On 26 December 2012 the crew a Boeing 737-800 (LN-DYM) being operated by Norwegian Air Shuttle on a scheduled domestic passenger flight from Helsinki to Kittilä as NAX 5630 temporarily lost control of the aircraft when a sudden, rapid and severe uncommanded pitch up occurred as the destination Instrument Landing System (ILS) GS was intercepted in day Instrument Meteorological Conditions (IMC) with the AP engaged. Upset recovery from stick shaker activation was achieved and there was no recurrence prior to completion of a second approach to land. None of the 179 occupants was injured.
An Investigation was delegated by the State of Occurrence to Norway as State of the Operator and so the Accident Investigation Board Norway (AIBN) carried out and completed the work. DFDR data was successfully downloaded to assist the Investigation. However, the 2 hour Cockpit Voice Recorder (CVR) recording relevant to the occurrence was overwritten which almost eliminated any opportunity to examine Crew Resource Management. Recorded radar data covering the occurrence was also available.
The AIBN noted that the failure to isolate the CVR was contrary to both European Aviation Safety Agency (EASA) regulations and the Operator's own procedures, which reflected the regulatory requirement. It was also noted that this failure to preserve CVR data after a serious incident was not uncommon in the experience of the Board and had been the subject of Safety Recommendations issued in both 2003 and 2006.
The 37 year old Captain of the aircraft was found to have completed his pilot training in Estonia in 1993 and had begun flying the 737 Classic for Estonian Air in 2002 and had obtained his command on the type in 2007 before moving at that rank to fly 737 Classics for an Estonian charter carrier and finally moving to an agency which leases pilots to Norwegian Air Shuttle and qualifying there in 2011 as a Captain on the 737NG. He had 3500 hours on the 737 and 8880 hours in total.
The 45 year old pilot acting as First Officer on the incident flight was also qualified as a Captain with Norwegian and had also completed his professional pilot training in 1993 in the USA and Denmark. He had flown as a 737 Captain since 2008 with various operators and had done so with Norwegian Air Shuttle on the 737NG since 2012. He had 7800 hours on the 737 and 11500 hours in total.
It was established that prior to commencing the incident flight, the aircraft had been parked outside for three days at low temperatures and snow to a depth of approximately 25 cm had accumulated on the upper surfaces of the aircraft. Removal of frozen deposits prior to departure from Helsinki was performed over a 15 minute period whilst the ambient temperature was -17 °C. Type 1 fluid (Clariant Safewing MP 1938 ECO (80) mixed with water was used, with 30% glycol used for "ice melting" and 60% water for the "final application". It was considered that this de-icing operation "appeared to have been carried out according to applicable procedures".
The flight was uneventful until the aircraft, with the (Channel A) AP and the A/T engaged, was established on the runway 34 ILS LOC at destination Kittilä and, at an altitude of 4400 feet Altimeter Pressure Settings (approximately 3800 feet above the landing runway threshold) and was about to become established on the ILS GS from below with Flap 5 set. At this point, the electric stabiliser trim (which on this aircraft type moves the entire stabiliser) ran for approximately 12 seconds in the nose up direction leading to a rapid increase in pitch and a consequent drop in airspeed. The latter caused the A/T to command full thrust which caused a further pitch increase.
Initially, there was no crew intervention, but as the pitch reached +12° (it had been +1.5° before the uncommanded pitch change), both pilots began to push their control columns forward. After 20 seconds, two seconds after the pilots had managed to exert sufficient force to get the control columns to the forward mechanical stop which FDR data showed had involved exerting almost 80 kg, the pitch reached a maximum of +38.5° and the airspeed dropped to 118 KCAS. A climb of almost 2000 feet occurred during a 24 second period - at mean rate of climb of over 4800 fpm.
The pilots were eventually able to begin slowly lowering the nose using this elevator input. Calculations made by Boeing indicated that the elevator had been extremely slow to respond, doing so at a rate of only 0.2°/second, compared with the normal rate of 50°/ second.
It was found that during the pitch up phase, no attempt had been made to disengage the AP, the A/T or manually run the electric stabiliser trim in the nose-down direction and neither was the maximum engine thrust which had been set by the A/T reduced. It was noted that had one or more of these actions been taken , it "would have resulted in the aircraft levelling off at an earlier stage". According to the aircraft commander's subsequent statement, he believed that the AP had disconnected soon after the aircraft nose began to rise. Only after the pitch had begin to reduce did the pilots apply manual stabiliser trim input, which resulted in the AP automatically disconnecting. Pilot training guidance from the operator in the event of an upset with the automatics engaged such as occurred in this case was noted to be "to return to manual flying by disengaging the AP and A/T".
As the pitch reduced through +10°, "the pilots quickly pulled the control column back with a force of approximately 44 kg and this overcorrection resulted in the pitch increasing again to +16°. The angle of attack at this time was "about 25°" and the Stall Warning and Stick Shaker activated for four seconds. Subsequent calculation showed that the prevailing stall speed as configured and at a 1g wing load, was 121 KIAS, but since the wing load at the time of the lowest airspeed was only 0.3g, no actual stall had occurred.
Once the pilots had regained control, they put the aircraft into a holding pattern and, suspecting that the upset had been caused by a "severe temperature inversion" advised this as the reason for their "missed approach". After verifying normal flight control function, a second approach was commenced and an uneventful landing followed.
After engine shutdown, the aircraft commander did not make an entry in respect of the occurrence and the aircraft continued in service. He advised the Investigation that whilst on the ground at Kittilä, he had spoken to the airline's Maintenance Control Center (MCC) on the telephone and after explaining what had happened and that the suspected cause was a temperature inversion, the MCC decided that the aircraft could continue flying.
Two days later, the aircraft commander had spoken to the on-call Company Chief Pilot, who happened to be the Company DFO and briefed him on the occurrence. This management pilot "did not perceive the incident to be serious" and did not take any action in respect of either the aircraft or the pilots.
After Boeing had examined the downloaded flight data, they concluded that an elevator restriction caused by a blockage in at least one of the elevator PCUs, each of which is operated through two input cranks, appeared to have occurred. Further analysis by both Boeing and the National Transportation Safety Board (USA) (NTSB) confirmed that a such a blockage had built up gradually at cruise altitude prior to the incident approach and that in order to have led to the extent of restriction evident, the most likely explanation was a blockage of either three of the four input cranks or all four of them.
The Investigation carried out tests to establish the extent to which it was possible for ground de-icing fluids to enter the 737-800 Tail Cone in the direction of the elevator PCU input cranks and it was confirmed that quite considerable amounts of fluid could do so and the cranks could easily be exposed to fluid which could then freeze and prevent their normal movement. Similar tests on a Boeing 737-300 gave similar results and it was concluded that the identified issue was relevant to all 737 variants, not just the 737NG ones. The Investigation found that until advised by the Board as a consequence of their Investigation, Boeing had been unaware of this risk.
It was also found that both Norwegian and SAS had been regularly experiencing winter season events where greater force than usual had been required to move the control column. A 2009 event to a Turkish operator's 737 Classic, which has only one input crank per elevator PCU, was also noted - although this had been found to be caused by a foreign object disabling one of the PCUs.
Safety Action taken by Boeing in 2013 in response to the findings of PCU blockage in the investigated incident were as follows:
- Revisions to the Boeing 737 FCOM requiring that ground de/anti-icing should be carried out with the stabiliser trim set within the take off range rather than, as previously advised, in the fully-forward position.
- Revisions to the Boeing 737 Aircraft Maintenance Manual to require that the application of ground de/anti-icing fluids should be carried out at an angle from the front and not from the side and with the stabiliser trim set within the take off range.
A Preliminary Report detailing the initial findings of the Investigation was issued on 19 November 2013. This noted that at that time, Boeing did not intend to rely on these procedural changes to provide full mitigation of the risk of ground de/anti icing fluids affecting the function of the elevation control system and that their "long term mitigation strategy was to make some sort of change of the design of the system which will prevent fluid impingement onto the control system components". However, Boeing subsequently stated that they had concluded that the changes being considered "would introduce an unacceptable risk of Foreign Object Debris (FOD) that could impair safety negatively" and would not be pursued.
In respect of the flawed crew response to the upset recovery, the Investigation came to the conclusion that although Norwegian "has a training concept which seems to be well founded and the company should be commended for exceeding the regulatory authorities' minimum requirements in respect of theoretical instruction, simulator training, and line training" It was, however, also noted that "in spite of this, the flight crew did not seem to have sufficient system understanding and automatic reflex to handle the incident in an optimum manner". In this connection, the Investigation noted that Norwegian stated that they had found the 1997 video 'Children of the Magenta Line' (which can be seen on SKYbrary from the Cockpit Automation - Advantages and Safety Challenges article in which a representative from American Airlines describes basic principles for handling automated aircraft "to be very useful in illustrating the importance of teaching pilots to switch to manual control of the aircraft if they need to handle an Upset Recovery situation".
The Investigation also considered that the aircraft should have been grounded after the occurrence and it was noted that a conversation with the on call Chief Pilot should have occurred before further operation of the aircraft and that even when such a conversation occurred two days later, there was no recognition of the potential significance of what had happened. The absence of recordings of calls to both Maintenance Control and Operations Control at the time of the event, in particular the former, was also noted. As this has since been rectified, it was decided that there was no need for a draft Safety Recommendation on this subject to be included in the Final Report.
In Conclusion, the Investigation formally identified seven "Material investigation results of significance for aviation safety" as follows:
- During its approach to Kittilä, the aircraft was close to stalling. The outcome of a stall could have been catastrophic.
- The analysis of data from the flight data recorder shows that three or four of the Input cranks on the aircraft's elevator Power Control Units were blocked, most likely due to ice. Calculations made by Boeing indicate that the elevator was extremely slow in responding. With only 0.2°/second, compared with the normal 50°/second. This indicates 1:250 compared with the normal response. At the end of the scenario, the blockage ceased.
- Fluid and humidity will penetrate the Tail Cone Compartment in connection with de-icing of Boeing 737. Increased humidity and spray settling on cold Input cranks may result in ice formation.
- The Investigation has documented that, even after the introduction of new de icing procedures from Boeing, large volumes of fluid can enter the Tail Cone Compartment during de-icing.
- AIB Norway questions whether certification requirements in FAR Part 25 § 25.671 and EASA CS-25 §25.671 for the Boeing 737 Classic and Next Generation series are satisfied.
- AIB Norway believes that training must be carried out at a quality and volume which ensure the establishment of system understanding and the automatic reflex of return to manual flying.
- The aircraft should have been grounded at Kittilä after the incident occurred. This is because the background of the serious control issues had not been clarified, which meant that the aircraft's air-worthiness had not been verified.
Three Safety Recommendations were issued as a result of the Investigation as follows:
- that Boeing conduct a new safety assessment of the Boeing 737 aircraft type as regards blockage of the aircraft type's elevator system, and establish measures in order to satisfy the requirements in FAR Part 25 § 25.671 and EASA CS-25 §25.671. [SL 2015/01T]
- that the Federal Aviation Administration (FAA) ensures that the aircraft manufacturer Boeing conducts a new safety assessment of the Boeing 737 aircraft type as regards blockage of the aircraft type's elevator system, and that the analysis result and established measures satisfy the requirements in FAR Part 25 § 25.671. [SL 2015/02T]
- that EASA ensures that the aircraft manufacturer Boeing conduct a new safety assessment of the Boeing 737 aircraft type as regards blockage of the aircraft type's elevator system, and that the analysis result and established measures satisfy the requirements in EASA CS-25 §25.671. [SL 2015/03T]
The Final Report was published on 25 March 2015