The story of United Airlines Flight 173 is known to every airline pilot, because it is studied by every trainee:
Shortly after 5pm on the clear-skied evening of 28 December 1978, United Airlines Flight 173 began its descent to Portland International Airport. The plane had taken off from New York that morning and, after making a pre-scheduled stop in Denver, it was reaching its final destination with 189 souls on board.
As the landing gear was lowered there was a loud thump and the aircraft yawed slightly to the right. The flight crew noticed that one of the green landing gear indicator lights wasn’t lit. The captain radioed air-traffic control at Portland, telling them, “We’ve got a gear problem.”
Portland’s control agreed that the plane would orbit the airport while the captain, first officer and second officer worked out what to do. The passengers were told that there would be a delay. The cabin crew began to carry out checks. The flight attendants were instructed to check the visual indicators on the wings, which suggested that the landing gear was locked down.
Nearly half an hour after the captain told Portland about the landing gear problem, he contacted the United Airlines maintenance centre, informing the staff there that he intended to continue the holding pattern for another 15 or 20 minutes. He reported 7,000lbs of fuel aboard, down from 13,000 when he had first spoken to Portland.
United’s controller sounded a mild note of concern. “You estimate that you’ll make a landing about five minutes past the hour. Is that OK?” The captain’s response was ostentatiously relaxed: “Yeah, that’s a good ball park. I’m not gonna hurry the girls [the cabin crew].” United 173 had 30 minutes of fuel left.
The captain and his two officers continued to debate the question of whether the landing gear was down. The captain asked his crew how much fuel they would have left after another 15 minutes of flying. The flight engineer responded, “Not enough. Fifteen minutes is gonna – really run us low on fuel here.” At 18.07 one of the plane’s engines lost power. Six minutes later, the flight engineer reported that both engines were gone. The captain, as if waking up to the situation for the first time, said: “They’re all going. We can’t make Troutdale [a small airport on the approach route to Portland].” “We can’t make anything,” said the first officer. At 18.13, the first officer sent the plane’s final message to air-traffic control: “We’re going down. We’re not going to be able to make the airport.”
[...]
It’s a miracle that only ten people were killed after Flight 173 crashed into an area of woodland in suburban Portland; but the crash needn’t have happened at all. Had the captain attempted to land, the plane would have touched down safely: the subsequent investigation found that the landing gear had been down the whole time. But the captain and officers of Flight 173 became so engrossed in one puzzle that they became blind to the more urgent problem: fuel shortage. This is called “fixation error”.
This led the industry to create a set of principles and procedures known as CRM, or Crew Resource Management:
CRM was born of a realisation that in the late 20th century the most frequent cause of crashes wasn’t technical failure, but human error. Its roots go back to the Second World War, when the US army assigned a psychologist called Alphonse Chapanis to investigate a curious phenomenon. B-17 bombers kept crashing on to the runway on landing, even though there were no apparent mechanical problem with the planes. Rather than blaming the pilots, Chapanis pointed to the instrument panel. The lever to control the landing gear and the lever that operated the flaps were next to each other. Pilots, weary after long flights, were confusing the two, retracting the wheels and causing the crash. Chapanis suggested attaching a wheel to the handle of the landing lever and a triangle to the flaps lever, making each easily distinguishable by touch alone. Problem solved.
Chapanis had recognised that human beings’ propensity to make mistakes when they are tired is much harder to fix than the design of levers. His deeper insight was that people have limits, and many of their mistakes are predictable effects of those limits. That is why the architects of CRM defined its aim as the reduction of human error, rather than pilot error. Rather than trying to hire or train perfect pilots, it is better to design systems that minimise or mitigate inevitable human mistakes.
In the 1990s, a cognitive psychologist called James Reason turned this principle into a theory of how accidents happen in large organisations. When a space shuttle crashes or an oil tanker leaks, our instinct is to look for a single, “root” cause. This often leads us to the operator: the person who triggered the disaster by pulling the wrong lever or entering the wrong line of code. But the operator is at the end of a long chain of decisions, some of them taken that day, some taken long in the past, all contributing to the accident; like achievements, accidents are a team effort. Reason proposed a “Swiss cheese” model: accidents happen when a concatenation of factors occurs in unpredictable ways, like the holes in a block of cheese lining up.
James Reason’s underlying message was that because human beings are fallible and will always make operational mistakes, it is the responsibility of managers to ensure that those mistakes are anticipated, planned for and learned from. Without seeking to do away altogether with the notion of culpability, he shifted the emphasis from the flaws of individuals to flaws in organisation, from the person to the environment, and from blame to learning.
The science of “human factors” now permeates the aviation industry.