The Luxembourg Maneuver: The crash of Luxair flight 9642
On the 6th of November 2002, a commuter flight on approach to Luxembourg suddenly fell out of the sky short of the airport. The twin turboprop Fokker 50 slammed belly-first into a field and burst into flames, killing 20 people; only two, including the captain, survived, making this the worst air disaster in the history of Luxembourg. While the tiny nation grappled with the tragedy, investigators discovered that a baffling series of events had occurred aboard the doomed airliner, culminating with the captain accidentally putting both engines into reverse! There was just one problem: this should have been impossible. Multiple layers of protection existed to prevent exactly this scenario. So how did it happen? Could it happen again? As it turned out, applying reverse thrust in the air was much easier than anyone thought — and it wouldn’t be long before this insidious design flaw struck a second time, with even deadlier results.
Luxair is the flag carrier of the Grand Duchy of Luxembourg, a tiny European nation sandwiched between France, Germany, and Belgium. The airline, which is partially owned by the government of Luxembourg, is and historically has been the only commercial passenger airline registered in the country, and since its founding in 1962, it has had a nearly flawless safety record with hardly any accidents or incidents, fatal or otherwise. By the early 2000s, its fleet consisted of several Boeing 737s and a similar number of Dutch-built twin turboprop Fokker 50s designed for shorter, regional flights. The Fokker 50 is a modernized version of the older Fokker F27 Friendship, which was first introduced in 1958. The updated version, which entered service in 1987, featured new, more efficient engines as well as modern avionics and cockpit instruments; this update proved successful and 213 were built, of which several dozen are still flying today.
Luxair flight 9642 was a regularly scheduled Fokker 50 service from Berlin, Germany to Findel Airport in the city of Luxembourg. On the morning of the 6th of November 2002, the flight was less than half full, with passengers booked in only 19 of the airliner’s 50 seats. In command were two pilots, Captain Claude Poeckes and First Officer John Arendt, who had a combined 3,300 hours of experience on the aircraft type. The crew also included a single flight attendant, bringing the total number of people on board to 22. After the passengers had boarded, flight 9642 departed Berlin at 7:40 a.m. and climbed away into the early morning gloom.
At 8:35, 55 minutes into the flight, the pilots first checked the Automated Terminal Information Service, or ATIS, to acquire an updated weather report for Luxembourg. What they found was discouraging: due to heavy fog, visibility at the airport was only 275 meters, below Luxair’s company minimum of 300 meters for the Fokker 50. Improvement was considered unlikely, so the crew resigned themselves to the near certainty that the flight would be delayed en route or diverted. They discussed their plans for the landing: should they attempt an approach? Where should they hold? When should they consider diverting? But Captain Poeckes did not decide on a course of action, and no preparations were made for an approach, since they did not expect to perform one anytime soon.
At 8:58, flight 9642 arrived at a waypoint called Diekirch where several other airplanes were circling in a holding pattern while they waited to land in Luxembourg. But the holding pattern was getting full and the air traffic controller wanted to start clearing out some of the airplanes. The plane in the best position to leave the pattern and attempt an approach just so happened to be flight 9642, so the controller instructed the crew to descend to 3,000 feet and fly on a heading to intercept the approach centerline. The controller was unaware that visibility was too low for a Fokker 50 to land because the pilots had not told him. Because visibility remained below 300 meters, the pilots of flight 9642 were caught off guard by the instructions, and First Officer Arendt asked, “What are they doing with us, holding, or is it for an approach?” As it appeared that flight 9642 was being cleared to begin its approach, the pilots now had to scramble to get the plane ready, prompting them to skip the usual approach briefing.
At 9:01, the controller removed any confusion by specifically clearing flight 9642 to approach Findel Airport. “Oh gosh, they’re bringing us in before all the others,” Arendt remarked, expressing his surprise at the clearance.
The crew quickly went over the approach sequence: after arriving at 3,000 feet, they would level off until reaching the radio beacon called ELU (Echo Lima Uniform), known as the “final approach fix,” whereupon they would commence their final descent to the runway. Although they were allowed to attempt an approach with less than 300m visibility, they would be obligated to abandon the approach if visibility did not improve above the minimum by the time they reached the final approach fix. Captain Poeckes was aware of this, and at 9:02 he said, “Tell him if at Echo we don’t have 300 meters, that we then do a go-around and fly to Diekirch.” At around this time, flight 9642 locked on to the signal from the airport’s instrument landing system and successfully aligned with the runway. Moments later, the controller informed them that visibility had worsened to 250 meters. Only now did Arendt tell the controller that this was a problem. “Uh, that’s copied Luxair nine six four two,” he said, “but we need three hundred meters for the approach.”
“Say we continue to ELU, if then we have nothing, then ehhh…” said Poeckes.
“Yes,” said Arendt. He now pulled out the before approach checklist and rushed to complete all the steps before reaching ELU.
At 9:04, flight 9642 arrived over ELU with reported visibility still below the minimum. Captain Poeckes said, “Yes, well, we do a go-around, missed approach,” and they kept flying onward at 3,000 feet instead of descending. But First Officer Arendt didn’t seem to get the message, as he continued with the before approach checklist. The last item on this checklist was to remove the ground idle stop, which he accomplished seven seconds after Poeckes called for a go-around.
The ground idle stop is a device that physically prevents the throttle levers from moving below ground idle, the lowest power setting that provides forward thrust. Flight idle is the lowest power setting used in flight; ground idle is similar but even lower. The zone between flight idle and ground idle is known as the ground range. Below the ground range is the reverse regime. The reverse regime and the ground range are together known as the “beta range,” in which the throttles no longer control power output, but instead directly control the pitch of the propeller blades. By shifting the pitch of the propeller blades below zero degrees, it is possible to generate reverse thrust, which is used to help slow the plane on landing.
Although the capability to produce reverse thrust is critical to bringing the plane to a stop after it’s on ground, it could be catastrophic if used in the air. To prevent reverse thrust from being engaged while in flight, a three-step activation process is used. First, a pilot must pull out the ground idle stop, which enables movement of the throttle lever from ground idle into the reverse regime, priming the system for quick activation of reverse thrust on landing. However, a secondary stop prevents the throttles from entering the ground range at all until the aircraft touches the ground. Once the plane’s anti-skid system detects that there is weight on the wheels or that the wheels are spinning with a speed of at least 20 knots, it sends signals to the flight idle stop solenoids located inside the two engines; once these are activated, the secondary stop is removed. The pilot can then pull the ground range selector (attached to the throttle lever) to move the throttles back through the ground range and into the reverse thrust position. Therefore, for reverse thrust to engage in flight, both flight idle stop solenoids must fail simultaneously, a pilot must deliberately remove the ground idle stop, and then a pilot must lift the ground range selector and pull the throttles back to the reverse position. In theory, the system should have been quite foolproof.
Ten seconds after Poeckes called for a go-around, the controller informed flight 9642 that visibility was now 300 meters, technically within limits for landing. This caused Poeckes to change his mind about abandoning the approach, since it was now possible to land. As a result, Arendt continued with the landing checklist, extending the flaps and lowering the landing gear. But they had continued level for some time after passing ELU, and now they were 300 feet above the glide slope to the runway. To lose altitude faster, Poeckes reduced power to flight idle, but Arendt said something to the effect that this wouldn’t work. However, Poeckes knew a trick to reduce thrust a little bit further. There are actually two flight idle stops: one that is engaged by the flight idle stop solenoids, and another which is removed when the ground range selector is lifted. By lifting the ground range selector, it was possible to move the throttles back slightly farther to the electronic stop, a technique that was prohibited in flight but which pilots sometimes used on the down low.
When the landing gear is lowered, the anti-skid system powers up so that it is in position to detect when the wheels touch the runway. However, unknown to the pilots of flight 9642, the anti-skid systems on all Fokker 50s concealed a dangerous design flaw: when the system first powered on, electromagnetic interference between the two anti-skid units could result in an erroneous “wheels spinning” signal for a period of about 30 microseconds. This was sufficient to trick the flight idle stop solenoids into thinking the plane was on the ground, causing them to open the secondary stop that prevents the throttle levers from entering the ground range. The flight idle stop solenoids would remain active for 16 seconds after the initial false signal was received from the anti-skid system. Therefore, during that 16-second period, it was possible to apply reverse thrust, as long as the ground idle stop had already been removed. It just so happened that this stop had indeed been removed on flight 9642 when the landing gear was lowered and the false signal was sent to the flight idle stop solenoids.
Coincidentally, it was during this 16-second window that Poeckes decided he needed to reduce thrust in order to descend faster and capture the glide slope. When he lifted the ground range selectors and moved the throttle levers backward, he expected the levers to come to rest at the secondary stop, but because the secondary stop had been temporarily removed, he inadvertently pulled them back to the final stop at the bottom of the beta range — putting the engines into reverse, which was supposed to be impossible in flight.
At 9:05 and 19 seconds, propeller blade pitch reduced through zero degrees and entered reverse power. Engine parameters such as propeller speed and thrust output began to increase rapidly, but in reverse. A loud noise suddenly filled the cockpit and the pilots felt a massive deceleration. “What’s that?” Poeckes exclaimed.
Within a couple of seconds, both pilots apparently realized that they were experiencing reverse thrust, as Arendt retracted the flaps to reduce drag and Poeckes jammed the throttles to max forward power in an attempt to go around. But he did so too hastily. On the Fokker 50, when the throttles are in the beta range, throttle commands are fed to a hydraulic actuator which adjusts blade pitch. When in the forward thrust regime, where throttle commands control power output instead of blade pitch, a separate system of counterweights automatically adjusts blade pitch to achieve the desired power output. But when rapidly moving from reverse thrust to forward thrust, the counterweight system was engaged before the hydraulic actuator had a chance to return the blades to a positive pitch angle. If the counterweights are engaged while the blade pitch is below zero degrees, the counterweights will instead pull the blades toward the maximum reverse pitch of -17 degrees. Therefore, by moving the throttles forward too quickly, Captain Poeckes caused both engines to get stuck in reverse.
With both engines generating full reverse power, the plane dropped like a rock from 2,500 feet as the pilots fought to regain control. Poeckes cut fuel flow to shut down both engines and stop them from producing reverse thrust, but there was little he could do to arrest their descent rate. The plane lost electrical power and both flight recorders ceased functioning, although the cockpit voice recorder cut back in a couple more times, capturing disjointed shouting: “This is screwed!” “Oh, shit!” In the background, the ground proximity warning system began to blare, “TOO LOW, TERRAIN.” Seconds later, Luxair flight 9642 slammed belly-first into the side of a highway on the outskirts of Luxembourg. The plane skidded across the road and sliced through a row of trees, ripping open the fuselage and ejecting many passengers, before coming to rest in a farmer’s field, where it immediately burst into flames.
Emergency services rushed to the scene, accompanied by Luxembourg’s Prime Minister; but by the time they arrived, fire had already consumed much of the passenger cabin, killing everyone inside. Ejected passengers lay strewn all over the field; most were dead, but one was found alive and was rushed to the hospital. Three more were pulled from the wreckage, suffering from severe burns; all of these soon succumbed to their injuries. However, the fire spared the cockpit, and after a difficult rescue operation, Captain Claude Poeckes was extracted alive — one of only two survivors out of the 22 on board.
The crash rocked the tiny country, which had never seen such a disaster before. This was the first ever fatal accident for Luxair and by far the deadliest plane crash ever to occur in Luxembourg; in fact, it had been 20 years since the country’s last aircraft accident of any particular magnitude. That meant that this would be the most important inquiry in the history of Luxembourg’s Administration for Technical Investigations (AET), which investigates all types of transportation accidents. In order to fully understand the crash, outside help would be needed.
An initial analysis by experts from several countries revealed that both engines went into reverse just before the plane fell out of the sky. A later, more detailed analysis revealed why. Confusion in the cockpit caused the plane to stray above the glide slope, prompting Captain Poeckes to try to use the ground range selector in order to descend faster. First Officer Arendt had removed the ground idle stop in accordance with the checklist, and a false signal from the anti-skid system removed the secondary stop, allowing Poeckes to move the throttles into the reverse regime accidentally. When he attempted to return to forward thrust, he did so too quickly, causing the engines to get stuck in reverse. After that, the plane rapidly lost lift, rendering recovery impossible. But authorities had known about the possibility of accidental activation of reverse thrust in flight since the 1950s, and regulations existed to prevent it. So how could this have happened?
To understand the regulatory background, investigators examined the history of reverse activation in flight on turboprop aircraft. They found records of accidents and incidents involving inadvertent activation of reverse thrust, some of them fatal, stretching back decades. As a result of some early accidents, authorities in the US and Europe imposed a requirement that turboprop aircraft have some type of lock or stop preventing the throttles from entering the reverse regime, which can only be removed via a “separate and distinct action by the crew.” The design of the Fokker 50 went well beyond this requirement, as it also had a secondary stop that would only open when the plane touched the ground. This had been added after the plane’s original certification due to recurring problems with pilots attempting to use the ground range in flight. (Strangely, despite numerous warnings and placards advising against the use of thrust settings below flight idle while in the air, pilots around the world continued to place the throttles into the ground range in flight in order to obtain increased descent performance.)
But as early as 1988, it became known that electromagnetic interference between the two individual anti-skid units could cause them to send a false “wheels spinning” signal if they powered up within 20 microseconds of each other. This would create a 16-second window where the flight idle stop solenoid would activate and disengage the secondary stop. In 1992, Fokker issued a non-binding service bulletin asking airlines to modify their anti-skid units so that this could not happen. It made the change voluntary because it judged the probability of the fault actually resulting in the activation of reverse thrust to be sufficiently remote that it did not constitute a serious threat to the safety of flight. Although some aircraft did have their anti-skid units sent to Fokker to undergo the modification, the Luxair plane involved in the accident was not among them.
The possibility that the throttles could become stuck in reverse if forward thrust was applied too quickly had also been known for some time. As a result of the 1978 crash of Pacific Western Airlines flight 314 in Cranbrook, British Columbia, in which a 737 attempted a go-around after deployment of the thrust reversers, resulting in a reverser becoming stuck open, Canada required all new aircraft certified in the country to be able to reliably move between reverse thrust and forward thrust in the event that reverse thrust must be cancelled suddenly. The ability to perform the so-called “Cranbrook maneuver” is a requirement unique to Canada. While undergoing the certification process in Canada, Fokker informed Transport Canada that the Fokker 50 would not be able to perform the Cranbrook maneuver, but Transport Canada did not require any modification to the design because the Fokker 50 was based on the type certificate of the Fokker F27, which was designed and certified prior to the introduction of the requirement. Had the plane been able to perform the Cranbrook maneuver, Luxair flight 9642 probably would not have crashed.
The other half of the story of flight 9642 involved human factors. Captain Poeckes had apparently used the strictly prohibited technique of lifting the ground range selectors to reach a slightly lower thrust setting, which he felt he needed to do because the flight had strayed above the glide slope while only a couple minutes short of the runway. There was no procedure for how to re-intercept the glide slope from above after passing the final approach fix, and the prudent thing to do would have been to go around. In fact, Poeckes almost did exactly that — but the updated visibility reading from the controller caused him to change his mind. However, principles of good airmanship hold that once the decision to go around has been made, this decision should not be reversed for any reason. Attempting to return to the glide path destabilized what had hitherto been a stable approach and created opportunities for error. The fact that Arendt removed the ground idle stop a full seven seconds after Poeckes called for a go-around was also suggestive of a breakdown in cockpit communication. Despite his captain’s callout, Arendt appeared to believe that they were continuing the approach, when proper procedures dictated that a go-around had begun and the before approach checklist should be abandoned. This lack of coordination appeared to have originated with the unexpected nature of the approach, which left the pilots confused and unprepared. In hindsight, they should have recognized that they were not ready and rejected the approach clearance, but in the moment, the desire to “get there” all too often overrides good judgment.
In 2003, the AET issued its final report on the crash, recommending that the modification to the Fokker 50’s anti-skid system be made mandatory; that crewmembers be informed of the problem with the anti-skid system until it is fixed; that it be made impossible to deliberately select thrust settings below flight idle while in the air; that Luxair implement a flight safety monitoring program to detect recurring crew errors and bad flying habits; that Luxembourgish authorities monitor Luxair’s training process; and several other changes. As a result of the recommendations, Dutch authorities issued an airworthiness directive mandating that all operators of the Fokker 50 modify their anti-skid systems in accordance with the 1992 service bulletin by the first of May 2004. The European Aviation Safety Agency also updated its requirements for flight idle stop systems to be much more comprehensive. Under the new rules, it must be impossible to deliberately or inadvertently select a thrust setting below flight idle while in flight; the systems preventing this must be sufficiently reliable as to render the possibility of failure “remote;” and a warning must be provided to the crew if these systems do fail. After undergoing the modification to the anti-skid system, the Fokker 50 met this new, strict requirement. And the story should have ended there — but tragically, it didn’t.
On the 10th of February 2004 — fifteen months after the crash of Luxair flight 9642, and two months after the publication of the final report — Kish Air flight 7170 prepared to depart Kish Island, Iran, for a regular international flight to Sharjah in the United Arab Emirates. Kish Air, an Iranian airline based on Kish Island, operated the flight using a Fokker 50 just like the one that crashed in Luxembourg in 2002. 40 passengers and six crew boarded the nearly full flight, which took off at around 11:00 a.m. and proceeded without incident toward Sharjah. The plane was scheduled to undergo the modification to its anti-skid system soon, but the deadline had not yet arrived, and the work had not been done.
As flight 7170 neared Sharjah, the captain attempted to delegate the approach to the first officer, who resisted this offer because he was not confident in his ability to conduct the approach. Eventually he gave in, and he flew the approach to Sharjah while the captain offered advice. However, the first officer struggled to maintain an appropriate airspeed and descent rate, and soon it became clear that the approach was too fast. In order to salvage the approach, the captain reclaimed control and attempted to return to the glide slope. At an altitude of about 1,000 feet, the crew lowered the landing gear; they were unaware that due to the fault with the anti-skid units, the secondary stop had been deactivated. Fourteen seconds after lowering the landing gear, the captain lifted the ground range selector and attempted to reduce thrust all the way to the secondary stop to increase their descent rate. But because the stop was not in place, he accidentally decreased thrust to ground idle instead, putting the throttles into the beta range. Forward speed dropped, drag increased sharply, a loud noise filled the cockpit, and the plane pitched steeply downward. The captain immediately pushed the throttles back to forward thrust, but just like on Luxair flight 9642, the transition was too quick; while the right engine managed to return to the forward thrust regime, the counterweights in the left propeller pulled its blade pitch in the wrong direction, putting the engine into reverse. Flight 7170 spiraled out of the sky and slammed into an area of bare earth inside a housing development, where it broke apart and burst into flames. Witnesses managed to drag four survivors out of the burning plane, but the rest of the occupants perished in the crash and the fire that followed. One of the survivors also died on the way to the hospital, bringing the final death toll to 43.
The crash of Kish Air flight 7170 was a virtual carbon copy of Luxair flight 9642, and would doubtlessly have been prevented if the modifications to the anti-skid system had been made earlier. The deadline of the first of May 2004 was reasonable, but unfortunately it did not arrive in time to save those who died at Sharjah. Investigators were deeply frustrated that even after all that had happened, pilots were still using the ground range selectors in flight, and that Fokker 50s with unmodified skid control units were still flying passengers. The Kish Air crash was completely preventable; those 43 people did not have to die.
By May of that year, the rest of the Fokker 50 fleet received the upgrade as scheduled, and no more repeat accidents involving this aircraft type have occurred since. But similar crashes involving other types of turboprops continued to happen. Most significantly, on the 12th of October 2011, Airlines PNG flight 1600, a de Havilland Canada DHC-8, crashed in Papua New Guinea after the pilots accidentally applied reverse thrust in flight. 28 of the 32 people on board were killed. The DHC-8 involved in the accident had far less protection against inadvertent application of reverse thrust than the Fokker 50 did. Instead of two stops, the DHC-8 had only one, which the pilots could deactivate using a switch. While reducing power in an attempt to correct a high approach speed, the first officer accidentally pressed the flight idle gate switches, allowing the engines to enter the reverse regime; aerodynamic forces then caused the propellers to overspeed, destroying both engines.
In order to comply with European and North American regulations, operators of the DHC-8 could install a device called a beta lockout which would physically prevent entry into the beta range while in flight, but in countries like Papua New Guinea that had not adopted the updated rules, this device was sold as an optional extra. Needless to say, Airlines PNG had not installed it. As a result of the accident, Transport Canada issued an airworthiness directive mandating the device on all DHC-8s. Still, other aircraft types without protections remained: for example, in 2013, 25 people were injured when Merpati Nusantara Airlines flight 6517, a Chinese-made Xian MA60, crash landed on the runway in Kupang, Indonesia, after the pilots accidentally selected reverse thrust shortly before touchdown.
Today, almost all large turboprop aircraft have effective systems to prevent the accidental or deliberate activation of reverse thrust in flight, and no accidents of this type have occurred since the 2013 Merpati Nusantara crash. But the lesson of all of these crashes remains important: that manufacturers must never take it for granted that pilots will stick to standard operating procedures. It took decades to eradicate the practice of deliberately lifting the ground range selector in flight, despite the risk. What other techniques that seem obviously dangerous might actually be in widespread use? The realization that humans are difficult to control should prompt manufacturers to consider ways to prevent pilots from making inputs that have no practical use in any normal or abnormal situation and which could lead to a crash. How much a pilot’s control authority should be limited is a topic of intense debate in the aviation industry, but the story of Luxair flight 9642 and the accidents that followed it should serve as an example of a place where a little less pilot authority could have saved lives. It’s hard to argue that the ability to engage reverse thrust in flight has any benefit, and the fact that many planes initially did not prevent the pilots from doing this represented a fatal lack of imagination on the part of the manufacturers. Why would any pilot ever attempt something so dangerous? Well, as they say, life finds a way.
_____________________________________________________________
Join the discussion of this article on Reddit!
Visit r/admiralcloudberg to read over 140 similar articles.
You can also support me on Patreon.
