When disaster occurs, people sometimes shrug and say, “It was a one-in-a-million chance.” James R. Chiles says in his recent book, Inviting Disaster: Lessons From the Edge of Technology, that people are letting themselves off too easily. It may be a one-in-a-million chance that you will win the lottery, but someone will.

Chiles argues that, while individual disasters may be hard to predict, the fact that so many of them are lurking out there somewhere means our only choice is to be prepared.

That means overcoming a human tendency that psychologists call heuristics. Most of us develop heuristics—generalizations about what can and can’t happen in the world—based on personal experience. Chiles says heuristics have led to many superstitions. If something goes badly one day, mentally we may link the problem to some small deviation from our routine. Chiles writes that one technician at the National Aeronautics and Space Administration (www.nasa.gov) “still grieves because he wasn’t wearing his lucky shirt when the Challenger went down” in 1986. The problem is that heuristics lead us to discount the possibility of a catastrophe, because few of us have ever experienced one. Though the Sept. 11 terrorist attacks exposed all of us to new thoughts of danger, Chiles says we mostly just go through the motions when we set up contingency plans for dealing with disasters.

Chiles counsels discipline and vigilance. As our communications, computer, and other systems “get bigger and more complex, we have to remember that our Achilles has many heels, so to speak,” Chiles says. “Some of the problems that arise will never have come up before, so the simple hindsight of heuristics can’t save us.” He cautions that “some of the worst disasters arose out of problems so minor that people had previously discounted them.”

To underscore his point, Chiles cites numerous disasters, such as the Turkish Airlines Inc. (www.turkishairlines.com) flight that lost a rear cargo door in 1974, sending the plane crashing into a French forest and killing 346 people. On a more hopeful note, Chiles tells the riveting story in the excerpt that follows. It is about an American Airlines Inc. (www.aa.com) pilot who earlier encountered exactly the same cargo-door disaster and landed his plane without the loss of a single life, in an exhibition of flying that Chiles says has never been equaled.

The difference between the two flights? The American Airlines pilot had, entirely on his own initiative, spent hours preparing himself for a problem that the aircraft designers had dismissed as hopelessly improbable.

On June 12, 1972, Mrs. Al Kaminsky was a passenger on American Airlines Flight 96 when the rear cargo door blew out with an almighty bang. The floor at the rear of the DC-10 collapsed, and panels in the cabin flew open. One of them gashed Kaminsky’s face. When the plane turned back and landed in Detroit, she hesitated about jumping from the top of the escape slide; a flight attendant had to push her out. Kaminsky slipped at the bottom and cut her foot to the bone. Finally, FBI agents detained her to interrogate her, her husband, and the other passengers about being suspected terrorists. “They tried to kill me!” Kaminsky was later heard saying.

That was true, if “they” were an armload of thoughtlessly designed parts on the DC-10’s cargo door. More important is that some people—mainly Capt. Bryce McCormick—saved Kaminsky’s life.

In every other instance in which airliners in flight faced the kind of mechanical crisis that Flight 96 did—pilots losing most of the flight controls—those airplanes crashed, killing all or many on board. McCormick, who mentally had girded himself two months earlier for just such an extreme emergency, brought everybody back home. The story of how McCormick happened to be in the wrong place at the right time is one of the most remarkable stories from the machine frontier.

In his first 28 years with American Airlines, McCormick mastered six types of airliners. Now with the DC-10 jumbo jet coming from McDonnell Douglas, McCormick looked it over tip to top. He even climbed inside the cargo compartment, where one thing bothered him: the location of the control linkages that governed the rear engine, rudder, and elevator on the tail. The DC-10 had three independent sets of control cables and hydraulic lines running to the tail. That was good, but those independent lines ran right next to each other. A problem that knocked out one could cut the others. McCormick pondered the fact that the DC-10, unlike the other jets he had flown, offered no manual backup system if the hydraulics failed.

To prepare McCormick for the changeover to the DC-10, American Airlines summoned him to its Fort Worth, Texas, training center in March 1972. One afternoon, McCormick told his instructor that he was worried about losing the hydraulic system. He asked for extra time on the simulator to determine if he could control and then land the giant airplane without a hydraulic system, using nothing but the engine throttles. McCormick was pleasantly surprised to find that he could. With a few more hours of simulator practice, McCormick was able to take off, fly around, and land using only the three throttle levers. He steered left by pulling back on the left-hand engine and advancing the right-hand engine; he steered right by doing the opposite. He made the DC-10 climb and descend by adjusting power on the tail-mounted engine, whose location on the fin gave him considerable leverage.

Although McCormick didn’t know it, an obscure mishap during the initial testing of the DC-10 foreshadowed exactly the kind of problem that his intuition and experience told him might occur.

Because the interiors of airliners are pressurized while flying in the thin air of high altitude, and because the higher air pressure inside pushes with great force toward the lower pressure outside, any outward-swinging door—such as the DC-10’s cargo door—will pop open unless it is gripped shut with a latch. So the DC-10 cargo door mechanism required the baggage handler to pull down the top-hinging door and shut it; swing down a lever on the outside of the door; press and hold a button that operated an electric motor at the top of the door until he heard a click; and wait seven more seconds until he heard the motor stop running. On the inward side of the door, that motor caused latches to reach out and grasp a metal fitting. If the motor didn’t lower the latches all the way, the door would appear to be closed until the airplane reached enough altitude to let the pressure differential blow the door out.

On May 29, 1970, during a cabin-pressure test at a hangar in Long Beach, Calif., an improperly closed cargo door burst open, causing the floor of the passenger compartment holding pressurized air to crash down into the cargo compartment holding now-unpressurized air. But the only thing that proved to McDonnell Douglas was that some joker on an airport tarmac might not press the electric button long enough to finish the latching process. The solution was to put a hole in the door for a vent flap that would be closed by the same linkage that shut the cargo door. If the vent didn’t shut, the pilots would know from the air leakage that there was a problem before they got high enough for the cargo door to blow out. It was foolproof, except for one thing: A little excessive force by a baggage handler, struggling to shut the door, could make the vent flap closed even though the cargo door wasn’t fully locked. The pilots would take off without knowing there was a problem.

On June 12, 1972, with fewer than 100 hours on the DC-10, McCormick got a chance to try out his new skill on a real airplane with real passengers. He was the captain of American Airlines Flight 96, originating in Los Angeles and terminating in New York, with stops along the way. During a brief layover in Detroit, a cargo handler had trouble closing the rear cargo door. By leaning his knee on the closing lever, the handler got the cargo door to shut, but the little vent flap looked askew. He called a mechanic, and they opened and shut the door again, deciding it was good enough. A warning light in the cockpit blinked out, telling the crew the door was locked. It wasn’t.

Climbing on autopilot at an altitude of 12,000 feet with 67 people aboard, Flight 96 was near Windsor, Ontario, when things went crazy on the flight deck. The crew heard a bang from the rear of the plane, and a jolt slammed co-pilot Paige Whitney and McCormick back in their seats. The left rudder pedal jammed to the floor, and the engine throttles flew back to idle. McCormick’s right leg came up, and his knee hit him in the chest as a blast of dust, grit, and rivets blew into his face, knocking off his headset. The emergency trim handle broke off in his hands.

McCormick tried moving the control column back to level out the airplane, but the elevator controls were so damaged that he could budge the column only with great difficulty. The airplane went into a right-hand turn and began nosing into a dive that, if not stopped, would be its last. Cockpit warning lamps flared up from one side of the panel to the other, telling of an engine fire and dangerously low air speed, among many other problems. The only things McCormick and Whitney could think of as the cause were a midair collision or a bomb.

In fact, the air pressure had generated so much leverage that it sheared off metal pins and blew the cargo door out. The door broke in two, folding the top part up like the lid of a tin can and sending the bottom to crash against the tail and fall to the ground. Just as happened in the 1970 hangar test, the cabin floor near the door collapsed. The collapse jammed the control cables to the tail.

As the round cocktail bar at the rear of the airplane collapsed into the crater that appeared in the floor, flight attendant Bea Copeland fell into the pit. She looked through the hole in the fuselage at her feet to see the landscape below.

McCormick pushed the wing-engine throttles to full power, bringing the airplane out of its dive. To counteract the right-hand bank from the jammed rudder, he turned the wheel on his control column 45 degrees to the left and kept it there. Then he paused to take stock of the situation. McCormick’s simulator training had taught him to avoid sudden moves, because the tiny edge of control he still had couldn’t extract the plane out of a steep dive or turn.

He and Whitney alerted air traffic control and, afraid of a possible fire, shut down the tail engine. McCormick nudged the wing engine throttles to see if he could control the airplane in the same way he had in the simulator. It worked. The DC-10 had a fatally flawed cargo-door design, but, as McCormick knew, the layout of its engines made it unusually well-suited to steering by engine power.

In one respect, McCormick was a little better off than he had prepared for in the simulator sessions: He had some use of the elevator control, although only one side was working, and every time he used the elevator it tried to roll the airplane over. In another respect, McCormick was worse off than in his simulator training, because he had no control over the tail engine.

Turning the wheel on the control column to the left leveled the airplane’s wings but left McCormick without enough use of the ailerons to control the airplane’s path. He could probably keep the airplane under control in midair, but could he steer it back to a runway?

At this point, the procedures manual called for an emergency descent to lower altitudes, but McCormick overruled that. The passengers could survive the thin air of 12,000 feet for a few moments, but his control over the airplane wouldn’t survive any sudden moves.

Flight attendant Copeland pulled herself to safety from the collapsed floor, and McCormick, citing a “mechanical problem,” coolly informed passengers that American Airlines would provide a new plane at Detroit so their trip could continue. The passengers’ mood lifted immediately. Suddenly, they could see beyond this apparently fatal problem to life on the ground.

Working very slowly, McCormick turned the jet back to Detroit’s Wayne County Airport. In a feat of airliner piloting that has never been equaled, McCormick kept the crippled DC-10 under control to the runway threshold.

It came in hot, at 186 m.p.h., because the only way McCormick could keep the airliner from tipping forward and smashing into the ground was to maintain high power on the engines. Immediately after the plane touched down, the jammed rudder sent the airliner off the runway to the right, the nose gear threatening to break off every time the airplane slammed across a taxiway. Now, irony of ironies, the airplane was speeding toward a crash with the airport fire station. Both wing engines were at full reverse, but they weren’t going to be able to stop the aircraft in time.

Co-pilot Whitney seized the moment and steered the DC-10 to safety by cutting back on one thrust reverser. This overpowered the stuck rudder. The wheels finally came to rest.

Not one person was killed, and this aircraft would fly again, most recently for FedEx Corp. [www.fedex.com].

McCormick asked McDonnell Douglas to “fix the damn door.”

From Inviting Disaster. by James R. Chiles. Copyright ©2001 by James R. Chiles. Published by arrangement with HarperBusiness, an imprint of HarperCollins Publishers Inc. All rights reserved. For more information, go to: www.invitingdisaster.com.