When American Airlines Flight 965 crashed into the mountains near Cali, Colombia, on December 20, 1995, it was an unusual accident for a U.S. carrier. Controlled flight into terrain, or CFIT, is more common in some developing countries where airlines fly older aircraft with less sophisticated crew training. It is a leading cause of fatal air carrier accidents worldwide. But Flight 965 did not fit that profile.
The Boeing 757 was equipped with a state-of-the-art flight management system (FMS), moving-map display, and a superbly trained crew that was familiar with the route.
General aviation accidents follow a similar pattern when a perfectly functioning aircraft is flown into the ground. While CFIT does happen with light single-engine airplanes, it seems to be more prevalent in high-performance singles and twins that are more likely to be out in the weather and flying at night. Ironically, the aircraft involved in CFIT accidents also tend to be better equipped.
This accident should serve as a warning to GA pilots. The IFR GPS receivers that are rapidly being installed in many of our cockpits are based on FMS technology and similar protocols. In most cases they will improve the pilot's situational awareness, but in a few they could degrade it catastrophically. The old problem of communication also played a part in the catastrophe at Cali. The information that follows was edited from the official accident report by Aeronautica Civil, Republica de Colombia (the Colombian equivalent of the FAA/NTSB).
Flight history
American Airlines 965 (AA965) departed Miami at 6:35 p.m. Eastern time, nearly two hours late for the three-hour, 12-minute flight to Cali. The route of flight from Miami went over Cuba, Jamaica, and then into Colombian airspace. Bogota Center cleared the flight direct from BUTAL intersection to the Tulua VOR (ULQ). At 9:10 p.m. the pilots communicated with AA's dispatch via datalink, asking for Cali weather. Cali reported clear, visibility greater than 10 kilometers, and scattered clouds.
At 9:26 the pilots requested descent clearance. The flight was initially cleared to Flight Level 240 and then to FL200. At 9:34 the flight was instructed to contact Cali Approach Control, a nonradar facility. AA965 contacted Approach at 9:34 and reported out of FL230. The controller asked, "DME distance from Cali?" The captain, who was not flying the aircraft, replied, "The DME is six-three." The controller replied, "Roger, [AA965] is cleared to Cali VOR, uh, descend and maintain one-five thousand feet. Altimeter three-zero-zero-two...no delay expected for approach. Report, uh, Tulua VOR." The captain confirmed the call and at 9:35 informed the first officer (FO) that he had "put direct Cali for you in there." This referred to programming the FMS.
The crew was prepared to land on Runway 1 at Cali, but the approach controller offered a straight-in approach to Runway 19. This shortened up the approach considerably and put the aircraft high relative to the north arrival fix, which was Tulua. To the runway change the FO responded, "Yeah, we'll have to scramble to get down. We can do it." The crew apparently felt some pressure to expedite the arrival following the long delay in Miami. Now things began to unravel.
The captain responded to Approach, "Uh yes, sir, we'll need a lower altitude right away, though." The controller then stated, "Roger. American 965 is cleared to VOR DME approach Runway One-Niner. Rozo Number One arrival. Report Tulua VOR." The captain replied, "Cleared the VOR DME to one-nine, Rozo One arrival. Will report the VOR. Thank you, sir." The controller stated, "Report, uh, Tulua VOR." The captain replied, "Report Tulua."
At 9:37:29 the pilots asked Approach, "Can American Airlines, uh, 965 go direct to Rozo and then do the Rozo arrival, sir?" The controller replied, "Affirmative. Take the Rozo One and Runway One-Niner, the wind is calm." The captain responded, "All right, Rozo, the Rozo One to one-nine, thank you, American 965." The controller: "Report Tulua and twenty-one miles, ah, five thousand feet." The captain responded, "OK, report Tulua twenty-one miles and five thousand feet, American 965."
At 9:37, after passing Tulua VOR during the descent, the airplane turned to the left of the cleared course and flew on an easterly heading for approximately one minute. The Boeing then turned right, while still descending. At 9:38:49 the first officer asked, "Uh, where are we?" and again, nine seconds later, asked, "Where we headed?" The captain responded, "I don't know...what happened here?" At 9:39:29 Morse code similar to the letters ULQ—Tulua VOR's identifier—was recorded.
At 9:40:01, the captain asked Approach, "And American, uh, thirty-eight miles north of Cali, and you want us to go Tulua and then do the Rozo, uh, to, uh, the runway, right to Runway One-Nine?" The controller answered, "You can [unintelligible word] landed, Runway One-Niner, you can use Runway One-Niner. What is altitude and DME from Cali?" The flight responded, "OK, we're thirty-seven DME at ten thousand feet." The controller stated at 9:40:25, "Roger. Report five thousand and, uh, final to one, one, Runway One-Niner."
The CVR recorded the crew's difficulties in programming the FMS. At 9:40:40 the captain stated, "It's that [expletive] Tulua I'm not getting for some reason. See, I can't get. OK now, no. Tulua's [expletive] up." At 9:40:49 the captain said, "But I can put it in the box if you want it." The FO replied, "I don't want Tulua. Let's just go to the extended centerline of, uh...." The captain stated, "Which is Rozo." At 9:40:56 the captain stated, "Why don't you just go direct to Rozo then, all right?" The FO replied, "OK, let's...." The captain said, "I'm goin' to put that over to you." The first officer replied, "Get some altimeters. We're out of, uh, ten now."
At 9:41:02 Cali Approach requested the flight's altitude. The flight replied, "965, nine thousand feet." The controller then asked at 9:41:10, "Roger, distance now?" There was no response. At 9:41:15, the ground proximity warning system (GPWS) sounded, "Terrain, terrain, whoop, whoop." The captain stated, "Oh [expletive]," and a sound similar to the autopilot disconnect warning began. The captain said, "Pull up, baby." The GPWS continued, "Pull up, whoop, whoop, pull up." The crew added full power and raised the nose until the stick shaker stall warning. The nose was lowered slightly, the stick shaker stopped, nose-up attitude then increased, and the stick shaker reengaged. The speed brakes that were extended during descent were not retracted.
At 9:42 p.m. AA965 crashed into a mountain in visual meteorological conditions near the town of Buga, 33 miles northeast of the Cali VOR (CLO) and 28 miles north of the approach end of Runway 19. The airplane struck El Deluvio Mountain at about 8,900 feet above mean sea level (msl), near the 9,000-foot summit. Of the 155 passengers, two flight crewmembers, and six cabin crewmembers on board, four passengers survived the accident.
Crew information
The 57-year-old captain and 39-year-old FO had more than 13,000 and 5,800 flight hours, respectively. Both had more than 2,200 hours in the Boeing 757. Including flights into Cali on December 9 and December 14, 1995, the captain had flown into Cali 13 times before the accident flight. The captain completed annual line checks on November 9, 1995 (domestic), and on December 9, 1995 (international). He had been employed by American since 1969 and was described by colleagues as respected for his professional skills, including his skill in communicating with crewmembers and passengers. The internationally qualified FO had never been to Cali but had flown to other destinations in South America.
Airplane information
The Boeing 757-223 was operated by AA since it was new on August 27, 1991. The aircraft was equipped with an FMS that included a worldwide navigation database that contained radio frequencies, with latitude and longitude coordinates of relevant navigation aids and airports appropriate for Boeing 757 operations. The database also included 757 performance data that governed autothrottle and autopilot functions. The FMS monitored the system and engine status and displayed the information, as well as airplane attitude, flight path, navigation, and other information, through cathode ray tube (CRT) displays.
The 757 was equipped with speed brakes, or overwing control surfaces, operated by a control lever located in the center control console. Speed-brake operation during flight is not automatic. Because of the limited airframe feedback from the speed brakes, the crew could be unaware that the brakes were extended.
The GPWS escape maneuver in the flight operations manual directed that the aircraft be configured to attain maximum climb performance to avoid obstacles ahead. Pilot actions included the disengagement of autopilot and autothrottle systems as well as selecting maximum power and attaining best angle of climb.
American Airlines training
A two-day ground school for new pilots flying international routes and annual training are required and provided by American. A special ground school with emphasis on crew resource management was given to all crewmembers qualifying for operations into Latin America. This went beyond the FAR Part 121 requirement.
All pilots were given a reference guide devoted exclusively to the hazards and demands of flying into Latin America. Some of the topics should resonate with GA pilots: "Warning! Arrivals May Be Hazardous"; "They'll [ATC] Forget About You"; "When Knowing Where You Are is Critical"; and "How to Determine Terrain Altitude." The introduction to the reference guide is profound: "Flights into Latin America can be more challenging and far more dangerous than domestic flying or the highly structured North Atlantic/European operation. Some Latin American destinations have multiple hazards to air operations, and ATC facilities may provide little assistance in avoiding them. En route and terminal radar coverage may be limited or nonexistent. Mountains, larger and more extensive than anything you've probably ever seen, will loom up around you during descent and approach, and during departure. Communications, navigation, weather problems, and an air traffic control philosophy peculiar to Latin America may conspire with disastrous consequences. There are many hazards in this environment, but the greatest danger is pilot complacency. From 1979 through 1989, 44 major accidents involving large commercial aircraft occurred in South America. Of these 44 accidents, 34 were attributable to pilot error, or were pilot-preventable with proper situational awareness."
Analysis
There was no evidence of malfunction in the airplane, its components, or its systems. Weather was not a factor, both crewmembers were properly qualified, and all navigation aids were functioning properly. After contacting Cali Approach, the crew accepted the controller's offer to land on Runway 19 at Cali, rather than Runway 1 that was flight planned into the FMS. After receiving clearance to descend to 5,000 feet msl, the crew made no attempt to terminate the descent, despite deviation from the published approach course, which is in a valley between two mountain ridges. Less than one minute prior to impact, after the crew recognized that the airplane had deviated from the prescribed inbound course, they attempted to turn back to the "extended centerline" of the runway, which as the captain stated, "is Rozo." The accident occurred following the turn back to the right from a track to the east of the prescribed course and an attempt to fly in a southwesterly heading to directly intercept the extended runway centerline.
Why did such an experienced crew become confused? There was clearly a misunderstanding with the controller, whose native language was Spanish, but who was speaking English. The CVR transcript when written is much less ambiguous than listening to poor-quality radio transmissions in the cockpit.
Experts now believe that the Rozo 1 Arrival was improperly named because Rozo was the end point of the arrival procedure. In the United States and Europe, arrival routes are named after their entry fixes. Applying that convention, this arrival should have been called the Tulua 1 arrival. When the captain stated, "Can American Airlines 965 go direct to Rozo and then do the Rozo arrival, sir?" it made no sense that the flight would go to the final approach fix (Rozo) to fly outbound back to Tulua, which was the entry point for the arrival. The controller compounded the error by stating, "Affirmative, direct Rozo One and then runway one niner, the winds calm." The captain replied, "All right, Rozo, the Rozo One to one-nine, thank you, American 965." The controller stated, "Affirmative, report Tulua and twenty-one miles, 5,000 feet." The captain acknowledged, "OK report Tulua, twenty- one miles at 5,000 feet, American 965." Both parties acknowledged these transmissions but neither understood. English is the language of aviation, but it is practiced with varying degrees of proficiency. Another layer in the safety net was missing when the controller was unable to distinguish an inappropriate readback.
The crew likely had trouble entering the Rozo arrival because of a confusing situation that existed in the FMS database. They selected a direct course to the identifier R, in the mistaken belief that R was Rozo, as it was identified on the approach chart. Instead, they had selected the Romeo NDB, located near Bogota, some 132 miles east-northeast of Cali. Both Rozo and Romeo had the same radio frequency, 274 kHz, and the same identifier R provided in Morse code on that frequency. Not only was the identifier identical, but also there was a methodology in the database that might confuse more than a few pilots. When requesting navaid information from the database, the navaid identifier is used—but not always. The letter R was the default value for the Romeo NDB. Since Bogota city and airport are larger than Cali, the larger airports are entered sequentially at the beginning of the database to satisfy the most users. To retrieve the Rozo NDB, the letters R-O-Z-O would need to be entered into the FMS since that was the FMS identifier for Rozo. The R is shown as the identifier for Rozo on the 1995 approach chart. The name of the NDB and its identifier were changed after the accident.
The crew was never able to resolve the ambiguity, and neither pilot concluded that continued descent was becoming lethal. Today, the Boeing 757 FMSs are less likely to leave pilots completely stranded and can retain some intermediate fixes. In the accident FMS, once direct Romeo was entered, all other fixes disappeared from the moving map.
Overreliance on the FMS and electronic map displays left the crew with a low level of situational awareness. The electronic maps failed to show critical aspects of the approach, and the crew had not briefed using the paper charts. Pilots of glass-cockpit aircraft can select an instrument approach procedure stored in the FMS. They can then direct the FMS to fly the approach, manually fly it with FMS guidance, or fly by reference to ground-based navaids and not use the FMS at all. Retrieving the available approaches and selecting a procedure requires multiple keystrokes.
According to the accident report, "Human factors researchers have written extensively on the potential risks that have been introduced by the automation capabilities of glass-cockpit aircraft. Among those identified are: overreliance on automation; shifting workload by increasing it during periods of already high workload and decreasing it during periods of already low workload; being 'clumsy' or difficult to use; being opaque or difficult to understand, and requiring excessive experience to gain proficiency in its use. One researcher has observed pilots on numerous occasions, even ones experienced in the systems, asking, 'What's it doing now?' in reference to an action of the FMS that they could neither explain nor understand."
Had the crew retracted the speed brakes as soon as the GPWS sounded, the Boeing might have cleared the ridge, but that is speculative and the results of simulator tests after the accident were inconclusive. Most jet aircraft at the time did not have automatic speed brake retraction upon application of power. Boeing's flight manual recommended that the captain's hand remain on the speed-brake lever while deployed in flight, as a reminder. AA's procedure did not contain that caution. Boeing stated that retracting speed brakes during a full-power go-around at low altitude could result in an unwanted pitch up, which was a primary reason it elected not to use automatic retraction.
Changing the arrival when there is little time to change will lead to difficulty in any aircraft. The faster and more complex the machine, the more quickly things can go awry. The crew fell behind the airplane simply because there was too much to do in the time available. According to the accident report the crew needed to:
- Find the approach chart for Runway 19 and review the relevant information such as radio frequencies, headings, altitudes, distances, and missed approach procedures.
- Program the flight management system for the new approach and compare information on the VOR DME Runway 19 approach chart with approach information displayed in the FMS.
- Recalculate airspeeds, altitudes, configurations, and other airplane control factors for selected points on the approach.
- Increase the descent rate and monitor the aircraft, while coordinating with ATC.
Complacency is the greatest danger to experienced pilots. This was a routine operation in good weather to an airport where the captain had been many times before. The FO never challenged the decision to continue even after the aircraft turned off course. Cali was not on American's "hit list" of hazardous airports because it is not especially high (3,162 feet msl) and the valley is relatively wide. Human nature is such that once a decision is made, it is much harder to change direction even when there is conflicting information. It appears that the captain never reconsidered his course even though it was obvious that he was lost.
Probable cause
Aeronautica Civil determined that the probable causes of this accident were:
- The crew's failure to adequately plan and execute the approach to Runway 19 at Cali and its inadequate use of automation.
- Failure of the crew to discontinue the approach into Cali, despite numerous cues alerting them of the inadvisability of continuing the approach.
- The lack of situational awareness of the crew regarding vertical navigation, proximity to terrain, and the relative location of critical radio aids.
- Failure of the crew to revert to basic radio navigation at the time when the FMS-assisted navigation became confusing and demanded an excessive workload in a critical phase of the flight.
Contributing factors
Contributing to the accident were:
- The crew's ongoing efforts to expedite the approach and landing in order to avoid potential delays.
- The crew's execution of the GPWS escape maneuver while the speed brakes remained deployed.
- FMS logic that dropped all intermediate fixes from the display(s) in the event of execution of a direct routing.
- FMS-generated navigational information that used a different naming convention from that published in navigational charts.
Three more contributing factors might be added for your consideration:
- The controller's failure to catch an improper readback.
- The database naming convention that allowed duplications.
- Complex FMS programming.
How do pilots get into such situations? Ego and successful past experience condition us to perform at or perhaps beyond our capabilities to expedite a departure or arrival. It's worked every time before, so why not now? Pilots are confident, take-charge individuals, and we seldom pass up a chance to perform. How many times have you been in a hurry-up situation and managed to pull it out? We've all been there. The challenge is knowing when to say when.
See also the index of "Safety Pilot" articles, organized by subject. Bruce Landsberg is executive director of the AOPA Air Safety Foundation. The author wishes to thank American Airlines, Capt. John Lauer, Rob Knapp, and Brian Fields for their assistance with this article.
Back to Cali
In late January, I retraced from a Boeing 757 jump seat the ill-fated flight from Miami to Cali. The crew and I reviewed the accident, and they explained the technical and procedural changes that had taken place. Amazingly, even today, in this world of database-driven systems, there are still dozens of navaids that are identified by a single letter. Requesting R from the FMS brought up two pages, and the only way to tell them apart was by latitude and longitude. When pressed to make a quick choice, this could be confusing. It seems like ICAO, the international governing body for aviation, and the various member countries could address this. Worldwide databases have been in widespread use for at least a decade and are here to stay.
My crew performed a thorough brief before leaving cruise altitude for the approach and discussed how contingencies, including an engine-out, were to be handled. One very noticeable difference between then and now is that one crewmember stays on "raw data," or ground-based navaids, while the other uses the "magic," as the automation is referred to. This is an excellent cross-check and clearly would have prevented the accident. There is wisdom here for GA pilots. If ground-based navaids are available, use them to back up the magic boxes. It may be old-fashioned, but it just might keep you out of the rough.
Flying into a South American valley at night is a no-jive situation. The minimum off-route altitude in all quadrants around Cali is 23,000 feet. The valley into Cali is deceptively wide (about 10 miles), and we could see the city lights from 30 miles out. At a speed of 250 knots, though, it would literally take only a minute to be at the high peaks to the east. We proceeded directly to Tulua VOR and flew the arrival. The winds on this clear evening indicated a landing to the north. We would overfly the airport, make a course reversal south of the airport, intercept the ILS, and land. I asked the captain about a visual approach since the weather was so good, but he stated that even with perfect conditions, they don't do visuals at night. Good procedure.
Former President Ronald Reagan said to "trust but verify," which is great advice to all pilots all the time, but doubly critical south of the border. Although the controller gave us the altimeter setting, the captain double-checked it with datalink hard copy from AA dispatch just to be sure. As noted in the analysis, one must listen very carefully to understand the controllers. Some of the backstops that we take for granted in the United States do not exist elsewhere. There is radar at Cali now, but if the pilot asks for an altitude below the minimum safe altitude or en route altitude, frequently ATC will grant it, assuming that the pilot knows where he is and will maintain terrain clearance. Y'all be careful down there.
Some of the hardware on the 757 has changed from five years ago. Enhanced ground proximity warning systems (EGPWS) now look forward rather than straight down and, depending on the circumstances, will provide 20 to 40 seconds' warning rather than the nine seconds that the crew of AA965 had. One thing that has not changed is that there is still no speed brake annunciation unless the flaps are extended. The new procedure is to keep a hand on the lever while the speed brakes are in use. The multifunction displays (MFDs) now have a graphical depiction of the terrain around the airport, similar to what is now available on MFDs in GA. Off to the east we could clearly see the red shading that showed high mountains.
In addition to electronic terrain depiction, Jeppesen now graphically portrays the high ground around airports on paper approach charts. That might have alerted the crew that there was no future in flying to the east.
Perhaps the most important change that professional crews have made is to recognize that the magic can increase the workload significantly in some circumstances. American now teaches the pilots "to go down in levels of automation" as flight conditions change from the original plan. If the FMS is flying the aircraft and everything is programmed appropriately, life is good. Leave it alone but verify. As soon as ATC changes something that requires reprogramming, it's time to assess whether it's worth trying to salvage the automation. Frequently, it's not. Ditch the magic and fly the airplane—that's what pilots are supposed to do. It has been my experience with GA FMSs—and was confirmed in observation of the professional crews—that frequently the magic does something that the pilot doesn't expect. It usually isn't a big deal, but it confirms that these units are complex. They will nibble and occasionally bite, even when you think you've mastered the box.
There's a message for the avionics designers in both GA and heavy iron. They need to spend more time understanding how their equipment is used in the real world of turbulence, distractions from ATC, last-minute route changes, weather, pilot fatigue, and big mountains at night. Just because a microprocessor is capable of doing something doesn't mean that another layer of complexity should be added to satisfy the gadget freaks among us or someone's "great" marketing idea to make the unit more "capable."
Simpler is safer, and if a massive amount of training and button pushing is required to operate the magic, then maybe we need a smarter magician. The lessons of Cali for pilots, avionics designers, ATC, and regulators alike are written in blood.— BL
