Accident Case Study
First, here is what happened:
- The captain's radio altimeter malfunctioned to read -8 feet in flight,
- The crew were slam dunked into Schiphol Airport, a common occurrence,
- A poor design allowed the autothrottles to use the left radio altimeter while the first officer flew the ILS with the autopilot coupled to the right autopilot.
- As the aircraft intercepted the ILS from above, the autothrottle had all it needed to go into "retard" mode,
- Neither pilot seemed to correlate a cascading series of warnings, including a low airspeed and the resulting high deck angle, with the radio altimeter failure.
- The aircraft ran itself out of speed at about 500 feet, at which time it stalled.
The Dutch accident investigators placed the blame on Boeing for the design of the radio altimeter / autothrottle interface while giving the crew an additional mention, as if they were bystanders to the crash.
Well I guess they were bystanders. Here's my take:
- The radio altimeter system was one of the leading maintenance squawks for the Boeing 737-800 of the time, in fact it was the top squawk at Turkish Airlines.
- Boeing knew the faulty radio altimeter could cause an autothrottle "retard" mode while in flight but reasoned that the cockpit had more than enough warning systems to alert the crew.
- In fact, the very airplane involved in this mishap had the "retard" mode happen in two previous flights in the previous 48 hours. But each crew noticed the "Retard" annunciation, the decaying airspeed, the low speed cue, and the higher than usual deck angle. Each crew disconnected the autothrottles and flew the jet to a successful landing.
- This crew did not. The captain was busy training a new first officer but there was a third pilot on the flight deck as a safety pilot. They got rushed with the slam dunk but nobody noticed the visual cues and five audible warnings until the stick shaker alerted them, too late.
Photo: Side view, Turkish TK-1951, from Dutch Safety Board Report, Illustration 5.
- Date: 25 FEB 2009
- Time: 10:26
- Type: Boeing 737-8F2
- Operator: THY Turkish Airlines
- Registration: TC-JGE
- Fatalities: 4 of 7 crew, 5 of 128 passengers
- Aircraft Fate: Destroyed
- Phase: Approach
- Airport: (Departure) Istanbul-Atatürk International Airport (IST/LTBA), Turkey
- Airport: (Destination) Amsterdam-Schiphol International Airport (AMS/EHAM), Netherlands
[Dutch Safety Board Report, ¶2.4]
- The Turkish Airlines’ Boeing 737-800, with registration TC-JGE, took off at 08.23 hours (local Turkish time) from Istanbul Atatürk Airport in Turkey for a passenger flight with flight number TK1951 to Schiphol airport. There were 128 passengers and four crew members in the cabin. The cockpit crew consisted of three pilots. The captain who was also the instructor occupied the left cockpit seat and the first officer who received ‘line flying under supervision’ occupied the right seat. The first officer under supervision was the pilot flying. Another first officer was seated in the observer’s seat in the cockpit and was acting as safety pilot. The right autopilot and the right flight director were selected and active for the first officer as pilot flying. The left flight director was active for the captain as the assisting pilot. The flight data recorder recorded that the left radio altimeter system provided erroneous readings, beginning shortly after take-off as the aircraft climbed through approximately 400 feet. It is not known if the pilots were familiar with those readings.
- The aircraft entered Dutch airspace from the east whilst descending. At 10.04:09 hours, the crew contacted Amsterdam Area Control. The crew was instructed to descend further, to alter the heading and informed that landing runway 18R could be expected. Next, the crew was given additional instructions a few times with regard to speed, altitude and heading and consecutively the instruction to fly to the so-called ARTIP navigation point.
- At 10.15:02 hours the captain contacted Schiphol Approach and reported that the aircraft was descending to FL70 at a speed of 250 knots. At that moment the aircraft was in the terminal control area, called Schiphol TMA 1. Air traffic control gave the instruction to fly to the Spijkerboor beacon and to continue the descend to FL40 for an instrument landing system approach for runway 18R. At this time the aircraft was above the province of Flevoland. An audio warning regarding the landing gear could be heard during this instruction; the aircraft was between FL84 and FL82 at this time. The warning continued for approximately one and a half minute with a short interruption. Next, the captain made the remark ‘radio altimeter’. At 10.17:11 hours the warning was activated again and could be heard for two seconds. Sometime later, the captain made the comment ‘landing gear’ and a little more than one and a half minute later the audio warning could again be heard for another two seconds. According flight data recorder data during the warnings a radio height of -8 feet was visible on the primary flight display of the captain. Shortly thereafter, flight TK1951 was given the instruction to descend to 2000 feet. At 10.19:42 hours the crew was instructed by air traffic control to turn left to heading 265 degrees. More than 40 seconds later the captain contacted the ground handling company of Turkish Airlines at Schiphol airport to specify the number of passengers and to request the parking position. Around 10.22:00 hours the aircraft obtained the altitude of 2000 feet and 15 seconds later the first officer asked flaps 1. The flaps were set in position 1 and a speed of 195 knots was selected via the mode control panel. The mode of the autothrottle was ‘mode control panel speed’.
- The right autopilot and the autothrottle had been activated as from departure in Turkey. The crew attempted to engage the second autopilot for a dual channel approach. This attempt resulted in the right autopilot to disconnect and the left autopilot not to engage. Next the right autopilot was engaged again. No new attempt was made to engage the left autopilot.
- At 10.23:34 hours flaps 5 and a speed of 170 knots were selected. Nine seconds later the audio warning with regard to the landing gear could again be heard during five seconds. According flight data recorder data, on the primary flight display of the captain a radio height of -8 feet was visible. Immediately thereafter landing gear down, a speed of 160 knots and flaps 15 were selected. The speed was higher at that moment but it was decreasing. The aircraft was now in the control zone called Schiphol CTR.
- At 10.24:09 hours the captain announced that the localizer signal had been intercepted. The aircraft started to follow the localizer signal automatically because the ‘approach’ mode of the flight control computer had been activated. At that moment the aircraft turned in the extension of the runway axis but was above the glide path at an altitude of 2000 feet. The speed was approximately 175 knots and was still decreasing and the distance to the start of the landing runway was approximately 5.5 NM. Shortly thereafter the flight director ‘roll bar’ of the primary flight display of the captain disappeared.
- An audio signal could be heard from the cabin in the cockpit at 10.24:19 hours. The pilots did not respond to this.
- The crew selected a lower altitude and another mode for the vertical flight path in order to let the aircraft descend. First 1200 feet and after ten seconds 700 feet were selected on the mode control panel for this. Subsequently, the cockpit crew selected the ‘vertical speed’ mode for the vertical flight path with a descend speed of 1400 feet per minute to approach the glide path from above. When this mode of the vertical flight path was selected, the flight mode annunciation of the autothrottle changed to ‘RETARD’ on both primary flight displays. As a consequence of this mode, the thrust levers went automatically to the idle position. The aircraft had a speed of approximately 168 knots when the descend was started.
- The crew was instructed to contact Schiphol Tower, at 10.24:24 hours by approach control. Twelve seconds later, before the captain contacted Schiphol Tower, the safety pilot remarked that they had a radio altimeter failure. The captain confirmed this. At 10.24:46 hours the aircraft intercepted the glide path at an height of approximately 1300 feet. Shortly thereafter the flight director pitch bar of the primary flight display of the captain disappeared. During the period when the aircraft was flying in the ‘vertical speed’ mode, the speed of the aircraft had first decreased to 158 knots and, subsequently, increased to 169 knots and, next, started to decrease again from the moment that the aircraft intercepted the glide path for runway 18R. The selected speed for the interception of the glide slope signal was 160 knots.
- At 10.24:48 hours the crew received landing clearance from the tower controller of runway 18R. This was confirmed by the captain after which there was no further contact between air traffic control and flight TK1951. The captain reported to the other cockpit crew members that the aircraft was passing 1000 feet. At 10.25:10 hours, at approximately 900 feet above the ground, flaps 40 was selected. Subsequently, the speed brake lever was moved in and out of the ‘arm’ position several times and both the green ‘speed brake armed’ and amber ‘speed brake do not arm’ lights illuminated. Immediately thereafter, at around 800 feet, the speed of 144 knots associated with the flaps 40 position was selected.
- At 10.25:17 hours the captain made the remark ‘yes, not in checklist completed’. Next, he listed the items of the landing checklist that the first officer had to answer to demonstrate that they had been executed correctly. In the meantime, the horizontal tailplane of the aircraft was trimmed by the autopilot and the safety pilot reported that he had received the call that the cabin was ready for the landing.
- At 10.25:23 hours the speed at an altitude of approximately 750 feet came under the selected speed of 144 knots. Before the last item of the landing checklist was executed, the captain called out ‘500 feet’ to demonstrate that the aircraft was passing a height of 500 feet. The first officer answered with the instruction to switch on the landing lights in confirmation of the above. The last item of the landing checklist is the check to ensure the cabin crew has been warned that they must take their seats and put on their safety belts. The captain asked the safety pilot to do this who immediately carried out this instruction. The aircraft was flying just below 500 feet with a speed of approximately 110 knots at this time. It is then approximately one minute before the planned landing.
- At 10.25:47 hours at approximately 460 feet above the ground, the stick shaker was activated. The safety pilot then warned about the too low speed.
- Nearly immediately the thrust levers were moved forward by slightly more than halfway but were immediately pulled back to the idle position by the still active autothrottle. The captain reacted immediately to the activation of the stick shaker by taking over the controls and by reporting this. At this time, the speed was 107 knots and the position of the nose approximately eleven to twelve degrees above the horizon. The safety pilot pointed out the speed two more times.
- At 10.25:50 hours one of the pilots deactivated the autothrottle, with the thrust levers in the idle position. One second later at an altitude of 420 feet, the autopilot was deactivated and the control column was pushed forward. Four seconds after the autopilot was deactivated, the stick shaker stopped and was again activated two seconds later. The pitch attitude was eight degrees below the horizon at that moment.
- At 10.25:56 hours the thrust levers were pushed forward for maximum thrust. The engines attained their full thrust in somewhat less than four seconds after the thrust lever selection what they held until the aircraft came into contact with the ground.
- Various ground proximity warning system warnings were also generated. A ‘sink rate’ warning was generated at 10.25:57 hours, followed by a warning to pull up the aircraft’s nose and a warning with regard to a sudden change in wind speed and direction. Immediately thereafter, the aircraft hit the ground in a field at a distance of approximately 1.5 kilometres of the threshold of runway 18R. According to the last data recorded on the flight data recorder, the aircraft’s nose position was 22 degrees above the horizon and the aircraft banked 10 degrees to the left when this equipment stopped recording (at 10.26:02 hours).
The report says the landing warnings "are not usual during this phase of flight." (¶5.4.1) I'm not so sure. It seems the captain acknowledge the faulty radio altimeter as the cause of the gear warnings.
This Boeing had two autopilots, either of which could be used for all modes of flight. Some operators and crews use the left autopilot if the control is from the left seat and the right autopilot from the right seat. They cannot be engaged together unless actively flying an ILS approach. It was this airline's practice to normally select both autopilots for an ILS. It is okay to use just one for a Category I ILS. It appears the right autopilot was selected as a normal selection after takeoff and an attempt was made to select the left autopilot for the ILS.
They were given what was known as a "short line up," a vector that drops them onto final above the glide path. This would require a low power, steep descent (the so-called "slam dunk") while configuring the airplane, dishing out the dive and restoring thrust levels to end up stabilized and on glide slope. ICAO rules do not allow for that but Dutch rules did, provided the pilot ask for it and the controller agrees. This gets the airplane on the ground sooner but requires a higher level of skill on part of the pilot.
Later analysis confirmed that the roll bars disappeared because the captain's flight director thought it was time to flare and land.
They were intercepting the glide slope from above so having the thrust levers go to idle would be expected but one would also expect them to return to a higher setting as the glide path was intercepted and speed stabilized with the higher drag of increased flaps.
The captain's flight director disappeared shortly after intercepting the localizer and glide slope because, added to the radio altimeter signal, it had all it needed to think it was time to land. The "RETARD" flight mode annunciation should have been visible on the captain's pilot flight display.
They are 34 knots below their target approach speed, the throttles are at idle, and their deck angle was more than likely very high. The frame around the airspeed indicator would have changed color and started flashing.
It took nearly 25 seconds to fully commit to the stall recovery.
[Dutch Safety Board Report, ¶5.2]
- The radio altimeter computer continuously transmits signals to the ground via the transmit antennas and the reflected signals are detected by the receive antenna. The radio altimeter computer calculates the height of the aircraft above the ground based on the shortest time required. The radio altimeter system is calibrated such that when the aircraft’s main landing gear touches the runway during landing the read-out height is ‘null’ feet. When the aircraft is on the ground (with the nose wheel on the ground), the valid values are from -2 to -6 feet.
- During the approach, and using the instrument landing system, it appeared that the left radio altimeter system suddenly indicated an erroneous height of -8 feet on the left primary flight display. In reality the height -8 cannot occur, however, the value itself is within the (design) height range of the radio altimeter system.
- As the erroneous radio height was lower than the required limit of 27 feet for the autothrottle to enter into the ‘retard flare’ mode and other conditions were being met, the autothrottle reduced the engine thrust to idle during the approach.
- The ‘retard flare’ mode was indicated on the primary flight display as ‘RETARD’. At the same time the right-hand side autopilot (which used data from the right-hand side radio altimeter system) followed the glide slope signal. The aircraft was trimmed nose up in order to follow the glide slope and the airspeed decreased.
- Turkish Airlines’ documentation shows that 235 radio altimeter system faults were reported with regard to the 52 Boeing 737-800 aircraft during the period from January 2008 to February 2009. Sixteen of these were from the accident aircraft.
- The Boeing 737-800 involved in the accident was delivered at the beginning of 2002 and was equipped with an autothrottle manufactured by Smiths (now GE Aviation) and two flight control computers manufactured by Honeywell. This combination was built into the Boeing 737 NG from the introduction of the aircraft in 1997 through to 2003.
- As laid down in the Rules and instructions air traffic control (VDV) of Air Traffic Control the Netherlands (LVNL) interception of the localizer signal, when approaching at 2000 feet, should occur at a minimum of 8 NM of the runway threshold below the glide path (refer to appendix R).
- The approach controller stated that he had the intention to let flight TK1951 intercept the localizer signal between 8 and 5 NM and the glide path from below. It was difficult to see at which exact distance the aircraft would have intercepted the localizer signal due to the scale that the air traffic controller had selected on his radar display. He instructed to fly heading 210 degrees. Because of the actual wind at 2000 feet the heading instruction resulted in a ground track of 202 degrees and an interception of the localizer signal at a distance of 5,5 NM from the runway threshold.
- The aircraft was in the terminal control area Schiphol TMA 1 when the instruction to fly heading 210 degrees was given. The minimum vectoring altitude in this area is 2000 feet. This meant that the aircraft was not allowed to be directed to a lower altitude to approach the glide slope from below. When the aircraft entered the control zone, the aircraft could have been directed to 1200 feet to thus approach the glide slope from below. The involved air traffic controller indicated that he monitored the aircraft and the flight path continuously, also after the aircraft had been handed over to the tower controller. He noticed that the position, speed and altitude were good. Based on the position of the aircraft when entering the control zone, the controller expected that the aircraft would intercept the localizer signal when it was still below the glide path, therefore, before 6.2 NM before the runway threshold. However, the heading instruction resulted in the aircraft intercepting the localizer signal at approximately 5.5 NM when it was still at 2000 feet, approximately 170 feet above the glide path. This meant that the method, indicated by the ICAO, for aligning an aircraft for the final approach and the Rules and instructions air traffic control were not complied with.
- The landing gear configuration warnings and the problems when activating the autopilots could have been a reason for the crew to diagnose the problem. No indication thereof was found on the cockpit voice recorder.
- During the flight, with the first officer as pilot flying, the right autopilot was engaged and the right flight director was selected. According to the documentation for Boeing 737 pilots, this means that the right flight control computer has control over the flight path, the right radio altimeter system provides this flight control computer with radio height data and the autothrottle calculates thrust commands and adjusts the position of the thrust levers as required. A crew might therefore not assume that a problem with the left radio altimeter system would have effect on an approach using the right autopilot and the right flight director, and that the autothrottle uses information of the left radio altimeter system.
- What is not dealt with completely, either in training courses or the documentation (because there is so little detail about this), are the connections between the several automation systems.
- The signal from the left radio altimeter system is the one used primarily by the autothrottle. There is only a switch to the right-hand system if that (left-hand) system is no longer working. This is a relic from the Boeing 737, certificated long ago, which in the original design prioritized the provision of information to the left pilot (captain). This original design has now been superseded by both technical facilities and a democratisation and reallocation of pilot duties in the cockpit. It is notice- able that this subject cannot be found in any of the Boeing 737 manuals or training documents for pilots. Pilots therefore do not have the correct knowledge about links between the control systems and data input for their own aircraft. The result of this is an incomplete or even incorrect ‘mental model’ of the automated flight control.
- It can, therefore, be concluded that the crew did not have any information available regarding the relation between the left radio altimeter system and the operation of the autothrottle.
- With regard to the Boeing 737 NG series the ‘retard flare’ mode is activated when the autothrottle is in use and certain conditions have been met, under which a radio height less than 27 feet. This mode should normally only be activated during the landing and is automatically deactivated two seconds after the wheels of the aircraft touch the ground. During flight TK1951, the left radio altimeter system specified a height of -8 feet at a given moment. The system did not switch to the right radio altimeter system. The autothrottle activated the ‘retard flare’ mode and the thrust levers were closed to take the position for minimum engine thrust based on this input and the system logics. In this phase of the flight the thrust levers’ position were not abnormal because the aircraft had to descend and to decrease airspeed. The conclusion is that intercepting the glide slope signal from above as a result of the localizer interception on 5.5 NM at 2000 feet has masked the incorrect operation of the autothrottle.
- The active right autopilot maintained the flight path set by the crew. The aircraft’s nose pitched up further and the speed dropped due to the thrust levers being held in idle for a long period and the glide slope being retained simultaneously. The flight could have been continued safely in such a situation if the pilots had intervened on time by any of the following methods:
- Pressing the TO/GA button on the thrust levers to initiate a go-around.
- Advancing the throttles and keep them in position manually.
- Deactivating the autothrottle (and possibly the right autopilot) and taking over control manually.
- During executing the landing checklist, when the speed brakes were armed, both the amber warning light indicating for an abnormal situation and the green light indicating that the speed brakes had been put in the automatic position, illuminated. The green ‘speed brake armed’ light illuminated when the speed brake lever was put in the arm position, which indicates normal operation. However, because of the difference between the left and right radio altimeter readings, the amber ‘speed brake do not arm’ light illuminated also.
- The actions of the crew as described above, from leaving 2000 feet altitude to intercept the glide slope from above until the stick shaker activation, occurred within a space of 100 seconds. The airspeed of the aircraft reduced during these 100 seconds. No indications were found on the cockpit voice recorder that the crew had observed any of the following indications that something was wrong during the reduction in airspeed:
- [After approximately 2 seconds]; after selecting the ‘vertical speed’ mode the flight mode annunciation for the autothrottle changed from ‘MCP SPD’ to ‘RETARD’ and stayed there.
- [After approximately 60 seconds]; shortly after selection of flaps 40 additional thrust should normally be selected to keep the aircraft on the glide slope.55 However, the thrust levers remained in the idle position because the ‘retard flare’ mode was maintained almost until the end of the approach.
- [After approximately 85 seconds]; the increase of the aircraft’s pitch position above a value that is not usual with regard to an approach (from more than 5 increasing to 10 degrees) during fifteen seconds before the stick shaker activation when the speed fell below the selected speed of the aircraft. This is not the case in an approach where the descend is constant (‘constant descend approach’).
- [After approximately 90 seconds]; the rectangle around the airspeed indicator on the primary flight display changed colour from white to amber and began to flash nine seconds before the stall warning (flashing of the airspeed box).
- In addition the speed tape on the primary flight display still displayed various indicators (in colour and shape) that the speed was falling below the selected speed and was approaching the stall speed.
Another autothrottle option was one built by Rockwell Collins which had an available update to prohibit auto-retard unless both radio altimeters agreed within 20 feet. The software of the Collins unit was not compatible with the Smiths autothrottle which could auto-retard with a radio altimeter disparity. But even the Collins autothrottles with updated software seem to be vulnerable to erroneous radio altimeter signals.
This would allow the aircraft to intercept the glide slope from below, as is normal practice.
While this is more than likely true, it does not relieve the pilots from the responsibility to fly the airplane. Even with the autopilot in control of the attitude of the airplanes and the autothrottles in charge of the thrust setting, it is up to the pilot to ensure the aircraft is where it needs to be. The pilots assume the role of monitors and must mentally fly the yoke and the throttles while doing this.
They should not have gotten both lights and that should have been another clue. They did arm and de-arm the speed brake handle three times, so they realized there was a problem but they didn't discuss the problem or its relation to the other anomalies.
Pilots should have a sense for proper power settings and pitch settings for all phases of flight. This will not only help with these kinds of automation monitoring issues, but will be invaluable when there is a pitot-static problem.
The Dutch report does not label causes, instead these are called "conclusions."
[Dutch Safety Board Report, ¶6] During the accident flight, while executing the approach by means of the instrument landing system with the right autopilot engaged, the left radio altimeter system showed an incorrect height of -8 feet on the left primary flight display. This incorrect value of -8 feet resulted in activation of the ‘retard flare’ mode of the autothrottle, whereby the thrust of both engines was reduced to a minimal value (approach idle) in preparation for the last phase of the landing. Due to the approach heading and altitude provided to the crew by air traffic control, the localizer signal was intercepted at 5.5 NM from the runway threshold with the result that the glide slope had to be intercepted from above. This obscured the fact that the autothrottle had entered the retard flare mode. In addition, it increased the crew’s workload. When the aircraft passed 1000 feet height, the approach was not stabilised so the crew should have initiated a go around. The right autopilot (using data from the right radio altimeter) followed the glide slope signal. As the airspeed continued to drop, the aircraft’s pitch attitude kept increasing. The crew failed to recognise the airspeed decay and the pitch increase until the moment the stick shaker was activated. Subsequently the approach to stall recovery procedure was not executed properly, causing the aircraft to stall and crash.
Dutch Safety Board, "Crashed during approach, Boeing 737-800, near Amsterdam Schiphol Airport, 25 February 2009," The Hague, May 2010 (project number M2009LV0225_01)