A Normal Accident, Alas
Complex systems are inherently vulnerable to “normal accidents” (also called “system accidents”). A complex system is one with a large number of components that interact. Moreover, these parts are “tightly coupled,” meaning inter alia that delays in performance of any element can cause the failure of the entire system, and that the order of the performance of these components is invariant. That is, the functioning of each part is necessary to the operation of the whole and the parts must operate in a specific sequence. That is, tightly coupled, complex systems have the potential to be like the one-hoss shay: they work fine until they don’t, and when they don’t the entire system breaks down. (Oliver Wendell Holmes Sr., the author of the poem, could be viewed as the true expositor of the theory of normal accidents).
Aviation is a complex system. In fact, it is a complex system of complex systems, in a fractal sort of way. At the micro level, planes themselves are complex, as are the people who fly them (individually and as members of crews) and control (coordinate) them. Zooming out a bit, a particular airport is a complex system. Reagan National (DCA), where the recent horrible crash occurred, is an example of that, and it is in fact a particularly complex complex system. It has a lot of planes landing and taking off, and these operations (and the preceding operations on the ground) must occur in a precise sequence. It also has another element complexity that is arguably unique to DCA–a massive volume of helicopter traffic operating in close proximity to the runways. The airport is also an artifact of the past, with short runways, and planes must often make sharp turns after takeoffs and during approaches. These conditions tighten the couplings and reduce system slack. For these reasons, DCA has always been my least favorite airport. Every takeoff and landing can be an adventure.
What happened at DCA earlier this week is highly likely to have been a normal accident in this particular complex system. Specifically, a series of actions and events, individually trivial, were deadly when interacting in this complex system.
Initial indications are that the Army Blackhawk helicopter that collided mid-air with the American Airlines CRJ-701ER was operating 100 feet above the allowed altitude (200 feet) at the time of the collision. Indeed, it gained that additional altitude shortly before the collision (after having flown at the correct altitude for some distance). Why? Perhaps the black boxes will provide some insight. Maybe not. Distraction, a gust of wind, a simple mistake. Could be myriad things–or several things interacting in a complex way.
Another element of the complex system is air traffic control. Immediately prior to the crash, Reagan ATC radioed the helo, asking if it saw the CRJ. The recordings I’ve heard don’t indicate a response: I’ve seen it conjectured that the helo was operating on a different frequency, but I have no idea. Regardless, the communication was extraordinarily ambiguous. Pilots can’t necessarily identify an aircraft type, especially at night. Moreover, there were multiple aircraft around, so which one was ATC referring to? How could the helo crew know? How could the controller know that the crew knew? Adding some directional information, like “at your 10 o’clock high descending left to right” would have focused attention on the plane on a collision course and made corrective action far more likely.
It was on a collision course because of a previous ATC instruction for the plane to shift from landing on Runway 1 to Runway 33.
The controller communicating with the plane and helo may have been bandwidth constrained. (Lack of “slack” in a complex system is a major contributor to its risk of failure). There should be two controllers on duty, one specifically handling helo traffic. But his supervisor had let him leave early, and the sole controller had to perform double duty. How familiar was he with controlling helos? Even if he was, was his ability to do so reduced by the greater workload put on him? That is, was the seemingly innocuous decision to let one person go home fatal because it eliminated vital slack in the system?
The role of the supervisor demonstrates another aspect of complex systems. They are often embedded in organizational and institutional structures (or perhaps better thought of as vice versa) and organizational and institutional factors can cause normal accidents. This is why a “safety culture” embedded in an organization is often essential. Bad organizations are conducive to system failure. (ValueJet, one of the canonical examples of a normal accident, was notorious for its lax safety culture. The erosion of Boeing’s culture is likely to prove another widely-taught case study).
Changing any one of these things probably would have meant no accident. That is, each element was a necessary condition for the accident. Individually they were low probability events, perhaps, but the probability of a sequence of low probability events is not zero. Very small, perhaps, but not zero.
The rarity of air crashes in the US demonstrates that the complex aviation system is very robust. This crash demonstrates that it is nonetheless at risk of an accident. That’s why they are called “normal accidents.” They are the normal (and indeed inevitable) part of the operation of a complex system.
So what is to be done? Well, one of the lessons of the study of complex systems and normal accidents is that it is impossible to reduce the risk of system failure to zero. Moreover, measures intended to improve safety (especially in the aftermath of one kind of failure) can actually make things worse, or at least, create the potential for different kinds of normal accidents. Adding some sort of safety mechanism makes the system more complex–especially if its proper utilization depends on the correct actions of other parts (notably, the operators of the system). (The 737 Max crashes are arguably on example of that). So a new piece may shut off one causal chain, but open another. Whether this is beneficial on net is impossible to say, precisely because the behavior of complex systems is inherently stochastic with a massive number of possible causal pathways relating actions of parts of the system to the operation of the whole.
Every normal accident tends to be unique. This one will no doubt be found to be as well.
Horrible accidents like this one inevitably lead people to ask: “who is to blame?” In normal accidents, its not too much of an exaggeration to say “everyone and no one.” In legal terms, this could be considered a case of “contributory negligence.” The negligence of multiple parties combined to cause the accident. But in complex systems everybody can do exactly what they are supposed to–that is, every human actor is non-negligent–and a normal accident occurs nonetheless.
Viewed broadly, this is all about complex chains of causation, so many chains that not all of them can be even identified, let alone understood or their probabilities calculated. Searching for someone to blame usually involves trying to find a sufficient condition for failure. But in most normal accidents, no single action is sufficient to cause it. Instead, a confluence of necessary conditions is “the” cause: not an individual cause, but multiple causes, the absence of any of which would mean no accident. For example, no altitude deviation by the helo. Even the helo having operated at a slightly higher or lower speed, or taking off slightly earlier or later, so it was at a different point in space at the time of the crash. The CRJ landing on Runway 1 instead of Runway 33. One could go on almost ad infinitum.
These kinds of issues come up all the time for me. For example, in my research: what caused the Great Financial Crisis? Will mandatory clearing eliminate the possibility of future Great Financial Crises? Why did oil prices spike and then crash in 2008? In my litigation work: determining what caused a particular price movement, and in particular, were the deliberate actions of one agent necessary for that price movement to occur.
Or in my avocation, history. My favorite example is “What Caused WWI?” Mountains of scholarship identify various necessary conditions: if the Germans hadn’t done this; if the Austrians hadn’t done that; if the Russians (or Serbians or British or French) had done something different, WWI wouldn’t have happened! So who caused it? Well, this would be an example where “everyone” is probably closest to the truth. Everyone played a vital role.
The world geopolitical system is inherently complex. The pre-1914 alliance system created tight coupling. Military logistics–notably the complexities of mobilization and the coordination of troop movements by rail–also created tight coupling. Historians have identified these as causes of the war. Yes, but only in the sense that they were parts of the system that operated as conditions necessary to turn “some damned thing in the Balkans” into a world war.
People want simple answers. They are impossible in complex systems.
Well, maybe not: “shit happens in complex systems” is both simple and accurate. Murphy’s Law is also informative.
All that said, the fact that something is normal doesn’t make it good. In fact, the normal is horrible. The victims and their families have my deepest condolences and should not view this as a rationalization of their tragic loss.
It may be a simple failure.
Suppose the FAA ruled that no other flights were permitted in the glide path for landing at runways at DCA, no exceptions.
Two corridors would exist (four for contrary winds).
By contrast,families are complex systems, more complex where there are step fathers or mothers, communities are more complex where loyalties are divided, etc.
Yet mostly things rub along without crashing.
In my view (having seen some fatal FUs) it’s a chain of simple errors that cause disasters, not complexity.
Comment by philip — February 1, 2025 @ 6:14 pm
Profsplaining ATC procedures and air accident investigation. The NTSB can stand down now.
Weirdly not a single mention of DEI, which is what this tragic incident has become all about (and presumably what motivated Craig to go off piste with this post). In this grim new world, every disaster can now be attributed to this.
Comment by David Mercer — February 2, 2025 @ 3:48 am
Many years ago a new acquaintance asked “What do you do?” “Petrochemical manufacturing.” “Isn’t that dangerous?” “Not if we do it right.”
By golly we took safety seriously. Even then, years later and having been properly trained in my industrial days, I once overlooked a nasty potential danger in an academic lab. It happens. The art is to keep the frequency vanishingly small.
One thing that struck me as a newcomer to the industrial firm was the care that was taken with vocabulary. Once you know some people misinterpret “inflammable” you don’t bemoan the state of the schools, you swap to “flammable”. The second action might save blood and treasure whereas the first won’t. Similarly the word “accident” was avoided – it turned out that too many people used “it was an accident” as a lazy way of avoiding responsibility for thought and action. We concentrated on “incidents” which included near misses and even simple oversights that hadn’t led to an incident.
One aspect of vocabulary did amuse me. When someone said that such-and-such an action was “forbidden” that was interpreted to mean that the firm rather disapproved of it. When the firm disapproved so strongly that it would kick up a ruckus the word used was “verboten”.
Why am I rabbiting on about vocabulary? I saw a comment from a highly experienced British pilot which may bear on your point about the traffic controller failing to direct the chopper pilot where to look for the airliner. The Briton said that he had often been disappointed by American ATCs because of the sloppy and incomplete way they expressed themselves. By contrast he made no criticism of their other technical abilities, he merely stated that they communicated poorly. Given that he had dealt with ATCs all over the place, often speaking English as a foreign language, that seemed to me to be a substantial criticism. I wonder whether his experience is common?
So my proposal is that ATC supervisors should routinely listen to recordings of their ATCs in action and act to improve their communication skills if necessary. If this is already done then the Briton’s complaint presumably boils down to it not being done well enough.
Comment by dearieme — February 2, 2025 @ 9:40 am
@dearieme: Interestingly, your proposal is reminiscent of advice I’ve heard as a motorcyclist, which is to narrate your riding to yourself as a way to be more aware of your actions and how to improve.
@Prof: As somebody who works in aerospace, I find this post extremely well thought out, and your systematic explanation is exactly the approach that our industry takes (In fact, it is interesting that the tools of financial system analysis led you to such an accurate description of a system that you are presumably much less familiar with). However I disagree on the conclusion: For me, an enormous red flag is the idea that uncontrolled (i.e. military) traffic seems to be allowed to cross controlled airspace basically at their own discretion, on a see-and-avoid basis, in the dark. I understand the reasons why this is allowed, but since it is not controlled by the system, I think it’s unfair to call it a failure (albeit a normal failure) of the system, since that system was denied the opportunity to control an obvious risk. I think the likely outcome of the investigation is a recommendation that, at least in peacetime, that military traffic enter the traffic pattern subject to the permission and control of ATC, just like any other aircraft, albeit flying on a different flightpath to airline traffic.
Comment by HibernoFrog — February 4, 2025 @ 4:19 am
@dearieme. Yes, US ATC/ Pilot comms are notoriously filled with slang, local terms not known outside the local airport, etc. My fave is Teterboro; they’ll ask you to report the Holland Tunnel. “I’m in an airplane, how am am I supposed to see an underwater tunnel?”
@Hiberno. The airspace is Class B for everyone-civil and military both require clearances as did PAT 25. The issue is using visual separation rather than standard IFR separation criteria. The politics of DCA are horrible- Congress wants more flights; the Secret Service would close the whole place for “security reasons”; everyone wants safety if it doesn’t impinge on their wants.
To add to the SWP’s post, I’m coming to opinion this is case of “procedural drift”. No one would have approved the mix of RWY 33 and the helicopter right underneath it with only 200’ of planned separation. It certainly in a written plan approved that way. What happened is gradual acceptance of narrower and narrower margins. Just the week before there was NMAC with and airliner doing a TCAS avoidance climb. Normalization of deviance.
I was in a military A-10 kid-air that while in daylight was almost the exact same geometry and height. It happens quick-the video does not come close describing it.
Comment by The Pilot — February 4, 2025 @ 10:21 am
“The airspace is Class B for everyone-civil and military both require clearances as did PAT 25.”
Thanks for the correction. I was under the impression that military aircraft had a sort-of standing permission to enter and just had to declare themselves, provided they stayed in their approved corridor.
The solution would seem to be simple, then: All traffic in controlled airspace should respect usual separation distances, controlled by, obviously enough, the air traffic controller. As you say, vertical separation of only 200 feet is pretty extreme, especially when we consider that the reduction from 1000ft to 2000ft vertical separation for the RVSM standard required quite a lot of extra hardware and control.
Comment by HibernoFrog — February 5, 2025 @ 7:19 am
I have to correct my autocorrect it certainly was NOT written as 200’. Standard visual separation is 500’ and IFR separation is 1,000’ until F290 where RVSM applies. High levels was a special due air density and every flight is under positive control. While the Army operates in civilian airspace and under an ATC Class B clearance, it’s still a visual environment and I’m sure the Army crews and ATC believes they are on a “mission from God”.
Comment by The Pilot — February 5, 2025 @ 5:58 pm
@The Pilot – You might be more correct than you think: The aircraft’s flight data recorder apparently showed 325 feet (plus/minus 25) and I’ve heard no suggestion that they had deviated from their intended flight path. The maximum allowed altitude for the helicopter was 200 feet, so I would understand from that that the planned vertical separation between the normal glide path and the helicopter corridor was only about 100 feet. Fair enough that you say it’s a visual environment, but in that case the helicopter should have been maintaining 1000 feet horizontal separation (if I remember VFR rules correctly) since the vertical separation was, for all practical purposes, nil. And that being the case, I don’t think that any ATC would tolerate airliners maintaining horizontal separation between each other by themselves – they’d be neatly sequenced up into a traffic pattern that keeps them well away from each other, and ATC would be able to see if they were getting closer than desired. So I still maintain that in this crash, ATC was either being denied proper control of the traffic, or was choosing not to exercise proper control of the traffic.
Comment by HibernoFrog — February 6, 2025 @ 6:37 am
@HibernoFrog & @ThePilot. ATC was cutting it way to close for comfort. As you both point out, there was very little margin for error, and an an error outside that margin occurred.
Comment by cpirrong — February 8, 2025 @ 2:41 pm
@HibernoFrog & @ThePilot. Small margin for error is another way of saying “tight coupling.” The procedures at DCA made the coupling tighter than necessary and increased the odds of a normal accident.
Comment by cpirrong — February 8, 2025 @ 2:50 pm