Written in Metal: The story of Delta Air Lines flight 1288
On the 6th of July 1996, a Delta Air Lines MD-88 was speeding down the runway in Pensacola, Florida, when a huge bang rocked the rear of the aircraft. The left engine ripped itself to shreds and the plane lost all electrical power, but the pilots slammed on the brakes and brought the aircraft safely to a halt, believing that they had saved their 137 passengers. That is, until a flight attendant came to the cockpit and told them the unthinkable: the back of the plane was in a state of chaos, and even worse, people were dead. The very last rows in fact were a scene of carnage, as a flying engine fragment had launched itself through the cabin, killing two passengers and severely injuring two more.
How was it that an engine could fail so catastrophically as to cause multiple fatalities aboard a flight which didn’t even crash? That question would fall to the National Transportation Safety Board, whose investigators dived deep into the history of the failed engine, gathering together pieces which had scattered themselves across the airport in order to tell the story of a tiny flaw that escalated to the point of failure. In the process, they would reveal the dangers posed by the inherent difficulty in detecting microscopic defects, and the inadequacy of the existing system to ensure perfect mechanical reliability.
Delta Air Lines flight 1288 should have been a flight so utterly routine as to be forgotten almost as soon as it was over, nothing more than one of the thousands of flights carried out each day by Delta, the world’s second largest airline. The short flight from Pensacola, Florida, to Atlanta Georgia, operated by a seven-year-old McDonnell Douglas MD-88, was booked with an average complement of 137 passengers and a standard crew of five. The weather was fine, the runway was long, and the pilots were well-rested. In short, there was no reason for something to go wrong — and yet, it did.
The pilots, whose names have not been released, certainly had no reason to suspect anything out of the ordinary. The First Officer’s routine pre-flight walkaround check revealed only two minor defects: a couple missing rivets on the wing, and a spot of oil on the left engine’s nose cone. Neither was a serious issue. The oil didn’t appear to be actively leaking, and far more than two rivets would have to be missing for a panel to come loose. The Captain agreed that the airplane was airworthy, so the crew jotted down the items in the technical log and proceeded with the pre-flight preparations.
By the time flight 1288 to Atlanta pushed back from the gate, there were 142 people on board, including a Boeing 767 pilot riding along in the cockpit jump seat. Also on board were four members of the Saxton family from Scottville, Michigan, on their way to a vacation in Atlanta, where the 1996 Olympic Games were scheduled to shortly begin. Thirty-nine-year-old mother of five Anita Saxton was flying that day with her sons Derek, aged 15, and Nolan, aged 12, as well as her daughter Spencer, aged 9. The group settled across four seats in row 37, the second to last row from the back of the plane. Nolan and Spencer, who took seats 37A and 37B, would perhaps have been disappointed to discover that their view out the window was partially blocked by the plane’s left engine, which was mounted to the aft fuselage.
As they taxied out to the runway, they probably heard the First Officer making a cabin announcement: “Good afternoon folks from the flight deck, we’re currently number one for departure, flight plan indicates a very brief forty minutes over to Atlanta, we’re expecting an on-time arrival…”
At 15:23, the tower announced, “1288, fly runway heading, clear for takeoff.” The Captain delegated the takeoff to the First Officer by calling out, “Your airplane.”
“I’ve got the aero machine,” the First Officer jokingly replied. Simultaneously, he pushed the thrust levers to takeoff power, and the MD-88 lurched away down the runway.
Flight 1288’s attempt to become airborne would be shockingly brief. Just three seconds after the throttles were advanced, a loud bang ripped through the airplane, and the cockpit voice recording immediately went dead.
Farther back, something far more material ripped through the passenger cabin. In the blink of an eye, the left side cabin wall in line with row 37 exploded in a hail of metal, plastic, and insulation, strafing the rear of the aircraft with debris, before whatever caused the blast exited out the other side, leaving several holes in the upper right side of the fuselage, above the overhead bins. Those passengers who were not immediately incapacitated could have glanced out the windows to see that the entire front portion of the left engine was gone.
In the cockpit, all the lights and instruments instantly went dark. As soon as his displays disappeared, the Captain announced that they were aborting the takeoff, and reduced thrust in both engines to idle. Applying the brakes, he brought the plane to a gradual halt from a speed of about 40 knots, keeping the plane straight on the runway until it finally stopped, only a few hundred meters from where it started.
In the cabin, panicked passengers, seeing bursts of flame emanating from the wrecked engine, urged the exit row occupants to open the overwing exits, and one in fact was opened before the plane had fully come to a stop. When it did finally stop moving, the passengers did not hesitate to flee through both overwing exits, even though the flight attendants had not ordered an evacuation.
Back in the cockpit, the First Officer attempted to report the rejected takeoff to the tower, but his radio had gone dead, along with the rest of the plane’s electrically-powered systems. Fortunately, the MD-88 had a backup emergency power switch, which the First Officer flipped some thirty seconds later, allowing him to finally declare an emergency about two minutes after being cleared for takeoff. Simultaneously, the lead flight attendant entered the cockpit to seek guidance from the captain, who told her not to initiate an evacuation, since his newly-restored instruments showed no indications of fire. The flight attendant then returned to the cabin and, using a megaphone, urged the passengers to remain seated.
Those at the front were unaware that the situation looked very different for those in the back. Seeing large amounts of dust, structural damage, and injured passengers, the two aft flight attendants attempted to contact the flight deck using the interphone, but received no reply, as electrical power had not yet been restored. Using their best judgment, they decided to independently initiate an evacuation, opening the aft right exit and tailcone exit, while those farther forward continued to flee through the overwing exits and onto the wings.
While one of the aft flight attendants oversaw the evacuation, the other attempted to assist several injured passengers. She found herself faced with a shocking scene of carnage, concentrated in row 37, where the unfortunate Saxton family had been seated. Anita Saxton and her son Nolan, seated in 37C and 37A respectively, were both obviously deceased, having been fatally struck by flying pieces of the engine. Nine-year-old Spencer, although seated in between them in seat 37B, had been spared due to her small stature, suffering only relatively minor injuries; her older brother Derek, who was not seriously hurt, rushed to her aid. Also in need of assistance was a male passenger unrelated to the Saxton family, who was lying unconscious in the aisle, bleeding profusely. The flight attendant, kneeling on the blood-soaked floor, did her best to render first aid as she and her colleague urged panicked passengers to move toward the front of the plane.
Up front, the crew tried to contact the aft flight attendants using the newly restored interphone, but there was no reply — they were simply too busy. The captain then sent the jump seat pilot and the First Officer back to inspect the cabin, where they immediately discovered that about two dozen passengers had exited onto the wings and jumped down to the runway, despite the command not to evacuate. The First Officer hurried back to the cockpit and informed the captain, who quickly shut down the engines — after all, with the right engine still running, hapless passengers could have been sucked in. The escapees were also at risk of being run over by responding fire trucks, so the First Officer added to air traffic control, “Be advised, we have passengers on the runway!”
He then left the cockpit and returned to the cabin, where he met the jump seat pilot returning from the rear. The off-duty pilot informed him that he had seen debris in the aisles and flight attendants assisting seriously injured passengers, prompting the First Officer to return to the cockpit a second time to inform the captain that the situation was much more serious than they had initially suspected. Even so, with no present danger to those still on board the aircraft, the crew decided to stop the evacuation to allow emergency personnel to board the plane. The First Officer then went back to the cabin a third time to halt the uncommanded evacuation, during which time he had to step out onto the wing to physically restrain a passenger who was attempting to jump off. It was only now that one of the aft flight attendants managed to make her way far enough forward to tell the captain that they had an “emergency situation” and “possibly two dead.”
With the scale of the incident now apparent to all the crewmembers, the situation was quickly brought under control. Within minutes, paramedics were able to board the airplane to evacuate the seriously injured passengers, including the unconscious man, and Spencer Saxton, accompanied by her brother, who had heroically stepped in as her guardian despite witnessing the horrific death of their mother just minutes earlier. The rest of the passengers exited the plane via a set of air stairs some 25 minutes later, many of them still unaware that they had been involved in a fatal accident.
◊◊◊
Later that day, long after the last passengers had left, a new group arrived on the debris-strewn runway at Pensacola Airport, consisting of investigators from the National Transportation Safety Board, or NTSB. They faced an unusual case: the airplane had not crashed, and in fact it had never even reached highway speeds, let alone become airborne, and yet two passengers were dead and two more were in hospital with serious injuries. Their job was to figure out how this could happen.
The proximate sequence of events was not hard to discern. The initiating failure within the left engine evidently involved a part called the fan hub, the rotating disk to which the engine’s fan blades are attached. As a solid chunk of titanium, the fan hub is normally found in one piece even after a high-speed crash, but here it was broken into several segments scattered over an area more than half a mile wide. About two thirds of the hub (shown above) exited the engine in a downward and leftward trajectory, bounced spectacularly off the runway, and flew 218 meters (714 feet) into a field. A second piece of the hub had passed clear through both cabin walls at tremendous speed before flying a further 730 meters (2,400 feet) to the right of the runway, where it was found next to a baseball field well outside the airport boundary. Most of the remaining portion of the hub was found very close to where it started, embedded in the right side cabin wall. This catastrophic failure had also caused considerable collateral damage, leaving a massive gash through the passenger cabin, punching a hole in the left wing, and ripping off the entire forward inlet portion of the engine, which was found lying on the runway some distance behind the airplane. The flying debris also severed electrical wires inside the cabin walls and ceiling, stopping both flight recorders and causing the total electrical failure experienced by the crew.
The wide distribution of its component parts and the scale of the damage to the airplane underscored the enormous amount of energy contained within the heavy, rotating fan hub even when the engine had not yet achieved full power. Due to their destructive potential, fan hubs and other rotating engine parts are manufactured to an extremely stringent standard, and in theory it should be almost impossible to break them. In fact, the fan hub is a so-called “life limited” part, which is guaranteed to last for 20,000 flight cycles, but must be permanently removed and replaced as soon as it has reached that number. In practice, most hubs would last several times that long before failing, but the 20,000-cycle life limit is intended to ensure that no properly manufactured hub is ever in service long enough to fail, with a confidence interval great enough to support a “guaranteed” lifespan.
However, the fan hub in the left engine had accumulated only 13,835 flight cycles when it suddenly broke apart during flight 1288. There was no sign that the hub had failed after being struck by an object, nor could any conceivable debris impact have split it into four pieces anyway. The fan hub itself must have been the initiating factor, and it didn’t take long for NTSB investigators to figure out how. Directly along one of the hub’s fracture faces, telltale striations, visible to the naked eye, betrayed the presence of a fatigue crack in the metal.
Metal fatigue, on its surface, is a blessedly uncomplicated concept. When stress is cyclically applied to a metal component, the material begins to break down, eventually forming a crack which then slowly grows with each load cycle until eventually the component fails. You can try this at home by bending a paper clip back and forth until it breaks. It is obviously much harder to break a titanium fan hub, but the basic idea is the same.
Because a fatigue crack grows once and then stops every time a load is applied, leaving a striation on the fracture surface, it is possible to determine the age of a crack by counting the number of striations like the rings on a tree. Using a microscope, NTSB investigators counted at least 13,000 striations on the fatigue surface of the accident fan hub, indicating that the fatigue crack had been growing from essentially the moment the part was first installed on a plane in 1990.
The origin point of the fatigue crack lay on the inside of a hole drilled through the hub from fore to aft, known as a tierod hole. The hub contained 24 such holes, arranged circumferentially around the center bore, in order to mount the “tierods” which connect the fan hub to the rotating components behind it. The fatigue crack had begun in the wall of one of these tierod holes before propagating out the back of the hole and across the aft face of the hub, reaching a total length of 3.54 centimeters (1.36 inch) before the hub lost its structural integrity and abruptly failed when the pilots attempted to apply takeoff power on flight 1288.
Examination of this tierod hole using a scanning electron microscope revealed a discolored area which was later determined to be up to 50% harder than the surrounding metal and contained significant impurities of oxygen and iron. In this area, which was about 23 millimeters (0.9 inch) long and 0.05 mm (0.002 inch) deep, the hole wall displayed a noticeably altered microstructure. For our purposes, “microstructure” is to a piece of metal as “grain” is to a piece of wood. To create this altered microstructure, or wonky grain, the titanium wall of the tierod hole must have been locally exposed to a temperature in excess of 650˚C (1,200˚F). This high temperature weakened the structure of the metal, introduced impurities, and caused minute cracks which later linked up to form the main fatigue crack once the fan hub was put into service.
This type of damage could only be the result of a manufacturing defect. And that meant that the NTSB would need to turn to a place far away from the runway in Pensacola: the factory where the fan hub was manufactured in Trollhättan, Sweden.
The McDonnell Douglas MD-88 was powered by two Pratt & Whitney JT8D turbofan engines, one of the most popular jet engines ever produced. However, while Pratt & Whitney assembled the final product at its factories in the United States, many of the components in the JT8D were produced by contract suppliers scattered all over the world. One of these suppliers was Swedish manufacturing giant Volvo, which produced numerous specialized engine parts, including the fan hub involved in the accident in Pensacola.
At Volvo’s advanced aerospace factory in Trollhättan, JT8D fan hubs were machined down to their final specifications using a series of computer-controlled drills. Among the more complex steps in the machining process was the drilling of the 1.31-centimeter (0.52 inch) wide and 7.39 cm (2.91 inch) deep tierod holes. The tierod holes were created in four stages. First, a drill cut the initial hole in a single pass; then the hole was slightly widened twice using two boring machines; and then finally the interior surface was honed to final specifications.
The initial drilling phase was the most critical due to the sheer volume of material which had to be removed and the temperatures reached by the metal during the process. To prevent damage, the drill was equipped with a special coolant dispensing mechanism which continuously sprayed fluid out of the drill head to cool the metal and wash away the titanium chips which would otherwise clog the hole.
Due to the high temperatures required to produce it, investigators suspected that the altered microstructure observed in the failed tierod hole on the accident fan hub was probably created during this drilling process. In order to prove the NTSB’s theory, Volvo drilled hundreds of test holes in blocks of aerospace-grade titanium using various combinations of abnormal drilling techniques and conditions in an attempt to recreate the damage on the accident fan hub. Success was finally achieved when Volvo ran the drill at an abnormally high rotation speed, causing damage to the drill bit which resulted in a buildup of titanium chips which blocked the flow of coolant to an adjacent area of the hole wall. The lack of coolant then allowed friction to heat the surface of the hole wall until it surpassed the 650-degree threshold required to alter the microstructure of the metal. This technique resulted in eight holes containing areas of altered microstructure, one of which was almost identical to the damage on the accident fan hub. As far as the origin of the defect was concerned, this was the smoking gun.
Although the exact reason for the drill breakdown could not be determined in this case, such events are known to happen from time to time, and any adverse consequences should have been caught during later stages of production. In fact, Volvo had in place a multi-stage inspection procedure designed to weed out even the most minutely damaged products before their delivery to Pratt & Whitney. This process consisted of a visual inspection to search for obvious machining marks, a Fluorescent Penetrant Inspection (FPI) designed to detect cracks; and a Blue Etch Anodize (BEA) test capable of detecting anomalies in the microstructure of the metal.
The damage inside the tierod hole would have been very difficult to detect during the visual inspection and the FPI process, but it should have appeared during the BEA test, which was specifically designed to catch this type of damage. During a BEA test, the hub is anodized to produce a blue oxide coating on the surface, which is then removed using a solution of nitric and hydrofluoric acid. In areas of anomalous microstructure, some of the blue oxide coating will remain in place, allowing such defects to be detected visually. Inspectors at Volvo were given six full-color placards showing various types of BEA indications which should result in the part being rejected.
Records indicated that when an inspector examined the accident fan hub following its manufacture in 1989, he observed an unusual blue oxide pattern inside the tierod hole which later developed the fatigue crack. This pattern didn’t match any of the six rejectable indications shown on the placards, so he reported it to the supervisory inspectors for further examination. The supervisors also checked the indication against the placards but failed to find a match, so they determined that the fan hub met Pratt & Whitney’s standards and cleared it for delivery.
Following its delivery to Pratt & Whitney, the fan hub did not undergo more than a cursory visual inspection to ensure that the part had not been damaged during shipping. Pratt & Whitney had already assessed Volvo’s quality control system to be capable of ensuring that faulty parts were removed from the product line prior to delivery, and so the company believed that no further inspections were needed. Consequently, the fan hub was installed in a JT8D engine and released for service in 1990 despite containing a fatal weakness lurking inside one of its tierod holes.
Once in service, this weak spot quickly spawned a fatigue crack which grew fractionally longer every time the engine was accelerated to takeoff power. During this period, the hub bounced around between different engines multiple times before it eventually ended up in the left engine on N927DA, the plane which would operate Delta flight 1288.
In January 1992, it was removed for a visual inspection after a mechanic’s file was accidentally sucked into the engine. No damage was found, and the hub was installed in a different engine in March of that year. It continued in service until September 24th, 1995, when this engine was removed, hub and all, because the fan blades had reached the end of their service life. Records indicated that the hub was then subjected to a full “heavy maintenance” session, which involved a fluorescent penetrant inspection (FPI), a dimensional inspection, and a shot-peening of the fan blade attachment slots.
These same records indicated that the hub passed its FPI check on October 27th, and was finally installed on N927DA on January 1st, 1996, six months before the accident. The NTSB’s next question, therefore, was why the FPI check on October 27th failed to detect the fatigue crack, which by then was over one inch long and should have been detectable with a greater than 95% confidence interval.
During the fluorescent penetrant inspection, the hub was subjected to a rigorous cleaning regime to remove any trace of dust, oil, or grime, culminating in its complete submersion in near-boiling water. Upon removal from the hot bath, the hub was flash-dried using its own residual heat. Once dry, inspectors coated the hub in a low-viscosity oil containing fluorescent dye, allowing the dye to seep into any microscopic defects, before the excess dye on the surface was washed away. The inspector then applied a layer of specialized “developer powder” designed to draw out any remaining fluorescent dye, hopefully revealing the locations of any cracks where residual dye may have been hiding. After waiting for the developer powder to take action, the inspector went over the entire surface of the hub using an ultraviolet light and a magnifying glass, searching for areas of fluorescence. Apparently, he found none, and the hub was returned to service.
This inspector had somehow missed the presence of a crack which should have been easily detectable. The NTSB ended up finding a wide range of reasons why this might have occurred, although it was unable to prove which one actually accounted for the failure.
One scenario held that the mistake took place during the cleaning process rather than the inspection itself. Investigators noted that that there was no mechanism in place to ensure that parts being cleaned for inspection were actually clean enough, and the cleaners had not been informed of the reason for the cleaning or its importance. In fact, any contamination of the fan hub could obscure a critical indication during the subsequent inspection. Furthermore, multiple industry experts testified to the NTSB that Delta’s policy of “flash-drying” the fan hub was insufficient to remove residual water. The director of technical services for the company that supplied the FPI fluid stated that water could remain in a deep fatigue crack after such a flash-drying, where it would repel the oil-based dye and prevent it from entering the crack. The director of technical services for a company that produced FPI equipment also testified that it was critical that the part be completely dry before application of the dye, which in his opinion could only be accomplished using some kind of dryer.
It was therefore possible that the hub was not clean, or there was water in the fatigue crack, resulting in the absence of any fluorescent indication for the inspector to find. Additionally, it was possible that the hub was inspected too long after the application of the dye, because all the dye would drain away within two hours, but no formal system was in place to ensure that the hub was inspected within that timeframe.
There were also a number of reasons why the inspector might have missed the indication even if it was there. The inspector was relatively inexperienced, with only 18 months on the job. He also stated that it was difficult, using the tools available, to see all the way inside the long and narrow tierod holes, where two-thirds of the crack was located. Furthermore, the developer powder often did not reach the interior of the tierod holes, potentially preventing the dye from rising to the surface.
Compounding these factors was the simple incompatibility of the task with human nature. The inspector who examined the accident fan hub reported that the process could take anywhere from 40 minutes to two hours, and that it was extremely “tedious” and “monotonous,” primarily because he almost never found anything. In fact, in his 18 months at Delta, the inspector could not recall ever finding a crack on this type of fan hub. This could have created an expectation that no cracks would ever be found, leading to generally reduced vigilance. The inspector stated that he tried to fight this tendency by approaching each part as though it contained a crack for him to find, but even this may have been insufficient to prevent the task from becoming rote. The NTSB noted that under such conditions, inspectors often forget where they left off if they are interrupted during the inspection, causing them to skip ahead in the process. This provided yet another potential explanation for the inspector’s failure to detect the crack.
Whatever the reason, the faulty fan hub went back into service, until it failed on the 6th of July aboard flight 1288. The inspector was no doubt horrified to discover that a crack in a part he thought was clean went on to kill a 12-year-old boy and his mother.
Except for its drying method, Delta’s inspection process met industry standards, but was vulnerable to inherent deficiencies in the way critical engine parts are inspected. When searching for minute flaws in components which almost never fail, human beings are dangerously fallible, falling victim to the vagaries of attention and tricks of the light. It is a system which works until it doesn’t, and it only needs to not work once for people to end up dead, as happened on Delta flight 1288. This is a difficult problem to solve, but the NTSB felt that the odds of detection would be improved if airlines rethought the concept of “life-limited” parts. In 1996, a life-limited component did not need to be regularly inspected because its life limit was considered a guaranteed minimum. In practice, therefore, these parts were only inspected if they happened to be removed from the airplane for unrelated reasons. However, this assumption did not take into account manufacturing defects which could cause the part to fail earlier than planned. Investigators therefore proposed that life-limited parts be inspected at one third and two thirds of their planned lifespan to add increased redundancy in case of a manufacturing flaw.
◊◊◊
An interesting final addendum to the tale, which complicates some of the above narrative, is buried in the NTSB’s public accident docket, in a letter to investigators from Patricia Garcia, an advocate representing Delta mechanics on behalf of the National Organization of Working Women. In her letter, Garcia presented evidence of a culture at Delta which could have contributed to reduced inspection quality, all other factors aside.
In the early 1990s, facing increased competition from low cost carriers like ValuJet and Southwest, Delta Air Lines launched a plan called “Leadership 7.5,” which was designed to reduce the airline’s transport costs from 9.3 cents per seat per mile to 7.5 cents. The initiative, if successful, would have saved two billion dollars, and Delta management planned to do it in part by cutting maintenance expenses. If all of this sounds familiar, it may be because Alaska Airlines was doing the same thing at around the same time for much the same reason.
In practice, Delta’s attempts to fulfill the “Leadership 7.5” initiative led to the mass firing of experienced maintenance personnel and their replacement by newcomers who could be paid less money. This was only possible because maintenance personnel at Delta were non-union, and the airline apparently resorted to heavy-handed tactics to keep them that way, as multiple unionization efforts were met with open retaliation. As a result, the average experience of inspectors at Delta rapidly decreased from 20 years to seven. (Keep in mind that the inspector who missed the crack in the accident fan hub had only 18 months of experience — well below even this reduced average.)
Simultaneous with this exodus of experienced mechanics, Delta began to suffer from an increased number of uncontained engine failures — that is, failures during which parts are ejected from the engine casing. These failures can be extremely dangerous, as the accident involving Delta flight 1288 so tragically illustrated. News articles published in 1997 confirm that Delta suffered an astonishing ten uncontained engine failures in less than four years between 1993 and 1997, including the one aboard flight 1288. This was apparently so out of the ordinary that the Federal Aviation Administration launched an inquiry into Delta’s engine maintenance practices later that year. Delta, for its part, contended that Pratt & Whitney was at fault for the string of failures, and at the NTSB’s public hearing on the flight 1288 accident, Ray Valeika, the Senior Vice President of Technical Operations at Delta, testified that the delivery of defective parts was more important than Delta’s failure to detect them. Nevertheless, other airlines did not seem to be having this problem.
Garcia alleged that, against this background, questionable decisions were made regarding the fan hub involved in the accident. She noted that despite a spare parts crunch underway at the time, the fan hub was out of service for a suspiciously long period. After being removed on September 24th, 1995 because the fan blades had reached their life limit, it sat for more than three months while being subjected to tests which could have been done in a week. Garcia claimed that the hub was out of service for so long because Delta knew it was defective, but eventually decided to install it in an engine anyway because they were short on spares. The evidence for this scenario is completely speculative, however. It seems at least as likely that the delay was caused by the very maintenance cuts already described by Garcia, which could have led to a backlog of unfinished inspection tasks.
Regardless of the specifics, this breakdown of the inspection culture at Delta certainly could have played an indirect role in the accident. However, the NTSB’s final report notes that Delta reformed its inspection process significantly as a result, including through the use of borescopes to see the insides of tierod holes, and by introducing squeeze bulbs to apply developer powder to the insides of the holes. Delta also changed its drying process and introduced better training for both inspectors and cleaners. Other parties to the incident made reforms as well. The FAA issued an airworthiness directive requiring immediate inspections of JT8D fan hubs in order to locate any similarly defective products; fortunately, none were found. The FAA also mandated closer monitoring of life-limited rotating engine parts, among numerous other more specific initiatives, and Pratt & Whitney provided Volvo with additional placards detailing new types of rejectable defects discovered during the investigation.
Looking back now, the reforms seem to have been sufficient. Although alarming letters by Delta mechanics, appended to Patricia Garcia’s report to the NTSB, proclaimed that the airline would surely suffer a major crash due to faulty maintenance, no such crash actually took place, and flight 1288 ended up being Delta’s last fatal accident. Even the airplane itself, after undergoing extensive repairs, kept carrying passengers without incident until 2018, transporting tens of thousands of people who probably had no idea of the aircraft’s sordid history. In fact, they wouldn’t have had much reason to think about it. Delta’s current 26-year fatality-free run, which it has achieved despite operating a fleet of hundreds of airplanes, makes it one of the safest airlines in the world today. In hindsight, however, it is impossible to say whether Delta made it out of the 1990s unscathed because the alarmists were wrong, or because the airline was lucky.
◊◊◊
Perhaps the most enduring lesson from this bizarre tragedy is that pilots are far from the only ones who hold passengers’ lives in their hands. The pilots of flight 1288 did absolutely nothing wrong, and were so external to the story that only those directly involved even know their names. Instead, it was a series of small mistakes, each of them understandable in the moment, made by individuals far removed from the runway in Pensacola, which sent a deadly shard of metal flying through the cabin of flight 1288. The lesson therefore is for inspectors, for cleaners, for airline executives — people who will never personally see the blood on the floor or hear the screams of horror. These people, too, play important roles in the delicate and miraculous transportation of billions of passengers in near-total safety. And every day, as managers decide which inspectors to employ, and inspectors face one tedious inspection after another, it might help to remember the tragic fate of the Saxton family, whose lives were forever altered by the smallest of flaws. Somewhere out there, another microscopic crack and another unsuspecting family are just now embarking on a new collision course, and we ought to believe that this time, the story inscribed in the titanium will be cut short before we realize that anything has been written.
_________________________________________________________________
Join the discussion of this article on Reddit!
Visit r/admiralcloudberg to read and discuss over 220 similar articles.
You can also support me on Patreon.
