Deactivation of the autopilot turned on a cockpit light (which was missed by the pilots), but more important, the pilot was trapped in a fantasy world in which he encouraged his children to turn the wheel this way and that and then to believe that this had an effect, while in fact the plane was (supposed to be) on autopilot. When his son actually controlled movements, the pilot was slow to realize this was no fantasy; indeed, his son was the first to point out that the plane was actually turning on its own (due to forces unleashed by Eldar’s turning motions), but the plane then quickly banked at such an angle as to force everyone against their seats and the wall so that the pilot could not wrest control of the plane from his son. After a harrowing vertical ascent, the copilot and Eldar managed to get the plane in a nosedive, which permitted control to be reestablished, but alas it was too late. The plane hurtled to the ground, losing all seventy-five aboard. Besides disobeying all standard rules for cockpit behavior, the pilot appeared blissfully unaware that he was doing this high in the air and was becoming trapped in the very fantasy he had created for his children. Of course, it is easy for adults to underestimate the special ability of children to seize control of electromechanical devices.
SIMPLE PILOT ERROR—OR PILOT FATIGUE?
We now turn to self-deception at higher levels of organization—within corporations or society at large—that impede airline safety. That is, pilot error is compounded by higher-level error. For example, the major cause of fatal airline crashes is said to be pilot error—about 80 percent of all accidents in both 2004 and 2005. This is surely an overestimate, as airlines benefit from high ones. Still, evidence of pilot error is hardly lacking and is usually one of several factors in crashes. We do not know how much of this error is entrained by self-deception, but a common factor in pilot error is one we have already identified: overconfidence combined with unconsciousness of the danger at hand. Certainly this combination appears to have doomed John F. Kennedy Jr. (and his two companions) when he set out on a flight his experienced copilot was unwilling to take—into the gray, dangerous northeastern fog in which a pilot can easily become disoriented, mistake up for down, lose control, and enter a death spiral.
Consider a commercial example, documented by the flight recorder. On a cloudy day in October 2004 at 7:37 in the evening, a twin-engine turboprop approaching the airport at Kirksville, Missouri, was descending too low, too fast, though the pilots could not see the runway lights until they were below three hundred feet and soon were on top of trees. Both pilots and eleven of the thirteen passengers died in the crash. Below ten thousand feet, FAA rules require a so-called sterile cockpit, in which only pertinent communication is permitted, yet both pilots were sharing jokes and cursing frequently below this altitude. They discussed coworkers they did not like and how nice it would be to eat a Philly cheesesteak, but they did not attend to the usual rules regarding rate and timing of descent or to the plane’s warning system alerting them to the rapidly approaching ground below.
Of course, the usual human bias toward self-enhancement makes this negligence more likely: “rules that apply to the average pilot do not apply to better ones, such as me.” The pilot, whose job in this situation was to watch the instruments, said it was all right to descend because he could see the ground. The copilot—whose job was to look for the runway—said he could not see a thing, but he did not challenge the pilot, as rules required him to do. The pilot kept descending as if he could see the runway when he probably saw nothing at all until finally he spotted the landing lights and then immediately the tops of trees. Here we see familiar themes from the crash of Air Florida Flight 90: the irrelevant and distracting talk during takeoff in the first case and landing in this one, pilot overconfidence prevailing over the more reality-oriented but deferential copilot, and the pilot’s failure to read instruments, as was his duty.
It should be mentioned that the pilots could be heard yawning during their descent, and they had spent fourteen hours on the job, after modest sleep. This was their sixth landing that day. Had they followed proper procedure, they still should have been able to land safely, but surely fatigue contributed to their failure to follow procedure, as well as to their degree of unconscious neglect of the risks they were taking.
Now here comes the intervention of self-deception at the next level. In response to this crash, the NTSB recommended that the FAA tighten its work rules for pilots by requiring more rest time, the second time it had done so in twelve years, because the FAA did not act on the first recommendation. In response to this crash, the airline industry, represented by its lobbying organization, the Air Transport Association, argued that this was an isolated incident that did not require change in FAA rules. (If accidents were not isolated incidents, we would not get on airplanes.) “The current FAA rules . . . ensure a safe environment for our crews and the flying public.” Of course, they do no such thing: they save the airlines money by requiring fewer flight crews. And note the cute form of the wording “our crews” comes first—we would hardly subject our own people to something dangerous—followed by reducing everyone else to “the flying public.” But neither management nor lobbyists are part of the flight crew, and predictably, the Airline Pilots Association backed the rule change. True to form, in March 2009, seven airlines sued in federal court to overturn a recent FAA rule that imposed forty-eight-hour rest periods between twenty-hour flights (e.g., Newark to Hong Kong), a decision that followed earlier pioneering work by Delta Airlines to institute the rule and to provide proper sleeping quarters for the pilots during their nearly daylong flight. The fiction is that the FAA represents the so-called flying public; the truth is that it represents the financial interests of the airlines and represents the general public only reluctantly and in response to repeated failures.
ICE OVERPOWERS THE PILOTS; AIRLINES OVERPOWER THE FAA
Ice poses a special problem for airplanes. Ice buildup on the wings increases the plane’s weight while changing the pattern of airflow over both the main wings and the small rear control wings. This reduces lift and in some cases results in rapid loss of control, signaled by a sudden pitch and a sharp roll to one side. The controls move on their own, sometimes overpowering counterefforts by the pilots. Commuter planes are especially vulnerable because they commonly fly at lower altitudes, such as ten thousand feet, at which drizzling ice is more common. When icing results in loss of control, the plane turns over and heads straight to the ground.
To take an example, on October 31, 1994, American Eagle Flight 4184 from Indianapolis had been holding at ten thousand feet in a cold drizzle for thirty-two minutes with its de-icing boot raised (to break some of the ice above it), when it was cleared by Chicago air traffic controllers to descend to eight thousand feet in preparation for landing. Unknown to the pilots, a dangerous ridge of ice had built up on the wings, probably just behind the de-icing boot, so that as the pilots dipped down, they almost immediately lost control. The plane’s controls moved on their own but on the right wing only, immediately tilting the plane almost perpendicular to the ground. The pilots managed to partly reverse the roll before the (top-heavy) plane flipped upside down and hit the ground at a 45-degree angle in a violent impact that left few recognizable pieces, including any of the sixty-eight people aboard.
This was an accident that did not need to happen. This kind of airplane (ATR 42 or 72 turboprops) had a long history of alarming behavior under icing conditions, including twenty near-fatal losses of control under icing conditions and one crash in the Alps in 1987 that killed thirty-seven people. Yet the problem kept recurring because safety recommendations were met by strong resistance from the airlines—which would have to pay for the necessary design changes—and the FAA ended up acting like a biased referee, approving relatively inexpensive patches that probably reduced (at least slightly) the chance of another crash but did not deal with the problem directly. As one expert put it, “Until the blood gets deep enough, there is a tendency to ignore a problem or live with it.” To wait until
after a crash to institute even modest safety improvements is known as tombstone technology. The regulators and airline executives are, in effect, conscious of the personal cost—immediate cost to the airlines in mandated repairs and bureaucratic cost to any regulator seen as unfriendly to the airlines—while being unconscious of the cost to passengers.
In the United States, the NTSB analyzes the causes of an airline disaster, relying on a series of objective data, cockpit and flight recorders, damage to aircraft, etc., to determine cause and then makes obvious recommendations. The theory is that this relatively modest investment in safety will pay for itself in future airplane design and pilot training to minimize accidents. In reality, everything works fine until the recommendation stage, when economic interests intervene to thwart the process. This is well demonstrated by the FAA’s inability to respond appropriately to the problem of ice buildup on smaller, commuter airplanes, a problem well known for more than twenty years yet claiming a new set of lives about every eight years, most recently on February 13, 2009, in Buffalo, New York, leaving fifty dead.
A deeper problem within the FAA was its unwillingness to reconsider basic standards for flying under icing conditions, as indeed had been requested by the pilots’ union. The FAA based its position on work done in the 1940s that had concluded that the chief problem was tiny droplets, not freezing rain (larger droplets), but science did not stop in the ’40s, and there was now plenty of evidence that freezing rain could be a serious problem. But this is one of the most difficult changes to make: to change one’s underlying system of analysis and logic. This could lead to wholesale redesign at considerable cost to—whom?—the airlines. So it was patchwork all the way around. There is also an analogy here to the individual. The deeper changes are the more threatening because they are more costly. They require more of our internal anatomy, behavior, and logic to be changed, which surely requires resources, may be experienced as painful, and comes at a cost.
The very symbol of a patch-up approach to safety is the fix the FAA approved for the well-proven habit of these planes in freezing ice to start to flip over. The fix was a credit-card-size piece of metal to be attached to each wing of a several-ton airplane (not counting passengers—or ice). This tiny piece of metal allegedly would alter airflow over the wings so as to give extra stability. No wonder the pilots’ union (representing those at greatest risk) characterized this as a Band-Aid fix and pointed out (correctly) that the FAA had “not gone far enough in assuring that the aircrafts can be operated safely under all conditions.” The union went on to say that the ATR airplanes had an “unorthodox, ill-conceived and inadequately designed” de-icing system. This was brushed aside by the FAA, a full six years before the Indiana crash, in which the airplane was fully outfitted with the FAA-approved credit-card-size stabilizers.
By the way, to outfit the entire US fleet of commuter turboprops with ice boots twice as large as before the Indiana crash would cost about $2 million. To appreciate how absurdly low this cost is, imagine simply dividing it by the number of paying customers on the ill-fated Indianapolis-to-Chicago trip and asking each customer in midair, “Would you be willing to spend $50,000 to outfit the entire American fleet of similar planes with the larger boot, or would you rather die within the next hour?” But this is not how the public-goods game works. The passengers on the Chicago flight do not know it is their flight out of 100,000 that will go down. Rather, the passengers know they have a 0.99999 chance of being perfectly safe even if they do nothing. Let someone else pay. Even so, I bet everyone would get busy figuring out how to raise the full amount. I certainly would. Of course, if each passenger only had to help install the boots on his or her own plane, about $300 per passenger would suffice. The point is that for trivial sums of money, the airlines routinely put passengers at risk. Of course, they can’t put it this way, so they generate assertions and “evidence” by the bushel to argue that all is well, indeed that every reasonable safety precaution is being taken. Six years before this crash, British scientists measured airflow over icy wings and warned that it tended to put the craft at risk, but these findings were vehemently derided as being wholly unscientific, even though they were confirmed exactly by the NTSB analysis of the Indianapolis–Chicago crash.
Finally, a series of trivial devices were installed in the cockpit and new procedures were mandated for pilot behavior. For example, a device giving earlier warning of icing was installed and pilots were told not to fly with autopilot when this light is on, precisely to avoid being surprised by a sudden roll to one side as the autopilot disengages. But of course this does not address the problem of loss of control under icing. From the very first Italian crash over the Alps, when one of the pilots lashed out at the control system that failed to respond to his efforts with an ancient curse on the system’s designers and their ancestors, it has been known that conscious effort to maintain control is not sufficient. And of course, pilots may make matters worse for themselves in a bad situation. In the Buffalo crash, the pilots apparently made a couple of errors, including keeping the plane on autopilot when they lowered their landing gear and deployed the flaps that increase lift. Suddenly there was a severe pitch and roll, suggestive of ice, which in fact had built up on both the wings and the windshield, blocking sight. Although the NTSB attributed the crash to pilot error, the fact that ice had built up, followed by the familiar pitch and roll, suggests a poorly designed airplane as well.
In short, a system has developed in which the pilot may make no errors—and yet the plane can still spin out of control. It is ironic, to say the least, that a basic design problem that deprives a pilot of control of the airplane is being solved by repeatedly refining the pilot’s behavior in response to this fatal design flaw. A pilot’s failure to do any of the required moves, for example, disengage autopilot, will then be cited as the cause. No problem with the airplane; it’s the pilot! But is this not a general point regarding self-deception? In pursuing a path of denial and minimization, the FAA traps itself in a world in which each successive recommendation concerns more and more pilot behavior than actual aircraft design changes. Thus does self-deception lay the foundations for disaster.
Consider an international example.
THE US APPROACH TO SAFETY HELPS CAUSE 9/11
The tragedy of 9/11 had many fathers. But few have been as consistent in this role as the airlines themselves, at least in preventing the actual aircraft takeovers on which the disaster was based. This is typical of US industrial policy: any proposed safety change comes with an immediate threat of bankruptcy. Thus, the automobile industry claimed that seat belts would bankrupt them, followed by airbags, then child-safety door latches, and whatnot. The airline’s lobbying organization, the Air Transport Association, has a long and distinguished record of opposing almost all improvements in security, especially if the airlines have to pay for them. From 1996 to 2000 alone, the association spent $70 million opposing a variety of sensible (and inexpensive) measures, such as matching passengers with bags (routine in Europe at the time) or improving security checks of airline workers. They opposed reinforced cabin doors and even the presence of occasional marshals (since the marshals would occupy nonpaying seats). It was common knowledge that the vital role of airport screening was performed poorly by people paid at McDonald’s wages—but without their training—yet airlines spent millions fighting any change in the security status quo. Of course, a calamity such as 9/11 could have severe economic effects as people en masse avoided a manifestly dangerous mode of travel, but the airlines merely turned around and beseeched the government for emergency aid, which they got.
It seems likely that much of this is done “in good conscience,” that is, the lobbyists and airline executives easily convince themselves that safety is not being compromised to any measurable degree, because otherwise they would have to live with the knowledge that they were willing to kill other people in the pursuit of profit. From an outsider’s viewpoint this is, of course, exactly what they are doin
g. The key fact is that there is an economic incentive to obscure the truth from others—and simultaneously from self.
Only four years after 9/11, the airlines were loudly protesting legislation that would increase a federal security fee from $2.50 to $5.50, despite numerous surveys showing that people would happily pay $3 more per flight to enhance security. Here the airlines did not pay directly but feared only the indirect adverse effects of this trivial price increase. Note that corporate titans appear to slightly increase their own chances of death to hoard money, but with the increasing use of corporate jets, even this is not certain.
We see again patterns of deceit and self-deception at the institutional and group levels that presumably also entrain individual self-deception within the groups. Powerful economic interests—the airlines—prevent safety improvements of vital importance to a larger economic unit, the “flying public,” but this unit is not acting as a unit. The pilots have their own organization and so of course do the (individually) powerful airlines, but the flying public exerts its effects one by one, in choice of airline, class of travel, destination, and so on—not in the relative safety of the flight, about which the public typically knows nothing. The theory is that the government will act on their behalf. Of course, as we have seen, it does not. Individuals within two entities should be tempted to self-deception—within the airlines that argue strenuously for continuation of their defective products and within the FAA, which, lacking a direct economic self-interest, is co-opted by the superior power of the airlines and acts as their rationalizing agent. In the case of NASA, those who sell space capsules to the public and to themselves never actually ride in them.
The Folly of Fools: The Logic of Deceit and Self-Deception in Human Life Page 23