The first flight of the largest battery-electric aircraft to take to the skies lasted nearly half an hour while costing just $5 of electricity. That aviation feat comes at a time when jet fuel prices have skyrocketed because of the US war with Iran.
The test flight of Heart Aerospace’s X1 demonstrator aircraft took place at Plattsburgh International Airport in upstate New York on August 12. The X1 aircraft is comparable in size to a small regional airliner and can achieve a maximum takeoff weight exceeding 25,000 pounds with the help of four wing-mounted electric motors. The battery-electric propulsion system delivered more than one megawatt of power during the maiden flight.
All-electric aircraft can offer quieter and cleaner flight without the emissions that come from burning jet fuel. They may also prove more reliably cost-effective than conventional aircraft that come with jet fuel costs subject to geopolitical disruptions.
Tenerife, the power gradient, and the calculus of voice
On 27 March 1977, two Boeing 747s collided on a runway in the Canary Islands, and 583 people died. It was the worst disaster in the history of civil aviation, and it happened on the ground, at Los Rodeos airport on Tenerife.
Neither flight was ever meant to be at Los Rodeos. They were bound for Gran Canaria, until a separatist group detonated a bomb in the terminal there and fear of a second one meant the airport was closed for safety. All flights headed to Gran Canaria were diverted to nearby airports such as Los Rodeos: a small, typically rather foggy airport on Northern Tenerife, with a single runway and a handful of taxiways. By the afternoon the apron was full of large international aircraft that had been diverted, and many of the taxiways were blocked by the planes parked on them. When the all-clear to start leaving finally came, the planes that wanted to leave couldn’t taxi around to the runway as usual, because there was no room. They had to taxi down the active runway itself, turn around, and take off back the way they had come.
By Mtcv for Dutch wikipedia. CC BY-SA 3.0, https://commons.wikimedia.org/w/index.php?curid=1091580
Speaking up on the flight deck
The KLM 747 was piloted by Captain Jacob van Zanten (11,700 flight hours), with First Officer Klaas Meurs (9,200 flight hours) beside him and Flight Engineer Willem Schreuder (17,031 flight hours) behind. Van Zanten taxied down the runway, turned the aircraft around, and got ready to depart. Behind them, the Pan Am 747 was still taxiing down the same runway, under instruction to turn off at the third exit.
Van Zanten pushed the throttles forward and began preparing for takeoff. Meurs, somewhat surprised, told him they didn’t have ATC (Air Traffic Control) clearance for taking off. Van Zanten replied and briskly said (in Dutch) “No, I know that. Go ahead, ask.”
The ATC tower then radioed KLM a route clearance, the instructions for after departure, which contained the word “takeoff” without actually being a clearance to take off. Meurs read it back and tailed off with the words “we are now at takeoff.” Van Zanten, already releasing the brakes, said two words over the top of him:“We’re going.”The controller, who could not see the runway through the fog, answered “OK,” and then, after a pause, “Stand by for takeoff, I will call you.“ At that exact moment however, the Pan Am crew keyed their microphone to say they were still on the runway. The two radio transmissions collided, producing a squeal that meant neither were audible. The only word that reached the KLM cockpit cleanly was “OK.”
The tower then told the Pan Am to report when it was clear of the runway, and Pan Am acknowledged. It turns out that the big 747 was too long to make the sharp turn left onto taxiway 3, and so they were still on the runway, heading to taxiway 4 instead. This much was audible in the KLM cockpit, and Schreuder heard it. He then asked the question that could have prevented disaster:
Schreuder: “Is he not clear then?”
van Zanten: “What did you say?”
Schreuder: “Is he not clear, that Pan American?”
van Zanten, emphatically: “Oh, yes.”
As he replied, Van Zanten increased the throttle, accelerating the 747 along the runway.
And then both Schreuder and Meurs remained quiet. For the ten or fifteen seconds that remained, while the KLM 747 sped up to takeoff speed, they said nothing, until the fog ahead cleared, at about 160 miles an hour, showing the Pan Am 747 directly in their path, pointing straight at them. Both crews tried to take evasive action. The Pan Am pilot turned left toward the grass verge beside the runway; whilst van Zanten pulled back hard enough to drag the tail along the tarmac, trying to take off straight up and over the Pan Am. However, Van Zanten had sensibly decided to refuel during the long wait, and combined with the full complement of passengers and luggage, it meant the KLM was heavy, and they didn’t make it. The wheels and one engine of the KLM ripped into the Pan Am, and the KLM hit the ground. The collision killed everyone aboard the KLM and most of those aboard the Pan Am. 583 people died as a result.
Wreckage on the runway of Los Rodeos after the Tenerife airport disaster of March 27, 1977
“But if it really matters, won’t people speak up?”
If we take one thing from this, it is this: people do not speak up with their concerns, and they especially do not speak up again once they have spoken up and been dismissed, even when their own lives and the lives of others are at stake. The interpersonal costs and risks of speaking up loom so large that they outweigh the benefits of doing so – even when lives are on the line.
Willem Schreuder was not inexperienced. He had more flying hours than either of the men in cockpit with him. He was aware of a potential problem and named it, twice. And then, having seen his concern bounce off the captain’s apparent confidence, he stayed silent, in an aircraft accelerating along a runway he had good reason to think was occupied by another plane. This isn’t cowardice or stupidity. It is how the interpersonal cost of speaking up feels for all of us. The official investigation reached the same conclusion. “Perhaps influenced by his great prestige, making it difficult to imagine an error of this magnitude on the part of such an expert pilot, both the copilot and flight engineer made no further objections” (quoted in Weick, 1990, p. 574). Van Zanten’s expert power in the cockpit actively suppressed the correction of his error.
This the outcome of the tacit calculus of voice, combined with Prospect Theory: we weigh the almost certain and immediate cost of speaking up against a possible benefit in the future. The cost of pressing the experienced captain a third time is immediate, social, and certain. We will be the person who second-guessed the chief instructor, out loud, on the basis of a belief, and if the runway turns out to be clear we will have aborted his takeoff for nothing. We all tend to over-estimate the immediate costs of speaking up, especially against someone with greater seniority or experience, so the calculus tips towards the negative and we remain silent. This is all very human and normal.
And we should take note of the form the doubt took. Schreuder did not say “there is an aircraft on that runway, stop.” He asked whether the Pan Am was clear. This is normal: we tend to raise concerns in mitigated forms, as hints and questions rather than statements and commands, and the softer the form, the lower risk it is to us, but also the easier it is to dismiss (Fischer and Orasanu, 1999). The calculus of voice also shapes how we say something as well as whether we say it at all.
Here’s the main takeaway though – if the calculus still tips toward silence when the downside is death for ourselves and others, then we should not be surprised that it tips toward silence in a marketing meeting, an ideation session, or a finance catch-up. In most of the meetings and conversations we have at work, the risk of death is fairly low. The high stakes that might justify the risk of speaking are not even close to this example, which means the silence makes even more sense. Tenerife is actually a fairly ordinary case of low psychological safety, but with a particularly tragic outcome.
KLM captain Jacob Veldhuyzen van Zanten featured in a 1977 advertisement for the airline
Whilst the disaster was playing out, as the Pan Am taxied through the fog toward an aircraft they couldn’t see, the crew talked about the KLM captain: “he’s anxious, isn’t he,” one said, “after he held us up half an hour, now he’s in a rush.” (The KLM had unintentionally blocked the Pan Am in while they refuelled). The Pan Am crew had read the situation well – crew members in both cockpits felt that something wasn’t right.
The Power Gradient
The second thing this disaster surfaced was the difference in power between the most powerful person in the space, and the least. The aviation safety literature of the period called it various things, the authority gradient, the cockpit gradient, the power gradient. They are all pointing at the same thing: the steeper the difference in power between the person at the top and the person who has something to say, the harder it is to say it. The literature at the time called this “safety silence”, “attenuated voice” or “mitigated speech”, but it’s all describing a lack of psychological safety. There is a great deal of evidence on how status differences shape cockpit communication and coordination (Milanovich et al., 1998, Hagen, 2013). The steeper the gradient, the more that voice is suppressed – it’s much harder to speak up against someone with greater power – power over your future, your reputation, your job, or your status. Power gradients are one of the most important things, perhaps the most important thing, governing whether people speak up.
“Power” is a large and ambiguous word though, so it helps to break it down. Drawing on French and Raven, we talk about four kinds of power.
Formal power (positional power) is the obvious kind, the kind that is described and written down on an org chart. Role, rank, title, seniority, grade, etc. It is the most legible form of power, and being visible, it’s also often the easiest to navigate.
Informal power is much harder to see, because it is rarely written down. It’s affected by social standing, reputation, popularity, the size and shape of our networks, our reputation, who we know and how many people we know. It’s largely invisible, which makes it harder to navigate.
Demographic power is mostly the power we have little or no control over – height, race, age, gender, sexuality, class, accent, socioeconomic background and more. It endows, or otherwise, different degrees of power in different contexts.
Expert power is what we know: our qualifications, our experience, our demonstrated competence in this particular context. A brain surgeon in a cockpit has very little of it (probably, although they may also be a qualified pilot). A highly trained and experienced surgeon in an operating theatre probably has a lot of expert power.
The Four Types of Power
Pulled apart, you can see that all four are usually in play at once, each to a greater or lesser degree. Sometimes one takes precedence, sometimes one compensates for another and sometimes they accumulate into something larger than any of them alone
In van Zanten they all stacked up. His informal power was significant: he was the face of KLM’s advertising, the man in the in-flight magazine, photographed under the line about the people who made punctuality possible. He was, at least in the world of the airline, a minor celebrity. There was demographic power too, in the tall, tanned, silver-haired Dutchman in a captain’s uniform. And his formal and expert power was as high as it went: he was KLM’s Chief Instructor on the 747, the man who taught other pilots how to fly, the airline’s recognised authority on this type of plane. He was who KLM would later try to reach to help investigate the crash, before they realised that he had been at the controls. Just a few weeks earlier, conducted Meurs’s qualification check on the 747. The first officer beside him owed his certification on the aircraft to the man he was trying to challenge.
All that combined meant the power gradient in that cockpit was incredibly steep.
It’s also worth noting that as Chief Instructor, Van Zanten had spent almost the preceding three months in the simulator, where the instructor clears himself to take off, and one likely explanation for starting to roll without clearance is simply that he reverted to the habit his role had built into him. Karl Weick, in the classic scholarly analysis of the disaster, calls this regression: under pressure, people fall back on what they learned first and know most thoroughly. He was also very aware of his own reputation for being punctual – indeed, that was what he was famous in KLM for – and combined with recently introduced safety rules on operational hours that meant if they didn’t take off soon, they’d be grounded overnight, this likely led to a great sense of urgency for Van Zanten. The reputation he was known for was now driving the throttle forward under his hand.
An easy version of this story makes van Zanten a tyrant, but the evidence doesn’t support it. Colleagues who knew him, including Jan Bartelski, a fellow KLM captain and later president of the international pilots’ federation, describe him as studious and introverted but warm, a believer in partnership who insisted his first officers call him “Jaap” rather than “Captain.” Here was a man trying, by temperament and stated belief, to lessen the gradient, but it still wasn’t enough, and psychological safety eroded in his cockpit regardless. The gradient doesn’t dissolve because the person above you is, personally, a good sort. We can work to mitigate the power gradient and we should, but being decent alone won’t do it.
So it’s not helpful here to say it was Van Zanten’s fault, or that having power is something to feel guilty about. Power is how we get things done. Most of us will, in some room at some time, be the most powerful person in it. What we are obliged to do is recognise and acknowledge it, because the gradient forms whether or not we want it to, and it has effects whether or not we intend them.
What we learned from the wreckage
The response to Tenerife, and to the accidents around it, was Crew Resource Management. It came out of a NASA workshop on human factors in 1979, which itself was catalysed by the Tenerife disaster, along with others, and was first adopted comprehensively by United Airlines in the early 1980s. Within a remarkably short space of time, it was taken up by nearly every airline in the world. It is, with some justification, often called the most successful safety programme humanity has ever created and is a large part of the reason that getting into an aeroplane is now one of the safest way to travel.
CRM emerged in aviation specifically to reduce catastrophic errors by changing culture: communication norms, authority gradients, briefing practices, and coordination under pressure. It has also been adopted in medicine, especially in emergency response and surgical teams. It trains people how to speak up when something looks or feels wrong, to challenge decisions regardless of seniority, to cross-check decisions, and to share situational awareness. In doing so, it creates a structured environment in which speaking up becomes expected and legitimate (Weller, Boyd and Cumin, 2014). The sense that it is safe to raise a concern is not a mysterious precondition that must somehow emerge. It is, at least in part, the result of concrete practices, training, and norms that make voice a normal part of the work.
It began life as Cockpit Resource Management and became Crew Resource Management, as further disasters taught more lessons. At Kegworth, cabin crew outside the cockpit could see what the pilots could not, and the information never made the journey forward. A steep power gradient between cockpit crew and cabin crew held it back. Accidents like this aught us that it is not enough to train only the people at the controls. Cabin crew, ground crew, air traffic control, operations staff: everyone in the system needs to be able to speak up to power at the moment it matters, and everyone needs the people above them to listen when they do. The safest crews are the ones where leadership is, in effect, shared: cabin and cockpit prompting and correcting one another rather than information travelling in one direction (Bienefeld and Grote, 2014).
CRM works on the problem from both ends. It scaffolds the act of speaking up against a gradient, giving people recognised, legitimate ways to push information upwards. And it works on the gradients themselves, building in practices that share power and distribute authority so that the slope is shallower before we have to climb it. Both are necessary. We can’t just teach the person at the bottom of the slope to be braver; we also have to make the slope less steep. And it’s a continuing effort – mitigated speech still persists even in trained crews, which is why CRM has to be lived rather than merely delivered (Perkins et al., 2022).
Walking ourselves up the ladder
One of the practices that came out of this world is PACE, a graded assertiveness tool, which is a scaffold built precisely for the situation Schreuder and Meurs found themselves in.
We begin with a Probe: a low-threat question that surfaces the concern without confronting anyone. “Is that red light meant to be on?”, “That Pan Am, is he clear yet?” Schreuder’s question was, in effect, a probe. If the probe doesn’t get traction, if it doesn’t draw attention to the thing we are actually concerned about, we escalate to an Alert, which names the hazard more clearly. “Oxygen is at 90% and falling.” or “We don’t have ATC clearance for takeoff.” Meurs’s first objection was an alert. If the alert doesn’t work either, we go to Challenge: stating the problem and proposing a different course of action, which is much harder, because now we‘re not just raising a worry, we’re suggesting the powerful person does something other than what they have decided. “I don’t think it’s safe to take off yet. There may be an aircraft on the runway. Let’s hold and check.” And if even that fails, we reach Emergency, an unambiguous command: “Stop. This is unsafe.” This is very interpersonally challenging and risky, but is less so if we’ve walked ourselves up the PACE steps already – and hopefully we don’t need to get to Emergency anyway, having addressed it somewhere down the ladder.
We see the same pattern far outside aviation. Elaine Bromiley died in 2005 during what should have been a routine operation, when her anaesthetists became fixated on intubating her and lost track of the time she’d spent without oxygen. The nurses in the room saw what was happening, and someone even fetched the kit for an emergency tracheotomy. But they didn’t speak up and directly challenge the anaesthetists, because the power gradient between nurses and consultants was just as steep as the one in the KLM cockpit (Harmer, 2005). Elaine’s husband Martin, an airline pilot, went on to found the Clinical Human Factors Group, and has spent the years since bringing aviation’s hard-won human-factors lessons into healthcare.
What Tenerife taught us
We have learned an enormous amount from this disaster, as we have from many others. The conditions that produced the silence in that cockpit are not rare or unique to aviation. A steep gradient, a confident expert in charge, and a team under time pressure isn’t just a description of a 1977 runway. It is a description of an ordinary leadership meeting in a board room, a weekly catchup with our manager, or any number of other comparatively mundane contexts (with the merciful difference that the stakes are usually lower). The silence itself is a natural outcome of conditions that organisations produce and reproduce in themselves (Morrison and Milliken, 2000).
That difference between a cockpit and a meeting is also a risk. Because the stakes are lower, silence is cheaper, and the scaffolding that aviation was forced to build under the pressure of mass fatalities is scaffolding that many of us are never offered. If two skilled people would not press a third time with their own lives on the line, we cannot reasonably expect anyone to press in a meeting where the worst case outcome is mild embarrassment or relationship damage, unless we have deliberately built the conditions that make speaking up worth the cost.
Weick’s 1990 analysis remains the best single account of how this happens. He described Tenerife as a vulnerable complex system: interrupted routines, interdependencies pulling tighter, pressure eroding cognitive capacity, and power gradients distorting communication, combining so that small errors multiplied and spread. None of them were using the term psychological safety because it wasn’t yet in mainstream use, but they were describing the exact same thing. The power gradient suppresses voice; the silence risks disaster; and the work is to build the conditions, structural as well as interpersonal, in which the least powerful person can say the thing, to the most powerful person, that needs saying while there is still time to act on it. Van Zanten’s last two words on the matter were ‘We’re going.‘
If you enjoyed this piece on the Tenerife Disaster, Jan Hagen’s Confronting Mistakesis a great book to read, because it works through similar disasters and explores why they happened, what might have prevented them, and what we learned from them. For the fullest blow-by-blow reconstruction of the accident itself, Admiral Cloudberg’s account is an excellent and detailed writeup. Under nearly all of them sits the same thing the human-factors investigators surfaced at Tenerife, decades before psychological safety became a recognised term outside of a narrow field of academia.
References
Bienefeld, N. and Grote, G. (2014) ‘Shared leadership in multiteam systems: How cockpit and cabin crews lead each other to safety’, Human Factors, 56(2), pp. 270–286.
Fischer, U. and Orasanu, J. (1999) ‘Cultural diversity and crew communication’. Paper presented at the 50th International Astronautical Congress, Amsterdam, October 1999.
Milanovich, D.M., Driskell, J.E., Stout, R.J. and Salas, E. (1998) ‘Status and cockpit dynamics: A review and empirical study’, Group Dynamics: Theory, Research, and Practice, 2(3), pp. 155–167.
Morrison, E.W. and Milliken, F.J. (2000) ‘Organizational silence: A barrier to change and development in a pluralistic world’, Academy of Management Review, 25(4), pp. 706–725.
Perkins, K., Ghosh, S., Vera, J., Aragon, C. and Hyland, A. (2022) ‘The persistence of safety silence: How flight deck microcultures influence the efficacy of crew resource management’, International Journal of Aviation, Aeronautics, and Aerospace, 9(3).
Weick, K.E. (1990) ‘The vulnerable system: an analysis of the Tenerife air disaster’, Journal of Management, 16(3), pp. 571–593.
Weller, J., Boyd, M. and Cumin, D. (2014) ‘Teams, tribes and patient safety: Overcoming barriers to effective teamwork in healthcare’, Postgraduate Medical Journal, 90(1061), pp. 149–154.
Login
