B738, vicinity Amsterdam Netherlands, 2009
B738, vicinity Amsterdam Netherlands, 2009
On 25 February 2009, a Boeing 737-800 crew making an automatic ILS approach to Amsterdam with the operating First Officer undergoing early stage line training and a Safety Pilot occupying the supernumerary crew seat lost control after a malfunction of one of the radio altimeters, which resulted in the autothrottle unexpectedly setting idle thrust. The resultant progressive pitch increase went unnoticed by any of the pilots until an EGPWS ‘PULL UP’ Warning occurred. A delayed response then prevented recovery and terrain impact followed with the aircraft wrecked but with no post crash fire and only nine fatalities amongst the 135 occupants.
On 25 February 2009, a Boeing 737-800 (PH-BGK) being operated by Turkish Airlines on an international passenger flight from Istanbul Ataturk to Amsterdam as TK1951 and making a ILS approach at destination in day VMC crashed on short final after the crew were unable to recover following an EGPWS PULL UP Warning before terrain impact occurred approximately 1,500 metres short of the intended landing runway. All three pilots, one member of the cabin crew and five of the 128 passengers were killed, 10 passengers and two cabin crew were seriously injured and 107 passengers and one of the cabin crew sustained minor injuries. Six passengers were uninjured.
The Accident Site. [Reproduced from the Official Report]
The Final Report of this very thorough Investigation is not presented in the standard format envisaged by Annex 13 at that time or since or in almost any way recognisably similar to this. Despite the relatively short main body of the report, factual information which would normally be expected to appear in the main body of the report appears in some of the 22 Appendices. There is also no meaningful summary for accident prevention purposes of the relative significance of the many contributory factors identified.
An Investigation into the Accident was carried out by the Dutch Safety Board. All relevant data was recovered from the FDR and two hour CVR.
The 54 year-old Training Captain had a total of approximately 17,000 hours flying experience of which approximately 10,885 hours was on type including 3,058 hours in command on type since being promoted to command almost four years previously. He had been employed by the airline as a pilot for almost 13 years and had gained all his 737 experience during this time. The 42 year-old First Officer undergoing line training, who was acting as PF for the accident flight, had a total of 4,146 hours flying experience of which just 44 hours were on type. He had been employed by the airline as a pilot for seven months after gaining 4000 hours flight time in the Turkish Air Force as a pilot. The accident flight was his seventeenth line training sector. Under the applicable Turkish Airlines’ procedures, the first 20 sectors of line training were to be completed with a Safety Pilot present so this presence was not a consequence of slow progress. The 28 year-old Safety Pilot occupying the flight deck Observer seat had a total of 2,126 hours flying experience of which 720 hours were on type.
FDR data showed that as the aircraft had climbed through approximately 400 feet after takeoff from Istanbul, the readings recorded from the left hand radio altimeter system had become “erroneous”. It was not determined whether any of the pilots were aware of this. The flight, with the First Officer under supervision acting as PF, was uneventful until the flight was receiving radar vectors to intercept the ILS LOC for an approach to runway 18R at destination.
FDR data showed that as the aircraft, which had earlier been cleared to descend to FL 070, was approaching FL080 and receiving a clearance to FL 040, an audio warning relating to the configuration of the landing gear had been recorded on the CVR. This warning continued for approximately 90 seconds apart from one brief interruption and prompted the Captain to call “radio altimeter”. FDR data indicated that during this warning, an obviously false radio altitude height of -8 feet agl would have been visible on the PFD.
Shortly afterwards, still above 2,500 feet agl, the same landing gear configuration warning occurred again for another two seconds, this time without an accompanying false radio altitude on the left side PFD. Further clearance to 2000 feet on QNH and onto a radar heading of 265° followed and soon after levelling at 2000 feet with the A/T in speed mode, the landing gear configuration warning occurred yet again, this time with the simultaneous appearance of a radio altimeter height of - 8 feet agl on the left side PFD. The First Officer called for flaps 1, which followed. The illustration below shows an annotated ground track from here onwards.
Half a minute later, the flight was cleared for the runway 18R ILS and given a closing heading for the LOC intercept of 210°. Normally, crews expect to capture the localiser below the ILS GS and in level flight at the altitude at which they have been cleared to join it. However, in this case, the closing heading given meant that the localiser was subsequently captured when slightly above the GS. It was noted that local ATC procedures allowed controllers some flexibility as to vectoring onto the ILS and it was found that this flexibility was used fairly regularly. The late acquisition of the ILS LOC, an undesirable but not uncommon situation at some busy airports, led to an increased workload for the crew. It was also followed, without recorded comment, by the disappearance of the roll bars from the Captain’s PFD.
The approach ground track with key annotations. [Reproduced from the Official Report]
The VS mode was selected to reach the ILS GS, first with 1200 fpm selected, then 700 feet and finally 1400 fpm. Although not required given the prevailing weather conditions, an attempt to also engage the left hand AP was then made in order to make ‘dual channel’ approach but as this caused the right hand AP to disconnect and did not result in the left hand AP engaging, the right hand AP was re-engaged and no further attempt was made to add the left hand autopilot. Flap 5 and a speed of 170 knots were selected and a few seconds later, the same landing gear configuration warning as had occurred earlier was again activated for 5 seconds with the left side radio altimeter again indicating the same false height of -8 feet agl. Immediately after this, the landing gear was selected down, Flap 15 selected and the speed set to 160 knots.
As this false radio altimeter height was lower than the height (27 feet agl) at which the A/T automatically enters the RETARD mode, the A/T immediately began to reduce thrust to flight idle because all the other conditions required for this to happen (flaps >12.5 degrees, A/T speed mode is selected, a climb or descent to a selected altitude is not in progress and the aircraft is not maintaining a selected altitude) were already met.
The GS was reached at approximately 1300 feet some 40 seconds after the LOC had been captured with none of the pilots having noticed the ‘RETARD annunciations which continued. FDR data showed that pitch indications had disappeared from the Captain’s PFD once the GS was captured but no response to this was recorded on the CVR. Landing clearance was given but once on the GS, thrust continued to reduce accompanied by a progressive increase in pitch attitude as the AP tracked the ILS GS but this also went undetected. The Captain made the 1000 feet call to which there was no response. Flap 40 was selected at 900 feet and the selected speed set the correct 144 knots for this at 800 feet but from 750 feet, the absence of thrust resulted in the speed reducing below 144 knots.
From here on, none of the three pilots present on the flight deck recognised that descent on the ILS GS with the autopilot engaged was being attempted with flight idle thrust set or that the descent in this energy state was resulting a steadily decreasing airspeed and a steadily increasing nose-up pitch attitude. As the airspeed reached 126 knots, the PFD airspeed indications turned amber and began to flash but there was no response. With the final item of the landing checklist - confirming on the PA that the cabin crew must secure themselves for landing - still outstanding, the Captain made the 500 feet call and the First Officer gave the standard response by calling for the landing lights. With about a minute to go to the intended landing, the Captain then asked the Safety Pilot to make the cabin crew call. The speed was now down to 110 knots.
Almost immediately, at 460 feet agl over flat terrain of similar elevation to the runway ahead, a speed of 107 knots and a pitch attitude of +11/12°, the stick shaker was activated. The Safety Pilot called low speed and repeated this two further times. The Investigation suspected from incomplete evidence that it was most likely to have been the First Officer who initiated the thrust increase and that when the Captain called that he was taking control, the thrust levers had only reached just over halfway and once released, the A/T, still continuing to show it was in ‘RETARD’ mode on the Flight Mode Annunciator (FMA) retuned them to idle within one second. Three seconds after the stick shaker had activated, with the thrust levers still aback in the idle position and the aircraft at 420 feet agl, one of the pilots deactivated the A/T. The AP was then disconnected and the control column was pushed forward (pitch from +11/12° to - 8°) but the thrust was not increased. The stick shaker activation briefly stopped but restarted after two seconds.
It was nine seconds after the initial activation of the stick shaker before maximum thrust was finally selected and one second later, whilst the thrust was still increasing, an EGPWS ‘SINK RATE PULL UP’ Warning was annunciated. It was no longer possible to recover before violent contact with the flat terrain below occurred six seconds later with maximum thrust still set.
Impact evidence showed that the rear fuselage was the first to hit the ground after which the aircraft came to a stop relatively quickly because of its low forward speed assisted by the soft nature of the soil. The aircraft was destroyed as a result of the impact with the fuselage breaking into three parts. Most, but not all of the fatalities and serious injuries occurred in the front section of the aircraft which was also where the most extensive damage to the interior occurred. Most of the passengers who sustained only minor injuries were seated in the main passenger cabin.
Why It Happened
As will be evident from the account above, the flight crew collectively failed to detect once finally fully established on the ILS that the steadily increasing pitch attitude was sufficiently abnormal to require that a reason for it needed to be urgently established. Thirty-seven seconds elapsed between the flap 40 landing flap selection and the onset of the stick shaker during which time the PFD indications and the engine thrust settings were in full view of all three pilots.
Even without this recognition, the Investigation concluded that had the response to the stick shaker activation - which is triggered by the approach to a stall rather than the onset of a stall - been immediate and in accordance with the relevant QRH procedure, with full thrust set held without delay, terrain impact could have been avoided. When this did not happen, the impact was inevitable with the EGPWS activation far too late to be of any recovery value to a fully stalled aircraft which it was estimated by Boeing would have required between 500 and 800 feet.
A number of other contributory factors were identified and discussed. Selectively summarised and in no significant order these included:
- The vectoring of the aircraft onto the ILS in a way which directly contributed to a rushed approach in which the ILS GS was reached not in level flight at 2000 feet but in descent from above at 1300 feet meant that the Captain would have been likely to focus on ensuring this was corrected to the potential detriment of other very basic flight management priorities. The fact that the configuration for landing was so late that the Landing Checklist was not completed until below 500 feet agl may be seen as evidence of workload exceeding the overall command capabilities of the Captain. The presence of a Safety Pilot with an excellent overview of the main aspects of flight management did not seem to have made much difference to monitoring in the lead up to the accident and may have been attributable to a relatively low level of experience as a pilot and the reliability of modern aircraft which results in increasingly infrequent exposure to in-flight equipment malfunctions such as the underlying one in this case.
- The underlying trigger for the accident was clearly the fault in the left hand radio altimeter and in particular the fact that it generated a false height below the automatic A/T ‘RETARD’ activation. The Captain’s apparent lack of concern at this malfunction may have been a consequence of the regularity of radio altimeter faults on the aircraft type at the operator concerned. The Investigation was unable to establish why the malfunction and in particular the false altitude reading had occurred. However, it was noted that the relatively poor overall reliability of this equipment on the aircraft type was true of both approved OEMs - Smiths, as installed on the accident aircraft and Rockwell Collins. In terms of the A/T radio altimeter inputs, it was found that a modification to prevent the A/T RETARD mode from operating altogether if the two radio altimeter inputs are more than 20 feet different was available but only compatible with Rockwell Collins radio altimeters. Only around a quarter of the operator’s 52 737-800 aircraft were found to have been delivered with the modified Rockwell Collins altimeter installed.
- It was established that Turkish Airlines flight crew had not been made aware that the 737NG A/T is configured to automatically use the left hand radio altimeter system and the only way a reversion to the right hand system occurs is if the left hand system is detected as not working. This reversion process failed to detect that whilst the left hand radio altimeter was still functioning, it was not doing so correctly. It was noted that this absence of an effective reversion of radio altimeter inputs to other systems was no longer present in other in-production aircraft and was a direct consequence of the FAA, as the issuer of the 737 type certificate, allowing, under grandfather rights, the continued use of old designs and components in a much updated version of an airframe instead of requiring a (more demanding) new Type Certificate even when the difference between old and current practices in system and component design clearly favoured the current. The Investigation also found it of particular note that there was no mention of the operationally significant fact about the source of radio altitude data for the A/T in any Boeing 737 Manuals or Technical Training Material. This situation was considered to have resulted in 737 pilots having “an incomplete or even incorrect mental model” of an important aspect of the AFCS, the sort of defective mental model which was seen as part of a wider problem of complex inter-related automation elements.
- Had the changes in FMA annunciations been monitored (see the illustration below), it was considered that this would have created a significant opportunity to detect the premature appearance and continued activation of the A/T RETARD mode. It was noted that most airlines base their OM SOPs on the guidance provided by the airframe manufacturer’s FCTM and FCOM guidance. In this respect, it was noted that the Boeing approach was described as the PM making callouts based on instrument indications or observations which the PF should then verify and acknowledge and if the PM does not make the required callout, the PF should do so. The Turkish Airlines OM was found to state that FMA mode changes must be called out but there was no evidence of this happening on the accident aircraft CVR. The Investigation conducted interviews with the operator’s 737-800 pilots which showed that there were two different approaches to FMA change monitoring. One group verified the mode changes without calling them out and the other verified and called out such changes. Most of the pilots who did call after verification were found to have had previous Airbus type experience where the FCOM prescribes FMA changes must be called out. The Boeing 737-800 FCOM was noted to state only that “calling out FMA changes is a good practice in accordance with CRM”. However, the Investigation concluded that “there was no clarity within the pilot corps at Turkish Airlines on calling out FMA changes” despite the importance of FMA status awareness.
Flight Mode Annunciations as displayed during the approach. [Reproduced from the Official Report]
- The fact that the Captain did not respond as procedurally required when the Safety Pilot pointed out that the left radio altimeter had malfunctioned and that, when the aircraft passed the 1000 feet stabilised approach gate with the aircraft clearly not stabilised the Captain made no call for a go around were regarded as having been contributory to the outcome as was absence of an operator’s procedure for the role of Safety Pilot.
The delayed crew response to the stick shaker activation which was the last opportunity to prevent a crash was considered to be a result of inadequate pilot training. This was of considerable concern given that the commander had been a type-experienced Training Captain.
The Investigation concluded that the Cause of the Accident was as follows:
While executing the approach by means of the instrument landing system with the right autopilot engaged, the left radio altimeter system showed an incorrect height of - 8 feet on the left primary flight display. This incorrect value of - 8 feet resulted in activation of the ‘retard flare’ mode of the autothrottle, whereby the thrust of both engines was reduced to a minimal value (approach idle) in preparation for the last phase of the landing. Due to the approach heading and altitude provided to the crew by air traffic control, the localiser signal was intercepted at 5.5 nm from the runway threshold with the result that the glide slope had to be intercepted from above. This obscured the fact that the autothrottle had entered the retard flare mode. In addition, it increased the crew’s workload. When the aircraft passed 1000 feet height, the approach was not stabilised so the crew should have initiated a go around. The right autopilot (using data from the right radio altimeter) followed the glide slope signal. As the airspeed continued to drop, the aircraft’s pitch attitude kept increasing. The crew failed to recognise the airspeed decay and the pitch increase until the moment the stick shaker was activated. Subsequently the approach to stall recovery procedure was not executed properly, causing the aircraft to stall and crash.
Safety Action taken as a result of the Accident whilst the Investigation into it was in progress was noted as having included, but not been limited to the following:
Boeing published a Flight Operations Technical Bulletin 737-09-2 shortly after the accident which included the reminder that “whether in automated or manual flight, flight crews must carefully monitor primary flight instruments (air speed, attitude etc.) for aircraft performance and the flight mode annunciation for autoflight”.
- abandoned the distinction between VMC and IMC for the height at which stabilised approach criteria are applicable in order to be able to effectively monitor compliance with these criteria in their OFDM programme.
- introduced additional simulator training on stall recovery procedures for all pilots.
- began using OFDM data to detect automation-related faults to ensure that they are more reliably identified and that quicker rectification facilitated where appropriate.
A total of 11 Safety Recommendations were made as a result of the Investigation as follows:
- that Boeing should improve the reliability of the radio altimeter system.
- that the FAA and the EASA should ensure that the undesirable response of the A/T and FMC caused by incorrect radio altimeter values is evaluated and that the A/T and FMC are improved in accordance with the design specifications.
- that Boeing, the FAA and the EASA should assess the use of an auditory low-speed warning signal as a means of warning the crew and - if such a warning signal proves effective - mandate its use.
- that Boeing should review its ‘Approach to Stall’ procedures with regard to the use of the AP and A/T and the need for trimming.
- that the Turkish DGCA, the ICAO, the FAA and the EASA should change their regulations in such a way that airlines and flying training organisations see to it that their recurrent training programmes include practicing recovery from stall situations on approach.
- that the FAA, the EASA and the Turkish DGCA should make (renewed) efforts to encourage airline awareness of the importance of reporting and ensure that reporting procedures are adhered to.
- that Boeing should make (renewed) efforts to ensure that all airlines operating Boeing aircraft are aware of the importance of reporting.
- that Turkish Airlines should ensure that its pilots and maintenance technicians are aware of the importance of reporting.
- that Turkish Airlines should adjust its safety programme.
- that the Dutch ANSP LVNL should harmonise its procedures for the (radar-vectored) transition of aircraft onto final approach as set out in the Air Traffic Control Rules and Instructions (VDV) with (the corresponding) ICAO procedures and ensure that air traffic controllers adhere to them.
- that the Dutch Transport and Water Management Inspectorate (IVW) should monitor LVNL’s compliance with national and international air traffic control procedures.
The Final Report was published on 6 May 2011.
- Loss of Control
- Stabilised Approach
- Missed Approach
- Radio Altimeter
- Crew Resource Management
- Pilot Workload
- Terrain Avoidance and Warning System (TAWS)
- Primary Flight Display (PFD)
- Cockpit Automation - Advantages and Safety Challenges
- Go-around from Low Airspeed/Low Thrust
- DGAC (France) Publications on Non-Stabilised Approaches
- Report of the Flight Crew Human Factors Investigation conducted for the Dutch Safety Board, Sidney Dekker, 2 July 2009.
- Final Report on the accident published by Dutch Safety Board on 06 May 2010: "Crashed during approach, Boeing 737-800, near Amsterdam Schiphol Airport, 25 February 2009".
- Boeing Multi Operator Message (MOM), MOM-09-0063-01B, issued to all operators 4 March 2009.