Architectures of Choice · Chapter 6

The Missing Fuselage

Survivorship Bias in Abraham Wald's 1943 Bomber Vulnerability Memos

Across the aluminum skin of American B-17 Flying Fortresses and B-24 Liberators limping back to airfields in East Anglia during the spring of 1943, ordnance crews recorded a consistent pattern of battle damage. When statistical officers divided the returning bombers into four structural zones and tallied every 20-millimeter cannon hole and flak-shrapnel tear per square foot of surface area, the empirical distribution looked unmistakable:

Steel armor plate was heavy. Adding armor to the entire exterior of a four-engine heavy bomber would cut its bomb load by half, lower its operational ceiling by 4,000 feet, and prevent it from reaching industrial targets across the Ruhr Valley and Schweinfurt. Looking at the damage tables compiled from hundreds of returning aircraft, senior officers in the United States Army Air Forces reached what seemed like an obvious engineering conclusion: bolt the heavy steel armor plates onto the fuselage and wings, where the airplanes were taking nearly twice as many hits per square foot as the engines.

Before executing the modification order, the military forwarded the damage logs to the Statistical Research Group (SRG), a classified wartime unit housed in a fourth-floor apartment building at 401 West 118th Street in Morningside Heights, Manhattan, operated by Columbia University for the Applied Mathematics Panel. Working inside those cramped rooms alongside economists Milton Friedman and George Stigler and director W. Allen Wallis was mathematician named Abraham Wald. Born to an Orthodox Jewish family in Cluj, Transylvania, Wald had been barred from Austrian university posts in the 1930s and had escaped Vienna for the United States in the summer of 1938 shortly before his parents and siblings were murdered at Auschwitz. Ironically, because Wald was technically classified as an "enemy alien" due to his birthplace, War Department security rules initially forbade him from reading the classified reports that his own secretaries were typing.

When Wallis briefed Wald on the bomber damage counts in early 1943, Wald immediately asked where the missing bullet holes were located.

German antiaircraft batteries on the ground and Messerschmitt Bf 109 fighters in the sky were not aiming selectively at the tail section while sparing the engines. Flak bursts and machine-gun sprays struck the silhouette of a bomber at random, proportional only to the exposed surface area of each component. If German shells struck every square foot of the aircraft at an equal baseline rate of 1.85 hits per square foot, why did the bombers parked on British runways show only 1.11 hits per square foot on their engines? Because the missing 0.74 hits per square foot were sitting at the bottom of the English Channel and across burned fields in northern France.

Between June and August 1943, Wald wrote a series of eight technical memoranda—collected under the title A Method of Estimating Plane Vulnerability Based on Damage of Survivors—that inverted the military's data set. What the Eighth Air Force had measured was not the probability of being hit in zone $i$, denoted $P(\text{Hit}_i)$, which was uniform per unit area across the aircraft. Instead, by inspecting only the airplanes that landed safely on Allied runways, the officers had measured the conditional probability of observing a hit in zone $i$ given that the aircraft survived the mission: $P(\text{Hit}_i \mid \text{Survive})$. What the armor engineers actually needed to calculate was the reverse conditional probability—the likelihood that a plane would survive the flight home given that it had taken a shell in zone $i$:

$$P(\text{Survive} \mid \text{Hit}_{i}) = \frac{P(\text{Hit}_{i} \mid \text{Survive}) P(\text{Survive})}{P(\text{Hit}_{i})}$$

Because the denominator $P(\text{Hit}_i)$ per square foot is constant across a randomly sprayed target, the true survival probability $P(\text{Survive} \mid \text{Hit}_i)$ is directly proportional to the density of bullet holes found on the survivors. A returning B-17 riddled with forty holes across its rear fuselage proved that the fuselage could absorb forty holes without falling out of the sky. Conversely, the near-total absence of returning bombers with three or more hits in an engine block or cockpit canopy proved that a single shell penetrating an oil cooler, carburetor manifold, or pilot windscreen was almost invariably fatal.

Using maximum-likelihood estimation across missions with known sortie counts and known total losses, Wald solved a system of simultaneous equations to reconstruct the invisible probability of catastrophic failure $q_i = 1 - P(\text{Survive} \mid \text{Hit}_i)$ for every unobserved wreck behind enemy lines. His calculations demonstrated that a single 20-millimeter cannon strike to the engine nacelle or fuel system carried more than three times the fatal vulnerability of an identical strike to the main fuselage skin. On Wald's recommendation, the Army Air Forces reversed their blueprints, leaving the bullet-scarred fuselages unarmored and wrapping the pristine, unmarked engines and cockpits in heavy steel plate—a protocol that remained standard across American combat aircraft through the Korean and Vietnam wars.