An Eastern Airlines Lockheed Model L-1011 series airplane crashed at 2342 EST, December 29, 1972, 18.7 miles west-northwest of Miami International Airport, Miami, Florida. The airplane was destroyed. Of the 163 passengers and 13 crewmembers on board, 94 passengers and five crewmembers received fatal injuries. Two survivors died later as a result of their injuries.  

History of Flight

Flight 401 originated at New York's John F. Kennedy Airport (JFK), with a destination of Miami (MIA). Flight 401 departed JFK at approximately 2120, with an expected arrival in Miami of approximately 2330. In addition to the captain, first officer, and flight engineer, there were an additional two "deadheading" crewmembers in the flight deck. One, a maintenance manager for Eastern Airlines, remained on the flight deck for the entire flight. The other passenger, an Eastern Airlines pilot, moved to an empty seat in the first class section shortly after takeoff from JFK. The airplane itself was new, having been put into service by Eastern Airlines only four months earlier.

The flight was uneventful until the approach into Miami. Weather was clear with unlimited visibility, however there was no moon. While configuring for landing, when attempting to lower the landing gear, the flight crew was unable to determine that the NLG was fully extended and locked in the extended position. The green indicator light which would normally illuminate upon locking of the NLG in the extended position did not indicate that the gear was locked. Both the main landing gear and the NLG need to be verified as "down and locked" prior to landing. The flight crew cycled the landing gear (retracted and re-extended), and the NLG still did not indicate that it was down and locked. Because the NLG had failed to indicate properly, the captain elected to perform a missed approach in order to troubleshoot the apparent NLG problem.

The flight crew communicated with MIA tower and advised them of the missed approach. MIA cleared them to climb straight ahead to 2,000 feet and contact Miami Approach Control (ATC). The approach controller instructed the flight to maintain 2,000 feet and begin a left turn out over the Everglades. The ATC controller planned to eventually set the airplane up for an extended downwind leg, parallel to the intended landing runway and on a reciprocal heading. The captain then instructed the first officer to engage the autopilot.

Upon engagement of the autopilot, all three crewmembers and the additional flight deck passenger began troubleshooting the NLG indication problem. The flight engineer performed a light test, which illuminates all the indicator lights on the flight deck. The NLG light did not illuminate. The flight engineer speculated that the light itself, which is a plastic housing containing two small light bulbs, might be improperly seated in its socket, and advised the first officer to remove and reinstall the light lens assembly. The first officer removed the light lens assembly, but it apparently jammed upon reinstallation. While the captain and first officer attempted to free the jammed light lens assembly, the flight engineer entered the forward electronics bay (below the flight deck) where a visual gear indicator is located. This indicator allows direct viewing of the NLG, and can indicate to the flight crew the lock-status of the NLG. During this time period, the airplane experienced a downward acceleration transient that resulted in a descent of 100 feet, and which was arrested by a nose up-pitch input. Immediately following the acceleration transient, MIA approach instructed the flight to turn to the heading which would result in the extended downwind leg for MIA. Upon attaining the new heading, the flight crew continued discussion about, and attempted to remove, the jammed nose-gear light assembly. During this discussion period, the flight deck voice recorder (CVR) recorded a tone intended to indicate that the airplane had deviated from its selected altitude by 250 feet. There appears to have been no reaction to this indication by the flight crew, and no correcting pitch change was evident on the flight data recorder (FDR). Due to the dark, moonless night coupled with flight over terrain relatively free of ground lighting, the flight crew was not visually aware of the airplane's descending flight path.

Approximately one minute later, the approach controller, noting that the reported altitude of Flight 401 was 900 feet, and knowing that the flight was assigned 2,000 feet, queried the flight crew as to their status saying, "How are things comin' along out there?" But, he did not specifically mention altitude in his radio call. The flight crew requested a return to the airport. The controller granted this request, assigning them a new heading. The flight crew acknowledged these instructions and began a turn back toward the airport. As the airplane was turning, the first officer commented that, "We did something to the altitude...we're still at 2,000, right?" The captain exclaimed, "Hey, what's happening here?" This was followed three seconds later by the sounds of initial impact. The airplane struck the ground while in a 28-degree left bank and was destroyed by impact. It was ultimately determined that the NLG was locked in position, so a safe landing could have been performed even though the flight crew had been unable to determine the gear status. The light bulbs in the NLG indicator light were both burned out.

Autoflight System

The autopilot flight director system (APFDS) provides autopilot and flight director pitch and steering commands and has two computers, designated "A" and "B". The "A" system provides flight director information to the captain's side of the airplane and the "B" system to the first officer's side. Except during an automatic landing, multiple autopilot channels cannot be engaged simultaneously. Autoflight status displays are located on both the captain's and first officer's instrument panels. The functions are controlled through various switches located on the glareshield. In the attached picture, the autopilot control panel is at the top center of the glareshield. The engagement paddles are near the center of the control panel, with the paddle for channel A on the left, and B on the right. Also visible in the photograph are the landing gear handle and gear indicator lights (green lights to the right of the center instrument panel) and the caution and warning light panel (located to the left of the center instrument panel).

The most basic autopilot mode is known as control wheel steering (CWS), whereby the autopilot provides attitude stabilization and attitude changes via flight crew application of forces to the control yoke. The command mode provides total control of the airplane in accordance with information input through the APFDS control panels on the glareshield. Moving either paddle halfway up will engage the CWS mode, while raising either paddle to the top of its travel will engage the Command mode. When engaged in the Command mode, an application of 15 pounds of force in the pitch axis will result in a reversion to CWS in the pitch axis only. If force is applied in the roll axis, the autopilot engage lever will revert to the CWS position. Complete disengagement is accomplished by moving the engage lever to OFF or by operating a switch on either control wheel. Autopilot induced forces can also be overridden at any time by pilot input.

The altitude hold function may be engaged when either CWS or Command is engaged. When altitude hold is engaged, the autopilot provides pitch commands to maintain the altitude existing at the time of engagement. As described earlier, if a pitch force is input through the control wheel, the autopilot will revert to pitch CWS. However, the engagement lever will remain in the originally selected position - either CWS or Command. Thus, it is possible to disengage altitude hold without an accompanying alert to the flight crew. The indications of such a reversion would be the extinguishing of the altitude mode-select light on the glareshield and the loss of the "ALT" annunciation on both annunciator panels.

On this particular airplane, the autopilot pitch computers were not matched, in that, the pitch override force for autopilot "A" was 15 pounds, while for "B" it was 20 pounds. As a result, it would be possible to disconnect the "A" system, with accompanying indications on the captain's instrument panel, but not on the first officer's panel, as its indications are provided by the "B" autopilot computer. In this situation, there would be no indications on the first officer's panel that the altitude hold mode was no longer operative.

Accident Investigation

The investigation focused primarily on determining why the unexpected descent had occurred. The NTSB considered four possible causes:

• Subtle incapacitation of the pilot

• Autoflight system operation

• Flight crew training

• Flight crew distractions

The possibility of pilot incapacitation arose following a medical examiner's finding that the captain had a large tumor in his brain. The medical examiner suggested that the tumor could have affected his vision, especially his peripheral vision, preventing his detection of altimeter and/or vertical speed indications while he focused on the NLG indicator across the flight deck. The medical examiner also noted that the amount of peripheral vision loss, if it existed at all, could not be predicted with any degree of accuracy based solely on the size and location of the tumor. The NTSB concluded that the tumor had not been a causal factor.

Relative to the autoflight system, the NTSB noted that the approach and go-around had been flown manually by the first officer until the captain ordered engagement of the autopilot. FDR data also confirmed autopilot engagement. At 288 seconds prior to impact, the airplane experienced a 0.04g transient, causing a 200 foot/min rate of descent. This indicated to the NTSB that the altitude hold mode of the autopilot had been disengaged. The NTSB noted that this transient occurred at the same time that the captain ordered the flight engineer to enter the electronics bay to visually check the NLG. The NTSB speculated that as he turned to address the flight engineer, he could have inadvertently applied a force to the control wheel sufficient to disconnect the altitude hold function. If the "A" autopilot had been the controlling autopilot, then an inadvertent disconnection may not have been evident to the first officer due to the disparity in disconnection forces between the "A" and "B" systems. The NTSB explained in the accident report, however, that they believed that the "B" autopilot had been the controlling autopilot, and in this case an inadvertent disconnection could have been noticed by the first officer.

A long discussion regarding the auto-throttle system and its integrated function with the autopilot concluded that the auto-throttle system had not been engaged during the last four minutes of the flight, and was therefore not a factor in the accident. Similarly, based on the assumption that the "B" autopilot had been the controlling autopilot, and its inadvertent disconnection could have been noticed by the first officer, the NTSB concluded that if the descent had been initiated by either an inadvertent autopilot disconnection or an inadvertent thrust reduction, or both, instrument indications, in combination with the altitude alert aural warning, should have alerted the flight crew to the initiation of the descent.

The NTSB further expressed concerns about the flight crew's level of understanding of the autopilot and the low forces required to cause an airplane attitude change in the CWS control mode. The NTSB investigated Eastern Airlines' training program relative to the autopilot, particularly with regard to CWS. The NTSB concluded that Eastern's training was adequate for familiarization with autopilot operation in CWS, but its use was limited by company policy. Therefore, the flight crews had limited operational experience. The NTSB concluded that this may have compromised the flight crew's ability to use and understand CWS. However, they also concluded that good pilot practices and Eastern training dictated that one pilot always monitor the progress of the flight at all times and under all circumstances.

Relative to flight crew distraction, the NTSB listed a number of minor distractions for the flight crew that, in combination, caused the flight crew to become preoccupied with resolving the abnormal gear indication with minimal regard for other flight requirements. Normally, in-flight distractions do not significantly degrade flight crew performance due to their short duration; however, in this case, the combination of factors and divided attentions of all three crewmembers was a major factor in the resulting accident. (Complete text of NTSB report)

A video reenactment of the last four minutes of the flight, based on the flight deck voice recorder information, was created as a flight crew resource management training aid. That video is available below. (Note:  This reenactment was filmed in a simulator and was not produced by Eastern Airlines.  The simulator used for the filming was not identically configured to the flight deck and warning system originally delivered to Eastern Airlines.  In this video, following the unintended departure from 2000 feet, a warning tone is heard, and footage of the altimeter shows a continuously flashing amber light.  Eastern Airlines had inhibited the flashing alert light below 2500 feet above the ground, so on the accident airplane, only the tone was produced, at 1750 feet.  There would have been no flashing light.  This discrepancy in the video could lead the viewer to assume that the flight crew must have ignored, or missed, two warnings, while in reality, the only warning that would have existed would have been a single, short duration, aural tone.)

Back to top 

The NTSB determined that the probable cause of the accident was the failure of the flight crew to monitor the flight instruments during the final four minutes of flight and failure to detect an unexpected descent soon enough to prevent impact with the ground. Preoccupation with a malfunction of the NLG position indicating system distracted the flight crew's attention from the instruments and allowed the descent to go unnoticed. Contributing to the distraction of the flight crew during the flight was the unsuccessful attempt of the flight engineer to visually ascertain whether the NLG was locked down. The flight engineer was not successful in his attempt to view the rods on the NLG linkage which indicate whether the gear is locked down. If this is to be done at night, a light in the nose wheel-well must be illuminated through a switch on the captain's eyebrow panel. A person attempting to view the indicator rods must pull a knob located over an optical sight in order to remove a cover on the far end of the sight. In the accident, the flight engineer twice noted that he could see nothing due to the darkness. It is unknown whether the captain attempted to activate the nose wheel-well light switch, whether the light was operative, or if the flight engineer properly operated the knob which would have removed the cover from the optical tube. Based upon CVR data, the flight crew seemed to think that the light should have been illuminated whenever the landing gear was extended.

For this reason, the NTSB believed that this system should be operable by one person; therefore, the switch for the wheel-well light should have been located near the optical sight. Furthermore, a placard outlining the proper use of the system should have been installed near the light switch and the knob for the optical sight cover.

Although the reason for the descent from the assigned altitude of 2,000 feet was not determined, the CVR data indicated that the altitude alert system sounded shortly after the initial descent. This alert system is comprised of a single C-chord and a flashing amber alert light. When the airplane departs the selected altitude by 250 feet, the alert sounds once and the amber light flashes continuously. However, on the Eastern Airlines configuration, the light is inhibited from operating below 2,500 feet radar altitude. Thus, on the accident airplane, the only altitude alert system warning to the flight crew that the airplane was descending was the single C-chord. There was no evidence on the CVR to indicate that the flight crew heard the audible warning as the airplane maintained a continuous descent into the ground. (Complete text of NTSB findings). 

Back to top

As a result of the investigation of the accident, the NTSB submitted three safety recommendations to the Federal Aviation Administration (FAA) on April 23, 1973. Those safety recommendations (A-73-11 through -13) were:

1) Require the installation of a switch for the Model L-1011 nose wheel-well light near the NLG indicator optical sight.

2) Require, near the optical sight, the installation of a placard which explains the use of the system.

3) Require the implementation of the NTSB's further safety recommendations (A-73-46) as follows: 

a. Review the ARTS III program for the possible development of procedures to aid flight crews when marked deviations in altitude are noticed by an air traffic controller.

b. Require that the altitude select alert light system on Eastern Airlines-configured L-1011 airplanes be modified to provide a flashing light warning to the flight crew whenever an airplane departs any selected altitude by +/- 250 feet, including operations below 2,500 feet radar altitude.

(Complete text of NTSB recommendations) 

Back to top

The regulations existing at the time of this accident did not address the probable cause of the failure of the flight crew to monitor altitude. Additionally, there was no regulation that directly addressed the design of the optical sight and its lighting controls that led to the difficulty that the flight engineer encountered in trying to ascertain the position of the NLG through the sighting device. General regulations pertaining to crew training requirements were applicable, but the training programs at Eastern Airlines were determined by the NTSB to have been adequate.

Following the advent of crew resource management (CRM) requirements, subparts N and O of 14 CFR part 121, "Operating Requirements: Domestic, Flag, and Supplemental Operation," were amended to make CRM training a regulatory requirement, most specifically

Section 121.404,"Compliance dates: Crew and dispatcher resource management training," (14 CFR 121.404)

Section 121.406, "Credit for previous CRM/DRM training," (14 CFR 121.406)

Section 121.427, "Recurrent training," (14 CFR 121.427)

Section 121.907, "Definitions," (14 CFR 121.907)

Section 121.909, "Approval of Advanced Qualification Program," (14 CFR 121.909)

Section 121.917, "Other requirements," (14 CFR 121.917)

Section 121.919, "Certification," (14 CFR 121.919) 

All of these regulations pertain to CRM training requirements. The latest versions of these regulations can be found in the FAA Regulatory and Guidance Library by clicking on each regulation.

Back to top

At the time of this accident, the prevailing philosophy among all airlines and flight crews was an autocratic practice with the captain in absolute control, and other crewmembers subordinate to, and subject to orders from, the captain. It was not typically expected that the flight crew would perform as a team, and subordinate crewmembers did not generally assert any authority while in flight. This generally resulted in crewmembers waiting for an order from the captain before performing any task, and inhibited initiative on the part of subordinate crewmembers in responding to abnormal or emergency situations.

The weak flight crew coordination and apparent neglect of flying tasks was apparent to the industry following this accident. It was stated that the captain should have delegated tasks to the other crewmembers and should have specifically assigned either himself or the first officer to concentrate on flying and navigating the airplane while other crewmembers undertook various tasks associated with determining the status of the landing gear. This finding was so powerful that it led to the development and predominant industry-wide adoption of CRM philosophies that have been refined and continue to this day to be the prevailing flight deck philosophy of all major carriers and operators of transport category airplanes.

An additional consideration for this accident was the actions of the air traffic controller. Altitude reporting equipment was relatively new and did not always accurately report altitude. Occasionally, the equipment indicated momentary, large, and false altitude changes. It was relatively well known by controllers that two or three successive radar sweeps were sometimes necessary to accurately determine the altitude of any particular radar target. Though the controller had an altitude readout and had been monitoring the progress of the flight following the missed approach, there were no requirements for controllers to provide guidance and/or issue warnings associated with altitude deviations. Further, the 900-foot indication was not alarming to him due to the known inaccuracies that could be temporarily displayed. The controller stated that he had noticed the deviation from 2,000 feet and was aware that that altitude had deteriorated to 900 feet but believed the altitude indication was erroneous. Further, he was not required to contact the flight or to correct the deviation. He did query the flight, but rather than request them to report their altitude, he asked, "How's it going out there?" A properly formulated controller intervention at this point could have halted the deviation and perhaps prevented the accident. The role of non-flight crewmembers, such as mechanics and air traffic controllers, is also emphasized in modern CRM training.

Back to top

• CRM - The captain did not divide the duties in the flight deck among the three crewmembers. In fact, the first officer was flying the airplane and trying to replace the NLG indicator light; while the captain assisted with the light and the flight engineer was out of the flight deck. Airline training and procedures dictate, that in the event of a non-normal procedure, the captain divide the flight crew duties prior to trouble-shooting the situation. In the case of Flight 401, the captain could have decided to fly the airplane himself, tell the first officer to run the check list, handle the radios, and trouble-shoot the NLG indictor light. He could have then assigned the flight engineer the task of inspecting the NLG through the optical sight. Failure to employ effective CRM techniques was the primary key safety issue faced by this flight crew.
• Training - Although the flight crew was adequately experienced, trained, and qualified to fly the Model L-1011, there were some training issues associated with the flight crew's understanding of the operation of the autoflight system, in particular, the low forces necessary to cause pitch changes when operating in CWS mode. This may have resulted in an inadvertent pitch command having been responsible for the initial departure from the assigned altitude.
• Lack of air traffic controller intervention - The controller was aware of the altitude deviation from the assigned 2,000 foot altitude but did not believe the indicated deviation was real. Further, the controller was under no requirement to notify the flight of the deviation or to issue instructions to correct the deviation.

Back to top

The flight crew assumed that the autopilot was maintaining altitude, heading, and airspeed. At some point prior to the last four minutes of the flight, the autopilot was disconnected or somehow placed in CWS mode. The flight crew did not notice the mode reversion, and continued to focus on the apparent landing gear problem while the airplane descended into the Everglades.

It was assumed that the flight crew knew the procedures for using the optical sight to view the NLG position and that they knew how to recognize a properly extended NLG when viewing the gear through the optical port in the electronics bay. The flight crew was not able to use the viewing port to determine the landing gear status, as the light was not turned on, and they appeared not to know that the light switch was located on the captain's instrument panel.  (Diagram of Optical Viewing Port)

Back to top

Design of optical port. Illumination of the NLG alignment markings were designed to allow viewing of the gear through the port to determine NLG status. However, the flight crew apparently assumed that illumination was provided any time the gear was down and did not understand that the light switch, located remotely on the captain's instrument panel, needed to be turned on in order to properly view the gear through the port. In this case, because the light had not been turned on by the captain, the view through the port was not illuminated and it was impossible to see the NLG. If a switch had been co-located with the viewing port, it would have been easily determined whether the light was on, and/or could have been turned on by the flight engineer when looking through the port, rather than being dependent on the captain to turn it on.

Flight crew training and procedures. The flight crew had been trained on the use of the autoflight system on the Model L-1011, but company policy and procedures specified that CWS mode not be used. Therefore, even though the flight crew had been trained in its use, they were essentially unfamiliar with its characteristics in flight, and with the ease by which pitch commands could be provided to the autopilot via the CWS mode.

The altitude alerting system. This system inhibited the visual alerting of deviation from altitude when below 2,500 feet radar altitude. Had this system not had this inhibit logic, it is possible that a member of the flight crew would have noticed the flashing amber visual indication after the airplane departed its assigned altitude.

Back to top

This accident was a catalyst for changes which resulted in the eventual adoption of CRM philosophies by many major carriers and, finally, by the FAA. CRM was first adopted in 1981 by United Airlines following a 1979 NASA workshop. Other airlines quickly followed suit. In 1990 the FAA initiated a voluntary "Advanced Qualification Program" (AQP), which included CRM training. CRM training has since become a regulatory requirement. A paper titled "The Evolution of Crew Resource Management Training in Commercial Aviation", written by a group at the University of Texas, explains the historical development of CRM training.

The most recent advisory material related to CRM (as of June 2007) is available at the following links: (newer versions may be created at any time)

Advisory Circular (AC) 120-51E, "Crew Resource Management Training," dated January 22, 2004  

AC 120-71, "Standard Operating Practices for Flight Deck Crewmembers," dated December 13, 1991 - Part 1, Part 2 

AC 60-22, Aeronautical Decision Making - Part 1, Part 2

Additionally, though this accident was not the catalyst for change, it was one more in a string of controlled flight into terrain (CFIT) accidents that had occurred in a relatively short time period. Following a CFIT accident in 1974, two years after Eastern Flight 401 where a Trans World Airlines Model 727 struck a mountain in Virginia while on approach to Washington National Airport in Washington, D. C., Congress mandated the installation of ground proximity warning systems in the U.S airline fleet.

Back to top

It does not appear that any ADs were issued as a result of this accident; however, it does appear that Eastern Airlines was required to modify the altitude select alerting system in its Model L-1011 fleet. The system had been configured such that amber warning lights, indicating a deviation from the selected altitude, were inhibited below 2,500 feet, leaving only a single aural warning (the sounding of a "C" chord) as the sole indication of altitude deviation.

Further, there had been an NTSB safety recommendation that a light switch for the NLG observation port be installed in the electronics bay near the viewing port. While an AD to mandate such a change was not written, a design change was made to incorporate such a switch.

Back to top

Airplane Life Cycle:

• Operational

Accident Threat Categories:

• Crew Resource Management
• Flight Deck Layout / Avionics Confusion

Groupings:

• Approach and Landing
• Automation
• Controlled Flight Into Terrain

Accident Common Themes:

• Human Error
• Pre-existing Failures
• Unintended Effects
• Organizational Lapses
• Flawed Assumptions

Back to top

Organizational Lapses

At the time of this accident, there were no formal CRM programs or training, and this particular flight crew did not follow primary assigned duties, resulting in a total flight crew fixation on the landing gear problem at the expense of flying and navigating the airplane. Further, Eastern Airlines, by company policy, did not allow flight crews to use the CWS mode of the autopilot so the flight crew was therefore unfamiliar with its characteristics and airplane behavior with CWS engaged.

Human Error

The flight crew became absorbed in solving the NLG problem and did not concentrate on flying or navigating the airplane. An inadvertent descent was not detected until just before impact, and corrections were never applied. The flight crew did not appear to notice the altitude deviation alarm and did not respond to it, allowing the descent to continue until impact. Finally, the flight crew did not appear to understand the operation of the NLG viewing port and as a result could not determine the state of the NLG.

Flawed Assumptions

There are two main assumptions that contributed to this accident. The first was the assumption by the flight crew that the autoflight system was controlling the airplane. Had this assumption been correct, it would have allowed them to focus on the landing gear problem while the airplane essentially took care of itself. Given that they did not appear to understand all the aspects of autoflight system operation, this assumption led to an inadvertent descent that was not detected.

The second assumption was made in the design of the NLG viewing port. While a light was provided to allow use of the port at night, or in dark conditions, the switch for that light was located on the captain's instrument panel and not near the port itself in the electronics bay. The designers assumed that a flight crew would be aware of or remember that the light switch needed to be activated by the captain prior to use of the port. The flight crew of Flight 401 assumed that illumination was automatic and hence were not able to use the port to determine the gear status.

Preexisting Failures

It was ultimately determined that both light bulbs in the nose-gear-position indicating light were burned out. This should have been detected during a warning light test prior to takeoff or during taxi. The burned out bulbs led to the flight crew's fixation on the problem, to the detriment of other duties, and ultimately were a major contributor in the occurrence of the crash.

Unintended Effects

The design of the NLG optical viewing port was provided with a light that was not automatically lit, but required that it be turned on by the captain. In this case, this prevented the flight crew (due to error or lack of knowledge) from viewing the landing gear through the port, and it prolonged the flight crew's attempts to solve the gear problem, diverting their attention away from flying the airplane.

The altitude alerting system's inhibition of visual alerting below 2,500 feet radar altitude may have been implemented to avoid nuisance alerts during-for example-visual approaches. In the case of Flight 401, however, this inhibit logic eliminated one possible alerting source.

Back to top

United Airlines Flight 173, McDonnell-Douglas Model DC-8-62, N8082U, December 28, 1978, Portland, Oregon. Following an apparent landing gear problem, the flight crew delayed landing and the airplane ran out of fuel, crashing in a wooded suburban area, killing eight passengers, the flight engineer, and a flight attendant. This accident, similar in circumstances to Eastern Airlines Flight 401, became the catalyst for mandatory CRM training.

See accident module

American Airlines Flight 965, Boeing Model 757-200, N651AA, December 20, 1995, crashed into a mountain top while on approach to Cali, Colombia. During descent and prior to initial approach, confusion over instructions from ATC and a perceived need to land as soon as possible to avoid flight crew duty time conflicts, resulted in an improper navigational fix being programmed into the autoflight system. The flight crew became confused as to their actual location and maneuvered into a mountain. Of the 167 passengers and crewmembers on board, 163 were killed in the crash.

See accident module

KLM Royal Dutch Airlines Flight 4805, Boeing Model 747-206B, PH-BUF, collided with and Pan American World Airways Flight 1736, Boeing Model 747-121, N736PA, Tenerife, Canary Islands, March 27, 1977. While the PanAm Model 747 back-taxied on the active runway, the KLM Model 747, with the flight crew confused as to ATC instructions, initiated a takeoff roll without clearance and collided with the PanAm 747. A total of 583 people were killed, constituting the worst aviation disaster in history (prior to September 11, 2001).

See accident module

Back to top 

Technical Related Lessons:

Inadvertent reversions away from the selected autoflight mode need to be obvious and attention-getting. (Threat Category: Flight Deck Layout/Avionics Confusion)

• It was concluded by the NTSB that the autopilot was inadvertently disconnected or reverted to another flight mode. The indications of this mode change consisted of small changes in the annunciations on the pilot and first officer's display panels. No aural alert appears to have been associated with the autopilot mode reversion. The cues provided by the autoflight system were insufficient in alerting the flight crew to a major change in autoflight mode, thereby allowing the gradual descent. While there are sensitivities to nuisance functioning of warnings, the inadvertent disconnection or mode reversion of an autoflight system should be compelling and unmistakable to a flight crew. 

Alerts indicating deviations from selected flight paths need to be obvious and attention-getting. (Threat Category: Flight Deck Layout/Avionics Confusion)

• In this accident, the only indication of departure from the commanded altitude was indirect, consisting of a single aural alert signifying an altitude deviation that was clearly missed by the flight crew. Eastern Airlines had inhibited the flashing altitude warning light (located on the altimeter) below 2,500 feet radar altitude; hence another warning that might have been available was prevented from functioning. 

Common Theme Related Lessons:

CRM training can enhance the ability to prevent and/or manage flight crew errors, and in maintaining continuity in flight crew performance of duties. (Common Theme: Human Error)

• The NTSB cited the primary cause of this accident as flight crew inattention. All three crewmembers and an additional passenger on the flight deck were completely focused on a gear-position-indicating problem to the total exclusion of the operation of the airplane. Proper exercise of CRM practices would have resulted in one of the pilots devoting his attention to flying the airplane while other crewmembers dealt with the apparent airplane problems.
• Had one of the pilots retained the responsibility for flying the airplane, it is likely the accident would not have occurred. Additionally, modern CRM training has resulted in a flight deck environment where crewmembers are encouraged to speak up and insist on a response if they believe something may be wrong. This extends outside the flight deck to non-traditional "crewmembers" such as mechanics and air traffic controllers.
• Armed with CRM programs, modern copilots and air traffic controllers are trained to speak up about the division of flight crew duties or observed deviations from assigned flight path.

Flight crew interface characteristics of new designs, including non-normal operations, should be addressed in training. Flight crew training programs should be consistent with the actual equipment and configurations being operated. (Common Theme: Organizational Lapses)

• It is clear from the accident report that the flight crew believed the light for the NLG viewing port was activated whenever the landing gear was extended. The light switch was actually located on the captain's instrument panel and had not been turned on. While this subtlety was probably addressed in initial airplane training, it may not have received any emphasis as its importance was not considered high and expected usage was low.
• As a result, the flight crew did not retain knowledge that became important, and this impact added to the flight crew's confusion related to the apparent landing gear problem. Properly understanding the operation of the system may have led to an early resolution of the problem, allowing the flight crew to refocus on the duties of flying the airplane, and thus preventing the accident.
• Even though the airplane was equipped with control wheel steering (CWS) autopilot mode, Eastern Airlines flight crews were prohibited by airline policy from using the mode, and were not familiar with its function, or airplane characteristics while in that mode.
• Eastern Airlines had inhibited part of the altitude alerting system (flashing light) below 2500 feet above the ground.

Technological innovations can be rendered ineffective by human errors. (Common Theme: Unintended Effects)

• In this particular accident, not only was the airplane one of the most technologically advanced of its era, but air traffic control had implemented altitude reporting hardware such that controllers were able to determine the altitudes of aircraft they were controlling. The ATC technology was relatively new and suffered from some short-term errors in altitude reporting. The controller in this event noted Flight 401's altitude deviation but did not assign any urgency to the low altitude or large deviation from the assigned altitude because he did not trust the information. The mistakes of the flight crew in not properly monitoring their flight information were compounded by the error of the controller in not taking advantage of the additional information presented to him and attempting to correct the altitude discrepancy. As a last line of defense, a query to the flight crew regarding altitude could have allowed a timely correction and prevented the accident.

Airplane cockpit safety features that are basic to the original airplane design should not be inhibited or modified without full consideration given to all of the safety implications of the change. This may be especially important in highly integrated cockpit configurations such as those of today's modern transport airplanes. (Common Theme: Unintended Effects)

• Eastern Airlines inhibited the L-1011's flashing amber alert light (next to the altimeter) at all altitudes below 2500 feet radio altitude. Thus, while holding at 2000 feet, when Flight 401 departed its assigned altitude, this flashing alert would have not activated. It is not known if this cue, in addition to the C-chord tone (which was missed by the crew), would have been enough to have alerted the crew to the airplane's descent. Nor can it be determined, at this time in history, how this inhibit was approved, or the basis of its approval. What is known, however, is that any change to cockpit display functions or features, no matter how seemingly minor, must be thoroughly analyzed by personnel who are completely knowledgeable of the original cockpit configuration, and who possess a thorough understanding of the safety implications of the change.

System status indication/alert integrity needs to be sufficiently reliable so that false indications are very rare events. The high rate of false indications, and the high rate of unnecessary actions which result, adds additional risks to safety of operation. (Common Theme: Pre-existing Failures)

• Following this accident, it was determined that both bulbs in the NLG indicator light were burned out, and the nose landing gear was, in fact, extended and locked down. The burned out bulbs should have been discovered by means of a light system test prior to takeoff, or any time prior to gear retraction following takeoff. The "gear down" green light remains illuminated until the gear is fully retracted on takeoff. Further, an inflight test of the lights would have revealed them to be burned out. The false gear indication monopolized the crew's time, to the detriment of their primary duties of flying and navigating the airplane. This total fixation on the pre-existing, and undiscovered failure was a major factor in this accident.

Back to top