Atlas Air Flight 3591

Date

23 February 2019

Phase of flight

Descent

Location

Trinity Bay, about 41 miles east-southeast of George Bush Intercontinental/Houston Airport, Texas, United States

Aircraft

Boeing 767-375BCF (converted freighter)

Registration

N1217A

Operator

Atlas Air, Inc., operating for Amazon.com Services LLC

Flight

Atlas Air 3591

Occupants

3

Fatalities

3The captain, the first officer and a non-revenue pilot riding in the jumpseat

Investigating body

National Transportation Safety Board (United States)

Final report

NTSB/AAR-20/02

Report date

14 July 2020

Report title

Rapid Descent and Crash into Water, Atlas Air Inc. Flight 3591, Boeing 767-375BCF, N1217A, Trinity Bay, Texas, February 23, 2019

On 23 February 2019 Atlas Air flight 3591, a Boeing 767-375BCF freighter flying for Amazon from Miami to Houston, descended rapidly from about 6,000 ft and struck a shallow, muddy marsh in Trinity Bay, Texas, about 41 miles east-southeast of George Bush Intercontinental/Houston Airport. The captain, the first officer and a non-revenue pilot riding in the jumpseat were killed, and the aeroplane was destroyed.

No mechanical fault played a part. The National Transportation Safety Board (NTSB) found that the go-around mode engaged by accident during a routine descent, that the first officer, who was flying, answered it with nose-down inputs driven by a false sensation of pitching up, and that the captain did not take control in time. Only 32 seconds passed between the mode change and the impact.

The accident is studied for three reasons: it shows how a benign automation surprise can become a loss of control within seconds, how compelling a somatogravic illusion can be in cloud, and how much depends on the pilot monitoring and on a clear transfer of control. The NTSB also looked well beyond the cockpit, at how airlines select pilots and share their training records.

The flight

Atlas Air operated the flight under Part 121 as a domestic cargo service for Amazon.com Services LLC, on an instrument flight rules flight plan. The aircraft, N1217A, had been built in 1992 as a passenger 767 and converted to a freighter in 2017. It had two General Electric CF6-80C2B6F engines, no open minimum equipment list items, and a take-off weight of 249,519 lb, within weight and centre of gravity limits. The report gives times in central standard time (local time); the flight left Miami at about 1033.

The captain, aged 60, had about 11,172 hours, of which 1,252 were on the 767; he had been upgraded to captain on the type in August 2018. The first officer, aged 44, had about 5,073 hours, including 520 hours as second in command on the 767, and had joined Atlas in July 2017. The first officer was pilot flying and the captain pilot monitoring. The autopilot and autothrottle were engaged and stayed engaged until the end of the flight.

A cold front lay between the aeroplane and Houston. Weather radar showed a "fine line" marking its leading edge, and at the moment the go-around mode engaged the aeroplane's position coincided with that line. The NTSB judged that windshear and, as the flight continued, instrument meteorological conditions were likely there. Cloud bases behind the front were generally between 2,000 and 3,000 ft above ground level.

The accident

The departure, cruise and initial descent were uneventful. At 1230:37, descending through about 17,800 ft, the captain checked in with Houston approach. At about 1236 the first officer briefly handed control to the captain after a display anomaly, which he cleared by cycling the electronic flight instrument (EFI) switch; he took control back at 1237:24. The controller asked the crew to "hustle all the way down" to 3,000 ft so that the flight would pass beneath departing traffic. The speedbrakes were extended, the slats lowered (the "flaps 1" setting), 3,000 ft was set on the mode control panel, and the crew began setting up the flight management computer for the approach.

The wreckage was highly fragmented and spread over a main debris field of about 12.3 acres, much of it buried in soft mud. More than 90 % was recovered in almost seven weeks. There was no evidence of any failure before impact, and continuity checks of all six microswitch contacts of the two go-around switches found nothing abnormal. The terrain awareness and warning system gave no alert: a manufacturer's simulation showed that its logic briefly rejected the radio altitude values, and that the recording ended before an alert would have been issued.

The investigation

How the go-around mode engaged

On the 767 the go-around switches sit on the outboard underside of each thrust lever, and the speedbrake lever lies just to the left of the thrust levers. Atlas procedures told the pilot flying to keep a hand on the speedbrake lever while the speedbrakes were extended, as a reminder to stow them at level-off. In a simulator, investigators found that a right-seat pilot holding the lever this way has his left hand and wrist under the thrust levers, close to the left go-around switch, and that a wristwatch reduces the clearance further.

The location and phase of flight ruled out a deliberate go-around, and no one called one. Presuming that the first officer was holding the speedbrake lever as expected, the NTSB concluded that his left wrist or watch probably contacted the left switch when the turbulence moved his arm. It is not known whether he was wearing a watch on the accident flight. Boeing, Atlas, another airline and NASA's Aviation Safety Reporting System had no record of a similar event on the 767, although the reporting system held 11 inadvertent go-around activations on other types between 1990 and 2017.

In the aeroplane's configuration the go-around mode commanded a climb of at least 2,000 ft per minute and advanced the thrust. A key systems point is that on N1217A manual inputs could override the automation without disconnecting it. Column forces above 25 lb overrode the autopilot, and the autothrottle could also be overridden by hand. A force of about 70 lb on one column made the left and right elevators move independently, each following its own pilot's column.

Why neither pilot saw the mode change

The flight mode annunciators showed "GA/GA/GA/CMD" and the engine display showed "GA", while the altimeter read about 6,300 ft instead of the 3,000 ft at which the crew expected thrust to increase. Neither pilot acknowledged the mode change or disconnected the automation, which was the expected Atlas response to unwanted automatic operation. The captain was probably head-down on the flight management computer and talking to air traffic control. The thrust levers took about 7 seconds to travel about 50°, and the engines took about 11 seconds to reach go-around thrust, a change gradual enough that it may not have caught his attention.

The somatogravic illusion

The otolith organs of the inner ear sense the combined effect of gravity and linear acceleration and cannot tell the two apart. When an aeroplane accelerates, the resultant gravito-inertial force swings aft, exactly as it would if the head were tilted back, so the pilot feels a nose-up attitude that does not exist. The illusion is strongest when there is no outside horizon.

The first officer's nose-down inputs began as go-around thrust and the stowing of the speedbrakes accelerated the aeroplane; longitudinal acceleration peaked at 0.27 g at 1238:42. As the nose dropped, vertical acceleration fell and the force vector swung further aft, probably strengthening the pitch-up sensation and possibly adding a sensation of tumbling backwards. The NTSB concluded that he "likely experienced a pitch-up somatogravic illusion" that prompted him to push.

His "stall" callouts had no basis in the data: the vane angle of attack was below minus 15° and the airspeed above 250 kt, and the stick shaker never activated. Even a real stall recovery begins with assessing the cues and disconnecting the automation, not with a steep nose-down push. The investigation found that his attention was absorbed by the false sensations and that he was not effectively scanning his instruments.

The first officer's training history

The NTSB found that startle, stress and sensory illusions can degrade any pilot's performance, but that this first officer "had fundamental weaknesses in his flying aptitude and stress response". Instructors and check airmen at several airlines described low situational awareness, overcontrolling and impulsive reactions to unexpected events. He had failed his 767 type rating check at Atlas in September 2017 and passed after remedial training. He had not disclosed some earlier training difficulties to Atlas, and Atlas' records review, which relied on designated agents, did not flag his unsuccessful attempt to upgrade to captain at his previous employer. The NTSB found that the pilot records database required by the Airline Safety and Federal Aviation Administration Extension Act of 2010 would, had it been in place, have given employers that information.

The captain's response

The captain took hold of his control column about 15 seconds after the mode change and pulled, but he did not call "I have control", as Atlas procedures required. For about 10 seconds the two pilots applied opposing forces, the elevators split, and the dive steepened. Neither pilot ever disconnected the autopilot or autothrottle. The aeroplane probably left cloud at about 3,000 ft; both elevators then went to full nose-up, but by then the situation was unrecoverable. The NTSB attributed the captain's degraded performance to "the ambiguity, high stress, and short timeframe of the situation."

The investigation found that the pilots' certification and qualifications, air traffic control services, the aeroplane's condition and maintenance, and its weight and balance were not factors. There was insufficient information to determine whether fatigue played a part.

Probable cause and contributing factors

The NTSB determined that the probable cause was "the inappropriate response by the first officer as the pilot flying to an inadvertent activation of the go-around mode, which led to his spatial disorientation and nose-down control inputs that placed the airplane in a steep descent from which the crew did not recover."

It listed three contributing factors:

• the captain's failure to adequately monitor the flight path and to assume positive control of the aeroplane to intervene effectively;
• systemic deficiencies in the aviation industry's selection and performance measurement practices, which failed to address the first officer's aptitude-related deficiencies and maladaptive stress response;
• the Federal Aviation Administration's failure to implement the pilot records database in a sufficiently robust and timely manner.

Safety recommendations and what changed

The report was adopted on 14 July 2020. The NTSB made six new recommendations to the FAA:

It also reiterated earlier recommendations, classified "Open—Unacceptable Response", on obtaining notices of disapproval for pilot applicants and on keeping and sharing detailed training records (A-05-1, A-10-17, A-10-19 and A-10-20), and it reiterated A-15-7 and A-15-8 on crash-protected cockpit image recorders. After the accident Atlas added a credibility-focused telephone interview and a logbook review to its hiring process, had a member of the flight operations team review each candidate's records, and wrote a standard operating procedure dedicated to pilot hiring.

Lessons for pilots

Know how your automation reacts to your hands. On this 767, pushing on the column overrode the autopilot but did not disconnect it, so the autopilot, the pilot and eventually the other pilot were all acting on the elevators at once. Learn, for your own type, which inputs disconnect and which merely override the autopilot and autothrust. When the automation does something you did not ask for, the standard response is to disconnect it and fly the aeroplane, as covered in flight deck automation.

Read the flight mode annunciator after every change. "GA" was annunciated on the flight mode annunciator and on the engine display, and the altimeter read about 6,300 ft, not the 3,000 ft at which the crew expected to level off. A disciplined scan, and calling out every mode change, gives the crew the chance to catch such a problem within seconds.

Confirm a stall before treating it. Stall recovery is driven by angle of attack cues: stick shaker, warnings, a high nose, low and decaying speed. None were present here. A dive with rising speed calls for the opposite response, recovering from a nose-low attitude as taught in upset prevention and recovery training.

One pilot flies, and control changes hands out loud. The captain's pull without "I have control" left the two pilots applying opposing forces through a split elevator for about 10 seconds. The pilot monitoring's first job is to monitor, and FMC programming or radio work should not leave the flight path unwatched during a descent with a level-off approaching. When the monitoring pilot has to intervene, a clear, acknowledged transfer of control is part of crew resource management, not a formality.

Selection and training records matter. The investigation showed that repeated training difficulties, spread across several employers and not fully disclosed, were never seen as a whole by the airline that hired him. For pilots this is a reminder that honest records and early remedial training protect everyone on the flight deck; for training captains, that concerns should be written down clearly.

Crash Investigations pages summarise official investigation reports for study and exam preparation. The investigating body's report is the authoritative account and prevails wherever it differs from this page. Under ICAO Annex 13, an investigation exists to prevent accidents, not to apportion blame or liability.