THE UNSTABLE SEED OF DESTRUCTION

We now come to a point where we can begin to answer the question addressed at the outset. A history of a nearly punctiform event, conducted with essentially unlimited resources, yields a remarkable document. Freed by wealth to explore at will, the NTSB could mock up aircraft or recreate accidents with sophisticated simulators. Forensic inquiries into metallurgy, ffactography, and chemical analysis have allowed extraordinary precision. Investigators have tracked documents and parts back two decades, interviewed hundreds of witnesses, and in some cases ferreted out real-time photographs of the accident in progress. But even when the evidence is in, the trouble only just begins. For deep in the ambition of these investigations lie contradictory aims: inquiries into the myriad of necessary causes evaporate any single cause or single cluster of causes from fully explaining the event. At the same time, the drive to regain control over the situation, to present recommendations for the future, to lodge moral and legal responsibility all urge the narrative towards a condensed causal account. Agency is both evaporated and condensed in the investigative process. Within this instability of scale the conflict between undefinable skill and fixed procedure is played out time and again. On the flightdeck and in the maintenance hangers, pilots and technicians are asked at one and the same time to use an expansive, protocol-defying judgment and to follow restricted set procedures. Both impulses – towards diffused and localized accounts – are crucial. We find in systemic or network analysis an understanding of the connected nature of institutions, people, philosophies, professional cultures, and objects. We find in localization the prospect of immediate and consequential remediation: problems can be posed and answered by pragmatic engineering. To be clear: I do not have the slightest doubt that procedural changes based on accident reports have saved lives. At the same time, it is essential to recognize in such inquiries and in technological-scientific history more generally, the inherent strains between these conflicting explanatory impulses.

In part, the impulse towards condensation of cause, agency, and protocol in the final “probable cause” section of the accident report emerges from an odd alliance among the sometimes competing groups that contribute to the report. The airplane industry itself has no desire to see large segments of the system implicated, and pushes for localization both to solve problems and to contain litigation. Following United’s 232 crash, General Electric (for example) laid the blame on United’s fluorescent penetration inspection and ALCOA’s flawed titanium.57 Pilots have a stake in maintaining the status of the captain as fully in control of the flight: their principal protest in the 232 investigation was that the FAA’s doctrine of “extremely improbable” design philosophy was untenable. In particular, the pilots lobbied for a control system for wide body planes that would function even if all hydraulic fluid escaped.58 But just in the measure that the pilots remain authors of the successful mission, they also have their signatures on the accident, and their recommendation was aimed at insuring that a local fix be secured that would keep their workplace control uncompromised. Government regulators, too, have an investment in a regulatory structure aimed at local causes admitting local solutions. Insofar as regulations protect safety, the violation of regulations enter as potential causal elements in the explanation of disaster. Powerful as this confluence of stakeholders can be in focusing causality to a point, it is not the whole of the story.

Let us push further. In the 1938 Civil Aviation Act that enjoined the Civil Aeronautics Authority to create accident reports, it is specified that the investigation should culminate in the ascription of a “probable cause” of the accident.59 Here “probable cause” is a legal concept, not a probabilistic one. Indeed, while probability plays a vital role in certain sectors of legal reasoning, “probable cause” is not one of them. Instead, “probable cause” issues directly from the Fourth Amendment of the U. S. Constitution, prohibiting unreasonable searches and seizures, probable cause being needed for the issuance of a warrant. According to Fourth Amendment scholar Wayne R. LaFave, the notion of probable cause is never defined explicitly in either the Amendment itself nor in any of the federal statutory provisions; it is a “juridical construct.” In one case of 1925, the court ruled that if a “reasonably discreet and prudent man would be led to believe that there was a commission of the offense charged,” then, indeed, there was “probable cause justifying the issuance of a warrant.”60 Put bluntly in an even older (1813) ruling,

probable cause was not “proof’ in any legally binding sense; required were only reasonable grounds for belief. “[T]he term ‘probable cause’ … means less than evidence which would justify condemnation.”61

Epistemically and morally, probable cause inculpates but does not convict. It points a finger and demands explanation of the evidence. Within the framework of accidents, however, in only the rarest of cases does malicious intent figure in the explanation, and this very circumstance brings forward the elusive notion of “human error.” Now while the notion of probable cause had its origins in American search and seizure law, international agreements rapidly expanded its scope. Delegates from many countries assembled in Chicago at the height of World War II to create the Convention on International Civil Aviation. Within that legal framework, in 1951 the Council of the International Civil Aviation Organization (ICAO) adopted Annex 13 to the Convention, an agreement specifying standards and practices for aircraft accident inquiries. These were not binding, and considerable variation existed among participating countries.

Significantly, though ICAO documents sometimes referred to “probable cause” and at other times to “cause,” their meanings were very similar – not surprising since the ICAO reports were so directly modeled on the American standards. ICAO defined “cause,” for example, in 1988 as “action(s), omission(s), event(s), condition(s), or a combination thereof, which led to the accident or incident.”62 Indeed, ICAO moved freely in its documents between “cause” and “probable cause,” and for many years ICAO discussion of cause stood extremely close to (no doubt modeled on) the American model.63 But to understand fully the relation between NTSB and ICAO inquiries, it would be ideal to have a case where both investigations inquired into a single crash.

Remarkably, there is such an event precipitated by the crash of a Simmons Airlines/American Eagle Avions de Transport Regional-72 (ATR-72) on 31 October 1994 in Roselawn, Indiana. On one side, the American NTSB concluded that the probable cause of the accident was a sudden and unexpected aileron hinge reversal, precipitated by a ridge of ice that accumulated beyond the de-ice boots. This, the NTSB investigators argued, took place 1) because ATR failed to notify operators how freezing precipitation could alter stability and control characteristics and associated behaviors of the autopilot; 2) because the French Directorate General pour Aviation Civile failed to exert adequate oversight over the ATR-72, and 3) because the French Directorate General pour Aviation Civile failed to provide the Federal Aviation Authority with adequate information on previous incidents and accidents with the ATR in icing conditions.64 Immediately the French struck back: It was not the French plane, they argued, it was the American crew. In a separate volume, the Bureau Enquetes Accidents submitted, under the provisions of ICAO Annex 13, a determination of probable cause that, in its content, stood in absolute opposition to the probable cause adduced by the National Transportation Safety Board. As far as the French were concerned, the deadly ridge of ice was due to the crew’s prolonged operation of their flight in a freezing drizzle beyond the aircraft’s certification envelope – with an airspeed and flap configuration altogether incompatible with the Aircraft Operating Manual.65

In both American and French reports we find the same instability of scale that we have already encountered in Air Florida 90 and United 232. On one hand both Roselawn reports zeroed in on localized causes (though the Americans fastened on a badly designed de-icing system and the French on pilot error), and both reports pulled back out to a wider scale as they each pointed a finger at inadequate oversight and research (though the Americans fastened on the French Directorate General and the French on the American Federal Aviation Authority). For our purposes, adjudicating between the two versions of the past is irrelevant. Rather I want to emphasize that the tension between localized and diffused causation remains a feature of all these accounts, even though some countries conduct their inquiries through judicial rather than civil authority (and some, such as India, do both). Strikingly, many countries, including the United States, have become increasingly sensitive to the problematic tension between condensed and diffused causation-contrast, for example, the May 1988 and July 1994 versions of Annex 13:

May 1988: “State findings and cause(s) established in the investigation.”

July 1994: “List the findings and causes established in the investigation. The list

of causes should include both the immediate and the deeper systemic causes.”66

Australia simply omits a “cause” or “probable cause” section. And in many recent French reports – such as the one analyzing the January 1992 Airbus 320 crash near Strasbourg – causality as such has disappeared. Does this mean that the problem of causal instability has vanished? Not at all. In the French case, the causal conclusion is replaced by two successive sections. One, “Mechanisms of the Accident,” aimed specifically at local conditions and the second, “Context of Use” (Contexte de Vexploitation”) directed the reader to the wide circle of background conditions.67 The drive outwards and inwards now stood, explicitly, back to back. Scale and agency instability lie deep in the problematic of historical explanation, and they survive even the displacement of the specific term “cause.”

There is enormous legal, economic, and moral pressure to pinpoint cause in a confined spacetime volume (an action, a metal defect, a faulty instrument). A frozen pitot tube, a hard alpha inclusion, an ice-roughened wing, a failure to throttle up, an overextended flap – such confined phenomena bring closure to catastrophe, restrict liability and lead to clear recommendations for the future. Steven Cushing has written effectively, in his Fatal Words, of phrases, even individual words, that have led to catastrophic misunderstandings.68 “At takeoff,” with its ambiguous reference to a place on the runway and to an action in process, lay behind one of the greatest aircraft calamities when two jumbo jets collided in the Canary Islands. Effectively if not logically, we want the causal chain to end. Causal condensation promises to close the story. As the French Airbus report suggests, over the last twenty-five years the accident reports have reflected a growing interest in moving beyond the individual action, establishing a mesoscopic world in which patterns of behavior and small-group sociology could play a role. In part, this expansion of scope aimed to relieve the tension between diagnoses of error and culpability. To address the dynamics of the small “cockpit culture,” the Safety Board, the FAA, the pilots, and the airlines brought in sociologists and social psychologists. In the Millsian world of CRM that they collectively conjured, the demon of unpredictable action in haste, fear or boredom is reduced to a problem of information transfer. Inquire when you don’t know, advocate when you do, resolve differences, allocate resources – the psychologists urged a new set of attitudinal corrections that would soften the macho pilot, harden the passive one and create coordinated systems. Information, once blocked by poisonous bad attitudes, would be freed, and the cockpit society, with its benevolent ruling captain, assertive, clear-thinking officers, and alert radio-present controllers, would outwit disaster. As we saw, under the more sociological form of CRM, it has been possible, even canonical, to re-narrate crashes like Air Florida 90 and United 232 in terms of small-group dynamic. But beyond the cockpit scale of CRM, sociologists have begun to look at larger “organizational cultures.” Diane Vaughan, for example, analyzed the Challenger launch decision not in terms of cold О-rings or even in the language of managerial group dynamics, but rather through organizational structures: faulty competitive, organizational, and regulative norms.69 And James Reason, in his Human Error invoked a medical model in which ever-present background conditions located in organizations are like pathogens borne by an individual: under certain conditions disease strikes. Reason’s work, according to Barry Strauch, Chief of the Human Performance Division at the NTSB, had a significant effect in bolstering attention to systemic, organizational dynamics as part of the etiology of accidents.70

Just as lines of causation radiate outwards from individual actions through individuals to small collectives, so too is it possible to pull the camera all the way back to a macroanalysis that puts in narrative view the whole of the technological infrastructure. Roughly speaking, this was Charles Perrow’s stance in his Normal Accidents.71 For Perrow, given human limitations, it was simply inevitable that tightly-coupled complex, dangerous technologies have component parts that interact in unforeseen and threatening ways.

Our narration of accidents slips between these various scales, but the instability goes deeper in two distinct ways. First, it is not simply that the various scales can be studied separately and then added up. Focusing on the cubic millimeter of hard alpha inclusion forces us back to the conditions of its presence, and so to ALCOA, Titanium Metals Inc., General Electric, or United Airlines. The alpha inclusion takes us to government standards for aircraft materials, and eventually to the whole of the economic-regulative environment. This scale-shifting undermines any attempt to fix a single scale as the single “right” position from which to understand the history of these occurrences. It even brings into question whether there is any single metric by which one can divide the “small” from the “large” in historical narration.

Second, throughout these accident reports (and I suspect more generally in historical writing), there is an instability between accounts terminating in persons and those ending with things. At one level, the report of United 232 comes to rest in the hard alpha inclusion buried deep in the titanium. At another level, it fingers the maintenance technician who did not see fluorescent penetrant dye glowing from a crack. Read different ways, the report on Air Florida flight 90 could be interpreted as spotlighting the frozen pitot tube that provided a low thrust indication; read another way the 737’s collision impact into the Fourteenth Street Bridge was due to the pilot’s failure to de-ice adequately, to abort the takeoff, or to firewall the throttle at the first sign of stall. Protocol and judgment stood in a precarious and unstable equilibrium. What to the American investigators of the Roselawn ATR-72 crash looked like a technological failure appeared to the French team as a human failing.

Such a duality between the human and the technological is general. It is always possible to trade a human action for a technological one: failure to notice can be swapped against a system failure to make noticeable. Conversely, every technological failure can be tracked back to the actions of those who designed, built, or used that piece of the material world. In a rather different context, Bruno Latour and Michel Callon have suggested that the non-human be accorded equal agency with the human.72 I would rather bracket any fixed division between human and technological in our accounts and put it this way: it is an unavoidable feature of our narratives about human-technological systems that we are always faced with a contested ambiguity between human and material causation.

Though airplane crashes are far from the world of the historian of science and technology or that of the general historian interested in technology, the problems that engaged the attention of the NTSB investigators are familiar ones. We historians also want to avoid ascribing inarticulate confusion to the historical actors about whom we write – we seek a mode of reasoning in terms that make sense of the actors’ understanding. We try to reconstruct the steps of a derivation of a theorem or the construction of an object just as NTSB investigators struggle to recreate the Air Florida 90’s path to the Fourteenth Street Bridge. We interpret the often castaway, fragmentary evidence of an incomplete notebook page or overwritten equation; they argue over the correct interpretation of “really cold” or “that’s not right.”

But the heart of the similarity lies elsewhere, not just in the hermeneutics of interpretation but in the tension between the condensation and diffusion of historical explanation. The NTSB investigators, like historians, face a world that often doesn’t make sense; and our writings seek to find in it a rational kernel of controllability. We know full well how interrelated, how deeply embedded in a broader culture scientific developments are. At the same time we search desperately to find a narrative that at one moment tracks big events back to small ones, that hunts a Copemican revolution into the lair of Copernicus’s technical objections to the impure equant. And at another moment the scale shifts to Copernicus’s neo-Platonism or his clerical humanism.73 At the micro-scale, we want to find the real source, the tiny anomaly, asymmetry, or industrial demand that eats at the scientific community until it breaks open into a world-changing discovery. Value inverted, from the epoch-defining scientific revolution to the desperate disaster, catastrophe too has its roots in the molecular: in a badly chosen word spoken to the АТС controller, in a too sharp application of force to the yoke, in a tiny, deadly alpha inclusion that spread its flaw for fifteen thousand cycles until it tore a jumbo jet to pieces.

At the end of the day, these remarkable accident reports time and time again produce a double picture printed once with the image of a whole ecological world of causation in which airplanes, crews, government, and physics connect to one another, and printed again, in overstrike, with an image tied to a seed of destruction, what the chief investigator of flight 800 called the “eureka part.” In that seed almost everyone can find satisfaction. All at once it promises that guilty people and failed instruments will be localized, identified, confined, and that those who died will be immortalized through a collective immunization against repetition through regulation, training, simulation. But if there is no seed, if the bramble of cause, agency, and procedure does not issue from a fault nucleus, but is rather unstably perched between scales, between human and non-human, and between protocol and judgment, then the world is a more disordered and dangerous place. These reports, and much of the history we write, struggle, incompletely and unstably, to hold that nightmare at bay.