Aloft

by William Langewiesche

  What makes this fight peculiar is the coding which allows it to be waged invisibly. Practically everything about air traffic control – whether it emanates from the controllers, their managers, or the airlines – now has a private as well as a public meaning. For instance, a proposed new arrangement called ‘free flight’ would give pilots more freedom to pick their own routes and more cockpit technology to do it safely, with less guidance from controllers. ‘Free flight’ may mean ‘smart technology’ and ‘progressive thinking’ to outsiders – and it probably would increase the capacity of the sky – but it means something quite different to hard-pressed controllers. To them, it is a policy so obviously irrelevant to the bottlenecks on final approach, which greater pilot freedom can only make harder to manage, that it must be interpreted as a coded taunt about the value of controllers and a mean-spirited (if empty) threat about their future. Even when new policies make sense – like the recent systemwide elimination of obsolete flight restrictions, or the reintroduction of inflight holding pools as a way of deriving maximum efficiency from the final approaches – they are interpreted as personal assaults on the working men and women. The controllers fight back through alarmist ‘equipment failure’ articles in the press and through careful cultivation of the safety myth – a tactic especially galling to the managers because of their own lack of credibility with reporters.

  The managers like to reassure themselves that many controllers have not joined the union and that at certain Sunbelt facilities nonunion controllers still constitute more than half of the work force. But that hardly means that those controllers have taken their side. The angry Californian who wrote to me had feelings against the union nearly as strong as those against the FAA headquarters. As I sat beside him one evening at his radar screen, he said, ‘We made a big mistake when we let in the AFL-CIO. Look at these guys around you, look at their attitude, look how they’re dressed. Where’s their professionalism? A “safety issue” for them is a tripping hazard on the stairs. The problem is, labor unions represent laborers.’

  He glumly watched the airplanes moving across his screen. ‘But you want to know the real problem? Go outside and look how empty the parking lot is after 5:00. Do you remember how full it was this afternoon? What were all those people doing today? They can prove in triplicate that the system works. So what? I’ve gotten so I’m just running out my time. Give me a year and I’ll be retired in Florida. I never thought I’d say it, but I’ll wish the union well.’

  When I asked another nonunion controller, at the Fort Worth Center, about the low rate of union participation in Texas, he said, ‘It’s simple. We can afford to watch and wait. It’s the big dog theory. Everybody knows it. How goes the Northeast, so goes the country.’

  And how goes New York, so goes the Northeast.

  Also hotly contested is the use of Flow Control, a command facility with formal responsibility for the hour-by-hour functioning of the national system and the power to intervene. Flow Control originally achieved prominence as a rational response to the 1981 strike, enabling a small team at the FAA headquarters, when necessary, to delay takeoffs across the nation in order to keep the reduced staffs at the busiest destinations from being overwhelmed. It was meant to be a fraternal player, the controllers’ friend and adviser. Since then, however, it has turned into something quite the opposite. Based in a futuristic radar room near Dulles Airport, it has become a master center with electronic vision that sees every airplane in the system and the authority to question and, in some circumstances, to countermand decisions made by individual controllers. Though it still initiates the departure holds which frustrate pilots and passengers, and though inevitably it miscalculates, causing needless delays, it now sees its mission largely in opposition to the individual control facilities – to keep as many airplanes in the air as possible and maintain pressure on the final approaches. The problem is not simply that controllers and Flow Control often now work at cross purposes; there is also the matter of symbolism. Flow Control has inserted teams into all the regional facilities – specialists who dress better than controllers and work under more relaxed conditions, sometimes from raised islands at the center of the control room floors. Those who say that Flow is just another bureaucratic empire have vastly underestimated it: Whatever its impact on air traffic, it is also Headquarters’ greatest hope, free flight’s natural companion, a Big Brother with the ability to identify recalcitrant controllers and the authority to intervene and fight back against them. The controllers’ union would like nothing more than to break into Flow Control. So far it has been unable to. Now the angriest controllers accuse the union itself of selling out. It is a dangerous sentiment. A similar escalation preceded the ill-considered strike of 1981, but that experience is well remembered, and no one expects the controllers to make such a mistake again. One reason is that the FAA itself provides them with rules and procedures that, if strictly followed, can snarl traffic nearly as effectively as a strike. But such a rule-book slowdown seems heavy-handed, since possibilities abound for more subtle dissent. Renegade job actions in particular can be as spontaneous and creative as a controller’s best work, and where the air space is already crowded, they require just a delicate lack of cooperation to produce big results.

  With such renegade actions, which have already begun, individual controllers quietly gum up the works. One man described the technique to me this way: ‘Slow down, speed up, slow down. Now turn right, turn left, stay up, go down.’ With one airplane you can create a ripple that will last for hours. You can also require unusually large in-trail spacing, or you can simply put airplanes into holding patterns. The details hardly matter, but what they add up to is sabotage.

  The pilots involved may not be aware of the reasons for their handling, but increasingly they have begun to question their clearances and to express dissatisfaction on the frequency. Civility is slowly disappearing. But from the controllers’ point of view, the beauty of renegade job actions is that they can occur naturally and without premeditation in the political climate of the control rooms, and they are easily deniable, or defensible in the name of safety. The delays they cause are difficult to distinguish from other, ordinary delays. Flow Control can eventually figure out what is happening, and may try to intervene, but usually does so too late. Airline passengers are affected, of course, but that is beside the point.

  Once again, the argument is in code. Renegade slowdowns deliver a clear threat within the agency, yet a threat so technical that it remains invisible to the outside world. The public has been frightened into submission. Neither the union nor the FAA will admit that an invisible war has broken out. Air traffic keeps growing, and everyone fears a loss of control.

  6

  Valujet 592

  On a muggy May afternoon in 1996, an emergency dispatcher in southern Florida got a call from a man on a cellular phone. The caller said, ‘Yes. I am fishing at Everglades Holiday Park, and a large jet aircraft has just crashed out here. Large. Like airliner size.’

  The dispatcher said, ‘Wait a minute. Everglades Park?’

  ‘Everglades Holiday Park along canal L-67. You need to get your choppers in the air. I’m a pilot. I have a GPS. I’ll give you coordinates.’

  ‘Okay sir. What kind of plane did you say? Is it a large plane?’

  ‘A large aircraft similar to a 727 or a umm… I can’t think of it.’

  This lapse was unimportant. The caller was a born accident observer – a computer engineer and private pilot with a pride in his technical competence and a passion for detail. His name was Walton Little. When he first saw the airplane it was banked steeply to the right and flying low, just above the swamp. Later he filed an official report in which he wrote:

  There was no smoke, no strange engine noise, no debris in the air, no dangling materials or control surfaces, no apparent deformation of the airframe, and no areas that appeared to have missing panels or surfaces… Sunlight was shining on the aircraft, and some surfaces were more reflectiv
e than others. I saw a difference in reflection of the wing skin in the area where I would expect the ailerons to be, as though they were not in neutral. In particular, the lower (outboard) portion of the right wing appeared less reflective as though the aileron was deflected upward.

  A couple of nearby fishermen instinctively ducked into their boat for cover, but not Walton Little, who stood on his deck facing ‘about 115 degrees,’ and watched the airplane hit the water. The shock wave passed through his body: ‘I was in disbelief that the crash had occurred. I stood there for just a moment to consider that it really did happen. I was already thinking that I needed to get my cellular phone out of the storage compartment and call 911, but I wanted to assure myself of what I was doing because it is against the law to make false calls to 911.’

  He called within a minute. After reading off his latitude and longitude to the dispatcher, he said, ‘I’m in a bass boat on the canal. I thought it was an aircraft from an air show or something, and—’

  The dispatcher interrupted. ‘What did you… Did you see flames and stuff come up, sir?’

  ‘I heard the impact and I saw dirt and mud fly in the air. The plane was sideways before it went out of my sight on the horizon about a mile from me.’

  ‘Yes sir. Okay. You said it looked like a 727 that went down?’

  ‘Uh, it’s that type aircraft. It has twin engines in the rear. It is larger than an executive jet, like a Learjet.’

  ‘Yes sir.’

  ‘It’s much bigger than that. I won’t tell you it’s a 727, but it’s that type aircraft. No engines on the wing, two engines in the rear. I do not see any smoke, but I saw a tremendous cloud of mud and dirt go into the sky when it hit.’

  ‘Okay sir.’

  ‘It was white with blue trim.’

  ‘White with blue trim, sir?’

  ‘It will not be in one piece.’

  Walton Little was right. The airplane was a twin-engine DC-9 painted the colors of Valujet, an aggressive young discount airline based in Atlanta. When it hit the Everglades, it was banked vertically to the right and pointed nearly straight down. The airplane did not sink mysteriously into the swamp, as reports later suggested, but shattered against it with the full furious force of a fast dive.

  By the time Walton Little felt the shock wave, everyone aboard was dead – the 2 pilots, 3 flight attendants, and 105 passengers. Their remains lay smothered within a shallow, watery crater and the liquid mud and grass that surrounded it. All that marked the surface was a fractured engine, a few dead fish, some jet fuel, and a scattering of personal papers, clothes, and twisted aluminum pieces – the stuff of tragedy. During those first few days some officials worried aloud about the accident’s effect on nature, but the swamp was not so fragile as that and quickly resumed its usual life. The families of those who died have proved less resilient.

  For the rest of us, though, the accident should be finished business. The official investigation ran its complete course, a ‘cause’ was found, contributing factors were acknowledged, and the Federal Aviation Administration wrote new regulations. Editorialists expressed their outrage, and individuals were held responsible. After a long suspension, Valujet returned to flight with a renewed commitment to safety. Other airlines promised to be more careful, too. And even the FAA went through a house-cleaning. By conventional standards, therefore, the reaction to the tragedy was admirable. And yes, we know anyway that flying is safe, that we are a winged species now, that the sky is ours for the taking. Certainly my own experience is that passengers do not need to cower around the exit rows, or carry emergency ‘smoke hoods,’ or avoid certain airlines and airplanes, or fear bad weather, or worry about some impending collapse of airline safety. Those are assertions made by aviation illiterates – the overly cautious people who can always gain an audience and who would smother us in their fear of violent death. The public, now a flying public, has the sense in the long run to ignore them. Nonetheless, the Valujet accident continues years later to raise a series of troubling questions – no longer about what happened but about why it happened and what is to keep similar accidents from happening again. As these questions lead into the complicated and human core of flight safety, they become increasingly difficult to answer.

  Consider for simplicity that there are only three kinds of airplane accidents. The most common ones you might call ‘procedural.’ They are those old-fashioned accidents which result from single obvious mistakes, which can be immediately understood in simple terms, and which lead to simple resolutions. For pilots – do not fly into violent thunderstorms, or take off with ice on your wings, or descend prematurely, or let fear or boredom gain the upper hand. Do not make the mistake of trusting your sense of balance, or of feeling too at home in the sky. Mechanics, ramp agents, and air traffic controllers must observe equally simple rules. As practitioners, we have together learned many such painful lessons.

  The second sort of accident could be called ‘engineered.’ It consists of those surprising material failures which should have been predicted by designers or discovered by test pilots but were not. Such failures at first defy understanding, but ultimately they submit to examination and result in tangible solutions. The American Eagle ATR turboprop dives into a frozen field in Roselawn, Indiana, because its deicing boots did not protect its wings from freezing rain – and as a result, new boots are designed and the entire testing process undergoes review. The USAir Boeing 737 crashes near Pittsburgh because of a rare hard-over rudder movement – and as a result a redesigned rudder control mechanism is installed on the whole fleet. The TWA Boeing 747 blows apart off New York because (whatever the source of ignition) the empty center tank contained an explosive mixture of fuel and air – and as a result explosive mixtures might in the future be avoided. Such tragic failures may seem all too familiar, but in fact they are rare, and they will grow rarer still as aeronautical engineering improves. You can regret the lives lost, and deplore the slowness with which officials respond, but in the long run there is reason to be optimistic. Our science will prevail.

  But the Valujet accident is different. It represents the third and most elusive kind of disaster, a type of ‘system accident’ which lies beyond the reach of conventional solution and which a small group of thinkers inspired by Yale sociologist Charles Perrow has been exploring elsewhere – in power generation, chemical manufacturing, nuclear weapons control, and space flight. Perrow has coined the more loaded term ‘normal accident’ for such disasters because he believes they are normal for our time. His point is that these accidents are science’s illegitimate children, bastards born of the confusion that lies within the complex organizations with which we manage our dangerous technologies. Perrow does not know much about airline flying – and what he says about it he often gets wrong – but his thinking applies to it nonetheless. In this case, the organization includes not only Valujet, the archetype of new-style airlines, but also the contractors who serve it, the government agencies that despite economic deregulation are expected to oversee it, and even the press and Congress, who also play important roles. Taken as a whole, the airline system is complex indeed.

  It is also competitive, and if one of its purposes is to make money, the other is to move the public through thin air cheaply and at high speed. Safety is never first, nor can it be, but for obvious reasons it is a necessary companion to the venture. Risk is a companion, too, but on the everyday level of practical compromises and small decisions – the building blocks of this ambitious enterprise – the view of risk is usually obscured. The people involved do not consciously trade safety for money or convenience, but inevitably they do make a lot of bad little choices. They get away with those choices because, as Charles Perrow mentioned to me, Murphy’s Law is wrong – what can go wrong usually goes right. But then one day, a few of the bad little choices combine, and circumstances take an airplane down. Who then really is to blame?

  We can find fault among those directly involved – and we probably need to. But if
our purpose is to attack the roots of such an accident, we may find them so entwined with the system that they are impossible to extract without bringing the whole structure down. The study of system accidents acts either to radicalize people or to force them to speak frankly. It requires most of us to admit that we do put a price on human life, and that the price, though incalculable, is probably not very high. In the case of Valujet it faces us with the possibility that we have come to depend on flight, that nothing we are willing to do can stop the occasional sacrifice, and that therefore we are all complicitous. Beyond such questions of blame, it requires us to consider the possibility that our solutions, by adding to the complexity and obscurity of the airline business, may actually increase the risk of accidents. System accident thinking does not demand that we accept our fate without a struggle, but it serves as an important caution.

  The distinction between the three types of accidents – procedural, engineered, and system – is of course not absolute. Most accidents have a bit of all three to them. And even in the most extreme cases of system failure, the post-crash investigation has to work its way forward conventionally, usefully identifying those problems which can be fixed, before the remaining questions begin to force a still deeper examination. That was certainly the way with Valujet Flight 592.

  It was headed from Miami to Atlanta, flown by Captain Candalyn Kubeck, age thirty-five, and her copilot Richard Hazen, age fifty-two. They represented the new generation of pilots, experienced not only in the cockpit but in the rough-and-tumble of the deregulated airline industry, where each had held a slew of low-paid flying jobs before settling on Valujet. It was no shock to them that Valujet was a nonunion operation or that it required them to pay for their own training. With 9,000 flight hours, over 2,000 in the DC-9, Candalyn Kubeck now earned what the free market said she was worth, about $40,000 a year, plus bonuses; her copilot Richard Hazen, ex-Air Force and with similar experience, earned about half as much. Valujet executives had convinced themselves that the low pay had a positive effect – that it allowed them to employ ‘real pilots’ who just wanted to fly.