Air Line Pilot, August 2000, page 18
By Gerard M. Bruggink
"It is appalling to see what trivial things can be among the causes of massive disaster." --Edmund Fuller, 1977
The accident happened in visibility so poor that the three parties involved (the two flight crews and the air traffic controllers) had no visual contact.
While facing the uncertainties of the new century, we would do well to remember the remarkable convergence of events and circumstances that culminated in aviation's worst disaster of the previous century--the 1977 accident that killed 583 persons when two Boeing 747s collided on the runway in Tenerife, the Canary Islands. The accident happened in visibility so poor that the three parties involved (the two flight crews and the air traffic controllers) had no visual contact. With no ground radar available, radio communications provided the only means of ensuring separation. That something went wrong with the information transfer is obvious, because one aircraft took off while the other was still on the runway.
This article will review some of the opportunities that existed to prevent the accident or to reduce the likelihood of its occurrence. This should lead to a better understanding of the most basic of human factor concepts: make it easier for yourself and others to stay out of harm's way. I will not try to cover every aspect of this accident. Readers who wish to know more details should read
1. the official Spanish accident report as reprinted in ICAO Aircraft Accident Digest No. 23;
2. the comments of the Dutch investigating authority appended to the Spanish report in accordance with the provisions of ICAO Annex 13; and
3. the human factors report on the Tenerife accident prepared by an ALPA study group.
Summary of events
On Sunday, March 27, 1977, the two B-747 charter flights that were to collide at Tenerife were heading for Las Palmas in the Canary Islands. One of them, KLM Flight 4805, had left Amsterdam at 0900 GMT. The other, Pan American Flight ("Clipper") 1736, had originated in Los Angeles. After a crew change and a refueling stop in New York, the flight took off at 0742 GMT.
At 1230 GMT, a terrorist's bomb exploded in the passenger terminal at Las Palmas and the airport was closed. (Local time at Las Palmas and Tenerife was the same as GMT; flying time between the two airports is about 25 minutes.) Many of the aircraft destined for Las Palmas were diverted to Los Rodeos Airport at Tenerife, including KLM 4805 and Clipper 1736.
While approaching Tenerife, the Pan Am captain requested permission to hold at altitude because he had adequate fuel. ATC refused the request and ordered the flight to land. The KLM and Pan American flights landed at 1338 and 1415, respectively. About 20 minutes after they landed, the KLM passengers were transported by bus to the terminal. The Pan Am passengers did not leave the aircraft.
At 1430, Las Palmas Airport opened and the exodus from Tenerife began. Clipper 1736 was ready to depart but was unable to do so because KLM 4805 blocked its entrance to Runway 12 (see airport diagram). The departure of both aircraft was delayed because the KLM aircraft was being refueled to avoid delay in Las Palmas, where another group of tourists was waiting for the return flight to Amsterdam the same day. The Spanish report does not give the time when the refueling started or how long it lasted. Nor does the report explain whether the captain did this on his own initiative or on the advice of his company. After stating that KLM 4805 had taken on 55,000 liters of fuel, the Spanish report makes this observation: "The aircraft could, in fact, have returned to Amsterdam with the fuel it had without refueling in Las Palmas."
At about 1645, fueling was completed and both flight crews called for start clearance. At 1658, KLM 4805 was cleared onto the airport's only runway. After some confusion about the taxi route, the flight was cleared to backtaxi to the end of the runway. Four minutes later, Clipper 1736 was also cleared to enter the runway with hard-to-understand instructions to leave the runway by the third taxiway. By this time, visibility had become very poor with light rain and patchy fog.
While KLM 4805 was backtaxiing on the runway, the controller asked the flight crew to report when it was ready to copy the ATC clearance. Because the flight crew was performing the checklist, copying this clearance was postponed until the aircraft was lined up in the direction of takeoff on Runway 30.
At 1702:51, the tower contacted KLM 4805:
Tower: KLM four eight zero five, how many taxiways did you pass?
KLM: I think we just passed Charlie four now.
Tower: Okay, at the end of the runway, make a one eighty and report ready for ATC clearance.
KLM: Okay, sir.
At 1703:29, the flight crew of Clipper 1736 contacted the tower. No one was talking in the KLM cockpit at this time, and the next exchange was clearly audible in that cockpit:
Pan Am: Would you confirm that you want the Clipper one seven three six to turn left at the third intersection? [Emphasis on third.]
Tower: The third one, sir, one, two, three, third, third one.
Pan Am: Very good, thank you.
Tower: Clipper one seven three six, report leaving the runway.
Pan Am: Clipper one seven three six.
The Pan Am crew's acknowledgment of the tower controller's instruction occurred just after the KLM captain told his crew to continue the checklist.
|The role players in this accident failed, in varying degrees, to act in accordance with the most basic of human factors concepts: make it easier for yourself, and others to stay out of harm's way.|
At 1704:24 the discussion in the Pan Am cockpit indicated that the crew saw Taxiway C-1. At 1704:58, the tower informed both flight crews that the runway centerline lights were out of order. At 1705:22, the Pan Am captain said, "That's two" [the second exit or taxiway]. The CVR transcript contains no subsequent mention of anyone's seeing or passing Taxiway C-3. When the collision occurred 1½ minutes later, the Pan Am airplane was approaching Taxiway C-4.
At 1705:44, a series of communications began, starting with a transmission from KLM's first officer (the times within the parentheses indicate when the transmission ended):
1705:44--KLM: The KLM four eight zero five is now ready for takeoff, and we are waiting for our ATC clearance. (1705:51)
1705:53--Tower: KLM four eight zero five, you are cleared to the Papa beacon, climb to and maintain flight level nine zero, right turn after takeoff, proceed with heading zero four zero until intercepting the three two five radial from Las Palmas VOR. (1706:08)
1706:09--KLM: Ah, roger, sir, we are cleared to the Papa beacon, flight level nine zero, right turn zero four zero until intercepting the three two five. We are now [uh-takin' off] or [at takeoff]. (1706:17)
The last portion of the first officer's readback was rushed and unclear. The two possible interpretations of the last two words are shown within brackets.
About 6 seconds before the first officer ended his readback, the brakes of KLM 4805 were released. At 1706:12, the KLM captain said, "Let's go--check thrust," and began the takeoff roll.
The controller's reply to the readback of the ATC clearance:
1706:18--Tower: Okay--(pause of 1.89 seconds) stand by for takeoff. I will call you. (1706:22)
Only the word, "Okay," was clearly heard in the KLM cockpit. The rest of the controller's sentence was blocked by an electronic squeal that was caused by the simultaneous transmission from Pan Am, which started shortly after the controller said, "Okay":
Pan Am: And we're still taxiing down the runway, the Clipper one seven three six. (1706:23)
Just the last few words, "Clipper one seven three six," were clearly audible in the tower and the KLM cockpit. Neither the controller nor the Pan Am crew was aware that the vital parts of their transmissions had overlapped.
At 1706:25, about 25 seconds before impact, the controller acknowledged receipt of the Clipper call sign:
Tower: Papa Alpha one seven three six, report runway clear.
Pan Am: Okay, will report when we're clear.
Tower: Thank you. (1706:32)
Immediately after this exchange, which was audible in the KLM cockpit, the KLM flight engineer raised a question:
1706:32--Flight engineer: Is he not clear, then?
Captain: What do you say?
Flight engineer: Is he not clear, that Pan American?
Captain: Oh, yes (emphatic). (1706:36)
At the same time the following comments were made in the Pan Am cockpit:
1706:32--Captain: Let's get the # # # [expletive] out of here.
First officer: Yes, he's anxious, isn't he?
Flight engineer: Yeh, after he held us up for an hour and a half.
Captain: There he is--look at him # # # that # # # is coming.
First officer: Get off! Get off! Get off!
1706:48--Sound of approaching KLM engines.
Three seconds before the collision, the KLM captain uttered an exclamation when he saw the Pan Am aircraft. He forced his airplane off the ground but was unable to lift it completely over the Pan Am B-747, which had turned sharply to the left when its flightcrew saw the other airplane approaching. There were no ground witnesses to the collision.
Both aircraft were destroyed by impact and fire.
Of the 248 occupants of the KLM aircraft, none survived. Of the 389 occupants of the Pan Am aircraft, 54 survived, including the flight crew.
The combined flying experience of the three Pan Am flightcrew members was 47,053 hours of which 3,919 were on the B-747. For the three KLM flightcrew members, these figures were 36,110 and 2,170 hours respectively.
The KLM captain was a training captain and the head of the company's Flight Training Department. Over the previous 6 years, he had spent most of his time conducting training on the B-747. He had given the first officer on the accident flight his B-747 qualification check about 2 months before the accident at Tenerife.
At the time of the accident, the Pan Am crew had 11 hours 20 minutes of duty time. The KLM crew had been on duty about 9 hours 20 minutes.
According to the Dutch comments to the Spanish report: "During taxiing out, the [KLM] captain several times asked the first officer for information that was already supplied. This might indicate some form of absentmindedness. However, it must be taken into account that he was occupied with the performance of the cockpit checklist."
Shortly before starting the engines, the Pan Am captain commented that he was "ready for the sack." Before he taxied onto the runway, he told the first officer, "We can hold here if he would let us." The first officer apparently did not hear this; he had trouble communicating with the ground controller and was tuning the radio to the approach control frequency.
Air traffic controllers
According to the ALPA report, at the time of the accident, a ground controller and an approach controller, co-located in the control tower, were providing air traffic control. The tower controller position was not staffed because of a lack of personnel. Both controllers had come on duty at about 1000 GMT.
The airport at Tenerife was not designed to accommodate the large number of aircraft that were diverted there the day of the accident. When the KLM and Pan Am B-747s taxied onto the runway, Taxiways C-1 and C-2 could not be used because of parked aircraft. The controllers had to provide aircraft separation under very poor visibility conditions and without the aid of ground radar.
The controllers and the flight crews of both aircraft used the word "Okay" several times in their radio transmissions. The controller used the call sign Papa Alpha 1736 (for Pan American) once that afternoon (at 1706:25). At all other times, the controller used the call sign "Clipper 1736."
The Dutch comments refer to background noises audible on the KLM CVR that suggest that the controller could hear the sound of a football match, via radio or television.
Duty time limits
According to the ALPA report, in December 1976, the Dutch government changed the work and rest regulations for flight crews. As a result, a captain no longer had the authority to extend duty time. The KLM crew "discussed the possibility of fines, imprisonment, or loss of licenses, should the time limits be exceeded," the ALPA report said.
According to the Spanish report, calculating the time limits had become "enormously complicated" and was impossible to do in the cockpit. The KLM captain spoke by HF to KLM's operations office in Amsterdam. He was told he would have no problem if he was able to take off before a certain time and that KLM would send a telex to Las Palmas if the flight crew risked exceeding the duty time limit (what this "certain time" was is not given).
The third taxiway
The pilots of Clipper 1736 were instructed to use the "third taxiway to the left." On the airport diagram, this exit is shown as C-3. The Pan Am airport chart did not designate the exits by number. Nor did signs or other markings identify the runway exits at the Tenerife airport.
Using C-3 to get on the parallel taxiway would require making two 145-degree turns. The exit and the parallel taxiway are both 73.8 feet wide. According to turning radius charts for the B-747, that airplane needs a minimum pavement width of 142 feet to make a 180-degree turn. The space required to turn 145 degrees is not given.
According to the ALPA study group, keeping all airplane wheels on a load-bearing surface while making the second 145-degree turn would have been a "practical impossibility." According to the Dutch comments, based on tests with a B-747 at Amsterdam's Schiphol Airport, "this maneuver could reasonably be performed." The Spanish report does not explain why the controller ordered the B-747 crew to use C-3 instead of C-4, the last exit, which would have involved two turns of about 35 degrees. (Note: based on measurement of C-4 as depicted on the Spanish wreckage distribution diagram, using that exit required a turn of about 16 degrees.)
After discussing the Pan Am crew's identification of C-1 and C-2, the Spanish report states: "Then, perhaps through error, or thinking that C-4 was an easier exit than C-3, they overshot the exit ordered by the tower."
The ALPA study group interviewed the Pan Am captain at an unspecified time. After discussing the problems associated with negotiating the sharp turns of C-3, ALPA's report states: "Thus, the Pan Am crew was convinced that the controller must have meant them to leave by C-4, an exit involving a left turn of only 35 degrees or so. Reinforcing this conclusion was the fact that, having seen other B-747[s] at Tenerife, they believed that the controller must have been familiar with its critical geometry. Once having reached that conclusion, and considering the previous confusion regarding their [taxi] route, they believed it better to proceed with their plan, rather than further question the controller."
That paragraph is followed by the comment that Pan Am 1736 was probably passing C-3 when the controller delivered the departure clearance to KLM 4805. As the controller delivered that clearance, the Pan Am crew was silent and listened to that clearance--because they could expect the same departure as that given KLM. "This concentration on the aural rather than the visual channel, along with the very low visibility, may have prevented their seeing Taxiway C-3 as they passed."
The distance from the tower to the C-3 exit at the runway was about 500 meters. There are no indications that the controller saw the KLM or the Pan Am airplane passing that or any other exit.
The airport is just a few miles from the sea coast and is 2,073 feet above sea level. Clouds that are 2,000 feet above the coastal waters are blown at ground level over the airport and produce rapid and drastic changes in visibility. A few minutes before the accident, the runway visibility at the approach end of Runway 30 was 300 meters.
Before engine start, the KLM captain said: "Hurry, or else it will close again completely." As the Pan Am airplane entered the runway, its captain said: "I don't think they have takeoff minimums anywhere right now."
The sequence of events that culminated in the collision at Tenerife began with the explosion of a bomb at the Las Palmas airport and the diversion of aircraft to Tenerife. However, that terrorist act was not an intrinsic part of the accident scenario that unfolded about 4½ hours later. This also applies to some of the subsequent events that seemed to conspire to put both B-747s on the runway in poor visibility conditions, such as
the denial of Pan Am's request to hold at altitude until Las Palmas reopened,
the KLM airplane's blocking Pan Am's access to the runway because of congestion in the holding area for Runway 12, and
the refueling of the KLM airplane, which delayed the simultaneous departure of both airplanes until the weather had deteriorated.
Although eliminating any of these random events would have prevented this particular collision, they should not be given causal significance by treating them as prescriptions for disaster in and by themselves. Instead, they should be seen as typical operational challenges that are not an uncommon part of the seasoned line pilot's working environment. The associated delays and frustrations may increase psychological stress but not necessarily to the point where judgment and decision-making are compromised. That would depend on the coping ability of the individuals involved and the additional aggravation of other stressors.
By the time the two airplanes began to backtaxi on the runway, both captains had expressed concern about the weather conditions. Although the poor visibility and the limited facilities of the airport created hazardous conditions, this should have made it obvious to all three parties that extra caution and proper radio communication were the only safeguards.
The basic elements of the accident mechanism fell into place during the last minute before the collision. It began with the KLM first officer's transmission implicitly asking for a takeoff and an ATC clearance when his airplane was lined up for takeoff. The controller responded by delivering the ATC clearance. This was in accordance with what he had told the KLM 4805 flight crew a few minutes earlier when he instructed that flight to make a 180-degree turn at the end of the runway and report ready for the ATC clearance. He had already offered delivery of the ATC clearance when the flight started backtaxiing but it was declined. This created a situation in which any ambiguity in the ATC clearance could lead to a premature takeoff.
Because the ATC clearance also contained the words "cleared" and "takeoff," the KLM captain apparently believed that he had received an ATC clearance as well as a takeoff clearance, and he acted accordingly. Before the first officer completed the rushed readback of the clearance, the brakes of the KLM aircraft were released, and the captain said: "Let's go--check thrust." His actions indicate that he assumed the runway was clear.
The controller had no intention of giving KLM a takeoff clearance. About 2 minutes before he issued the ATC clearance, he had instructed Pan Am to report when leaving the runway, and he had not yet received such a report. That instruction and the conversation that preceded it were clearly audible in the KLM cockpit, and the crew was silent:
Pan Am: Would you confirm that you want the Clipper one seven three six to turn left at the third intersection?
Tower: The third one, sir, one, two, three, third, third one.
Pan Am: Very good, thank you.
Tower: Clipper one seven three six, report leaving the runway.
Clipper: Clipper one seven three six.
This exchange could have given the KLM crew the impression that Pan Am 1736's crew was looking at C-3 and that it took only confirmation by the controller to enter that exit. The fact that the Pan Am crew never reported that it had left the runway may have lost its significance for the KLM crew once they adopted that assumption. Actually, Pan Am had not even reached C-1 yet when that conversation took place.
Another explanation for the assumption that the Pan Am B-747 had left the runway may have been the KLM captain's mistaken belief that they were cleared for takeoff because no controller would give such a clearance unless he is sure it is safe to do so.
In the misleading light of hindsight, concluding that the KLM captain proceeded on a potentially deadly assumption without verifying that assumption with a brief radio call to Pan Am or the controller is easy. Such action would have taken only a few seconds and should be considered a natural part of a pilot-in-command's role as the last line of defense--provided that distracting concerns are not overriding his protective instincts. Psychological stressors may have compromised the KLM captain's judgment, making him "go-minded" at the expense of caution.
One such stressor may have been the inflexible duty time limits and the related penalties that kept him from using his own initiative in handling the situation that confronted him that afternoon. Uncertainty about returning to Amsterdam in time to escape the wrath of the Dutch Aviation Authority may have had an insidious effect on his decision-making. In 1999, an NTSB study referred to this accident as a possible example of how duty time rules that are too rigid may "create their own safety hazards" (NTSB/SR-99/01). The Flight Safety Foundation, in an article in its Airport Operations, MarchApril 2000, mentions how the influence of "a punitive culture of either an airline or a civil aviation authority" may affect a flight crew's decision to declare an emergency. The duty time limits in this case must have constituted a "punitive culture" for the KLM captain who was under time constraints.
The rapidly changing visibility conditions as the KLM captain lined up the airplane on Runway 30 were another psychological stressor. He had no way of knowing if these conditions would still meet his takeoff minimums if he waited any longer. Furthermore, as an upper management pilot, he may have been more concerned than a regular line pilot about the economic disadvantages to the company if his flight was stranded in Tenerife or Las Palmas.
Relevant with regard to the captain's state of mind may have been his questioning of the first officer about information that the controller had already supplied. The Dutch comments admit that this might indicate some form of absentmindedness, but add: "It must be taken into account that he was occupied with the performance of the cockpit checklist." Even if that was true, visualizing a situation in which checklist routine takes precedence over a controller's instructions is difficult.
In summary, the stress the captain was under when he was lined up for takeoff may have provoked a well-known human tendency: when our mind is firmly set on a desired course of action we tend to hear only what we want to hear and shut out everything that may interfere with our plan. David Beaty describes the phenomenon as follows: "In my 40-year fight for the role of human factors in aircraft accidents to be recognized, I have found that one of the very strongest of human factors is the resolute determination not to want to know, particularly if that knowledge is disturbing [and] discomforting and could be costly and embarrassing to take required action on."--British Airways Flight Deck, Autumn 1993.
While the KLM first officer was rushing through the readback of the ATC clearance, he saw that the captain was responding as if he had also received a takeoff clearance. Therefore, he ended his transmission with some hard-to-understand words: "We are now [uh- taking off] or [at takeoff]."
The controller's immediate response to the readback was "Okay," followed by a 1.89-second pause. The KLM captain must have interpreted that as approval of his earlier decision to start the takeoff roll.
What the controller meant by "Okay" is not explained. He probably used it to confirm the correctness of the ATC clearance readback. It might also have been a delaying term while he was thinking about the confusing last words of the readback.
Whatever the true explanation, following the pause after "Okay" the controller continued with: " stand by for takeoff--I will call you." That clear-cut instruction reflected his expectation that KLM 4805 was stationary and waiting for its takeoff clearance. However, the reception of that vital instruction in the KLM cockpit was distorted by an electronic squeal caused by the simultaneous transmission of a warning message from the Pan Am cockpit: "And we're still taxiing down the runway, the Clipper one seven three six." The squeal ended after the word "runway" so that only the Clipper's call sign was clearly audible in the KLM cockpit and the tower.
The controller's brief hesitation after his "Okay" was unfortunate but understandable. The same thing can be said about the Pan Am's crew reaction under the existing conditions. Being aware of the KLM captain's desire to be on his way to Las Palmas, they were rightfully concerned that the ambiguous term "Okay" could be misconstrued as a clearance to take off. Thus, when the controller paused momentarily, they jumped at the opportunity to send their warning message. This caused the virtual blocking of two transmissions, either of which should have stopped the KLM airplane in its tracks, had it been received separately.
Note: This accident could have been prevented if an anti-blocking device (ABD) had been in general use at the time; however, such a device was not developed until later. Systems that are now available can be easily installed at low cost. For an overview of the alarmingly slow progress through the regulatory mills of this solution to the hazards of frequency congestion, see "Be Careful--Heterodynes Are Out There!" January 1998.
The next comment can be made only in the form of a question: should the electronic squeal that followed the controller's "Okay" have raised a red flag in the KLM cockpit? The KLM crew must have realized that at least two parties were transmitting simultaneously. The first clear words following the squeal was the call sign given by Clipper 1736, suggesting that at least a Pan Am crewmember had been one of the callers. To what extent this should have aroused suspicion in a crew relieved to be on its way but engaged in a demanding takeoff is difficult to say.
As soon as the controller had finished his message, "Stand by for takeoff--I will call you," he heard the Pan Am airplane's call sign. His immediate response:
Tower: Papa Alpha one seven three six, report runway clear.
Pan Am: Okay, will report when we're clear.
The KLM flight engineer, who was probably more attentive to ongoing radio calls at that time than the two busy pilots, heard this and began to question his own belief that the Pan Am B-747 had left the runway:
Engineer: Is he not clear, then?
Captain: What do you say?
Engineer: Is he not clear, that Pan American?
Captain: Oh, yes. (emphatic)
Why the controller used "Papa Alpha" instead of "Clipper" as Pan Am's call sign for the first and only time that afternoon at that particular moment would be interesting to know. The least that can be said is that its use might have moderated the engineer's assertiveness.
The collision occurred 15 seconds after the captain said "Oh, yes" in response to the engineer's question. According to the Dutch comments, at the moment the captain spoke those words, he still could have successfully rejected the takeoff.
Underlying accident factors
The operational risks inherent in the prevailing conditions that afternoon could have been reduced by having both airplanes use the last runway exit (C-4). Some of the obvious advantages of using C-4 include the following:
The KLM crew would not have had to make a 180-degree turn on a 150-foot-wide runway with an airplane that had a minimum turning radius of 142 feet.
While the KLM airplane was in the holding area for Runway 30, its ATC clearance could have been delivered with less chance that the crew would also interpret it as a takeoff clearance.
The Pan Am crew would have avoided the risk of getting stuck while trying to negotiate the third exit.
The Pan Am crew would not have had the discussion with the controller about C-3 that may have given the KLM crew the impression that the Pan Am airplane was on the verge of leaving the runway.
The absence of identifying markers at the runway exits and on the small Pan Am airport chart would not have led to confusion if the controller had referred to C-4 as the last exit.
Why the Pan Am crew missed the third exit is not clear. The cockpit voice recorder gives no indication that the crew saw that exit. The Spanish and Dutch sources offer tentative explanations without referring to statements that the Pan Am captain may have made in his initial interviews. According to the ALPA report: "The Pan Am crew was convinced that the controller must have meant them to leave by C-4." If that was the case, it is tempting to speculate what might have happened if the Pan Am crew had volunteered information about its intentions in a timely manner.
This brief review of the previous century's worst aviation accident identified most of the opportunities that existed to prevent that disaster or to reduce the likelihood of its occurrence. The unavoidable impression is that frustration, fatigue, and a few system discrepancies, specifically the Dutch duty time limits, compromised the protective instincts of all three parties. Add to this the language problem and the possible influence of cultural differences, and it is not surprising that the information transfer left something to be desired.
The role players in this accident failed, in varying degrees, to act in accordance with the most basic of human factors concepts: make it easier for yourself and others to stay out of harm's way. The several manifestations of this shortcoming had a common denominator: uncritical acceptance of easily verifiable assumptions. In that regard, no amount of technological progress in the new century can alter the crucial role of the human factor in the aviation system.
Gerard M. Bruggink, a former deputy director of the Bureau of Accident Investigation at the NTSB who maintains his interest in accident investigation and prevention, also wrote "A Changing Accident Pattern," May 1997.