ON a muggy May afternoon in 1996 an emergency dispatcher in southern Florida got a call from a man on a cellular phone. The caller said, "Yes. I am fishing at Everglades Holiday Park, and a large jet aircraft has just crashed out here. Large. Like airliner-size."
The dispatcher said, "Wait a minute. Everglades Park?"
"Everglades Holiday Park, along canal L-sixty-seven. You need to get your choppers in the air. I'm a pilot. I have a GPS. I'll give you coordinates."
"Okay, sir. What kind of plane did you say? Is it a large plane?"
"A large aircraft similar to a seven-twenty-seven or a umm ... I can't think of it."
This lapse was unimportant. The caller was a born accident observer—a computer engineer and a private pilot with pride in his technical competence and a passion for detail. His name was Walton Little. When he first saw the airplane, it was banked steeply to the right and flying low, just above the swamp. Later he filed an official report, in which he stated,
There was no smoke, no strange engine noise, no debris in the air, no dangling materials or control surfaces, no apparent deformation of the airframe, and no areas that appeared to have missing panels or surfaces.... Sunlight was shining on the aircraft, and some surfaces were more reflective and some less reflective. I saw a difference in reflection of the wing skin in the area where I would expect the ailerons to be, as though they were not neutral. In particular, the lower (outboard) portion of the right wing appeared less reflective as though the aileron was deflected upward.
Nearby fishermen ducked into their boat for cover—but not Walton Little, who stood on his deck, facing "about 115 degrees," and watched the airplane hit the water. The shock wave passed through his body.
I was in disbelief that the crash had occurred. I stood there for just a moment to consider that it really did happen. I was already thinking that I needed to get my cellular phone out of the storage compartment and call 911, but I wanted to assure myself of what I was doing because it is against the law to make false calls to 911.
He called within a minute. After telling the dispatcher about the crash and reading off his latitude and longitude, he said, "I'm in a bass boat on the canal. I thought it was an aircraft from an air show or something, and..."
The dispatcher interrupted. "What did you ... Did you see flames and stuff come up, sir?"
"I heard the impact, and I saw dirt and mud fly in the air. The plane was sideways before it went out of my sight on the horizon about a mile from me."
"Yes, sir. Okay. You said it looked like a seven-twenty-seven that went down?"
"Uh, it's that type aircraft. It has twin engines in the rear. It is larger than an executive jet, like a Learjet."
"It's much bigger than that. I won't tell you it's a seven-twenty-seven, but it's that type aircraft. No engines on the wing, two engines in the rear. I do not see any smoke, but I saw a tremendous cloud of mud and dirt go into the sky when it hit."
"It was white with blue trim."
"White with blue trim, sir?"
"It will not be in one piece."
Walton Little was right. The airplane was a twin-engine DC-9 painted the colors of ValuJet, an aggressive young discount airline based in Atlanta. When it hit the Everglades, it was banked vertically to the right and pointed nearly straight down. The airplane did not sink mysteriously into the swamp, as reports later suggested, but shattered as it hit the surface with the furious force of a fast dive.
By the time Walton Little felt the shock wave, everyone aboard was dead—two pilots, three flight attendants, and 105 passengers. Their remains lay in a shallow, watery crater filled with liquid mud and grass. All that marked the surface was a fractured engine, a few dead fish, some jet fuel, and a scattering of personal papers, clothes, and twisted pieces of aluminum—the stuff of tragedy. During those first few days some officials worried aloud about the accident's effect on nature, but the swamp was not so fragile as that, and quickly resumed its usual life. The families of those who died have proved less resilient. Most will feel the poison forever.
For the rest of us, though, the accident should be finished business. The official investigation is over, a "cause" has been found, contributing factors have been acknowledged, and the Federal Aviation Administration has written new regulations. Editorialists have expressed their outrage, and individuals have been held responsible. After a long suspension ValuJet has returned to the air with a renewed commitment to safety. Other airlines, too, have promised to be more careful. And even the FAA has gone through a housecleaning. So by conventional standards the reaction to the tragedy has been admirable. And yes, we know anyway that flying is almost always safe. After years as a working pilot, I have a poetic idea of why: airplanes are fundamentally at home in the sky. Certainly my own experience is that passengers do not need to cower around the exit rows, or carry emergency "smoke hoods," or fear bad weather, or worry about some impending collapse of airline safety. Those are ideas promoted by aviation illiterates—overly cautious people who can always find an audience, and who would smother us in their fear of violent death. The public has the sense in the long run to ignore them. Nonetheless, the ValuJet accident continues to raise troubling questions—no longer about what happened but about why it happened, and what is to keep something similar from happening in the future. As these questions lead into the complicated and human core of flight safety, they become increasingly difficult to answer.
Consider, for simplicity, that there are three kinds of airplane accidents. The most common ones might be called "procedural." They are those old-fashioned accidents that result from single obvious mistakes, that can immediately be understood in simple terms, and that have simple resolutions. To avoid such accidents pilots must not fly into violent thunderstorms, or take off with ice on their wings, or descend prematurely, or let fear or boredom gain the upper hand. Mechanics, ramp agents, and air-traffic controllers must observe equally simple rules. As practitioners, we have together learned many painful lessons.
The second kind of accident could be called "engineered." It consists of those surprising materials failures that should have been predicted by designers or discovered by test pilots but were not. Such failures at first defy understanding, but ultimately they yield to examination and result in tangible solutions. An American Eagle ATR turboprop dives into a frozen field in Roselawn, Indiana, because its de-icing boots did not protect its wings from freezing rain—and as a result new boots are designed, and the entire testing process undergoes review. A USAir Boeing 737 crashes near Pittsburgh because of a rare hard-over rudder movement—and as a result a redesigned rudder-control mechanism will be installed on the whole fleet. A TWA Boeing 747 blows apart off New York because, whatever the source of ignition, its nearly empty center tank contained an explosive mixture of fuel and air—and as a result explosive mixtures may in the future be avoided. Such tragic failures seem all too familiar, but in fact they are rare, and they will grow rarer still as aeronautical engineering improves. One can regret the lives lost and deplore the slowness with which officials respond, but in the long run there is reason to be optimistic. The Wright brothers were products of the Enlightenment. Our science will prevail.
The ValuJet accident is different. I would argue that it represents the third and most elusive kind of disaster, a "system accident," which may lie beyond the reach of conventional solution, and which a small group of thinkers, inspired by the Yale sociologist Charles Perrow, has been exploring elsewhere—for example, in power generation, chemical manufacturing, nuclear-weapons control, and space flight. Perrow has coined the more loaded term "normal accident" for such disasters, because he believes that they are normal for our time. His point is that these accidents are science's illegitimate children, bastards born of the confusion that lies within the complex organizations with which we manage our dangerous technologies. Perrow is not an expert on commercial flying, but his thinking applies to it nonetheless. In this case the organization includes not only ValuJet, the archetype of new-style airlines, but also the contractors that serve it and the government entities that, despite economic deregulation, are expected to oversee it. Taken as a whole, the airline system is complex indeed.
Keep in mind that it is also competitive, and that if one of its purposes is to make money, the other is to move the public through thin air cheaply and at high speed. Safety is never first, and it never will be, but for obvious reasons it is a necessary part of the venture. Risk is a part too, but on the everyday level of practical compromises and small decisions—the building blocks of this ambitious enterprise—the view of risk is usually obscured. The people involved do not consciously trade safety for money or convenience, but they inevitably make a lot of bad little choices. They get away with those choices because, as Perrow says, Murphy's Law is wrong—what can go wrong usually goes right. But then one day a few of the bad little choices come together, and circumstances take an airplane down. Who, then, is really to blame?
We can find fault among those directly involved—and we probably need to. But if our purpose is to attack the roots of such an accident, we may find them so entwined with the system that they are impossible to extract without toppling the whole structure. In the case of ValuJet the study of system accidents presents us with the possibility that we have come to depend on flight, that unless we are willing to end our affordable airline system as we know it, we cannot stop the occasional sacrifice. Beyond the questions of blame, it requires us to consider that our solutions, by adding to the complexity and obscurity of the airline business, may actually increase the risk of accidents. System-accident thinking does not demand that we accept our fate without a struggle, but it serves as an important caution.
THE distinction among procedural, engineered, and system accidents is of course not absolute. Most accidents are a bit of each. And even in the most extreme cases of system failure the post-crash investigation must work its way forward conventionally, usefully identifying those problems that can be fixed, before the remaining questions begin to force a still-deeper examination. That was certainly the way with ValuJet Flight 592.
It was headed from Miami to Atlanta, flown by Captain Candalyn Kubeck, age thirty-five, and her copilot Richard Hazen, age fifty-two. They represented a new kind of commercial pilot, experienced not only in the cockpit but in the rough-and-tumble of the deregulated airline industry, where both had held a number of low-paid flying jobs before settling on ValuJet. It would have been no shock to them that ValuJet pilots were non-unionized, or that the company required them to pay for their own training. With 9,000 flight hours behind her, more than 2,000 of them in a DC-9, Kubeck earned what the free market said she was worth—about $43,000 a year, plus bonuses. Hazen, formerly in the Air Force and with similar experience, earned a bit more than half as much.
Pilots were not the only low-paid employees at ValuJet—flight attendants, ramp agents, and mechanics made a lot less there than they would have at a more traditional airline. So much work was farmed out to temporary employees and independent contractors that ValuJet was sometimes called a "virtual airline." FAA regulators had begun to worry that the company was moving too fast, and not keeping up with its paperwork, but there was no evidence that the people involved were inadequate. Many of the pilots were refugees from the labor wars at the old Eastern Airlines, and they were generally as competent and experienced as their higher-paid friends at United, American, and Delta. ValuJet was helping the entire industry to understand just how far cost-cutting could be pushed. Its flights were cheap and full, and its stock was strong on Wall Street.
But six minutes out of Miami, while climbing northwest through 11,000 feet, Richard Hazen radioed, "Ah, five-ninety-two needs an immediate return to Miami." In the deliberate calm of pilot talk this was strong language. The time was thirty-one seconds after 2:10 P.M., and the sun was shining. Something had gone wrong with the airplane.
The radar controller at Miami Departure answered immediately. Using ValuJet's radio name "Critter" (for the company's cartoonish logo—a smiling airplane), he gave the flight clearance to turn initially toward the west, away from Miami and conflicting traffic flows, and to begin a descent to the airport. "Critter five-ninety-two, ah roger, turn left heading two-seven-zero, descend and maintain seven thousand."
Hazen said, "Two-seven-zero, seven thousand, five-ninety-two."
The controller was Jesse Fisher, age thirty-six, a seven-year veteran, who had twice handled the successful return of an airliner that had lost cabin pressurization. He had worked the night before, and had gone home, fed his cat, and slept well. He felt alert and rested. He said, "What kind of problem are you having?"
Hazen said, "Ah, smoke in the cockpit. Smoke in the cabin." His tone was urgent.
Fisher kept his own tone flat. He said, "Roger." Over his shoulder he called, "I need a supervisor here!"
The supervisor plugged in beside him. On Fisher's radar screen Flight 592 appeared as a little oval and an associated group of numbers, including a readout of its altitude. Fisher noticed that the airplane had not yet started to turn. He gave the pilots another heading, farther to the left, and cleared them down to 5,000 feet.
Aboard the airplane Hazen acknowledged the new heading but misheard the altitude assignment. It didn't matter. Flight 592 was burning, and the situation in the cockpit was rapidly getting out of hand. One minute into the emergency the pilots were still tracking away from Miami, and had not begun their return. Hazen said, "Critter five-ninety-two, we need the, ah, closest airport available."
The transmission was garbled or blocked, or Fisher was distracted by competing voices within the radar room. For whatever reason, he did not hear Hazen's request. When investigators later asked him if in retrospect he would have done anything differently, he admitted that he kept asking himself the same question. Even without hearing Hazen's request he might have suggested some slightly closer airport. But given that the flight's position was only twenty-five miles to the northwest, Miami still seemed like the best choice, because of the emergency equipment there. In any case "Miami" was the request he had heard, and he intended to deliver it.
To Hazen he said, "Critter five-ninety-two, they're gonna be standing, standing by for you." He meant the crash crews at Miami. "You can plan Runway One-two. When able, direct to Dolphin now."
Hazen said, "... need radar vectors." His transmission was garbled by loud background noises. Fisher thought he sounded "shaky."
Fisher answered, "Critter five-ninety-two, turn left heading one-four-zero."
Hazen said, "One-four-zero." It was his last coherent response.
The flight had only now begun to move through a gradual left turn. Fisher watched the target on his screen as it tracked through the heading changes: the turn tightened and then slowed again. With each sweep of the radar beam the altitude readouts showed a gradual descent—8,800, 8,500, 8,100. Two minutes into the crisis Fisher said, "Critter five-ninety-two, keep the turn around, heading ah one-two-zero."
Flight 592 may have tried to respond—someone keyed a microphone without talking.
Fisher said, "Critter five-ninety-two, contact Miami Approach on—correction, no, you just keep on my frequency."
Two and a half minutes had gone by. It was 2:13 P.M. The airplane was passing through 7,500 feet when suddenly it tightened the left turn and entered a steep dive. Fisher's radar showed the turn and an altitude readout of XXX—code for such a rapid altitude change that the computer cannot keep up. Investigators later calculated that the airplane rolled to a sixty-degree left bank and dove 6,400 feet in thirty-two seconds. During that loss of control Fisher radioed mechanically, "Critter five-ninety-two, you can, ah, turn left, heading one-zero-zero, and join the Runway One-two localizer at Miami." He also radioed, "Critter five-ninety-two, descend and maintain three thousand."
Then the incredible happened. The airplane rolled wings-level again and pulled sharply out of its dive. It is highly unlikely that the airplane would have done this on its own. It is possible that the autopilot kicked in, or that one of the pilots, having been incapacitated by smoke or defeated by melting control cables, somehow momentarily regained control. Fisher watched the radar target straighten toward the southeast, and again read out a nearly level altitude—now, however, merely a thousand feet. The airplane's speed was almost 500 miles an hour.
The frequency crackled with another unintelligible transmission. Shocked into the realization that the airplane would be unable to make Miami, Fisher said, "Critter five-ninety-two, Opa-Locka Airport's about ah twelve o'clock at fifteen miles."
Walton Little, in his bass boat, spotted the airplane then, as it rolled steeply to the right. The radar, too, noticed that last quick turn toward the south, just before the final nose-over. On the next sweep of the radar the flight's data block went into "coast" on Fisher's screen, indicating that contact had been lost. The supervisor marked the spot electronically and launched rescue procedures.
Fisher continued to work the other airplanes in his sector. Five minutes after the impact another low-paid pilot, this one for American Eagle, radioed, "Ah, how did Critter make out?" Fisher didn't answer.
IT was known from the start that fire took the airplane down. The federal investigation began within hours, with the arrival that evening of a National Transportation Safety Board team from Washington. The investigators set up shop in an airport hotel, which they began to refer to as the "command post." The language is important. As we will see, similar forms of linguistic stiffness, specifically engineerspeak, ultimately proved to have been involved in the downing of Flight 592—and this is a factor that the NTSB investigators, because of their own verbal awkwardness, have been unable quite to recognize.
It is not reasonable to blame them for this, though. The NTSB is a technical agency, staffed by technicians, which occupies a central position in the stilted world of aviation. Its job is to examine important accidents and to issue nonbinding safety recommendations—opinions, really—to industry and government. Because the investigators have no regulatory authority and must rely on persuasion to influence events, it may at times be necessary for them to use official-sounding language. Even among its opponents, who often feel that its recommendations are impractical, the NTSB has a reputation for technical competence. The NTSB is a piece of engineering done right. In a world built on compromise, it manages to play the old-fashioned, unambiguous role of the public's defender.
The press plays a more difficult role, though one equally important to the public's safety. It has a classically symbiotic relationship with the NTSB, relying on the investigators for information while providing them with their only effective voice. Nonetheless, in the time of crisis immediately after an accident, a tension exists between the two. Working under pressure to get the story out, reporters resent the caution of the investigators and their reluctance to speculate anonymously. Working under pressure to get the story right, investigators, for their part, resent the reporters' incessant demands during the difficult first days of an accident probe—the recovery of human remains and airplane parts. By the time I got to Miami, nineteen hours after Flight 592 hit the swamp, the two camps had assumed their habitual positions and were passing each other warily in the hotel lobby.
Twenty miles to the northwest, deep in the Everglades, the recovery operation was already under way. The NTSB had set up a staging area—a "forward ops base," one official called it—beside the Tamiami Trail, a two-lane highway that traverses the watery grasslands of southern Florida. Within two days this staging area blossomed into a chaotic encampment of excited officials—local, state, and federal—with their tents and air-conditioned trailers, their helicopters, their cars and flashing lights. I quit counting the agencies. The NTSB had politely excluded most of them from the actual accident site, which lay seven miles north, along a narrow levee road.
The press was excluded even from the staging area, but was provided with two news conferences a day, during which investigators cautiously doled out tidbits of information. One NTSB official said to me, "We've got to feed them or we'll lose control." But the reporters were well behaved, and if anything a bit overcivilized. Near the staging area they settled into their own little town of television trucks, tents, and lawn chairs. The location gave them good Everglades backdrops and shots of alligators swimming by; the viewing public could not have guessed that they stood so far from the action. They acted impatient, but in truth this was not a bad assignment; at its peak their little town boasted pay phones and pizza delivery.
Maybe it was because of my obvious lack of deadline that the investigators made an exception in my case. They slipped me into the front seat of a Florida Game and Fish helicopter whose pilot, in a fraternal gesture, invited me to take the controls for the run out to the crash site. From the staging area we skimmed north across the swamped grasslands, loosely following the levee road, before swinging wide to circle over the impact zone—a new pond defined by a ring of turned mud and surrounded by a larger area of grass and water and accident debris. Searchers in white protective suits waded side by side through the muck, piling pieces of people and airplane into flat-bottomed boats. It was hot and unpleasant work performed in a contained little hell, a place that one investigator later described to me as reeking of fuel, earth, and rotting flesh—the special smell of an airplane accident. We descended onto the levee, about 300 yards away from the crash site, where an American flag and a few tents and trucks constituted the recovery base.
The mood there was quiet and purposeful, with no sign among the workers of the emotional trauma that officials had been worriedly predicting since the operation began. The workers on break sat in the shade of an awning, sipping cold drinks and chatting. They were policemen and firemen, not heroes but straightforward guys accustomed to confronting death. Not knowing who I was, they spoke to me frankly about the gruesome details of their work, and made indelicate jokes, but they seemed more worried about dehydration than about "taking the job home" or losing sleep. I relaxed in their company, relieved to have escaped for a while the expectation of grief.
It was, of course, a somber place to be. Human remains lay bagged in a refrigerated truck for later transport to the morgue. A decontamination crew washed down torn and twisted pieces of airplane, none longer than several feet. Investigators tagged the most promising wreckage, to be trucked immediately to a hangar at an outlying Miami airport, where specialists could study it. Farther down the levee I came upon a soiled photograph of a young woman with a small-town face and a head of teased hair. A white-suited crew arrived on an airboat and clambered up the embankment to be washed down. Another crew set off. A boatload of muddy wreckage arrived. The next day the families of the dead came on buses, and laid flowers and cried. Pieces of the airplane kept being hauled up for nearly another month.
Much was made of this recovery, which—prior to the offshore retrieval of TWA's Flight 800—the NTSB called the most challenging in its history. It is true that the swamp made the search slow and difficult, and that the violence of the impact meant that meticulous work was required to reconstruct the critical forward cargo hold. However, it is also true that the physical part of the investigation served to confirm what a look at a shipping ticket had already suggested—that ValuJet Flight 592 burned and crashed not because the airplane failed but, in large part, because the airline did.
To me as a pilot, the most impressive aspect of the investigation was the speed with which it worked through the false pursuit of an electrical fire—an explanation supported by my own experiences in flight, and all the more plausible here because the ValuJet DC-9 was old and had experienced a variety of electrical failures earlier the same day, including a tripped circuit breaker that had resisted the attentions of a mechanic in Atlanta, and then mysteriously had fixed itself. I was impressed also by the instincts of the reporters, who for all their technical ignorance seized on the news that Flight 592 had been loaded with a potentially dangerous cargo of chemical oxygen generators—more than a hundred little firebombs that could have caused this accident, and that indeed did.
Flight 592 crashed on a Saturday afternoon. By Sunday the recovery teams were pulling up scorched and soot-stained pieces. On Monday a searcher happened to step on the flight-data recorder, one of two required black boxes meant to help with accident investigations. The NTSB took the recorder to its Washington laboratory and found that a blip in the flight data six minutes after Flight 592's takeoff seemed to indicate a momentary rise in air pressure. Immediately afterward the recorder began to fail intermittently, apparently because of electrical-power interruptions. On Tuesday night, at a press conference at the hotel, Robert Francis, the vice-chairman of the NTSB and the senior official on the scene, announced in a monotone, "There could have been an explosion." A hazardous-materials team would be joining the investigation. The investigation was focusing on the airplane's forward cargo hold, which was located just below and behind the cockpit, and was unequipped with fire detection and extinguishing systems. Routine paperwork indicated that the Miami ground crew had loaded the hold with homeward-bound ValuJet "company material," a witch's brew of three tires—at least two of them mounted—and five cardboard boxes of old oxygen generators.