On 27 March 1977, at 17:06 local time, two Boeing 747s collided on the single runway of Los Rodeos Airport on the Spanish island of Tenerife, killing 583 people. It remains the deadliest accident in aviation history. A KLM 747, registration PH-BUF, began its takeoff roll in dense, drifting cloud while a Pan American 747, registration N736PA, was still taxiing on the same runway toward an exit it had not yet reached. The KLM aircraft, already accelerating, lifted its nose and tore through the Pan Am’s upper fuselage. All 248 people aboard the KLM died; 335 of the 396 aboard the Pan Am died. The 61 survivors, all from the Pan Am’s forward section, escaped before fire consumed both aircraft.
Neither aircraft was scheduled to be at Los Rodeos. Both had been diverted there earlier that Sunday after a bomb planted by a Canary Islands separatist group exploded in the passenger terminal at their intended destination, Gran Canaria, and a second device was reported. The diversions packed Los Rodeos — a small airport with one runway, one parallel taxiway, and no ground radar — beyond its comfortable capacity. Parked airliners blocked part of the taxiway, so departing aircraft had to taxi down the active runway itself and turn around at the far end, a procedure called backtaxiing. When Gran Canaria reopened, the controllers worked to launch the backlog into deteriorating weather, with low cloud rolling across the field and visibility collapsing from a kilometre to a few hundred metres and back within minutes.
The investigation was conducted by the Spanish Subsecretaría de Aviación Civil, with formal participation by Dutch authorities (the Netherlands Aviation Safety Board), the United States, and the operators, in accordance with the international convention governing aircraft-accident inquiry. The Spanish report, released in October 1978, placed the fundamental cause squarely on the KLM captain: he began his takeoff roll without an air traffic control clearance, did not heed the tower’s instruction to stand by, and did not stop when the Pan Am crew transmitted that they were still on the runway. The Dutch authorities, while accepting that the KLM captain had taken off prematurely, emphasised a mutual misunderstanding in the radio communications and the inherent limitations of voice radio rather than assigning blame to one man alone. KLM ultimately admitted that its crew was responsible and compensated the victims’ families.
No crime was prosecuted; both captains died in the collision and the inquiry was administrative, not criminal. What the disaster produced instead was a wholesale change in how flight crews communicate and how they work together. The accident is the founding case for two enduring reforms: standardised, unambiguous radio phraseology — the word “takeoff” reserved for an actual clearance — and Crew Resource Management, the training discipline that empowers junior crew members to challenge a captain’s error before it kills everyone aboard.
On 12 August 1985, Japan Air Lines Flight 123, a Boeing 747SR-100 registered JA8119, crashed into a mountain ridge in Gunma Prefecture about 100 kilometres northwest of Tokyo, killing 520 of the 524 people aboard. Four passengers survived. It is the deadliest single-aircraft accident in aviation history and the deadliest accident involving any single airliner. The aircraft had departed Tokyo’s Haneda Airport at 18:12 local time on a short domestic flight to Osaka’s Itami Airport. About twelve minutes after takeoff, climbing through roughly 24,000 feet over Sagami Bay, the aft pressure bulkhead at the rear of the cabin ruptured.
The rupture was catastrophic in a specific, cascading way. The sudden release of pressurised cabin air into the unpressurised tail blew off a large part of the vertical stabiliser and severed all four of the aircraft’s hydraulic systems, which ran together through the tail. With no hydraulics, the crew lost the use of every conventional flight control — ailerons, elevators, rudder, and the ability to extend flaps or slats. Captain Masami Takahama and his crew were left to fly a 250-tonne aircraft using engine thrust alone, fighting a violent up-and-down oscillation called a phugoid. For about 32 minutes they kept the aircraft airborne, turning it by varying power between the wings, before it descended into the forested ridges of the Osutaka area and struck terrain at 18:56.
Japan’s Aircraft Accident Investigation Commission (AAIC) investigated, with participation by the United States National Transportation Safety Board and the manufacturer, Boeing. Its report, released on 19 June 1987, traced the disaster to a faulty repair Boeing had performed seven years earlier. In 1978 the same airframe, then operating as JAL Flight 115, had suffered a tailstrike on landing at Osaka that cracked the aft pressure bulkhead. The Boeing-approved repair called for a single continuous splice plate joining the bulkhead’s two halves with three rows of rivets. The repair crew instead fitted two separate splice plates, an arrangement that left part of the joint effectively carrying load through a single row of rivets and cut its fatigue resistance to roughly 70 percent of a correct repair. Fatigue cracks grew silently from the rivet holes over thousands of pressurisation cycles until, after about 12,300 flights, the joint failed.
No criminal conviction followed in Japan, though prosecutors investigated for years; the responsibility lay overwhelmingly with a foreign manufacturer’s repair performed years before the crash. The accident reshaped the inspection of pressure-vessel repairs, the philosophy of hydraulic-system redundancy and routing, and aircraft survivability standards, and it remains a landmark study of how a single hidden maintenance defect can sever the redundancy that a four-system aircraft was designed around.
On 25 May 1979, American Airlines Flight 191, a McDonnell Douglas DC-10-10 registered N110AA, crashed seconds after takeoff from Chicago O’Hare International Airport, killing all 271 people aboard and two more on the ground, for a total of 273. It remains the deadliest aviation accident on United States soil. As the aircraft rotated for takeoff on a routine service to Los Angeles, the No. 1 engine — the left wing engine — together with its supporting pylon broke away from the wing, flipped up and back over the wing’s leading edge, and fell to the runway. The aircraft, already committed to flight, climbed briefly, then rolled steeply to the left, descended, and struck the ground in an open field near a trailer park about a kilometre beyond the runway, where it disintegrated and burned. The whole sequence, from the engine departing the wing to impact, lasted only about 31 seconds.
The engine separation alone would not necessarily have been fatal — the DC-10 was designed to fly on two engines. What made the loss unrecoverable was a cascade of secondary failures caused by the engine and pylon tearing away. As the pylon ripped from the wing it severed hydraulic and electrical lines in the leading edge. This caused the outboard leading-edge slats on the left wing to retract, while those on the right wing stayed extended. The wing with retracted slats stalled at a higher speed than the other; with one wing flying and one stalled, the aircraft rolled uncontrollably to the left. The same damage disabled the cockpit instruments that would have warned the crew of the slat asymmetry and the impending stall, so the pilots, who could not see their own wings from the cockpit, flew the aircraft by the book for an engine-out climb — exactly the procedure that, with the left slats retracted, drove the dying wing into a deeper stall.
The National Transportation Safety Board investigated. Its report, AAR-79-17, determined that the engine and pylon had separated because of damage inflicted weeks earlier during maintenance. American Airlines, like some other carriers, had adopted a time-saving procedure to remove and reinstall the engine and pylon as a single unit using a forklift, rather than detaching the engine from the pylon first. The procedure was difficult to perform precisely; on N110AA a misalignment during reinstallation had cracked the pylon’s aft attachment fitting, and that crack grew under flight loads until the pylon failed on takeoff. The Board’s verdict was a maintenance-induced structural failure compounded by design vulnerabilities and oversight gaps. The accident grounded the entire DC-10 fleet for weeks and reshaped how engine maintenance procedures are approved and policed.
On 3 March 1974, Turkish Airlines Flight 981, a McDonnell Douglas DC-10-10 registered TC-JAV, crashed into the Ermenonville Forest about 40 kilometres northeast of Paris, killing all 346 people aboard — 335 passengers and 11 crew. There were no survivors. For just over three years, until the Tenerife runway collision of March 1977, it was the deadliest accident in aviation history; it remains the deadliest single-aircraft crash with no survivors, the deadliest DC-10 accident, and the deadliest air disaster on French soil.
The aircraft had left Istanbul Yeşilköy on a scheduled service to London Heathrow with an intermediate stop at Paris Orly. At Orly some 50 passengers disembarked and roughly 216 boarded, many of them travellers rebooked from carriers grounded by a British European Airways strike, including a group of English rugby supporters returning from a France–England match at the Parc des Princes. The DC-10 departed Orly heavily loaded. Roughly nine minutes after takeoff, as it climbed through about 11,500 feet over the town of Meaux, the aft left cargo door tore away from the fuselage. The pressure differential between the cabin and the suddenly depressurised cargo hold — about 5.2 pounds per square inch — collapsed a section of the passenger floor above the door. Six occupied passenger seats and the floor beneath them were ejected through the open hatch. The collapsing floor severed the control cables and hydraulic lines that ran beneath it to the tail and the centre engine. The crew lost most pitch control and rudder authority. Seventy-seven seconds after the door failed, the aircraft struck the forest at high speed in a shallow dive.
The French Minister of Transport appointed a commission of inquiry by decree the following day; because the aircraft was American-built, the commission included United States participation. Its conclusion was a matter of design. The aft cargo door used an outward-opening, latch-over-the-pressure-vessel scheme whose locking mechanism could give the appearance of being secured when the latches were not fully driven home. The door could be — and on TC-JAV had been — closed in an unsafe state. The same fundamental flaw had already failed once in flight, over Windsor, Ontario, in 1972, without a catastrophic outcome; the warning had been documented inside the manufacturer in the 1969–1972 period, most famously in an internal memorandum by McDonnell Douglas engineer Dan Applegate. The fix that should have prevented Flight 981 had been ordered, recorded as completed, and not actually installed on this airframe.
No criminal conviction followed the crash, but the litigation that did — a mass civil action settled in 1975 — pried open the manufacturer’s records and forced the design history into public view. The disaster reshaped how regulators treat a known latent flaw: the door was redesigned across the DC-10 fleet by mandatory airworthiness directive, and the episode became a standing case study in the difference between issuing a recommendation and compelling a fix.
On 19 July 1989, United Airlines Flight 232, a McDonnell Douglas DC-10-10 registered N1819U, crash-landed at Sioux Gateway Airport in Sioux City, Iowa, after the catastrophic failure of its tail-mounted number two engine destroyed all three of the aircraft’s hydraulic systems. Of the 296 people aboard, 112 were killed and 184 survived. Unlike most entries in this file, the outcome is remembered less for the deaths than for the survivals: an aircraft left with no conventional flight controls was kept airborne for some 44 minutes and brought to a runway by a crew improvising with engine thrust alone, a feat the investigators and the wider profession regarded as extraordinary.
The aircraft had departed Denver’s Stapleton International for Chicago O’Hare, with onward service to Philadelphia. About an hour into cruise at 37,000 feet, the stage-one fan disk of the rear General Electric CF6-6 engine fractured and burst apart. The engine failed in an uncontained manner: high-energy fragments were thrown clear of the engine casing and through the tail. Those fragments cut the lines of all three independent hydraulic systems where they passed close together near the tail. Hydraulic fluid drained away, and with it went the aircraft’s ability to move its elevators, ailerons, rudder, flaps, and slats. The DC-10 was, in the conventional sense, uncontrollable.
What followed was a controlled descent flown on differential thrust. Captain Alfred Haynes and his crew, joined by an off-duty United DC-10 training check airman, Captain Dennis Fitch, who was travelling as a passenger and came forward to help, manipulated the two remaining wing engines — adding and reducing power on each side to turn, and using power changes to coax the nose up and down — to fly the crippled aircraft toward Sioux City. On final approach the aircraft was descending too fast and drifting right; the right wingtip struck the runway, the aircraft cartwheeled, broke apart, and caught fire. That so many lived through it was attributed to the crew’s airmanship, the cabin crew’s preparation, and a well-drilled local emergency response that happened to be on a shift change with extra personnel available.
The National Transportation Safety Board, in report AAR-90/06, traced the disaster to a metallurgical defect that had been present in the fan disk since its manufacture and had grown into a fatigue crack that inspections failed to catch. The board’s probable cause did not stop at the metal; it faulted the inspection and quality-control regime that should have found the crack and did not.
On 17 July 1996, at about 20:31 eastern daylight time, Trans World Airlines Flight 800, a Boeing 747-131 registered N93119, exploded roughly twelve minutes after takeoff from John F. Kennedy International Airport in New York and fell into the Atlantic Ocean near East Moriches. All 230 people aboard — 212 passengers and 18 crew — were killed. The aircraft was bound for Charles de Gaulle Airport in Paris and, before Paris, on to Rome; it never climbed past roughly 13,700 feet. The breakup scattered wreckage across the seabed off Long Island and triggered one of the largest and most contested accident investigations in United States history.
The National Transportation Safety Board’s central conclusion was an explosion of the airplane’s center wing fuel tank (CWT). The nearly empty tank held a flammable mixture of fuel vapor and air; something ignited it, the tank ruptured, and the forward fuselage separated and fell away while the rest of the aircraft flew on briefly, trailing fire, before breaking apart. The Board’s probable cause names the mechanism precisely and states its uncertainty honestly: it could not identify the ignition source with certainty, but the most likely candidate it evaluated was a short circuit outside the tank that allowed excessive voltage into the fuel-quantity-indication system (FQIS) wiring running inside it.
Because the explosion happened over water in clear evening light, hundreds of people on Long Island and in boats saw it, and many described a streak of light rising toward the fireball — a description that fed an enduring belief that a missile or bomb had destroyed the airplane. The FBI and CIA examined the physical evidence and the witness accounts in detail and found no trace of an external detonation, no warhead residue, and no missile damage; the criminal investigation closed in late 1997 with the finding that no criminal act had occurred. The streak, the agencies concluded, was most consistent with the burning, climbing aircraft itself after the initial explosion.
The accident’s lasting consequence was regulatory and engineering, not judicial. No one was prosecuted; the cause was an industry-wide vulnerability, not a single culpable act. The NTSB’s finding that an ordinary jet flew with an explosive fuel-air mixture in a heated tank, waiting only for a stray spark, forced the FAA to attack both halves of the problem: the flammable vapor and the ignition energy. The result was a body of rules on fuel-tank system safety and, eventually, a requirement to render center tanks inert.
On 2 September 1998, Swissair Flight 111, a McDonnell Douglas MD-11 registered HB-IWF, crashed into the Atlantic Ocean about five nautical miles southwest of Peggy’s Cove, Nova Scotia, after an in-flight fire the crew could not control. All 229 people aboard — 215 passengers and 14 crew — were killed. The aircraft, an overnight service from New York’s JFK to Geneva, had been airborne for under an hour when the pilots smelled an unusual odour; within minutes a suspected air-conditioning smell escalated to a fire above the cockpit ceiling, and roughly twenty minutes after the first odour the airplane struck the water at high speed and disintegrated. The recovery and reconstruction that followed became one of the most exhaustive in aviation history.
The Transportation Safety Board of Canada investigated under report A98H0003 and released its findings on 27 March 2003 after more than four years’ work. The TSB concluded that a fire most likely began above the ceiling on the right side of the cockpit, near the rear wall, and that the most likely ignition was an electrical arcing event. Investigators recovered wire segments showing arcing damage, and a segment of arced cable belonging to the in-flight entertainment network (IFEN) — a supplemental system installed in the forward cabin — lay in the area where the fire most probably originated. The Board judged it likely that the lead arcing event involved one or more wires, which could have been IFEN wires, aircraft wires, or a combination; it could not declare the IFEN cable alone the sole initiating event.
Whatever the precise spark, the disaster turned on what happened next. The arc ignited flammable cover material on the aircraft’s thermal-acoustic insulation blankets — material whose outer film was metallized polyethylene terephthalate, or MPET. That covering met the flammability test standard in force at the time, yet it could be ignited and could sustain and spread fire. The fire propagated through the concealed space above the ceiling faster than the crew could locate or fight it, attacking wiring and systems and ultimately overwhelming the airplane.
Because the materials that propagated the fire were certified as compliant and yet proved dangerously flammable, the TSB’s central message was that the certification standard itself was inadequate. This is a design and certification finding, not a piloting one: the crew followed reasonable procedures for an unknown smell, but the aircraft was built with hidden flammable material and vulnerable wiring that allowed a small electrical fault to become an uncontrollable fire. The investigation drove the removal of MPET-covered insulation from the worldwide fleet and a fundamental tightening of material-flammability test standards.
In the early hours of 1 June 2009, Air France Flight 447, an Airbus A330-203 flying overnight from Rio de Janeiro to Paris, fell into the equatorial Atlantic with 228 people aboard. None survived. The aircraft had been cruising normally at 35,000 feet when its three pitot tubes — the small forward-facing probes that measure airspeed — iced over inside a band of high-altitude convective weather. The airspeed readings became briefly unreliable, the autopilot and autothrust disconnected as designed, and control of a perfectly airworthy jet passed abruptly to two pilots who did not understand what was happening to it. Within about four and a half minutes the A330 had stalled and descended, nose high and wings roughly level, into the sea.
The aircraft was almost new and the icing event was transient: the probes cleared within about a minute, and the airframe never suffered any failure that would have prevented continued flight. The accident sequence was instead an unrecognized aerodynamic stall. The pilot flying, the most junior of the three crew, made and then sustained nose-up control inputs that pulled the aircraft into a steep climb, bled off its speed, and held it stalled all the way down. A stall warning sounded almost continuously, yet the crew never identified the condition or applied the standard recovery — nose down, reduce angle of attack. The captain, resting at the moment the trouble began, returned to the cockpit too late to diagnose the situation before impact.
France’s Bureau d’Enquêtes et d’Analyses pour la sécurité de l’aviation civile (BEA) led the investigation under ICAO Annex 13. Its task was extraordinary: the wreckage and recorders lay nearly 4,000 metres deep, and it took almost two years and four search campaigns to locate them. The BEA published its final report on 5 July 2012. The report’s analysis centred on the crew: the loss of airspeed information triggered a chain of inappropriate manual inputs and a failure to recognize the stall, set against deeper deficiencies in high-altitude manual-flying training, crew coordination, and the ergonomics of the warnings the crew received.
The legal aftermath ran far longer than the technical one. A 2022–2023 criminal trial in Paris ended in March 2023 with the acquittal of both Air France and Airbus. The victims’ families appealed. On 21 May 2026 the Paris Court of Appeal reversed that outcome, convicting both companies of corporate manslaughter (homicides involontaires) and imposing the maximum corporate fine of 225,000 euros on each. Both companies announced they would appeal to the Court of Cassation. As of mid-2026 the case remains, in legal terms, open.