Aloft
Page 18
Your responsibility in recognizing hazardous materials is dependent on your ability to: 1. Be Alert! 2. Take time to ask questions! 3. Look for labels… Ramp agents should be alert whenever handling luggage or boxes. Any item that might be considered hazardous should be brought to the attention of your supervisor or pilot, and brought to the immediate attention of Flight Control and, if required, the FAA. REMEMBER: SAFETY OF PASSENGERS AND FELLOW EMPLOYEES DEPENDS ON YOU!
It is possible that the ramp agent was lulled by the company-material labels. Would the Sabretech workers, aviation insiders, ship him a hazardous cargo of his own material without letting him know? His conversation with the copilot, Richard Hazen, about the weight of the load may have lulled him as well. Hazen, too, had been formally trained to spot hazardous materials, and he would have understood better than the ramp agent the dangerous nature of oxygen canisters, but he said nothing. It was a routine moment in a routine day. The morning’s pesky electrical problems had perhaps been resolved. The crew was calmly and rationally preparing the airplane for the next flight. As a result, the passengers’ last line of defense folded.
What are we to make of this tangle of circumstance and error? One suspicion is that its causes may lie in the market forces of a deregulated airline industry and that in order to keep such accidents from happening again we might consider the possibility of re-regulation – a return to the old system of limited competition, union work forces, higher salaries, and expensive tickets. There are calls, of course, to do just that. The improvement in safety would come from slowing things down and allowing a few anointed airlines the leisure to discover their mistakes and to act on them. The effects on society, however, would be inflationary and anti-egalitarian – a return to a constricted system that most people could not afford to use. Moreover, aviation history would argue against it. Despite the obvious chaos of the business and the apparent regularity of airline accidents, air travel has become safer under deregulation. Much of that improvement comes from technical advances that would have occurred anyway – those that have resulted in the continued reduction of ‘procedural’ and ‘engineered’ accidents.
The other way to regulate the airline industry is not economic but operational – detailed governmental oversight of all the technical aspects of flight. This is the approach we have taken since the birth of the airlines in the 1920s, and it is what we expect of the FAA today. Strictly applied standards are all the more important in a free market, in which unchecked competition would eventually force the airlines to cut costs to the point of operating unsafely, until accidents forced each in turn out of business. An airline should not overload its airplanes or fly them with worn-out parts, but it also cannot compete effectively against other airlines that do. Day to day, airline executives may resent the intrusion of government, but in their more reflective moments they must also realize that they need this regulation in order to survive. The friendship that has grown up between the two sides – between the regulators and the regulated – is an expression of this fact which no amount of self-reform at the FAA can change. When after the Valujet crash David Hinson of the FAA reacted to accusations of cronyism by going to Congress and humbly requesting that the agency’s ‘dual mandate’ be eliminated, so that it would no longer be required by law to promote the airlines, he was engaged in a particularly hollow form of political theater.
The critics had real points to make. The FAA had become too worried about the reactions of its friends in the airline industry, and it needed to try harder to enforce the existing regulations. Perhaps it needed even to write some new regulations. And like NASA before, it needed to listen to the opinions and worries of its own lower-level employees. But there are limits to all this, too. The dream of a zero-accident future is about as realistic as the old Valujet promise to put safety first. When at a post-crash press conference in Miami a reporter asked Robert Francis of the NTSB, ‘Shouldn’t the government protect us against this kind of thing?’ the honest answer would have been, ‘It cannot, and never will.’
The truth helps because in our frustration with such accidents we are tempted to invent solutions that, by adding to the obscurity and complexity of the system, may aggravate just those characteristics which led to the accidents in the first place. This argument for a theoretical point of diminishing safety is a central part of Perrow’s thinking, and it seems to be borne out in practice. In his exploration of the North American early warning system, Sagan found that it was failures of safeties and redundancies that gave the most dangerous false indications of missile attack – the kind that could have triggered a response. The radiation accidents at both the Chernobyl and the Three Mile Island power plants were induced by failures in the safety systems. Remember also that the Valujet oxygen generators were safety devices, that they were redundant, and that they were removed from the MD-80s because of regulations limiting their useful lives. This is not an argument against such devices but a reminder that elaboration comes at a price.
Human reactions add to the problem. Administrators can think up impressive chains of command and control and impose complex double-checks and procedures on an operating system, and they can load the structure with redundancies, but there comes a point – in the privacy of a cockpit or a hangar or an office or a house – beyond which people will rebel. These rebellions are commonplace, and they result in unpredictable and apparently arbitrary actions, all the more so because in the modern insecure workplace they remain undeclared. The one thing that always gets done right is the required paperwork.
The paperwork is a necessary and inevitable part of the system, but it, too, introduces dangers. The problem is not just its wastefulness but the deception that it breeds. In the Sabretech hangar the two unfortunate mechanics who signed the lines about the nonexistent safety caps just happened to be the slowest to slip away when the supervisors needed signatures. The other mechanics almost certainly would have signed, too, as did the inspectors. Their good old-fashioned pencil whipping is the most widespread form of Vaughan’s ‘normalization of deviance.’
The fraud they committed was a small part of a much larger deception – the creation of fully formed pretend realities that include unworkable chains of command, unlearnable training programs, unreadable manuals, and the fiction of regulations, checks, and controls. Such pretend realities are familiar to all of us. They extend even into the most self-consciously progressive organizations, with their attempts to formalize informality, deregulate the workplace, share profits and responsibilities, respect the integrity and initiative of the individual. The systems work in principle, and usually in practice as well, but the two may have little to do with each other.
No one is to blame for this divergence, and there may be no way to avoid it, but we might now begin to see how the pretend realities lie falsely within our new world like the old-fashioned parks of a formal landscape. We can hide for a while in our fantasies of agreement and control, but ultimately we cannot escape the vernacular terrain – the cockpits and hangars and auto body shops, the lonely lit farmhouses sailing backward through the night – where we continue to struggle through life on the face of a planet.
We have come to a point in history not of an orderly existence but of something less expected: the possibility of seeing ourselves reflected perfectly in the turbulence and confusion that exists inside the sky. This gives me hope. It means that the sky is not some separate place but a vast new extension of our human earth, and that I as a pilot have perhaps not wasted my time there. Flight’s greatest gift is to let us look around, and when we do we discover that the world is larger than we have been told and that our wings have helped to make it so.
7
The Crash of EgyptAir 990
I remember first hearing about the accident early in the morning after the airplane went down. It was October 31, 1999, Halloween morning. I was in my office when a fellow pilot, a former flying companion, phoned with the news: It was EgyptAir Flight 990, a giant twin-engine Boeing 7
67 on the way from New York to Cairo, with 217 people aboard. It had taken off from Kennedy Airport in the middle of the night, climbed to 33,000 feet, and flown normally for half an hour before mysteriously plummeting into the Atlantic Ocean sixty miles south of Nantucket. Rumor had it that the crew had said nothing to airtraffic control, that the flight had simply dropped off the New York radar screens. Soon afterward an outbound Air France flight had swung over the area and had reported no fires in sight – only a dim and empty ocean far below. It was remotely possible that Flight 990 was still in the air somewhere, diverting toward a safe landing. But sometime around daybreak a Merchant Marine training ship spotted debris floating on the waves – aluminum scraps, cushions and clothing, some human remains. The midshipmen on board gagged from the stench of jet fuel – a planeload of unburned kerosene rising from shattered tanks on the ocean floor, about 250 feet below. By the time rescue ships and helicopters arrived, it was obvious that there would be no survivors. I remember reacting to the news with regret for the dead, followed by a thought for the complexity of the investigation that now lay ahead. This accident had the markings of a tough case. The problem was not so much the scale of the carnage – a terrible consequence of the 767’s size – but, rather, the still-sketchy profile of the upset that preceded it, this bewildering fall out of the sky on a calm night, without explanation, during an utterly uncritical phase of the flight.
I don’t fly the 767, or any other airliner. In fact, I no longer fly for a living. But I know through long experience with flight that such machines are usually docile, and that steering them does not require the steady nerves and quick reflexes that passengers may imagine. Indeed, as we saw on September 11, 2001, steering them may not even require much in the way of training – the merest student-pilot level is probably enough. It’s not hard to understand why. At their core airplanes are very simple devices – winged things that belong in the air. They are designed to be flyable, and they are. Specifically, the 767 has ordinary mechanical and hydraulic flight controls that provide the pilot with smooth and conventional responses; it is normally operated on autopilot, but can easily be flown by hand; if you remove your hands from the controls entirely, the airplane sails on as before, until it perhaps wanders a bit, dips a wing, and starts into a gentle descent; if you pull the nose up or push it down (within reason) and then fold your arms, the airplane returns unassisted to steady flight; if you idle the engines, or shut them off entirely, the airplane becomes a rather well-behaved glider. It has excellent forward visibility, through big windshields. It has a minimalist cockpit that may look complicated to the untrained eye but is a masterpiece of clean design. It can easily be managed by the standard two-person crew, or even by one pilot alone. The biggest problem in flying the airplane on a routine basis is boredom. Settled into the deep sky at 33,000 feet, above the weather and far from any obstacle, the 767 simply makes very few demands.
Not that it’s idiot-proof, or necessarily always benign. As with any fast and heavy airplane, operating a 767 safely even under ordinary circumstances requires anticipation, mental clarity, and a practical understanding of the various systems. Furthermore, when circumstances are not ordinary – for example, during an engine failure just after takeoff or an encounter with unexpected wind shear during an approach to landing – a wilder side to the airplane’s personality suddenly emerges. Maintaining control then requires firm action and sometimes a strong arm. There’s nothing surprising about this: all airplanes misbehave on occasion, and have to be disciplined. ‘Kicking the dog,’ I called it in the ornery old cargo crates I flew when I was in college – it was a regular part of survival. In the cockpits of modern jets it is rarely necessary. Nonetheless, when trouble occurs in a machine as massive and aerodynamically slick as the 767, if it is not quickly suppressed the consequences can blossom out of control. During a full-blown upset like that experienced by the Egyptian crew, the airplane may dive so far past its tested limits that it exceeds the very scale of known engineering data – falling off the graphs as well as out of the sky. Afterward the profile can possibly be reconstructed mathematically by aerodynamicists and their like, but it cannot be even approximated by pilots in flight if they expect to come home alive.
I got a feel for the 767’s dangerous side last summer, after following the accident’s trail from Washington, D.C., to Cairo to the airplane’s birthplace, in Seattle, where Boeing engineers let me fly a specially rigged 767 simulator through a series of relevant upsets and recoveries along with some sobering replays of Flight 990’s final moments. These simulations had been flown by investigators more than a year before and had been reported on in detail in the publicly released files. Boeing’s argument was not that the 767 is a flawless design but, more narrowly, that none of the imaginable failures of its flight-control systems could explain the known facts of this accident.
But that’s getting ahead of the story. Back on October 31, 1999, with the first news of the crash, it was hard to imagine any form of pilot error that could have condemned the airplane to such a sustained and precipitous dive. What switch could the crew have thrown, what lever? Nothing came to mind. And why had they perished so silently, without a single distress call on the radio? A total electrical failure was very unlikely, and would not explain the loss of control. A fire would have given them time to talk. One thing was certain: the pilots were either extremely busy or incapacitated from the start. Of course there was always the possibility of a terrorist attack – a simple if frightening solution. But otherwise something had gone terribly wrong with the airplane itself, and that could be just as bad. There are more than 800 Boeing 767s in the world’s airline fleet, and they account for more transatlantic flights than all other airplanes combined. They are also very similar in design to the smaller and equally numerous Boeing 757s. So there was plenty of reason for alarm.
One of the world’s really important divides lies between nations that react well to accidents and nations that do not. This is as true for a confined and technical event like the crash of a single flight as it is for political or military disasters. The first requirement is a matter of national will, and never a sure thing: it is the intention to get the story right, wherever the blame may lie. The second requirement follows immediately upon the first, and is probably easier to achieve: it is the need for people in the aftermath to maintain even tempers and open minds. The path they follow may not be simple, but it can provide for at least the possibility of effective resolutions.
In the case of EgyptAir Flight 990 the only information available at first was external. The airplane had arrived in New York late on a flight from Los Angeles, and had paused to refuel, take on passengers, and swap crews. Because of the scheduled duration of the flight to Cairo, two cockpit crews had been assigned to the ocean crossing – an ‘active crew,’ including the aircraft commander, to handle the first and last hours of the flight; and a ‘cruise crew,’ whose role was essentially to monitor the autopilot during the long, sleepy mid-Atlantic stretch. Just before midnight these four pilots rode out to the airport on a shuttle bus from Manhattan’s Pennsylvania Hotel, a large establishment where EgyptAir retained rooms for the use of its personnel. The pilots had been there for several days and, as usual, were well rested. Also in the bus was one of the most senior of EgyptAir’s captains, the company’s chief 767 pilot, who was not scheduled to fly but would be ‘deadheading’ home to Cairo. An EgyptAir dispatcher rode out on the bus with them, and subsequently reported that the crew members looked and sounded normal. At the airport he gave them a standard briefing and an update on the New York surface weather, which was stagnant under a low, thin overcast, with light winds and thickening haze.
Flight 990 pushed back from the gate and taxied toward the active runway at 1:12 AM. Because there was little other traffic at the airport, communications with the control tower were noticeably relaxed. At 1:20 Flight 990 lifted off. It topped the clouds at 1,000 feet and turned out over the ocean toward a half moon rising above
the horizon. The airplane was identified and tracked by air traffic control radar as it climbed through the various New York departure sectors and entered the larger airspace belonging to the en-route controllers of New York Center; its transponder target and data block moved steadily across the controllers’ computer-generated displays, and its radio transmissions sounded perhaps a little awkward, but routine. At 1:44 it leveled off at the assigned 33,000 feet.
The en-route controller working the flight was a woman named Ann Brennan, a private pilot with eight years on the job. She had the swagger of a good controller, a real pro. Later she characterized the air traffic that night as slow, which it was – during the critical hour she had handled only three other flights. The off shore military-exercise zones, known as warning areas, were inactive. The sky was sleeping.
At 1:47 Brennan said, ‘EgyptAir nine-ninety, change to my frequency one-two-five-point-niner-two.’
EgyptAir acknowledged the request with a friendly ‘Good day,’ and after a pause checked in on the new frequency: ‘New York, EgyptAir nine-nine-zero heavy, good morning.’ Brennan answered, ‘EgyptAir nine-ninety, roger.’
That was the last exchange. Brennan noticed that the flight still had about fifteen minutes to go before leaving her sector. Wearing her headset, she stood up and walked six feet away to sort some paperwork. A few minutes later she approved a request by Washington Center to steer an Air France 747 through a corner of her airspace. She chatted for a while with her supervisor, a man named Ray Redhead. In total she spent maybe six minutes away from her station, a reasonable interval on such a night. It was just unlucky that while her back was turned Flight 990 went down.