The has ordered modifications to autothrottle computers to correct what Dutch investigators concluded is a design anomaly that played a significant role in the February 2009 crash of a 737-800. Last November issued a service bulletin to operators recommending the same fix, but action is not mandatory.
The FAA issued a preliminary rulemaking on March 3 that, if finalized as is, will give operators three years to modify or replace affected 737NG autothrottle computers on 497 U.S.-registered aircraft. The directive likely will be echoed by regulators around the world.
The issue centers on a 737 design feature that has the autothrottles driven in part by altitude readings from the left-side, or captain's, radio altimeter unless the altimeter detects a malfunction. The problem attracted attention during the Dutch Safety Board's (DSB) probe of Turkish Flight 1951, which crashed on approach to Amsterdam Schiphol Airport, killing five passengers and four crewmembers, including three pilots.
The first officer flew the approach, using the right-hand autopilot. The left-hand radio altimeter delivered incorrect altitude information but did not register its data as faulty. Because the right-hand altimeter was not malfunctioning, the first officer did not detect an issue, and the pilots did not realize the altimeter data disagreed.
Nearing the airport, the left altimeter indicated that the 737 was much lower than it truly was and caused the autothrottles to enter “retard flare” mode—normally done at 27 ft. or lower—while the plane was still at 750 ft., bringing the engine speeds to approach idle. As the airspeed slowed, the right-hand autopilot—still working off accurate altitude information from its associated altimeter—pushed the aircraft's nose up to keep it on the selected glidepath.
The flight crew, which included an instructor pilot, did not recognize the mode change and resulting near-stall condition until the 737 was less than 500 ft. from the ground. They attempted to recover but crashed about a mile from the runway threshold. While the DSB said the crew could have recovered from the near-stall state, it criticized Boeing's design and lack of communication on the altimeter malfunction issue for creating the problem.
The DSB's probe discovered that the altimeter problems have “a long history,” including some incidents in which the retard flare mode was activated too soon. However, Boeing's only fleet-wide action came in 2004, when it modified the 737NG's preflight dispatch deviation guide to prohibit use of associated autopilot modes if either altimeter is malfunctioning.
“This shows that Boeing was aware of the possible consequences of inadequate performance of the radio altimeter system,” the DSB states in its 2010 final report on the accident. “[H]owever, this did not result in any procedures for situations where the problems with the radio altimeter system only occurred during the flight.”
Boeing told the DSB it conducted both statistical analyses and simulator tests on the malfunction. The manufacturer determined that the issue “did not involve a safety problem,” reasoning that the likelihood of an event below 500 ft. was “very small” and events at higher altitudes were recoverable
The DSB disagreed. “The consequences of an erroneous radio altimeter signal and the unsafe autothrottle design should have led to the conclusion in 2004 there was a safety problem,” its report states. “[An appropriate] reaction from Boeing would have been to issue a warning to all users.”
Boeing says the service bulletin referenced in the notice of proposed rulemaking (NPRM) is “one of the final components” of the changes the airframer has made to the 737 after the crash. Others include operations manual updates and software changes in April 2010, and a July 2010 production line cut-in that added an “Airspeed Low” aural alert to new 737NGs.
Meanwhile, in a final rule issued March 5, the FAA is requiring operators of Boeingto replace radio altimeter antennas and, in some aircraft, the radio altimeter transceiver after reports of “erratic” operation of the system while airborne. Potential effects include landing short of the runway. The FAA says the rule does not affect any U.S.-registered 777s.