How Safe Is This Flight?

The litany of errors would have been laughable--if 37 people hadn't lost their lives. USAir Flight 1016 was on its final approach to Charlotte, N.C., on a stormy evening last July when a deadly phenomenon known as wind shear caught the pilots by surprise. Plenty of other people knew the weather was dangerous: USAir had evacuated the rampway due to lightning; two planes waiting for takeoff had decided to hold on the ground. Another departing plane had radioed the control tower that there was a heavy storm directly overhead. But little of this information was passed to the crew. The USAir pilots did try to abort the landing when they were suddenly blinded by torrential rain. But the captain apparently became disoriented and told the copilot to angle the plane's nose down just when he should have climbed. The DC-9 hit the ground at 142 mph and broke apart as it skidded through a grove of trees. The nose came to rest on a road; the tail rammed an empty house. The cabin shattered into a gruesome tangle of metal, bags and bodies-including that of a 9-month-old baby ripped from her mother's arms.

Two weeks ago the National Transportation Safety Board officially cited pilot and controller error as the cause of the crash -but clearly, far more had gone wrong. The Air Line Pilots Association charged that the crew had been "lured into a dangerous situation" because they were not given vital weather information. The controllers in Charlotte countered that they'd done their jobs. In the cockpit, the on-board windshear detector didn't sound because it is programmed not to when the flaps are being deapproach. On a grassy field 10 miles away, a specialized Doppler radar that would have provided better weather information hadn't been installed, in part because federal officials were haggling with the landowner who wanted $2 million for the plot. The unsettling truth was that USAir 1016 crashed right through holes in the system designed to protect aircraft from the decades-old problem of wind shear, and so could any other plane, at any time.

Federal Aviation Administration officials like to boast that USAir 1016 was the first fatal U.S. jet crash in more than 26 months. But it was also a wake-up call for an industry that has been lulled into complacency in recent years. By the end of 1994, 328 Americans had died in 34 commercial-airline crashes, large and small--many of them due to old problems, like wind shear, icing and fires, that should have been solved long ago. This week the NTSB will grill FAA officials about why they haven't done more to prevent runway accidents. That will happen in a hearing on the collision of a TWA jet and a Cessna in St. Louis that killed two people last November. Last week the board revealed that the pilot of an American Eagle turboprop that crashed in Raleigh, N.C., last December, killing 15, had become confused after misinterpreting a cockpit light; he'd already resigned under pressure from another airline. Meanwhile, experts remain haunted by the mystery of why USAir Flight 427 plunged into the ground near Pittsburgh at 240 miles per hour last September. Could the 1,100 other 737s in the U.S. commercial fleet be vulnerable as well? "I dearly wish we could find something wrong then we could fix it." says Paul Russell, Boeing's chief engineer for airplane safety.

When crashes occur, many people worry about problems with the airline, or the aircraft model. But while some carriers and models do have more troubling records than others, the greatest risks can be traced to the system that oversees the airline industry. NEWSWEEK has learned that:

The technology that runs the nation's air-traffic-control system is so antiquated that controllers still record their instructions to planes in longhand on paper--a practice that dates to the early days of commercial aviation.

U.S. air traffic is expected to double to 1 billion passengers a year by 2010, but already many airports are seriously congested. Eight incidents in which controllers sent planes too close to each other over southern California this year prompted the FAA to conduct a special review of procedures there.

Unlike international carriers, many U.S. domestic airlines are vulnerable to sabotage. There is no requirement that airlines X-ray checked luggage, or ensure that every suitcase actually belongs to a passenger who gets on the flight.

Federal prosecutors are reviewing the actions of a high-ranking FAA official who allegedly helped derail a probe into counterfeit airplane parts. The Transportation Department's inspector general, Mary Schiavo, says that FAA management has undermined several prosecutions by denying that counterfeit parts represent a safety hazard.

The U.S. aviation industry can no longer claim to be the world's safest, as it has for decades. MIT statistician and NEWSWEEK consultant Arnold Barnett says the risk of being killed is now greater on U.S. commercial flights than on major international airlines (chart).

FAA Administrator David Hinson says the U.S. safety record "speaks for itself." Since the 1960s, the accident rate has dropped by 85 percent, while the volume of flights has doubled. So why does the prospect of a plane crash frighten us so much--when the risk of drowning in the bathtub is 10 times higher? Because the statistics don't reflect the powerful emotional impact that an air disaster has-or the ripples it sends through the economy. The crash of Flight 427 in Pittsburgh not Only killed all 132 people on board and disrupted their families forever. it also cost USAir $40 million in canceled bookings and half of its stock price. The company, which employs 44,328, may yet go bankrupt, its accounting fir warned last week. Each plane crash also vividly reminds us of how vulnerable are. hurtling at 500 miles per hour, seven miles above the earth, sealed in a pressurized metal can. Flying requires faith that the technology is reliable and the humans won't make errors--and that faith is tested anew each time a plane goes down.

The experience of 1994 was so bad that even Transportation Secretary Federico Pena thinks it's time for a change. "I have been to too many crashes," he said late last year, as he ordered a safety audit of the nation's airlines and announced a "zero accident" goal. Pena is also pushing a proposal to separate the air-traffic-control operation into a government-run corporation. Major changes are needed; the FAA is a notoriously inbred bureaucracy that moves at glacial speed. Last month it announced with fanfare a recommendation to hold commuter airlines to the same safety standards as commercial jets - something the NTSB had recommended in one form or another for 23 years. Even seemingly simple changes seem beyond the agency's capability. Since the 1950s, experts have urged the FAA to standardize the confusing mishmash of runway signs at different airports that have contributed to ground collisions. After eight people died in a runway accident in Detroit in 1990, the FAA finally published specific rules for the signs, but it gave 570 airports until 1994 to comply. Some still haven't. Robert David, the FAA's manager of airport-safety operations, calls that "an ambitious date you can't expect it to be implemented overnight."

Part of the FAA's foot-dragging has to do with complex federal procurement rules, which virtually guarantee that new technology will be obsolete before it can be purchased. Another problem is the agency's dual mandate to both promote and police the aviation industry, which requires it to weigh the benefit of any proposed safety rule against the cost to the industry. Geraldine Frankowski of the Aviation Consumer Action Project, a Washington watchdog group, says, "The only message the public can take is that if enough passengers die in a 12-month period, we'll change the rules." But even a pattern of fatal accidents doesn't always prod the agency into making changes---or admitting that safety hazards might exist. Inspector General Schiavo says FAA managers "tell us they don't want to label things a problem because they don't want to frighten the public or hurt the economic viability of aviation."

Given that attitude, it's amazing that the U.S. aviation industry has been as safe as it is. Experts agree that but for the skill of pilots, controllers and mechanics-and the willingness of many airlines to go beyond FAA minimum standards-there would be far more problems. And with traffic steadily increasing, that track record may become tarnished unless the industry and its regulators respond faster to well-known hazards. A look at some of the major safety issues facing U.S. aviation shows why:

When Pena visited a German air-traffic control museum on a recent trip, he was stunned to see, displayed among the antiques, the same standard radar display used by most American controllers today. Worse, the Germans told Pena that much of their state-of-the-art technology had been purchased in the United States. Fourteen years after Ronald Reagan fired the striking airtraffic controllers, the system is still a lightning rod for controversy. This time it's not just stressed and overworked controllers, but outmoded equipment too. The FAA's own plan to modernize its ATC system has been bungled, officials admit. Once expected to cost $4.3 billion and start operating in 1993, the new system is now at least $2.7 billion over budget, and years behind schedule.

What's in use now is antiquated. Airtraffic-control facilities experience an average of 2,000 power failures a year, and some backup computer systems are so old that the only technicians who can repair them are dying off or retiring. Then there's the paper flight-strip system. These strips were lined up in the wrong order on a metal easel at the O'Hare tower on Feb. 25. As the controller started to rearrange them, he accidentally steered a departing British Airways 747 onto a collision course with a departing United Airlines DC-10. The controller quickly realized his error and alerted the DC-10 to climb. But the two jumbo jets, carrying 507 people, nevertheless missed each other by a mere 300 feet.

Most primitive of all is the system for guiding planes over the Atlantic Ocean. The FAA has no radar or radio system powerful enough to track them all the way across the ocean. Pilots are supposed to report their positions about once an hour to the FAA's en-route center in Islip, on New York's Long Island. But to do so, they have to use prewar high-frequency radio technology. The pilots contact a private company called ARINC, which types their messages into a computer that sends it to a printer at the FAA center. There it is given by hand to a controller. If the controller decides that two planes may come too close, it can take up to 30 minutes to alert the pilots via ARINC; it can also take half an hour for pilots encountering turbulence to get clearance to change altitude. If the situation is dangerous, international aviation rules allow pilots to change altitudes on their own, and inform controllers later. But that can mean straying into another plane's path.

Why can't pilots talk to controllers over cellular phones like the ones passengers have at their seats? Cell phones aren't reliable enough, the FAA says. The agency is waiting for new communications and navigation equipment based on satellite technology that will track the location of all planes at all times. California controllers are testing it now to talk with planes in the Pacific; dispatchers in Tokyo use similar technology today to guide taxis. But it's still unclear whether the new system can meet its 1998 target date.

A similarly byzantine procurement process has stalled the FAA's giant modernization program, but that's not all that's gone wrong. Congress approved the broad outlines of the plan in 1982, and the first priority was to build new workstations and backup equipment for frontline controllers. Originally, the plan was to use off-the-shelf technology with specialized software. But the contract awarded to IBM called for one of the largest and most complex computer networks ever envisioned. And the FAA kept tinkering with the specifications. By 1993, officials had admitted it was years behind schedule, and not even IBM was confident it would work as intended. Last year outside consultants concluded that the design "has a high risk of failure" and that much of the project might have to be scrapped. Desperate to salvage at least some of the work, Hinson brought in another consultant, George Donohue of the Rand Corp., who is now attempting a major reorganization from busting up the "cliques" in the FAA's engineering division to hiring better software engineers. Steven Zaidman, FAA's deputy director of communications, navigation and surveillance, insists, "We're on the road to modernization now" and just in time. "We know we can't keep the [old equipment] operating forever."

If flying through rough weather makes you uneasy, it, s a legitimate fear. Crashes related to thunderstorms have killed more U.S. air travelers in the last 20 years than any other hazard, says MIT's Barnett. In the summer months, they've contributed to more fatalities than all other problems combined. The biggest threat is from wind shear --a sharp change in wind speed and direction over a short distance. Wind shear is particularly dangerous when it occurs near ground level and in "microbursts," which can slam a jet aircraft into the ground like an unseen fist (chart, page 23). Combating wind shear first became a priority in 1982, when 152 people were killed aboard a Pan Am 727 attempting to land in New Orleans. Three years later, after 137 more died when a wind shear smashed a Delta Air Lines L-1011 into pieces in Dallas-Ft. Worth, the FAA decided to invest millions of dollars in Terminal Doppler Weather Radars (TDWR) that could provide advance warning to controllers and pilots.

Raytheon delivered 47 Dopplers on schedule in 1992, and they were slated for installation at the most wind-shear-prone airports in the nation. But today, Doppler radar is fully operational only in three of them-Houston, Memphis and St. Louis. Most of the others have been stalled by petty political battles, disputes over land prices and pesky environmental problems. The preferred location in San Juan, Puerto Rico, turned out to be the site of a historic fort. Indian artifacts were discovered at the site in Dallas; in Tampa, Fla., the problem was endangered turtles. Long Island residents blocked Doppler for Kennedy and La Guardia because they feared radiation, and Sen. Alfonse D'Amato wanted to buy radar made by a local manufacturer. "Everybody's been a little frustrated on this one," says Jim Evans, whose MIT weather-research group helped the FAA select the installation sites. The FAA now promises to have all 47 Dopplers in place by 1996.

It was one of the most dramatic rescue scenes of the 1980s: helicopters hovering over the frozen Potomac, a hero diving in from shore. Seventy-eight people died in January 1982 when an Air Florida jet crashed into Washington's Fourteenth Street Bridge after a buildup of ice on its wings thwarted its takeoff. At the time, the NTSB recommended a series of changes in deicing procedures, but the FAA adopted few of them, until a similar accident occurred at La Guardia 10 years later. like the Air Florida plane, a USAir Fokker F-28 had waited in line for takeoff longer than its deicing lasted; 27 people died when it crashed on takeoff, many of them drowning in Flushing Bay while trying to escape the sinking plane.

The NTSB blasted what it called "lax standards" for icing throughout the industry after the La Guardia accident -and four months later the FAA recommended that airlines use longer-lasting deicing fluid and that controllers give pilots more accurate departure times. But ice poses dangers to aircraft in flight as well-particularly for commuter planes. Jets are designed to channel the heat from their engines over their wings, preventing a buildup of ice in flight. Prop planes don't have such systems. They have to let a quarter-inch of ice form, then activate inflatable rubber "boots" running along the wings that expand to crack the ice off (chart).

The FAA hasn't updated its standards for certifying such systems since the 1960s--and planes are tested under limited conditions. Meteorologists have repeatedly warned that freezing rain and drizzle harm planes differently; the NTSB has urged new standards since 1981. But as recently as last September, Hinson insisted that -no such changes in FAA rules were necessary. Less than two months later, on a chilly Halloween afternoon, an American Eagle ATR waiting to land at O'Hare had to hover between 5,000 and 15,000 feet for 37 minutes--in freezing drizzle. Suddenly, the twin-engine turboprop rolled steeply and dived into a soybean field in Roselawn, Ind., killing all 68 people on board.

It wasn't the first time the popular European-made commuter plane had encountered mysterious rolls in icy conditions. A similar accident in Italy in 1987 killed 37 people; in 1988, a Simmons ATR-42 suddenly banked left and dropped nearly 800 feet in icy conditions over Wisconsin before the pilot recovered-just 1,000 feet from the ground. After the Roselawn tragedy, the FAA temporarily grounded ATRs from flying in icy conditions, ran further tests and issued new flying instructions to ATR pilots. The manufacturer, Avions de Transport Regional, extended the deicing boot on the ATR's wing. Meanwhile, Charles Huettner, FAA's associate administrator for aviation safety, concedes that "in hindsight, searching the data, we found there have been a number of icing incidents with a variety of aircraft. We could have been tipped off earlier."

Like icing and wind shear, runway accidents are another old safety issue that should have been fixed long ago. Confusing runway signs are just part of the problem. A 1991 crash in Los Angeles, in which a USAir jet landed on top of a commuter plane parked at the runway, occurred because a controller lost sight of the small plane in the fog. Five near collisions in the last six months have prompted the FAA to review its practice of "taxi into position and hold," in which controllers clear departing planes onto runways even while an arriving plane may not have left. In September, one 737 missed another at Chicago's Midway Airport by only 100 feet.

Preventing runway accidents ranks high on the NTSB's "10 most-wanted list" for safety improvements-the board has issued 61 separate recommendations for reducing the risks since 1972. But many of the changes are tied up in the FAA's massive new Airport Movement Area Safety System (AMASS) and the related Airport Surface Detection Equipment-3 (ASDE-3), which will include a complex ground radar and tracking system to warn controllers of potential collisions. The FAA promised Congress it would have AMASS operational by 1992. But AMASS has since turned into a mess. Soon after a test of the system began in San Francisco, the FAA's Air Traffic Division demanded 30 modifications to the hardware and software; half of those changes will require more time and money, but very few of them will enhance safety. FAA personnel are concerned that AMASS will be used mostly to grade controllers' performance. The NTSB is disgusted: "Progress on this important project has been effectively paralyzed ... " it told the FAA in February.

The NTSB's latest deadline for response on the issue expires this week, and the FAA plans to release a new report, promising to put AMASS on a "fast track." The $200 million systems will be in place at roughly 30 airports by the year 2000. What will controllers at the other airports do to keep track of traffic on the runways? Says David Nussbaum, program manager at Westinghouse Norden, which makes the systems: "They look out the window."

One of the most heart-wrenching findings in the Charlotte crash was the NTSB's report that a 9-month-old baby probably died needlessly. She had been sitting on her mother's lap in row 21, but the force of the impact propelled her to row 17, where she suffered massive head injuries. The NTSB once again urged the FAA to end the practice of allowing babies under 2 to ride on laps, and require them to sit in child-safety seats. But the FAA has steadfastly refused, on the ground that airlines might lose as much as $1 billion in business if families had to purchase seats for their infants and that, if families drove cars instead, they'd face a greater risk. Perhaps. But airlines have repeatedly said they would give discounts -or free seats to infants, rather than risk losing family business. The Air Transport Association, which represents major carriers, has itself petitioned the FAA to require child seats since 1990, after one baby was killed and three were hurt in the crash of a United Airlines DC-10 in Sioux City, Iowa. The FAA also cites technical difficulties: only one of the child seats now on the market meets its specifications; some actually cause more injuries. But outside experts say manufacturers would rush to build acceptable seats if the FAA mandated them. "'Inexplicable' is the only way to describe the FAA's reaction," says the NTSB's Barry Sweedler.

Requiring child seats is just one way the FAA could make air crashes more "survivable." More than 60 percent of aircrash fatalities occur not from impact, but from injuries sustained later mostly from smoke inhalation and fire. Prodded by experts at its own Civil Aero-Medical Institute (CAMI), the FAA finally ordered airline seats to be made of fire-retardant material. But it allowed carriers to replace them gradually, as they wear out, with no deadline for compliance. Cabin carpets, wall coverings and blankets still burn far too quickly, emitting smoke and toxic fumes. Alex and Shifra Richman, whose son, David, was one of 34 people who died-many of them from smoke inhalation--in the 1991 USAir runway accident in Los Angeles, have since become air-safety activists. Alex Richman says that after the incident, the FAA ordered airlines to make emergency-exit rows 20 inches wide by 1992 to facilitate escapes. "The airlines cried poverty, and all of them got waivers. The FAA is now proposing a 10inch width. " He and his wife now carry their own smoke hoods whenever they fly.

After the devastating explosion of PanAm Flight 103 over Lockerbie, Scotland, in 1988, a Brooklyn, N.Y., jury found the airline guilty of "willful misconduct" for allowing an unaccompanied suitcase on board, Investigators determined that the plastic explosives had been packed into a radio/cassette player hidden in a bag first checked onto an Air Malta flight, then transferred to Pan Am in Frankfurt and transferred again in London. But terrorists could use the same method today to sabotage any domestic carrier in the United States. Airlines refuse to discuss their security practices, but the fact is that on some airlines, it's remarkably easy to buy a ticket, check a suitcase at the curbside and then never get on the plane. "On domestic flights, the security is almost zero," says Isaac Yeffet, former director of security for El Al. Yeffet himself has put fake bombs in unaccompanied bags at least six times on U.S. domestic flights in recent years and says they've never been stopped-even when he purchased tickets in the name of known terrorists like Abu Nidal.

Many foreign airlines, and all U.S. carriers operating abroad, do have a system of ensuring that each bag checked onto a flight matches up with an actual passenger on board a cumbersome double check-in procedure that requires travelers to arrive one to two hours before flight time. But the FAA doesn't require such checks on U.S. domestic flights, nor does it require airlines to even X-ray checked luggage. U.S. authorities insist that to date, terrorist bombers haven't targeted U.S. domestic flights like they have flights abroad--and that the cost and inconvenience of examining roughly 1 million pieces of luggage checked every day outweighs the potential risk.

After the Lockerbie tragedy, Congress ordered the FAA to devise a system of "sniffing" each bag, accompanied or not. for explosives, and to have it in commercial use by November 1993. But FAA officials say the technology proved more difficult than expected-particularly for detecting small amounts of plastic explosives in the middle of jumbled luggage. "It's not like trying to find a needle in a haystack. It's like trying to find a piece of straw in a haystack," says Bruce Butter-worth, FAA's director of security policy. Semtex, used in the Lockerbie bombing, has no metal content and can be shaped into a variety of forms, some as thin as notebook paper. Only a small amount can down a big jetliner; the Czech manufacturer sold 1,000 tons of it to Libya.

The FAA has also insisted that whatever system it develops be able to scan each bag in six seconds or less, and not register too many false alarms. Last December, after expensive false starts, the FAA did certify one such system, the CTX-5000, which uses medical CT-scan technology. But the scanners cost $865,000 each, and a busy airport like Kennedy would require 32 of them just to sniff all carry-on luggage, and dozens more for checked bags. Meanwhile, critics say it's only a matter of time before terrorists realize how vulnerable U.S. flights are. When authorities raided the Manila apartment of Ramzi Ahmed You set, the alleged mastermind of the World Trade Center bombing, they found a United Airlines timetable and computer data with times for detonating bombs. according to an indictment unsealed last week.

The DOT inspector general's office, in the meantime, is worried about counterfeit airplane parts. Because almost everything on an airplane-from complex engines to common bolts-is subjected to heavy wear and tear, and even small parts can be crucial, manufacturers and repair shops are supposed to issue written certificates guaranteeing that they are authentic and reliable. Certified parts are also expensive so there is a vast black market in fake and stolen ones. Schiavo says her office has already won 98 convictions in bogus-parts cases; an additional 125 indictments are pending and 150 more cases are under review. But the FAA is reluctant to acknowledge that bogus parts could constitute a safety hazard. Schiavo's office even found that 39 percent of the spare parts in the inventory the FAA keeps for its own Planes lacked proper documentation.

The FAA's attitude is grating on Schiavo. Two years ago federal prosecutors in Phoenix had to drop serious charges against two engine-repair companies they thought were welding turbine blades illegally after FAA associate administrator Anthony Broderick concluded that such unapproved repairs were not a safety hazard. Now, prosecutors are conducting a follow-up investigation into the FAA's handling of the case. Broderick's attorney says he cannot comment while the investigation is pending.

Flying a modern jetliner is in many ways like sitting at an office computer terminal. Information appears on screens, not dials and gauges. Pilots type many commands on keyboards, and electronic impulses-not hydraulic cables-send messages to the wings and tail to turn or descend. So-called fly-by-wire technology first appeared on the Concorde in 1969, then in the latest Boeing models. The European-made Airbus planes are the most sophisticated of all. But some critics think Airbus may have gone too far in taking control from humans--and they cite a disturbing litany of crashes in France, South Korea, Poland, Egypt and Japan in recent years. When an Airbus A-320 crashed during a demonstration flight in France in 1988, one Airbus director defended it as "a remarkable plane-even my janitor could fly it." But some seasoned pilots haven't been so lucky. In June, even Airbus's chief test pilot couldn't recover from a low-altitude stall during a test flight of an A-330. He raced to take control from the computers, but could not increase air speed in time. It crashed, killing him and six other crew members.

In that, as in other incidents, Airbus blamed pilot error--but the real culprit may be the autopilot, which sometimes acts in ways the human crew can't understand. Michael McIntyre, who flies Airbuses for United, says all pilots have seen the aircraft do something inexplicable: "Two of the most common phrases are, 'Was that for us?' and 'Why did it do that?'" The problem, he says, is that the sophisticated aircraft doesn't always communicate why it is doing something, or what it will do next. Experts say the plane's computers can't override the pilot but that accidents can occur when the pilot tries to override the autopilot without disconnecting it. "It's not unlike the cruise control on your car--if it's accelerating into the car ahead of you, and you're trying to use the emergency brake, that doesn't disconnect the cruise control," McIntyre says.

Airbus spokesman David Venz says it's "hogwash" to accuse the Airbus planes of moving in mysterious ways. He also says that pilots, unlike many critics in the press, do understand how the plane works "If they don't understand, any rational pilot wouldn't fly the plane." But some who fly the high-tech planes, and love them, still wish they knew more. Capt. Paula Brandmeier, who pilots automated 737-300s for United, says her training course taught how to operate the on-board computers, but "they never really explained the logic behind it. They just teach you how to push the buttons." Boeing's new 777, which will debut in U.S. service in June, uses much of the same fly-by-wire technology-but experts contend that pilots will be "more in the loop" in the 777 than they are in the Airbus's design.

Sophisticated planes. Antiquated equipment. How will a system that is already showing strains cope with I billion passengers a year? "We're already trying to fly our planes as close together as possible, either for-ward or aft or side by side. It leaves little room for error," says United's McIntyre. Twenty-two U.S. airports encountered more than 20,000 hours of flight delays in 1993 -costing the industry $1.6 million per hour-and that number is expected to rise by 50 percent in the next eight years. But it is extremely difficult to build new airports, or expand old ones, as the 10-year struggle to build Denver international shows.

One way the industry plans to cope is to sandwich more runways into the same space at existing airports-and move traffic on them more efficiently. Small commuter planes may be allowed to take off and land on just half a runway, for example. Twenty years from now, aviation officials envision VSTOL aircraft (for Vertical or Short TakeOff and Landing) that work like helicopters ferrying passengers on many short-distance routes, freeing runways for bigger aircraft. For longer flights, 800-seat, 260-foot-long "superjumbo" jets will help consolidate the billion-passenger-a-year industry into fewer flights. But all of these changes bring the potential for more, and bigger, accidents. "We're trading off capacity against safety," warns Geoff Gosling, a research engineer at U.C. Berkeley's Institute of Transportation Studies.

At present, U.S. airlines do have a remarkable record for safety-moving more than 1.5 million passengers and 30,000 flights every day, virtually all of them without a hitch. But the lessons of the last year demonstrate that pilots, controllers, airline executives-and particularly federal regulators - should all be paying more attention and responding faster to the rare accidents that do occur. Given the problems endemic to the system, it is nothing short of miraculous that U.S. air travel is as safe as it is. And that record is too important to rest on a wing and a prayer.

Crashes are random, but experts have calculated the odds of dying on airlines based on deaths in the past decade.

PER DOMESTIC JET FLIGHT AIRLINE DEATH RISK, 1985-94 American 0 Southwest 0 TWA 0 Continental 1 in 10 million Delta 1 in 8 million United 1 in 4 million Northwest 1 in 3 million USAir 1 in 2 million

PER PROP/TURBOPROP FLIGHT AIRLINE GROUP** DEATH RISK, 1985-94 Trans World Express 0 USAir Express 1 in 10 million American Eagle 1 in 1.5 million Continental Express 1 in 1.5 million Delta Connection 1 in 1.5 million Northwest Airlink 1 in 1.5 million United Express 1 in 1.5 million Alaska Airlines Commuter 1 in 1 million

PER JET FLIGHT BETWEEN COUNTRIES AIRLINE DEATH RISK, 1985-94 Air Canada 0 British Airways 0 El Al 0 Japan Air Lines 0 Qantas 0 Air France 1 in 100 million Lufthansa 1 in 100 million Alitalia 1 in 1 million ..MR.-

* The probability that someone who randomly flew on one of these flights would be killed en route.

** Covers 95% of the U.S. commuter flights in the U.S. ..MR0-

During the last 20 years, thunderstorms and wind shear led to more passenger deaths in plane crashes than did any other circumstances.

NO. OF MAJOR NO. OF CIRCUMSTANCE CRASHES* DEATHS Thunderstorm wind shear 4 419 Collisions (ground and air) 3 159 Ice buildup 3 122 DC-10 hydraulic failure 2 371 Takeoff without flaps 2 161 Unknown cause 2 147 Engine loss in flight 1 69 Sabotage 1 39 Engine loss on takeoff 1 31 Total 19 1,518 ..MR.-

* Major crashes are defined as those that kill at least 10 percent of the passengers on board. ..MR0-

For Years, U.S. carriers were considered the safest in the world. Yet since 1990, other First World airlines have moved ahead.

MAJOR U.S. 20 INTN'L CARRIERS CARRIERS** 1965-74 1 in 2 million 1 in 500,000 1975-84 1 in 10 million 1 in 4 million 1985-94 1 in 7 million 1 in 7 million 1990-94*** 1 in 6.5 million 1 in 7 million

U.S. WESTERN EUROPE 1985-89 1 in 2 million 1 in 500,000 1990-94 1 in 2 million 1 in 3 million ..MR.-

* The probability that someone who randomly flew on one of these flights would be killed en route

** Carriers include Qantas, Air Canada, Air France, Icelander, Japan Airlines, Air Portugal, British Airways, Austrian, Sas, Lufthansa, Aer Lingus, KLM, Iberia, South African, Sabena, Finnair, Olympic, El Al, Air New Zealand, Swissair

*** Estimates ..MR0-

1 Microburst wind shear is a swirl of turbulent winds caused by a rush of air toward the earth. it typically occurs during thunderstorms.

2 An airplane flying into the microburst encounters a strong headwind that increases air flow over the wings and lifts the plane.

3 At the center of the microburst, the plane encounters strong downdrafts and then increasing tailwinds, causing a sudden loss of altitude and speed.

4 The pilot can regain control by increasing power to the engines and climbing. But loss of air speed and altitude can stall the plane and lead to a crash.

Before takeoff in icy conditions, the FAA requires that all aircraft be sprayed with an oily liquid called propylene glycol, which ice from form the wings.

In commuter planes, rubber deicing panels can be inflated on the wings and tail to crack off ice in midflight.

In carrier jets, hot air from engines is siphoned through metal tubes to the wings, preventing ice from forming during the flight.

How Safe Is This Flight? | News