Airline Safety A Special Report

Let's assume that you are going to be in a major air crash. Just hypothetically, based on what we know about major air crashes. Say you and your wife are going on your vacation on Western Airlines flight 2605, a DC-10 that leaves Los Angeles for Mexico City, due to arrive at 6:05 a.m. Mexico City time. You roar down the runway and experience the thrill of lift-off. The basin is beautiful at night, even in the orange haze, and you admire the surreal lights as the sleek aircraft climbs over the ocean.

The flight is comfortable, uneventful. It is a wide-cabin jet, quiet and pleasant, not too crowded--almost empty, in fact. You put a cool one in your hand, maybe read the first couple of chapters of Maurice Collis' Cortes and Montezuma. You have a bite to eat and listen to canned music. You watch some N.F.L. highlights. You doze.

Approaching Mexico City, perhaps the captain points out that, off to the side of the aircraft, it is possible to make out the 17,887-foot peak of the dormant volcano Popocatepetl, shrouded by low-lying fog. The seat-belt sign goes on and a stewardess makes two announcements, one in English, the other in mangled Spanish, emphasizing that the captain is making his descent into Mexico City's Benito Juárez Airport ("our final destination") and that Federal law requires you to keep your seat belt securely fastened about you. You fasten it, but not all that securely. You smile over at your wife, but she is asleep with a Newsweek in her lap.

In a little while, you hear a "ding" as the No Smoking sign lights up and you are told (in two languages) that you should extinguish all your smoking materials. If you happen to be listening to the cockpit--tower communications through the headset provided for your listening pleasure, you may even chuckle inwardly when you hear the controller tell the pilot that he is off course, because the pilot responds, "Just a little bit." You probably reckon, well, they have all these radio navigation aids to line you up on the runway, anyway, as you look outside and see that it is, indeed, foggy out there, down this low over Mexico City's 7800-foot terrain.

It is unlikely that you know of the Red Star rating given to Benito Juarez Airport by the International Federation of Air Line Pilots Associations, which means that the field is seriously deficient. It does not have, for example, an RVR (runway visual range) system, which tells the pilot how far along the runway he will be able to see. You probably also don't know that the radar there fails from time to time and the navigation aids upon which you are depending are considered insufficient, as are the landing aids. Furthermore, on this morning, one of the two parallel runways is under construction and out of service. Visibility has been reported as two or three miles, but other reports indicate that it could be much lower. High in the mountains, things can change quickly.

When the plane jolts onto the runway the first time, you are slammed against your seat belt. You may be nervous--a sudden heat may rise to your face--but it could just be a hard landing. Then, when the engines scream and the airplane starts to lift again, skittering and swerving like a car on ice, you know something unusual is happening, but there is little time for analysis. The aluminum body of the aircraft rings like a gong--you've never heard anything like it and you certainly won't forget that ungodly sound, not as long as you live. And for the first time, there is actually some question in your mind about just how long that is going to be.

Your wife is awake now, but only for a moment. Her face is ashen, but before either of you can speak, the plane slams into something solid (that aluminum gong again) and begins, almost in slow motion, to break apart. Your seat belt now rips into your abdomen and the pain demands your full attention. Your wife starts to say something, but you don't know what it is. Your breath is gone as you are thrown violently forward, then suddenly backward into your seat again. Not five seconds have passed. You may be trying to figure out what she is saying when the seat belt snaps in two around your wife's stomach and she goes rocketing through the cabin with a force that takes seats off their mounts and bends her body in ways that no one could possibly survive. Which is when you realize that she is not going to survive. An odd calm has descended upon you, and though you don't know it, it is a classic form of panic. You are beyond fear, perhaps just thinking, Wait, no, this isn't the way it's supposed to happen....

Your seat belt is now stretched out from the force and from the fact that you didn't tighten it all the way to begin with. On the next impact, with the pain searing up your sides and back, you slide out, under the belt, and are in tumbling pursuit of your wife. As if by magic, all your clothes are blown off your body and you are naked. The plane is now in three, maybe four sections--it's hard to tell, because there is flame and smoke pouring through your little piece of it and there is the sound of ripping aluminum--the gong is torn, that awful sound replaced by others, the soft, steady detonation of pockets of vaporized kerosene. There are flashes of heat and wind rushing by, but the pain is gone now; there is the roar of jet engines, the buckling of surfaces. There may even be people screaming (your wife?), but you don't hear them.

And it is over as quickly as it began. You have stopped flying, and it's so much quieter--now you can hear the people, but they aren't screaming, they're just moaning or talking incoherently, and perhaps you think, A lot of people must have died .... Ten, maybe 20 seconds have elapsed, and a $40,000,000 DC-10 has been rolled into a fiery ball. Across the concrete, where you can see only out of the corner of your eye, flames are roaring and leaping 50, 80 feet into the sunrise. Someone is lurching across the grass out there, completely engulfed in flames, just like in the movies. You've never seen a burning man before. You are lying on the ramp, unable to move. You are naked and can't feel your arms or legs; you are only vaguely aware that the concrete surface is cool on your cheek, but the sun is coming up now and you're just wondering where your wife went, thinking of her thin fingers and the color her hair takes on in direct sunlight.

•

On October 31, 1979, Western Airlines flight 2605 crashed on landing at Mexico City's Benito Juarez Airport. There were two parallel runways and the pilot, using a "nonprecision" radio landing aid, was trying to line up on the right-hand one. No one knows why, but he lined up instead on the left, which was closed. The controller told him he was off course and he said, "Just a little bit," and then landed, with one set of tires in the mud, one on the concrete. He tried to take off again and actually got airborne, but then immediately hit a truck and killed its driver before the plane hit a building, then another building, disintegrating as it went. Seventy-three people died on the spot, though the word died does not begin to convey what they went through. The people responsible for air crashes of this magnitude like to couch their descriptions in vague, official locutions that serve to temper and dilute reality until it seems that the entire affair was a simple bookkeeping error in no one's favor. "Fatalities resulted" is a favorite, or, "Lives were lost," using the passive verb forms to suggest that, well, like earthquakes and cholera, these things just happen.

Try it yourself. It can work wonders with some serious problems: Stop lights were run, for example. Controlled substances were utilized, taxes were evaded, illegal campaign contributions were received by this office. You see? No blame. The reality is quite another matter.

Off the record, I spoke with a state's attorney who happened by ill luck to be one of the first to the scene of a major air crash. "There wasn't much we could do," he said with a kind of puzzled look, as if he still couldn't quite believe what he had seen. "We found a few heads. I think we found an arm or something." Traumatic decapitations resulted. Amputations and enucleations as well. When an airline announces that lives were lost, it makes it sound as if, even at this very moment, every effort is being made to locate them and it is only a matter of time before the misplaced items are returned.

The National Transportation Safety Board (NTSB) delicately worded its opinion that the airline industry doesn't much care what happens:

While the over-all safety record of the current generation of jet aircraft clearly indicates a basically sound foundation for the regulatory (continued on page 148)Airline Safety(continued from page 142) oversight of U. S. commercial aviation and the commitment of the industry to safety, the Safety Board is concerned that this accident may be indicative of a climate of complacency...the Safety Board is concerned that the nature of the identified deficiencies in design, manufacturing, quality control, and maintenance and operational procedures may reflect an environment which could involve the safe operation of other aircraft by other carriers.

The passage refers to the crash of American Airlines flight 191 in May 1979, but the message is clear: More often than we'd care to contemplate, in the official mind of the airline industry, there is little distinction between lives and luggage. They both get lost from time to time.

What that subtle manipulation of attitude does to the flying public is to make air crashes more acceptable. Fortified by those comforting turns of phrase, by loads of reassurance and reams of statistics, the average passenger quickly regains his sense of security after hearing of a major air crash and is once again ready to step into anything with two wings and a bright paint job. The press generally gets right in step, too, quoting statistics that say flying is 115 times safer than driving, and so on. It all boils down to a very successful public-relations campaign that makes air crashes an inevitable part of modern civilization, like radiation cancer, rivers that burn and "superprompt critical power excursions" in nuclear reactors.

To accept air crashes as inevitable is to ensure that they will happen in increasing numbers--and with greater frequency than if they were categorically considered unacceptable. If God came along and struck planes from the sky from time to time, the airline industry's view might make sense. But that is not the most common mechanism by which planes crash. And we can only conclude that those who take responsibility for lofting people through the skies have come around to a way of thinking that places a relatively low value on human life, though those people will never admit that the logic exists with which to indict them. "Jet transports have an excellent 20-year history of reliability and safety," a top NTSB official told the industry journal Aviation Week. "That fine record may be contributing to a feeling in the industry that they can get by with being a little less diligent."

Why do you suppose an airline would want to send a jumbo jet into a mountaintop airport with one runway closed, with insufficient landing aids, at dawn--when the probability of poor visibility is at its highest? The answer is simple. At night, the airline has to ferry that plane there for its daily flights and would rather have you along, paying for the trip, even if it is a relatively risky trip. The airline can advertise lower fares because it is a night flight. It won't tell you what you're really getting into. You just assume it's as safe as any other flight.

So when you get on a plane, it may be a good plane or a bad plane--a safe trip or a dangerous trip--but you can be sure of one thing: It's going to be cost effective. And once a plane is in service, it is not cost effective unless it stays in service. Dispatch reliability is the name of the game; "Asses in seats and planes in the air," as one official of the Federal Aviation Administration put it. The goal is money, not safety.

No one is suggesting that the airlines, the pilots, the Government or anyone else wants planes to crash. Everyone is embarrassed by crashes. But there is really no economic incentive to get there safely. The plane may arrive at its destination or it may arrive directly at the slopes, as a DC-10 (through no apparent fault of the plane) did on November 28, 1979, 1500 feet up the side of a 13,202-foot-high volcano called Mount Erebus. The airline makes money either way. The business can rebound from deaths--insurance more than covers a crash and in the 55-year history of the industry, no punitive damages have been levied against an airline or a manufacturer for killing people. The cost of insuring a passenger is something like 50 cents per flight, and the average number of deaths is 280 a year. "The insurance companies don't care," says Gerald Sterns, one of the country's top aviation lawyers. "[McDonnell] Douglas pays less now than it did in 1974." The insurance companies are more than happy to take in the premiums now, invest them, then pay out the relatively small settlements after a crash, three or four years in the future, with inflated dollars. "They don't even cough picking up a DC-10," says Sterns. "Thirty or forty million dollars over three or four years is nothing."

As for the airlines, they could double or triple the rate at which they crash planes and feel no additional pain. Not just in terms of economics, either. The statistical methods the industry uses to show how safe it is are given to the public in such enormous numbers (billions of passenger miles, for example) that a few hundred deaths one way or another will not alter the statistics noticeably. But even using their own statistics, 1979 appears to have been a particularly devil-may-care year for airlines. General aviation, long thought to be the more dangerous way to fly, showed up nearly a third safer than airline travel last year. The NTSB said there were 5.148 airline fatalities per 100,000 hours, as compared with 3.285 for general aviation. Where does that leave the highly touted professionalism and technical wizardry?

In economic terms, it is easy to see why an airline doesn't suffer when a crash occurs. National Airlines presented a disturbingly poignant example of how a crash affects an airline economically: A few years back, National flew one of its 727s into Escambia Bay in Florida. National realized an after-tax profit of $1,500,000 from the crash, which amounted to a gain of 18 cents per share, due to excess insurance coverage on the plane. Only ten days after the crash, National issued a press release announcing that and saying the profit came from "the recent involuntary conversion of a 727 aircraft."

By contrast, the business cannot so easily rebound from sagging profits. And that sets the ultimate priority. Here, the subject of weather enters into the equation. An airplane's ability to make money depends on its ability to keep flying, which depends--or used to depend--largely on the weather. If you can't see, for example, you increase your risk. And while we have developed a wide variety of equipment for blind flying, it is most useful in the air, not on the ground. If the DC-10 captain going into Mexico City had seen a truck on the runway, he would certainly have realized he was approaching the wrong runway.

In 1972, at Chicago's O'Hare International Airport, Delta flight 954 landed under very poor conditions without incident. The visibility was about 1320 feet, which a jet can cover in a few seconds on landing or take-off. Through the omission of one word in a controller's instructions to the captain of Delta 954, the plane went the wrong way on the airport surface, started to cross an active runway and was hit by a departing DC-9, whose crew couldn't see flight 954 until it was too late to stop. Why were operations taking place under such conditions--conditions so poor that the tower couldn't even see the planes moving on the ground? To follow all the arguments, you need to be a journeyman in white-water logic, but one argument says that, yes, aircraft operations can be accomplished successfully under those restricted conditions. But if you were one of the 293,000,000 passengers who flew in 1979, you might have another line of reasoning that says a mass-transportation system should not operate so close to the edge. Sure, it's OK for military pilots and private pilots to use these hairsplitting minimums: In the one case, they've pledged their lives to freedom; in the other, it's a personal, individual and theoretically well-informed choice. But when all you've pledged is your credit card and when your only desire is to visit Grandma, you are probably an unwitting party to this experiment in profit making and deserve a larger margin of safety or, at the very least, more information. Major airlines have been shooting category III approaches into Los Angeles International (LAX) now for some time, with full loads of passengers. Most readers will not know what a category III approach is. And if they were told before the flight, they might elect to wait a few hours rather than try one, though these "fully coupled" approach systems are said to be highly reliable. Simply explained, a category III approach is one in which there may be no ceiling and no visibility. It's an automatic landing, usually in dense fog, where planes without automatic landing systems divert to other airports.

By March 27, 1977, five years after that Chicago Delta crash, we had not learned much. Two 747s, in a virtual replay of the O'Hare crash, collided on Tenerife, one of the Canary Islands, one taxiing, the other taking off. Again, it was a small semantic error that started the chain of events during greatly reduced visibility. If everyone had agreed beforehand that it was stupid to fly paying passengers under such conditions, that would not have happened. Why do you suppose this goes on?

•

The problems of economics begin at the drawing board (with the "paper airplane," as they call it, the safest plane of all). Beech is a major airplane manufacturer. It doesn't make airliners, but the example should help give you some perspective on the business. Recently, Beech introduced a plane called the Skipper. In prototype, it had a tail like most planes you see. "The conventional tail of the [Skipper] worked very nicely," Aviation Consumer magazine reported, "but the marketing department overruled the engineers and ordered a T tail for styling reasons."

For styling reasons. And then the T tail didn't work right and had to be Rube Goldberged until it did. Beech is not unique in the industry, but it does appear unusually susceptible to marketing-department whims. The legendary Model 35 series V-tail Bonanza, with a 30-year history of in-flight structural failures, is the most obvious example. Studies verified by the FAA and the NTSB show that this very popular airplane has in-flight structural failures, such as the tail's falling off, 24 times as often as the same plane with a conventional tail--the models 33 and 36 Bonanzas. But styling sells more planes.

You may never be in a Beech product (those who fly them swear by them), but the people under discussion are professional engineers, just like the ones at any commercial-aircraft manufacturing company. While we all readily accept the fact that it is impossible to design a plane so that some fool can't come along and punch a hole in the ground with it, it seems equally obvious that the designer's task is being made needlessly complicated by marketing departments and styling considerations.

The birth of an airliner is a complicated process, but it's probably not what people think it is. A manufacturer doesn't tell its engineers, "Go and design the best airplane in the world." Generally, an airline or a group of airlines gets the notion that it could sell more seats if only it had a certain type of plane. And then it goes to the manufacturers and says, "How about something in a wide-body three-holer?" And the manufacturers try to meet those specifications and submit drawings, not to the FAA but to the airlines themselves. All of which should help you understand how the vast, incomprehensible brain trusts can put in millions of man-hours and come up with a bucket of bolts that won't stay in the air.

Unfortunately, even when a plane comes off the drawing board in good shape (and most do), its problems are only just beginning. Once again, the problems are economic. Consider pilot training, for example. Airline pilots are generally trained in simulators prior to training with you on board. Those people whose jobs depend on defending simulators will vigorously support the notion that they are realistic--very realistic. I've ridden in a 747 simulator and it was certainly realistic. What it wasn't was real. In fact, the day I took that ride, the big joke at the training center was that the DC-10 simulator wasn't working because someone had crashed it. Literally. Surely, the pilot who did that walked off the line mortified and embarrassed and in some degree of trouble with his employer. But he did walk off the line, he wasn't carried off in a rubber sack. Put simply, there is no penalty for crashing a simulator.

"I thought that was an asset," FAA Administrator Langhorne Bond told me. "The first time I did a blown tire--a rejected take-off [in a simulator]--I ran off the end of the runway because I didn't push [the brakes] hard enough. The use of simulators has to be considered a significant breakthrough. Just a great, great tool for sharpening up on emergencies."

But there is another school of thought among aviation experts that views the practice of training airline pilots in simulators with the same degree of skepticism that one might have for an army that trained its soldiers by having them carry broomsticks and shout "Bang! Bang!"

The reason for training in simulators is the fuel crisis. When we checked, it cost $2760 per hour to run a 747, $1850 for a DC-10, $1320 for a 707 and $800 for a 727.

Even if a pilot manages to learn how to fly by using a simulator, his problems with the fuel crisis are just beginning. An ordinary jetliner burns thousands of pounds of kerosene an hour. Each flight is conducted with the smallest allowable quantity of fuel on board, especially since it takes fuel to carry fuel. On December 28, 1978, United Airlines sent up 189 people in a DC-8 with enough fuel to get from Denver to Portland. But the plane experienced difficulty with its landing gear when it neared the airport, so the captain went out to circle and solve the problem. And that DC-8 just ran out of fuel. It crashed in the woods seven miles short of the runway. There was no fire, of course, because there was nothing left to burn; had there been, the plane would have reached the airport. The NTSB blamed the pilot, and while none of us would like a pilot to be flying us around with so little fuel, there is more to the story. According to the pilot's testimony, he knew his gear would collapse on landing and so he wanted to land with as little fuel as possible to avoid a fire. Unfortunately, his gauges were in error.

John Galipault, president of the Aviation Safety Institute, says of fuel gauges on aircraft, "It's a crummy business. If you could design a device that would accurately measure the amount of fuel in an airplane's tanks, you could retire very nicely." The fuel gauges can be off by thousands of pounds. Before the fuel crisis, a pilot could fill his tanks if he liked and the company wouldn't complain. "But now," says Galipault of the amount of fuel airliners carry, "they're marginal--all of them."

The United pilot in that DC-8 had information indicating that he could make it to the airport; his information was wrong. His gauges said he had 3000 pounds of fuel or--at a burn rate of 12,000 pounds an hour--15 minutes of (continued on page 205)Airline Safety(continued from page 150) fuel left when he decided to turn toward the airport. But suddenly the gauges read empty and the engines started flaming out. Here are excerpts from the cockpit voice recorder. At the time, the only thing the crew knew was that the landing gear would buckle on them when they landed. The passengers had been alerted that the landing might not be normal. The engineer speaking didn't know that in about five minutes he would be dead. The pilot and the copilot would survive.

Captain: OK--how are the people?

Engineer: Well, they're pretty calm and cool--ah, some of 'em are obviously nervous--ah, but for the most part, they're taking it in stride--they--I, ah, stopped and reassured a couple of them; they seemed a little bit more--more anxious than some of the others.

Captain: OK, well, about two minutes before landing--that will be about four miles out--just pick up the mike, the P.A., and say, "Assume the brace position."

Engineer: OK.

A few minutes later, the controller called:

United one seven three heavy, if you could, ah, give me souls on board and amount of fuel.

Copilot: I think he wants souls on board, he wants crew members and everything.

Captain: OK, we're going to go in now, we should be landing in about five minutes.

Engineer: I think you just lost number four [engine], buddy, you----

Copilot: Better get some cross-feeds open there or something.

Engineer: OK.

Copilot: We're going to lose an engine, buddy.

Captain: Why?

Copilot: We're losing an engine.

Captain: Why?

Copilot: Fuel. Open the cross-feeds, man.

Captain: Open the cross-feeds there or something. Showing a thousand [pounds] or better.

Copilot: I don't think it's in there. It's flamed out.

Engineer: We're going to lose number three in a minute, too. It's showing zero.

Captain: You got a thousand pounds.

Engineer: Five thousand in there, buddy, but we lost it.

Captain: All right.

Engineer: Are you getting it back?

Copilot: No, number four, you got that cross-feed open?

Engineer: No, I haven't got it open.

Captain: Open 'em both, [expletive] get some fuel in there.

Copilot: It's going to be [expletive] on approach, though.

Captain: You gotta keep 'em running, Frostie.

Engineer: Yes, sir.

Copilot: Get this [expletive] on the ground.

Engineer: Yeah.

At that point, they called to say they were going in. The controller told them they were "18 flying miles" from the field.

Engineer: Boy, that fuel sure went to hell all of a sudden.

Captain: There's, ah, kind of an interstate-highway-type thing along that bank on the river in case we're short.

Copilot: Let's take the shortest route to the airport.

Engineer: We've lost two engines, guys.

Controller: United one seventy three heavy, contact Portland tower.

Copilot: OK.

Controller: Have a good one.

Captain: They're all going. We can't make Troutdale.

Copilot: We can't make anything.

Captain: OK, declare a mayday.

Copilot: Portland tower, United one seventy three heavy, mayday, we're--the engines are flaming out, we're going down, we're not going to be able to make the airport.

Tower: United one----

(Impact with transmission lines, as derived from tower tape.)

United Airlines did it again on June 4, 1979, but that time luck was with the people on board the DC-8, flight 398 from San Francisco to Seattle. The plane landed in Portland, out of fuel. When it touched down, the engines flamed out. The plane had to be towed to the gate.

In October 1979, a Pan Am 747 was going into New York's Kennedy International and had to hold for an hour. The pilot shot the approach but couldn't land because of weather. He went to his alternate airport, Newark. When he touched down, he hit the thrust reversers and two engines quit. A third quit as he pulled off the runway. He was out of fuel. As Galipault says, "Walking that last mile isn't the way to get to the airport." You will be surprised at how little money airlines are saving by risking your life that way. A DC-10 from Chicago to Los Angeles, for example, might carry 80,000 pounds of fuel. It costs roughly $1000 to carry that fuel, since the DC-10 uses about 12 percent of its fuel to carry fuel.

Another example of aviation economics at work concerns the so-called flotation device. At this writing, there are seven airlines operating over water without life rafts. The FAA finds that acceptable and has, in fact, proposed a rule to allow all airlines to fly even longer distances over water without rafts.

Wayne E. Williams, who runs the Florida-based Nova University Institute for Survival Technology, has conducted sea-survival courses for the military and others and is a recognized expert in his field. If you are lucky enough to have a life vest under your seat when you get on an airplane, you might want to try it on before leaving the gate--Williams has demonstrated that those devices are "extremely difficult to locate, extract, unpack, don, attach and inflate." In tests, even trained crew members have been unable to do it. Further, says Williams, "most have insufficient buoyancy and will allow head immersion in fairly light sea conditions."

You've seen the signs on board an airliner that say the seat cushions are good for flotation. According to Williams, the Coast Guard considers those seat cushions "not suitable for nonswimmers and children." They should be used "only where you have other boating activity (implying a rapid recovery) and should not be used where you will encounter hypothermia [subnormal body temperature]." Since most of the large bodies of water around and within the United States have temperatures between 32 and 40 degrees Fahrenheit most of the year, and since the human body can lose heat as much as 30 times faster in water than in air, passengers should expect rapid hypothermia if an airliner lands in water.

"The FAA justifications for deleting rafts are defective," says Williams. "They can only serve the airlines' economic interests, not safety.... A DC-3 accident might involve 30 people; today's air crashes can kill ten times that. The increase in numbers is critical, because the very size of the group makes its recovery from the water impossible within life-expectancy times.

"In each major terminal area, the Coast Guard has one helicopter on 30-minute alert. It can pick up 20 persons, at the rate of one per minute, under ideal conditions. Conditions will not be ideal. [The pilot] will have problems locating the group. When he does, they will be widely dispersed. If they're in vests, they will have small lights visible less than one half mile. With cushions, no lights. But all those will be academic problems. They will all be dead before he arrives."

The FAA's logic in allowing airliners to operate over water without life rafts goes like this: "No scheduled U. S. air carrier has ever ditched a turbojet aircraft." That's a quote from R. L. Collie, then--acting chief, Air Carrier Division of the Flight Standards Service of the FAA. He was writing in response to an October 20, 1978, complaint from Patricia Robertson Miller, at that time president of the Association of Flight Attendants. What Collie doesn't mention is that turbojet aircraft do land in water, even if the landings can't be classified as ditchings, and that the FAA has no official definition of ditching.

In 1961, a 707 splashed down off Long Island. That same year, a 720 overshot into the water at Boston. In 1962, another 707 got dunked at Kennedy. In 1964, a DC-8 at New Orleans and again that year, another 707 at Kennedy; 1968, a DC-8 at San Francisco; 1969, another DC-8 at LAX; 1970, a DC-9 near St. Croix; and in 1978, that National pilot flew his 727 into Escambia Bay. According to the Air Line Pilots Association (A.L.P.A.), there were 42 no-notice water impacts of jetliners between 1959 and 1979, 15 in the U. S. An official of the NTSB recently told Williams that that type of accident will continue to happen.

"There are no 'proper' life vests," Williams says. If you find a vest under your seat, take it out and look at it. If you were in the Service in World War Two, you may recognize it. It costs about $25; a 30-man raft costs $2000. Compare that with the $40,000,000 price tag of, say, a DC-10 or an L-1011. If your car costs you $10,000 and you refuse to put 50 cents into it to save some lives, the comparison is mathematically the same.

•

Look at the airline business long enough and you stop seeing guardian angels and begin seeing accountants. Safety is a statistical pastime. The real issue is profit, which can literally jeopardize the safety of any flight. The airplane brings in money only when it flies. The maintenance base, then, is designed not to keep the plane in perfect condition but to get it back into the air as quickly as possible within the limits of the law. And the law does not regulate safety--it merely sets out minimums, the bare-bones basics, below which your chances of survival get so poor that lawmaking becomes necessary. The law is not meant to be a standard. How much should be done on each plane is a judgment call and a matter of great debate.

The DC-10 crash of American flight 191 in Chicago in May 1979 was caused in part by slipshod maintenance, which focused a great deal of attention on how the airlines service their planes. The resulting Congressional study concluded, simply, that maintenance problems come from two sources, the first being a heartfelt desire to save money.

The second is more subtle. Modern aircraft are designed according to a concept called fail-safe. An FAA report describes it this way:

This principle contemplates that, while each critical component or system element is required to perform functions within the design envelope of the aircraft, its failure will nevertheless be assumed...appropriate analyses and tests are required to insure that sufficient redundancy exists so that after a single failure, redistribution of functions will occur to other components...capable of assuming them safely.

Maintenance departments within airlines, showing their great faith in the fail-safe principle, will frequently defer maintenance in the belief that nothing serious will happen if something breaks. There are so many backup systems, the plane's bound to fly.

"It's all redundancy," a TWA mechanic told me. "That's what's between you and a crash. And, anyway, if I don't catch it, my boss will, and if he don't, the next guy down the line will, and so on." The real danger in that attitude is that, in effect, it reduces--even removes--the element of redundancy. If you have one primary system and one backup system, and if the primary goes out and you use the backup, you have eliminated the redundancy. If the backup fails, you're out of the game.

I spoke with a pilot who said of the DC-10, "When we saw that this airplane was coming down the pike, we had some input. We insisted on pneumatically operated air speed and altimeters, and they were installed. They work independent of all electrical power on the airplane. A lot of airlines don't have this. All the instruments that are on those flight panels are electrically powered. And if you crap up the electrical, you've got yourself a real bucket."

So much for redundancy.

Even if the aircraft has genuinely redundant systems, the maintenance is not always working hand in hand with the fail-safe principle. When a modern jetliner can produce something on the order of $50,000 a day in gross revenue, it's difficult to keep it on the ground because you can't get a $50 component to fit it. Or because someone put on the wrong fuel-pressure gauge or happened to install the thrust-reverser bolts backward or because the tires are slick or there's a dent in the wing.

Airplanes with each of those problems have been sent out into service--real airplanes with real passengers--by Braniff, Northwest, Frontier, Pan Am, Piedmont, United and others. If the carrier knows that the FAA probably won't catch the violation, and if it does may then only impose a $1000 fine, what's the reason to worry?

In the fall of 1978, the House of Representatives asked the United States Comptroller General to look into how the FAA manages safety problems. The report issued this year says that the FAA does not have:

• effective systems for identifying safety hazards,

• a comprehensive planning process to address safety issues,

• an adequate system for planning and approving individual safety programs,

• a proper system of controls to govern the implementation phase of safety projects, or

• sufficient evaluation of safety programs and projects.

The report further states that within the Government body charged with ensuring aviation safety, "no single individual or office has been responsible for hazard identification, and organizational conflicts have existed between FAA and the [NTSB]."

Since it is the FAA's responsibility to crack down on airlines that refuse to maintain planes in an airworthy condition, and since the FAA has traditionally failed to do so, it is encouraging to see what could be a new attitude developing. Last year, the FAA asked Braniff to pay $1,500,000 for maintenance violations. PSA was charged with $385,000 and Prinair with $166,000. American has already paid $500,000 for DC-10 mismanagement in connection with the Chicago crash. Continental paid $100,000 for similar infractions. While $500,000 hardly seems like a stiff penalty in light of the 273 people killed as a result of American's haphazard maintenance program, it may help other airlines take this business more seriously.

I spoke with Langhorne Bond about it and he admitted there was a lot of room for improvement of the FAA--airline relationship. "We've been too much coach and not enough cop," he told me. "We're trying to get our people back into the cop mode." He said that the last time the FAA was really as tough as it should always be was when Pete Quesada was in charge, which was under Eisenhower. Now, Bond promised, things are going to change. Indeed, the Comptroller General's report admits, "A new climate...appeared to exist in FAA," though the report hastens to add, "...we have some reservations about FAA's ability to see the effort through...."

Unlike many students of air safety, I regard Bond as a reasonably honest administrator, trying to do a decent job in an impossibly tough position. Any FAA Administrator is going to draw the heaviest fire possible--it goes with the territory. The next few years will tell if Bond is good, but he seems to have made some advances. For one thing, the regulatory function appears more open to public scrutiny. He says he wants "to ventilate the place a little bit. The FAA is in transition. Business in the past has been more secretive. We have not handled it very gracefully. But a new generation of people is coming in."

•

Given all the variables that economics can produce in the airline industry, we are finally forced to ask, Could economics alone produce an airplane that would not fly? Or one that, flying ever so regularly, was marginal when it came to safety? Could the entire process break down to the point that, under no direct Government or regulatory control, the industry could produce a plane that would be the most economically successful machine flying and yet not live up to standards we just assume exist? And having been so conceived, could such a plane then be inspected, approved and certificated by the Federal Government?

J. P. Hann, director of flight operations and laboratory tests at McDonnell Douglas in Long Beach, told me that as far as safety went, the limits had just about been reached. The last area they were closing in on now was the human factor. I don't think anyone will disagree that the weakest component in the system is sometimes the guy in the left seat (or in front of the radar scope or holding the wrench), but what Hann said bothered me because it did not seem to include the Ph.D. who had designed the aircraft. He seemed to be saying that the monumentally complex system of aircraft design, certification and manufacture worked logically, the way we might expect it to work: You build on the knowledge and experience of decades, you learn from mistakes, you evolve safer and safer aircraft and systems. When a mistake or a flaw is found, you eliminate it from the system and move on. It bothered me even further because it did not admit to the economic pressures that exist during design of an aircraft.

Airplanes crash for a variety of reasons. There have been more 707 and 727 crashes than DC-10 crashes, but people don't go around calling Boeing planes defective. The 707 and the 727 have never had their type certificates revoked on an emergency basis. The NTSB has never said of those planes, as it said of the DC-10, "The deficiencies raise concerns about aircraft design and certification."

There would never have been a question about DC-10 design if it had not fallen out of the sky of its own accord so many times, if it had not literally fallen apart in mid-air. And while it may be understandable that the human is the weakest component of the system, that fact only complicates the problem. When the guy in the left seat blunders in a big way, he does not defend his mistake. Generally, he is buried with it. When a designer fluffs it, however, he goes before a group of peers and is allowed to present evidence to prove how good his mistake is. If he is clever and wishes to keep his job, he can convince his employer and even the FAA that his mistake is actually a design innovation. And it will go on the airplane. Especially if it weighs less or costs less or takes up less space. Often, the best design from an economic standpoint is the worst thing for safety.

Immediately after the American Airlines crash of the DC-10 at Chicago, I called McDonnell Douglas. Spokesmen there were not interested in talking. They didn't exactly say "Go away," but they didn't return phone calls and didn't encourage contact. A reporter knows when he's being brushed off. Months later, the public-relations firm of Carl Byoir and Associates, one of the largest in the world (it represented Howard Hughes, for example), called me, saying Douglas was eager to talk. For the next few weeks, I received calls from Byoir representatives at least twice a week until I flew out to Long Beach to visit the Douglas facility, where the DC-10 is built. They had just hired a new PR executive to assist with the foundering DC-10 image. He told me of plans to take a large group of reporters up in a DC-10 ("go up and do stalls and stuff"), to show a prepared film explaining how safe the Ten really is. And while I didn't take the ride, the visit was eye opening.

Wandering around inside the McDonnell Douglas plant is like walking through a Lewis Carroll dream after taking the pill that makes you small: Everything is 40 times bigger than normal. By golf cart, a Douglas executive and I glided along among the clean brown-and-tan-colored buildings, buildings so large their size doesn't even register until you drive inside one and see, as you pass from sunlight to fluorescent shade, the sign warning, It Takes Six Minutes to Open or Close This Door, a door like no other you are ever likely to see.

I stood in a room--a single room--that contained ten entire DC-10s. That is but one room in a complex in which the workers travel in some cases from one desk to another by bicycle and in which others can be seen hitchhiking at lunch hour to get to another part of the plant. Some of those are third-generation employees of Douglas, where planes have been built without interruption since 1923--which cannot be said of either Boeing or Lockheed.

The DC-10 is built in stages and takes 18 months from start to finish. Some parts are made elsewhere by other companies, some are fabricated right there, but eventually the whole plane emerges on the Douglas flight line at the Long Beach Airport and one day John Brizendine, president of Douglas, simply hands over the keys to a pilot--literally. I watched the press watch Laker Airways take delivery on December 13, 1979. The stunning, snow-white DC-10 had a Christmas bow around its entire 62-foot girth and Brizendine stood on an elevated ceremonial platform and held forth on the notion that this was a benefit to all mankind, this craft. He wished for peace on earth and then, in the Douglas tradition, handed over the gold key and cut off the pilot's necktie.

In another building, we watched a section of fuselage arrive on a special vehicle one might call a truck. It was a piece of midsection that would be fitted with a cockpit and a nose assembly, a perfect cylinder of aluminum skin and skeleton still painted with yellow-green bichromate corrosion inhibitor. Apparently, even the employees are not used to the remarkable enormity of those operations. Workers all over the area stopped to watch when the safety horn sounded, signaling that the great crane was lifting the object and moving it a few meters to its cradle at the end of a long line of partially finished fuselages.

After two days in the Douglas plant, I had no doubt that the men and women there are as dedicated and sincere, as talented and well trained as any group in aviation. Douglas is no more rapacious than Hughes Aircraft, Bell Helicopter or Bell Telephone. It is multinational business at its finest.

At the time of my visit, McDonnell Douglas had three quarters of a billion dollars in cash. Sales in 1978 were 4.1 billion dollars, making the company 63rd on the Fortune 500 list. These people have to be doing something right--a lot of things right, come to think of it. The Douglas DC-3 was the first aircraft ever to show a profit by carrying passengers. It doubled as the C-47, a proven, versatile military airplane that did remarkable duty in Vietnam as Puff the Magic Dragon, a gunship that could put a round into every square inch of a football field in 60 seconds.

And out there in the Long Beach sun, in the spick-and-span, designer-toned atmosphere of the Douglas plant, watching the workers assemble the infinitely, unimaginably complex DC-10 airplane, it was difficult to imagine that sleek bird doing anything but flying off to greater glory. Difficult, that is, if you hadn't already seen it rolled into a smoldering ball off the departure end of a runway, and seen the grisly suggestion that there had once been humans in there, eagerly awaiting that first cocktail, wrapped inside 100 miles of wire and an aluminum skin. For a grisly suggestion is all that remains when that noble concept becomes a reality--and then fails at its one designated task.

•

Realizing that the Douglas family mourns, too, when another DC-10 goes down does not make it any easier to deal with the fundamental problems of that airplane. I found it perfectly natural for Douglas to defend its product in ways that disagree with explanations found outside the Douglas family, explanations voiced by experts who have good reason to believe that if the world of modern jet aircraft was destined, sooner or later, to produce a genuine dog, McDonnell Douglas drew the short straw, for whatever reasons.

And if the DC-10 continues to be one of the most popular airliners in service, having logged nearly 6,000,000,000 passenger miles, carrying some 150,000 people a day, there are still increasing numbers of people, including pilots, airline mechanics, stewardesses and aviation professionals, who have coolheadedly allowed that flying itself carries sufficient risk without doing it in a questionable aircraft.

"I don't fly it anymore," said a DC-10 captain with 31,000 hours of flying experience, a man steeped in aircraft systems, accident investigation for a major airline and airplane engineering. I was shocked. That happens to be one of the highest-paying jobs for an airline pilot today. "Yeah," he said sadly, "but I looked at how they were reacting to its deficiencies and I left the airplane. Because I think it is not a sound airplane. A number of pilots have downgraded."

He put a finer point on it: Stepping down from the Ten to the 707 or the 727 represents an estimated $1000-to-$2000-a-month pay cut. "Flight attendants, too," he continued. "You wouldn't believe the flip-over of people who have that same opinion. Even passengers are starting to do it. Somebody's going to be stuck on it, though. So there are some opportunities for junior people to fly the Ten, because a guy like myself isn't doing it."

"What is the biggest problem with the DC-10?" I asked.

"The fact is," he said, "the DC-10 can roll over and play dead on any take-off."

In the executive offices at McDonnell Douglas, I met with the senior engineer on the DC-10 project, Bob Hornburg, who had prepared an elaborate briefing for me that showed the DC-10 to be as safe and reliable as any plane flying. The Ten had been his life for years and he just couldn't get over it; his energy and faith in the machine were truly remarkable as he insisted that previous problems (that's what he called the worst crashes in world and U. S. history, "problems") with the plane had not been design flaws, they had been the result of mishandling of the aircraft.

The language of defense for the DC-10 struck me as rather odd. It has flown more passenger miles with fewer deaths than any other aircraft. Its "dispatch reliability" is among the best in the country. But those are economic terms, used to measure profitability. They have nothing to do with safety. Without knowing it, Hornburg was telling me that the DC-10 was a profitable, popular airplane, which no one will deny. And he fervently believed that fact made the plane acceptable. It was a bit frightening.

He told me that certification had not been rushed, a charge frequently leveled at Douglas. The story is complicated, but a group of reporters from the London Sunday Times described it succinctly:

The DC-10 was born out of one of the most savage marketing conflicts in civil aviation history. In the Sixties, it became clear that big fan-jet engines would make possible a new generation of "wide-bodied" air buses. Boeing established a commanding lead in the long-haul section of that market with the remarkable 747. Two ailing firms were left to struggle for the medium-haul business: Lockheed, which was trying to return to the civil market after years of overdependence on defense, and Douglas, once the world's greatest builders of commercial aircraft, reduced to chaos and penury by the eccentricities of its founding family.

Douglas was taken over by the aggressive military-aircraft builders McDonnell and, late in 1967, the new McDonnell Douglas Corporation announced that it was going to try to catch up on the lead of nearly one year that Lockheed had established in the race to get orders for a three-engined air bus. This was a contest of "paper aircraft," in which both sides made larger and larger promises.... What nobody really expected--or wanted--was that both paper planes would actually be built.

Hornburg told me that that version of history was preposterous, that Douglas was virtually paying no attention to what Lockheed was doing. Douglas had come up with the DC-10 design completely on its own. And as far as rushing it into production, he said certification took 43 months. I didn't know what to make of that figure. That's only three and a half years. He said 18,000,000 man-hours had gone into engineering the plane, "the equivalent of 1000 people working for nine years." They are fond of analogies at Douglas. And that one doesn't seem to hang together. Try another: If you had to have open-heart surgery, would you choose a physician who had trained for nine years or one who had crammed "the equivalent" into three and a half years?

Douglas emphasizes that "the DC-10, when properly maintained and inspected, is completely airworthy." To understand that statement, you have to read between the lines. The position is the one discussed earlier: no blame. There is a nasty legal battle brewing out of the American Airlines DC-10 crash in Chicago. An engine fell off and a lot of people died.

Douglas' position on the Chicago crash is that American Airlines wasted a perfectly good airplane. And it certainly seems true that American broke the engine mount during maintenance. The briefing given to me by Hornburg at Douglas contained this statement: "The recent problems with DC-10 developed only when unauthorized and improper maintenance procedures were used. Different design techniques might have prevented those problems, but the problems would also have been prevented if ground crews had followed the manufacturer's instructions." So even Douglas itself is not 100 percent emphatic about the design of the pylon, other than to say it is a good, workable design and has been mishandled. The point, however, is that other aircraft are built so that they can't be mishandled that way.

The DC-10 is a machine with many tricks up its sleeve, and the spherical bearing--a component of the pylon holding the engine to the wing--that started the chain of events that killed 273 people is only one. The NTSB said of the Ten, "The design of the aircraft's systems apparently failed to account for the possibility that a single event could simultaneously render critical portions of the flight control, hydraulic and electrical systems inoperative."

The DC-10 captain I interviewed said of the plane, "It's a house of cards." We laid out the engineering drawings and operating manual for the Ten and went through them, system by system. A large jet's hydraulic system is its life line, driving the control surfaces that make the plane speed up or slow down, turn and bank. The other jumbo jets have four hydraulic systems, separate from one another, to drive flight controls. If one hydraulic system goes down, it may not affect the outcome of the flight.

In the DC-10, there are only three systems and they are questionable. For one thing, they can be interconnected. The fluid from one cannot flow to another, but there are two pumps--called reversible motor pumps--that connect the systems. The 1-3 pump connects systems one and three, the 2-3 pump connects two and three. If the number-one system, for example, loses pressure, this 1-3 reversible motor pump will start up, allowing the number-three system to pressurize the number-one system. It's the same with the 2-3 pump.

But what if number one actually springs a leak? The number-three system is then faced--through the reversible motor pump--with the task of trying to pressurize a system with a hole in it. That's like trying to blow up a punctured balloon. "It's going to be pumping fluid like mad," the DC-10 captain said, "expending an awful lot of its own pressure trying to pressurize the other system that can't be pressurized."

What he says is not just speculation. He has had firsthand experience with that hydraulic house of cards. Once, on take-off, one of his systems sprang a leak. The reversible motor pump got into the act as described. When the captain pulled up the landing gear, the airplane's controls began to fail. Fortunately, this captain was familiar enough with the quirks of this plane's hydraulics that he turned off those reversible motor pumps. His controls came back when he'd once again isolated the three systems. The reason the landing gear triggered the loss of control effectiveness is because lifting those huge wheels takes a lot of hydraulic power. And in the plane's degraded condition, with a reversible motor pump going "open-ended," there wasn't that much power.

Douglas claims that what the DC-10 captain experienced can't happen. There is, for example, a low-level regulator that senses when a system has lost its fluid. It is true that that cutoff switch exists in each system, but it reads only below the one-gallon level. Each system holds 35--40 gallons of fluid. Douglas further says that there is a flowmeter that, sensing an abnormally fast flow, would shut off the reversible motor pumps. But those "hydraulic fuses" are not located in the main lines, and in service they have failed to shut off the pumps, according to reports. So (the DC-10 captain's theory goes) if the number-one system is being helped by the number-three system, number three is degraded and then number two comes along to help it. Since it cannot help the open-ended system, it, too, begins to lose pressure. Then all three systems are involved in this futile effort. Vital hydraulic power is being wasted.

It should be pointed out that Lockheed's design also has similar mechanical connection of hydraulic systems. It calls its reversible motor pumps Power Transfer Units (P.T.U.). The key, however, is that Lockheed's instructions call for keeping those turned off, especially in the event of a leak. Some pilots are now flying DC-10s with the switches in the off position, in violation of the DC-10 manual, because they consider it safer.

•

The next time you are on a jetliner, sit over a wing and watch the leading-and trailing-edge devices--the slats and flaps. Before take-off, they will extend from the wing outward. As the airborne plane picks up speed, they will retract, because they are designed to provide high lift at lower speeds. If, with slats extended, you can take off in a DC-10 at 153 knots, you had better be very sure they are going to stay extended--because without them, you may need 170 knots.

Unfortunately, the DC-10, unlike other jets, has no such guarantee. The slats can fold up without warning, putting the plane below its flying speed and causing it to drop out of the air.

The DC-10 slats are not actuated by the hydraulic system: Instead, they are actuated by a series of cables routed around a drum, which in turn is run by a hydraulic cylinder. I asked Hornburg why it had been designed in that unnecessarily complicated fashion. He seemed to take offense and said it wasn't unusual at all. "How would you do it?" he asked. Since I wasn't in the business of doing it at all, I didn't know what to say.

But I did ask Boeing and the DC-10 pilot I was interviewing and they both said the same thing. In the words of the pilot, "No other aircraft [except Douglas'] are set up on a cable-actuation system. The strange thing is that the Ten does not have any preventive device to keep the slats from folding up when the power comes off suddenly." On Boeing planes, the slats are extended by ball-jack screws and locked out; no matter what happens, they won't retract.

The slat system is significant in the context of the Chicago DC-10 crash, because when an engine tore lose, the left-wing slats retracted, causing that wing to stop flying. Since the right wing was still flying, the aircraft rolled over to the left. In fact, it went to a partially inverted position before hitting the ground. The argument has been made that in simulator tests, the plane was flyable in that configuration. The argument can also be made that in the only nonsimulated test of that configuration, the plane was demonstrably not flyable.

When a wing stops flying, it's called an aerodynamic stall. In flight 191, the left wing stalled--that is, it didn't produce enough lift. By Federal law, any aircraft certificated in the U. S. must have adequate stall-onset buffet. Though stalling an airplane is a simple, common maneuver, practiced by all pilots during training, it is very difficult to explain to those who don't fly. First of all, the term stall is unfortunate because it makes people think of their car stalling. An aerodynamic stall has nothing whatsoever to do with engines. You can stall a glider, which has no engine. The force that causes an airplane to go up is called lift. Lift is produced by a wing when air flows smoothly over it. If you run the plane through the air fast enough, eventually the wings will produce so much lift that it will overcome the weight of the plane. At that point, the plane will leave the ground. Suppose you are sitting in the driver's seat of an airplane, cruising along, and you start gradually pulling the nose up, pointing it toward the sky at a steeper and steeper angle. Eventually, you will reach an angle at which the smooth flow of air over the wings breaks up. burbles off the wings and ceases to produce lift sufficient to hold the airplane up. The airplane will then start going down. If you watch someone landing a plane, you can see this happen (or nearly happen). As the plane nears the ground, the pilot will pull the nose up, higher and higher, and finally the plane will simply squat on the runway, no longer flying. That--more or less--is a stall.

As the plane approaches this stalled condition, the turbulent, burbling airflow over the wings moves rearward as the plane moves forward. The turbulent air hits the tail, which shakes the plane. This shaking is called stall-onset buffet. It's a signal to the pilot that he is going to stall. If the pilot doesn't want to stall, then he can put the nose down. If he does want to stall, he can continue to pull the nose up. Further complicating matters, one wing can stall before the other, causing the plane to roll or spin.

Asked to describe the stall characteristics of the DC-10, the captain said, "It was sharp, quite sharp. When she went, it was at a far lower speed than I thought it was going to be and when it did go, why, it was just blooey! A shake, and down we started." He is not the first airline pilot I talked with who complained of the Ten's stall characteristics. I met one at the NTSB hearings and asked him what it was like stalling the DC-10. He thought for a moment and then said, "It's like driving over a cliff."

At Douglas, I was told that the DC-10 stall characteristics were fine. They were normal, gentle, benign and, in fact, the prestall buffet was considered too pronounced. J. P. Hann said that because of that, the autoslat extend mechanism was devised to put the plane farther away from the stall. When you approach stall in the Ten, the slats automatically go out, giving you a margin over the stall speed that you would not have with slats retracted. Then the buffet stops, because you're no longer near the stall.

On the other hand, down the hall, Bob Hornburg told me, "The buffet warning is very, very light." He said the autoslat extend mechanism would make it more pronounced. There seems to be an alarming variety of opinion about how this airplane really behaves.

Whatever the buffet is really like, there is an additional stall warning device, electrically powered. Captain Dale Leppard of the National Accident Investigation Board of A.L.P.A. refers to it as "what appears to be a Russian-roulette type of system."

And Donald Armstrong, chief of the FAA's Western Region Flight Test Branch (and the pilot who flew the DC-10 for its original certification), says, "You will run out of roll control, if you will, prior to reaching the angle of attack at which aerodynamic buffet would be experienced.... In the American flight 191 configuration, all evidence indicates that there was no significant aerodynamic warning in the form of buffet down to the point where the roll-off occurred." In other words, the plane will roll irreversibly over on its back with no warning. Which is what it did.

Probably the best-known design flaw in the DC-10 is the aft cargo door. Early in the design of the Ten, it was found that you could blow that door off if you weren't very careful with it. The loss of a door might not be important to flight, but when the cabin experiences what is called explosive decompression, another fault raises its ugly head: The cabin floor collapses, whereupon yet another flaw shows up. The vital control cables are routed through the floor. When those lines are severed, you've got--as the DC-10 captain put it--"a misguided missile."

The real problem with that door has never been adequately explained. There are two basic types of doors on planes, plug doors and latch doors. The plug door opens inward. When it is closed, the air pressure within the plane makes it impossible for that door to open in flight. If you make a plug-type cargo door, however, you reduce your cargo space. The door has to have space inside the plane to open inward. The DC-9 has a latch-type cargo door, but it is not subject to the problem of the DC-10 cargo door. The DC-9 door is closed hydraulically. If it's not latched properly, the pressure inside the plane will cause the hydraulic closing device to back off, letting air escape slowly. The captain will see that his plane is not pressurizing and return to correct the problem.

In the DC-10, it was decided to use an electrical door-closing mechanism, which is not capable of backing off to let air escape. It holds the door shut, that is, until the plane has gotten high enough to build sufficient pressure to blow the door off. Whereupon another design defect comes to light: The DC-10 floor can withstand only three pounds of pressure per square inch. When that door blows off, the pressure is far beyond that range and the floor collapses, because the cargo door was put below deck.

Douglas saw that problem coming and added a vent door to the cargo door to prevent the airplane from being pressurized if the cargo door weren't latched correctly. But that didn't work, either. It was then possible to latch the door improperly and to close the vent door so the cabin would pressurize, leading the crew to think everything was secure. The aircraft was certificated by the FAA that way and went into service. In 1972, less than one year after delivery of the first one, an American Airlines DC-10 climbed out over Windsor, Ontario, and popped the door at 12,000 feet. The floor collapsed, as predicted.

The DC-10 captain says he and his fellow pilots told Douglas to get designs--steal them from Boeing, if they had to--necessary to make the doors stay closed. At Douglas, the attitude was that the door was a good design--it just wasn't foolproof.

"So," says Hornburg, "we Murphy-proofed it." But not every plane was reworked immediately. Turkish Airlines had a DC-10 with the unimproved door on it in March 1974 when a baggage handler tried to close it. It closed all right. At least it looked closed. The plane climbed out to about 12,000 feet and again the door let go. When the floor collapsed, the control lines were cut. People were sucked out through the gaping hole. It rained people that day and the world was up in arms about the door. The plane crashed into a forest, scattering people over half a mile.

Two weeks before the Turkish crash, Douglas had told the FAA that installation of blowout panels in the DC-10 floor to prevent collapse was fiscally not feasible--it was just too expensive. After the crash, Douglas said it had already installed blowout panels on some Japan Airlines planes. It turned out that JAL wouldn't accept the planes without the panels. It also turned out that not only did those panels cost a mere $125,000 per plane, Douglas charged JAL with half the price.

The doors and floors have been modified and remodified now, and Douglas tells me they are fixed. Maybe the plane is fixed, but I'm not going to be the one to test it.

•

No matter how airworthy a plane is, it appears that there will continue to be crashes. Some pilot is going to come up short or some airline will skimp on fuel and the plane will go down and the NTSB boys will don their blue jump suits and scratch their heads and pick through the pieces, declaring the crash "survivable." And we will ask, Then how come so few survived? And they will say, "Thermal trauma" and "Severe thoracic deformation," and so on.

I sat down with Gilbert Haas, director of protective services for Lee County, Florida. He has the look of one who has seen the action. He has stood in many a field, shaking his head and wondering how it all came this far. We were talking about a concept called crashworthiness. He sighed. "If you went to your local building inspector and said, 'I'm going to build a night club and it's going to be 182 feet long, with eight-foot ceilings; it'll have six exits measuring 76 by 42 inches, and I'm going to serve drinks, allow smoking and show movies, and there will be 325 people there every night, and the aisles will be 19 inches wide,' what do you think he'd say about giving you a building permit?" Haas smiled. "He'd throw you into the street. Yet the airlines have done just that. In addition, they have 80,000 pounds of kerosene in the basement."

There are numerous changes that could be made in airliners that would improve chances of survival in a crash. The seats, for example, could be mounted so that they wouldn't break loose. There are virtually no fatal jetliner crashes in which the seats don't come loose, injuring or killing people. Douglas assured me that its seats were mounted just as strong as they needed to be, stressed to nine gs. On the other hand, Langhorne Bond told me, "Nine gs is less than for automobiles. The possibility of a change is real." He has asked the FAA to determine what could or should be done to strengthen seats.

In April 1975, Richard F. Chandler of the Civil Aeromedical Institute's Protection and Survival Laboratory presented material explaining how he had strengthened general-aircraft seats to make them more crashworthy, "with a weight increase of only a few ounces. These simple changes increased the failure level of the seat to in excess of 40 gs." His paper further notes, "The pioneering work of [John J.] Swearingen and [A. Howard] Hasbrook...formed the basis for many principles in aircraft crashworthiness that are generally accepted today. As early as 1954, Hasbrook stated ten 'crash survival design recommendations' that remain generally applicable to this day." For a quarter of a century, then, there has been at least some knowledge about increasing survivability in air crashes. Virtually none of that knowledge has been applied in modern jetliners.

Seat belts in airliners are inadequate. The single lap belt is recognized as marginal protection. Cars are required to have shoulder belts. Pilots must wear shoulder belts by Federal law. But not airline passengers. The reason is simple. People don't want to see shoulder belts. If the average passenger got on an airplane and saw a proper seat with proper restraints, it would probably look like something in the cockpit of an F-4 Phantom jet. And the passenger would say, "Thank you very much," and walk right out and get on a train.

But suppose you do survive the impact. Suppose the belt holds and doesn't rupture your spleen and fracture your pelvic saddle. What, then, will be your chances of getting out of the plane? The answer is disheartening. It would be nice to tell you to sit by an exit door--and, by all means, do, if you can--but don't count on its opening. Most passengers are not aware of how easy it is to jam an airliner door, jam it so that it cannot be opened even with pneumatic or hydraulic override systems. It does not take a crash to jam a door. Long airplanes are flexible. They twist and torque and bend in flight. The 60-below-zero temperatures at altitude and the high temperatures on the ground contract and expand the metal. What does that do to the doors?

Hubert I. Bennett, former president of Teledyne McCormick Selph, noted that "after landing and taxi, the aircraft must sometimes be aligned by pulling the nose wheel in a perfectly straight line of 20 feet or more in order to allow easy manual opening of cargo doors...excessive ground braking of the Boeing 747 has contributed to jamming some exits."

One 1969 study of emergency evacuation done by the Flight Safety Foundation covering the period of 1957--1967 said, according to Bennett, "that there was no really reliable means of emergency egress from our modern jet aircraft. This is also true today." In 26 accidents included in that data, where such details were available, "it was found that of the 215 exits available, only 53 were used, or a percent usage of 24.7.... There are logical reasons why 75.3 percent of doors and exits are not used in a postcrash situation. After impact, fuselages are torqued and the resultant effect is jammed doors and exits . . . making them completely inoperable or impossible to open."

Hasbrook wrote a paper in 1962 that attempted to deal with those problems. "In the past," he said, "the aviation industry...has paid major attention to the problem of providing rapid emergency escape facilities for occupants of transport aircraft, particularly in high-density tourist compartments.

"Why, then, did 16 of 122 occupants of a modern jet airliner perish while attempting to evacuate a virtually intact--but smoke-filled--aircraft at Denver, Colorado, on July 11, 1961?" He went on to note "that decelerative forces were extremely low throughout the accident, and no impact injuries of any consequence occurred within the aircraft." But "soon after the aircraft came to rest, two major fire areas developed."

Captain B. V. Hewes, chairman of the Rescue and Fire Committee of A.L.P.A., has said, "Testing by competent world authorities has determined that 50 feet either side of the fuselage is the critical control area, since any fire in this area will melt the skin of an aluminum fuselage." He also noted, "Previous history of aircraft crash fires has shown that survival times of more than four minutes are rare.... Of course, it is understood that if the fuselage has been seriously ruptured, survival times can be reduced considerably."

Hasbrook, in reference to the Denver crash, stated, "The width of the aisle between the rows of triple seats in the tourist section was 15.5 inches.... It was virtually impossible, due to the narrow aisle width, for...attendants in the tourist section to go forward and accelerate the passengers toward the rear exit."

Nineteen sixty-one is a long time ago. However, the new DC-9 Super 80, not even off the line as we go to press, has an aisle width of only 19 inches; the new Boeing 767 has two 19-inch aisles. While it is clear that there are too many people being jammed onto planes, modern jet travel is not cost effective any other way.

What about fire, though? Is it inevitable that fire will break out when an airliner crashes? With our current jets, assuming the plane is not out of fuel, you can pretty much count on a big fire that will erupt rapidly, burn intensely and result in many deaths if the people don't get out with haste.

That does not have to be so, of course. If there were an incentive to design a crashworthy plane, it would be designed rapidly. The research has been going on for decades. The British recently developed a fuel additive that prevents the massive fireballs we generally see when planes crash. A company called Vulcan Industrial Packaging has developed a fuel-tank insert that disperses heat and prevents fuel explosions. But aircraft manufacturers regard people doing such research the way a tolerant parent regards the eccentric doodlings of a child--with a gentle smile, a pat on the head, a kind word. And then they go back to making the same airplanes.

Worse, the passenger is not being warned what to expect during a crash. He has no access to information that might be crucial someday. It is well known among accident investigators that many passengers would be alive today if they had known how to act after the crash took place. Most passengers don't even know that what they wear can affect their chances for survival in a crash. Double-knit materials, for example, melt and adhere to human skin, radically increasing the severity of burns.

Once a fire starts, getting burned is not the only problem you face. Aircraft interiors are decorated with materials that, when heated, emit smoke or poisonous gases or both, further increasing the risk of incapacitation or death. (Since hot smoke and gases rise, you should know that the more breathable air will be closest to the floor.)

Yes, there are many things we could do to make airliners more crashworthy and, yes, there are technologies to reduce the chance of postcrash fire and to reduce the toxic gases given off by aircraft interiors; but, well, they aren't being used, I'm not sure why. You can go around and around in this industry--talk with the Army, even visit the National Aviation Facilities Experimental Center in New Jersey, where those wonderful crashworthiness innovations that won't be put on airplanes are developed; ask the engineers, the pilots, the rule makers and the accident investigators, and you still may not have the answer. More than likely, though, you'll hear, "It's too new," or, "Those data are exaggerated," or, "We're looking into that area," or, "Not feasible on the current generation of aircraft...."

The litany goes on and on, and at the end of the song, you always find the passenger, popping a crisp, green American Express card onto the counter with a cocky grin and saying, "Well, when my number's up, my number's up."

And when the number comes up, you find the passenger once again. Only this time you find him here and there in a field. And standing over him, you find a group of men, like preachers in blue jump suits, shaking their heads and writing in their notebooks, "Thermal trauma" and "Multiple impact injuries" and "Severely fragmented" and other phrases that once more make it appear as if the event has done nothing more serious than invalidate a widely accepted theory.

why do planes crash? if you look long enough, and hard enough, you find the answer is often very simple: money

"It may be a good plane or a bad plane--but you can be sure of one thing: It's going to be cost effective."

"At this writing, there are seven airlines operating over water without life rafts."