One letter, two beacons: American Airlines Flight 965's rushed approach ends on a mountain near Cali

On the night of 20 December 1995 an American Airlines Boeing 757 flying from Miami to Cali, Colombia struck the side of a mountain near Buga at about 8,900 feet, killing 159 of the 163 people aboard. The accident is remembered less for any mechanical failure than for what happened inside the aircraft's flight management system: a crew member entered the single letter "R" for the Rozo beacon printed on the approach chart, the navigation database returned a beacon called Romeo far away near Bogota instead, and once the entry was executed the autopilot began turning the jet roughly 90 degrees away from its cleared approach path while it continued a rushed descent into mountainous terrain. Colombia's Aeronautica Civil placed the probable causes on the flight crew's planning, execution and loss of situational awareness, but listed the flight management system's logic and its divergent naming convention among the contributing factors.

What happened

Flight 965 left Miami about two hours late with 155 passengers and eight crew, and the cockpit voice recording captured the crew's concern about the delay's effect on the flight attendants' rest requirements for the next day's flight, according to the US Federal Aviation Administration's Lessons Learned case study. Cali sits at the southern end of a long valley walled by ridges that rise to 14,000 feet, and approach control had no radar coverage that night, so controllers depended entirely on position reports from the crew.

Late in the descent the controller offered a straight-in approach to runway 19 instead of the planned ILS to runway 01. Accepting it saved time but forced a much faster descent and a scramble to find new charts and reprogram the aircraft. The captain had earlier commanded the flight management system to proceed direct to the Cali VOR, which under the system's logic removed the intermediate fixes, including the Tulua reporting point and the Rozo beacon, from the navigation display. When the crew then tried to rebuild the arrival by entering "R", the identifier shown on the paper chart for Rozo, the control display unit offered a list of waypoints ordered by distance from the aircraft. Rozo was not among them.

The ROZO NDB was not one of the selectable waypoints.

FAA Lessons Learned, Boeing 757-223 N651AA

The nearest entry on that list was Romeo, a non-directional beacon near Bogota that shared Rozo's identifier letter and its 274 kHz frequency. The entry was executed, the autopilot banked left toward Romeo, and about a minute of eastbound flight carried the aircraft over high ground. The crew disconnected lateral navigation and turned back to the right, but by then they had lost track of where they were. The ground proximity warning system called terrain at 21:41:15; the crew applied full power and pitched up steeply, but left the speedbrakes extended, and the recording ended thirteen seconds later.

The database trap

The final report by Aeronautica Civil of Colombia traced the substitution to how navigation data was keyed. Colombia had assigned the letter R to both the Romeo and Rozo beacons. Under the ARINC 424 data standard, a duplicate identifier is resolved by using the navaid's name instead, so Rozo was loaded into the database under the four-letter string ROZO while R remained the key for Romeo. Simulator and bench tests at Boeing during the investigation reproduced the behaviour closely: typing R produced a list of waypoints sorted by distance with Romeo, near Bogota, at the top, Rozo absent entirely, and execution of the selection commanding a turn toward Bogota.

The report placed Romeo roughly 132 miles east-northeast of Cali, a figure AOPA Pilot repeated in its 2001 account, which was edited from the official report. The FAA's case study instead describes Romeo as about 150 nautical miles from the aircraft's position at the time of the entry; the two figures are measured from different reference points, and the smaller number from the official report should be treated as the authoritative separation between the two beacons. The report says the pilots could not have known of the substitution without checking the map display or the coordinates, and Boeing's simulation showed that entering R drew a dashed line pointing off the map to the east-northeast; American's policy required exactly that verification, and the other pilot's approval, before executing a course change. AOPA also notes the naming was cleaned up afterwards.

The name of the NDB and its identifier were changed after the accident.

AOPA Pilot, Landmark Accidents

How it was investigated and answered

A helicopter sighted the wreckage at about 06:30 on 21 December and search teams landed within minutes; the report judged the response timely and effective given the remote, mountainous terrain. The report records that five passengers initially survived with serious injuries and that one of them later died in hospital, leaving four survivors out of 163 occupants.

Investigators examined the accident aircraft's flight management computer memory at Honeywell, questioned Jeppesen Sanderson about how its database was built, and ran the sequence again in Boeing simulators. The report, signed in September 1996 in Bogota, named four probable causes, all of them centred on the crew: inadequate planning and execution of the runway 19 approach together with inadequate use of automation, failure to abandon the approach despite numerous cues, loss of situational awareness about altitude, terrain and the location of radio aids, and failure to fall back on basic radio navigation once the automated system became confusing. Among the contributing factors it listed the system logic that dropped intermediate fixes when a direct-to command was executed, and navigation data that used a naming convention different from the published charts.

With the concurrence of Aeronautica Civil, the US National Transportation Safety Board issued a block of recommendations to the FAA in the A-96 series, published by the FAA alongside the case study. They included a requirement that flight management systems retain the fixes between the aircraft and its target after a direct-to command, standards to make automated displays match approach charts, a review of arrival and departure naming conventions with ICAO member states, and a direct warning about duplicate identifiers abroad.

Inform pilots of flight management system (FMS)-equipped aircraft of the hazards of selecting navigation stations with common identifiers when operating outside of the United States and that verification of the correct identity and coordinates of FMS-generated waypoints data is required at all times.

NTSB recommendation A-96-97, via FAA

Why it moves the needle

Flight 965 is one of the clearest early cases in which an automated system did precisely what its designers specified and still steered a vehicle full of people toward disaster. No component malfunctioned: the ground proximity warning system worked, the autopilot tracked the commanded course faithfully, and the database resolved a duplicate identifier by the rules of the standard it was built to. The danger lived in the seams between three artefacts that were each internally consistent but mutually inconsistent, namely the paper chart that showed R for Rozo, the database that reserved R for Romeo, and the display logic that quietly deleted the fixes a crew needed to notice the difference.

The response reshaped the industry. The FAA's own account describes the accident as the catalyst for the retroactive rule requiring terrain awareness and warning systems across the US commercial fleet, and the recommendations pushed toward harmonising automated displays with charts and toward training pilots to recognise when the flight computer has become an obstacle rather than an aid. Three decades later the same failure pattern, an operator's plausible input silently matched to the wrong entity inside an automated system that then acts on it, recurs in far more capable systems, which is why this crash remains a reference point rather than a period piece.