How we stretched our aviation system to the brink

Air travel is remarkably, astonishingly safe.

Every year, commercial US airlines take more than 800 million domestic passengers to their destinations, and in a typical year, zero of them are killed and very few are injured. It’s a track record made possible by a fairly intense commitment to safety.

But increasingly over the last few years, we’ve been testing these limits.

Right now the example in the headlines is Newark Liberty International Airport, which had three air traffic controllers on duty when it was supposed to have 14 and which over the last couple of weeks suffered three “communications blackouts” where air traffic controllers couldn’t communicate with approaching planes.

But it’s not just Newark. There has been an alarming rise in near-misses, communications blackouts, and other serious problems over the last few years at airports across the country, often a consequence of understaffing and high traffic. The midair collision near Reagan National Airport in Washington earlier this year that killed over 60 people was the deadliest air crash in the US since 2001.

Even with the Washington disaster, very few of these incidents, thankfully, get anyone killed. That’s because the US achieves the astonishing safety of our air travel system with defense in depth, which means a bunch of different things have to go wrong for a crash to happen.

Planes have on-board systems that should alert them if they’re too near another plane, even if air traffic control is sleeping on the job. There are backup emergency frequencies in case a communications blackout occurs. There are pre-published procedures for what to do in the event of a landing that looks unsafe, so if the pilots find themselves abruptly entirely out of contact with the ground, or coming in for a landing on a runway that they realize too late isn’t clear, they have been trained on precisely how to respond.

Pushing our defenses against disaster to the limits

In the risk analysis world, this is called the “Swiss cheese” model of how to prevent a disaster.

Every layer of a system made up of humans — with all our flaws — is going to have some gaps. Air traffic controllers will have a bad day, or be tired, or let something slip their mind. Technological solutions will have limitations and edge cases. Pilots will make mistakes or have a medical emergency or get confused by unusual instructions.

So each layer of the defenses against disaster has “holes” in it. But so long as the holes don’t all line up — so long as there isn’t a gap in every single layer at the same time — the defenses hold, and the planes land safely.

All of this means that despite the absurd strain on air traffic controllers, flying out of Newark is still almost certainly going to go fine.

But to achieve and maintain the exceptionally low accident levels that we’ve taken pride in over the last 20 years, “almost certainly” isn’t good enough. If you want not just 99.9 percent of planes but every single plane, every single year, to land safely, you can’t afford to let one of the layers of our defenses get more and more full of holes. A “near miss” where several layers of defenses fail should be taken incredibly seriously and prompt changes, even if one other layer sufficed to save us.

Any event which would have been a mass casualty event if not for the good judgment and quick thinking of the pilots, or if not for good weather, or if not for an activation of the automatic TCAS collision avoidance system, needs to be treated as a major emergency. If we let near-misses become business as usual, then it’s inevitable that some percentage of them will convert into actual mass disasters — as happened in Washington this January, where a helicopter and plane collided in an airspace that was known to have risky amounts of helicopter traffic and a bunch of alarming near-misses.

This is, of course, important in its own right, since every single commercial plane crash is a preventable tragedy. But it’s also, I sometimes fear, a symptom of a broader cultural malaise.

Plane crashes used to be horrifyingly common. We made them rarer through a comprehensive, aggressive program to add layers of defense against human error, revising our procedures through tragedy after tragedy. And we succeeded.

If you read the description of almost any plane crash that occurred in the 1970s, one thing stands out: it could not have happened today. Through mechanical improvements, procedural improvements, training improvements, and backup systems, we’ve built planes that are much, much harder to crash.

But then, as frequent deadly plane crashes became a distant cultural memory, we immediately started testing how far we could underresource those systems. We ignored near-misses and staffing shortages; we failed to heed warnings that our systems are in trouble and our procedures need changes. Boeing pushed out a dangerous new plane, hoping that other layers of our collective defenses against crashes would suffice to keep them in the air; in the US, those other layers were sufficient, but in poorer countries, they were not.

The parallels to other areas of modern life stand out. It used to be that half of children were dead before age 5; vaccination changed that, but in the world made safe by vaccination, parents grew skeptical of it. Now kids are dying of measles again.

It’s been observed that “what if we hike tariffs?” is an idea that comes around once a century or so, and goes badly enough we’re warned off it for a while. We have to touch the hot stove ourselves to learn that it burns us, it seems: the cultural memory doesn’t last for all that long.

This isn’t necessarily a bad thing, by itself. I wouldn’t want to live in a world where caution only ever ratchets up; safety is a trade-off, and it’s reasonable to relax precautions if we still get good results without those precautions.

But in some cases — like understaffing air traffic control or not vaccinating against measles — the precaution in question passes any reasonable cost-benefit calculation. Our “lesson” is taught by the deaths of innocent people.

And more terrifyingly, it’s not clear we’re even learning from our brush with reality. Were the deaths of children in Texas enough to turn around measles vaccination rates? Did the crash over the Potomac teach us to start paying more attention to near-misses?

It’s too early to say, but it doesn’t look good so far — and that is what really scares me.

A version of this story originally appeared in the Future Perfect newsletter. Sign up here!