KLM-Panam Tenerife Disaster - Go Flight Medicine

‍

The Boeing 747 was first introduced in 1970 by Panam Airlines. The 747 was the first aircraft to earn the moniker 'Jumbo Jet', which has now become synonymous with all large passenger aircraft. Even after more than 3 decades, this incredible double-decker aircraft remains one of the largest in the fleet today. On 27 March 1977, not one but two Boeing 747's collided at a small airfield in the Canary Islands, causing the most deadly aircraft mishap to date. After the smoke and fog cleared, 583 souls had perished and the remaining 61 survivors suffered non-fatal injuries.

THE SWISS CHEESE MODEL

‍

There have been a variety of frameworks to describe the underlying process of human error. Highly reliable industries that experience constant threats to the safety of customers, employees or the public have embraced these models in an effort to better understand and prevent the serious accidents. One of the most well known of these frameworks is the Domino Theory of accident causation, which was created by early American industrial safety advocate Herbert Heinrich. This model suggested that injuries occurred due to one's social environment, which he likened to the first domino in a series. Once this domino fell over it directly caused a series of other dominos to fall ultimately leading to an accident and subsequent injury. This model from the 1930's was further developed by Frank Bird in the 1970's by simply changing the names of some of the dominoes. Bird felt that the initial cause of most accidents was due to lack of management controls or poor management decisions. Therefore, the initial domino became a metaphor for 'Absence of Safety Controls.'In 1990, a paper published by James Reason argued for an updated framework to better understand accident causation. This approach has come to be known as the "Swiss Cheese Model" and although originally described for use in the field of nuclear energy, has been embraced by aviation, space, healthcare and other highly reliable organizations. Rather than focusing on the preceding event as a cause for a given effect, the assumption in this model is that there exist many causes for potential errors in complex organizations that at times occur independently of one another. Sometimes these effects are caused by preceding events, but not always. The accident and subsequent injury only occurs if all of the 'holes' of the Swiss Cheese are aligned. If any barrier can disrupt this chain of events the accident will also be avoided.

The four overarching categories in the Swiss Cheese Model are:

Organizational Influences
Unsafe Supervision
Preconditions for Unsafe Acts
Unsafe Acts

Many lessons were learned from the Tenerife disaster and a variety of changes to standard communication and interpersonal interactions across aviation were proposed and later incorporated into the airlines industry after this tragedy. This monumental accident also provides a perfect example of the utility of the Swiss Cheese Model for describing the causation of accidents. As a number of unusual events and latent failures accumulated, it took just a handful of active failures in the form of unsafe acts to make this mishap seem inevitable. Although this model was not even developed until decades following the Tenerife Disaster, we can use this model to retroactively identify the various 'holes in the cheese'.

HOLES IN THE CHEESE

‍

If any of the below preconditions or subsequent unsafe acts did not occur, this tragic aircraft mishap would also likely have been avoided. Some of these preconditions caused another, yet some exist independently. The combination of all of these latent and active failures arising on the same day, place, and time provides a critical illustration as to how when the 'holes' in the Swiss Cheese Model align, an accident may be inevitable.

Explosion at Gran Canaria Airport: Both Pan Am Flight 1736 and KLM Flight 4805 were not originally scheduled to land at Los Rodeos, but instead had flight plans that concluded at the larger Gran Canaria Airport on another nearby island. A bomb detonated at Gran Canaria earlier that day and a second bomb threat was also received. This forced the airport to close temporarily and therefore all Gran Canaria air traffic were diverted to neighboring airports. Five large commercial aircraft were ultimately diverted to Los Rodeos (now Tenerife North Airport) on Tenerife Island.
Size & Characteristics of Los Rodeos Airport (Tenerife): Los Rodeos International Airport on Tenerife Island was a small one-runway regional airport that is not used to large volumes of air or ground traffic. Due to the fact that the airport has only one runway and one main taxiway, air traffic controllers (ATC) had to instruct aircraft to back-taxi down a runway to prepare for takeoff. In this case, KLM 5805 was instructed to back-taxi down the entire runway and prepare for takeoff at the other end. Pan Am 1736 was instructed to taxi down the runway in the same direction as KLM, but instead pull off into the third taxiway (C-3).

Dense Fog in Tenerife: Los Rodeos Airport, which is located at an elevation of 633 metres (2,077 feet) was experiencing low scattered clouds on the day of the mishap. As the various aircraft were taxiing prior to KLM's takeoff attempt, fog conditions continued to worsen. Visibility began at about 500 m (1,600 ft) and worsened to less than 100 m (330 ft). This low visibility prevented Pan Am 1736 from identifying which taxiway they were directed to turn off. Also, while KLM sat motionless at one end of the runway, their crew was completely unable to see Pan Am 1736 on the runway in front of them. After the collision occurred, the dense fog confused initial emergency responders even prevented them from finding the wreckage and survivors of the second aircraft.
Absence of Ground Radar: This technology, known simply as surface movement radar (SMR) by the International Civil Aviation Organization, has been available since the 1950's. By using SMR, air traffic controllers can have a full site picture of positions for all ground aircraft in an airfield. At the time of the mishap in Tenerife, Los Rodeos Airport did not have this technology available and therefore the dense fog prevented ATC from being able to directly visualize any aircraft's specific location. Instead, they had to infer an aircraft's location based on the description that crew members provided during radio transmissions.
KLM 4805 Fully Refuels at Los Rodeos Airport: This act alone, although not egregious or innappropriate, contributed or worsened the severity of this mishap in 3 notable ways. The additional time taken to fuel the KLM aircraft delayed takeoff by an additional 35 minutes, which allowed fog to worsen and visibility to decrease. The extra fuel also added considerable weight to the KLM Boeing 747, which forced the aircraft to require more runway to gain sufficient speed for takeoff. Without this additional weight, KLM 4805 may have cleared Pan Am 1736 prior to collision. Lastly, the additional fuel directly led to a much larger and more serious fire when it ignited following the collision, which significantly decreased the survival rate for passengers.
Pan Am 1736 Misses Turn: As stated above, Pan Am 1736 was supposed to make a left hand turn off of the runway down the third taxiway (C-3). The actual collision occurred near the fourth taxiway (C-4). Subsequent analysis determined that taxiway C-3 was poorly marked, would have required the Pan Am Boeing 747 to make a very difficult 148 degree turn, and was difficult to see in the dense fog.
[caption id="attachment_4235" align="alignright" width="300"]

Personality Traits of Key Personnel: Captain Veldhuyzen van Zanten of KLM 4805 was highly criticized and emphatically blamed by some after the cockpit voice recorder conversations were released. Upon first glance, it seems that Capt Veldhuyzen van Zanten's emphatic eagerness to depart led him to twice increase input to throttles with the intention to takeoff prior to clearance from ATC. In the first episode, the KLM First Officer spoke up pointing out that ATC had not provided clearance. In the second event, although the KLM Flight Engineer voiced uneasiness about this action, the Captain seemingly overruled him and began the takeoff. Veldhuyzen van Zanten was KLM's current chief of flight training and so respected by KLM that his photo adorned many KLM advertisements on their in-flight magazines. His senior position over the co-pilot and flight engineer was thought to have contributed to their seeming inability to effectively delay the takeoff until full clarification could be attained from ATC.

COCKPIT VOICE RECORDER (CVR) TRANSCRIPT

APP—Air traffic control tower at Los Rodeos AirportPA RT—Pan Am aircraft radio transmissionPA 1—Victor Grubbs, Pan Am CaptainPA 2—Robert Bragg, Pan Am First OfficerPA 3—George Warns, Pan Am Flight EngineerPA 4—Unidentified fourth person in Pan Am cockpit, likely one of two Pan Am employees who boarded in Tenerife and were sitting in the cockpit jumpseatsKLM RT—KLM aircraft radio transmissionKLM 1—Veldhuyzen (Jacob) van Zanten, KLM CaptainKLM 2—Klaas Meurs, KLM First OfficerKLM 3—Willem Schreuder, KLM Flight Engineer?—Unidentified

Figure 1 Enlarge Photo credit: © Galaxie Production1658:14.8 KLM RT: Approach KLM 4805 on the ground in Tenerife.1658:21.5 APP: KLM—ah—4805, roger.1658:25.7 KLM RT: We require backtrack on 12 for takeoff Runway 30.1658:30.4 APP: Okay, 4805 ... taxi ... to the holding position Runway 30. Taxi into the runway and—ah—leave runway (third) to your left.1658:47.4 KLM RT: Roger, sir, (entering) the runway at this time and the first (taxiway) we, we go off the runway again for the beginning of Runway 30.1658:55.3 APP: Okay, KLM 80—ah—correction, 4805, taxi straight ahead—ah—for the runway and—ah—make—ah—backtrack.1659:04.5 KLM RT: Roger, make a backtrack.1659:10.0 KLM RT: KLM 4805 is now on the runway.1659:15.9 APP: 4805, roger.1659:28.4 KLM RT: Approach, you want us to turn left at Charlie 1, taxiway Charlie 1?1659:32.2 APP: Negative, negative, taxi straight ahead—ah—up to the end of the runway and make backtrack.1659:39.9 KLM RT: Okay, sir.With the KLM aircraft now taxiing down Runway 12, Air Traffic Control turns its attention to Pan Am 1736. The controllers instruct the plane to travel down the runway and then exit it using one of the transverse taxiways. This would clear the way for the KLM plane to take off. This portion of the transcript comes from the Pan Am cockpit voice recorder.1701:57.0 PA RT: Tenerife, the Clipper 1736.1702:01.8 APP: Clipper 1736, Tenerife.1702:03.6 PA RT: Ah—we were instructed to contact you and also to taxi down the runway, is that correct?1702:08.4 APP: Affirmative, taxi into the runway and—ah—leave the runway third, third to your left, [background conversation in the tower].1702:16.4 PA RT: Third to the left, okay.1702:18.4 PA 3: Third, he said.PA?: Three.1702:20.6 APP: [Th]ird one to your left.1702:21.9 PA 1: I think he said first.1702:26.4 PA 2: I'll ask him again.1702:32.2 PA 2: Left turn.1702:33.1 PA 1: I don't think they have takeoff minimums anywhere right now.1702:39.2 PA 1: What really happened over there today?1702:41.6 PA 4:They put a bomb (in) the terminal, sir, right where the check-in counters are.1702:46.6 PA 1: Well, we asked them if we could hold and—uh—I guess you got the word, we landed here...1702:49.8 APP: KLM 4805 how many taxiway—ah—did you pass?1702:55.6 KLM RT: I think we just passed Charlie 4 now.1702:59.9 APP: Okay ... at the end of the runway make 180 [degree turn] and report—ah—ready—ah—for ATC clearance. [background conversation in tower]1703:09.3 PA 2: The first one is a 90-degree turn.1703:11.0 PA 1: Yeah, okay.1703:12.1 PA 2: Must be the third ... I'll ask him again.1703:14.2 PA 1: Okay.1703:16.6 PA 1: We could probably go in, it's ah...1703:19.1 PA 2: You gotta make a 90-degree turn.1703:21.6 PA 1: Yeah, uh.1703:21.6 PA 2: Ninety-degree turn to get around this ... this one down here, it's a 45.1703:29.3 PA RT: Would you confirm that you want the Clipper 1736 to turn left at the third intersection? ["third" drawn out and emphasized]1703:35.1 PA 1: One, two.1703:36.4 APP: The third one, sir, one, two, three, third, third one.1703:38.3 PA ?: One two (four).1703:39.0 PA 1: Good.1703:39.2 PA RT: Very good, thank you.1703:40.1 PA 1: That's what we need right, the third one.1703:42.9 PA 3: Uno, dos, tres.1703:44.0 PA 1: Uno, dos, tres.1703:44.9 PA 3: Tres—uh—si.1703:46.5 PA 1: Right.1703:47.6 PA 3: We'll make it yet.1703:47.6 APP: ...er 7136 [sic] report leaving the runway.1703:49.1 PA 2: Wing flaps?1703:50.2 PA 1: Ten, indicate 10, leading edge lights are green.1703:54.1 PA ?: Get that.1703:55.0 PA RT: Clipper 1736.1703:56.5 PA 2: Yaw damp and instrument?1703:58.6 PA 1: Ah—Bob, we'll get a left one...1703:59.3 PA 2: I got a left.1704:00.6 PA 1: Did you?1704:00.9 PA 2: And—ah—need a right.1704:02.6 PA 1: I'll give you a little...1704:03.8 PA 2: Put a little aileron in this thing.1704:05.0 PA 1: Okay, here's a left and I'll give you a right one right here.1704:09.7 PA 1: Okay, right turn right and left yaw.1704:11.4 PA 2: Left yaw checks.1704:12.4 PA 1: Okay, here's the rudders.1704:13.6 PA 1: Here's two left, center, two right center.1704:17.8 PA 2: Checks.1704:19.2 PA 2: Controls.1704:19.6 PA 1: Haven't seen any yet!1704:20.3 PA 2: I haven't either.1704:21.7 PA 1: They're free, the indicators are checked.1704:24.6 PA 2: There's one.1704:25.8 PA 1: There's one.1704:26.4 PA 1:That's the 90-degree.1704:28.5 PA ?: Okay.1704:34.5 PA 2: Weight and balance finals?1704:37.7: [Sounds similar to stabilizer trim]1704:37.2 PA 1: We were gonna put that on four and a half.1704:39.8 PA 3: We got four and a half and we weigh 534. [sound of stabilizer trim]1704:44.6 PA 2: Four and a half on the right.1704:46.8 PA 2: Engineer's taxi check.1704:48.4 PA 3: Taxi check is complete.

Figure 2 Enlarge Photo credit: © Galaxie Production

1704:50.5 PA 2: Takeoff and departure briefing?

1704:52.1 PA 1: Okay, it'll be standard. We gonna go straight out there till we get 3,500 feet, then we're gonna make that reversal and go back out to ... 14.

1704:58.2 APP: [KLM] 8705 [sic] and Clipper 1736, for your information, the centerline lighting is out of service. [APP transmission is readable but slightly broken]

1705:05.8 KLM RT: I copied that.

1705:07.7 PA RT: Clipper 1736.

1705:09.6 PA 1: We got centerline markings (only) [could be "don't we"] they count the same thing as ... we need 800 meters if you don't have that centerline ... I read that on the back (of this) just a while ago.

1705:22.0 PA 1: That's two.

1705:23.5 PA 3: Yeah, that's 45 [degrees] there.

1705:25.7 PA 1: Yeah.

1705:26.5 PA 2: That's this one right here.

1705:27.2 PA 1: [Yeah], I know.

1705:28.1 PA 3: Okay.

1705:28.5 PA 3: Next one is almost a 45, huh, yeah.

1705:30.6 PA 1: But it goes...

1705:32.4 PA 1: Yeah, but it goes ... ahead, I think (it's) gonna put us on (the) taxiway.

1705:35.9 PA 3: Yeah, just a little bit, yeah.

1705:39.8 PA ?: Okay, for sure.

1705:40.0 PA 2: Maybe he, maybe he counts these (are) three.

1705:40.0 PA ?: Huh.

1705:44.8 PA ?: I like this.

In the final minute before the collision, key misunderstandings occur among all the parties involved. And in the end, the KLM pilot initiates takeoff, even though Air Traffic Control has not issued the proper clearance.

1705:41.5 KLM 2: Wait a minute, we don't have an ATC clearance.KLM 1: No, I know that. Go ahead, ask.1705:44.6 KLM RT: Uh, the KLM 4805 is now ready for takeoff and we're waiting for our ATC clearance.1705:53.4 APP: KLM 8705 [sic] uh you are cleared to the Papa beacon. Climb to and maintain flight level 90 ... right turn after takeoff proceed with heading 040 until intercepting the 325 radial from Las Palmas VOR.1706:09.6 KLM RT: Ah, roger, sir, we're cleared to the Papa beacon flight level 90, right turn out 040 until intercepting the 325, and we're now (at takeoff).1706:11.08: [Brakes of KLM 4805 are released.]1706:12.25 KLM 1: Let's go ... check thrust.1706:14.00: [Sound of engines starting to accelerate.]1706:18.19 APP: Okay.Why Air Traffic Control would say "okay" after KLM has said it is taking off is unknown. Perhaps, the official investigation noted, the controller thought that KLM meant "we're now at takeoff position." But the problem is compounded in the moments immediately following, when both Air Traffic Control and Pan Am RT speak simultaneously. This causes a shrill noise in the KLM cockpit that lasts for almost four seconds and makes the following three communications hard to hear in the KLM cockpit:1706:20.08 APP: Stand by for takeoff ... I will call you.PA1: No, uh.PA RT: And we are still taxiing down the runway, the Clipper 1736.

The following messages are audible in the KLM cockpit, causing the KLM flight engineer, even as the KLM plane has begun rolling down the runway, to question the pilot:

1706:25.47 APP: Ah—Papa Alpha 1736 report runway clear.1706:25.59 PA RT: Okay, we'll report when we're clear.1706:31.69 APP: Thank you.1706:32.43 KLM 3: Is hij er niet af dan? [Is he not clear, then?]1706:34.10 KLM 1: Wat zeg je? [What do you say?]1706:34.15 PA ?: Yup.1706:34.70 KLM 3: Is hij er niet af, die Pan American? [Is he not clear, that Pan American?]1706:35.70 KLM 1: Jawel [Oh, yes.] {emphatically}FROM FLIGHT DATA RECORDER1706:40.5 [Pan Am captain sees landing lights of KLM Boeing at approx. 700 m] PAN AM CAPTAIN There he is ... look at him. Goddamn that son-of-a-bitch is coming! PAN AM FIRST OFFICER Get off! Get off! Get off!1706:43.5 KLM FIRST OFFICERV-1.1706:44.0 [PH-BUF (KLM 4805) started rotation.]1706:47.4KLM CAPTAIN [Exclamation/expletive]1706:50 N736PA (Pan Am 1736) records sound of collision.

SAFETY RESPONSES & RECOMMENDATIONS

Following this horrible aircraft accident, a number of reforms were incorporated into the aviation industry. Although the Swiss Cheese Model did not yet exist at the time of this mishap, it is easy to see how examples of Organization Influences, Unsafe Supervision, Preconditions for Unsafe Acts, and Unsafe Acts can be readily identified as either causal or contributory to this mishap.Some of the recommendations by investigators to prevent future mishaps include:

Standardization of Communication: Ambiguous and non-standard communication increased the confusion and opportunity for critical misunderstanding in the 1977 accident in Tenerife.
Acceptance of English as the standard language in Aviation: The KLM crew often vasilated between English and Dutch. ATC spoke both English and Spanish. The use of English as the standard working language in aviation was re-emphasized.
Crew Resource Management: The United 173 crash over Portland Oregon in 1978 directly led to the NTSB calling for a specific type of training that ultimately evolved into Crew Resource Management. However, this tragic mishap and the role that interpersonal dynamics in the cockpit contributed was fresh on the minds of the NTSB investigators less than 2 years later.
Installation of Ground Radar and a Second Airport at Tenerife

REFERENCES

Project Tenerife - Spanish & Dutch Original Investigation Reports