Human Factors Accident Case Studies

A handful of accidents did more than any textbook to create modern human factors training. In each, the outcome turned less on the machine than on how the people on the flight deck communicated, shared the work, monitored the aircraft and made decisions. Their names are the vocabulary of crew resource management: Tenerife for communication, Eastern 401 for fixation, Portland for assertiveness, Erebus for latent organisational failure.

This article summarises nine of them, five accidents of the 1970s, the decade that produced CRM, and four more recent cases that tested it, with the lessons that training draws from each. The facts come from the official investigation reports. The four recent cases have full summaries in the site's Crash Investigations section.

Staines Trident (1972)

In the Staines Trident accident of 18 June 1972, a British European Airways Hawker Siddeley Trident 1C, G-ARPI, took off from London Heathrow for Brussels and crashed near Staines less than three minutes later. All 118 people on board were killed. The public inquiry found that the leading-edge droops had been retracted at about 162 kt, some 60 kt below the proper speed of 225 kt, leaving a wing that could not support the aircraft. The stall warning and stick pusher operated; the crew failed to diagnose why, and the stall recovery system was overridden. The aircraft entered a deep stall from which it could not recover.

The inquiry pointed to more than one person's error. Among its immediate causes were the handling pilot's failure to achieve and maintain adequate speed after the noise-abatement procedure, and the crew's failure to monitor the speed errors and to observe the movement of the droop lever. Its underlying causes, all but one concerned with human factors, included the limited experience of the co-pilot. Its recommendations included a baulk to prevent premature retraction of the droops, which the manufacturer then developed, and greater awareness among pilots of subtle as well as obvious incapacitation. The aircraft had no cockpit voice recorder, and the inquiry's recommendations led to their installation in British airliners.

Lessons: monitor and call out every configuration change; where a wrong selection can be fatal, guard against it by design, as the inquiry recommended for the droops (see high-lift devices); incapacitation can be subtle; and a crew in which the junior members do not speak up has lost its second line of defence.

Eastern Air Lines 401 (1972)

On 29 December 1972 Eastern Air Lines Flight 401, a Lockheed L-1011 TriStar from New York, was approaching Miami at night when the nose landing gear position indication did not show the gear down and locked. The crew held at 2,000 ft over the Everglades on autopilot, and all three flight crew members became absorbed in the problem, one of them going down to the avionics bay to check the gear visually. The autopilot's altitude hold function disengaged, possibly because a pilot inadvertently applied a force to the control column, and the aircraft began a slow descent that nobody noticed. An altitude alert chime sounded, but no crew member commented on it. The TriStar struck the Everglades. Of the 176 people on board, 99 were fatally injured and two survivors died later.

The NTSB found the probable cause to be "the failure of the flight crew to monitor the flight instruments during the final 4 minutes of flight, and to detect an unexpected descent soon enough to prevent impact with the ground", with "preoccupation with a malfunction of the nose landing gear position indicating system" as the distraction.

Lessons: one pilot always flies and monitors the flight path while the other deals with the problem; automation must be monitored, not trusted; and attention fixed on a minor fault can kill.

Tenerife (1977)

The Tenerife airport disaster began on 27 March 1977, when a bomb explosion at Las Palmas closed that airport and many aircraft diverted to Los Rodeos, Tenerife, including two Boeing 747s, of KLM and Pan Am. With the apron congested, departing aircraft had to backtrack along the runway in fog. The KLM aircraft began its take-off roll without a take-off clearance while the Pan Am 747 was still taxiing on the runway, and the two collided. 583 people died, the deadliest accident in aviation history.

The Spanish investigation found a chain of communication failures. The KLM first officer's readback of the route clearance ended with "we are now at take-off", which the controller did not take to mean that the aircraft was rolling. The controller's reply, "OK... stand by for take-off, I will call you", coincided with a Pan Am transmission that they were still taxiing down the runway, and the two transmissions blocked each other so that only "OK" was clearly heard. On the KLM flight deck the flight engineer asked whether the Pan Am aircraft was clear of the runway, and the captain emphatically said it was.

Lessons: expectation turns an unclear message into the clearance a crew wants to hear; phraseology must be unambiguous, which is why TAKE-OFF is now used only in the take-off clearance and its cancellation (see radiotelephony phraseology); and a doubt voiced once, then dropped, protects nobody.

United Airlines 173 (1978)

On 28 December 1978 United Airlines Flight 173, a DC-8-61 with 189 people on board, was approaching Portland, Oregon, when a landing gear problem appeared. The captain held near the airport for about an hour while the crew worked through the problem and prepared the cabin for a possible emergency landing. The aircraft ran out of fuel and crashed in a suburban area of Portland; ten people died.

The NTSB found that the probable cause was the captain's failure to monitor the fuel state and to respond properly to the low fuel state and to the crew's advisories about it, a failure that resulted from preoccupation with the landing gear malfunction and preparations for a possible landing emergency. Contributing was "the failure of the other two flight crewmembers either to fully comprehend the criticality of the fuel state or to successfully communicate their concern to the captain". The Board asked the FAA to urge airlines to train captains in participative management and other crew members in assertiveness, and the 1979 NASA workshop on resource management on the flight deck followed.

Lessons: the captain leads but must invite and weigh the crew's input; concerns must be stated explicitly and persistently; and fuel is time (see in-flight fuel management).

View full schematic

Mount Erebus (1979)

In the Mount Erebus accident of 28 November 1979, Air New Zealand Flight 901, a McDonnell Douglas DC-10 on an Antarctic sightseeing flight from Auckland, flew into the lower slopes of Mount Erebus on Ross Island. All 257 people on board were killed. The coordinates programmed into the navigation system had been changed by the airline without the crew's knowledge, so the track they believed ran down McMurdo Sound led over Mount Erebus. The crew descended below cloud to fly visually, and in poor visual contrast the white slope merged into the overcast (see controlled flight into terrain).

The two official inquiries disagreed. The Chief Inspector of Air Accidents reported in 1980 that the probable cause was the captain's decision to continue the flight at low level towards an area of poor surface and horizon definition when the crew were not certain of their position. A Royal Commission reported in 1981 that the single dominant and effective cause was the mistake of the airline officials who programmed the aircraft to fly directly at Mount Erebus and did not tell the crew.

Lessons: latent failures made far from the flight deck, here an unnoticed data change, can lie dormant until conditions reveal them; automation can separate an error from its effect by hours; and navigation data must be verified.

US Airways 1549 (2009)

On 15 January 2009 US Airways Flight 1549, an Airbus A320 climbing out of New York LaGuardia, struck a flock of Canada geese at 2,818 ft above the ground and lost thrust in both engines. Within seconds the captain took control and started the APU, and the first officer began the engine dual failure checklist, which had been written for a failure at high altitude. The captain judged that neither LaGuardia nor Teterboro could be reached and ditched on the Hudson River about three and a half minutes after the strike. All 155 occupants survived.

The NTSB found that the decision to ditch provided the highest probability that the accident would be survivable, and listed the crew's decision-making and crew resource management among the factors that contributed to survival. It also found that task saturation made it harder for the captain to hold his intended speed on final. See the Crash Investigations summary.

Lessons: clear roles from the first seconds; do the high-value actions early; decide and commit; and expect workload to degrade even an excellent crew.

Air France 447 (2009)

On 1 June 2009 Air France Flight 447, an Airbus A330 cruising at FL350 over the Atlantic, lost valid airspeed indications when ice crystals most likely blocked its Pitot probes. The autopilot disconnected and the flight controls reverted to alternate law. The pilot flying made mainly nose-up inputs, the aircraft climbed to about 38,000 ft and stalled, and it remained stalled until it struck the sea. All 228 people on board died.

The BEA found a crew that was surprised and whose cooperation progressively broke down. The captain was resting and the relief captain had been designated only implicitly; the pilot not flying took priority on the controls without a callout; both pilots made simultaneous inputs; and neither identified the stall. Its recommendations included high-altitude manual handling and stall training, training for surprise, and criteria for relief captains. See the Crash Investigations summary.

Lessons: startle degrades task sharing; transfer of control must be explicit; and the stall warning must be believed.

Qantas 32 (2010)

On 4 November 2010 an intermediate pressure turbine disc of a Rolls-Royce Trent 900 burst on Qantas Flight 32 (QF32), an Airbus A380 climbing out of Singapore. Fragments damaged the wing, a fuel tank, hydraulics, electrics and flight controls. Five pilots were on the flight deck. With a controllable aircraft and fuel, they held within 30 NM of Changi at 7,400 ft for the roughly 50 minutes the ECAM procedures took, assessed the damage, checked controllability and landed. All 469 people on board were unhurt.

The ATSB found that the flight and cabin crews "managed the event as a competent team": the captain and first officer flew and ran the procedures while the extra pilots gathered information, liaised with the cabin and inspected the wing. It also recorded that the pilots cancelled a cabin crew emergency call, taking it for another ECAM alert. See the Crash Investigations summary.

Lessons: buy time when the aircraft allows it; use every crew member, with one clear leader; and check what the aircraft can still do before committing to the landing.

Asiana Airlines 214 (2013)

On 6 July 2013 Asiana Airlines Flight 214, a Boeing 777-200ER with 307 people on board, struck the seawall short of runway 28L at San Francisco at the end of a visual approach in good weather; three passengers died. The trainee captain was flying, supervised by an instructor on his first flight in that role, with a relief first officer on the jump seat. After the descent was mismanaged, the autothrottle was left in a mode in which it no longer controlled airspeed, and none of the three pilots noticed the speed decaying until the aircraft was about 200 ft above the ground.

Contributing factors in the NTSB's findings included complex automation, "nonstandard communication and coordination regarding the use of the autothrottle and autopilot flight director systems", the instructor's inadequate supervision and crew fatigue. See the Crash Investigations summary.

Lessons: call out every mode change; monitor speed, path and thrust whatever the automation is doing; instructors must intervene early; and treat the stabilised approach gate as a go-around decision.

Common threads

The early accidents taught the industry that technical skill was not enough; the later ones show both what trained crews can achieve and how automation and surprise create new traps. The same threads run through threat and error management and flight deck communication.

Library articles are written for study and exam preparation. They do not replace your aircraft's approved documentation, your operator's procedures or the regulations themselves.