Subscribe by E-mail

Archives

Google Translate

Recent Assets

  • Big guy
  • Snow pic.jpg
  • ATL.jpg
  • A380 first flight.jpg
  • Northwest A320.jpg
  • A330MRTT wet contact 1.jpg
  • A330MRTT wet contact 2.jpg
  • DA42 belly landing.jpg
  • APA protest 1.jpg
  • Emirates shower flyertalk.jpg

Turkish Airlines crash: evidence points to pilots

| | Comments (100) | TrackBacks (0) |
This morning the Dutch investigators are holding a press conference on the Turkish Airlines Boeing 737-800 crash at Amsterdam last week and I understand that later Boeing will release a safety bulletin. From a reliable source, the contents of the Boeing bulletin will include the points below. Regrettably they don't reflect well on the pilots, who are dead of course - but I'd caution that there is a long investigation still to come.

  • no evidence of fuel shortage, birdstrike, icing, windshear, wake turbulence, or engine, system or control malfunction
  • the first officer was initially flying the aircraft and was inexperienced in airline operations
  • autopilot and autothrottle were in use
  • the aircraft was initially high and fast on the approach and at about 2,000ft above ground the throttles were pulled to idle
  • the authrottle went to "retard" mode and the throttles then stayed at idle for about 100 seconds during which time the speed fell to 40kt below reference speed
  • the aircraft descended through the glideslope with the captain talking the first officer through the before landing checklist
  • the stick shaker activated at about 400ft above ground and the first officer increased power
  • the captain took control and as the first officer released the throttles they moved to idle due to being in "retard" mode
  • after six seconds the throttles were advanced but as the engines responded the aircraft hit the ground in a slightly nose-high attitude
  • throughout the episode the left-hand radio altimeter read negative seven feet altitude, but the right-hand radalt worked correctly
Boeing will warn crews about fundamentals like flying the aircraft, monitoring airspeed, monitoring altitude, and will give advice about radalt issues.

0 TrackBacks

Listed below are links to blogs that reference this entry: Turkish Airlines crash: evidence points to pilots.

TrackBack URL for this entry: http://www.flightglobal.com/cgi-bin/mt/mt-tb.cgi/47632

100 Comments

Why I don't get is why the throttles remained in retards mode and why TOGA wasn't activated.

I think the most important question is not rather why they didnt activate TOGA but why and eventually HOW did they get off the glideslope so badly? What about the CVR?

I think the most important question is not rather why they didnt activate TOGA but why and eventually HOW did they get off the glideslope so badly? What about the CVR?

please wait for official report about the crash. please do not speculate the facts.

Mathijs

Could you please provide more info on your source to make it more reliable? For example a sample copy of the bulletin

Kieran Daly

I understand your question but I'm sorry, I'm not able to help further at the moment. There is an investigators' press conference starting in a few minutes and later we will publish more material on www.flightglobal.com from that. Apologies again.


on the last bullit. I guess Boeing is aware of the fact that the crash location is app. 15ft below sealevel

Seems to have been the aircraft anyway

Martijn

Investigation will focus on "defect altitude machine" of boeing, as I quote live from the press conference

Ian Powell

Ok, the bif question:- what''s the manual say if the 2 radio altimeters are different?!

Can somebody explain what "retard" mode is?

With full respect to Boeing, it has to try to protect its interests, and I am in full agreement with Orko. Speculation serves only vicarious interests not serious aviation folks. We should wait for official communications and results of a proper investigation.

Ian Powell

"We should wait for official communications and results of a proper investigation."

But the results are just out. I repeat my question. What's the flying manual say if the 2 radio altimeters don't agree?

1st Why did they let him go 40knts below reference speed ???
2nd Why did they release the thrust levers after the stall warning and gave them the abillty to retard again ???

Dicks Airbus

The findings in short. Points to radalt defect and this went unnoticed by FO due to last minute checklist operation

* Capt LH seat, (fully qualified) FO in RH seat, observer FO on jumpseat
* Normal approach, no changes, to 18R
* Descent on AP, normal procedure for TK
* At 1950 ft LH RadAlt indicated -8 ft and passed this info on the A/T
* From CVR: crew get aural landing-gear warning but not consider this a problem
* A/T pulled throttles closed (At 1950 ft. because A/P thinks aircraft is landing)
* stick shaker at 450 ft (Because no reaction by pilots on closing of throttles by A/P)
* From FDR: full power was then applied
* FDR stores 25 hours, in this case 8 flights, same problem had occured twice previously before previous landings.

The things said in the press conference a few min ago sounds like the same stuff that's written up here.

Ian Powell

>1st Why did they let him go 40knts below reference >speed ???
They didn't know there was a problem with the speed. (They didn't realise that the A/P had closed the throttles)

>2nd Why did they release the thrust levers after the >stall warning and gave them the abillty to retard >again ???
The thrust levers were released when the pilot took control.

@Dick:
last item: which problem had occured before: the RadAlt?

Dicks Airbus

A classic combination of hardware and human failure.

Few points:
- Why was crew not watching speed, etc.? What was 2nd FO doing, reading a paper?
- Definitely an issue with A/T status change feedback (Boeing will need to fix that)
- Design issue when two radalt provide a certain level of inconsistant data (Boeing will need to fix that)

Sad, sad, sad.

Whoops. Looks like Boeing carries most of the blame.

Ian Powell

>Why was crew not watching speed, etc.? What was 2nd FO doing, reading a paper?

Very harsh. I would have simply said, why didn't any 3 pilots notice the air speed.

Dicks Airbus

@jaaph: referring to the radalt failure reading on capt side.

Yes, perhaps Boeing is now lined up for class action suits. The system clearly does not cross reference the other altimeter.

Anonymous

>Whoops. Looks like Boeing carries most of the blame.

Yep. Dutch Safety Safety Board: Safety Alert to Boeing:
*** Recommend to review Fligth Manual B737: if radio altimeters are inop, autothrottles and autopilot must not be engaged;

Dicks Airbus

FROM: THE BOEING COMPANY
TO: MOM [MESSAGE NUMBER:MOM-MOM-09-0063-01B] 04-Mar-2009 05:29:01 AM US PACIFIC TIME
Multi Operator Message

This message is sent to all 737-100,-200,-300,-400,-500,-600,-700,-800,-900,-BBJ customers and to respective Boeing Field Service bases, Regional Directors, the Air Transport Association, International Air Transport Association, and Airline Resident Representatives.

SERVICE REQUEST ID: 1-1228079803
ACCOUNT: Boeing Correspondence (MOM)
DUE DATE: 10-Mar-2009
PRODUCT TYPE: Airplane
PRODUCT LINE: 737
PRODUCT: 737-100,-200,-300,-400,-500,-600,-700,-800,-900,-BBJ
ATA: 3400-00

SUBJECT: 737-800 TC-JGE Accident at Schiphol Airport, Amsterdam - 25 February 2009

REFERENCES:
/A/ 1-1222489391 Dated 25 February 2009

Reference /A/ provides Boeing's previous fleet communication on the subject event. The US NTSB, FAA, Boeing, the Turkish DGCA, the operator, the UK AAIB, and the French BEA continue to actively support the Dutch Safety Board's (DSB) investigation of this accident.

The DSB has released a statement on the progress of the investigation and has approved the release of the following information.

While the complex investigation is just beginning, certain facts have emerged from work completed thus far:

- To date, no evidence has been found of bird strike, engine or airframe icing, wake turbulence or windshear.
- There was adequate fuel on board the airplane during the entire flight.
- Both engines responded normally to throttle inputs during the entire flight.
- The airplane responded normally to flight control inputs throughout the flight.


The Digital Flight Data Recorder (DFDR) data indicates that the crew was using autopilot B and the autothrottle for an ILS (Instrument Landing System) approach to runway 18R at Amsterdam Schiphol airport. During the approach, the right Low Range Radio Altimeter (LRRA) was providing accurate data and the left LRRA was providing an erroneous reading of -7 to -8 feet. When descending through approximately 2000 feet the autothrottle, which uses the left radio altimeter data, transitioned to landing flare mode and retarded the throttles to the idle stop. The throttles remained at the idle stop for approximately 100 seconds during which time the airspeed decreased to approximately 40 knots below the selected approach speed.

The two LRRA systems provide height above ground readings to several aircraft systems including the instrument displays, autothrottle, autopilots and configuration/ground proximity warning. If one LRRA provides erroneous altitude readings, typical flight deck effects, which require flight crew intervention whether or not accompanied by an LRRA fault flag, include:

- Large differences between displayed radio altitudes, including radio altitude readings of -8 feet in flight.
- Inability to engage both autopilots in dual channel APP (Approach) mode
- Unexpected removal of the Flight Director Command Bars during approach
- Unexpected Configuration Warnings during approach, go-around and initial climb after takeoff
- Premature FMA (Flight Mode Annunciation) indicating autothrottle RETARD mode during approach phase with the airplane above 27 feet AGL. There will also be corresponding throttle movement towards the idle stop. Additionally, the FMA will continue to indicate RETARD after the throttles have reached the idle stop

Boeing Recommended Action
- Boeing recommends operators inform flight crews of the above investigation details and the DSB interim report when it is released. In addition, crews should be reminded to carefully monitor primary flight instruments (airspeed, attitude etc.) and the FMA for autoflight modes. More information can be found in the Boeing 737 Flight Crew Training Manual and Flight Crew Operations Manual.

Operators who experience any of the flight deck effects described above should consult the troubleshooting instructions contained in the 737 Airplane Maintenance Manual. Further, 737-NG operators may wish to review 737NG-FTD-34-09001 which provides information specific for the 737-NG installation. Initial investigations suggest that a similar sequence of events and flight deck indications are theoretically possible on the 737-100/-200/-300/-400/-500. Consequently the above recommendations also apply to earlier 737 models.

Anonymous

At least I hope certain turks stop calling us and our Towercontrol racists. That stuff really hurt us. And I expect more blaming to come. This is so sad. We are in the Age of Protectionism already. There will be only losers. Peace.

Still too early for a final judgement,but human factors seem to be very important here.Whatever malfunction,speed is life so watch it,and don't let the autopilot push you under the glidescope.Seems awfully fundamental to me,and I'm only a private pilot.

Dicks Airbus

Well, if the RA showed -8, it is not failed (as far as the system goes), therefore the AP will not disconnect.

This is the weak point that started the sad event (a minus reading should be a defect). Guess the system engineers at Boeing will have to take a look at negative numbers & cross reference checking of radalt.

In addition the crew did not help by the fact that they seemed to rely on the automation just too much. Automation is a supporting system, like fuel - checking still needs to be done as if these systems were not present.

Sad chain of events based on hardware and human error. We can all learn from this.

Dicks Airbus

A note: radalt shows -2 when on the ground (0 when touching positive pitch altitude).

Why at RA reading of -8 the AP was not auto-disconnected is a system design failure imho.

Appeantly this was a single autopilot approach flown with AP B.

Kieran Daly

Thank you to everyone for your intelligent contributions - greatly appreciated.

I have to say I think those people suggesting that Boeing carries most of the 'blame' are not being realistic in view of the conditions on the day.

Huge questions over CRM here, to put it at its gentlest.

MusicRab

>Sad chain of events based on hardware and human error. We can all learn from this.

"human error" is harsh at this stage. Hardware AND software errors certainly prime candidates.

Dicks Airbus

@Keiran Daly: Yes, I totally agree with you. Over 100 seconds the crew did not notice the speed decay - what were they doing instead of monitoring the a/c?

AP kept it on GP, AT was thinking the a/c is on the ground and in idle.

Definitely very serious CRM issues that let this happen.

Comments from a layman:
Boeiing needs to do some adaptation ?
- when the two LRRA have different readings over a certain limit, shouldn't there be a visual an auditive warning system. Autopilot should take in account the measurements of both LLRA and, when different, activate a kind of alert-state where lots of parameters are cross-checked and the pilots warned.
- Why is autopilot not checking the duration of the autothrottle RETARD mode during final approach ? It shouldn't last for 100 seconds, no ?
- Apparently autopilot also isn't checking the minimum reference speed for landing ?
I thought autopilot was much "smarter".

Pilots were probably busy and to much relying on autopilot systems. Although i'm far from being a pilot,
I'm also running on autopilot rather frequently. Man-machine interaction (or lack of) should be reconsidered ?

What is the logbook telling about the two times it happended before?

Quote: - Apparently autopilot also isn't checking the minimum reference speed for landing ?
I thought autopilot was much "smarter".

The aplha-floor protection was probably not working because the system was in Retard mode.

Not being an expert, could someone comment on the need for TWO "Low Range Radio Altimeters"? Apparently, only one is used for specific systems, without cross-checking or temporal evaluation (a "step" from 2000ft to -8ft within a short time is not physical).

Clearly the autopilot should have more sophisticated software to detect erroneous data. However, as a private pilot of a Cessna Skyhawk, I can report that the most basic responsibility of the pilot on landing approach is to maintain adquate airspeed to avoid a stall. I check the airspeed every few seconds on short final approach.

The crew is at least as much to blame as the autopilot for this tragedy. They NEVER should have allowed the airspeed to get so low. That rule is absolutely fundamental even to a beginning student pilot, let alone a team of 3 professionals.

Anonymous

Pilots are there to control the aircraft whether via the autopilot or manually. It is not unusual for trainee pilots too get training on commercial flights (ie with passngers on board). This seems innocuous enough when all is going smoothly, but as we have seen in this case it is a lethal practice. It should be outlawed. Only fully competent pilots should be in the cockpit. I write as a professional pilot with decades of experience.

Pilots are there to control the aircraft whether via the autopilot or manually. It is not unusual for trainee pilots too get training on commercial flights (ie with passngers on board). This seems innocuous enough when all is going smoothly, but as we have seen in this case it is a lethal practice. It should be outlawed. Only fully competent pilots should be in the cockpit. I write as a professional pilot and flying instructor on multi-engine jets, with decades of experience.

It's NOT Boeing's Fault

The Autothrottle and Autopilot are separate systems. You can land the 737 manually (without Autopilot as you'd expect in an Autoland situation) yet keep the Autothrottle engaged! Boeing recommends against leaving Autothrottles on during manual landings but many do it. That's another issue. When the Radar Altimeter, likely the Captains, reads below a specific value (I forget, like 15') the Autothrottle goes into a Retard Mode "thinking" the plane is about to land. Retard is Idle power. That simple. Being high and fast, a.k.a. the proverbial Slam Dunk, onto a Glide Slope, is an edgy experience and is best done with the Autopilot clicked off. Autothrottles ON will protect you on the slow side but in this case, the Captains Radar Altimeter was broken. Things break. Crew has to be attentive. Not Boeing, forget it. How many hours and years have 737s been flying safely? Broken gage, loss of situational awareness, misundestaing of fairly simple automation. Sad.

Colgan crash had no autothrottles and go too slow.

Type B-737,757,767,777

How could anyone blame Boeing for this? The PIC is responsible for getting the plane on the ground. Instruments fail. It's not like the tail fell off. Fly the airplane.

Dicks Airbus

@By It's NOT Boeing's Fault: Please quote where you read they came in high and fast (this is not the case, they were perfectly lined up on GS).

Re Not Boeing:

although I go with most of what you write, the following DOES worry me: the software bluntly makes a critical decision based on a sensor that believes it is already under the tarmac.

It is a general rule that safety related software/electronics shall not rely on a single system. Safety related computers are based on the voting principle: the majority decides. The minimum is a 2 out of 2 system: the outcome of 2 computers are compared by a fail-safe comparator and only if both give identical information the required action will be carried out. If the information is not identical an alarm or - if possible - a safety shutdown shall be initiated. A 2 out of 3 system is preferred. If one malfunctions, the other 2 still have the majority and can take care of a safe automatic operation. 3 out of 5 systems are very common in safety related applications, even in car industry. Common mode errors (e.g. a failure of a common power supply for all systems) shall be prevented. Systematic design errors shall be prevented as well, computers based on diverse technology and software are preferred for safety critical applications. This all is common practice in safety technology. I can't imagine that that the autopilot of a Boeing airplane is not based on this principle and that it relies on just a single altitude meter.

From the report (http://www.onderzoeksraad.nl/docs/rapporten/Persverklaring_4_maart_GB.pdf):

"At a height of 1950 feet the left radio altimeter suddenly indicated a change in altitude – from 1950
feet to - 8 feet - and passed this onto the automatic pilot"

Is the autopilot an idiot? A sudden change of 1958ft on one side of the plane and the plane just decides Okay its time to land.

The actual reading of -8 feet would not be strange on the ground as half of the Netherlands is below sea level. IIRC the lowest point on earth is like 1100 feet below sea level.

@ Hans: I like to hear what you state, because that's how one would like these systems to operate, but the AT decided to go to idle based on ONE faulty radalt. The other radalt was simply not monitored by the AT. Ans unfortunately neither by the three pilots.

In my opinion, the statement below is the sole reason for the crash.

- the captain took control and as the first officer released the throttles they moved to idle due to being in "retard" mode

> although I go with most of what you write, the following DOES worry me: the software bluntly makes a critical decision based on a sensor that believes it is already under the tarmac.

I think this surely is correct.

However the place where the plane crashed, was aproc -15ft below, because that place is below sealevel. It still can be that the software doesn't work correctly with negative levels. (even if the landing spot is below sealevel)

Just out of curiousity, aren't there any flight paths that might go through negative altitudes? Examples that come to mind are Death Valley - California (-280feet) and along the Dead Sea shore (-1400 feet). I guess there probably aren't any major airports in these regions.

Is the reading from LRRA compared to the destination tarmac level for the A/P to determine whether to put the throttle into "retard" mode?

Hans, thanks for your explanation. Now I understand why the safety board say they will focus on the radalt-A/T coupling: they are not done with this yet. Hopefully they'll also find a decent explanation as to why the crew let the speed drop unnoticed.

>1st Why did they let him go 40knts below reference >speed ???
They didn't know there was a problem with the speed. (They didn't realise that the A/P had closed the throttles)

I can understand that they didn't realise the A/P had closed the throttles but what puzzles me is that they did allow the airspeed drop that much without intervention. Constant monitoring of airspeed and aircraft attitude are fundemental when landing, one of the first things you pick up when learning how to land a airplane. The indications on the speedtape are very clear as well. How can they have missed this ?

JimmyJazz

The pilots were stuck in RETARD mode.

Retards.

Posts above suggest a single autopilot was engaged. Also there is insufficent details at this stage to suggest something more certain.

I had an instance when on a dual channel approach the autopilot pitched 15 deg nose down at 800 feet, rate of descent increased rapidly without warning, next GPWS was activated,so a prompt go-around was initiated without further incident. Also numerous times I have had he autopilot play up once engaged on the LOC/GS because of signal interference ie aircraft moving around the ground instalations distorting the signal. The most recent one was when an A380 was given clearance to line up whilst we were on approach, the automatics went berserc trying to follow the LOC/GS indications which were erratic.
I have had on a single Autopilot approach in IMC bank angle 40'deg followed by +10' pitch followed by -10' deg pitch.
In such a critical phase monitoring of the automatics is of the essence as sometimes they can do some unexplained things.

Retard mode, in cruise reaching top of descent in VNAV the autothrottles move tp idle position. Retard mode is activated on a dual channel approach, and is activated passing 27'feet RA. Activated only if FLARE mode engages if it doesn't then both autopilots disengage.
Two independent radio altimeters provide radio altitude to its respective flight control computers.With an Radio altimeter inop the autopilot disconnects 2 seconds after Loc/gs capture. Isn't in amsterdam the platform height 2000' ft for ILS procedure?

As for speed reversion the Retard mode is followed by ARM mode, provides minimum speed protection.The AFS commands a speed 5 kts greater than minimum speed. Reaching 5kts greater than minimum speed reactivates MCP speed selection control.The AFS commands nose down to increase speed if thrust levers are not advanced.


I can only highlight somethings that I have observed in my experience. Those are :mode confusion, type of approach used, complacency, unnecessary chat especially during approach, Radio altimeters MEL'ed, conduct of approach, briefing for it or lack of, what things to look out for mentioned to trainee(this should take place at topd not during approach as I have witnessed) etc are just some of the things that we do not know at this stage. Lets not forget especially on training flights, at low level if you don't watch it closely things can get rather demanding in a mere second so staying ahead of it all is of paramount importance.

Human or interface or designers of the interface, who is to blame, the neverending discussion. The interface was wrong, the designers did not design enough security valves and the humans did not act appropiately to the chain of events because they ignored warnings and relied on the autopilot/autothrottle to handle everything correctly. As a flyer and a computer program designer I can understand all the viewpoints expressed, but as a physician I can not. As every physical measure has a 95% confidence interval, one in every 20 measures is wrong. The first thing physicians learn is never to rely on numbers. If the patient can talk, has a firm pulse and is feeling as warm as I am, the chance that the patient will die in seconds is zero. No numbers needed. Any intern that has the guts to rely on a low blood pressure on a monitor without looking at the patient to check whether the monitor is showing the actual blood pressure has a serious problem. No patient would accept that a physician would say, well I treated you wrong because the monitor was faulty. After this somewhat lenghty and probably boring comment as a relative outsider I have to conclude that the only responsibles were the pilots. As I understand two pilots were going through a checklist when the fatal events occured, but what was the third doing then? Landing is a critical procedure. If I were to walk away from an unstable patient at the intensive care to discuss the charts with the intern without asking a third party to warn me for crucial changes, what would be the verdict in court? The only conclusion can be that these kind of errors are allways human. The next step is to kill the designers that were stupid enough to connect throttle control to a single faulty altimeter without cross checking the other flight parameters. I would say that the only indication that an airplane is on the ground is when the suspension of the landing gear is compressed. Let's put a sensor there! (untill it becomes faulty and we can begin the discussion all over again).

A layman here. Why is nothing being said about the cockpit voice recorder. At what stage did the pilots become aware of what was wrong? Did they say anything?

And, since it happened before according to the flight recorder. Was it the same pilot? If not, what did he/they do, and most importantly, did they warn anybody?

Oscar Polat

I think it is a serious f***-up by both Turkish Airlines for not fixing the faulty altimeter and by Boeing, how on earth the system relies on one altimeter and cuts down the engine power? Unbelievable, I am not a pilot I am a stress engineer, so I am just wondering if there are three altimeters on the aircraft, wouldn't you say read from all three and make a decision based on that?

By the way, I have read a comment by a Dutch guy who was complaining that Turks call them racist, but you are, I am sorry to say this, I think it is true, I am a Turkish stress engineer once a Dutch engineer once called me a monkey (meaning not as intelligent as a Dutch person I guess :). But may be it is true, how on earth Turkish Airlines did not fix the faulty altimeter and why the pilots ignored the warnings?

It is really sad!

P.S. If a Dutch guy is reading this, I don't think women are inferior to men and I don't oppress my women, just in case you did not know. :)

Speculation is worst we can do, ask yourself if you can accept pilot incapacitation?

Francis D

@Oscar Polat on March 5, 2009 7:57 AM

From (another) Dutch guy (total passenger layman but interested):

1- I don't think Turkish ppl in general are calling us rascist (there are still many moderates here in Holland despite the success of mr. Wilders)
2- Having said that, its undeniable that there are big cultural differences worldwide in dealing with blame and guilt (which is the point the "dutch guy" seems to be referring to, however bluntly)
3- Those differences should not impede us from assessing the causes objectively and learning from the outcome. Something that, in this stage, is still premature pending more info (like VCR transcript)

Respect and regards to all!

PS Good to hear u think women are equal (they are ;))... however, u seem to have more than one? ("I don't oppress my woMEN) Or is that a typo? ;) Any position on man-man relations?

Francis D

@Kieran Daly

My apologies for the last message being a little off-topic. As a layman I really enjoy reading this blog tho, very interesting.

Francis D

@Kieran Daly

My apologies for the last message being a little off-topic. As a layman I really enjoy reading this blog tho, very interesting.

Another Dutchman

Some Turkish papers blame the Dutch investigators for covering up any Dutch mistakes. Partly based on the assumption that the pilots are heroes and should not be blamed at all...
A bit of an one-sided view, it seems, but could there be some cover-up for the Dutch traffic controllers? Shouldn't they have seen that the plane was way too low, and have warned sometime during that 100 seconds period?
Is it peculiar that so far nothing was stated about this aspect?

roeland

By JwS on March 4, 2009 8:23 PM


you write that most of the netherlands is below sealevel; well that's true. However, a LRRA measures the height to ground, so it doesn't care if you're having your field elevation at -8ft, or +300 ft. That only counts when you are referring to QNH.

Ok, being an ex aircraft avionics engineer -- the trigger was maybe the #1 RA, but not the cause. The crew has been asleep, It's a CRM issue.

Also, nobody noticed that the yellow door selectors must have been in manual? This also indicates that at engine-start/take off, the list haven't been completed either. This also supports the crew being not too good at their work.

Old Lizzy

Once more I am reminded there is rarely if ever a single probable cause to an accident. We all go through CRM training and have the Swiss cheese slide drilled into us about several relatively minor issues/failures lining up nicely to create a "perfect storm" scenario.

We have had a relatively good record for some time now in the safety section of the industry and it is now shattered by several recent accidents, all of which of course continue to be investigated, but which all lets be honest carry a single message - AVOIDABLE.

Common themes? Crews distracted/fatigued, not recognizing a failure and responding appropriately. Compacency is always an enemy of an automated cockpit. I have flown 777, 320/319, and it is awfully easy to sit back, relax and work on 5 across or 7 down. You simply cannot stare at instruments all day long. Whereas flying the venerable 727 for instance, kept you on your toes - it needed flying and talking to.

I would argue we are starting to pay the price for high tech airliners that do not present subtle failures very, well, subtly. We are paying the price for fiscally driven minimum pilot training. We are paying the price for outdated flight time and duty regulations that do not reflect the demands made on a human body that has not advanced like the planes it operates. We are paying the price for the dumbing down of our profession.

And then in the midst of all these avoidable wrecks comes an event that makes a good case for buying a lottery ticket. The Hudson ditching due to all engine failure/degradation. Incredible odds taking out both engines, followed by benchmark decision making, teamwork and flying skills, followed up by near perfect evacuation and rescue. Made us pilots all feel good for sure. Until Buffalo, and until Amsterdam....back to reality ladies and gentlemen - we are not so good most of the time.

And then I go back to my own carrier, where we do not have the issue of low time pilots, but we have incredibly low morale. We have been beaten into a pulp by bankcruptcy, 9/11, corporate decisions made by uncaring rapists who should have trouble looking at themselves in the mirror. I fly a 767, with arguably one the simplest fuel systems imaginable - two engines and three tanks. Yet we cannot seem to go a few weeks without having a major fuel event, such as a crew taking off without any boost pumps working, (suction feed works!) flameouts due to crossfeed mismanagement (maybe suction feed does not work!) and the result? Near total thrust loss due to failure to burn fuel from the center tank prior to wing tank selection..... trust me, it really is very simple, or at least it was.....

All of these fuel mismanagement issues have resulted in more and more SOPS being written, instead of fewer. Example - we are now not allowed to use the crossfeed without referring to a 5 page (yes, five page) flight manual checklist now.

As I say, no single probable cause at all......

Let's get back to some basics everyone.

Lizzy

Martijn

Does anyone realise that the ground levels at this particular airport are actually -8 Feet?

(the airport is build on the bottom of an old lake)

I am not an expert, but assume a radalt is measuring independent of any other equipment so not using any reference to the actual height of the ground, so this must be coincedence?


Cem ARGUN

Obviously Boeing is responsible for a faulty or risky autopilot system. Assuming the RA is active at about 2500 feet, at 1950 feet, a steep change of 1958 feet should have been considered as a major fault and the other RA should have been cross referenced, also the negative value for an absolute to the ground measurement should have been considered as major fault and the autopilot should have been deactivated.

Turkish Airlines is responsible as they have permitted their airplane to fly and especially landing in autopilot, knowing that it had the same RA defect within the last 25 flight hours. It doesn't matter whether it's been fixed, as they did not clearly understand the real cause of the problem.

Pilots are sure responsible in not noticing a speed half the reference speed for 100 seconds, especially knowing that the RA is defective.

What about ATC? They have radar & ILS. They supposedly knew the approaching plane's distance to the airport & its speed with their own proper tower equipment, contradicting the faulty RA altitude communicated by the plane to the tower. Or is it not communicated instantly?

Boeing has mission critical design flaws, Turkish Airlines has mission critical safety operating procedure flaws, the pilots have mission critical judgment & equipment monitoring flaws. Why on earth the tower has not warned the pilots within 100 seconds? Can all the parties involved might be in such a paralysis?

Is it a coincidence that this faulty altimeter accident happeneed at Schiphol Airport, one of the few maybe the only major international airport below sea level? As Boeing engineers have not taken into account a negative RA reading as a fault, it might very well be that they haven't taken into account that airports might as well be below sea level.

Faulty RA, stupid auto-pilot, airport below sea level, "In God We Trust Airlines", 3 sleepy pilot, paralyzed ATC and only 9 dead. Now this must be fate.

Martijn

@ Cem ARGUN

Exactly. Screening some of the discussions, i can't find anything related to the fact that the airport (and surrounding area) are below sealevel.

Could this be an accident related to software problems similar to the Y2K issue where software was reaching "zero"?

CAPT. IMAD HASBINI

ITIS THE RESPOSIBILITY OF THE CAPTAIN PERFORMING THE TRAINING AND THE PILOT IN THE JUMP SEAT AND THEN THE TRAINEE FIRST OFFICER AS 100 SEC PASSED AND NO BODY WAS MONITORING THE SPEED AND THE ENGINE INSTUMENTS WHERE THE PILOT DOING THE TRAINING SHOULD HAVE HIS EYES ON THE FRONT PANELS EVEN IF HE WAS READING THE CHECKLIST. FOR ME I CONSIDER IT IS 99% PILOT ERROR AND 1% SYSTEM ERROR AS WHEN THE SYSTEM FAULTED A LOT OF WARNINGS CAME OUT BUT WAS NOT REGARDED CORRECTLY BY THREE PILOTS.

CAPT. IMAD HASBINI

IT IS ALSO BOEING TO BE BLAMED AS THE SYSTEM HAS A DEFECT AS THE PILOT FLYING WAS USUNG AUTOPILOT2 AND AUTO THROTTLE 2 SO THEY SHOULD RECIEVE INFORMATION FROM NO2 RADIO ALTIMETER AND DISREGARDS NO1 RADIO ALTIMETER. AND THERE SHOULD BE A WARNING TO PRONOUNCE THE RADIO ALTIMETER DIFFERENCE AT LEAST BELOW 1000 FEET ALTITUDE.

@ Martijn
LRRA measures the height to ground, negative reading indicates instrument failure.

@ Martijn
LRRA measures the height to ground, negative reading indicates instrument failure.

737 captain

Anyone ever seen the video from Capt. Vandenberg........

If you are not sure what the aircraft is doing..... click click, AP off AND A/T off, first fly the aircraft, go to a safe altitude (above MSA ESA)

100 seconds is a lifetime in aviation terms.

CRM is certainly one of the major issues here!

Safe flying to all of you

Anonymous

@ Mike, Steve,

My a.m. comment about safety critical electronics, is a summarize of international standards, e.g. IEC61508 for industrial controls. Even for household controls such a standard exists (IEC60730). I don't know anything about aircraft controls, but I still can't imagine that these controls will not meet the safety level of industrial or even household controls. More over,for many applications a safe state can be defined, e.g a control for a gasturbine will close the gasvalve - a safety shutdown- in case a reading of the sensors appears to be not reliable. For a flying airplane a safety shutdown is impossible. This means that redundancy is required. The task of an unreliable system component must be taken over by another component in case of a failure. A.m. standards are based on safeguards and secundary safeguards, systems guarding the correct functioning of the functional part of the control. More and more I get the impression that in a 737 it is the pilot who has to act as the safeguard! (S)he must check the instruments and aircraft behaviour while the autopilot is doing its job. I always understood that in a plane it is the other way around: if the pilot makes a mistake, the instruments will alarm him (her). Is there anybody who can explain this to me?

Hans

A negative reading on a radio altimeter does not indicate a failure. They're typically set up so that they read 0 at main gear touchdown on approach, and as the nose rotates down, the value goes slightly negative. Most aircraft, sitting still on the ground, will show a radio altitude that is negative by several feet.

Not a pilot

Looks like what system engineers call a 'fatal error between chair and keyboard'. It's common knowledge that the frequency of these errors can be reduced by better operator training, AND improvements in the Human Machine Interface (HMI).

Why isn't there an alert/caution when a disagree between a left-hand and right-hand primary flight instrument occurs? Why doesn't the A/T disengage when the throttles are moved manually? The FO pushed them forward, clearly indicating that the person in control of the aircraft needed more power. When the Capt took control, the FO took his hand of the throttles (as he should). It's plain stupid that the A/T resumed control over the power-settings (which was retard) at that time.

Besides the HMI, I get the idea that the pilots were flying the aircraft as if they were playing a flight-sim on a game-console. Isn't it standard practice to constantly scan your flight instruments during critical parts of the flight (like landing)? Instead, these pilots engaged autopilot channel-B, concentrated on the training of the trainee-pilot, and let the system sort out itself. A pilot can hand over the control of the aircraft to an automated system, NOT the responsibility. It took the activation of the stick-shaker to remind them of that responsibility.

Not a pilot

I continue to be shocked as more details come out. Why weren't the pilots monitoring airspeed ??? The most basic and critical item to check continuously is airspeed when on short final approach to landing. Every student pilot is taught that.

It turns out that when the stick shaker activated indicating an imminent stall, the 1st officer applied full throttle, but just seconds later the captain wanted to take control. For 6 seconds during the change of control, the engines were again at idle as commanded by the autopilot. How could the pilots allow that ? It's beyond me. When the captain again applied full power, it was too late and a second or two later the plane stalled and dropped like a rock to the ground. Luckily it was already low enough that most survived.

A very unfortunate chain of events...triggered off by just one faulty RadAlt. I was wondering...if one RadAlt was faulty and the other was ok, couldn't the flight augmentation computers have rapidly done a kind of vote against the conflicting RadAlts by maybe...doing a quick check on what GPS had to report in terms of Radio Height?

Another thing that could be considered is, a review of approach procedures. I also don't think its possible to know before hand if a RadAlt is working or is going to screw up the way this one did.

It almost reminds me of an accident I had on my old "MS-Flight Simulator '98". I was approaching Lima's (Peru) airport at a comfy, level, 4,000ft. I was combing the coast at 150IAS with full flaps and gear-down, waiting to capture the localizer for a right-hand turn, to be followed by glideslope capture. All was going smoothly until -like the RadAlt which decided to "step"- my scenery files also decided to "step". All of sudden, the scenery files error made the ground come rushing up to me without my Altimeter showing a corresponding loss of height (re: approaching a hill/mountain causes Alt to fall even though VertiSpeed remains at "zero"). It happened twice; the first time I escaped by climbing...I actually heard the tires touch the "rising ground" for a split second as my 734 pulled up in time. The second time, I was caught off guard due to monitoring of the localizer indicator's slide. I could pull up in time and...the ground "hit me".

How could I know the scenery would screw me up, how could the Turkish crew know that their RadAlt would screw them. They should not be blamed entirely unless you want to criticize them for not distrusting the flaw as soon as it reared its ugly head. I would have distrusted at first sign of anomalous behaviour, disengaged auto-whatever, handled manually...and always have GPS informing me of Lat/Lon/Alt even though it wouldn't be engaged.

Please tell me what you think of my opinion via email or Yahoo-360. Cheers.

PS: I'm not a pilot...yet.

@ Joe
Sorry, Just wanted to point out that the below sealevel story is not relevant, and negative reading at that speed/before tochdown indicates possible error.
What do you read app say 100 sec before tochdown? ;-)

questions

100 seconds do not start from the moment the a/c left ra failed. schippol app. makes u fly a high speed app.( 160 kts till 4 miles) and as the a/c was high and at high speed and assuming they were putting the flaps, 100 secs must have started way before the ra failure.
as the stick is shaked f/o applied power but due to software a/thr retarded.u are approaching to a stall but the a/thr retards it self. how stupid is that!
the report says 'as the engines responded' what kind of a delay are they talking about?
i think major factors here.first the crew realized the speed loss late due to the nature of the high speed decelerated app.& they were distracted by poor visibility,the warnings caused by ra,checklist and tower talks.and the other reson is the software .u cant crash a airbus 320 given the same conditions.
and something i wonder.an engine with full thrust impacted to ground. shouldnt the fan blades be all boken?

Sharat Chandrasekhar

Quoting CAPT. IMAD HASBINI;

IT IS ALSO BOEING TO BE BLAMED AS THE SYSTEM HAS A DEFECT AS THE PILOT FLYING WAS USUNG AUTOPILOT2 AND AUTO THROTTLE 2 SO THEY SHOULD RECIEVE INFORMATION FROM NO2 RADIO ALTIMETER AND DISREGARDS NO1 RADIO ALTIMETER.

No. One hates to speak ill of the departed, but it is sadly, the careless pilots that are to be blamed for this accident - Plain and Simple. There is no plausible excuse for an experienced flight instructor with 15000 hours not to notice a speed bleed down to stall during approach.

737 engine response is about 6 seconds.

Blades are the hardest things in a plane (and black boxes..)

Norbert

Is recovery of a stalled 737 still possible at 450 ft? If I stall my glider, I have learned to push the nose down instead of pulling the nose up, because pulling up just further decreases speed and further increases the stall. I realize my glider is not a 737, but shouldn't the principle be similar?

Working in the railway signallization, I know almost all of the rail systems have some kind of fail-safe or redundant systems to prevent such conditions. For example when the signal light turns to red, you make sure it is red, not another colour. It is hard to imagine that the autopilot of this state-of-the-art aircraft obeys to the output of a single altimeter??. 2-out-of-2 is the minumum required. Is it too expensive to put several altimeters and several autopilots in the aircraft and make sure all their results are the same? I would like to talk to the engineers who made the design. Make sure that the electronics systems are working as designed before blaming the humans.

I read some of your comments and it made me very sad. Seeing how disrespectful you can talk about people who are dead now. They have families who are in deep pain. Could you keep this in mind when you write about them.

I do not know why the flight crashed. I am not a pliot, but besides one pilot there were 2 more pilots who were experienced. One of the pilots was even a teacher, I cannot believe he made such a bad mistake.

If there are pilots on here writing, can someone tell me how the impact could be of a plane that landeded just 2 minutes before the TK flight? Could that be the reason for this immediate height and speed loss?
Regarding some airline experts there need to be 5 minutes difference between those landings. Is this correct?

Even if that instrument was broke, how can it be that when checking with the tower, the tower did not see a discrepancy ? Lets say the pilots slept for 1000 seconds...what did the tower do???

If there was fog on that morning, regarding the dutch news, is it possible for the pilots to see that there is something wrong?

I cannot get rid of the feeling that there are aspects which some people are trying ot hide...be it BOEING, Turkish Airlines or the Dutch Transportation Safety Board...I doubt that there was such a huge human mistake....

Dirk van der Laan

Hello DD, you have asked many questions that undoubtedly many people with little knowledge about aircraft operations have.
There are two issues here. First, who is to blame? Second, why has this crash happened? The answer to the first question is in this case simple. The failure of an instrument, that is mainly important for the autopilot, should never have lead the crew to lose sight of the speed and stall. "Always keep flying the aircraft" is one of the basic rules among pilots and the crew hasn't and the captain is ultimately responsible for that.
However the second one is more interesting and harder to answer and still under investigation by the Dutch TSB. Key attention goes to the failing radio-altimeter which has had consequences for the automatic operations of the aircraft that many people, pilots included, didn't know about.
It becomes too technical to explain what the consequences were, but the main thing is that the captain assumed to auto-pilot to prevent the aircraft from flying too slow and it didn't.
Had he known what was happening of course he would have turned off the autopilot. However, since he didn't know and also was training his co-pilot, he and the other crewmembers failed to notice the failing autopilot and the decreasing speed.
And when they finally did notice and reacted swiftly it was too late.

Finally, to answer your question about whether the tower shouldn't have alerted the pilots, the answer is NO. Speed is the responsibility of the pilots and of them alone. Air traffic control can give advice and notify, but their main job is to keep airplanes from flying into each other.

And ... I don't see who is hiding anything. I see just a small instrument-failure, bad luck and late reaction of the pilots. That's all.

Pilot error..... end of story!!! Sad but true!

Joe,
... end of story only when you need a stick to hit the pilot with. Start of story if you want to learn from it. Choose what you would like your critics to choose when you make a mistake.
"Let he who is without sin cast the first stone"

Karel Idema

One of the first actions recovering from a stickshaker or stall condition is AP and AT off and the power levers full forward (against the stop and not TOGA!!). Don't worry about egt's in the red. The thrust returned however to idle and remained there for 6 precious seconds as the AT was still in command. I guess the aircraft was at least 10 seconds or more deprived from emergency thrust when badly needed. This last mistake, again not operating according the Flight Manual, might have been the fatal one.
Certainly this will be checked in the simulator.

Ummm, a thought just popped up:
Is it possible to transfer FADEC (Full Authority Digital Engine Control) from obtaining altitude data from either RadAlt manually?

If its possible (at the pilot's discretion), then it could have been possible to avert the crash by "telling" (settings of course) the auto-throttle (FADEC) to disregard the faulty left RadAlt and rely on the right RadAlt.

...just a thought.

Of course a captain with thousands and thousands of hours experience doesn't know the standard stall recovery.
Kept the AP and AT connected for fun and didn't touch the throttles 'caus he loved crashing.
Hmmm...

Karel Idema

Let it be clear the autopilot B did a perfect job so the aircraft did not leave the glideslope otherwise the aural glideslope warning would have been triggered alerting the crew. The pitch was increased further and further to maintain the GS causing a speed drop as no power was applied There was no malfunction in the autothrottle system itself. It received information from RA 1 it was time to close the throttles and it did. This action must have been announced on the PFD with IDLE or RETARD i.s.o. SPD in the Flight Mode Annunciators. This annunciation as well as the speed decay, the pitch increase from 2 to 14 degrees, the lack of normal engine RPM and sound, the lack of rapid throttle movements, usual during approach with ATS on, it all went unnoticed by three crew. Why? Is Boeing to blame for this mishap?
The crew was not intending to make an autoland as is suggested many times. An autoland requires two AP's in command.
Furthermore all indications of the primary flightinstruments are compared constantly and a warning will be triggered when appropriate. A RA is not a primary flightinstrument.

Anonymous

Some points/questions:

1. In the previous two flights of that plane, the same instrument failed, but no accident took place. Presumably the pilots who got killed in the crashed flight were NOT the pilots in those earlier flights. One wonders why the pilots of the earler flights did not warn the airline about the problem. (Or, if they did, why the airline did not take action.)

2. Boeing's design is clearly idiotic: The autopilot is designed to take a critical decision (the decision of turning off the engines) by relying on only ONE of the TWO existing measuring instruments. As an earlier comment noted, even the household appliances are not designed that way. Doesn't that suggest irresponsible design on the part of Boeing?

(It is interesting that most of the killed people are either Boeing engineers, or the pilots.)

3. When the captain was taking over from the first officer, the engine is turned off again because the first officer releases the lever. That is followed by a 6 second pause, after which the engine starts again. Does that show a second neglect that lasted 6 seconds? Or is it that the captain immediately pushed the lever but the engine responds with a delay of 6 seconds?

'Click - Click'
'Click - Click'

retired guy/investigator

Also answers to Dicks Airbus comments, several additional comments and facts,
1) Amsterdam Airport Schiphol landing altitude is 15 feet below sea level (-15ft)
2) Captain (was called very experienced) operated as check pilot for the co-pilot who had prof-check to accomplish
3) Captain at RH seat as PNF (doing Nav/Com), co-pilot at LH seat (actual handles a/c) as PF
4) "learner pilot" at observer seat in front of Flight Deck door (obviously not at all observing)
5)AP/AT/Auto Land is NOT a Boeing design, I asume captains LRRA, who senses the Alt. didn't go gradually from 2000 to -8ft but must have dropped fast?, System should sens this malfunction and disconnect!
6) 100 seconds during the final approach (when especial extra attention is needed) is a very, very long time not to observe this and not interfear?
7) Too bad, lessens learnt for all of us during future flights.
8) No Flight Log enterings were found about previous Altimeter misreadings recorded at the last 25 hrs, according FDFR it happened twice, it would not hard to find out who/which pilots are guilty for this ignorance! They must feel most guilty for this crash

QUOTE: By retired guy/investigator on March 12, 2009 9:43 PM

8) No Flight Log enterings were found about previous Altimeter misreadings recorded at the last 25 hrs, according FDFR it happened twice, it would not hard to find out who/which pilots are guilty for this ignorance! They must feel most guilty for this crash UNQUOTE


A very harsh statement… And I very much tend to disagree…

The fact that the FDR (a machine with numerous sensors, storing numerous data…) has detected a radio altimeter fault does not necessarily mean that any of the previous crews were (made) aware of this fact.

During flight, not all data recorded by a FDR is announced to the crew, nor will it reach a flight deck crew during flight or ever thereafter…

Kind regards, learner . . .

Ali Oztas

As a frequent flyer and Gas Turbine control engineer (industrial applications), I would like to give some comments about this "hot" subject.
1) Technical
Design philosophy of altimeter should comply with minimum avionics safety standards. There are numerous ways to configure redundant initiators (instruments) such as voting, average and median etc. Next step is designing the sequencing software in such a way that if one or more initiators fail, the system should go to its fail safe status and disengage auto control systems. At the same time a single failure of an initiator should not lead to catastrophic failure of the asset (airplane). The captain is obviously is not a control engineer and his primarily task is flying the airplane. I am confident that post implementing these designs in the early test stages, the Boeing Company would have performed fully functionality checks. Sometimes due to commercial reasons an/or technical reasons, final use of this design might be limited. I understood that Boeing Company has their RCM (reliability centered maintenance), IPF (instrumental protective functions) for designing and maintaining their systems. We should trust prestigious company like Boeing for all their compliances.
Post complete functionality tests of the avionic system, any revealed design deficiencies will be undergo risk assessment for safety and reliability compliances versus the cost. Remaining findings and design philosophy will be translated to operating manuals for the flight operators. The operators should then undergo competency development programs (simulator training, class room trainings etc.)

2) Human factor
What ever robust design of the avionics system, there will be always a human factor for success of failure of safe operating your asset (airplane). During transient operations (landing and take off), the captain should monitor the critical instruments such as this altimeter(s).

It appears that we all are focusing on the consequence of a failure (faulty LRRA as confirmed during the initial investigations). Did we find the root cause of the LRRA failure? Was this instrument maybe wrong calibrated or maybe not calibrated as per maintenance intervals? Failure modes of these instruments are known by the designers, premature failure modes could be excluded. It appears that, LRRA is giving the wrong reading in low altitudes (in this case). How about the readings on higher altitudes and their associated control and operating philosophies? Is same LRRA used for higher altitudes and is there any evidence of faulty readings?

Let’s quit blaming each other! We should learn from mistakes and share our knowledge for the sake of safe flying.
My advice for the virtual civilization "warriors" (Dutch Guy and the Turkish): we are living in a multicultural world and we have to respect each other and avoid virtual civilization clashes, at least on our level as professionals.
From understanding comes respect, do we understand each other?
TEMPUS FUGIT...

Ali Oztas


James Gow

For now, give the the flight crew, and their families, a break.

When I learnt that the difference between flying and falling was but a few knots the law prohibited me from carrying passengers. It seems that the passengers must now pay for our industry to re learn.

unless i've missed it : where's the vital evidence from the cockpit voice recorder(s)& the flight data boxes(s), which should explain lots of things....before prejudging ?

That is some inspirational stuff. Never knew that opinions could be this varied. Thanks for all the enthusiasm to offer such helpful information here.

Leave a comment

Want a user picture? Get a Gravatar!

December 2009

Sun Mon Tue Wed Thu Fri Sat
    1 2 3 4 5
6 7 8 9 10 11 12
13 14 15 16 17 18 19
20 21 22 23 24 25 26
27 28 29 30 31    

Technorati

Technorati search

» Blogs that link here