Turkish Airlines Nineteen Fifty-One, the Schiphol Approach, and What a Faulty Radio Altimeter Revealed About the Gap Between Using Automation and Understanding It

On February 25, 2009, Turkish Airlines Flight 1951 - a Boeing 737-800 - crashed on approach to Amsterdam Schiphol Airport, killing nine people and injuring eighty-six. The proximate cause was an autothrottle that commanded engine idle at 1,900 feet above the ground because a faulty sensor told it the aircraft had already landed. The underlying cause was that nobody in the cockpit caught the mode change before the aircraft ran out of energy to recover.

What Was Wrong Before the Approach Began

The left radio altimeter on the aircraft was malfunctioning before the flight departed Istanbul. It was stuck at negative eight feet - indicating the aircraft was eight feet below ground level regardless of actual altitude.

The radio altimeter, also called a radar altimeter, bounces a signal off the ground to give the aircraft a precise height reading during the approach and landing phases. It is accurate to within a foot or two and becomes the primary altitude reference the automation trusts below 200 feet above the ground. The barometric altimeter handles cruise altitude; the radio altimeter is what the aircraft’s automation uses near the runway.

A minimum equipment list entry existed for the degraded left radio altimeter. The crew knew about the fault. The aircraft was legal to fly. What was not fully understood was what that faulty sensor would do to the autothrottle during the approach.

Why the Autothrottle Commanded Idle at 1,900 Feet

The Boeing 737 autothrottle operates in different modes depending on phase of flight. During a normal approach, it works in speed mode - maintaining the target approach speed the crew has set. But there is a designed mode transition called retard flare, which commands the throttles to idle. This is correct behavior at touchdown: when the aircraft lands, you want idle thrust.

The trigger for retard flare is a radio altimeter reading below a threshold altitude. On certain configurations of the 737 NG, the autothrottle’s retard flare logic could be triggered by a single radio altimeter reading below that threshold, even when the opposing altimeter was reading a normal approach altitude. The system did not reconcile the two readings before acting.

The left radio altimeter was reporting the aircraft was already on the ground. So at approximately 1,900 feet, still miles from the runway threshold on a fully stabilized ILS approach, the autothrottle commanded both throttles to idle. The engines began spooling down. Thrust disappeared. Airspeed started to decay.

This was not a design error in the conventional sense. The system was executing exactly what it was programmed to do with the data it had. It was not hardened against a known-failed sensor reporting a plausible-but-wrong value.

What the Crew Experienced - and Didn’t Notice

The autopilot was still flying the aircraft. The ILS glideslope and localizer needles were centered. The approach trajectory looked textbook from every external vantage point.

As airspeed bled off, the autopilot began pitching the nose up slightly to hold the glidepath. That pitch energy came directly out of the aircraft’s airspeed margin. The aircraft was getting slower and slower while continuing to track the glideslope perfectly - appearing, to a scan focused on needle deflection, entirely normal.

There was no annunciation that cut through the crew’s attention patterns. The autothrottle mode change was displayed on the flight mode annunciator - a line of small text near the top of the primary flight display - but that display was not part of anyone’s active scan at that moment. The throttle levers had moved to idle. Nobody called it out.

At approximately 460 feet above the ground, the stick shaker activated. The stick shaker is a physical vibration through the control column signaling the aircraft is at the edge of a stall. At under 500 feet with zero thrust, it is not a diagnostic cue - it is a declaration that the energy state is already critical.

The first officer, who was pilot flying, pulled back on the controls. It was an instinctive response, but pulling back at low altitude with near-stall speed and no thrust worsens the energy state. The crew advanced the throttles. The engines began spooling up. Jet engines cannot develop full thrust instantaneously, and the seconds that spool-up requires were no longer available.

The aircraft struck the ground approximately 1.5 kilometers from the runway threshold.

What the Dutch Safety Board Found

The Dutch Safety Board led the two-year investigation. Its findings did not center on pilot error in the traditional sense. What it documented was an automation architecture that could act on data from a single failed sensor without cross-checking against available contradicting data, combined with a cockpit monitoring environment where an unexpected mode transition did not reliably surface to the crew’s awareness during a high-workload approach phase.

The investigation also identified that the autothrottle mode annunciator - the display showing what mode the autothrottle is operating in - was not a mandated focus of monitoring callouts at the time under the carrier’s standard operating procedures. The transition to retard flare at 1,900 feet was visible on the flight deck. It was not seen.

Turkish Airlines 1951 is not an isolated incident. The same underlying dynamic appears across multiple major accidents.

Asiana Airlines Flight 214 at San Francisco in 2013 involved a crew that set the autothrottle to a mode that did not maintain airspeed, believed the speed was being held, and did not catch the decay until the aircraft was below the glidepath and slow. The aircraft struck the seawall short of the runway.

American Airlines Flight 965 at Cali, Colombia in 1995 involved a crew that entered a navigation fix identifier the flight management computer resolved to an unexpected waypoint. The aircraft turned off the published missed approach track, and the crew did not catch the deviation before terrain impact.

The common thread is not incompetence - some of these crews had thousands of hours in type. The pattern is automation operating in a mode the crew did not expect, in a phase of flight where the cue to that mode transition was not prominent enough in the normal scan to trigger action before the energy or trajectory state became unrecoverable.

How the Industry Responded

Following the accident, Boeing issued operational documentation to operators worldwide. Changes were made to training programs. The 737 received additional alerting modifications. The autothrottle mode annunciator became a mandated focus of monitoring callouts at many carriers. Standard operating procedures were updated to include explicit acknowledgment of autothrottle mode transitions during approach.

The FAA and aviation authorities worldwide expanded training initiatives around mode awareness - the skill of knowing what mode your automation is in at any given moment, when transitions between modes are expected, and when a transition is anomalous. Advanced Qualification Programs at major carriers now include scenario training built around unexpected automation mode changes. Upset Prevention and Recovery Training incorporates automation-off scenarios to ensure pilots retain the skills to recover when automation does the wrong thing.

The monitoring callout is not procedural overhead. When a crew explicitly calls out the mode they have armed, they verify it. When they acknowledge a mode transition aloud, unexpected transitions get caught. The callout is a designed error-catching mechanism.

Why This Matters for Every Pilot Flying Automation

The lesson of Turkish Airlines 1951 applies whether the cockpit has a steam-gauge panel or a full glass suite. The Garmin G1000 and G3000 platforms have flight mode annunciation. The autopilot modes you arm are displayed. The transitions happen. If you are not building the habit of actively monitoring those transitions, you are relying on the automation to never receive bad data and never enter the wrong mode.

Automation does not monitor itself. It executes what it is programmed to execute, with the data it has, in the mode it is in. When the data is bad, it executes incorrectly. When the mode is wrong, it does the wrong thing precisely. The safety net between correct automation behavior and catastrophic automation behavior is the pilot’s awareness of what that automation is doing in real time.

Cockpit automation has made aviation substantially safer. The accident record on aircraft with functioning autopilot and autothrottle supports that conclusion clearly. The question is not whether to use automation. The question is whether you understand what it is doing at every moment - and can recognize when it is doing something wrong.

Mode awareness is not a supplement to flying skill. It is flying skill, in the cockpit environment that aviation now operates in.

Key Takeaways

Turkish Airlines Flight 1951 crashed at Amsterdam Schiphol on February 25, 2009, killing nine, after a faulty left radio altimeter triggered the autothrottle’s retard flare mode at 1,900 feet - miles from the runway.
The autothrottle’s response to the bad sensor data was technically correct behavior; the system was not designed to cross-check a failed sensor against a valid opposing reading before commanding idle thrust.
By the time the stick shaker fired at 460 feet AGL, there was no longer enough altitude or energy to recover.
The accident drove industry-wide changes: mandatory autothrottle mode monitoring callouts, additional alerting modifications to the 737, and expanded automation mode-awareness training.
Mode awareness - knowing what mode your automation is in, when transitions are expected, and when to call an anomaly - is a fundamental proficiency requirement in any glass-cockpit aircraft, from a Garmin G1000 to a transport-category airliner.