and use APU pressure to rotate the core. However, the procedures for such an APU restart in the Quick Reference Handbook only applied to restarting engine №1, because the procedure was intended for a situation in which both engines had flamed out for the same reason, such as bad fuel or heavy rain, under the assumption that the pilots could then use engine №1 to restart №2. As a result, First Officer McClelland would have had to improvise a procedure for restarting №2 based on the procedure for №1, which was way beyond his abilities, given his limited Boeing 737 experience. And even if he had somehow thought of this in the first place, the time available would have been insufficient to complete the procedure anyway.
◊◊◊
All of this having been said, one major question remained: why did the №1 engine fail in the first place?
Working off of tips from witnesses, investigators turned up several pieces of the fan blades from engine №1 in a field in the village of Sutton Bonington more than three kilometers behind the crash site, including the outer panel of blade №17. This panel showed clear signs of metal fatigue — that is, the cyclical breakdown of the material over the course of repeated load applications, resulting in cracks which grow until the component fails. Simulations confirmed that the release of the outer portion of this blade unbalanced the engine and caused the vibrations and surging during the initial engine failure. However, the engine continued to operate relatively normally for several more minutes after this, indicating that damage at that time was limited — certainly less than the extensive destruction of the fan and compressor assemblies which was found on the engine after the crash. The fact that the missing piece of blade 17 was found so close to the crash site, and not at the initial point of failure, provided the answer to this mystery. Most likely, the AAIB concluded, the blade fragment became embedded in the acoustic liner throughout the descent, before being sucked in, destroying the engine, when the pilots increased power on final approach.
However, that was only part of the story. The bigger question was why the fan blade had failed so quickly — after all, fatigue failures of engine fan blades typically occur over the course of many years, while this one failed after only two months. Furthermore, the blade was identical to every other, without any sign that it was uniquely defective. That left only two real possibilities: either the engine was struck by some foreign object, weakening the blade, or there was a problem with the engine’s fundamental design. However, an examination of the fan blade showed no evidence of it having been struck by a bird, rock, or any other object at any point during its brief service life. This finding led investigators to look deeper at the engineering angle instead.
The 737–400 was fitted with brand new CFM-56–3C-1 engines, which were developed by engine manufacturer CFM International from the CFM-56–3B-1 and 3B-2 engines fitted to the Boeing 737–300. One of the main differences between the two versions was a slightly altered fan blade design, which helped the 3C-1 engines achieve an additional 1,500 pounds of takeoff thrust relative to the 3B models. However, for the most part, the engines were nearly identical, and the 3B versions had so far performed flawlessly in service. So what went wrong?
Normally, a fan blade experiences approximately one load cycle per flight, as power is increased for takeoff and then removed again after landing. The fatigue progression resulting from this type of cyclical load application was much too slow to explain the failure of blade 17. However, one way that the rate of metal fatigue could be greatly accelerated was if the blade was experiencing abnormal stress due to cyclical vibrations, which could be imparted thousands of times during the course of a single flight, rather than once. CFM was of course well aware of this possibility, and had conducted extensive testing during the development of the CFM-56–3 series of engines in order to rule out the existence of any potentially dangerous vibration modes.
Engine fan blade vibration is a complicated topic, but on the most basic level, it helps to understand that the blades are subject to immense forces during engine operation, and that even the most minute imbalance in the blades themselves or the structure to which they are attached could induce damaging vibrations that only manifest under particular conditions. Some level of vibration is inevitable, but low-level vibrations lack the energy necessary to initiate and perpetuate metal fatigue. However, every blade has its limits — specifically, an “endurance limit,” which represents the maximum amount of vibratory stress which can be imparted before blade damage occurs.
During certification tests on the CFM-56–3 series of engines, CFM sought to prove that the blades would not experience vibratory stresses greater than 35% of their endurance limit during any conceivable mode of operation. These tests were accomplished in a laboratory using an engine fitted with a wide array of strain gauges, which measured the stress on the blades as engineers accelerated the engine through its full performance range, all the way up to a core rotation speed (or N1) of 103% of the designated red line speed, faster than the engine should ever spin during normal operations. However, an N1 speed of 103% could only be achieved at high altitudes where the air is less dense. In order to achieve this speed in a laboratory, CFM engineers used special equipment which altered airflow through the engine and made it possible to achieve an N1 of 103% while on the ground. Although the engine passed the tests with flying colors, the use of special equipment meant that the airflow through the engine during the test was not a perfect simulation of the conditions at high altitudes — a fact which will become important later.
When CFM developed the CFM-56–3C-1 model, tests showed that the new variant possessed vibration characteristics which were virtually identical to the CFM-56–3B series, so new vibration tests up to 103% N1 were not conducted. This fact led AAIB investigators to suspect that there could be a hidden vibration mode, present in the 3C-1 but not the 3B, which would only manifest at high altitudes and high N1 values, allowing it to fall through the cracks in CFM’s testing regime. CFM initially resisted this theory, preferring to believe that the failed blade had been damaged by some foreign object. In fact, the company conducted a vibration test on the 3C-1 engine up to 103% N1 for unrelated reasons in early 1989, shortly after the accident, and no unexpected vibration modes were detected. For a moment, it seemed that CFM might be right, and the AAIB might be wrong.
Then, on June 9th, 1989, a Dan-Air Boeing 737–400 was climbing through 25,000 feet after takeoff when its №1 engine failed, resulting in symptoms similar to those on flight 92. This time, however, the engine quit immediately, the failure was properly recognized, and the pilots made an uneventful landing. Once again, a fan blade on a CFM-56–3C-1 engine had failed due to fatigue. And that wasn’t all: just two days later, on June 11th, another CFM-56–3C-1 engine failed in the same manner aboard another British Midland 737–400 as it was climbing through 29,000 feet. This flight also landed safely, but the pattern was clear, and alarm bells were sounding at the highest levels of Britain’s Civil Aviation Authority. Immediately after the two engine failures, the CAA grounded all Boeing 737–400s in the country, and on June 15th it issued an airworthiness directive mandating the immediate replacement of nearly every fan blade on every CFM-56–3C-1 engine currently in service. The 737–400s were then allowed to fly again, but pilots would not be allowed to use the highest power settings until the blades were replaced. Finally, the other shoe had dropped: clearly there was a systemic problem with this type of engine after all. The challenge, then, was to find it.
In order to solve the mystery, the AAIB worked with CFM engineers to develop new testing methods that could detect vibrations which might have remained hidden under the conditions used during certification. Eventually, their efforts paid off, as the tests revealed a hitherto unknown vibration mode which manifested only in the 3C-1 variant, and only at high power settings and high altitudes during the later stages of the climb — exactly where flight 92, and the other two incident flights, were flying when the failures occurred. The AAIB and CFM eventually found a faint signature of this vibration mode in the data collected during the unrelated vibration tests in early 1989, but the differences between the laboratory conditions and real high altitude operations almost completely masked its presence. In fact, there was no way that CFM engineers could have noticed it in the original data unless they already knew what to look for.
When active, this vibration mode subjected the fan blades to continuous stresses up to 80% of their endurance limit, weakening the material until metal fatigue took hold at the location of some minor imperfection, such as a small nick or manufacturing defect. It typically took several months or more in service for this fatigue to begin, but once it started, it would progress to failure very rapidly, due to the high frequency of the load cycles. In fact, the Dan-Air fan blade started experiencing fatigue only three flights before it failed, and the blade in the second British Midland incident lasted just two flights. This made the fatigue impossible to detect during regular inspections, because the probability of an inspection taking place between the initiation of the fatigue and the failure of the blade was virtually nil.
Now that the problem was identified, however, CFM moved swiftly to correct the problem, and redesigned fan blades were soon installed on every CFM-56–3C-1 engine, enforced by a legally binding airworthiness directive. The 3C-1 model went on to have a long and uneventful service life, with no similar problems ever recurring.
◊◊◊
The crash of British Midland flight 92 revealed a number of weaknesses in the aviation system, from crash survivability to pilot training to engine certification processes. Several substantial initiatives resulted from or were influenced by the crash, including expanded vibration testing for new engine models, as well as a major effort intended to reduce crashes caused by inappropriate crew responses to engine problems. The British Midland disaster was not the first crash to be caused by a pilot shutting down the wrong engine; in fact, this type of error has been occurring ever since the development of the first multi-engine airplanes. In 1996, several major air safety bodies, including the US Federal Aviation Administration, released a joint report which found that such incidents were caused by a number of factors, including misleading engine failure scenarios in training and a lack of specific training on how to recognize a malfunction. Following the publication of the study, the FAA spearheaded a decade-long effort to improve pilot training in these areas.
Additionally, the accident contributed to ongoing efforts to improve crash survivability, which resulted in changes to the way overhead bins and seats are attached to the airplane structure on future aircraft. The 737’s quick reference handbook was also updated to provide APU restart procedures for both engines, not just №1.
And on top of these changes, the AAIB made a number of interesting recommendations, including that a regulatory framework be established for externally-mounted CCTV cameras on airplanes; that regulators research whether rear-facing seats or three-point harnesses might improve crash survivability; that a warning light illuminate to alert pilots to excessive engine vibrations (now common on many aircraft); and that crew coordination training scenarios involve the flight attendants (now standard practice throughout the industry).
It is also worth noting that technological improvements in the decades since the crash have made it much easier for pilots to determine which engine is malfunctioning, should a malfunction occur. Most modern aircraft are now equipped with an Engine Indication and Crew Alerting System, or EICAS, which provides more detailed information about engine operations and can provide the pilots with explicit warning messages that greatly assist in identifying which engine has a problem. This technology isn’t quite foolproof: in 2015, a TransAsia Airways ATR-72 crashed shortly after takeoff from Taipei, Taiwan, killing 43, after the captain shut down the wrong engine while dealing with a malfunction. Although a system similar to EICAS produced a warning message indicating which engine was faulty, the captain acted instinctively before reading the message, and there was insufficient altitude for him to correct his mistake before the plane struck the ground. Nevertheless, had British Midland flight 92 been equipped with an EICAS, it’s almost certain that the crash wouldn’t have happened, given the amount of time available for the pilots to look at it.
And yet, despite this fact, the Boeing 737 still does not come with an EICAS. 737s are rolling off the assembly line at this very moment without the system. This is because adding an EICAS would disrupt the continuity between the various 737 models, forcing pilots to receive separate type ratings for 737s with EICAS and those without. This feature of the 737 series is so fundamental that when a rule requiring EICAS on new models certified in the US came into effect at the end of 2022, Boeing and 737 operators lobbied Congress to grant an exemption, allowing the FAA to finish certifying the new 737 MAX 10 and MAX 7 without an EICAS. The pressure was immense: after all, major airlines didn’t want to buy the MAX 10 and MAX 7 if their pilots would have to acquire a new type rating to fly them, and if the airlines weren’t going to buy the models, then Boeing wasn’t going to build them, resulting in job losses and a shortage of narrow body airliners on the market. As a result, in the immediate future, 737s will continue to fly around the world without the benefit of EICAS, even though nearly every other modern airliner now has the system. There were of course compelling reasons behind the exemption, but that doesn’t mean there isn’t a trade-off.
And so, should modern 737 pilots find themselves again facing an engine failure of ambiguous origin, it will remain incumbent on them alone to identify the source of the problem, just as it was for Captain Kevin Hunt and First Officer David McClelland. It would be disingenuous to avoid criticism of some of their decisions — mistakes were most definitely made, a fact which Captain Hunt freely admitted. It is possible, however, to understand and forgive. After all, understanding doesn’t have to be the same as justifying. Unfortunately, that wasn’t the stance taken by British Midland — although neither pilot was likely to fly again anyway, the airline only added insult to their injuries by firing both Hunt and McClelland for cause shortly after the accident. This move was criticized by many in the industry, including Hunt himself, who accused British Midland of firing a crippled former pilot as a stunt with no purpose except to avoid deeper self-examination. McClelland, for his part, sued British Midland for wrongful termination and was awarded £57,000 in damages.
Like any accident, the crash of flight 92 was the result of a confluence of factors, and it would be hard to call it an individual’s fault. Some of these factors were under the pilots’ control; others were not. Disaster arose from faulty assumptions during the certification of the engines, from unrealistic training, from unfortunate coincidence, and finally from poor decision-making under pressure, coming together to send the plane into the ground short of the runway, even though the odds favored a safe outcome. A brief moment of realization, or perhaps even a few more seconds of thrust from the left engine, would have seen the plane soar over the M1 motorway to a successful landing at Castle Donington, and 47 people would still be alive. That’s the heartbreaking thing about flight 92 — at any moment, a well-placed word, dropped into the hubbub of conversation in the cockpit, could have prevented all that suffering. But that moment never came, and the best thing we can do is to learn from the consequences.
_________________________________________________________________
Join the discussion of this article on Reddit
Support me on Patreon (Note: I do not earn money from views on Medium!)
Visit r/admiralcloudberg to read and discuss over 230 similar articles
