Careening Into the Future
At 3:16 p.m. on 19 July, 1989, the jet's tail engine blew apart. Twelve thousand meters above the US midwest, shards of the engine's fan rotor cut through the rear of the aircraft, shredding its hydraulic systems. As fluid bled from hydraulic tubing, the pilots in the front of the plane lost command of the rudder, elevators, and ailerons essential to stabilizing and guiding the craft. Immediately the plane twisted into a downward right turn. United Airlines Flight 232 from Denver to Chicago - with 296 people aboard - was out of control.
By itself, the failure of the tail engine was not catastrophic: the DC-10 had two other engines, one under each wing. But cockpit gauges showed a complete loss of hydraulic quantity and pressure. When the first officer tried to halt the right turn, the plane didn't respond. As the rightward bank became critical, the captain took over, pulling back on the control column and turning the wheel hard left - but still there was no response. In a last ditch effort to regain command, he cut power to the left engine and boosted it to the right one. The right wing slowly came up, and the plane rolled back to a horizontal position. The right turn stopped.
Yet the situation remained critical. The plane was no longer turning, but it was still losing altitude. The captain sent crew members to look out of the windows in the passenger cabin. They saw that the inboard ailerons were slightly up, the spoilers were locked down, and the horizontal stabilizers were damaged. None of the main flight-control surfaces was moving. And it appeared that the airframe might have suffered structural damage severe enough to cause it to break apart in flight.
Back in the cockpit, the captain and first officer worked the flight controls feverishly - they still believed they could change the plane's trajectory. But their efforts produced no obvious effect. The captain also manipulated the thrust of the two remaining engines, sometimes giving extra power to the left engine, sometimes to the right engine. This action did have a noticeable effect. It helped keep the plane level and countered its tendency to turn right. But changes in engine thrust gave the captain only minimal control. In fact, from the perspective of the passengers, the plane was moving in three dimensions simultaneously: it was rolling from side to side and pitching up and down, as if riding long waves across the sky.
A flight attendant opened the cockpit door to say that an off-duty United Airlines pilot, seated in first class, had offered to help. He was a "check airman" who flew with flight crews to assess their performance. The captain acknowledged that the unexpected assistance was urgently needed, because he was finding it impossible to work the flight and thrust controls simultaneously. When the airman entered the cockpit, the captain briefed him on the aircraft's critical situation in a staccato of abbreviate sentences. "Tell me what you want, and I'll help you," he replied. The captain asked him to take over the thrust controls. Grasping an engine throttle in each hand, the check airman then knelt on the floor between the captain and first officer's seats, and - with his eyes fixed on the flight instruments - began to manipulate the power of the two wing engines.
About fifteen minutes had passed since the explosion. The nearest airport was at Sioux City, Iowa. But the plane had lost nearly 7,000 meters of altitude and - despite the best efforts of the check airman - was still describing a series of clockwise circles over the Iowa countryside. In various parts of the United States, clusters of people had gathered around microphones and speakers to follow United 232's plight and to offer suggestions. The crew particularly wanted to hear from the United Airlines System Aircraft Maintenance (SAM) facility in San Francisco.
Second Officer to United Airlines Chicago Dispatch: "We need any help we can get from SAM, as far as what to do with this. We don't have anything. We don't [know] what to do. We're having a hard time controlling it. We're descending. We're down to 17,000 feet. We have . . . ah, hardly any control whatsoever.
But the SAM engineers didn't have a clue how to help. They had never heard before of a simultaneous failure of all three hydraulic systems. They kept asking, in disbelief, if there really were no hydraulic quantity or pressure. And they asked the second officer to flip back and forth through the pages of a thick flight manual, to no avail. The crew's frustration with ground support rose.
Captain to Second Officer: "You got hold of SAM?"
Second Officer: "Yeah, I've talked to 'im."
Captain: "What's he saying?"
Second Officer: "He's not telling me anything."
Captain: "We're not gonna make the runway fellas . . . . we're gonna have to ditch this son of a [bitch] and hope for the best."
Almost thirty minutes into the crisis, SAM had finally assembled a team of engineers around the speaker and asked the second officer for yet another full report. He provided a detailed rundown of the aircraft's status. After a period of radio silence, SAM again asked: "United 232, one more time, no hydraulic quantity, is that correct?" The second officer replied in exasperation: "Affirmative! Affirmative! Affirmative!" The engineers on the ground, the crew decided, could offer no help. United 232 was on its own.
Yet, at almost exactly the same time, the check airman accomplished a miracle. He managed to bring the plane around in a single, broad turn to the left, lining up the plane for the shortest runway at the Sioux City airport. This was the only left turn the plane was to make following the explosion. The captain called the head flight attendant forward and explained the procedures for an emergency landing.
Captain: "We're going to try to put into Sioux City, Iowa. It's gonna be tough . . . gonna be rough."
Flight Attendant: "So we're going to evacuate?"
Captain: "Yeah. We're going to have the [landing] gear down, and if we can keep the airplane on the ground and stop standing up [i.e. stop right side up] . . . give us a second or two before you evacuate. 'Brace, Brace, Brace,' will be the signal . . . it'll be over the PA system: 'Brace, Brace, Brace'."
Flight Attendant: "And that will be [the signal] to evacuate?"
Captain: "No, that'll be to brace for the landing. And then if we have to evacuate, you'll get the command signal to evacuate. But I really have my doubts you'll see us standing up, honey . Good luck sweetheart."
Thirty-five kilometers from the airport and at 1,300 meters altitude, the plane was still roughly lined up for the runway. Sioux City air traffic control suggested a slight left turn to produce a better approach and to keep the plane away from the city. "Whatever you do, keep us away from the city," the captain implored. Almost immediately afterward, as if in defiance, the plane began its tightest rightward turn, a complete 360-degree circle. The crew desperately tried to bring the nose around to face the runway again. As the aircraft rolled to a severe angle, the check airman exclaimed "I can't handle that steep of bank . . . can't handle that steep of bank!" For five excruciatingly slow minutes, the plane turned in a circle. Working the throttles, the check airman leveled the wings once more and got the plane back to its original course.
Sioux City Control: "United 232 heavy: the wind's currently three six zero at one one. Three sixty at eleven. You're cleared to land on any runway."
The runway that they were heading towards was closed and covered with equipment. Two minutes before touch down, airport workers scrambled frantically to clear the equipment away. It was also short, at just over 2,000 meters; and, without hydraulic pressure, the plane had no brakes. But Sioux City Control assured the captain that there was a wide, unobstructed field at the end. The cockpit crew struggled with the controls through the flight's last seconds.
Captain: "Left turns! Left turns! Close the throttles."
First Officer: "Close 'em off."
Captain: "Right turn. Close the throttles."
First Officer: "Pull 'em off!"
Check Airman: "Nah. I can't pull 'em off or we'll lose it. That's what's turning ya!"
Unidentified voice: "OK."
First Officer: "Left throttle . . . left! Left! Left! Left! Left! Left! Left! . . . Left! Left! Left!
[Ground proximity alarm sounds]
First Officer: "We're turning! We're turning! We're turning!"
Unidentified voice: "God!"
The plane hit the ground at the runway's leading edge, just to the left of the centerline. The right landing gear touched the ground first, then the right wing. The plane skidded across the runway to the right, lost its right engine, chunks of its right wing, and its tail engine. It then ploughed across the grass, lost its left engine and tail section, and hit the pavement of another runway. The cockpit nose broke off. The remainder of the fuselage cartwheeled away and exploded in flames, coming to rest upside down in the middle of a field. Of the 296 passengers, 111 died, including one flight attendant. The entire cockpit crew survived.
At first, United 232's experience seems to be no more than an isolated, harrowing event in the skies of the United States - a tale of heroism in the face of terror, of discipline and skill in the face of unforseen catastrophe. It was a dramatic front-page story that had everybody talking and astonished for a day, before it was enveloped by the rational, bureaucratic procedures of accident investigators.
But when I read about United 232, something struck a deeper cord. The event could serve, I suspected, as a crude but vivid metaphor for a more general situation we are all facing, individually and collectively.
When the plane's tail engine disintegrated, the flight crew immediately faced a staggeringly complex task. Multiple, simultaneous, and interdependent emergencies converged in the cockpit. Some were recognized and understood, some were misunderstood, and some didn't even cross the crew's threshold of consciousness. As the crew members tried to make sense of their instruments and the data they received via their eyes and ears, problems cascaded into other problems with almost overwhelming speed. The crew was swept along by a tightly coupled stream of cause and effect. For forty-four harrowing minutes, the captain and his officers assessed a prodigious flow of incoming information, made countless inquiries and observations, and issued dozens of commands. Even with the extra help from the check pilot, it was all they could do to keep the plane aloft and roughly on course to a crash landing.
Of course, our daily lives don't have nearly the same drama or urgency. But most of us feel, at least on occasion, that we are losing control; that issues and emergencies, problems and nuisances, and information - endless bits of information - are converging on us from every direction; and that increasingly our lives have become so insanely hectic that we seem always behind, never ahead of events. Connections among places and peoples, among macro and micro events, connections that are often unexpected and invariably barely understood in their dimensions, weave themselves around us. Most of us also sense that immense, uncomprehended, and unpredictable forces are operating just beyond our view, such as economic globalization, mass migrations, and changes in Earth's climate. Sometimes these forces are visible; more often they flit like shadows through our consciousness, disappearing in a haze of uncertainty and contradictions as we struggle with our day-to-day concerns.
Yet the flight of United 232 is more than a vivid metaphor for a world of converging complexities and connections, of decision making at high speed under high uncertainty, and of the difficulty of managing in such circumstances. It is also a metaphor for crisis - for the sharp, unexpected, blinding events that sometimes send us reeling. Investigation after the crash revealed that the engine explosion was caused by a fatigue crack in the tail engine's stage 1 fan disk, a large donut of titanium alloy out of which radiate the blades of the jet engine's fan. The crack occurred near the center of the disk, at the site of a tiny metallurgical flaw formed when it had been cast seventeen years beforehand. Slowly, imperceptibly, during 38,839 hours of flying time (about 7 billion revolutions of the disk), this flaw turned into a crack, and the crack grew in length. At the time of the disk's last inspection, in April 1988, it was over a centimeter long and should have been noticed by United's inspectors. But it was not. And 2,170 flight hours later, in a split second, the crack shot outwards to the edge of the disk, and the disk blew apart.
In our personal lives we sometimes see similar sudden and shocking events: physical or mental disease unexpectedly affects a loved one, companies we deal with abruptly go bankrupt, and our computers, televisions, and cars suddenly break down. Within the larger society, stock markets sometimes crash, revolutions occasionally break out, and floods at times devastate communities. The simple mental models in our heads, the models that guide our daily behavior, are built around assumptions of regularity, repetition of past patterns, and extrapolation into the future of slow, incremental change. These mental models are the autopilots of our daily lives. But external reality has the habit of intruding with the unexpected. No matter how much we plan, no matter how much we build buffering institutions and technologies, buy insurance, and develop forecasts and predictions, reality constantly surprises us. Sometimes these are happy surprises; sometimes they are not. Rarely are our reactions neutral.
But in this regard, United 232 also offers some reassuring lessons. Faced with sudden calamity, the crew members used their wits and their courage to save almost two thirds of the lives aboard. The US National Transportation Safety Board (NTSB) declared that "under the circumstances, the UAL flight crew performance was highly commendable and greatly exceeded reasonable expectations." The situation they faced was unprecedented: they hadnÕt trained for it; no airline crew had ever trained for it. Such a disaster was thought too unlikely or too catastrophic to justify specific training. The pilot and his officers therefore had to invent, on the spot, a method for controlling the plane. They also had to assess the plane's damage, choose a place to land, and prepare their passengers for a crash landing.
Put differently, the moment the engine exploded, crew members had to meet a sharply higher requirement for ingenuity - that is, for practical solutions to the problem of flying the aircraft.
Home | Book Contents | Book Excerpt | Suggested Readings |
Ingenuity Theory | About Thomas Homer-Dixon | Order The Book