Turkish Airlines Flight 1951 — The Altimeter That Fooled the Throttle

Turkish Airlines 1951 stalled short of Amsterdam’s Runway 18R because one of the aircraft’s two radio altimeters was generating a false reading of negative eight feet — and the autothrottle responded to this false reading by reducing thrust to the idle landing setting at 1,950 feet during the approach. The crew did not detect the thrust reduction until the stick shaker activated at 460 feet. Recovery was impossible. Nine people died.

This accident is a case study in one of the most insidious failure modes in automated aviation systems: silent, gradual degradation driven by a faulty sensor, producing hazardous system behaviour that is invisible in the operational context because it resembles normal system behaviour at a different phase of flight.

The autothrottle was doing exactly what it was designed to do. The radio altimeter was producing a value the protection logic had not anticipated. The crew was monitoring a stable approach. Everything looked normal. Nothing was.

Turkish 1951 is the automation accident where no alarm fired, no warning activated, and no unusual indication appeared — until the aircraft was 460 feet above the ground and stalling. The failure was silent, gradual, and invisible until the margin had already gone.

Date	25 February 2009
Flight	TK 1951
Aircraft	Boeing 737-800
Operator	Turkish Airlines
Fatalities	9 of 135 on board
Category	Automation / Radio Altimeter / Autothrottle / Sensor Fault
Location	Amsterdam Schiphol Airport, Netherlands

The Event

TK 1951 is established on a stable ILS approach to Schiphol Runway 18R
The left radio altimeter begins generating a persistent false reading of -8 feet
The autothrottle interprets this as ‘aircraft is on the ground’ and reduces thrust to idle landing setting
Thrust reduction begins at approximately 1,950 feet on the approach — a phase where idle thrust is completely inappropriate
The crew is monitoring a stable, normal-looking approach; the thrust reduction is gradual and initially consistent with slight speed changes
Speed decays progressively from 144 knots to below stick shaker activation
At 460 feet, the stick shaker activates
Recovery thrust is applied but insufficient altitude remains
The aircraft stalls into farmland 1.5 km short of the runway
9 of 135 on board die; the aircraft is destroyed

The autothrottle system on the Boeing 737 uses radio altimeter data to schedule thrust reduction during the landing flare — a legitimate and useful function. The fault was that one altimeter’s -8 feet reading fell within a specific range that the protection logic treated as ‘on the ground’ rather than ‘failed sensor.’

Systems Engineering Perspective

From a systems engineering perspective, TK 1951 exposes a specific gap in the sensor fault tolerance architecture of the autothrottle system. The system’s protection logic addressed large-negative altimeter readings (obviously wrong) but not small-negative readings that appeared plausible.

The most dangerous sensor failure mode is not the one that produces an obviously wrong value — it is the one that produces a plausible wrong value that falls within the system’s accepted range.

The -8 Feet Value — Plausible Enough to Pass the Protection

Boeing had identified the risk of a faulty radio altimeter causing autothrottle idle thrust at inappropriate phases of flight. They had implemented protection logic to prevent this. The protection activated for altimeter values below a threshold — values that were clearly wrong.

The left radio altimeter on TK 1951 produced a value of -8 feet. This is a fault value — no aircraft is 8 feet underground. However, -8 feet fell within the range that the protection logic treated as plausible: the aircraft might, in the logic’s assessment, be ‘just touching the ground.’ The protection logic that should have caught this fault did not, because the fault value fell in a specific gap in the protection design.

A protection logic that addresses obvious sensor failures but not plausible sensor failures provides protection against the failures it is easy to defend against, not the failures it needs to defend against.

Idle Thrust at 1,950 Feet — Normal Behaviour at the Wrong Time

The autothrottle reduction to idle is normal behaviour. At 20 feet, it is the landing flare de-power. At 1,950 feet, it is a catastrophic power reduction that will cause the aircraft to decelerate and stall. The behaviour was identical in both cases. In one context, it is correct. In the other, it is fatal.

The crew was monitoring the approach at 1,950 feet and saw what appeared to be minor speed variation. They had no indication that the autothrottle had made a fundamental mode change. The failure was, from the flight deck perspective, invisible.

Human Factors Perspective

The human factors dimension of TK 1951 is the automation monitoring problem: the tendency of experienced crews to trust stable, apparently-normal automation behaviour in a routine operational context, reducing the independent monitoring that would detect subtle deviations.

Automation Monitoring in a Stable Environment

The approach was stable. The instruments were showing normal values. The autoflight was engaged. In this environment, active monitoring of individual autoflight parameters — specifically, verifying that autothrottle thrust setting was appropriate for the approach phase — is cognitively demanding and psychologically de-prioritised.

The automation monitoring failure was not negligence. It was the predictable outcome of a well-trained, experienced crew in a stable approach environment, behaving exactly as the operational environment had trained them to behave.

Automation monitoring is most needed when it is least natural — during stable, routine operations where nothing appears to demand attention.

Speed Monitoring Callouts — The Absent PNF Duty

An explicit SOP requirement for the PNF to make airspeed callouts at defined intervals on approach — for example, every 500 feet — would have detected the speed decay before it reached the stick shaker threshold. This duty was not formalised in the SOPs of the time.

System Interaction Breakdown

1. Protection Logic Gap at -8 Feet

The Boeing autothrottle protection logic had a gap: it addressed large-negative altimeter values but not small-negative values like -8 feet. The gap allowed a plausible fault value to activate hazardous behaviour.

2. No Radio Altimeter Disagreement Alert

The two radio altimeters — left showing -8 feet, right showing the correct height — disagreed significantly. No cockpit alert communicated this disagreement to the crew. The disagreement existed in the system; it was invisible on the flight deck.

3. Gradual Speed Decay Without Alert

The speed decayed gradually over a period of approximately two minutes. No alert activated until the stick shaker at 460 feet. The system had no intermediate speed alert calibrated to approach phase.

A speed decay that takes two minutes to reach stall warning on approach is invisible to a monitoring system that only alerts at the stall threshold. Intermediate alerts exist to provide recovery time.

Significance in Aviation Risk

1. Altimeter Disagreement Alerting Mandated

Post-TK 1951, radio altimeter disagreement alerting was mandated on aircraft using altimeter data in autothrottle logic. If the two altimeters disagree beyond a defined threshold, the crew is alerted.

2. Autothrottle Protection Logic Revised

The Boeing autothrottle protection logic was revised to address the -8 feet gap, ensuring that negative altimeter values within a plausible range also trigger protection logic.

3. Approach Speed Monitoring SOPs

Speed callout requirements during approach were formalised as explicit PNF duties, providing a procedural mechanism for detecting speed deviations before they reach critical levels.

Closing Perspective

Turkish Airlines 1951 is the accident that proved the most dangerous sensor failure is not the one that looks wrong — it is the one that looks right. A radio altimeter reading of -8 feet is obviously a fault. It is also a value that falls within a plausible range in the specific protection logic that governs the autothrottle.

Nine people died in the gap between an obviously wrong sensor value and a plausible one. The protection logic update, the altimeter disagreement alert, and the approach speed monitoring SOPs that followed all exist because of what happened at Schiphol on 25 February 2009.

The lesson is not that automation is dangerous. The lesson is that every sensor that drives automation requires protection against every fault mode — including the plausible ones.

TK 1951 is the proof that automation fault tolerance must address plausible failures, not just obvious ones. The -8 feet altimeter reading was the most dangerous kind of wrong — it was wrong enough to kill, right enough to pass the protection logic.