Quote of the Day - Warnings and Accidents

NASA management had many, many warnings that there was something wrong, but the warnings were disregarded. It was like a child that runs in the road and the parent is very upset and says it's very dangerous. Sooner or later the child gets run over. Is it an accident? No it's not an accident. – Richard Feynman on the Challenger accident.

I was at my office when the Challenger crashed. I had just returned from a meeting at Johnson Space Center with a co-worker. We took a break to watch the launch – and watched live as the Shuttle program I had been working on for seven years fell apart in flames.

I followed the subsequent investigation closely. All of us did. Eventually the cause was tracked down to a series of events: A leak in the solid rockets let flame escape. It melted the strut holding the solid rocket booster to the external tank. The SRB swung into the external tank, rupturing it. The external tank collapsed, throwing the orbiter off the stack. This happened when the Shuttle was going through maximum dynamic pressure. The wind tore the orbiter apart when the orbiter tilted back as it flew off the tank. There was no explosion. The fireball was the result of hydrogen escaping the tank and igniting when it reached the open flame of the main engines.

Most people missed the real cause of the disaster. Challenger was destroyed through a specific set of conditions and the subsequent series of events that resulted. Yet – as Feynman realized – that was not real reason the Shuttle crashed. The crash was the result of the real reason. The real reason was that NASA got careless.

Between July 1985 and January 1986, NASA flew seven Shuttle missions. I was in Mission Control for six of them. (51-L was the first mission since STS-4 I did not support.) In each of those seven missions a problem occurred, which could have caused a catastrophic failure that could have killed a crew. In one mission, sensors indicated the engines were overheating. (It resulted in an abort-to-orbit.) In another, there was a failure in the reaction control system that eliminated redundancy. (Mission rules called for the mission to be terminated and brought home early. It wasn’t.) In another, there was a weather scrub at the transatlantic abort landing strips. The Shuttle launched anyway.

The Challenger flight rules stated you should not launch if the Orbiter was chilled below 30 degrees F. (That was why there was no data on the effects of chilling the SRBs to 27 degrees F. NASA did not pay for the analysis because it was unneeded. You could not launch below 30 degrees due to Orbiter constraints.)

The bigger point is that NASA ran seven straight missions in which a known flaw could have brought down a Shuttle. But they got away with it the first six times. And why wouldn’t they? The chance that any one flaw would be fatal was miniscule. The seventh proved if you do something stupid enough times, it eventually catches you. Moreover, within the context of each individual system, the hazard was known and could be mitigated. The problem was that hazards had effects outside the individual system.

The SRB leak was an example. SRBs had leaked on earlier missions. The leak reduced thrust to orbit but otherwise did not matter. You ended up in a lower orbit. Even if the flame played on the external tank, it did not matter. The tank was filled with liquid hydrogen which would absorb the heat of the flame and prevent the tank surface from melting. It only mattered when it melted the strut holding the tank and booster apart. Of course, then it really mattered.

Feynman realized there was no one cause for the Shuttle crash. If you get sloppy, and ignore flight rules, eventually some combination of circumstances will trip you up.

I bring this up because much the same principle applies to the mid-air collision in Washington, DC. People are focusing on the cause of the accident rather than the reason it happened. Was the helicopter pilot flying too high? Did the helicopter pilot focus on the wrong aircraft? Were there too few air traffic controllers on duty? Were the controllers competent? There is a belief that if we can identify the cause we will avoid future accidents.

Except . . . we did that with Challenger. And 16 years later, almost to the day, we lost Columbia to a similar set of foul-ups. People make mistakes.

If the helicopter pilot was 150-200 feet higher than the pilot should have been, that was a mistake. Under normal circumstances, it is not a major error. Similarly, if an air traffic controller was too tired or too busy to make one more check to ensure the helicopter had the right aircraft in sight, the ATC made a mistake. But under normal circumstances, it was not a major error. Yet, in this case, a set of minor mistakes led to tragedy.

The solution is not to insist people not make minor mistakes. Those are going to happen. The solution is to design a system where minor mistakes will not cause a catastrophe. In this case, routing helicopters along the Potomac River perpendicular to the flight path of jetliners landing at (or taking off from) a commercial airport seems a singularly bad idea. It maximizes the opportunity to let a series of minor errors cascade into disaster. Shortly before I wrote this, the DOD announced military helicopters were not to fly along the Potomac near Reagan Field.

Yet it is not as straightforward as simply banning flights. Chesterton’s fence applies. There was a reason for the helicopter flights. This helicopter was on a training mission. The mission was a nighttime exfiltration of Federal leaders from Washington, DC. It is the type of thing that may be necessary when the balloon goes up. It is one of those missions you have to get right, and get right in adverse conditions. This requires practice. Lots of practice. Over and over. Our armed forces train like they fight.

The question now comes down to whether there was another way to conduct this mission. Is there a route the helicopters can fly without flying across approach patterns, and still do this mission as well as before? If the balloon goes up and leaders of the Federal government have to be evacuated under wartime conditions will that mission be completed as efficiently as it would have been using the old flight path? If not, is the loss of efficiency acceptable? As Thomas Sowell once observed, “There are no solutions. There are only trade-offs.”

Trade-offs also apply when it comes to Reagan Airport. The military could fly its original flight profile if Reagan were shut down and the land repurposed. It is a legacy airfield with many problems. There are two other airports close at hand. Yet shutting it down creates other issues. It is convenient. People rely on it. Again, Chesterton’s fence comes into play.

Similarly, trade-offs were the reason NASA flew seven Shuttle missions after flight rules called for the missions to be delayed or cut short. There was a cost to delaying or terminating a mission. Six times that cost proved higher than the benefit gained by continuing. The seventh time, the cost of ignoring flight rules proved higher – and more painful – than an extra two-day’s delay would have been. The problem was that the analysis done in making the go/no-go decision was flawed. The risks had not been evaluated properly.

The same thing happened on January 29. Several people made flawed risk assessments, with tragic consequences. The real lesson from this tragedy is the same lesson that Challenger offered. People make mistakes. The only way to mitigate those mistakes is to ensure that mistakes, especially small, usually inconsequential mistakes, do not have fatal consequences. In this case, the result of a cascade of mistakes is 67 dead.

Yes, the control tower should have been fully staffed, and with competent people. Yes, the helicopter pilot should have been more concerned with flying too high than flying too low. Yes, people designing the mission flown by the helicopter should have been more aware of outside factors (other than optimizing the mission) than they were. I am sure when the NTSB investigation is done there will be a list of findings as long as my arm.

We will fix the problems that led to this crash going forward. Just like they fixed the problems that led to the Air Florida crash in 1982. There has not been a similar accident since then. There will not be until the Air Florida crash is forgotten. But I can guarantee, there will be another air catastrophe in the future. Like the Flight 5342 crash, it will be caused by a cascading step of minor mistakes that lead to disaster. Because people make mistakes.