Was the ValuJet crash in the Florida Everglades on May 11, 1996, an example of a “system accident”?

Joined Nov 2021
1,739 Posts | 523+
United States
1665853288347.jpeg

1665853317892.jpeg

The revised fatality count was 110 persons.

Yes, we’re going to be respectful to the victims and their families. Of course, we are. And I think part of that respect is very honestly looking for a cause and how to prevent similar disasters in the future.

complexity —> accident

And that’s the main idea of the system accident theory, that complexity comes at a higher cost than we generally acknowledge.
 
Joined Oct 2011
40,550 Posts | 7,631+
Italy, Lago Maggiore
As an IT manager I consider the "System Accident" a philosophical curiosity which I put with the cosmic pessimism of Murphy's Laws.
There is something wrong in the conception that more complex a system is and more possible a failure is: otherwise the Apollo Program would have never carried humans to the Moon [and not only one time].

The capabilities and the attention of the persons who manage complex systems are the potential cause of a failure.
At any level.

Then ... think to chips, the "hearts" of the computers.
Present chips are thousands times more complex than the chips of early 90's.
If we apply the SA paradigm to chips ... we couldn't understand why they work!
 
  • Like
Reactions: Multicolored Lemur
Joined Nov 2021
1,739 Posts | 523+
United States
Last edited:

“ . . the NTSB quickly determined that just before takeoff, 144[16] expired chemical oxygen generators, each slightly larger than the size of a tennis ball can, had been placed in the cargo compartment in five boxes . . ”

“ . . Laboratory testing showed that canisters of the same type could heat nearby materials up to 500 °F (260 °C). . ”

NTSB = National Transportation Safety Board

Apparently, one or several of these oxygen generators switched on and began generating oxygen — and this process also created a surface temperature of some 500 degrees Fahrenheit.

The oxygen made the fire worse, which burned through some control wires and brought the plane down.
 
Joined Dec 2021
8,823 Posts | 4,298+
Australia
Do you know how many things have to go wrong to cause an aircraft to crash?
I don't, I can only try to imagine. However, it's my understanding that aircrafts are built to far higher standards than say a car. Plus that many critical airplane components have up to triple redundancies.(?)

I've always been of the impression that a single catastrophic failure can cause a plane to crash. However, I'm saying that as a passenger. I'd be really interested in opinions from independent engineers.
 
Joined Apr 2010
50,502 Posts | 11,794+
Awesome
I don't, I can only try to imagine. However, it's my understanding that aircrafts are built to far higher standards than say a car. Plus that many critical airplane components have up to triple redundancies.(?)

I've always been of the impression that a single catastrophic failure can cause a plane to crash. However, I'm saying that as a passenger. I'd be really interested in opinions from independent engineers.

I'm not just talking about the components of the aircraft itself failing. Each aircraft goes through regular checking, and there is redundancy in the checking process, so any faults and repairs have to be signed off by a supervisor, so the whole system has to fail for a single component to fail.

Aircraft crashes are more often than not due to pilot error, not component faiure, and there are multiple systems and procedures there too, from psychological evaluations to re-certifications and training, to backup crew members.

The 737 MAX crashes were exceptional, and caused by both the failure of the manufacturer, and the regulator.
 
  • Like
Reactions: Multicolored Lemur
Joined Nov 2021
1,739 Posts | 523+
United States

“ . . the creation of an entire pretend reality that includes unworkable chains of command, unlearnable training programs, unreadable manuals, and the fiction of regulations, checks, and controls. Such pretend realities extend even into the most self-consciously progressive large organizations, with their attempts to formalize informality, to deregulate the workplace, to share profits and responsibilities, to respect the integrity and initiative of the individual. The systems work in principle, and usually in practice as well, but the two may have little to do with each other. Paperwork floats free of the ground . . ”
This is probably William Langewiesche’s most far-reaching criticism, that our organizations are not near as flexible and adaptable as we like to think they are.

And this guy with the hard name is probably the Michael Jordan of “system accident” theory! :winktongue:
 
Joined Nov 2021
1,739 Posts | 523+
United States

“ . . Conventional accidents—those I call procedural or engineered—will submit to our solutions, but as air travel continues to expand, we can expect capricious system accidents to blossom. Understanding why might keep us from making the system even more complex, and therefore perhaps more dangerous, too.”

* This is how Langewiesche ends his article.
This is the idea that as we work to reduce pilot error accidents and engineering accidents, we might pass the point of diminishing returns and make system accidents more likely [in a bad bargain fashion].
 
Joined Nov 2021
1,739 Posts | 523+
United States
The capabilities and the attention of the persons who manage complex systems
Especially the attention.

And I’d personally say, a steady eddie B+ level of attention is the sweet spot. Trying to maintain A+ attention for an 8-hour (or 10 hour) workday is just not viable.
 
  • Like
Reactions: Belgarion
Joined Nov 2021
1,739 Posts | 523+
United States
I've always been of the impression that a single catastrophic failure can cause a plane to crash.
Each aircraft goes through regular checking, and there is redundancy in the checking process,
This sounds pretty good. We’re going to have overlapping checks and we’re going to see any problems developing early. But there can also be unexpected bolts from the blue. For example . . .

1665939163731.jpeg

1665939237070.jpeg

1665939274846.jpeg

The movie Apollo 13 was generally pretty accurate. Once difference was the crew heard a small explosion 93 seconds after stirring the oxygen tanks. This made it harder to read the situation but the crew and mission control still figured it out.
 
Joined Oct 2011
40,550 Posts | 7,631+
Italy, Lago Maggiore
This sounds pretty good. We’re going to have overlapping checks and we’re going to see any problems developing early. But there can also be unexpected bolts from the blue. For example . . .

View attachment 59041

View attachment 59042

View attachment 59043

The movie Apollo 13 was generally pretty accurate. Once difference was the crew heard a small explosion 93 seconds after stirring the oxygen tanks. This made it harder to read the situation but the crew and mission control still figured it out.
During Apollo program some astronauts died [on Earth, it was Apollo 1 mission in 1967].
What probably is not clear about complicated systems is that it's natural that the potential failure probability tends to increase.
This is why attention and capabilities [professionalism] of the persons who manage those systems have to increase as well.

But if a human being can project a system, an other human being will be able to manage it.
 
Joined Jan 2021
4,992 Posts | 3,605+
Conch Republic. "WE Seceded where others failed"
I don't, I can only try to imagine. However, it's my understanding that aircrafts are built to far higher standards than say a car. Plus that many critical airplane components have up to triple redundancies.(?)

I've always been of the impression that a single catastrophic failure can cause a plane to crash. However, I'm saying that as a passenger. I'd be really interested in opinions from independent engineers.
As an Engineer whose thing is "Industrial Life Safety" I won't presume to speak for aircraft designers, just only adding my own 2c worth.

In the Industrial world, there is this thing called "Safety Matrix". What if THIS happens, yeah we've accounted for it. What if THAT happens, yeah we've accounted for it. What if THIS plus THAT happens at the same time? Yeah, we can handle that. It's what the matrix is all about.

But... suppose that THIS plus THAT plus ANOTHER THING all happen at the same time? We can't model this, we can't deal with it, and ESPECIALLY we can't train on it.

It's why the GOOD companies out there hyper-focus on preventing the first-order things from happening. So that when a second thing happens it doesn't compound it. The BAD companies out there ignore this and take an "acceptable risk". In the Energy sector, I won't name any names but the initials "B" and "P" come to mind.

As an engineering firm, we've turned down projects from a certain company.
 
Joined Dec 2021
8,823 Posts | 4,298+
Australia
I'm not just talking about the components of the aircraft itself failing. Each aircraft goes through regular checking, and there is redundancy in the checking process, so any faults and repairs have to be signed off by a supervisor, so the whole system has to fail for a single component to fail.

Aircraft crashes are more often than not due to pilot error, not component faiure, and there are multiple systems and procedures there too, from psychological evaluations to re-certifications and training, to backup crew members.

The 737 MAX crashes were exceptional, and caused by both the failure of the manufacturer, and the regulator.
Ah, of course. You're talking about the administrative models as much as the physical systems. Those systems are indeed rigorous, and obviously work. Proof is in the low number of crashes relative to air miles or even individual trips. The stats must be a fraction of <1% , surely (?)

Having exceptionally good physical components with rigorous admin procedures results in safe flying. EG QANTAS, Australia's national airline has never had an crash. From memory, I think there have been some near misses.

Can't help but try to imagine how things would be if cars were built to the same exacting standards and if driver training was as thorough. I guess the first thing would be the virtual end of private transportation. Not a bad thing in itself. But, not feasible in a culture built around the car and roads for them. Not to mention the manufacturing systems built around the car .


A true anecdote : Went to China i9n 1985
As an Engineer whose thing is "Industrial Life Safety" I won't presume to speak for aircraft designers, just only adding my own 2c worth.

In the Industrial world, there is this thing called "Safety Matrix". What if THIS happens, yeah we've accounted for it. What if THAT happens, yeah we've accounted for it. What if THIS plus THAT happens at the same time? Yeah, we can handle that. It's what the matrix is all about.

But... suppose that THIS plus THAT plus ANOTHER THING all happen at the same time? We can't model this, we can't deal with it, and ESPECIALLY we can't train on it.

It's why the GOOD companies out there hyper-focus on preventing the first-order things from happening. So that when a second thing happens it doesn't compound it. The BAD companies out there ignore this and take an "acceptable risk". In the Energy sector, I won't name any names but the initials "B" and "P" come to mind.

As an engineering firm, we've turned down projects from a certain company.

Good post, thanks.


Anecdote, parts are hearsay, parts are not: I visited China in 1985. We flew from one city to the next with CACC , piloted by red army pilots. Russian Ilyushins, turbo prop.

The true bit: When they took off, they would climb to cruising altitude quickly at an acute angle. Reverse when reducing altitude to land. When at cruising height they liked to turn off the a/c .My wife fainted.

Hearsay: That it was common practice to put deck chairs in the aisles when overbooked. That they would have trainee pilots perched on a stool placed near the pilot. From memory CACC had at least one fatal crash that I heard about.

The link below gives a long list of 'incidents and accidents:

 
  • Like
Reactions: Multicolored Lemur
Joined Oct 2009
4,420 Posts | 1,161+
San Diego
n
View attachment 59006

View attachment 59007

The revised fatality count was 110 persons.

Yes, we’re going to be respectful to the victims and their families. Of course, we are. And I think part of that respect is very honestly looking for a cause and how to prevent similar disasters in the future.

complexity —> accident

And that’s the main idea of the system accident theory, that complexity comes at a higher cost than we generally acknowledge.
The valuejet crash occurred because of a single point failure. NOT a complex one. Old oxygen generators that had been replaced and left in a box on the plane with several being uncapped. One of the uncapped generators ignited, and created both heat, and oxygen that significantly lowered the ignition temperature of surrounding materials. The resulting fire brought down the plane.
Someone not doing their job properly is not really an example of 'complexity' causing unforeseen consequences or costs. It could be that an added complexity of someone else double checking the maintenance crews work might have prevented a simple human error.

And the theory that complexity, itself, is a contributory cause is ironically simplistic. Doing ANYTHING regardless of how simple or complex it might be entails risks and the potential for the unforeseen.
In fact, a serious argument can be made for the idea that simplicity is more likely to have negative consequences, BECAUSE simplistic thinking fails to envision the complexity inherent in some tasks we chose to take on.

Example: There is no doubt that a solid steering column is a simpler and more direct means of connecting a steering wheel to the rack and pinion steering of a car. But that simplicity resulted in people being killed by the steering column piercing their chest in otherwise survivable collisions. A collapsible steering column is no doubt more complex, yet it eliminated those kinds of injuries.
By the same token, there is no doubt that a modern airliner is vastly more complex than the early radial engined airliners. And yet, air travel has become vastly safer as a direct result of added complexity, BECAUSE flying thru the air safely turns out to be a complex problem to solve. We literally went 10 full years without a single commercial airline fatality in the US, a far better record of per mile flown passenger safety than that ever attained with more simple systems of earlier eras. Despite the fact that in 1929 only 6,000 passengers flew on US airliners, compared to 674 million carried in 2021.

So complexity is often the Solution to making systems less prone to failure, or less likely to fail from a single cause. To Wit. A four engine aircraft has FOUR TIMES the chance of an engine failure as a single engine aircraft. But then, the failure of your single engine carries a far greater potential cost than having 3 of your 4 engines still working. Which is why all transoceanic airlines were required to have 4 engines. The number of required engines was only dropped to 2 as fanjet engines proved, thru hundreds of thousands of operational hours, to be five times as reliable as piston engines.

While its a great idea to have fewer points of potential failure in any system, rather often, the only way to reduce single point failure is to create systems with redundancy, or sufficient complexity that a catastrophic event would require Multiple things to go wrong in a causal chain, thereby reducing the likelihood that all those opportunities to break the causal chain had been missed.
 
Joined Nov 2021
1,739 Posts | 523+
United States
I visited China in 1985. We flew from one city to the next with CACC , piloted by red army pilots.
You got to see China before most of its modern economic growth! :)

I think China’s been very successful. Sustainable 7% or thereabouts economic growth for a number of years in a row. Many, many human beings lifted out of poverty.

Now, I don’t like things such as the Tiananmen Square Massacre of 1989. Of course I don’t. But optimist that I am, as China becomes more of a middle class society, plus social media, this kind of crap becomes less likely.

* since this is squarely political, I guess we should cut off the discussion at Dec. 31, 2000. But plenty to discuss in the 1990s.
 
Joined Nov 2021
1,739 Posts | 523+
United States
The valuejet crash occurred because of a single point failure. NOT a complex one. Old oxygen generators that had been replaced and left in a box on the plane with several being uncapped.
.
.
A collapsible steering column is no doubt more complex, yet it eliminated those kinds of injuries. . .
I disagree with the first point, but very much agree with the second. In many cases, we’re a long way from the diminishing returns of complexity and/or maybe there are some kinds of complexity we can easily absorb.

But as far as not loading the oxygen generators, we didn’t have a ghost of a chance.

First off, they were called “canisters.” The fact that they produced oxygen through a high-temperature reaction, that was viewed as an uncomfortable truth we must blunt or water down.

I’ve read that the lanyard — the part the passenger pulls down to start the reaction and start the oxygen flowing — was taped down. To me, that sounds better than some dopey plastic cap. The Wikipedia article on the crash says some of them were scotch-taped. I haven’t read that before, but even arguing that one on points, it still might be better than a dopey plastic cap.

Obviously, they should have fired them off in an empty field, like the workers did for one or two for fun. And then, since there’s a poisonous chemical residue inside the fired canister which we’re never going to get to, I guess that needs to be in a toxic chemical landfill [and locally!], although that really seems like overkill. And we humans seem more concerned with end-point safety, than along-the-process safety.

And the co-pilot actually helped the worker better distribute the load, I think 5 boxes around the circumference of the tire. Like I’m saying, not a ghost of a chance. If oxygen generators were viewed as potentially dangerous, potentially ignitable, the co-pilot could have rejected this cargo.

I’m going to try to pull an article from engineer Brian Stimpson that the steps leading up to this crash more clunked together than flowed together [my description].
 
Joined Nov 2021
1,739 Posts | 523+
United States
Last edited:
.
.
Step 3. Continental Airlines, a potential SabreTech customer, was planning an inspection of the facility, so a SabreTech shipping clerk was instructed to clean up the work place. He decided to send the oxygen generators to ValuJet's headquarters in Atlanta and labelled the boxes "aircraft parts". He had shipped ValuJet material to Atlanta before without formal approval. Furthermore, he misunderstood the green tags to indicate "unserviceable" or "out of service" and jumped to the conclusion that the generators were empty.

Step 4. The shipping clerk made up a load for the forward cargo hold of the five boxes plus two large main tires and a smaller nose tire. He instructed a co-worker to prepare a shipping ticket stating "oxygen canisters - empty". The co-worker wrote, "Oxy Canisters" followed by "Empty" in quotation marks. The tires were also listed.

Step 5. A day or two later the boxes were delivered to the ValuJet ramp agent for acceptance on Flight 592. The shipping ticket listing tires and oxygen canisters should have caught his attention but didn't. [but, No. :neutral: The very fact that they’re called “canisters.” The fact that we’re too embarrassed to say, Oh, by the way, these guys burn at 500 degrees Fahrenheit! ! ! And every organization does this kind of thing.] The canisters were then loaded against federal regulations, as ValuJet was not registered to transport hazardous materials. It is possible that, in the ramp agent's mind, the possibility of SabreTech workers sending him hazardous cargo was inconceivable.

Step 6. The ramp agent discussed the load with the co-pilot, who should have known better than to accept the material. The last line of defence was breached; the five boxes were taken into the forward cargo hold and stacked around the outer edge of one of the large main tires which was lying flat. The other main tire was leaned against the bulkhead.
.

===============

Now, Brian Stimpson seems to come down on the other side — that you can have complex, high-reliability organizations. And he gives the examples of a U.S. Nimitz-class aircraft carrier and the Diablo Canyon nuclear plant.
 
Joined Apr 2010
50,502 Posts | 11,794+
Awesome
In this crash, there were multiple things that had to have gone wrong for the accident to happen.

One, the oxygen cylinders did not have safety caps. If they had, they would not have activated, but the company (Sabretech) that handled them didn't have the caps, so they improvised by either wrapping the lanyards round the cylinders or cutting them off.
Two, someone wrote "Empty" on the manifest, rather than what the mechanics had written, which was "Expired". An expired cylinder still potentially has oxygen generating chemicals in it, it has simply passed its expiry date, while an empty canister cannot generate oxygen. If the person handling the cargo manifest had written "Expired", the pilots may well have not signed off on the cargo manifest.
Thirdly, cylinders were improperly packed with bubble wrap. The activated cylinder(s) melted the wrap and caused it to ignite. NTSB tests showed that an activated cylinder on its own wouldn't be enough to cause a fire. I believe they were also stored on top of some used aircraft wheel, so the rubber may have ignited.

All of these things had to happen to cause the accident to happen. It was not a case of complexity causing it, the complexity was there to stop the accident but all the potential safety checks failed.

EDIT: MulticoloredLemur beat me to it.
 

Trending History Discussions

Top