This section's line that every height-critical automation trusts the radio altimeter is the whole story of a Boeing 737 arriving at Amsterdam on 25 February 2009. Its left radio altimeter was reporting a height of minus 8 feet while the aircraft was still descending on the ILS, and the system treated the value as usable. The autothrottle, which takes its height from that side, did what it does in the last feet before touchdown: it entered the retard flare mode and pulled both engines back to idle, high on the approach, with the only sign a small RETARD annunciation on the primary flight displays.
The crew had been lined up by air traffic control at 5.5 NM and 2,000 ft, so the glideslope had to be captured from above, which loaded them with extra procedures, pushed the landing checklist late, and hid the fact that the thrust had gone to idle and stayed there. The right autopilot, working from the healthy right radio altimeter, flew the glideslope faithfully; as the speed bled away the nose rose to hold it. Passing 1,000 ft the approach was not stabilised and the airline's own procedure required a go-around, which was not flown. The stick shaker fired at 460 ft. The first officer pushed forward and the levers went forward, but reaching full thrust took nine seconds, the recovery was not completed correctly, and the aircraft stalled into a field 1.5 km short of the runway. Nine of the 135 aboard died, including all three pilots, and 120 were injured.
The Dutch Safety Board's conclusions ran upstream of the cockpit: radio altimeter faults on the 737-800 had troubled several airlines for years and were known to the manufacturer and the regulator, but had been treated as a technical nuisance rather than a flight-safety hazard, so pilots were never told; certified autothrottle software versions responded differently to a bad radio height, and the comparator that checks the two altimeters against each other had never been made mandatory. The crew, the report said, had no way of understanding the significance of what they saw. For this section the point is precise — the radio altimeter's trustworthiness is exactly why a wrong value from it is dangerous, because the systems built on it do not ask twice.