PILOT ERROR AND ACCIDENT CASE STUDIES

-Vikash K Thakur

Pilot error (sometimes called cockpit error) is a term used to describe the
cause of an accident involving an airworthy aircraft where the pilot is
considered to be principally or partially responsible. Pilot error can be
defined as a mistake, oversight, lapse in judgment, or failure to exercise due
diligence by an aircraft operator during the performance of his/her duties.

Usually in an accident deemed due to "pilot error", the pilot in

command (Captain) made the error unintentionally. However, an intentional
disregard for a standard operating procedure (or warning) is still considered
pilot error, even if the pilot's actions justified criminal charges.

An aircraft operator (airline or aircraft owner) is generally not held

accountable for an incident that is principally due to a mechanical failure of
the aircraft unless the mechanical failure occurred as a result of pilot error.

The pilot may be declared to be in error even during adverse weather

conditions if the investigating body deems that the pilot did not exercise due
diligence. The responsibility for the accident in such a case would depend
upon whether the pilot could reasonably know of the danger and whether he
or she took reasonable steps to avoid the weather problem. Flying into a
hurricane (for other than legitimate research purposes) would be considered
pilot error; flying into a microburst would not be considered pilot error if it
was not detectable by the pilot, or in the time before this hazard was
understood. Some weather phenomena (such as clear-air turbulence or
mountain waves) are difficult to avoid, especially if the aircraft involved is
the first aircraft to encounter the phenomenon in a certain area at a certain
time.

One of the most famous incidents of an aircraft disaster attributed to

pilot error was the crash of Eastern Air Lines Flight 401 near Miami, Florida
on December 29, 1972. The pilot, co-pilot, and Flight Engineer had become
fixated on a faulty landing gear light and had failed to realize that the
autopilot buttons had been bumped by one of the crew altering the settings
from level flight to a slow descent. The distracted flight crew did not notice
the plane losing height and the aircraft eventually struck the ground in the
Everglades, killing 101 out of 176 passengers and crew.

The subsequent National Transportation Safety Board (NTSB) report on

the incident blamed the flight crew for failing to monitor the aircraft's
instruments properly. Details of the incident are now frequently used as a
case study in training exercises by aircrews and air traffic controllers.

Placing pilot error as a cause of an aviation accident is often

controversial. For example, the NTSB ruled that the crash of American
Airlines Flight 587 was due to the failure of the rudder which was caused by
"unnecessary and excessive rudder pedal inputs" on the part of the co-pilot
who was operating the aircraft at the time. Attorneys for the co-pilot, who
was killed in the crash, argue that American Airlines' pilots had never been
properly trained concerning extreme rudder inputs. The attorneys also
claimed that the rudder failure was actually caused by a flaw in the design of
the Airbus A300 aircraft and that the co-pilot's rudder inputs should not have
caused the catastrophic rudder failure that led to the accident that killed 265
people.

During 2004 in the United States, pilot error was listed as the primary
cause of 78.6% of fatal general aviation accidents, and as the primary cause
of 75.5% of general aviation accidents overall. For scheduled air transport,
pilot error typically accounts for just over half of worldwide accidents with a
known cause.

Human Error

To understand the problem of aviation judgment it is helpful to look at

human error and the human information processing system. Our awareness
of the 'human error problem' in aviation began when cockpit voice
recordings of pilot communications prior to fatal accidents revealed the
enormous factor played by human error in accidents. The result was a very
large proportion of accidents that were listed as 'pilot error'. Pilots have long
been dismayed by the use of this term to describe their failures because it
sounds as if the pilot was negligent in someway. In most circumstances that
have resulted in pilot error accidents, the pilots involved were putting forth
their best efforts to fly safely. to say that an accident was caused by pilot
error and go no further is no better than saying that a mechanical failure
accident was caused by the airplane. In both cases we are obligated to look
further into the reasons for the pilot or mechanical failure that led to the
accident. Obviously, mechanical failures are easier to trace because there is
usually an abundance of physical evidence to show the way. The reasons for
pilot failures are more difficult to discover but they usually can be found as
well, if one is willing to use psychological and sociological expertise and
probe into the behaviour and thought patterns of crew involved.

Pilot Error Definition

Human error may be defined as, 'any human activity that fails to accomplish
the intended outcome'. In continuous controlled flying we are always
comparing intended or desired outcome with actual outcome. As these the
actual outcome departs from intended outcome, we notice it, make a
decision, and act by moving the controls to bring the two closer together. I
fact, straight and level flight can be defined as a series of error correction
maneuvers. To err is human, to correct errors is what flying is about. Why is
it so much easier for pilots to accept that they make these types of control
errors and so hard to accept judgmental errors? Pilots, who don't want to
admit to any weaknesses, sometime define pilot error in curious ways.

What types of errors do pilots make?

Paul M. Fitts, a pioneer in aviation factors, together with Jones, saw that
many aircraft accidents in the US military were being caused by pilot and
sought answers to determine why. Believing that at least a part of the reason
for the pilot error accidents was in the design and location of the cockpit
instruments and controls, he surveyed pilots asking them what types of
errors they had made or observed other pilots make during their experience
as aviators, In all, pilots reported 270 different types of instrument reading
errors and 460 different types of control errors.

Control errors were classified as follows:

Substitution errors: Confusing one control with another (for example,

Confusing flap and gear controls).

Adjustment errors: Operating a control too rapidly or too slowly,

moving a switch to the wrong position, or following a wrong sequence in
operating several controls (for example, turning fuel selector to wrong tank).

Forgetting errors: Failing to check, unlock, or use a control at the

proper time (for example, taking off without flaps to take off position).

Reversal errors: Moving a control in a direction opposite to that

necessary to produce the desired results (for example, moving trim control in
the wrong direction).

Unintentional activation: Inadvertently operating a control without

being aware of it.

Instrument reading errors were classified as follows:

Misreading errors: Multi-indicator instruments (for example Misreading

3 pointer altimeter by more than 1000 ft)

Reversal errors: Reversing the interpretation of an instrument

indication (for example Misinterpretation of gyro compass)

Signal interpretation errors: Misinterpretation of message conveyed by

sound or light warning (for example Interpretation of stall warning as
landing configuration warning)

Legibility errors: Errors resulting from difficulty in seeing the numbers

or scales distinctly

Substitution errors: Mistaking one instrument for another (for example

Confusing Manifold pressure and Tachometer)

Using an inst. That is inoperative unknowingly accepting as valid the

indication of inst. that is not reliable.

Scale interpretation error: Errors that result from difficulty in

interpolating between number gradations of scale.

Errors due to illusions: Misconception due to conflict between body

sensations and inst. indication and errors due to visual illusions in poor
weather.

Forgetting errors: Failing to check inst. prior to TAKE OFF or during

flight.

These two classes of pilot errors, identified by Fitts and Jones were
enormously important to the refinement of the cockpit inst. panel. One of the
result of the study was the basic "T" arrangement of flight inst. as shown
below that has been the cornerstone of standardization in the cockpit since
the late 1940's.The focal point of the arrangement is the attitude indicator
which is the inst. on which pilots spend most of their visual attention time.
The other three inst. serve as conformation sources of information and take
on more or less importance depending on the maneuver being performed.

Airspeed Indicator Attitude indicator

Altimeter

Direction indicator

A second development to come out of the two classes of pilot errors

published by Fitts and Jones was a host of human factors research studies to
determine how to design inst. and controls for pilots, in particular, but also
for people in general who are controlling machines. It is important in human
machine interface design to take advantage of learn stereotypic behavior to
minimize the amount of training necessary. For example we learn through
our development years that when we see something deviate from where it
should be, we move it back in the opposite direction. Naturally, then when
people get to cockpit of an airplane and see a symbol deviating from center,
the natural response is to move the controls in the opposite direction to
bring it back. This is known as 'Control Display Compatibility' and is one of
the basic tenets of display and control design in field of human factors.

Human Performance and Limitations

All flight crew who have studied for PPL or ATPL should already be
reasonably familiar
with the theory of Human Performance and Limitations (HPL) and, in
particular the
basic aviation psychology, applicable to flying. CRM requires a reasonable
understanding of such concepts as human information processing, attention
and
vigilance, decision making, communication, arousal and stress, and
personality
differences. It is important to appreciate that all humans have both physical
and
cognitive limitations, and to understand something about the nature of those
limitations with respect to themselves and also to other crew members when
flying
in a multi-crew situation.

Basic Theory
ICAO has, in many of its publications, based its descriptions of human factor
around a model known as the SHELL model.
S = Software (procedures, Ops manual, etc.), H = Hardware (Cockpit layout,
aircraft
design, etc.); E = Environment (weather, day/night, unfamiliar aerodrome,
busy TMA,
etc.); L = Liveware (the person or people).

Human Performance and Limitations is sometimes used as a term to

describe all
human factors issues (i.e. all the elements of the SHELL model), and at other
times,
to describe only those human factors aspects directly relating to the
performance of
individuals (i.e. only the "liveware" element of the SHELL model). There are
various
taxonomies which exist, listing the elements which are considered to be
human
performance and limitations, although it should be said that these are
generally
derived from those taxonomies used for military pilots and tend to favour the
physiological aspects of performance. What is important is not to worry too
much
about which 'categories' the various aspects of human factors come under
but,
rather, to ensure that CRM training covers all those areas which are relevant,
and to
the appropriate level of detail.

ICAO Human Performance Training Curriculum for Pilots

The following text has been taken from the ICAO Human Factors Training
Manual,
Doc 9683 (1998).

Module 1: Introduction to Human Factors in Aviation

In this module, the rationale for Human Factors training should be explained.
A good
point of departure is the fact that since 1940, three out of four accidents
have had at
least one contributory factor relating to human performance.
The introduction has to be carefully prepared in order to capture the pilot’s
interest. It
is desirable that training directed at meeting any examination or test
requirement
associated with the revised Annex 1 be kept relevant to operational aspects
of flight.
A practical orientation is therefore essential to effective training. The
relevance of the
programme must be made quite clear to pilots – this is not intended as an
academic
exercise. Therefore, only that information which relates to pilot performance
should
be included. Training personnel should present the information according to
their
particular operational needs and may wish to take specific aspects of their
local
accident/incident experience into account.
The SHELL model might be usefully introduced in this module as one of the
possible
aids to understanding the interactions between the different components of
the
system, as well as the potential for conflict and error arising from the various
mismatches which can occur in practice.
The SHELL concept (the name being derived from the initial letters of its
components,
Software, Hardware, Environment, Liveware) was first developed by Edwards
in
1972, with a modified diagram to illustrate the model developed by Hawkins
in 1975.
For those familiar with the long-established concept of”man-machine-
environment”
(now referred to as”human-machine-environment”), the following
interpretations are
suggested: liveware (human), hardware (machine) and software (procedures,
symbology, etc.), environment (the situation in which the L-H-S system must
function). This building block diagram does not cover the interfaces which
are outside
Human Factors (hardware-hardware; hardware-environment; software-
hardware) and
is only intended as a basic aid to understanding Human Factors.

Module 2: The Human Element (Aviation Physiology)

Breathing; recognizing and coping with:
• hypoxia
• hyperventilation
Pressure effects; effects on ears, sinuses and closed cavities of:
• trapped or evolved gases
• decompression
• underwater diving
Limitations of the senses
• visual
• aural
• vestibular
• proprioceptive
• tactile
Acceleration effects; positive and negative”G’s”
• aggravating conditions
Disorientation
• visual illusions
• vestibular illusions
• coping mechanisms
Fatigue/alertness
• acute
• chronic
• the effects on skill and performance
Sleep disturbances and deficits
• Circadian dysrhythmia/ jet lag
• Personal health
Effects of:
• diet/nutrition
• alcohol
• drugs (including nicotine/caffeine)
• medications (prescribed; over-the-counter)
• blood donations
• aging
Psychological fitness/stress management
Pregnancy

Module 3: The Human Element (Aviation Psychology)

Human errors and reliability
Workload (attention and information processing)
• perceptual
• cognitive
Information processing
• mind set and habit patterns
• attention and vigilance
• perceptual limitations
• memory
Attitudinal factors
• personality
• motivation
• boredom and complacency
• culture
Perceptual and situational awareness
Judgement and decision-making
Stress
• symptoms and effects
• coping mechanisms
Skills/experience/currency vs. proficiency

Module 4: Liveware-Hardware: Pilot-equipment Relationship

Controls and displays
• design (movement, size, scales, colour, illumination, etc.)
• common errors in interpretation and control
•”glass” cockpits; information selection
• habit patterns interference/design standardisation
Alerting and warning systems
• appropriate selection and set-up
• false indications
• distractions and response
Personal comfort
• temperature, illumination, etc.
• adjustment of seat position and controls
Cockpit visibility and eye-reference position
Motor workload

Module 5: Liveware-Software: Pilot-software Relationship

Standard operating procedures
• rationale
• benefits
• derivation from human limitations and the accident/incident record
Written materials/software
• errors in the interpretation and use of maps/charts
• design principles and correct use of checklists and manuals
• The four 'P's (philosophies, policies, procedures, practices)
Operational aspects of automation
• overload/underload and phase of flight; complacency and boredom
• staying in the loop/situational awareness
• automated in-flight equipment; appropriate use, effective task allocation,
maintenance of basic flying skills

Module 6: Liveware-Liveware: Interpersonal Relations

NOTE: Liveware-Liveware deals with interpersonal contacts happening at
the present time
(here and now), as opposed to the interpersonal contacts involving people
outside
of the current operating situation (the latter are considered in Module 7).
Factors influencing verbal and non-verbal communication between and with:
• flight deck crew
• cabin crew
• maintenance personnel
• company management/flight operations control
• air traffic services
• passengers
How verbal and non-verbal communication affects information transfer and
thus
safety and efficiency of flight
Crew problem solving and decision-making
Introduction to small group dynamics/crew management (see also ICAO
Circular 217
for further information on this topic).

Module 7: Liveware-Environment: The Operating Environment

• A systemic view of safety
• The aviation system: components
• General models of organisational safety
• Organisations structures and safety
• Culture and safety
• Procedures and safety
• Safe and unsafe organisations

Human Error, Reliability and Error

Management

The science of Human Factors accepts the fact that human error is
inevitable - what
is important is to ensure that human error does not result in adverse events
such as
air accidents. This can be addressed in two ways: reducing errors in the first
place,
and controlling errors such that they, or their immediate effects, are
detected early
enough to allow remedial action. CRM addresses both types of mitigating
strategies,
but concentrates particularly on error detection, especially in the multi-crew
situation.

Human reliability is the science which looks at the vulnerability of

human beings to
make errors (or less than perfect performance) under different
circumstances. One
could argue that it is more of an art than a science, since it is very difficult to
predict,
in quantifiable terms, human reliability in different situations, and from
individual to
individual. However, there are certain conditions under which humans are
more likely
to make errors (e.g. during circadian lows, when stressed, when overloaded,
etc.), but
these will be covered in other Appendices rather than under "human
reliability" as
such. If readers wish to find further information on the science of human
reliability, a
few references are included at the end of this Appendix.

The following text, which draws heavily from Professor James Reason's book
"Human Error", explains some of the basic theory of human error.

Basic Theory

Introduction to Human Error

It has long been acknowledged that human performance is at times

imperfect. Nearly
two thousand years ago, the Roman philosopher Cicero cautioned “It is the
nature of
man to err”. It is an unequivocal fact that whenever men and women are
involved in
an activity, human error will occur at some point.

In his book “Human Error”, Professor James Reason defines error as follows:
“Error will be taken as a generic term to encompass all those occasions
in which a planned sequence of mental or physical activities fails to
achieve its intended outcome, and when these failures cannot be
attributed to the intervention of some chance agency”.

Error Models and Theories

To appreciate the types of error that it is possible to make, researchers have
looked
at human error in a number of ways and proposed various models and
theories. These
attempt to capture the nature of the error and its characteristics. To
illustrate this, the
following models and theories will be briefly highlighted:
• design- versus operator-induced errors;
• variable versus constant errors;
• reversible versus irreversible errors;
• slips, lapses and mistakes;
• skill-, rule- and knowledge-based behaviours and associated errors;
• the ‘Swiss Cheese Model’.

Design- Versus Operator-Induced Errors

In aviation, emphasis is often placed upon the error(s) of the front line
operators, who
may include flight crew, air traffic controllers and aircraft maintenance
engineers.
However, errors may have been made before an aircraft ever leaves the
ground, by
aircraft designers. This may mean that, even if an aircraft is maintained and
flown as
it is designed to be, a flaw in its original design may lead to operational
safety being
compromised. Alternatively, flawed procedures put in place by airline,
maintenance
organisation or air traffic control management may also lead to operational
problems.
It is common to find when investigating an incident or accident that more
than one
error has been made and often by more than one person. The ‘error chain’
captures
this concept. It may be that, only when a certain combination of errors arise
and error
‘defences’ breached (see the ‘Swiss Cheese Model’) will safety be
compromised.

Variable Versus Constant Errors

In his book “Human Error”, Professor Reason discusses two types of human
error:
variable and constant errors. The implication is that constant errors may be
predicted and therefore controlled, whereas variable errors cannot be
predicted and
are much harder to deal with. If we know enough about the nature of the
task, the
environment it is performed in, the mechanisms governing performance, and
the
nature of the individual, we have a greater chance of predicting an error.

However, it is rare to have enough information to permit accurate

predictions; we can
generally only predict along the lines of “fatigued pilots are more likely to
make errors
than alert pilots”, or “The SOPs for task X on aircraft type Y is known as
being
ambiguous and likely to result in pilot error”. It is possible to refine these
predictions
with more information (e.g. The SOPs in Operator Z's QRH are known as
being ambiguous), but there will always be random errors or elements which
cannot be
predicted.

Reversible Versus Irreversible Errors

Another way of categorising errors is to determine whether they are
reversible or
irreversible. The former can be recovered from, whereas the latter typically
cannot be.
For example, if a pilot miscalculates the fuel he should carry, he may have to
divert to
a closer airfield, but if he accidentally dumps his fuel, he may not have many
options
open to him.
A well designed system or procedure should mean that errors made by flight
crew
are reversible. Thus, if a flight crew member incorrectly selects fuel feed
which
results in an imbalance, the aircraft systems should generate an appropriate
alert.

Slips, Lapses, Mistakes and Violations

Professor Reason highlights the notion of ‘intention’ when considering the
nature of
error, asking the questions:
• Were the actions directed by some prior intention?
• Did the actions proceed as planned?
• Did they achieve their desired end?

Slips can be thought of as actions not carried out as intended or planned,

e.g. ‘finger
trouble’ when dialling in a frequency or ‘Freudian slips’ when saying
something.
Lapses are missed actions and omissions, i.e. when somebody has failed to
do
something due to lapses of memory and/or attention or because they have
forgotten
something, e.g. forgetting to lower the undercarriage on landing.
Mistakes are a specific type of error brought about by a faulty plan/intention,
i.e.
somebody did something believing it to be correct when it was, in fact,
wrong, e.g.
switching off the wrong engine.
Slips typically occur at the task execution stage, lapses at the storage
(memory) stage
and mistakes at the planning stage.
Violations sometimes appear to be human errors, but they differ from slips,
lapses
and mistakes because they are deliberate ‘illegal’ actions, i.e. somebody did
something knowing it to be against the rules (e.g. deliberately failing to
follow proper
procedures). A pilot may consider that a violation is well-intentioned, e.g.
electing not
to climb in response to a TCAS RA, if he is certain that the other aircraft has
already
initiated avoiding action. There is great debate about whether flight crew
should
follow SOPs slavishly, or should elect to diverge from SOPs from time to time.
Whatever the case, and however well-intentioned, this would still technically
constitute a 'violation' rather than an error.

Skill-, Rule- and Knowledge-Based Behaviours and Associated Errors

Human behaviour can generally be broken down into three distinct
categories: skill based,
rule-based and knowledge-based behaviour.
Each of these behaviour types have specific errors associated with them.
Examples of skill-based errors are action slips, environmental capture and
reversion.
Action slips as the name implies are the same as slips, i.e. an action not
carried out
as intended. The example may consist of a pilot intending to key in FL110
into the FMS but keying in FL100 by mistake, after having been distracted by
a query from his co-pilot.
Environmental capture may occur when a pilot carries out a certain task very
frequently in a certain location. Thus, a pilot used to reaching for a certain
switch to
select function A on an Airbus A320, may inadvertently select the same
switch on an
Airbus 321 when, in fact, it has a different function.
Reversion can occur once a certain pattern of behaviour has been
established,
primarily because it can be very difficult to abandon or unlearn it when it is
no longer
appropriate. Thus, a pilot may accidentally carry out a procedure that he has
used for
years, even though it has been recently revised. This is more likely to
happen when
people are not concentrating or when they are in a stressful situation.
Reversion to
originally learned behaviour is not uncommon under stress.
Rule-based behaviour is generally fairly robust and this is why the use of
procedures
and rules is emphasised in aircraft maintenance. However, errors here are
related to
the use of the wrong rule or procedure. For example, a pilot may
misdiagnose a fault
and thus apply the wrong SOP, thus not clearing the fault. Errors here are
also
sometimes due to faulty recall of procedures. For instance, not remembering
the
correct sequence when performing a procedure.
Errors at the knowledge-based performance level are related to incomplete
or
incorrect knowledge or interpreting the situation incorrectly. An example of
this might
be when a pilot makes an incorrect diagnosis of a situation without having a
full
understanding of how the aircraft systems work. Once he has made such a
diagnosis,
he may well look for information to confirm his (mis) understanding, while
ignoring
evidence to the contrary (known as confirmation bias).

Violations
It is a fact of life that violations occur in aviation operations. Most stem from
a genuine
desire to do a good job. Seldom are they acts of laziness or incompetence.
There are three types of violations:
• Routine violations;
• Situational violations;
• Optimising violations.

Routine violations are things which have become ‘the normal way of doing
something’ within the person’s work group (e.g. flight crew from one
company base).
They can become routine for a number of reasons: flight crew may believe
that
procedures may be over prescriptive and violate them to simplify a task
(cutting
corners), to save time and effort. This rarely happens in flight operations,
since flying
tasks are so proceduralised, but it is not unusual to see these types of
violations in
maintenance engineering.

Situational violations occur due to the particular factors that exist at the
time, such
as time pressure, high workload, unworkable procedures, poorly designed
man machine
interface in the cockpit. These occur often when, in order to get the job
done, pilots consider that a procedure cannot be followed.

Optimising violations involve breaking the rules for ‘kicks’. These are
often quite
unrelated to the actual task. The person just uses the opportunity to satisfy a
personal
need. Flying an illegal circuit over a friend's house might be an example.
Time pressure and high workload increase the likelihood of all types of
violations
occurring. People weigh up the perceived risks against the perceived
benefits,
unfortunately the actual risks can be much higher.

Error Management

One of the key concepts associated with error management is that of

"defences in
depth", based on the premise that there are many stages in any system
where errors
can occur, and similarly many stages where defences can be built to prevent
and trap
errors. Professor James Reason covers error management in his book
"Human Error".

Reason's ‘Swiss Cheese Model’

In his research, Reason has highlighted the concept of ‘defences’ against
human error
within an organisation, and has coined the notion of ‘defences in depth’.
Examples of
defences are pre-flight checks, automatic warnings, challenge-response
procedures,
etc., which help prevent to ‘trap’ human errors, reducing the likelihood of
negative
consequences. It is when these defences are weakened and breached that
human
errors can result in incidents or accidents. These defences have been
portrayed
diagrammatically, as several slices of Swiss cheese (and hence the model
has
become known as Professor Reason’s “Swiss cheese” model)

Some failures are 'latent', meaning that they have been made at some point
in the
past and lay dormant. This may be introduced at the time an aircraft was
designed or
may be associated with a management decision. Errors made by front line
personnel,
such as flight crew, are ‘active’ failures. The more holes in a system’s
defences, the
more likely it is that errors result in incidents or accidents, but it is only in
certain
circumstances, when all holes ‘line up’, that these occur. Usually, if an error
has
breached the design or engineering defences, it reaches the flight operations
defences (e.g. in flight warning) and is detected and handled at this stage.
However,
occasionally in aviation, an error can breach all the defences (e.g. a pilot
ignores an in
flight warning, believing it to be a false alarm) and a catastrophic situation
ensues.

Error Detection and Prevention

The concept of redundancy should be applied at all stages of the aviation
system,
never assuming that one single mechanism, especially if human, will detect
and
prevent an error. CRM provides a form of redundancy in that it emphasises
the role
of the second pilot to check what the first pilot has done. There is a potential
danger
with independent checks that the second person will trust the first person
not to have
done anything wrong, and therefore not to carry out the second check
properly. CRM
dual checking is one of the last lines of defence, especially if no automatic
system
checks and alerts are present, and pilots should always be alert for the
possibility that
their colleague may have made an error, when carrying running through
SOPs which
require challenge-response checks, no matter how much they might trust
and
respect the other pilot. Similarly, the pilot carrying out the first action should
never
become complacent and rely upon the other pilot detecting an error. (The
same
applies with pilot-ATC communications, and read backs). It is essential to
remember
that we are all human therefore we all make mistakes from time to time, so
assume
the worst.

Sensory illusions in aviation

Because human senses are adapted for use on the ground, navigating by
sensory input alone during flight can be dangerous: sensory input does not
always accurately reflect the movement of the aircraft, causing sensory
illusions. These illusions can be extremely dangerous for pilots.

Vestibular system
Fluid in the inner ear reacts only to rate of change, not a sustained change.
For example, if a pilot initiates a banking left turn, the inner ear will detect
the roll into the turn, but if the turn is held constant, the inner ear will
compensate and rather quickly, although inaccurately, report to the brain
that it has returned to level flight.

As a result, when the pilot finally levels the wings, that new change will
cause the inner ear to produce signals that produce the perception of
banking to the right. This is the crux of the problem experienced by pilots
flying without instruments in low-visibility weather. Even the best pilots will
quickly become disoriented if they attempt to fly without instruments when
there are no external visual references, because vision provides the
predominant and coordinating sense that humans rely upon for stability.
Perhaps the most treacherous thing under such conditions is that the signals
the inner ear produces are incorrect though they may feel right.

These sensory illusions occur because flight is an unnatural environment; our

senses are not capable of providing reliable signals that we can interpret and
relate to our position in three dimensions without visual reference.

Vestibular/somatogyral illusions

llusions involving the semicircular and somatogyral canals of the vestibular

system of the ear occur primarily under conditions of unreliable or
unavailable external visual references and result in false sensations of
rotation. These include the leans, the graveyard spin and spiral, and the
coriolis illusion.

The leans

This is the most common illusion during flight, and is caused by a sudden
return to level flight following a gradual and prolonged turn that went
unnoticed by the pilot. The reason a pilot can be unaware of such a gradual
turn is that human exposure to a rotational acceleration of 2 degrees per
second squared or lower is below the detection threshold of the semicircular
canals. Leveling the wings after such a turn may cause an illusion that the
aircraft is banking in the opposite direction. In response to such an illusion, a
pilot may lean in the direction of the original turn in a corrective attempt to
regain the perception of a correct vertical posture.

Graveyard spin

The graveyard spin is an illusion that can occur to a pilot who enters a spin.
For example, a pilot who enters a spin to the left will initially have a
sensation of spinning in the same direction. However, if the left spin
continues the pilot will have the sensation that the spin is progressively
decreasing. At this point, if the pilot applies right rudder to stop the left spin,
the pilot will suddenly sense a spin in the opposite direction (to the right).

If the pilot believes that the airplane is spinning to the right, the response
will be to apply left rudder to counteract the sensation of a right spin.
However, by applying left rudder the pilot will unknowingly re-enter the
original left spin. If the pilot cross-checks the turn indicator, he would see the
turn needle indicating a left turn while he senses a right turn. This creates a
sensory conflict between what the pilot sees on the instruments and what
the pilot feels. If the pilot believes the body sensations instead of trusting the
instruments, the left spin will continue. If enough altitude is lost before this
illusion is recognized and corrective action is not taken, impact with terrain is
inevitable.

Graveyard spiral

The graveyard spiral is more common than the graveyard spin, and it is
associated with a return to level flight following a prolonged bank turn. For
example, a pilot who enters a banking turn to the left will initially have a
sensation of a turn in the same direction. If the left turn continues (for more
than about 20 seconds), the pilot will experience the sensation that the
airplane is no longer turning to the left. At this point, if the pilot attempts to
level the wings this action will produce a sensation that the airplane is
turning and banking in the opposite direction (to the right). If the pilot
believes the illusion of a right turn (which can be very compelling), he will re-
enter the original left turn in an attempt to counteract the sensation of a
right turn.

Unfortunately, while this is happening, the airplane is still turning to the left
and losing altitude. Pulling the control yoke/stick and applying power while
turning would not be a good idea because it would only make the left turn
tighter. If the pilot fails to recognize the illusion and does not level the wings,
the airplane will continue turning left and losing altitude until it hits the
ground.

Coriolis illusion

This involves the simultaneous stimulation of two semicircular canals and is

associated with a sudden tilting (forward or backwards) of the pilot's head
while the aircraft is turning. This can occur when tilting the head down (to
look at an approach chart or to write on the knee pad), or up (to look at an
overhead instrument or switch) or sideways. This can produce an
overpowering sensation that the aircraft is rolling, pitching, and yawing all at
the same time, which can be compared with the sensation of rolling down a
hillside. This illusion can make the pilot quickly become disoriented and lose
control of the aircraft.

Vestibular/somatogravic illusions

Somatogravic illusions are caused by linear accelerations. These illusions

involving the utricle and the saccule of the vestibular system are most likely
under conditions with unreliable or unavailable external visual references.

Inversion illusion

An abrupt change from climb to straight-and-level flight can stimulate the

otolith organs enough to create the illusion of tumbling backwards, or
inversion illusion. The disoriented pilot may push the aircraft abruptly into a
nose-low attitude, possibly intensifying this illusion.

Head-up illusion

The head-up illusion involves a sudden forward linear acceleration during

level flight where the pilot perceives the illusion that the nose of the aircraft
is pitching up. The pilot's response to this illusion would be to push the yoke
or the stick forward to pitch the nose of the aircraft down. A night take-off
from a well-lit airport into a totally dark sky (black hole) or a catapult take-off
from an aircraft carrier can also lead to this illusion, and could result in a
crash.

Head-down illusion

The head-down illusion involves a sudden linear deceleration (air braking,

lowering flaps, decreasing engine power) during level flight where the pilot
perceives the illusion that the nose of the aircraft is pitching down. The
pilot's response to this illusion would be to pitch the nose of the aircraft up. If
this illusion occurs during a low-speed final approach, the pilot could stall the
aircraft.

Visual illusions

Visual illusions are familiar to most of us. As children, we learned that

railroad tracks — contrary to what our eyes might tell us — don't come to a
point at the horizon. Even under conditions of good visibility, one can
experience visual illusions.

Linear perspective illusions

This illusion may make a pilot change (increase or decrease) the slope of his
final approach. They are caused by runways with different widths, upsloping
or downsloping runways, and upsloping or downsloping final approach
terrain. Pilots learn to recognize a normal final approach by developing and
recalling a mental image of the expected relationship between the length
and the width of an average runway.

Upsloping terrain or narrow or long runway

A final approach over an upsloping terrain with a flat runway, or to an

unusually narrow or long runway may produce the visual illusion of being too
high on final approach. The pilot may then pitch the aircraft's nose down to
decrease the altitude, potentially resulting in dropping short of the runway at
high speed.

Downsloping terrain or wide runway

A final approach over a downsloping terrain with a flat runway, or to an

unusually wide runway may produce the visual illusion of being too low on
final approach. The pilot may then pitch the aircraft's nose up to increase the
altitude, which can result in a low-altitude stall or a missed approach.

Other visual illusions

Black-hole approach illusion

A black-hole approach illusion can happen during a final approach at night

(no stars or moonlight) over water or unlit terrain to a lighted runway beyond
which the horizon is not visible. If the pilot has no peripheral visual cues to
be oriented relative to the earth, there may be the illusion of being upright
and the runway itself to be tilted and sloping.

A particularly hazardous black-hole illusion involves approaching a runway

under conditions with no lights before the runway and with city lights or
rising terrain beyond the runway. These conditions may produce the visual
illusion of being too high on final approach, resulting in pitching the aircraft
nose down to decrease the perceived approach angle.

Autokinetic illusion

The autokinetic illusion gives the pilot the impression that a stationary object
is moving in front of the airplane's path; it is caused by staring at a fixed
single point of light (ground light or a star) in a totally dark and featureless
background. This illusion can cause a misperception that such a light is on a
collision course with the aircraft.

False visual reference illusions

False visual reference illusions may cause the pilot to orient the aircraft in
relation to a false horizon; these illusions can be caused by flying over a
banked cloud, night flying over featureless terrain with ground lights that are
indistinguishable from a dark sky with stars, or night flying over a featureless
terrain with a clearly defined pattern of ground lights and a dark, starless
sky.

Vection illusion

This is when the brain perceives peripheral motion, without sufficient other
cues, as applying to itself. Consider the example of being in a car in lanes of
traffic, when cars in the adjacent lane start creeping slowly forward. This can
produce the perception of actually moving backwards, particularly if the
wheels of the other cars are not visible. A similar illusion can happen while
taxiing an aircraft.
 Spatial disorientation
Spatial disorientation is a condition in which an aircraft pilot's perception of
direction (proprioception) does not agree with reality. While it can be brought
on by disturbances or disease within the vestibular system, it is more
typically a temporary condition resulting from flight into poor weather
conditions with low or no visibility. Under these conditions the pilot may be
deprived of an external visual horizon, which is critical to maintaining a
correct sense of up and down while flying.

A pilot who enters such conditions will quickly lose spatial orientation if there
has been no training in flying with reference to instruments. Approximately
80% of the private pilots in the United States do not have an instrument
rating, and therefore are prohibited from flying in conditions where
instrument skills are required. Not all pilots abide by this rule, and
approximately 40% of the NTSB fatal general aviation accident reports list
continuation of flight into conditions for which the pilot was not qualified as a
cause.

Senses during flight

During the abnormal acceleratory environment of flight, the vestibular and

proprioceptive systems do not respond veridically. Because of inertial forces
created by acceleration of the aircraft along with centrifugal force caused by
turning, the net gravitoinertial force sensed primarily by the otolith organs is
not aligned with gravity, leading to perceptual misjudgment of the vertical. In
addition, the inner ear contains rotational "accelerometers," known as the
semicircular canals, which provide information to the lower brain on
rotational accelerations in the pitch, roll and yaw axes. However, prolonged
rotation (beyond 15-20 s) results in a cessation of semicircular output, and
cessation of rotation thereafter can even result in the perception of motion in
the opposite direction. Under ideal visual conditions, the above illusions are
unlikely to be perceived but at night or in weather, the visual inputs are no
longer capable of overriding these illusory nonvisual sensations. In many
cases, illusory visual inputs such as a sloping cloud deck can also lead to
misjudgments of the vertical and of speed and distance or even combine
with the nonvisual ones to produce an even more powerful illusion. The
result of these various visual and nonvisual illusions is spatial disorientation

Effects of disorientation

Once an aircraft enters conditions under which the pilot cannot see a distinct
visual horizon, the drift in the inner ear continues uncorrected. Errors in the
perceived rate of turn about any axis can build up at a rate of 0.2 to 0.3
degrees per second. If the pilot is not proficient in the use of gyroscopic flight
instruments, these errors will build up to a point that control of the aircraft is
lost, usually in a steep, diving turn known as a graveyard spiral. During the
entire time, leading up to and well into the maneuver the pilot remains
unaware that he is turning, believing that he is maintaining straight flight.

The graveyard spiral usually terminates when the g-forces on the aircraft
build up to and exceed the structural strength of the airframe, resulting in
catastrophic failure, or when the aircraft contacts the ground. In a 1954
study, the Air Safety Foundation found that out of 20 non-instrument-rated
subject pilots, 19 of the 20 entered a graveyard spiral soon after entering
simulated instrument conditions. The 20th pilot also lost control of his
aircraft, but in another maneuver. The average time between onset of
instrument conditions and loss of control was 178 seconds.

Spatial disorientation can also affect instrument-rated pilots in certain

conditions. A powerful tumbling sensation (vertigo) can be set up if the pilot
moves his head too much during instrument flight. This is called the Coriolis
illusion. Pilots are also susceptible to spatial disorientation during night flight
over featureless terrain.

Spatial Orientation

Spatial orientation is our ability to maintain our body orientation and/or

posture in relation to the surrounding environment (physical space) at rest
and during motion. Humans are designed to maintain spatial orientation on
the ground. The three-dimensional environment of flight is unfamiliar to the
human body, creating sensory conflicts and illusions that make spatial
orientation difficult and sometimes impossible to achieve. Statistics show
that between 5% and 10% of all general aviation accidents can be attributed
to spatial disorientation, 90% of which are fatal.

Good spatial orientation on the ground relies on the use of visual, vestibular
(organs of equilibrium located in the inner ear), and proprioceptive
(receptors located in the skin, muscles, tendons, and joints) sensory
information. Changes in linear acceleration, angular acceleration, and gravity
are detected by the vestibular system and the proprioceptive receptors, and
then compared in the brain with visual information.

Spatial orientation in flight is difficult to achieve because numerous sensory

stimuli (visual, vestibular, and proprioceptive) vary in magnitude, direction,
and frequency. Any differences or discrepancies between visual, vestibular,
and proprioceptive sensory inputs result in a sensory mismatch that can
produce illusions and lead to spatial disorientation.

The Otolith Organs and Orientation

Two otolith organs, the saccule and utricle, are located in each ear and are
set at right angles to each other. The utricle detects changes in linear
acceleration in the horizontal plane, while the saccule detects gravity
changes in the vertical plane. However, the inertial forces resulting from
linear accelerations cannot be distinguished from the force of gravity
(according to the theory of general relativity they are the same thing)
therefore, gravity can also produce stimulation of the utricle and saccule. A
response of this type will occur during a vertical take-off in a helicopter or
following the sudden opening of a parachute after a free fall.

"Seat of the pants" flying

Anyone in an aircraft that is making a coordinated turn, no matter how

steep, will have little or no sensation of being tilted in the air unless the
horizon is visible. Similarly, it is possible to gradually climb or descend
without a noticeable change in pressure against the seat. In some aircraft, it
is possible to execute a loop without pulling negative G so that without visual
reference, the pilot could be upside down without being aware of it. That's
because a gradual change in any direction of movement may not be strong
enough to activate the fluid in the semicircular canals, so the pilot may not
realize that the aircraft is accelerating, decelerating, or banking.
 CASE STUDIES

Eastern Air Lines Flight 401

Eastern Air Lines Flight 401 was a Lockheed L-1011 Tristar 1 jet that crashed
into the Florida Everglades on the night of December 29, 1972, causing 101
fatalities (77 initial crash survivors, two died shortly afterward). The crash
was a result of the flight crew's failure to recognize a deactivation of the
autopilot during their attempt to troubleshoot a malfunction of the landing
gear position indicator system. As a result, the flight gradually lost altitude
while the flight crew was preoccupied and eventually crashed. It was the first
crash of a wide-body aircraft and, at the time, the deadliest in the United
States

Crash

Eastern Air Lines Flight 401, operating with a four-month-old Lockheed L-

1011-1 Tristar (the 12th example delivered to the carrier) carrying 163
passengers and 13 crew members, left New York's JFK airport on Friday,
December 29, 1972 at 9:20 p.m., en route to Miami International Airport. The
flight was under the command of Captain Robert Loft, 55, a veteran Eastern
Air Lines pilot ranked 50th in seniority at Eastern. His flight crew included
First Officer Albert Stockstill, 39 and Second Officer (flight engineer) Donald
Repo, 51. A fourth member—Eastern technical officer, Angelo Donadeo,
returning to Miami from an assignment in New York—accompanied the
flightcrew for the journey. The ten women flight attendant crew on Flight
401 included: Mercedes Ruiz, Sue Tebbs, Adrienne Hamilton (lead flight
attendant), Trudy Smith, Dorothy Warnock, Pat Ghyssels, Beverly Raposa,
Patty Georgia, Stephanie Stanich and Sharon Transue. Pat Ghyssels (seated
on jumpseat 3L) and Stephanie Stanich (seated on jumpseat 4L) died in the
crash.

The flight was routine until 11:32 p.m., when the flight began its approach
into Miami International Airport. After lowering the gear, First Officer
Stockstill noticed that the landing gear indicator, a green light identifying
that the nose gear is properly locked in the "down" position, did not
illuminate. The cause, discovered after much investigation, was due to a
burned-out light bulb. The landing gear could have been manually lowered
either way. The pilots cycled the landing gear but still failed to get the
confirmation light.

Loft, who was working the radio during this leg of the flight, told the tower
that they would abort their landing and asked for instructions to circle the
airport. The tower cleared the flight to pull out of its descent, climb to two
thousand feet (610 m), and then fly west over the darkness of the
Everglades.

The cockpit crew removed the light assembly and Second Officer Repo was
dispatched into the avionics bay beneath the flight deck to check visually if
the gear was down through a small viewing window. Fifty seconds after
reaching their assigned altitude, Captain Loft instructed First Officer
Stockstill to put the L-1011 on autopilot. For the next eighty seconds the
plane maintained level flight. Then it dropped one hundred feet (30 m), and
then again flew level for two more minutes, after which it began a descent so
gradual it could not be perceived by the crew. In the next seventy seconds,
the plane lost only 250 feet (76 m), but this was enough to trigger the
altitude warning C-chord chime located under the engineer's workstation.
The engineer had gone below, and there was no indication by the pilot's
voices recorded on the CVR that they heard the chime. In another fifty
seconds, the plane was at half its assigned altitude.

As Stockstill started another turn, onto 180 degrees, he noticed the

discrepancy. The following conversation was recovered from the flight voice
recorder later:
Stockstill: We did something to the altitude.

Loft: What?

Stockstill: We're still at 2,000 feet, right?

Loft: Hey — what's happening here?

The jetliner crashed at 25°51′53″N 80°35′43″WCoordinates: 25°51′53″N

80°35′43″W. The location was west-northwest of Miami, 18.7 miles (30.1 km)
from the end of runway Eight Left (8L). The plane was traveling at 227 miles
per hour when it flew into the ground. The left wingtip hit first, then the left
engine and the left landing gear, making three trails through the sawgrass,
each five feet wide and more than 100 feet (30 m) long. When the main part
of the fuselage hit the ground it continued to move through the grass and
water, breaking up as it went.

Cause of the crash

The NTSB investigation discovered that the autopilot had been inadvertently
switched from altitude hold to CWS (Control Wheel Steering) mode in pitch.
In this mode once the pilot releases pressure on the yoke the autopilot will
maintain the pitch attitude selected by the pilot until he moves the yoke
again. Investigators believe the autopilot switched modes when the captain
accidentally leaned against the yoke while turning to speak to the flight
engineer, who was sitting behind and to the right of him. The slight forward
pressure on the stick would have caused the aircraft to enter a slow descent,
maintained by the CWS system.

Investigation into the aircraft's autopilot showed that the force required to
switch to CWS mode was different between the A and B channels (15 vs 20
pounds respectively). Thus it was possible that the switching to CWS in
channel A did not occur in channel B thus depriving the First Officer of any
indication the mode had changed (Channel A provides the Captain's
instruments with data, while channel B provides the First Officer's).

After descending 250 feet from the selected altitude of 2000 feet a C-chord
sounded from the rear speaker. This altitude alert, designed to warn the
pilots of an inadvertent deviation from the selected altitude, went unnoticed
by the fatigued and frustrated crew. Investigators believe this was due to the
crew being distracted by the nose gear light, and because the flight engineer
was not in his seat when it sounded and so would not have been able to hear
it. Visually, since it was nighttime and the aircraft was flying over the
darkened terrain of the Everglades, there were no ground lights or other
visual indications that the TriStar was slowly descending into the swamp. It
was also discovered that Captain Loft had an undetected tumor in his brain,
although this was later found to be in an area controlling vision.

The final NTSB report cited the cause of the crash as pilot error, specifically:
"the failure of the flight crew to monitor the flight instruments during the
final four minutes of flight, and to detect an unexpected descent soon
enough to prevent impact with the ground. Preoccupation with a malfunction
of the nose landing gear position indicating system distracted the crew's
attention from the instruments and allowed the descent to go unnoticed."

Flash Airlines Flight 604

Flash Airlines Flight 604 was a charter flight operated by Egyptian charter
company Flash Airlines. On 3 January 2004, the Boeing 737-300 crashed into
the Red Sea shortly after takeoff from Sharm el-Sheikh International Airport,
killing all 142 passengers, many of them French tourists, and all 6 crew
members. The findings of the crash investigation are controversial, with
accident investigators from the different countries involved not agreeing on
the cause.

Flight 604 has the highest death toll of any aviation accident in Egypt, and
the highest death toll of any accident involving a Boeing 737-300.

History of the flight

The aircraft, a Boeing 737-3Q8 had originally been delivered to TACA Airlines
in 1992. Other operators included Color Air, Egypt-based Mediterranean
Airlines, and the prior corporate identity of Flash Airlines, Heliopolis Airlines.

The flight took off at 04:44 Eastern European Time (0244 GMT) from runway
22R at the Egyptian resort en route to Paris via Cairo. The captain was one of
Egypt's most experienced pilots, with over 7,000 hours flying experience that
included a highly decorated career in the Egyptian Air Force.

After taking off, the aircraft should have climbed and initiated a left turn to
follow the air corridor to Cairo designated by the Sharm el-Sheikh VOR
station. The captain appeared surprised when the autopilot was engaged,
which he immediately switched off again. The copilot warned the captain
that the bank angle was increasing. At a bank angle of 40 degrees to the
right, the captain said "OK, come out". The ailerons were briefly returned to
a neutral before being commanded to increase the bank to the right. The
aircraft reached an altitude of 5,460 feet (1,660 m) with a 50 degrees bank
when the copilot exclaimed "Overbank!" repeatedly when the bank angle
kept increasing. The bank angle was 111 degrees right, while the pitch
attitude was 43 degrees nose down at an altitude of 3,470 feet (1,060 m).
The observer on the flight deck, also a pilot, but a trainee on this type of
aircraft, shouted "Retard power, retard power, retard power!” Both throttles
were moved to idle; the captain appeared to regain control of the airplane
from the nose-down, right bank attitude. However the speed increased,
causing an overspeed warning. At 04:45, the aircraft impacted the water
about 9.4 statute miles (15.2 km; 8.2 NMI) south of the airport. The impact
occurred while the aircraft was in a 24 degree right bank, 24 degree nose-
down attitude, travelling at 416 knots (770 km/h)(478 mi/h) and pulling 3.9g
(38 m/s²). All passengers and crew were killed on impact.

Charles de Gaulle Airport initially indicated the Flash Airlines flight was
delayed; authorities began notifying relatives and friends of the deaths of the
passengers two hours after the scheduled arrival time. Authorities took
relatives and friends to a hotel, where they received a list of passengers
confirmed to be on the flight. Marc Chernet, president of the victims'
families association of Flight 604, described the disaster as the "biggest air
disaster involving French nationals" in civil aviation.

Investigation

Initially, it was thought that terrorists might have been involved, as fear of
aviation terrorism was high (with several major airlines in previous days
canceling flights on short notice). The British Prime Minister at the time, Tony
Blair, was also holidaying in the Sharm el-Sheikh area. A group in Yemen said
that it destroyed the aircraft as a protest against a new law in France
banning headscarves in schools. Accident investigators dismissed terrorism
when they discovered that the wreckage was in a tight debris field,
indicating that the aircraft crashed in one piece; a bombed aircraft would
disintegrate and leave a large debris field.

The wreckage sank to a depth of 1,000 m (3,300 ft), making recovery of the
flight data recorder and cockpit voice recorder difficult. However two weeks
after the accident, both devices were located by a French salvage vessel and
recovered by a ROV. The accident investigators examined the recorders
while in Cairo. The maintenance records of the aircraft had not been
duplicated; they were destroyed in the crash and no backup copies existed.

The Ministry of Civil Aviation (MCA) investigated the accident, with

assistance from the American National Transportation Safety Board (NTSB)
and the French Bureau d'Enquêtes et d'Analyses pour la Sécurité de
l'Aviation Civile (BEA).

The MCA released its final report into the accident on March 25, 2006. The
report did not conclude with a probable cause, listing instead four "possible
causes".

The NTSB and the BEA concluded that the pilot suffered spatial
disorientation, and the copilot was unwilling to challenge his more
experienced superior. Furthermore, according to the NTSB and BEA, both
officers were insufficiently trained. The NTSB stated that the cockpit voice
recorder showed that 24 seconds passed after the airliner banked before the
pilot began correcting maneuvers. Egyptian authorities disagreed with this
assessment, attributing the cause to mechanical issues. Shaker Kelada, the
lead Egyptian investigator, said that if Hamid, who had more experience
than the copilot, detected any problems with the flight, he would have raised
objections. Some media reports suggest that the plane crashed due to
technical problems, possibly a result of the apparently questionable safety
record of the airline. This attitude was shown in a press briefing given by the
BEA chief, who was berated by the first officer's mother during a press
conference, and demanded that the crew be absolved of fault prior to the
completion of the investigation. Two months after the crash Flash Airlines
went bankrupt.

U.S. Summary Comments on Draft Final Report of Aircraft Accident Flash

Airlines flight 604, Boeing 737-300, SU-ZCF January 3, 2004, Red Sea near
Sharm El-Sheikh, Egypt. Quote from page 5 of 7:

"Distraction. A few seconds before the captain called for the autopilot to be
engaged, the airplane’s pitch began increasing and airspeed began
decreasing. These deviations continued during and after the autopilot
engagement/disengagement sequence. The captain ultimately allowed the
airspeed to decrease to 35 knots below his commanded target airspeed of
220 knots and the climb pitch to reach 22°, which is 10° more than the
standard climb pitch of about 12°. During this time, the captain also allowed
the airplane to enter a gradually steepening right bank, which was
inconsistent with the flight crew’s departure clearance to perform a climbing
left turn. These pitch, airspeed and bank angle deviations indicated that the
captain directed his attention away from monitoring the attitude indications
during and after the autopilot disengagement process. Changes in the
autoflight system’s mode status offer the best explanation for the captain’s
distraction. The following changes occurred in the autoflight system’s mode
status shortly before the initiation of the right roll: (1) manual engagement of
the autopilot, (2) automatic transition of roll guidance from heading select to
control wheel steering-roll (CWS-R), (3) manual disengagement of the
autopilot, and (4) manual reengagement of heading select for roll guidance.
The transition to the CWS-R mode occurred in accordance with nominal
system operation because the captain was not closely following the flight
director guidance at the time of the autopilot engagement. The captain
might not have expected the transition, and he might not have understood
why it occurred. The captain was probably referring to the mode change
from command mode to CWS-R when he stated, “see what the aircraft did?,”
shortly after it occurred. The available evidence indicates that the
unexpected mode change and the flight crew’s subsequent focus of attention
on reestablishing roll guidance for the autoflight system were the most likely
reasons for the captain’s distraction from monitoring the attitude".

Problems associated with the complexity of autopilot systems were

documented in the June 2008 issue of Aero Safety World. Before the
completion of the investigation, Avionics writer David Evans suggested that
differences in instrumentation between the MiG-21 (with which the captain
had experience) and the Boeing 737 may have contributed to the crash.

Garuda Indonesia Flight 200

Garuda Indonesia Flight 200 (GA200) was the scheduled domestic passenger
flight of a Boeing 737-497 operated by Garuda Indonesia between Jakarta
and Yogyakarta, Indonesia. The aircraft crashed and burst into flames while
landing at Adisucipto International Airport on March 7, 2007. According to
the airline, 21 passengers and 1 crew member were killed; both the captain
and the first officer survived and were admitted to an Indonesian military
hospital.

Flight chronology

Flight GA200 originated in Jakarta and was carrying 133 passengers, 19 of

whom were foreigners. Several Australian journalists were on the flight,
covering the visit of Australia's Foreign Affairs Minister Alexander Downer
and Attorney-General Philip Ruddock to Java. . They were on the flight as the
aircraft carrying Australian dignitaries were at capacity.

At approximately 7 am local time (UTC+7), while attempting to land at

Adisucipto International Airport, Yogyakarta, Indonesia, the plane overran the
end of the runway, went through the perimeter fence and stopped in a
nearby rice field after it bounced three times. Passengers in the plane and
witnesses on the ground reported the plane approached the runway at a
speed greater than normal. According to passengers, the plane shook
violently before it crashed. At some point the plane caught fire, and while
most passengers were able to escape, a number of passengers perished
inside the burning fuselage. This may have been caused by the broken main
exit door, which is located at the front left. The fire may have been ignited
from the nose landing gear after its wheels were snapped off, which were
found later on the runway.

The pilot, Captain Muhammad Marwoto Komar, claimed that there was a
sudden downdraft immediately before the flight landed, and that the flaps on
the aircraft may have malfunctioned.

Investigation

Australia was heavily involved in the investigation in which the Australian

Federal Police disaster victim identification experts were deployed to the
scene to assist with the identification of bodies. Australian Transport Safety
Bureau staff assisted at the scene by inspecting the wreckage to attempt to
piece together a picture of the incident. The "black box" recorders consisting
of a flight data recorder and cockpit voice recorder were removed from the
wreckage and flown to Canberra, Australia, for further analysis by the Bureau
of Air Safety Investigations using equipment not yet available in Indonesia.
The United States' National Transportation Safety Board dispatched a team
to assist in the investigation, including representatives from Boeing and the
Federal Aviation Administration. Staff in Australia could not read the cockpit
voice recorder of the black box, which was then sent to the Boeing factory in
Seattle, United States, to be deciphered.

Police started the investigation of the pilots, who had been suspended and
were suffering from psychological trauma after the inferno.[who?] According
to the pilots, a huge gust of wind was responsible for the disaster, while
witnesses said that the plane was at a higher than normal speed during
landing. Police were said to be investigating the possibility of a detonator
inside the aircraft, with Police spokesman Budi Santoso saying "About a
suspicion of a detonator might have been found inside the ill-fated plane, we
are still investigating it. To prove it, it will take a long time, and the police
are still collecting evidence both from witnesses' information and from
objects found from the plane wreckage,".

After the flight data and black box recordings were analyzed, and a complete
safety review of the airport was conducted, it was revealed that the
Yogyakarta Airport did not conform to international safety standards, having
a runway runoff a quarter the recommended length; pilots reported the
reverse thrust of one engine was not working prior to takeoff; the weather
was calm, contradicting claims of an updraft; data recordings revealed no
mechanical fault before landing; black box recordings revealed there was no
cockpit argument, as reported; safety vehicles were unable to reach the
crash site in sufficient time, failing to conform to global safety standards.
On 17 March 2007, new evidence from the flight data recorder indicated that
wing flaps on the plane were not extended for landing. New evidence came
up on April 1, 2007 and it is reported that the pilot and co-pilot were arguing
about the plane's speed, but other reports said there was no evidence for
this.

On 11 April 2007, Indonesia's National Safety Transport Committee released

a preliminary finding into the crash, confirming that Garuda Flight 200 was
travelling at around 410 km/h - almost twice the normal speed - when it
came in to land. A Garuda Pilots' Association official has speculated that the
captain could have been trying to save fuel due to a new fuel conservation
bonus scheme recently introduced by Garuda Airlines.

On October 22, 2007, the official enquiry blamed the crash on pilot error. The
captain ignored the plane’s automated warning system as it sounded alarms
fifteen times. He also ignored calls from the co-pilot to go around and make
another approach.

On 4 February 2008 the captain, Marwoto Komar, was arrested and charged
with six counts of manslaughter. The charge carries a penalty up to life
imprisonment if the court finds the crash was deliberate. Short of that
finding, the lesser charge of negligent flying causing death, carries a
maximum sentence of seven-years. The copilot testified that he had told the
captain to go around because of excessive speed, and that he then had
blacked out due to the severe buffeting. On 6 April 2009, the captain was
found guilty of negligence and sentenced to 2 years in jail. Despite all
evidence pointing towards severe pilot error, the captain's conviction was
quashed by the Indonesian High Court on September 29, 2009.
Helios Airways Flight 522
Helios Airways Flight 522 (HCY 522 or ZU522) was a Helios Airways Boeing
737-300 flight that crashed into a mountain on 14 August 2005 at 12:04
EEST, north of Marathon and Varnavas, Greece. Rescue teams located
wreckage near the community of Grammatiko 40 km (25 miles) from Athens.
All 121 on board were killed.

Flight and crash

Date: 14 August 2005

All times EEST (UTC + 3h), PM in bold

Time Event

0900 Scheduled departure

0907 Departs Larnaca International Airport

0911 Pilots report air conditioning problem

0912 Cabin Altitude Warning sounds at 12,040 feet (3,670 m)

0920 Last contact with Nicosia ATC;

Altitude is 28,900 feet (8,809 m)

0923 Now at 34,000 feet (10,400 m);

Probably on autopilot

0937 Enters Athens Flight Information Region

1007 No response to radio calls from Athens ATC

1020 Athens ATC calls Larnaca ATC;

Gets report of air conditioning problem

1024 Hellenic Air Force (HAF) alerted

To possible renegade aircraft

1045 Scheduled arrival in Athens

1047 HAF reassured that the problem

Seemed to have been solved

1055 HAF ordered to intercept by Chief of

General Staff, Admiral Panagiotis Chinofotis

1105 Two F-16 fighters depart Nea Anchialos

1124 Located by F-16s over Aegean island of Kea

1132 Fighters see co-pilot slumped over,

cabin oxygen deployed, no signs of terrorism

1149 Fighters see an individual in the cockpit,

apparently trying to regain control of aircraft

1150 Left (#1) engine stops operating,

presumably due to fuel starvation

1154 CVR records two MAYDAY messages

1200 Right (#2) engine stops operating

1204 Aircraft crashes in mountains

near Grammatikos, Greece

Hans-Jürgen Merten, a 59-year-old German contract pilot hired by Helios for

the holiday flights, served as the captain. Pampos Charalambous, 51, a
Cypriot who flew for Helios, served as the first officer. 32-year old Louisa
Vouteri, a Greek national living in Cyprus who served as a chief purser,
replaced a sick colleague.

The flight, which left Larnaca, Cyprus at 09:07 local time, was en route to
Athens, and was scheduled to continue to Prague. Before take-off the crew
failed to set the pressurization system to "Auto," which is contrary to
standard Boeing procedures. Minutes after take-off the cabin altitude horn
activated as a result of pressurization. It was, however, misidentified by the
crew as a take-off configuration warning, which signals that the aircraft is not
ready for take-off, and can only sound on the ground. The horn can be
silenced by the crew with a switch on the overhead panel.

Above 14,000 ft (4,267 m) cabin altitude, the oxygen masks in the cabin
automatically deployed. An Oxy ON warning light on the overhead panel in
the cabin illuminates when this happens. At this point, the crew contacted
the ground engineers. Minutes later a master caution warning light activated,
indicating an abnormal situation in a system. This was misinterpreted by the
crew as indicating that systems were overheating.

At some point later the captain radioed the engineer on the ground to say
that the ventilation fan lights were off. This suggests that the captain was
suffering from hypoxia, as the 737-300 has no such lights. The engineer
asked the captain to repeat. The captain then said that the equipment
cooling lights were off, which again suggested confusion. The engineer said,
"this is normal, please confirm the problem." The engineer then asked, "Can
you confirm that the pressurization system is set to AUTO?" The captain,
however, disregarded the question and instead asked in reply, "Where are
my equipment cooling circuit breakers?" The engineer then asked whether
the crew could see the circuit breakers, but received no response.
After the flight failed to contact air traffic control upon entering Greek air
space, two F-16 fighter aircraft from the Hellenic Air Force 111th Combat
Wing were scrambled from Nea Anchialos Air Base to establish visual
contact. They noted that the aircraft appeared to be on autopilot. In
accordance with the rules for handling "renegade" aircraft incidents (where
the aircraft is not under pilot control), one fighter approached to within 300 ft
(91 m), and saw the first officer was slumped motionless at the controls. The
pilot could also see that the captain was not upright in the cockpit and that
oxygen masks were seen dangling in the passenger cabin.

Later, the F-16 pilots saw the flight attendant Andreas Prodromou enter the
cockpit and sit at the controls, seemingly trying to regain control of the
aircraft. He eventually noticed the F-16, and signaled him. The pilot pointed
forward as if to ask, "Can you carry on flying?" Prodromou responded by
shaking his head and pointing downward. The cockpit voice recorder
recorded him calling "mayday" multiple times. Within minutes, due to lack of
fuel, the engines failed in quick succession and the aircraft began to
descend. Prodromou grabbed the yoke and attempted to steer, but the plane
continued, hit the ground and exploded. At the time of impact, the
passengers and crew were likely unconscious but breathing. None survived.

The aircraft was carrying 115 passengers and a crew of 6. The passengers
included 67 due to disembark at Athens, with the remainder continuing to
Prague. The bodies of 118 individuals were recovered. The passenger list
included 93 adults and 22 people under the age of 18. Cypriot nationals
comprised 103 of the passengers and Greek nationals comprised the
remaining 12.

The cause of the crash (according to air crash investigations) was that the
cabin pressurization control valve was set to manual and was not switched
back to auto after post-maintenance pressurization testing was completed.
As a result, the cabin never pressurized during the ascent to 35,000 feet
(11,000 m). The flight attendant seen in the cockpit managed to stay
conscious by using the spare oxygen bottles provided in the passenger cabin
for crew use.

Investigation

Suspicions that the aircraft had been hijacked were ruled out by Greece's
foreign ministry. Initial claims that the aircraft was shot down by the fighter
jets have been refuted by eyewitnesses and the government.

Loss of cabin pressure—which, without prompt alleviation, would cause pilot

unconsciousness—is the leading theory explaining the accident. This would
account for the release of oxygen masks in the passenger cabin. Weighing
against this is the fact that the pilots should have been able to don their own
fast-acting masks and make an emergency descent to a safe altitude
provided that they recognized the pressurization system as the source of the
alarm and acted before their minds were too impaired by hypoxia.

The flight data recorder and cockpit voice recorder were sent to Paris for
analysis. Authorities served a search warrant on Helios Airways'
headquarters in Larnaca, Cyprus, and seized "documents or any other
evidence which might be useful in the investigation of the possibility of
criminal offences."

Most of the bodies recovered were burned beyond visual identification by the
fierce fires that raged for hours in the dry brush and grass covering the crash
site. However, it was determined that a body found in the cockpit area was
that of a male flight attendant and DNA testing revealed that the blood on
the aircraft controls was that of flight attendant Andreas Prodromou, a pilot-
in-training with approximately 260–270 hours of training completed.
Autopsies on the crash victims showed that all were alive at the time of
impact, but it could not be determined whether they were conscious as well.
Prodromou was not originally scheduled to be on the flight; he joined the
crew so he could spend time with his girlfriend, a fellow Helios flight
attendant.

Decompression hypothesis

The preliminary investigation reports state that the maintenance performed

on the aircraft had left the pressurization control on a 'manual' setting, in
which the aircraft would not pressurize automatically on ascending; the pre-
takeoff check had not disclosed nor corrected this. As the aircraft passed
10,000 feet (3,000 m), the cabin altitude alert horn sounded. The horn also
sounds if the aircraft is not properly set for takeoff, for example flaps not set,
and thus it was assumed to be a false warning. The aircrew found a lack of a
common language and inadequate English a hindrance in solving the
problem. The aircrew called maintenance to ask how to disable the horn, and
were told where to find the circuit-breaker. The pilot left his seat to see to
the circuit breaker and both aircrew lost consciousness shortly afterwards.
The leading explanation for the accident is that the cabin pressurization did
not operate and this condition was not recognized by the crew before they
became incapacitated. Decompression would have been fairly gradual as the
aircraft climbed under the control of the flight management system. The
pressurization failure warning on this model should operate when the
effective altitude of the cabin air reaches 10,000 ft (3,000 m) at which
altitude a fit person will have full mental capacity.

The emergency oxygen supply in the passenger cabin of this model of

Boeing 737 is provided by chemical generators that provide enough oxygen,
through breathing masks, to sustain consciousness for about 12 minutes,
normally sufficient for an emergency descent to 10,000 feet (3,000 m),
where atmospheric pressure is sufficient to sustain life without supplemental
oxygen. Cabin crew has access to portable oxygen sets with considerably
longer duration. Emergency oxygen for the flight crew comes from a
dedicated tank.

Previous pressurization problems

On 16 December 2004, during an earlier flight from Warsaw, the accident

aircraft experienced a rapid loss of cabin pressure, and the crew made a
successful emergency descent. The cabin crew reported to the captain that
there had been a bang from the aft service door, and that there was a hand-
sized hole in the door's seal. The Air Accident and Incident Investigation
Board (AAIIB) of Cyprus could not conclusively determine the causes of the
incident, but indicated two possibilities: an electrical malfunction causing the
opening of the outflow valve, or the inadvertent opening of the aft service
door.

The mother of the first officer killed in the crash of Flight 522 claimed that
her son had repeatedly complained to Helios about the aircraft getting cold.
Passengers also reported problems with air conditioning on Helios flights.
During the two months before the crash, the aircraft's Environmental Control
System required repair five times.

On the morning of the crash, after the aircraft arrived at Larnaca on a flight
from the United Kingdom, the cabin crew reported an abnormal noise coming
from the right aft service door during the flight. Helios engineers performed
a visual inspection of the door and a pressurization leak check, and reported
no defects, leaks, or abnormal noises.
Tenerife airport disaster
The Tenerife airport disaster in 1977 was a collision involving two Boeing 747
passenger aircraft on the runway of Los Rodeos Airport (now known as
Tenerife North Airport) on the Spanish island of Tenerife, one of the Canary
Islands. With 583 fatalities, the crash remains the deadliest accident in
aviation history. All 248 aboard the fully fuelled KLM flight were killed. There
were also 335 fatalities and 61 survivors from the Pan Am flight, which was
struck along its spine by the KLM's landing gear, under-belly and four
engines. Rescue crews were unaware for over 20 minutes that the Pan Am
aircraft was also involved in the accident, because of the heavy fog and the
separation of the crippled aircraft following the collision.

The collision took place on March 27, 1977, at 17:06:56 local time. The
aircraft were operating as Pan Am Flight 1736 (the Clipper Victor) under the
command of Captain Victor Grubbs, and KLM Flight 4805 (the Rijn) under the
command of Captain Jacob Veldhuyzen van Zanten. Taking off in heavy fog
on the airport's only runway, the KLM flight crashed into the top of the Pan
Am aircraft back taxiing in the opposite direction. The Pan Am had followed
the back taxiing of the KLM aircraft, under the direction of Air Traffic Control,
and the KLM's flight crew had been aware of Pan Am back taxiing behind
them on the same runway. Despite lack of visual confirmation (because of
the fog) the KLM captain thought that Pan Am had cleared the runway and so
attempted to take off without further clearance to do so. Several other key
factors contributed to the accident.

Flight details

For both planes, Tenerife was an unscheduled stop. Their destination was
Gran Canaria International Airport (also known as Las Palmas airport),
serving Las Palmas on the nearby island of Gran Canaria. Both are in the
Canary Islands, an autonomous community of Spain located in the Atlantic
Ocean off the west coast of Morocco.

Pan Am Flight 1736 had taken off from Los Angeles International Airport with
an intermediate stop at New York's John F. Kennedy International Airport.
The aircraft was a Boeing 747-121, registration N736PA. Of the 380
passengers, 14 had boarded in New York, where the crew was also changed.
The new crew consisted of Captain Victor Grubbs, First Officer Robert Bragg,
and Flight Engineer George Lawrence; there were 14 other crew members.
The airplane was Pan Am's first Boeing 747 (ex Clipper Young America).

KLM Flight 4805, a charter flight for Holland International Travel Group from
the Netherlands, had taken off four hours before from Amsterdam Airport
Schiphol. Its captain was Jacob Veldhuyzen van Zanten and the first officer
was Klaas Meurs. The aircraft was a Boeing 747-206B, registration PH-BUF.
The KLM jet had 235 passengers and 14 crew members, including 48
children and three infants. Most of the KLM passengers were Dutch; four
Germans, two Austrians, and two Americans were also on the plane. After
the aircraft landed at Tenerife, a Dutch tour guide named Robina van
Lanschot, who lived on the island in Puerto de la Cruz and wanted to see her
boyfriend that night, elected not to re-board the 747, leaving 234 passengers
on board.

Chain of events leading to disaster

Bombing at Las Palmas

Events on both planes had been routine until they approached the islands.
Then, at 1:15 pm, a terrorist bomb (planted by separatist Fuerzas Armadas
Guanches) exploded in the terminal of Gran Canaria International Airport. It
had been preceded by a phone call warning of the bomb. The civil aviation
authorities closed that airport after the bomb detonated and diverted all of
its incoming flights to Los Rodeos, including the two Boeing 747 aircraft
involved in the disaster. Upon contacting Gran Canaria airport, the Pan Am
flight was informed of the temporary closure. Although the Pan Am crew
indicated that they would prefer to circle in a holding pattern until landing
clearance was given, the plane was ordered to divert to Los Rodeos, along
with the KLM flight. This led to the critical cramped aircraft conditions within
the smaller airport.

Congestion at Los Rodeos

In all, at least five large aircraft were diverted to Los Rodeos, a regional
airport that could not easily accommodate them. The airport consisted of one
runway and one major taxiway parallel to it, as well as several small
taxiways connecting the main taxiway and the runway. While waiting for
Gran Canaria airport to reopen, the diverted aircraft took up so much space
that they were parked on the long taxiway, meaning that it could not be
used for taxiing. Instead, departing aircraft would have to taxi along the
runway to position themselves for takeoff, a procedure known as a runway
backtrack.

Refuelling

After the threat at Gran Canaria International Airport had been contained,
authorities reopened the airport. The Pan Am aircraft was ready to depart,
but the KLM plane and a refuelling vehicle obstructed the way to the active
runway. Captain van Zanten had decided to fully refuel at Los Rodeos
instead of Las Palmas, apparently to save time, but added extra weight,
greatly retarding liftoff (and accident escape) ability, which proved fatal. The
refuelling took an estimated 35 minutes. By a factor of just 12 feet of lack of
manoeuvre clearance, due to KLM's refuelling, Pan Am was stuck behind it
until KLM was finished, delaying its ability to fly out before the KLM flight.

Taxiing and weather conditions

Following the tower's instructions, the KLM aircraft was cleared to back taxi
the full length of runway 30 and make a 180° turn to put the aircraft in
takeoff position — a difficult manoeuvre to perform with a 747 on a runway
only 45 m (150 ft) wide. While KLM 4805 was back taxiing on runway 30, the
controller asked the flight crew to report when it was ready to copy the ATC
clearance. Because the flight crew was performing the checklist, copying this
clearance was postponed until the aircraft was in takeoff position on Runway
30. During taxiing, the weather deteriorated and low-lying clouds now limited
the visual range to about 300 m (1,000 ft). Legal or stipulated threshold for
take-off was 700 metres visibility, as noted in the Nova documentary and
relayed by a surviving Pan Am pilot in an on camera interview. Pan Am pilots
were thinking visibility conditions were not present for take-off. But weather
changed by seconds and/or minutes.

Shortly afterward, Pan Am 1736 was instructed to also back taxi, to follow
the KLM aircraft down the same runway, to exit the runway by taking the
"third exit" on their left and then using the parallel taxiway. Initially the crew
was unclear as to whether the controller had told them to take the first or
third exit. The crew asked for clarification and the controller responded
emphatically by replying: "The third one, sir; one, two, three; third, third
one". The crew began the taxi and proceeded to identify the unmarked
taxiways using an airport diagram as they reached them.

Based on the chronology of the cockpit voice recorder (CVR) and the
distances between the taxiways (and the location of the aircraft at the time
of the collision), the crew successfully identified the first two taxiways (C-1
and C-2), but their discussion in the cockpit never indicated that they had
sighted the third taxiway (C-3), which they had been instructed to use. There
were no markings or signs to identify the runway exits. The Pan Am crew
appeared to remain unsure of their position on the runway until the collision,
which occurred near the intersection with the fourth taxiway (C-4). Pan Am's
lack of visibility and runway exiting confusion probably contributed to its
slow taxiing speed, another key factor in the accident.

The angle of the third taxiway would have required the plane to perform a
turn of approximately 145°, which would lead counter-productively back
toward the still-crowded main apron. At the end of C-3 another 145° turn
would have to be made to continue taxiing towards the start of the runway.
Taxiway C-4 would have required just two 35° turns. A study carried out by
the Air Line Pilots Association after the accident concluded that making the
second 145° turn at the end of taxiway C-3 would have been "a practical
impossibility", although the Dutch report stated that such a manoeuvre
"could reasonably be performed". The official report from the Spanish
authorities did not explain why the controller had instructed the Pan Am
aircraft to use the third taxiway, rather than the sensible and easier fourth
taxiway.

Communication misunderstandings

Immediately after lining up, the KLM captain advanced the throttles (a
standard procedure known as "spin-up", to verify that the engines are
operating properly for takeoff) and the co-pilot, surprised by the manoeuvre,
quickly advised the captain that ATC clearance had not yet been given. The
captain responded, "I know that. Go ahead, ask." The co-pilot then radioed
the tower that they were "ready for takeoff" and "waiting for our ATC
clearance". The KLM crew then received a clearance which specified the
route that the aircraft was to follow after takeoff. The instructions used the
word "takeoff", but did not include an explicit statement that they were
cleared for takeoff.

The KLM co-pilot read the flight clearance back to the controller, completing
the read back with the statement "we're now at takeoff" or "we're now, uh,
taking off" (the exact wording of his statement was not clear ), indicating to
the controller that they were beginning their takeoff roll. The captain
interrupted the co-pilot's read back with the comment "We're going". As
noted in the Nova documentary, the subordinate co-pilot this time chose not
to embarrass his superior a second time and state they still did not have the
proper clearance to take-off.

The Spanish controller, who could not see the runway due to the fog, initially
responded with "OK" (terminology which is nonstandard), which reinforced
the KLM crew's or captain's misinterpretation that they had takeoff
clearance. The controller's response of "OK" to the co-pilot's nonstandard
statement that they were "now at takeoff" was likely due to his
misinterpretation that they were in takeoff position and ready to begin the
roll when takeoff clearance was received, but not actually in the process of
taking off. The controller then immediately added "Stand by for takeoff, I will
call you", indicating that he had not intended the clearance to be interpreted
as a takeoff clearance. He probably had not heard the captain's
announcement that they were "going", since van Zanten had said this to his
fellow crew members and not transmitted it on the radio himself.

However, a simultaneous radio call from the Pan Am crew caused mutual
interference on the radio frequency, which was audible in the KLM cockpit as
a whistling sound (or heterodyne). This made the crucial latter portion of the
tower's response audible only with difficulty by the KLM crew. The Pan Am
crew's transmission, which was also critical, was reporting that "We're still
taxiing down the runway, the Clipper 1736!" This message was also blocked
by the heterodyne and inaudible to the KLM crew. Either message, if heard in
the KLM cockpit, would have given the KLM crew time to abort its second
takeoff attempt.

Due to the fog, neither crew was able to see the other plane on the runway
ahead of them. In addition, neither of the aircraft could be seen from the
control tower, and the airport was not equipped with ground radar.

After the KLM plane had started its takeoff roll, the tower instructed the Pan
Am crew to "report when runway clear". The crew replied: "OK, we'll report
when we're clear". On hearing this, the KLM flight engineer expressed his
concern about the Pan Am not being clear of the runway by asking the pilots,
"Is he not clear, that Pan American?". However, the captain emphatically
replied "Oh, yes" and continued with the takeoff.

Collision

According to the CVR, Captain Grubbs, captain of the Pan Am plane, spotted
the KLM's landing lights just as the plane approached exit C-4, exclaiming,
"Goddamn, that son-of-a-bitch is coming straight at us!" with the co-pilot
Robert Bragg yelling, "Get off! Get off! Get off!". The Pan Am crew applied
full power and took a sharp left turn towards the exit to avoid a collision. KLM
Captain van Zanten attempted to avoid a collision by climbing away,
scraping the tail of the plane along the runway for 20 m (70 ft). The lower
fuselage of the KLM plane hit the upper right side of the Pan Am's fuselage at
approximately 140 knots (160 mph) , ripping apart the center of the Pan Am
jet almost directly above the wing, and its right engines took out Pan Am's
upper-deck passenger cabin.

The KLM plane was briefly airborne, but the impact with the Pan Am had
sheared off the #1 (outer left) engine, and the #2 (inner left) engine had
ingested significant amounts of shredded materials from the Pan Am. The
KLM pilot quickly lost control, went into a stall, rolled sharply, slammed into
the ground at a point 150 m (500 ft) past the point of collision and slid a
further 300 m down the runway. As the jet was fully fuelled, a deadly inferno
ensued.

A survivor of the Pan Am flight, John Coombs of Haleiwa, Hawaii, said that
sitting in the nose of the plane probably saved his life: "We all settled back,
and the next thing an explosion took place and the whole port side, left side
of the plane, was just torn wide open."

Both airplanes were destroyed. All 234 passengers and 14 crew members in
the KLM plane died, while 326 passengers and 9 crew members aboard the
Pan Am flight were also killed, primarily due to the fire and explosions
resulting from the fuel spilled in the impact. The other 56 passengers and 5
crew members aboard the Pan Am aircraft survived, including the captain,
first officer, and flight engineer. Most of the survivors on the Pan Am aircraft
walked out onto the left wing, the side away from the collision, through holes
in the fuselage structure. The Pan Am's engines were still running at takeoff
power for a few minutes after the accident despite First Officer Bragg's
intention to turn them off. The top part of the cockpit, where the engine
switches were located, had been destroyed in the collision. After a short time
running at full power the Pan-Am's engines began to disintegrate, throwing
engine parts at high speed that killed at least one flight attendant who had
escaped the burning plane. Survivors waited for rescue, but it did not come
promptly as the firefighters were initially unaware that there were two
aircraft involved and were concentrating on the KLM wreck some distance
away in the thick fog. Eventually, most of the survivors on the wings dropped
to the ground below.
Captain Veldhuyzen van Zanten was KLM's chief of flight training and the
airline's preferred pilot for publicity such as magazine advertisements. As
such, KLM attempted to contact him to give public statements regarding the
disaster, before learning that he was the captain involved. Veldhuyzen van
Zanten had given Klaas Meurs, the first officer on the ill-fated flight, his
Boeing 747 qualification check about two months before the accident.

Investigation

About 70 crash investigators from Spain, the Netherlands, the United States,
and the two airline companies were involved in the investigation. Facts
showed that there had been misinterpretations and false assumptions.
Analysis of the CVR transcript showed that the KLM pilot was convinced that
he had been cleared for takeoff, while the Tenerife control tower was certain
that the KLM 747 was stationary at the end of the runway and awaiting
takeoff clearance. It appears KLM's co-pilot was not as certain about take-off
clearance as the captain.

Subsequent to the crash, first officer Robert Bragg, who was responsible for
handling the Pan Am's radio communications, made public statements which
conflict with statements made by the Pan Am crew in the official transcript of
the CVR. In the documentary Crash of the Century (produced by the makers
of Mayday), he stated he was convinced the tower controller had intended
they take the fourth exit C-4 because the controller delivered the message to
take "the third one, sir, one; two, three; third, third one" after the Pan Am's
had already passed C-1 (making C-4 the third exit counting from there). The
CVR shows unequivocally that they received this message before they
identified C-1, with the position of the aircraft somewhere between the
entrance and C-1. Also, in a Time article, Bragg stated that he made the
statement "What's he doing? He'll kill us all[!]" which does not appear in the
CVR transcript.

Probable cause

The investigation concluded that the fundamental cause of the accident was
that the KLM captain took off without takeoff clearance. The investigators
suggested the reason for his mistake might have been a desire to leave as
soon as possible in order to comply with KLM's duty-time regulations, and
before the weather deteriorated further.

Other major factors contributing to the accident were:

The sudden fog greatly limited visibility. The control tower and the crews of
both planes were unable to see each other.

Simultaneous radio transmissions, with the result that neither message could
be heard.

The following factors were considered contributing but not critical:

Use of ambiguous non-standard phrases by the KLM co-pilot ("We're at take

off") and the Tenerife control tower ("OK").

Pan Am mistakenly continued to exit C-4 instead of exiting at C-3 as

directed.

The airport was (due to rerouting from the bomb threat) forced to
accommodate a great number of large aircraft, resulting in disruption of the
normal use of taxiways.

Dutch response

The Dutch authorities were reluctant to accept the Spanish report blaming
the KLM captain for the accident. The Netherlands Department of Civil
Aviation published a response that, whilst accepting that the KLM aircraft
had taken off "prematurely", argued that he alone should not be blamed for
the "mutual misunderstanding" that occurred between the controller and the
KLM crew, and that limitations of using radio as a means of communication
should have been given greater consideration.

In particular, the Dutch response pointed out that

the crowded airport had placed additional pressure on all parties, KLM, Pan
Am, and the controller;

sounds on the CVR suggested that during the incident the Spanish control
tower crew had been listening to a football game on the radio and may have
been distracted.

the transmission from the tower in which the controller passed KLM their ATC
clearance was ambiguous and could have been interpreted as also giving
take-off clearance. In support of this part of their response, the Dutch
investigators pointed out that Pan Am's messages "No! Eh?" and "We are still
taxiing down the runway, the Clipper 1736!" indicated that Captain Grubbs
and First Officer Bragg had recognised the ambiguity;
if the Pan Am aircraft had not taxied beyond the third exit, the collision
would not have occurred.

Speculations

Speculation regarding other contributing factors includes:

Captain van Zanten's failure to confirm instructions from the tower. The
flight was one of his first after spending six months training new pilots on a
flight simulator, where he had been in charge of everything (including
simulated ATC), and having been away from the real world of flying for
extended periods.

The flight engineer's apparent hesitation to challenge Van Zanten further,

possibly because Captain van Zanten was not only senior in rank, but also
one of the most able and experienced pilots working for the airline.

A study group put together by the Air Line Pilots Association found that not
only the captain, but the first officer as well dismissed the flight engineer's
question. In that case, the flight engineer might have been either reassured
or even less inclined to press the question further.

The reason only the flight engineer reacted to the radio transmission "Alpha
one seven three six report when runway clear" might lie in the fact that this
was the first and only time the Pan Am was referred to by that name. Before
that, the plane was called "Clipper one seven three six". The flight engineer,
having completed his pre-flight checks, might have recognized the numbers
but his colleagues, preparing themselves for take-off, might have
subconsciously been tuned in to "Clipper".

The extra fuel the KLM plane took on added several factors:

it delayed takeoff an extra 35 minutes, which gave time for the fog to settle
in;

it added over forty tons of weight to the plane, which made it more difficult
to clear the Pan Am when taking off;

it increased the size of the fire from the crash that ultimately killed everyone
on board.

Captain van Zanten's reaction, once he spotted the Pan Am plane, was to
attempt to take off before he had adequate airspeed. The sharp lifting angle
caused the KLM jet to drag its tail on the runway, thereby reducing its speed
even further. The plane had, however, exceeded its V1 speed .

Responsibility

Although the Dutch authorities were initially reluctant to blame Captain van
Zanten and his crew , the airline ultimately accepted responsibility for the
accident. KLM paid the victims or their families compensation ranging
between $58,000 and $600,000.

Safety response

As a consequence of the accident, there were sweeping changes made to

international airline regulations and to aircraft. Aviation authorities around
the world introduced requirements for standard phrases and a greater
emphasis on English as a common working language. For example, ICAO
calls for the phrase "line up and wait" as an instruction to an aircraft moving
into position but not cleared for takeoff. The FAA equivalent is "position and
hold" . Also several national air safety boards began penalizing pilots for
disobeying air traffic controller's orders. Air traffic instruction should not be
acknowledged solely with a colloquial phrase such as "OK" or even "Roger",
but with a read back of the key parts of the instruction, to show mutual
understanding. Additionally, the phrase "takeoff" is only spoken when the
actual takeoff clearance is given. Up until that point, both aircrew and
controllers should use the phrase "departure" in its place (for example
"ready for departure"). Cockpit procedures were also changed. Hierarchical
relations among crew members were played down. More emphasis was
placed on team decision-making by mutual agreement. This is known in the
industry as Crew Resource Management.

In 1978 a second airport was inaugurated on the island: the new Tenerife
South Airport (TFS). This airport now serves the majority of international
tourist flights. Los Rodeos, renamed to Tenerife North Airport (TFN), was then
used only for domestic and inter-island flights, but in 2002 a new terminal
was opened and it carries international traffic once again, including budget
airlines. The Spanish authorities installed a ground radar at Tenerife North
following the accident.
1996 Charkhi Dadri mid-air collision

The 1996 Charkhi Dadri mid-air collision occurred on 12 November 1996

when Saudi Arabian Airlines Flight 763 (SVA 763), a Boeing 747-168B en
route from New Delhi, India, to Dhahran, Saudi Arabia, collided in mid-air
with Kazakhstan Airlines Flight 1907 (KZK 1907), an Ilyushin Il-76 en route
from Shymkent, Kazakhstan to New Delhi, over the village of Charkhi Dadri,
Haryana, India. All 349 people on board both flights were killed, making it the
deadliest mid-air collision in history.

History and cause

Flight SVA 763 departed Delhi at 6:32 PM local time. Flight KZK 1907 was, at the same time,
descending to land at Delhi. Both flights were controlled by approach controller VK Dutta. The
crew of flight 763 consisted of captain Khalid Al Shoubaili, first officer Nazir Khan, and flight
engineer Evris. On Flight KZK 1907, Gennadi Cherepanov served as the pilot and Egor Repp
served as the radio operator.
Flight KZK 1907 was cleared to descend to 15,000 feet (4,600 m) when 74 miles (119 km) from
the airport while Flight SVA 763, traveling on the same airway as Flight KZK 1907 but in the
opposite direction, was cleared to climb to 14,000 feet (4,300 m). About eight minutes later,
around 6:40 PM, Flight KZK 1907 reported having reached its assigned altitude of 15,000 feet
(4,600 m) but it was actually lower, at 14,500 feet (4,400 m), and still descending. At this time,
Dutta advised the flight, "Identified traffic 12 o'clock, reciprocal Saudia Boeing 747, 10 miles
(16 km). Report in sight."
When the controller called Flight KZK 1907 again, he received no reply. He warned of the other
flight's distance, but it was too late—the two aircraft had crashed almost head-on. The tail of
KZK 1907 sliced through the left wing of SVA 763. Flight SVA 763 had lost its horizontal
stabilizer in its left wing and as a result, went into spiral motion towards the ground resulting in
an in-flight structural failure; at almost 705 miles per hour the aircraft hit the ground. The
fuselage of Flight KZK 1907 remained structurally intact until it crashed in a field. Rescuers
discovered four critically injured passengers but all died soon afterward . In the end, all 312
people on board Flight SVA 763 and all 37 people on Flight KZK 1907 perished.
Capt. Timothy J. Place, a pilot for the United States Air Force, was the sole eyewitness to the
event. He was making an initial approach in a Lockheed C-141B Starlifter when he saw "the
cloud suddenly flashes into bright red".

Crash investigation and report

The crash was investigated by the Lahoti Commission, headed by then-Delhi
High Court judge Ramesh Chandra Lahoti. Depositions were taken from the
Air Traffic Controllers Guild and the two airlines. The flight data recorders
were decoded by Kazakh Airlines and Saudia under supervision of air crash
investigators in Moscow and Farnborough, Hampshire, England, respectively.
The commission determined that the accident had been the fault of the
Kazakh Il-76 commander, who (according to FDR evidence) had descended
from the assigned altitude of 15,000 feet (4,600 m) to 14,500 feet (4,400 m)
and subsequently 14,000 feet (4,300 m) and even below that. The report
ascribed the cause of this serious breach in operating procedure to the lack
of English language skills on the part of the Kazakh aircraft pilots; they were
relying entirely on their radio operator for communications with the ATC.
Kazakh officials stated that the aircraft had descended while their pilots were
fighting turbulence inside a bank of cumulus clouds. Also, a few seconds
from impact, the Kazakh plane climbed slightly and the 2 planes collided. If
they had not climbed slightly, it is likely that they would have passed under
the Saudi plane. The counsel for the ATC Guild denied the presence of
turbulence, quoting meteorological reports, but did state that the collision
occurred inside a cloud. This was substantiated by the affidavit of Capt.
Place, who was the commander of the aforementioned Lockheed C-141B
Starlifter he was flying into New Delhi at the time of the crash. The members
of his crew would file similar affidavits. The ultimate cause was held to be
the failure of the Kazakh pilot to follow ATC instructions, whether due to
cloud turbulence or due to communication problems.
Indira Gandhi International Airport did not have secondary surveillance radar,
which produces exact readings of aircraft altitudes; instead the airport had
outdated primary radar, which produced approximate readings. In addition,
the civilian airspace around New Delhi had one corridor for departures and
arrivals. Most areas separate departures and arrivals into separate corridors.
The airspace had one civilian corridor because much of the airspace was
taken by the Indian Air Force. Due to the crash, the air-crash investigation
report recommended changes to air-traffic procedures and infrastructure in
New Delhi's air-space: Separation of in-bound and out-bound aircraft through
the creation of 'air corridors', installation of a secondary air-traffic control
radar for aircraft altitude data, mandatory collision avoidance equipment on
commercial aircraft operating in Indian airspace and reduction of the
airspace over New Delhi which was formerly under exclusive control of the
Indian Air Force.
The Civil Aviation Authorities in India made it mandatory for all aircraft flying
in and out of India to be equipped with an ACAS (Airborne Collision
Avoidance System). This was the first time in the world that ACAS was
mandatory.

2010 Polish Air Force Tu-154 crash

The 2010 Polish Air Force Tu-154 crash happened on 10 April 2010, when a
Tupolev Tu-154M aircraft of the Polish Air Force crashed near the city of
Smolensk, Russia, killing all 96 people aboard. These include the Polish
president Lech Kaczyński and his wife, the chief of the Polish General Staff
and other senior Polish military officers, the president of the National Bank of
Poland, Poland's deputy foreign minister, Polish government officials, 12
members of the Polish parliament, senior members of the Polish clergy, and
relatives of victims of the Katyn massacre. They were en route from Warsaw
to attend an event marking the 70th anniversary of the Katyn massacre. The
site of the Katyn massacre is approximately 19 kilometres (12 mi) west of
Smolensk.
The cause of the crash is under investigation. According to preliminary
reports, the pilot attempted to land at Smolensk North Airport, a recently
decommissioned former military airbase, in thick fog that reduced visibility
to about 500 metres (1,600 ft). The plane was too low as it approached the
runway. It struck trees in the fog, turned upside down, and fell to the ground
200 metres (660 ft) before the airfield in a wooded area, where it broke into
pieces.

Accident

The Tupolev Tu-154M of the carrying Polish President Lech Kaczyński

crashed at 10:56 MSD (08:56 CEST, 06:56 UTC), near the village of Pechersk,
just north of the city of Smolensk, Russia, from where Kaczyński was due to
visit the nearby site marking the 70th anniversary of the Katyn massacre.
The plane took off at 07:23 CEST (05:23 UTC) from Warsaw Frédéric Chopin
Airport (800 km away from Smolensk), carrying 89 passengers and 7
crewmembers; presidential aide Zofia Kruszyńska-Gust became ill just
before the trip and did not board the plane. Some of the earlier reports gave
erroneous information about the number of persons on board the flight.

About an hour before the crash, a Yakovlev Yak-40 jet also belonging to the
Polish government carrying Polish journalists from the president's press pool
landed at the airbase without incident. But the weather conditions were
quickly deteriorating: shortly after, a Russian Ilyushin Il-76 attempted to
land, but due to poor visibility, the crew decided to divert to the Vnukovo
Airport near Moscow. When the presidential plane arrived at the airbase it
was enveloped in thick fog, and the ground control personnel suggested the
pilot land at another airfield. The pilot was told by the control tower to divert
the plane's landing to either Moscow or Minsk (400 km and 300 km away,
respectively). However after circling the airport at several hundred meters of
altitude three times, the pilot made the decision to land there. The plane
crashed during this attempt 200 m (650 feet) short of the runway after
hitting some 10-metre (33-foot) high trees on the approach to the
runway. The crash occurred in fog (500 m/1,600 ft visibility) about 200
metres (700 ft) from Smolensk North Airport, 300 to 400 metres (1,000 to
1,300 ft) off the landing path. The cause of the crash is under
investigation. Preliminary data suggest this incident may have been
controlled flight into terrain, despite the fact that the plane had been
equipped with a terrain awareness and warning system (TAWS) made by
Universal Avionics Systems of Tucson. On 24 April 2010 The Russian
Interstate Aviation Committee confirmed that TAWS system was turned on.
However, there is no Smolensk (XUBS) airport in the TAWS database.

The Governor of Smolensk Oblast, Sergey Antufyev, confirmed that there

were no survivors in the crash. Pictures from the scene showed parts of the
airplane charred and strewn through a wooded area. The Russian Prime
Minister, Vladimir Putin, said that the bodies of those killed in the crash
would be brought to Moscow for identification. However, Kaczyński's body
was identified in Smolensk and was flown directly to Warsaw on the
afternoon of 11 April.
Investigation

Within hours of the crash, the President of Russia, Dmitry Medvedev,

announced the establishment of a special commission for the investigation of
the accident. The commission will be supervised by Prime Minister Vladimir
Putin. An Investigation Committee of the Prosecutor General of Russia
started a criminal case in accordance with a "violation of the safety rules" of
the Russian Criminal Code.

Putin and Medvedev expressed to the Polish Prime Minister Donald Tusk that
they would work closely with Poland in investigating the crash. Initial signs
pointed to an accident, possibly due to the fog that is very common in the
area in spring and autumn, as well as pilot error.

Two flight recorders were recovered undamaged from the crash site during
the afternoon/early evening of 10 April, as was confirmed by Sergey Shoygu,
the Russian Minister of Emergency Situations. That evening, it was reported
that the recordings confirm that the pilot was making attempts to land
against the advice of air traffic controllers. The third flight recorder was
found on 12 April.

Preliminary data indicated that the plane hit the treetops as it was making
the approach to the airport in poor visibility.

On the day after the crash, investigators said they had reviewed the flight
recorders, and confirmed that there were no technical problems with the
Soviet-built aeroplane, ruling out initial theories that the 20-year-old plane
was at fault. Alexei Gusev, general director of the Aviakor factory, said that
the aircraft's three engines had been repaired and technicians had upgraded
the plane's avionics. He said that there were no doubts about the plane's
airworthiness.

Russia is offering full cooperation to Polish prosecutors during the

investigation. Polish investigators in Russia have been given access to all
procedures of Russian investigators. They do not have the authority to
conduct investigative actions by themselves, but they are participating on
equal terms with their Russian counterparts in the interviews with people
involved and other parts of the investigation. Polish officials are to secure all
Polish state documents found in the wreckage, as well as electronic devices
(portable computers and mobile telephones) belonging to government
officials and military officers. In turn Russian investigators received from
Poland materials secured after the crash, including those about the technical
state of the airplane and fitness of the pilot. The Polish investigation results
will be based in part on Russian findings, but they are not bound by the
results of the Russian investigation. Preliminary results of the investigations
were to be released on Thursday (including the cockpit voice recordings), but
this was postponed until after the weekend when the funeral of the
presidential couple is to take place. The third flight data recorder, designed
and produced in Poland, will be sent to Poland and analyzed there, with the
participation of Russian experts. An initial report by Russia's Interstate
Aviation Committee (Russian: Межгосударственный авиационный
комитет (MAK)) revealed that all three engines were operating normally,
and that there was no fire or explosion before the aircraft crashed.

The aircraft

The aircraft, a Tupolev Tu-154M, construction number 90A837, was

manufactured at Kuibyshev aviation plant (No. 18) on 29 June 1990 for the
Polish Air Force. It was one of two Tupolev Tu-154s that served as official
government jets; this aircraft—with a tail number of 101—was for
presidential use, while another—marked 102—is used by the prime minister.
The aircraft had undergone a major overhaul in December 2009 and Aleksey
Gusev, the head of the maintenance plant that carried out the work, told
Polish TV that it should not have had technical problems. The crash
happened 138 flight hours after the most recent overhaul.

Technical installations at Smolensk North Airport

Smolensk North Airport, a former military airbase now in mixed military-

civilian use, is not equipped with a Western-style ILS (instrument landing
system), only with a Russian ILS-like PRMG system, which would have
allowed for safe operations in extreme instrument meteorological conditions.
The Polish airplane was modified to use the Western-style ILS. A non-
directional beacon system (NDB) is installed at the airport, but such a
system can be used only for a non-precision approach to the runway, as its
antennas are situated on the opposite ends of the runway and thus give only
basic directional information about a landing plane's position relative to the
axis of the runway. As it is a navigational aid, not a landing aid, it remains
the crew's responsibility to keep track of the planes altitude.
Airport and pilot communication

The airport's traffic control communicated with the pilots in Russian, and,
according to one of the controllers, the Polish crew had problems
communicating in this language. However, according to Tomasz Pietrzak, the
former commander of the Polish 36th Special Aviation Regiment, the pilot in
charge of the flight Arkadiusz Protasiuk knew Russian perfectly. Protasiuk
had landed in Smolensk three days before the crash, when he was part of
the crew bringing Polish Prime Minister Donald Tusk to the April 7 ceremony,
and at the time no communication problems with ground control were
reported.

The airport, which should have normally been closed due to the severe
conditions, was not declared closed as its management feared that this could
cause a diplomatic incident. According to the news agency Interfax, the pilot
was told that Smolensk North Airport was enveloped in thick fog and strongly
advised against landing, but still he decided to continue with the original
flight plan to Smolensk and attempt a landing. According to an interview
with a flight controller Pavel Plusnin it was suggested to the pilot that he
land at an alternative airfield in Moscow or Minsk. According to Plusnin, the
pilot said, that he would attempt one approach, and if landing was not
possible, he would then divert to another airfield.

Alexandr Aleshin, the First Deputy Chief of the Staff of the Russian Air Force,
said that during the ensuing runway approach the plane increased its
descent rate and went below the glide slope 1.5 km (0.93 mi) from the
runway. Controllers instructed the pilot to abort the approach; when he did
not, controllers advised the aircraft to fly to one of the suggested alternative
landing points. According to Aleshin, this order was repeated several times
but the crew continued with the approach and crashed.