1

CAST Analysis of TK1951 Crash near Schiphol Airport

Nicole Gagnier

Basic Events Surrounding the Accident

A Boeing 737-800, Turkish Airlines flight 1951, departed Istanbul Ataturk
Airport in Turkey on 25 February 2009 with three pilots, four cabin crew and 128
passengers. During approach to Amsterdam Schiphol Airport runway 18 right
(18R), the aircraft crashed into a field about 1.5 kilometers from the runway killing
four crew (including all three pilots) and five passengers. Three crew members and
117 passengers additionally sustained injuries.

The proximal events surrounding the crash of TK1951 are as follows:

(8.23) TK1951 departs Istanbul Ataturk Airport with three pilots, four cabin crew
and 128 passengers. The first officer was in training for the specific flight route so
the captain also acted as instructor. The third pilot acted as the safety pilot and was
tasked with observing the flight. The flight operated a Boeing 737-800.
Shortly after takeoff, the left radio altimeter fails. The crew has the right autopilot
engaged at this time and thus the system used the right hand radio altimeter system.
The autothrottle continues to use the left radio altimeter reading as per design.

(10.15:02) Initial contact with the Schiphol ATC is made. Aircraft is descending at a
speed of 270 knots. Schiphol ATC instructs TK1951 to make an instrument landing
approach on Runway 18R. An audio warning regarding the landing gear is heard on
the Flight Data Recorder for 1.5 minutes and the captain remarks radio altimeter.

(10.17:11) Landing gear audio warning activates again for 1.5 minutes and captain
comments landing gear. FDR indicates that the faulty altimeter reading of -8ft is
displayed on the primary flight displays at this time.

(10.22:38) ATC instructs the crew to maintain an altitude of 2000ft and a heading of
210 which would result in interception of the localizer signal of the instrument
landing system at 5.5 NM from the runway threshold. Consequently the approach
required that the glide path be intercepted from above. At the time of the accident,
visibility was 4500 meters. There were some clouds at 700ft, heavy clouds at 800ft,
and the sky was overcast from 1000 to 2500ft. The landing gear alarm sounds again
at 10.23:34.

(10.24:09) The captain announces that the localizer signal of the instrument landing
system has been intercepted but the aircraft is still at 2000 feet and must descend to
reach the glide path. Approach mode of the flight control computer had been
activated. The flight crew selects vertical speed mode for the vertical flight path
with a descend speed of 1400ft/min to approach the glide path from above. As a
2
result the autothrottle switched to Retard Flare mode (only activated in the final
phase of landing below 27 feet) after all the necessary preconditions are met due to
the faulty reading from the left radio altimeter. The thrust settings are
automatically adjusted to idle. The primary flight displays showed the indicator
RETARD to signify this setting. The fight crew did not recognize this warning.

(10.24:24) Safety pilot remarks the aircraft has a radio altimeter failure. Captain
confirms.

(10.24:48) The captain receives landing clearance from the Schiphol ATC. The
aircraft reaches 1000ft but the flight crew has yet to stabilize the approach
(complete the landing checklist) but does not perform a go around (standard
procedure if the approach has not yet been stabilized by 1000 ft).

(10.25:23) The airspeed drops below the selected speed of 144 knots at an altitude
of approximately 750ft. The aircraft passes a height of 500ft and the approach is not
stabilized but the flight crew continues with the approach. When the airspeed
reaches 126 knots, the frame of the airspeed indicator begins to flash and change
color. The artificial horizon indicates the nose of the aircraft was pitching
excessively high. The flight crew does not notice these warnings.

(10:25.47) The stick shaker activates at an altitude of 460ft, warning of the
impending stall. Immediately after the stick shaker activates, the first officer pushes
the control column forward and pushed the throttle levers forward (standard stall
procedure). The captain, however, responds by taking over control from the first
officer. At this point, the autothrottle had not yet disengaged and since the first
officers commands were interrupted, the autothrottle pulled the throttle back to the
retard flare setting.

(10.25:50) The autothrottle is disengaged and the captain has control but no thrust
setting is selected.

(10.25:56) Nine seconds after the stick shaker activated and at an altitude of 350ft,
the captain has pushed the throttle levers fully forward. At this point, the stall is
unrecoverable.

(10.25:57) Various warnings sound due to sink rate and stall. Immediately after, the
aircraft crashes in a field about 1.5km from the runway threshold resulting in the
death of all three pilots and five passengers and injuries to three crew and 117
passengers. The aircraft is destroyed.


Ultimately, the accident was the crash of the TK1951 aircraft resulting in a loss of
the aircraft as well as nine deaths and 120 injuries. The system hazard
corresponding to this accident is death, injury, and/or equipment loss due to
incorrect thrust settings for given flight conditions. The related system safety
3
constraint is that the safety control structure (outlined below) must maintain
appropriate thrust settings at all times in order to avoid risk of death, injury, or loss.
In addition, the safety control structure must minimize the effect of disturbances
that may interrupt proper operation and selection of thrust settings and induce risk.

Safety Control Structure

Based on the accident report published by the Dutch Safety Board, the
diagram below shows the controls in place related to this accident. Not all of the
controls functioned effectively as is discussed in the analysis of each component.



Figure 1. Basic Safety Control Structure Related to TK1951

4
Physical Process Analysis

The Boeing 737-800 is equipped with many instruments and features
designed to aid pilots in controlling the aircraft. The systems particularly important
to this accident include the radio altimeters, the Autopilot Flight Director System
(AFDS), the Instrument Landing System (ILS), and various warning and display
systems.
The radio altimeter system is made up of two independent systems, left and
right. The radio altimeter uses radio signals to determine altitude when the
measured height is 2500ft or less. The left radio altimeter reading is displayed on
the left primary flight display while the right radio altimeter reading is displayed on
the right primary flight display. The left radio altimeter failed on TK1951 shortly
after takeoff.
The Autopilot Flight Director System (AFDS) is used to fly the aircraft
automatically and consists of two flight control computers and a computer for the
automatic thrust control (autothrottle). One flight control computer corresponds to
the captains systems on the left side of the cockpit while the other corresponds to
the first officers systems on the right. Only one system is engaged when in use
during flight and is often used on most commercial flights. The crew enters
selections for modes (heading, altitude, speed, and other commands) and these
selections are displayed on the primary flight displays. The right and left autopilot
systems use the right and left radio altimeters, respectively but the autothrottle
primarily uses the left radio altimeter, only switching to the right altimeter if a faulty
reading is detected (at which time a warning is displayed on the primary flight
displays). The system on TK1951 did not detect the faulty altimeter reading. The
AFDS automatically switched into Retard Flare mode, a mode in which thrust levels
are set to idle and the noes pitches up for when the aircraft is in the final phases of
landing below 27ft. The primary flight displays displayed RETARD to signify this
setting.


Figure 2. Schematic for Autothrottle and Autopilot Systems




5
In addition to displaying the flight mode, the primary flight displays show
many other useful values such as airspeed, rate of descent or climb, pressure
altitude, radio height, heading, and flight path information as well as the artificial
horizon (shows the attitude of the aircraft compared to the horizon). Both the
captain and the first officer have a primary flight display.



Figure 3. Primary Flight Display Layout


The Instrument Landing System (ILS) is a radio navigation system used for
runway approach. Schiphol ATC instructed TK1951 to use the ILS for landing on
runway 18R. The system utilizes a radio localizer signal and glide slope beacons to
provide the pilot with precise information regarding the runway location and glide
path.
The Boeing 737-800 is also equipped with many other warning systems in
addition to the indications given on the primary flight displays. The landing gear
configuration warning system emits an audio signal when a landing attempt is being
made without the landing gear down and locked. The stall warning system, known
as the stick shaker, vibrates the control columns warning of the impending stall.
The above physical systems are a few of the many physical controls and
safety related equipment on the 737-800. The major failures of the system were the
failure of the left radio altimeter to provide an accurate altitude reading and the
failure of the AFDS to recognize the faulty reading and adjust flight control
accordingly. In addition, since the pilots did not effectively recognize the hazardous
conditions in a timely manner, so the warning systems did not satisfy their
requirements. See the chart below for an outline of the physical system.
6

Physical Controls and Safety Related Equipment







Requirements (roles/responsibilities): Provide physical protection from death,
injury, or equipment loss.
1. Provide accurate feedback and assistance to the operators regarding the state of
the aircraft.
2. Recognize inaccurate or faulty instrumentation readings and switch to back up
or secondary devices when necessary.
3. Maintain the aircraft in a safe state while in the autopilot operational mode.
4. Provide adequate indicators and warnings to alert operators of the existence of
hazardous conditions.
5. Provide methods for safe evacuation and communication with emergency crews
in case of crash.

Emergency and Safety Equipment (controls): Only those relevant to TK1951 are
listed.
Radio altimeter system
Autopilot Flight Director System (AFDS: autothrottle, right autopilot, and left
autopilot)
Instrument Landing System (ILS)
Stall warning system (stick shaker)
Landing gear configuration warning system
Primary flight displays and artificial horizon

Failures and Inadequate controls: (the links below refer to the requirements
above)
Left radio altimeter fails ( 1)
Autothrottle utilizes faulty altimeter reading ( 2)
Autothrottle selects incorrect thrust setting for given flight conditions ( 3)
Indicators were not strong to alert pilots to hazardous conditions in a timely
manner ( 4)

Physical Contextual Factors:
Past incidents with radio altimeters not reported by pilots at TA and at other
various airlines. Many incidents occurred but few were reported to the
manufacturer, Boeing. An appropriate solution had yet to be found.
AFDS designed to use the right radio altimeter when the right autopilot is in use
(similarly use the left altimeter when the left autopilot is in use) but the
autothrottle still uses the left radio altimeter as the primary signal when in right
autopilot mode.
7
Safety Control Structure Analysis

The following sections analyze the individual components of the safety
control structure presented on page 3.
Pilots

Safety-Related Responsibilities:
Perform appropriate control actions to minimize hazards to the aircraft and
passengers.
Respond appropriately to emergencies and hazardous conditions
Instruct and inform the passengers and crew on emergency actions when
necessary.
Report incorrectly functioning equipment.

Context:
ATC routinely instructed pilots to execute a short approach that is not
recommended by ICAO standards. ATC instructed TK1951 to do the same
requiring the aircraft to intercept the glide slope from above.
First officer was in training called line flying under supervision so the captain
acted as an instructor on top of his other duties. A third pilot, the safety pilot,
accompanies the captain and first officer to monitor the sate of the aircraft and
provide warnings if the crew is distracted.
Other pilots had rarely reported incidents with faulty altimeters. Due to the small
number of incidents reported, Boeing did not include procedures for response to
a faulty altimeter during flight (only before flight in the Dispatch Deviation
Guide).

Control actions related to the loss:
Captain:
Did not execute a go around when the approach was not stabilized by 1000ft or
500ft.
Did not recognize warnings and indicators regarding the unsafe state of the
aircraft when the Retard Flare setting engaged.
Took over control after the stick shaker activated reengaging the autothrottle and
cancelling the first officers thrust selection.
Did not respond to the safety pilots warning about the faulty altimeter reading.

First Officer:
Did not recognize warnings and indicators regarding the unsafe state of the
aircraft when the Retard Flare setting engaged.
Did not respond to the safety pilots warning about the faulty altimeter reading.

Safety Pilot:
Did not recognize warnings and indicators regarding the unsafe state of the
aircraft when the Retard Flare setting engaged.
Distracted by landing checklist and thus did not perform safety monitoring duties
effectively.
8

The pilots often are subject to the majority of the blame in accidents since
they are almost always the most direct link to the physical system state at the time
of the crash. The pilots are responsible for minimizing hazards to the state of the
aircraft and passengers as well as for responding to emergencies if necessary. The
TK1951 flight had a total of three pilots due to the fact that the first officer was in a
process known as line flying under supervision in which the captain acts as an
instructor and helps teach the first officer about certain flight routes and certain
airports. The trainee has usually just completed the training for the specific model
of aircraft he is flying. While line flying under supervision, a third pilot, known as
the safety pilot, accompanies the captain and first officer and is responsible for
notifying the crew of any important warnings or relevant flight conditions should
they not notice.
One of the most prominent failures in control by the pilots was the failure to
execute a go around at 1000ft and 500ft, the altitudes at which a go around should
be executed if the approach has not been stabilized in bad visibility and poor
visibility, respectively. This placed extra pressure on the pilots to perform multiple
duties in a short period of time. The process model flaws for this choice could
include the fact that short approaches were routine procedure at the Schiphol
airport (described below) or that Turkish Airlines did not provide adequate training
or monitoring to ensure that pilots complied with these standards. In addition, the
increased pressure on the pilots due to the un-stabilized landing and the short
approach may have contributed to why the crew did not realize many of the

Process Model Flaws:
Pilot:
Believed the routine short approach and interception of glide slope from above was safe
and common practice.
Believed the autothrottle and autopilot systems were functioning properly.
Did not know the aircraft was migrating towards higher risk since he did not recognize the
warnings and indicators (presumably due to distraction by the landing checklist).
Did not know proper procedure to respond to radio altimeter failure in flight.
Believed that taking over control was the best decision for the safety of the aircraft.

First Officer
Believed the autothrottle and autopilot systems were functioning properly.
Did not know the aircraft was migrating towards higher risk since he did not recognize the
warnings and indicators (presumably due to distraction by the landing checklist).
Did not know proper procedure to respond to radio altimeter failure in flight.

Safety Pilot:
Believed the autothrottle and autopilot systems were functioning properly.
Did not know the aircraft was migrating towards higher risk since he did not recognize the
warnings and indicators (presumably due to distraction by the landing checklist).
Did not know proper procedure to respond to radio altimeter failure in flight.


9
indications and warnings that showed the aircraft migrating into a more and more
hazardous state before the stall (despite the presence of the safety pilot). It is
possible that the manufacturer or Turkish Airlines could provide better training to
help recognize such states faster.
As heard on the flight data recorder, the safety pilot did notice the faulty
altimeter readings and notified the captain and first officer but neither man took
action to investigate the problem and find a solution. The manufacturer did not
provide any information regarding procedure in such an event so the flight crew did
not have much to work with to develop their mental models. The flight crew was
also very busy with the un-stabilized approach and so most likely did not have much
time to try to investigate and understand the system interactions.
Finally, after the stick shaker activated, the captain took over control from
the first officer who had already adjusted control appropriately to recover from the
stall. In doing so, the captain negated the first officers selections and delayed the
selection of the appropriate settings by seconds, crucial time in recovering from a
stall. There was not enough information to determine whether or not this was
standard practice (that the captain always take over control) but it is now obvious
in this case that this procure may not have been the best choice. It is necessary to
have more information regarding pilot training for stall and emergencies in order to
better analyze the systemic factors.
Although the pilots did fail to adequately perform all appropriate control
responsibilities, it is evident that many of these choices have underlying systemic
factors that will be analyzed in the coming sections.

10
Turkish Technic (Turkish Airlines Maintenance):


Turkish Technic is a subsidiary of Turkish airlines and is responsible for the
maintenance of Turkish Airlines aircraft. Since the manufacturer did not provide a
mechanical fix to the altimeter issue, Turkish Technic did not have much impact on
the safety control structure related to this accident. The maintenance crews,
though, should communicate with the flight crews and ensure that all incidents are
accurately reported and documented. As stated before, incidents were not always
reported since crews were unable to reproduce the problem or thought it was a
minor issue. Turkish Technic explored many options to help prevent corrosion in
the radio altimeter systems since they believed this was a contributing factor to the
faulty readings.
Safety-Related Responsibilities:
Collect incident reports from flight crews regarding issues with equipment.
Perform necessary or prescribed fixes for broken equipment.
Maintain equipment and assure routine checks are done for safety over the
operational life of the aircraft.
Inform manufacturer of safety incidents and failures.
Update maintenance procedures when necessary.

Context:
Incidents with radio altimeters were often irregular and difficult to reproduce.
Few pilots followed through on reports regarding faulty altimeters.
Airline management and company culture did not effectively communicate the
importance of reporting all incidents.
Boeing did not deem the faulty radio altimeters to be a safety issue so no
maintenance procedures or fixes were issued.

Control actions related to the loss
Did not ensure that all incidents of altimeter failure were reported.

Process Model Flaws:
Did not believe that all incidents of altimeter failure were serious enough to report.

11
Schiphol Air Traffic Control:


The Schiphol ATC works under the jurisdiction of ATC the Netherlands. The
Schiphol ATC is obliged to comply with the regulations imposed by ATC the
Netherlands, which are generally informed by ICAO standards. The Schiphol ATC,
however, routinely did not comply with these regulations at the time of the accident.
The regulations state that a short approach may be offered to pilots if they also
receive instructions that require them to intercept the glide path from below. This
regulation does not necessarily coincide with ICAO standards, as well, since ICAO
standards require that the aircraft be oriented in a horizontal position when the
glide path is intercepted and the above regulation allowed for deviations from this
requirement. In the case of TK1951, the Schiphol ATC instructed the pilots to make
an approach that required them to intercept the glide path from above and not
while oriented horizontally so the regulations were violated and the aircraft was
Safety-Related Responsibilities:
Ensure that aircraft within Dutch airspace remain a safe distance away from one
another at all times.
Provide clearances for approach and landing and appropriate flight paths for such
maneuvers.
Ensure the pilots receive approach and landing instructions that minimize exposure
to hazardous conditions.
Communicate any hazardous conditions or risks to pilots when necessary.

Context:
ICAO standards require that an aircraft must be flying horizontally on final approach
track before the glide path is intercepted.
ATC at Schiphol airport often instructed pilots to make a short approach when
landing on runway 18R. The approach is not inherently unsafe but the pilots must be
aware of the short approach and ATC must instruct the pilots to descend below
2000ft in order to intercept the glide slope from below and thus fulfill the above
ICAO standard.
ATC at Schiphol airport often instructed pilots to make short approaches with
headings that required the aircraft to intercept the glide slope from above.

Control actions related to the loss
Instructed TK1951 pilots to make an approach that required the aircraft to intercept
the glide slope from above (at a distance of 5.5NM from the runway threshold)
placing the aircraft in a higher risk situation.

Process Model Flaws:
Believed the approach instructions given to the pilots were safe and standard
practice and complied with regulations (not adequately communicated by upper
level management).

12
placed in a state of higher risk. While the Schiphol ATC are in part at fault for giving
such instructions, ATC the Netherlands did not properly oversee such behavior and
correct it. In addition, the regulations imposed by ATC the Netherlands were not in
accordance with ICAO so even if the Schiphol ATC followed the Rules and
Instructions Air Traffic Control (regulations document published by ATC the
Netherlands) meticulously, they would still be in violation of ICAO standards. This
is clearly a systems issue.

13
Turkish Airlines (Management):


The Turkish Airlines management organization is closely linked with the
safety control structure related to TK1951. Ultimately, the airline is responsible for
the safety and efficiency of all of its flights. The management can have a substantial
influence on company culture and common practices, which tie it to many of the
systemic flaws that contributed to this accident.
Safety-Related Responsibilities (Related to TK1951):
Ensure that Turkish Airlines flights arrive safely and in a timely manner to their
destinations.
Oversee the operations of Turkish Technic (maintenance) and perform audits.
Ensure that all accidents, incidents, and near-misses are reported and addressed.
Ensure that airline operations are in accordance with JAA regulations and guidelines.
Communicate with manufacturer regarding operational issues with aircraft.
Establish pilot training programs including those for emergency situations and
regularly audit and retrain pilots.

Context:
Incidents with radio altimeters were often irregular and difficult to reproduce.
Boeing did not believe the radio altimeter incidents were safety issues and thus did
not provide a solution for in flight failures for airlines to implement into their
procedures.

Control actions related to the loss
Did not ensure that all incidents of altimeter failure were reported by instilling a
company culture that emphasized the importance of reporting every incident.
Did not address a proper radio altimeter solution (either mechanical fix, procedure
update, or both) in response to failure in flight (not just before takeoff).
Did not effectively train pilots to perform a go around if the approach is not
stabilized by 1000ft.
Did not effectively train pilots on the operations of the autothrottle and autopilot in
case of radio altimeter failure.
Did not effectively train pilots to recognize warnings related to the hazardous
conditions the plane was experiencing after the altimeter failure.
Did not properly train pilots on duties regarding line flying under supervision as the
safety pilot became distracted from his primary duty of monitoring the state of the
flight.

Process Model Flaws:
Did not know the full scope of the radio altimeter incidents due to lack of reporting.
Believed the warnings were sufficient for the pilots to recognize the stall and recover
in time.
Did not fully understand the impact of radio altimeter failure on autopilot and
autothrottle systems.


14
One of the primary flaws in the control structure was the lack of
documentation of incidents with faulty altimeters. This lack of documentation led to
a limited scope of the incidents provided to the manufacturer and aviation
authorities. Turkish Airlines did not report all of the incidents experienced on their
flights for various reasons. The management failed to instill a company attitude that
reporting all incidents was necessary to ensure the proper evaluation and
investigation into safety related matters. Consequently, Turkish Airlines was not
able to provide a solution to Turkish Technic or the Turkish Airlines pilots since the
manufacturer did not have enough reports of the incident to consider it a safety
issue (see below).
The training and monitoring of Turkish Airlines pilots also comes into
question after further investigation into the systemic factors involved in this
accident. The pilots did not execute a go around when the approach was not
stabilized by 1000ft or 500ft, which is against regulation. While there is not enough
information to determine whether or not this was a routine practice, the pilots did
not seem flustered by this choice so it can be assumed this was a fairly regular
procedure. This shows flaws in both the training and monitoring of pilots.
Additional training flaws are exposed by the fact that the pilots did not
recognize and respond in a timely manner to the warnings and indicators
communicating the hazardous state of the aircraft, even despite the presence of a
safety pilot. The pilots should be trained to be able to handle multiple duties while
monitoring the state of the aircraft effectively. The safety pilot should also be
trained and monitored so that he or she always focuses on observing the state of the
aircraft since the safety pilot on TK1951 was seemingly distracted from this task.
Finally, the pilots did not fully understand the interconnections between the
radio altimeters, the autothrottle, and the autopilot systems. While this is an item
that should be included in Turkish Airlines pilot training, it is important to note that
Turkish Airlines management did not even fully understand this issue due to a lack
of knowledge provided by the manufacturer.
15
Boeing (Manufacturer):


Many of the above control actions were very closely related to the crash of
TK1951 and are related to systemic factors within Boeing. While Boeing did not
know the full scope of the incidents due to lack of complete reporting, the company
determined by statistical analysis that the issue was not a safety one. While the
details of this statistical analysis are not known, these analyses often do not
properly characterize system issues and thus are not always an accurate metric for
determining whether something is a safety concern or not.
The radio altimeter system issues had been known to Boeing since 2001 and
occurring in many airlines, not strictly Turkish Airlines. Boeing receives
approximately 13,000 reports per year related to the 737NG (out of 400,000 per
year for the entire Boeing fleet) and very few were related to the radio altimeter
system, even fewer involving activation of the Retard Flare setting. Based on these
numbers, Boeing did not consider these incidents to be major issues although the
Safety-Related Responsibilities:
Design a safe aircraft.
Develop operating procedures to control the state of the aircraft and minimize risk.
Provide fixes and updates to design and/or procedures when necessary.
Respond to operator reports on incidents and safety concerns with appropriate fixes.
Perform hazard analyses and identify safety-critical procedures and equipment.
Provide training for operators regarding safety procedures and processes in case of
hazardous conditions.
Provide operational manuals and literature to airlines for safe operation of the
aircraft by pilots, maintenance crews, etc.

Context:
Operators did not accurately report all of the incidents with faulty altimeters and
thus the numbers of safety reports received by Boeing regarding the issue was not
representative of the scale of the problem.
Boeings statistical analysis methods for safety issues concluded that the incident
was not a safety concern.
Boeing had already placed information on procedure for flying with a failed radio
altimeter in the Dispatch Deviation Guide (for if the altimeter fails before takeoff).

Control actions related to the loss
Did not provide information to operators regarding procedure in case of altimeter
failure during flight.
Did not make operators aware of ways to detect altimeter failure.
Did not design an autopilot/autothrottle system that could accurately correct for
faulty left radio altimeter reading.

Process Model Flaws:
Did not believe the issue with faulty radio altimeters was a safety issue.

16
effect on the autothrottle is a significant problem. This point is a good example of
hindsight bias in the report as it states, The Board considers that Boeing reasonably
could have realized that the problem particularly the effect on the autothrottle
could have had an impact on safety. I believe it is fair to state that Boeing failed to
provide adequate control actions in that pilots were not notified of possible
consequences with the autothrottle system and did not have enough information to
inform their process models. The cause of the radio altimeter failure was not
discovered.
In case of a radio altimeter failure, Boeing provided information on how to
respond if the failure occurred before takeoff. Procedure for such an event was
included in the Dispatch Deviation Guide (after a question from an airline in 2004)
and stated that the autothrottle and autopilot should not be used for approach and
landing. Again, this provided no procedure for how to act in case of an in flight
failure or how to detect abnormalities in the autopilot or autothrottle due to faulty
altimeter readings.
In addition, the overall design of the radio altimeter system and its
interaction with the AFDS is questionable since the system was not able to detect
the failure and adjust the controls properly. This is a failure in control by Boeing
since the design of the system places the aircraft in a state of higher risk. Finally,
since the pilots were delayed in recognizing the hazardous state of the aircraft, one
can conclude that either Boeing or the airline should supply better training methods
and tools to help detect such issues sooner and possibly redesign the cockpit
interface/warning system.
17
Air Traffic Control the Netherlands:


Air Traffic Control the Netherlands is an independent organization under the
jurisdiction of the Dutch Transport and Water Management Inspectorate. The group
is responsible for publishing Rules and Instructions Air Traffic Control, a document
listing regulations that must be observed by all Dutch ATCs. This document,
however, did not comply with ICAO standards and, furthermore, since the Schiphol
ATC often violated the regulations imposed by this document, the control imposed
by ATC the Netherlands was flawed. This can in part be attributed to the fact that
the Dutch Transport and Water Inspectorate did not successfully monitor ATC the
Netherlands. More knowledge, however, is needed to determine the complete
process model for this group and why they did not perform adequate control
actions.
Safety-Related Responsibilities:
Issue guidelines, procedures, and standard operating instructions for all Dutch air
traffic controllers (Rules and Instructions Air Traffic Control) and ensure that they
are in accordance with ICAO and JAA standards.
Ensure that all Dutch air traffic controllers follow above guidelines, procedures, and
standard operating instructions through oversight and audits.

Context:
ICAO standards require that an aircraft must be flying horizontally on final approach
track before the glide path is intercepted.
ATC at Schiphol airport often instructed pilots to make a short approach when
landing on runway 18R. The approach is not inherently unsafe but the pilots must be
aware of the short approach and ATC must instruct the pilots to descend below
2000ft in order to intercept the glide slope from below and thus fulfill the above
ICAO standard.
ATC at Schiphol airport often instructed pilots to make short approaches with
headings that required the aircraft to intercept the glide slope from above, violating
Air Traffic Control the Netherlands regulations.

Control actions related to the loss
Regulations document published by ATC the Netherlands, Rules and Instructions Air
Traffic Control, did not require the aircraft to intercept the glide path while flying
horizontally, rather only that the glide path be intercepted from below.
Did not enforce the regulations established by the above document (i.e. aircraft
routinely made approaches that intercepted the glide slope from above).

Process Model Flaws: Unknown

18
Dutch Transport and Water Management Inspectorate (IVW):


The Dutch Transport and Water Management Inspectorate (IVW) is national
aviation authority in the Netherlands. The group oversees Air Traffic Control the
Netherlands and monitors and inspects all aircraft either registered in the
Netherlands or that fly through Dutch airports. Although not much information is
known regarding the context or process model flaws with respect to the IVW, it is
known that the group did not successfully monitor the actions of Air Traffic Control
the Netherlands because neither the regulations published by ATC the Netherlands
nor practice of the Schiphol ATC comply with ICAO/JAA standards. Since neither
ICAO nor JAA can enforce these standards, it is up to the national aviation authority
to do so and the IVW failed to adequately control the system in this case. Since not
much is known as to why this occurred, an investigation into the IVW management
and operations would be beneficial for this analysis.
Safety-Related Responsibilities:
Ensure aviation safety in the Netherlands
Monitor the operations of Air Traffic Control the Netherlands and perform necessary
audits.
Ensure that Air Traffic Control the Netherlands is in accordance with national and
international standards and adjust procedures when necessary.
Ensure airlines meet regulations imposed by the JAA.
Randomly inspect foreign registered aircraft visiting Dutch airports to ensure safety.

Context: Unknown

Control actions related to the loss
Did not adequately audit Air Traffic Control the Netherlands since the organization
was not observing its own rules and standards.
Did not ensure the regulations imposed by Air Traffic Control the Netherlands were
in accordance with ICAO standards.

Process Model Flaws: Unknown

19
Ministry of Transport (Turkey):


Little information is available regarding the involvement of The Ministry of
Transport (Turkey). The Ministry has jurisdiction over Turkish Airlines and
therefore Turkish Technic maintenance operations as well and so we can conclude
that the ministry should strongly give strong recommendations to or impose
regulations on airlines within its jurisdiction in order to emphasize the importance
of reporting all incidents with faulty or troublesome equipment. In addition, the
Ministry failed to establish a proper response to the altimeter incidents but through
analyzing the process models, we see that the Ministry most likely had inaccurate
data (or none at all) regarding the altimeter incidents.
Safety-Related Responsibilities:
Ensure aviation safety in Turkey.
Oversee Turkish Airlines and Turkish Technic and perform audits.
Ensure airlines meet regulations imposed by the JAA.
Issue licenses and certification for Turkish Airlines crews, aircraft, etc.

Context: Unknown

Control actions related to the loss
Did not ensure the proper investigation and response to faulty altimeter incidents.

Process Model Flaws:
Did not know scope of altimeter incidents due to lack of reporting.

20
Dutch Safety Board:


Little information is available regarding to the response of the Dutch Safety
Board to the altimeter incidents prior to the crash of TK1951. The Dutch Safety
Board made recommendations to Boeing immediately following the accident but no
information is available on if the board made recommendations after the many
incidents with radio altimeters that occurred beforehand or if the board was even
aware of such incidents.
Safety-Related Responsibilities:
Investigate aviation accidents and incidents that occur in the Netherland or involve
Dutch airlines/aircraft.
Determines causes of and contributing factors to incidents and accidents.
Issue recommendations to involved parties to aid in improving safety constraints.

Context:
The NTSB and DSB can only make recommendations. It is up to the regulatory
organizations themselves (FAA, IVW, etc.) to adopt and enforce the
recommendations

Control actions related to the loss:
Did not ensure that all incidents of altimeter failure were properly investigated and
solved.

Process Model Flaws:
Did not know scope of the altimeter failure problem until the after TK1951 crash.

21
Federal Aviation Administration (FAA):


Again, little information is known regarding the involvement of the Federal
Aviation Administration (FAA) in the crash of TK1951. The FAA has authority to
impose regulations on the manufacturer, Boeing, and failed to ensure that a viable
solution was given to operators regarding the faulty altimeter incidents prior to the
accident. It is unknown, however, if the FAA was aware of these incident. If not,
why were they not made aware of such an issue? If they were aware, it can be
assumed that Boeing presented the argument that, based on statistical analysis and
the known scope of the incidents, the incidents did not seem to be safety hazards
and thus the FAA did not take action. The FAA could have further investigated this
issue in order to ensure that a solution was implemented but since the organization
is flooded with many incidents and issues, this topic was lost in the mix.
Safety-Related Responsibilities (Related to TK1951):
Ensure aviation safety in the United States of America.
Certify aviation products and organizations, including the Boeing 737-800.
Develop and enforce regulations and standards for all aircraft produced (and flown)
in the United States and update such regulations should new safety concerns arise.

Context:
The Dutch Safety Board (and similarly the National Transportation and Safety Board
in the United States) can only make recommendations to the FAA. It is up to the FAA
to take such recommendations and implement them as regulations or airworthiness
directives.

Control actions related to the loss
Did not ensure that Boeing issued a proper radio altimeter solution (either
mechanical fix, procedure update, or both) in response to failure in flight (not just
before takeoff).

Process Model Flaws:
Unaware of the scope of the radio altimeter incidents due to lack of reporting.
Did not believe that the radio altimeter incidents were major safety concerns.

22
International Civil Aviation Organization (ICAO) and Joint Aviation
Authorities (JAA):


The International Civil Aviation Authority (ICAO) and the Joint Aviation
Authorities (JAA) are both organizations with similar missions and limitations.
ICAO produces Standards and Recommended Practices that act as guidelines for
international aviation regulations. ICAO cannot enforce these regulations but the
contracting states are required to implement them to the best of their abilities and
report to ICAO any differences between national legislation in their state and ICAO
standards. The Joint Aviation Authorities (JAA) is a partnership between the
national aviation authorities of many European countries including the EU and
Turkey. The JAA develop and publish Joint Aviation Requirements (JARs) but, much
like ICAO recommendations, JARs are only enforceable when included in national
legislation or regulations.
In terms of control failure, since these organizations cannot enforce any
regulations, ICAO and JAA fulfilled their control responsibilities. An argument can
be made, however, that these organizations should develop methods to better
monitor the implementation of ICAO and JAA regulations and to pressure member
states to comply since the Dutch aviation authority was not adequately enforcing
these regulations themselves.




Safety-Related Responsibilities:
Develop and implement common safety standards, procedures, and recommended
practices for members of the respective organizations.
Issue recommendations to members.
Update maintenance procedures when necessary.

Context:
ICAO has established guidelines for approach that state an aircraft must be flying
horizontally on the final approach track before the glide path is intercepted. This
standard establishes many of the common practices of approach.

Control actions related to the loss: Because the standards and recommended practices
had been established for safe approach procedures and because ICAO and JAA cannot
enforce the recommendations, the organizations fulfilled their control responsibilities. The
national legislation must enforce the recommendations.

Process Model Flaws:
Did not know that national legislations were not effectively enforcing ICAO and JAA
recommendations.

23
Conclusion

Through the CAST analysis of the TK1951 crash, many of the systemic factors
that contributed to the accident were revealed. In comparing the above CAST
analysis with the Dutch Safety Board accident report, however, many of these
systemic factors were also noted in the DSB document. Midway through the
investigation of TK1951, the Dutch Safety Board participated in a workshop to teach
the board how to apply the techniques of CAST and STAMP. It can be assumed,
therefore, that this new knowledge influenced the investigation for TK1951. In the
report, the Dutch Safety Board lists the following major causes of the accident;

1. Non-stabilized approach
2. Convergence of circumstances
3. Unsafe lining up for the runway (intercepting the glide path)
4. Inadequate supervision by the Dutch Transport and Water Management
Inspectorate
5. Faulty radio altimeter system
6. Failure to report all incidents of altimeter issues
7. Line flying under supervision distractions
8. Inadequate approach to stall training
9. Unsafe standard operating procedures (mostly in reference to pilots)
10. Inadequate safety assurance from Turkish Airlines (risk identification
and management)

Many of the above factors listed by the Dutch Safety Board are systemic
factors noted in the CAST analysis. I believe the DSB report, in general, produced a
report that minimized blame and hindsight bias, although there were instances of
both. If the DSB had not had such training in CAST methods and employed a root
cause method, I believe the report would have focused much more on the pilot error
and the Schiphol ATC error.
A few systemic factors uncovered by the above analysis were not discussed
at length in the DSB report. For example, the failure of the pilots to recognize the
warnings and displays indicating the hazardous state of the aircraft before stall not
only points to the possibility of inadequate training but also to the possibility that
the cockpit interface and warning systems are not effectively designed to best alert
the pilots, even when they are busy performing other duties. In addition, the report
focused greatly on the Dutch Transport and Water Management Inspectorate, the
aviation authority in the Netherlands, but did not focus on the aviation authorities in
the United States and Turkey. Although not much information is known regarding
to these organizations roles in the incident, I believe that both could have pressed
for further investigation and management of the faulty altimeter accidents.
In conclusion, the DSB report produced a very thorough analysis of systemic
factors but still had instances of hindsight bias and blame. The DSB report and the
above CAST analysis makes it evident that this accident was not simply pilot or ATC
error but rather a combination of numerous systemic factors that led to a migration
24
to higher risk. An even more in depth CAST analysis of TK1951 would potentially
reveal additional systemic factors in other organizations (such as the FAA and
Ministry of Transport Turkey as stated above) as well as insight into the impact the
design of the cockpit had on the pilots mental models.



































Source:
The Dutch Safety Board. Crashed during Approach, Boeing 737-800,
Near Amsterdam Schiphol Airport. By P. van Vollenhoven. The Hague: Dutch Safety
Board, May 2010.