Team-BHP - Boeing 737 Max crashes and grounding

Quote:

Originally Posted by Sutripta (Post 4734722)

Interesting reading

It is interesting and you can see the similarities. Having said that, the Turkeys crew really bungled up this landing. There are multiple reasons why they should have gone around, they were not stabilised, they were still fumbling with a check list when on final, they were not monitoring air speed, captain took control, but did not put his hand on the throttle etc etc. They had a third pilot in the cockpit, all three pilots made several serious faults.

The full investigation report can be found here:

https://www.onderzoeksraad.nl/en/pag...-800-amsterdam

Summary of what happened:

Quote:

What caused the aircraft to crash?
The Boeing 737-800 can be flown either manually or automatically. This also applies to the management of the engines. The autothrottle regulates the thrust of the engines. The aircraft is fitted with two radio altimeter systems, one on the left and one on the right. In principle, the auto- throttle uses the altitude measurements provided by the left radio altimeter system. Only if there is an error in the left system that is recognised as such by the system, the autothrottle will use the right-hand radio altimeter system.
The aircraft involved in the accident was being flown by the first officer, who was sitting on the right-hand side. His primary flight display showed the readings measured by the right radio altime- ter system. The right-hand autopilot was in use and, once air traffic control had provided a heading and altitude to be flown, it was in the ‘altitude hold’ mode in order to maintain that altitude. During the approach, the left radio altimeter system displayed an incorrect height of -8 feet. This could be seen on the captain’s (left-hand) primary flight display. The first officer’s (right-hand) primary flight display, by contrast, indicated the correct height, as provided by the right-hand system. The left- hand radio altimeter system, however, categorised the erroneous altitude reading as a correct one, and did not record any error. This is why there was no transfer to the right-hand radio altimeter system. In turn, this meant that it was the erroneous altitude reading that was used by various aircraft systems, including the autothrottle. The crew were unaware of this, and could not have known about it. The manuals for use during the flight did not contain any procedures for errors in the radio altimeter system. In addition, the training that the pilots had undergone did not include any detailed system information that would have allowed them to understand the significance of the problem.
When the aircraft started to follow the glidepath (the ideal path to the runway) because of the incorrect altitude reading, the autothrottle moved into the ‘retard flare’ mode. This mode is nor- mally only activated in the final phase of the landing, below 27 feet. This was possible because the other preconditions had also been met, including flaps at (minimum) position 15. The thrust from both engines was accordingly reduced to a minimum value (approach idle). This mode was shown on the primary flight displays as ‘RETARD’. However, the right-hand autopilot, which was activated, was receiving the correct altitude from the right-hand radio altimeter system. Thus the autopilot attempted to keep the aircraft flying on the glide path for as long as possible. This meant that the aircraft’s nose continued to rise, creating an increasing angle of attack of the wings. This was nec- essary in order to maintain the same lift as the airspeed reduced.
In the first instance, the pilots’ only indication that the autothrottle would no longer maintain the pre-selected speed of 144 knots was the RETARD display. When the speed fell below this value at a height of 750 feet, they would have been able to see this on the airspeed indicator on the primary flight displays. When subsequently, the airspeed reached 126 knots, the frame of the airspeed indicator also changed colour and started to flash. The artificial horizon also showed that the nose attitude of the aircraft was becoming far too high. The cockpit crew did not respond to these indica- tions and warnings. The reduction in speed and excessively high pitch attitude of the aircraft were not recognised until the approach to stall warning (stick shaker) went off at an altitude of 460 feet. This warning is activated shortly before the aircraft reaches a stall situation. In a stall situation the wings of the aircraft are not providing sufficient lift and the aircraft cannot fly anymore.
If the prescribed recovery procedure - i.e. selecting full engine power and reducing the pitch atti- tude of the aircraft - is implemented correctly and immediately when the stick shaker starts, then the aircraft will continue to fly normally. Boeing’s procedures also prescribe that the throttle levers should be pushed fully forward in such a case.
The first officer responded immediately to the stick shaker by pushing the control column forward and also pushing the throttle levers forward. The captain however, also responded to the stick shaker commencing by taking over control. Assumingly the result of this was that the first officer’s selection of thrust was interrupted. The result of this was that the autothrottle, which was not yet switched off, immediately pulled the throttle levers back again to the position where the engines were not providing any significant thrust. Once the captain had taken over control, the autothrottle was disconnected, but no thrust was selected at that point. Nine seconds after the commencement of the first approach to stall warning, the throttle levers were pushed fully forward, but at that
6
point the aircraft had already stalled and the height remaining, of about 350 feet, was insufficient for a recovery.
The Board concludes that the improper functioning of the left-hand radio altimeter system led to the thrust from both engines being reduced by the autothrottle to a minimal value too soon, ulti- mately causing too big a reduction in speed. The airspeed reached stall speed due to a failure of monitoring the airspeed and pitch attitude of the aircraft and a failure to implement the approach to stall recovery procedure correctly. This resulted in a situation where the wings were no longer providing sufficient lift, and the aircraft crashed.
Non-stabilised approach
Until the point when the stick shaker started, the crew were still performing actions in prepara- tion for the landing, under pressure, including ticking off the landing checklist. Standard Operating Procedures of Turkish Airlines prescribe, however, that if there is insufficient visibility, as was the case here, all of these actions should be completed by the time the aircraft is at an altitude of 1000 feet. If the preparations have not been completed by that point, with the result that the approach is not stabilised by then, the pilots should execute a go-around. This provision is not confined
to Turkish Airlines, in fact, but is a general rule. When the aircraft passed 1000 feet, this was checked off by the crew, but it did not result in a go-around. The aircraft passing 500 feet was also announced, the go-around altitude if the aircraft is not stabilised and visibility is actually good. This did not result in a go-around either, despite the fact that the approach was not stabilised, since the landing checklist had not yet been completely ticked off.
The captain is ultimately responsible for the safe completion of the flight and complying with legal conditions and airline procedures, as long as these are not inconsistent with the safe completion of the flight. It is likely that the captain did not regard a continuation of the approach below 1000 feet, or even later when the aircraft passed 500 feet, as a threat to the safe completion of the flight.
Being stabilised is important not only to ensure that the aircraft is in the correct configuration and power selection for the landing, but also to provide the pilots with a chance to monitor every aspect of the final approach. The Board considers a stabilised approach of major importance for a safe completion of a flight and pilots should keep strictly to these Standard Operating Procedures.
Convergence of circumstances
That the accident could happen was the result of a convergence of circumstances. These circum- stances could only have resulted in the accident happening because of their mutual interaction. The following are the complex of factors that played a role in the accident.
Lining-up for the runway
The instrument landing system of the runway was used during the approach made by the accident flight. This system indicates the heading (the localizer signal) and the descend angle to the landing runway. The localizer signal is the first to be intercepted. Then, during a normal interception of the signals from the instrument landing system, the glide path is approached and intercepted from below. The use of the aircraft’s navigation equipment is designed and optimised for this purpose.
However, the crew had received instructions from air traffic control to maintain an altitude of 2000 feet and a heading of 210°. This heading ultimately resulted in interception of the localizer signal at 5.5 NM (nautical miles) from the runway threshold. According to air traffic control procedures, in view of the altitude of 2000 feet, this should have happened at a minimum of 6.2 NM, in order to be able to intercept the glide path from below. The method for approach, without instructing
it to descend to a lower altitude, resulted in the glide path having to be intercepted from above. When the thrust levers moved to ‘flight idle’ as a result of the ‘retard flare’ mode of the autothrot- tle, the aircraft reacted as would be anticipated in this situation. The aircraft had to lose speed and descend in order to intercept the glide path. This masked the fact that the autothrottle had moved into ‘retard flare’ mode.
It has to be pointed out that an approach in this way is not inherently unsafe. The procedures applied by Air Traffic Control the Netherlands permit an approach between 8 and 5 NM from the runway threshold, on certain conditions. The approach should be ‘offered’ to the pilots to ensure
7

that they are aware of the short approach - and the aircraft must get instructions to descend to an altitude below 2000 feet to make sure the glide path is intercepted from below.
The guidelines of the International Civil Aviation Organization say that an aircraft must be set
up in such a way as to be flying horizontally on the final approach track before the glide path is intercepted. The Rules and instructions air traffic control is a document produced by Air Traffic Control the Netherlands, which includes guidelines, conditions and operating instructions for air traffic controllers. That document does not state that an aircraft must be given the opportunity to be flying horizontally on the final approach path before it intercepts the glide path. The Rules and instructions air traffic control do indicate that the glide path must be intercepted from below. This does not guarantee in every case that the aircraft can be in horizontal flight, as advised by the International Civil Aviation Organization, at the point when it intercepts the glide path. The Board considers it important that the regulations of Air Traffic Control the Netherlands should be made to coincide with international guidelines.
As said an approach between 8 and 5 NM from the runway threshold is permitted, provided it is ‘offered’ to the pilots and they get instructions to descend to an altitude beneath 2000 feet. The Air traffic Control the Netherlands stated that at Schiphol airport this kind of approach was used very often. For runway 18R over 50 percent of the approaches were done this way. Normally
an ‘offer’ is not mentioned, as was the case for flight TK1951, so pilots must make up from the instructed heading that the glide path will be intercepted between 5 and 8 NM of the threshold of the runway, nor a descend to an altitude below 2000 feet is instructed. The deviation from the regulations is structural and the fact that it happens so often does not change these regulations and in no sense implies that the regulations are no longer applicable. The Board regards it as a matter of concern that Air Traffic Control the Netherlands does not observe its own rules.
Supervision by the Transport and Water Management Inspectorate
The Inspectorate is responsible for exercising supervision over Air Traffic Control the Netherlands, and performs periodical audits. The Rules and instructions air traffic control however, have not been tested by the Transport and Water Management Inspectorate. Furthermore the audits per- formed by the Inspectorate give no indication as to whether individual air traffic controllers acted
in accordance with the Rules and instructions air traffic control. The Board is surprised that the Transport and Water Management Inspectorate does not test if the regulations of Air Traffic Control the Netherlands are in line with the regulations of the International Civil Aviation Organization. Furthermore, the regulatory body should also be testing whether air traffic controllers are operating in line with their own internal rules.
The radio altimeter
During the approach, the left radio altimeter system indicated -8 feet, although the aircraft was at a considerably greater height than that. The Board’s investigation has not uncovered a reason for this change in the radio height to -8 feet.
The problem is not an isolated one, however. The failure of radio altimeter systems in Boeing 737- 800 aircraft has a long history. This has happened not only at Turkish Airlines but also within other airlines. Turkish Airlines has been bringing the problem to the attention of Boeing since 2001. This has happened at various times and in various ways over the course of years, including the problem being highlighted at a forum (the ‘fleet team resolution process’), chaired by Boeing, sending off flight data recorder information for analysis and returning and testing some antennas. Turkish Airlines has also sought all manner of technical solutions to prevent corrosion, which was cited by Turkish Airlines as a possible cause of the poor performance of radio altimeter systems.
Given the fact that the problem manifested itself not only with Turkish Airlines, but also with other airlines, the prime responsibility in relation to solving the problem with the radio altimeter system lay not with Turkish Airlines but with Boeing as designer and manufacturer of the aircraft.
Boeing receives about 400,000 reports each year regarding technical problems with its aircraft. Of these, about 13,000 reports relate to the Boeing 737 NG. Out of these 13,000 reports each year, only very few were related to problems with the radio altimeter system which had an impact on Boeing’s automatic flight system, in the period from 2002-2009. Only some of these cases were related to the activating of the ‘retard flare’ mode of the autothrottle.
8

Looked at in isolation, these are small numbers. Nevertheless, the Board considers that Boeing reasonably could have realised that the problem - particularly the effect on the autothrottle - could have had an impact on safety. The Board considers not only that an analysis of the problems with the radio altimeter system and the effects on the systems that make use of the data of the radio altimeter would have been appropriate, but that it also would not have been superfluous to inform the airlines and thus the pilots about the problems and the possible consequences.
The Board reaches this conclusion for two reasons. First of all, a question from an airline company regarding a passage in the Flight Crew Operations Manual, back in 2004, led to the inclusion of the warning, mentioned previously, in the Dispatch Deviation Guide. This warning stated that, with radio altimeter(s) inoperative before the flight, the associated autopilot or autothrottle ought not to be used for the approach and landing. This shows that Boeing was aware of the possible conse- quences of the inadequate performance of the radio altimeter system. As previously stated, however, this did not result in any procedures for situations where the problems with the radio altimeter system only occurred during the flight.
Secondly, two incidents were discussed in Boeing’s Safety Review Board in 2004, where the ‘retard flare’ mode was activated at 2100 feet and 1200 feet respectively, as a result of negative read- ings from the radio altimeter system. This too shows that Boeing was aware of the possibility of the occurrence of the specific consequences that arose in this particular case. Following statistical analysis and the performance of flight simulator tests, Boeing concluded that this was not a safety problem, because, among other things, the pilots obtained adequate warnings and notifications to allow them to intervene in time, in order to recover the situation and land safely. However an extra warning to make sure that pilots intervene in time would certainly not have been misplaced.
Reports
The following factor also played a part. Analysis of the flight data showed that only part of the problems with the radio altimeter system had been reported by Turkish Airlines pilots. Two further comparable incidents had occurred shortly before the accident flight. The pilots in question indi- cated that the irregularities could not be reproduced on the ground, and did not recur during their return flights. The crews did not, therefore, report the incident. At other airlines as well, analysis of flight data showed that the number of times when erroneous radio altimeter readings occurred in one of the radio altimeter systems was several times the number of reports actually made by pilots.
By not reporting incidents, the information is lost, with the ultimate result that neither the airline nor the aircraft manufacturer is made fully aware of the number of significant incidents. Since risk analysis is based partly on the reporting of incidents, failure to report also has an unintentional impact on the degree to which Boeing was in a position to determine the scope of a potential problem.
The Board considers that complaints and defects should always be reported timely and completely. Reports are essential to determine the urgency for realisation of solutions and by that for the proper performance of the system of safety within aviation.
Line flying under supervision
The first officer had moved from the Turkish Air Force to Turkish Airlines in June 2008. He had gained about 4000 hours of flight experience in the air force. For the first officer, the flight was part of a training ‘line flying under supervision’. It was his 17th line flight under supervision and his first flight to Schiphol airport.
Line flying under supervision familiarise a pilot with the operational aspects of flying with passen- gers on certain routes and to certain airports. This training commences after the pilot in question has passed his training to fly a Boeing 737 and is therefore fully authorised to fly this type of air- craft. During this type of flights, the captain also acts as an instructor. At Turkish Airlines an extra pilot is on board, in an observer’s role, the safety pilot, for the first 20 flights of line flying under supervision.
9

The nature of line flying under supervision means that the captain has instructional duties in addi- tion to his responsibility for performing a safe flight. The captain’s instructional objectives therefore also become relevant. In the context of clarifying a technical instructional point, the captain may decide to deviate from standard communication and coordination procedures for cockpit crews, so that the first officer gains personal experience of what happens or does not happen.
It is therefore one of the tasks of the safety pilot to warn the crew if they should fail to notice any- thing important. This can happen because the captain has extra instructional duties to undertake and is therefore under a greater operational load. During the approach, the safety pilot did indeed warn the captain about the error in the radio altimeter system, but did not do so when the airspeed fell below the pre-selected value. It is possible that the safety pilot was also distracted by then. Shortly after flaps position 40 had been selected, he received a message that the cabin crew were ready for landing. He passed this on to the captain. During the very final phase, shortly before the approach to stall warning was activated, the safety pilot was dealing with the captain’s instruction to warn the cabin crew of the impending landing. When the stick shaker was activated and during the recovery procedure, he warned the captain about the excessively low airspeed.
It is concluded that the system of a safety pilot on board flight TK1951 did not work sufficiently well.
Approach to stall training
The European rules for training pilots that applied to Turkish Airlines - the Joint Aviation Requirements, Operations 1 and Joint Aviation Requirements, Flight Crew Licensing - only pre- scribed approach to stall training in the context of type qualification training. The training required for qualification to be allowed to fly a particular aircraft type. This may explain the first officer’s rapid reaction to the stick shaker. He had recently undergone his type qualification training.
There is no rule prescribing training in recovery after an approach to stall warning in the recurrent training. The thinking behind this is apparently that an approach to stall situation will be unlikely to occur, and pilots know how to deal with it. Furthermore all of the standard communication and coordination procedures in relation to monitoring the flight path and airspeed are aimed precisely at avoiding such a situation.
The view of the Board however, is that the training rules are inadequate: in some cases, such as that of the captain, there are no exercises at all in dealing with approach to stall situations for many years. The fact that the approach to stall warning is a last safety means entails that, if an approach to stall situation arises, there is an immediate and acute emergency situation. It is then crucial for the crew to respond adequately. The Board accordingly considers that the recurrent training provided by the airlines should be supplemented by approach to stall training.
Standard Operating Procedures
Finally, the Board has some comments to make about standard operating procedures. The manu- als available to the pilots contain no information about the consequences that a non-functioning left radio altimeter system would have for the other automatic systems. Therefore the cockpit crew of flight TK1951 were unable to make a proper assessment of the consequences of this, and the risk to the approach. The short line-up and the approach to the glide path from above, this involved extra activity and left less time available to get the approach stabilised in good time. The landing checklist was accordingly being worked on at a later point than would be normal. In addition, this flight was also a training flight, so that the captain had to divide his attention between instructional duties and his own normal duties.
The various different factors outlined above, and even a combination of some of them, will occur somewhere in the world on a daily basis in flight operations. What is unique about this accident is the combination of all the factors in a single flight. The accumulation of these factors reached its peak in the final phase during the flight’s final approach, for a period of about 24 seconds before the start of the approach to stall warning, with the result that the aircraft’s speed and attitude were not being closely monitored at exactly the point when this was necessary.
10

The standard operating procedures in aviation are the safety barriers designed to ensure that flight safety is not compromised in cases such as the one described above. An example of this is the standard operation procedure of Turkish Airlines, indicating that if the approach is not stabilised at 1000 feet, no attempt may be made to land. Being stabilised is important not only to ensure that the aircraft is in the correct configuration and power selection for the landing, but also to provide the pilots with a chance to monitor comprehensively every aspect of the final approach. As shown by the chain of events during flight TK1951, the importance of these standard operating procedures must not be underestimated if the flight is to be undertaken safely.

For the first couple of days after this horrific accident the Turks portrait the crew as heroes, trying there damnest to safe the plane and passengers. As soon as the voice recorder was read a very different picture emerged.

What is interesting to note is that the Turkish had been complaining to Boeing about the single sensor before, and they were not the only ones. But it also mentioned that not all incidents got reported properly and accurately either. This sort of behaviour rings bells with the first Max crash.