The Crash of Turkish Airlines flight 1951
On the 25th of February 2009, a Turkish Airlines Boeing 737 was on final approach into Amsterdam’s Schiphol Airport when it suddenly stalled and fell out of the sky. The plane slammed belly-first into a field, killing 9 people and injuring 120 others. An investigation by the Dutch Safety Board found that a malfunctioning radio altimeter tricked the autothrottle into thinking the plane was landing — and that a storm of psychological factors left the pilots ignorant of the problem, allowing the computer to inadvertently stall the plane. The report raised far-reaching questions about how humans interact with technology, and highlighted ways in which interface design fails to take human nature into account.
Turkish Airlines flight 1951 was a regularly scheduled service from Istanbul to Amsterdam using a “Next Generation” Boeing 737–800. On the 25th of February 2009, there were 128 passengers and seven crew on board this flight, including three pilots: Captain Hasan Arisan, First Officer Murat Sezer, and “safety captain” Olgay Özgür. This was an official training flight for Sezer, who had only completed 17 flights since he was hired and had never flown to Amsterdam; therefore, a third pilot was on board to make sure that the other pilots didn’t miss anything under the increased workload. But that would not be the only thing making this flight slightly less than routine.
For many years, airlines around the world had been reporting what appeared to be a minor nuisance problem with the 737’s radio altimeters. Boeing received hundreds of reports of radio altimeters suddenly showing negative altitude readings while in flight. Airlines tried everything to fix the problem, but could not get it to go away.
A radio altimeter measures a plane’s height above terrain by bouncing a radio signal off of the ground and recording the response time. The 737 has two radio altimeters, one on the captain’s side, and one on the first officer’s side. Many computerized systems on board the 737 use data from the radio altimeter in their calculations. One of these is the autothrottle, the system that automatically adjusts engine power throughout the flight. In a few of the radio altimeter malfunctions reported to Boeing, the negative radio altimeter reading caused the autothrottle to believe the plane was near the ground, allowing it to improperly enter “retard flare” mode, in which it reduces thrust on the engines seconds before touchdown to help slow the plane and raise the nose — a process called “flaring.” In the cases where this occurred, pilots always disabled the autothrottle, accelerated manually, and landed without any problems. Boeing recognized the issue, however, and in 2004 it put a passage into the 737’s “Dispatch Deviation Guide” advising not to use the autothrottle during landing if the radio altimeter was found to be inoperative before the flight.
In the days leading up to the 25th of February 2009, the captain’s side radio altimeter on the Turkish Airlines 737 that would become flight 1951 malfunctioned several times, erroneously showing a reading of -8 feet while the plane was in the air. As usual, maintenance engineers were unable to find the cause of the malfunction. But the problem never reappeared on the ground, and flight 1951 took off from Istanbul with both radio altimeters fully operative. Almost immediately, the radio altimeter malfunctioned again and showed a reading of -8 feet. But soon the plane climbed above the range of the radio altimeter, and the pilots put it to the back of their minds.
The rest of the flight to Amsterdam was normal, until the final approach into Schiphol, when the altimeter started reading -8 feet again. Safety Captain Özgür pointed this out to the other pilots, who acknowledge the failure. Then as the plane descended further, a landing gear warning went off, because the system believed the plane to be near the ground without its landing gear down. Captain Arisan, apparently familiar with the failure, remarked that the radio altimeter was responsible for the alarm. The crew ignored the warning and continued the approach.
However, their approach was not entirely stable. They were well behind the timeline called for in the standard operating procedures with regard to the altitudes at which the approach and landing checklists should be completed. Technically this was reason to declare a missed approach and go around for another landing attempt, but the pilots never even considered doing so. On top of this, they were performing what is known as a “slam dunk” approach. When landing using an instrument landing system, the computer locks on to a “glide slope” that guides the plane down at the proper angle toward the runway. Normally, pilots will level off and intercept the glide slope from below, but in a slam dunk approach, they drop steeply and intercept it from above, which is considerably more difficult. Air traffic control rules in the Netherlands did not authorize controllers to allow slam dunk approaches, but it was common practice at Schiphol to assign them anyway.
To understand what happened next, a little bit of background about the 737’s autopilot and autothrottle modes is necessary. During the approach, the crew used the autopilot’s “approach mode,” which allowed them to set progressively lower target altitudes. Just before intercepting the glide slope, the pilots would switch the autopilot from approach mode to “vertical speed mode,” which allowed them to set a target descent rate instead of a target altitude. The only autothrottle mode relevant to this case is the previously mentioned “retard flare” mode. The retard flare mode can only activate when the autothrottle is engaged, the plane is less than 27 feet above the ground, the flaps are extended beyond 12.5 degrees, and no target altitude is selected in the autopilot. When all of these conditions are met, this tells the autothrottle that the plane is seconds from touchdown, so retard flare mode engages and the computer “flares” the airplane.
As flight 1951 descended toward the runway in Amsterdam, each of these conditions was successively met. The autothrottle drew its altitude information from the captain’s side radio altimeter, which was erroneously reading -8 feet. Normally if there was a fault with the captain’s altimeter, it would switch to the first officer’s altimeter, but the failure of the altimeter was such that it didn’t produce a fault warning that the autothrottle could detect. Therefore the autothrottle treated the reading of -8 feet as valid data. While completing the approach checklist, the pilots extended the flaps to 15 degrees, meeting the condition that the flaps must be set to at least 12.5 degrees. Finally, when the crew switched the autopilot from approach mode to vertical speed mode, the target altitude was erased. With all the conditions met, the autothrottle switched to retard flare mode right as flight 1951 was beginning the “slam dunk” descent to intercept the glide slope from an altitude of 2,000 feet.
Upon entering retard flare mode, the autothrottle automatically decreased thrust on both engines to idle, and the word “retard” appeared in red on the pilots’ electronic displays. However, the decrease in thrust did not immediately strike the crew as important because of an unfortunate coincidence: it came right when they expected thrust to decrease anyway. When intercepting the glide slope from above on a “slam dunk” approach, altitude must be lost quickly, and a high descent rate was selected. The crew fully expected the autothrottle to decrease thrust to achieve this high descent rate. None of the three pilots noticed that the autothrottle mode on their displays had changed to “retard,” and that the decrease in thrust was actually because the computer thought they were landing.
Shortly thereafter, flight 1951 intercepted the glide slope, at which point thrust should have increased to maintain a shallower descent rate. But because the autothrottle was in retard flare mode, it did not. In an effort to keep the plane on the glide slope, the autopilot pitched the plane’s nose up to generate more lift. Soon, flight 1951’s speed was well below normal and its angle of attack was abnormally high. Still, no one noticed that anything was wrong, possibly because the pilots were distracted working through the landing checklist (which they should have already completed). It was unusual that during this entire time, no one monitored the airplane’s airspeed or pitch attitude — or at least no one recognized that these parameters were abnormal, even though the low airspeed eventually triggered a flashing amber box around the airspeed value on the electronic display.
As the airspeed dropped dangerously low, Safety Captain Özgür became momentarily distracted by a report from a flight attendant that the cabin was ready for landing, which he repeated to the pilots. Therefore he too was not monitoring the airspeed at a critical moment. Seconds later, the “stick shaker” warning activated, shaking the pilots’ control columns to warn them that their speed was dangerously low and the airplane was about to stall. Recognizing the warning immediately, First Officer Sezer, who was flying the plane, increased thrust on both engines and pushed his control column forward to prevent the stall from occurring. But within a second or two, Captain Arisan announced, “I have control,” prompting Sezer let go of the throttles. When “retard flare” mode is engaged, manual power inputs are not allowed, so the autothrottle simply rolled both engines back to idle as soon as Sezer took his hand off the levers! Seconds later, the plane stalled and fell out of the sky from an altitude of just 450 feet.
As the stall began, Captain Arisan pushed the nose down and accelerated the throttles to maximum power. But it was already too late. Recovery from a stall would have taken at least 500 feet of altitude, and they didn’t have that. Flight 1951 fell straight down like a rock before belly-flopping into a farmer’s field just 1.5 kilometers from the runway.
The plane hit hard, breaking into three sections and sliding to a stop in a very short distance, while the engines catapulted themselves forward and upward across a nearby canal. The brutal impact killed all three pilots, as well as a flight attendant and five passengers, mostly in the front of the plane. Of the 126 others on board, 120 were injured in the violent crash. By a stroke of luck, the plane didn’t explode or catch fire, doubtlessly saving many lives. Nevertheless, there was a mad rush to escape as passengers feared an explosion at any moment. First responders arrived at the scene after some minutes and were relieved to find many survivors already walking away from the plane. A fleet of 60 ambulances rushed at least 84 people to nearby hospitals.
Survivor accounts of the crash appeared in the media almost immediately. “It felt like we fell into a void,” one passenger recalled. Others said that the plane “fell backwards” or “dropped like a stone.” Most said that everything unfolded in five seconds or less. This made it clear from the beginning that flight 1951 stalled before it crashed, but the reason why was far from simple. The stall itself was a result of the autothrottle entering retard flare mode in response to a false radio altimeter reading, but a number of questions had to be asked. First, why was the autothrottle able to erroneously enter retard flare mode in the first place? Why was this possibility not recognized before the crash? And most importantly, why didn’t the pilots notice that there was a problem?
The history and development of the Boeing 737 NG’s autothrottle system and radio altimeter explain most of the mechanical questions. The altimeter problems had been known for many years, but no amount of tests was able to reveal the cause of the discrepancies. They were also not categorized as a flight safety issue, which meant they received a low priority. Then, in 2004, Boeing was made aware that a faulty radio altimeter could cause the autothrottle to enter retard flare mode when it should not. At that time five cases of this had been reported. Boeing’s tests found that a faulty altimeter reading would not necessarily be flagged as such inside the computer system. In 2006, it rolled out a solution to the problem in the form of a software update to all new 737s built from 2006 onward, which prevented the autothrottle from entering retard flare mode if the two radio altimeter readings didn’t agree. However, the autothrottles on 737s built before 2006 (including the accident airplane) ran a different operating system that couldn’t support the new software, so they didn’t receive the update. (Testing after the crash showed that the update was not 100% effective anyway.) This was not considered a safety issue because, if retard flare mode engaged erroneously, the pilots could simply disable the autothrottle and continue the flight, as they had done in all reported incidents up to that time, and indeed as they did in seven more incidents that occurred after that.
Why, then, did the pilots of flight 1951 fail to recover and allow the plane to stall, when at least a dozen other crews faced the exact same problem and came out fine? The Dutch Safety Board’s attempts to answer this question shed light on troubling issues with the way pilots interfaced with technology and with the standard operating procedures.
On the surface level, the pilots were at fault because they failed to notice the change in autothrottle mode, failed to notice their decreasing airspeed, flew an unstable approach, and did not apply maximum power as soon as the stick shaker went off. However, the investigation argued that these faults extended far beyond this particular crew. Research showed that most Boeing pilots do not actively look at the messages displaying the current mode of the autothrottle and autopilots. (This is in contrast to Airbus pilots, for whom procedures dictate that they must call out mode changes. Boeing pilots were not required to do so.) Additional research revealed that, while humans are inherently bad at monitoring automation, certain visual cues can make it easier or harder. In fact, pilots have an easier time monitoring old-style airspeed gauges that use a dial, as opposed to simply a number, because it provides an instant visual cue with no need to mentally process what the number means in context. In practice, a key part of monitoring airspeed comes down to seeing the airspeed indicator in peripheral vision while attending to other tasks, and investigators felt that the design of modern indicators made pilots less likely to notice them.
The investigation addressed the pilots’ failure to abandon the approach on similar terms. By the time it intercepted the glide slope, flight 1951 was in contravention of at least three items required for a stable approach: the landing checklist was not complete by 1,000 feet, the throttle levers were not in the correct position, and the speed was too low. Turkish Airlines operating procedures called for a missed approach to be made if even one of these items was not met. However, the investigation found that for crews all over the world, missed approach guidelines actually had little bearing on whether they decided to go around or not. Pilots generally decided to continue approaches unless there was some indication that they could not land safely, and did not abort approaches simply because they did not meet the standard definition of “stabilized.” Therefore, pilots effectively operated on a different set of guiding principles than the ones that were officially in place. Once again, the design of the system did not seem to take human nature into account.
The entire sequence of events leading up to the crash pointed to a phenomenon that the Dutch Safety Board called “automation surprise.” When an “automation surprise” occurs, the automation acts in ways that pilots do not expect, and they miss cues that predict its actions. The crew of flight 1951 had no way of knowing that the autothrottle sourced its altitude data from the captain’s radio altimeter only, and also had no way of knowing that this altimeter’s faulty reading would cause it to enter retard flare mode. *The fact that they were not anticipating a mode change significantly reduced their chances of noticing it.* These obscure workings of the autothrottle system were not in the operations manual, and the 737’s Quick Reference Handbook — the booklet the gives procedures for abnormal situations — had nothing to say about a radio altimeter failure. The result was that the pilots’ frame of mind differed from the actual rules under which their plane was now operating. This also contributed to the failure to immediately hold the throttle levers at maximum power after the stick shaker went off. Based on what they thought they knew about the situation, the possibility that the computer might pull the throttles back to idle during a stall recovery never crossed their minds.
There was also a certain amount of bad luck that separated flight 1951 from other incidents involving the accidental activation of retard flare mode. Had the retard flare mode not engaged right when the pilots were expecting engine power to decrease for unrelated reasons, they would have immediately realized there was a problem. This also could have been avoided if they were not following a “slam dunk” approach, which was not technically allowed under Dutch regulations. Even more unfortunate was the fact that the third pilot, who was on board specifically to monitor things the other pilots might miss, also failed to notice the mounting warning signs. He was subject to the exact same human pitfalls as the other pilots, and could not monitor airspeed or predict autothrottle modes any better than the others.
As a result of the investigation’s initial findings, Boeing issued several bulletins with advice on how to fix the recurring radio altimeter problems on the 737, and another warning pilots that retard flare mode could engage as a result of the bad altitude readings. Turkish Airlines added more training including an extra simulator session involving low-altitude stall recovery. In its final report, the Safety Board recommended that Boeing find a way to make its radio altimeters more reliable; that the autothrottle logic be redesigned to prevent the sort of failure that occurred on flight 1951; that relevant agencies consider mandating an audible low airspeed warning; and that airlines include stall recovery in their recurrent training for line pilots. The Safety Board also addressed a problem with reporting mechanisms. During the investigation they found that only a small fraction of radio altimeter failures were reported to airlines or to Boeing, and recommended that some way be found to ensure better reporting rates. Ultimately, the issues at play in the crash of Turkish Airlines flight 1951 transcend any individual accident, and the debate over how best to ensure that humans and automation work together effectively continues to this day. This accident is a perfect example of a case where neither pilot error nor mechanical failure can by itself account for the outcome. Rather, a series of coincidences led to disaster inside the context of a system that hindered the pilots’ ability to recognize the danger that they were in, until it was too late.
To find the full collection of over 100 plane crash analyses, visit r/admiralcloudberg on Reddit. Thank you for reading!
