When the Altimeter Lied: Turkish Airlines 1951 and the Hidden Autothrottle

A single faulty sensor on the left wing fed a −8-foot reading into a system the crew thought they had bypassed — and nine people died before anyone understood what the automation had done.

On the morning of 25 February 2009, Turkish Airlines Flight 1951 descended toward Amsterdam Schiphol Airport through broken cloud on an ILS approach to Runway 18R. The Boeing 737-800 carried 135 people from Istanbul. What should have been a routine arrival in one of Europe’s busiest hubs ended in a ploughed field roughly 1.5 kilometres short of the threshold, the aircraft’s nose buried in Dutch soil while runway lights still glowed through the winter haze.

The Dutch Safety Board would later call what happened an automation surprise — not because the airplane malfunctioned in some exotic way, but because the crew’s mental model of the 737’s architecture did not match reality.

A Sensor That Failed Quietly

During the approach, the left radio altimeter — the device that measures height above the ground by bouncing radio waves downward — began transmitting erroneous data. At one point it indicated the aircraft was eight feet below the surface: a physically impossible reading that nonetheless satisfied the logic governing the autothrottle.

On the 737-800, the autothrottle monitors radio-altimeter height to manage thrust during the landing phase. When the system believes the airplane is within roughly 27 feet of the ground, it enters “retard flare” mode and commands idle thrust, mimicking a pilot’s power reduction in the flare. A −8-foot indication tripped that threshold instantly. Engine power rolled back to idle while the aircraft was still hundreds of feet above the field.

The failure did not announce itself with a master warning or a clear annunciation that thrust had been surrendered to a ghost altitude. The autothrottle simply did what it was programmed to do, responding to data the crew assumed they had sidelined.

The Crew’s Reasonable Assumption

The flight crew was already carrying a heavy workload. They were correcting from above the glide path, managing configuration and navigation while descending through weather toward Schiphol. When the left radio altimeter failed, they took action that aligned with Boeing’s published guidance: they selected the right autopilot and the right flight control computer, believing that choice would isolate them from the defective left-side sensor.

That belief was understandable. In many flight-deck architectures, selecting an alternate control channel routes critical inputs through the healthy side. What Boeing’s documentation did not clearly disclose — what the Dutch Safety Board found the crew could not reasonably have known — was that the autothrottle always received radio-altimeter data from the left unit, regardless of which autopilot or flight control computer was engaged.

The crew thought they had fenced off the bad data. The autothrottle had not gotten the message.

The Seconds That Ran Out

With thrust at idle on a stabilized approach profile, airspeed bled away. The crew, focused on glide-path capture and approach tasks, did not register the decay in time. At 460 feet above ground level, the stick shaker activated — the airframe’s blunt warning that the wing was no longer flying. The 737 stalled. There was too little altitude and too little energy to recover.

The impact carved a crater in the field northwest of the airport. All three flight-deck crew members and six passengers died. One hundred twenty-six occupants survived, many injured, in what could have been a far worse catastrophe given the energy of the crash.

Investigators from the Dutch Safety Board, supported by human-factors specialist Sidney Dekker’s separate crew-focused analysis, reconstructed a chain in which no single dramatic error explained the outcome. Instead, a latent design characteristic — autothrottle dependence on the left radio altimeter, undocumented in a way crews could use — combined with a quiet sensor fault and the compressed timeline of a high-workload approach.

NASA’s subsequent safety message on the accident echoed the same theme for the wider aviation community: highly automated aircraft can change state without the conspicuous cues pilots associate with hand-flying mistakes.

Documentation as a Safety System

The TK1951 investigation did not conclude that the Turkish Airlines crew ignored warnings or disregarded procedures. It concluded that they operated within a model of the 737’s automation that was incomplete. The autothrottle’s “retard flare” logic, fed by a failed altimeter they believed they had bypassed, became a mode-awareness trap: the airplane was in a landing-thrust regime while the crew still believed they were in a powered approach.

For student and rated pilots studying modern glass-deck aircraft, the lesson is architectural, not anecdotal. Knowing what a switch selects is not the same as knowing what every downstream system still listens to.

Why it matters to you

The crew of TK1951 selected the right autopilot to isolate the failed left radio altimeter, but the autothrottle still used the left altimeter data. Incomplete documentation about system architecture created a mode-awareness trap that killed nine people — not because the pilots failed to fly, but because no checklist item told them the autothrottle never changed its data source. In training and on the line, treat automation as a network of hidden couplings: when a sensor or mode behaves oddly, ask which systems still consume that input, verify thrust and airspeed with the same discipline you would on a raw-data approach, and refuse to assume that selecting the “good” side rewrites the entire airplane. Mode awareness is not knowing which button you pressed; it is knowing what the aircraft is doing because of it.