OBSERVATORY ehsanrahman.com
SYS OK SWEEP 10 rpm COVERAGE 98.2% {{ clock }}
./about ./projects ./aci-logs ./contact
DIRECTIVE · KNOWN-SPACE rumsfeld.txt
// MONITORING THE KNOWN — HUNTING THE UNKNOWN
There are known knowns. Things we know we know. There are known unknowns — things we know we do not know. But there are also unknown unknowns — the ones we don't know we don't know.
— Donald Rumsfeld · U.S. Secretary of Defense, 2002
A borrowed frame, used here in its older engineering sense: map what is known, name what is uncertain, and keep looking for the conditions nobody has yet seen.

Ehsan Rahman

Site Reliability Engineer · system monitoring & dependency mapping
I monitor infrastructure the way a controller works a sector{{ popS0 }}: separating traffic, chasing squawks{{ popSq0 }}, and routing around weather cells{{ popW0 }}.
RADAR · SECTOR 7
AIRWAY MAP · GLOBAL
known knowns known unknowns unknown unknowns
KNOWN KNOWNS
{{ knownN }}
tracked · transponder ok
KNOWN UNKNOWNS
{{ kuN }}
primary only · watching
UNKNOWN UNKNOWNS
{{ uuN }}
unidentified · on sweep
EVENT LOG · realtimetail -f
{{ ln.t }} {{ ln.lvl }} {{ ln.msg }}
ABOUT · whoami$ cat bio.md

I map the microburst{{ popM0 }} zones of complex architectures.

I treat the scope like a radar screen in a fast-moving storm: validate the main flow, pursue intermittent squawks{{ popSq1 }} the moment they surface, and vector traffic{{ popVT0 }} proactively around pop-up weather cells{{ popW1 }} — before the airspace collapses.

Known traffic, known gaps, and the unforecasted phenomenon that defies the briefing — the unknown unknown. The work is holding the first two on the screen, inferring the third, and acting before service is compromised.

ACTIVE PROJECTS · ~/shippedknown knowns
SHIPPED · watchOS / iOS
DeuceMate 🎾

Privacy-first tennis scoring for Apple Watch with an iPhone companion — live scoreboard, 20+ match stats, momentum & heart-rate coaching, and one-tap AI coaching exports. Native SwiftUI, zero dependencies, built end-to-end with an AI-agent workflow.

SHIPPED · iOS
Somnus 🌙

Sleep debt, made visible — a running total of how far behind your sleep target you are, built on Apple Watch sleep data from Apple Health. Everything is computed on-device: no accounts, servers or analytics. Native SwiftUI, HealthKit and Swift Charts.

LIVE · web app
11+ Vocab Builder 📖

A vocabulary trainer for the UK 11+ exam: themed readers, spoken stories and a dozen word games — quizzes, scramble, flash blitz, synonym snap and constellation explorers — with text-to-speech throughout.

INCIDENT LOGS · ACI · AIR CRASH INVESTIGATION ↗$ cat post-mortem.md
// The first story names the failure. The second explains the system.

The operator is visible; the system is usually harder to see.

I watch Air Crash Investigation and then read the reports behind the episodes as an engineer might read a production post-mortem: slowly, past the immediate failure, asking what had to be true in the wider system for it to become possible.

Across 33 cases — one featured study and 32 ledger entries — the same conditions recur: noisy alarms, corrupt inputs, deferred fixes, brittle procedures, unrealistic tests, and incentives far upstream. The point is not an easy aviation analogy, but to find the failure modes that keep reappearing in complex systems.

PROX — what was blamed
The probable cause as written. Usually the last human to touch it.
ROOT — what was true
The latent condition beneath it — in the design, data, or process.
POWER — what was left out
Where the report fell short: cost, influence, or who got to write it.
A useful post-mortem examines the conditions around the failure, not merely the person nearest to it. Otherwise the latent fault stays exactly where it was.
SYSTEMIC LENS · METHOD / POWER / COMMERCIAL PRESSURE
METHOD · HOW THE CASES WERE READ

Primary intake came from the series and general reading. AI was used to cross-check each case against the official accident report and correct for documentary perspectives. I reviewed and analysed the cases; the conclusions come from the objective record, not the screen narrative.

THE DEEPEST PATTERN ISN'T IN THE COCKPIT

Read enough cases and the strongest pattern is systemic — shaped by incentives, oversight, commercial pressure, and decisions made far upstream of the failure.

When the fuller truth surfaces, it is often forced into view by someone without a stake in preserving the original story: a grieving parent, a dissenting investigator, a whistleblower, a lawsuit, or a public inquiry. Blame without that wider examination becomes punishment theatre.

FOLLOW THE MONEY · FIVE FORMS

Behind a striking share sits one upstream force that rarely makes the probable cause: the cost line. It stretches the maintenance interval, fits the cheaper part, flies the schedule the weather warned against — then lets the operator take the fall. Nearly half the ledger carries commercial.

Cut the maintenance — stretch inspections, skip independent checks, thin the night shift, or run a flag-of-convenience operator. · Alaska 261 · Air Midwest 5481 · Aeroperú 603 · Birgenair 301 · BA 5390 · Continental 2574
Fit the cheaper part — use an older or mismatched component to save money. · Air Transat 236
Fly the schedule — let the on-time number outrank the weather margin. · American 1420 · TransAsia 222
Grow past your competence — expand faster than training and SOPsStandard Operating Procedures can carry, or keep a marginal pilot flying because you are short. · TransAsia 235 · TransAsia 222 · Crossair 3597
Sell the sizzle, bury the fix — ship the feature that sells and leave the unglamorous safety change for later. · Swissair 111 · United 811 · Turkish 981 · Propair 420

Commercial pressure is a real boundary condition, not a complete explanation. Aviation always prices risk; technology raises the bar when better testing and new approaches become affordable, while regulators sometimes accept risk longer after lobbying over cost. The question is where “safe enough” was set, by whom, and who had to carry it.

GET-THERE-ITIS · THE JUDGMENT NO SCHEDULE CAN MAKE

Aviation's name for the strongest pull is get-there-itis: the destination quietly outranking the margins. Its antidote is the airmanship to stop the revenue and take the cost before the cost takes you. Knowing when to break off, divert, or refuse an approach is less a procedure than a judgment about what risk is worth carrying, and for whom. The best operators are defined as much by what they decline as by what they can push through.

FAILURE MODES · transferable9 patterns · open one
CRITICALMonitoring & alertingAlerts must be readable, trusted, and actionable.

The link between the machine's state and the human's grasp of it breaks five ways: can't read it (a plausible lie); mixed signals (contradictory readings); too much of it (an alert cascade); didn't fire (a silent or late warning); and cried wolf (repeated false alarms). Only the last is alert fatigue.

SAME SHAPE → Ambiguity, contradiction, overload, silent failure, and false alarms defeat monitoring differently. “Add more alerts” is rarely the answer.

Alitalia 404Birgenair 301Aeroperú 603Qantas 32Qantas 72Delta 1141Ansett 703Trigana 267Linate 686
CRITICALAutomation authorityDefine precedence, visibility, and override.

When machine and human gave opposite orders, nothing said who won. In one case collision avoidance said climb while the controller said descend; in another, a flight computer pushed the nose down on data the pilots knew was false and could not instantly countermand.

SAME SHAPE → High-authority automation must surface what it is doing and why, then stand down the moment its inputs are suspect.

ÜberlingenQantas 72Birgenair 301Aeroperú 603TransAsia 235
WARNINGOne corrupt inputValidate inputs; fail loud.

A blocked tube, taped port, mislabelled data channel, or wrongly calibrated gauge fed automation that acted confidently on a lie while contradictory alarms buried the crew.

SAME SHAPE → Reconcile redundant readings and flag the outlier. A value that looks valid must not inherit unlimited authority merely because it parsed.

Aeroperú 603Birgenair 301Qantas 72Tuninter 1153Gimli 143Alitalia 404
WARNING“Compliant” is not “safe”Test the real operating envelope.

Engines were certified against rainfall no real storm produced; a heat exchanger was “compliant with the requirements” yet choked by ice; a propeller was proven flat in a lab, never against the airflow that turned it into a wall.

SAME SHAPE → Passing assumptions that exclude the real operating envelope is decoration, not validation.

TACA 110BA 38Southern 242Delta 191
WARNINGNo fail-safeDesign for safe failure, not perfect execution.

A windscreen bolted on from outside, a cargo latch that read “locked” without being locked, and a single jackscrew nut with no backup left no margin. One ordinary slip downstream was enough.

SAME SHAPE → Use redundancy, reject incompatible parts or states, and make the default failure safe.

RISK TRANSFERS → A weak design hands risk to every installer, inspector, and operator downstream, who must now be perfect forever.
BA 5390United 811Turkish 981Alaska 261Propair 420
WARNINGDeferred reliability & feature riskDebt compounds; features add risk.

An inspection interval stretched four-fold, flammable material stayed because retrofit cost, a mismatched part was forced in for the schedule, and one unverified hand owned a safety-critical task. Maintenance debt accrues silently and comes due at the worst moment, rarely on the watch of whoever deferred it.

RISK ACCUMULATES → Deferring known work compounds exposure over time.
RISK MULTIPLIES → A feature added to make a product desirable brings new surface area the appeal can hide: premium entertainment was the draw; its wiring was the fire. Treat every feature as risk surface, not only a selling point.

The exit is a feedback loop: record what maintenance repeatedly catches and bake that learning into the next design.

Alaska 261Air Transat 236Swissair 111Air Midwest 5481Continental 2574
WARNINGNormalised devianceWorking shortcuts quietly become procedure.

Crews descended below minimums, pressed approaches into storms, and landed past crosswind limits often enough that the risk stopped feeling like risk until a low-margin day made the bill payable.

SAME SHAPE → Continuation bias makes “press on” feel rational while the margin erodes. The deviation stays invisible until it becomes the headline.

American 1420TransAsia 222Crossair 3597Delta 1141
BASELINEFixationKeep eyes on the primary objective.

Whole crews watched a burnt-out indicator bulb or a hung landing gear while the aircraft, unwatched, descended into the ground. The skipped step was the load-bearing one.

SAME SHAPE → When everyone converges on the same low-stakes anomaly, nobody guards the primary objective.

Eastern 401Ansett 703Delta 1141
BASELINEAuthority gradientSeverity must override rank and ambiguity.

A first officer was right and overruled eighteen times. Another crew said “we need priority” but not the magic word “emergency,” so no one acted. Severity that hangs on rank or one phrase fails.

SAME SHAPE → Escalation needs unambiguous severity, and the junior with the correct read needs a sanctioned route to override. Politeness is not a control system.

Avianca 052First Air 6560Alitalia 404Crossair 3597
FEATURED CASE · DESIGN / CONTROL / OVERSIGHT

Boeing 737 MAX — when known anti-patterns coupled

Commercial constraints shaped the architecture; the architecture created new risk; and the safety case transferred that risk to operators who were neither informed nor equipped to carry it.
automation authoritycorrupt inputmixed signalsno fail-safeblame gradientcommercial
READ THE FULL RELIABILITY & RISK ANALYSIS
CASE NOTES · WHY THIS ONE IS FEATURED

Lion Air 610 · 29 OCT 2018 · 189 dead
Ethiopian Airlines 302 · 10 MAR 2019 · 157 dead

Most incidents here expose one or two recurring failure modes. The MAX coupled nearly all of the most transferable ones in a recent system: commercial constraint became design constraint; hidden automation acted on one bad sensor; recovery risk moved to operators who did not know what had been delegated; and compliance fragments hid the whole.

Technology had advanced. The organisational blind spot had not. The full analysis follows the chain from market pressure to delegated control, hidden sensor dependency, assumed human mitigation, certification, incident response, and the layered redesign.

THE LEDGER · ~/incidents32 compact cases · featured MAX study above
Monitoring & alerting 3 cases Linate 686 · Trigana 267 · Qantas 32
Linate · SAS 686 Runway collision in fog at Milan Linate · 118 dead 2001
Linate · SAS 686
2001 ↗
Runway collision in fog · 118 dead, Italy's worst
PROXA business jet taxied onto the active runway in fog.
ROOTGround radar decommissioned, incursion alarm disabled for nuisance, ICAOInternational Civil Aviation Organization-violating markings — every barrier removed for convenience.
POWERA controller was convicted first; the airport and ANSPAir Navigation Service Provider's years of deferred safety spending surfaced only on appeal.
alert fatigueblame gradient
Trigana 267 Terrain warning distrusted in the Papua highlands · 54 dead 2015
Trigana 267
2015 ↗
ATR 42 flew into the Papua highlands · 54 dead
PROXCrew flew below terrain clearance with the terrain warning disabled.
ROOTIts terrain warning (EGPWSEnhanced Ground Proximity Warning System — terrain-database aware) kept crying wolf on routine approaches — most likely because its database was too coarse and out of date for the topography around this remote strip to place the airport correctly (and perhaps not even GPS-linked). The captain habitually pulled its breaker to cope, and this time never reset it.
POWERReads as a reckless pilot muting a safety net — but a warning that cries wolf off stale data teaches crews to distrust it. The false-alarm burden, forced by a terrain map he couldn't fix, gets far less weight than his fatal habit.
alert fatigueblame gradient
Qantas 32 A380 uncontained engine failure · 469 aboard 2010
Qantas 32
2010 ↗
A380 uncontained engine failure · 0 dead, 469 aboard
PROXNone on the crew — an out-of-spec oil pipe cracked and burst the turbine disc.
ROOTA misaligned counter-bore left the pipe wall too thin — a manufacturing nonconformity, later found fleet-wide.
POWEREighty alerts in seconds nearly buried the root cause — the crew worked the storm of warnings by hand and put a crippled A380 down with no one hurt — while the maker's QAQuality Assurance lapse was settled privately for ~A$95M, out of public view.
alert overloaddeferred reliability
Automation authority 3 cases Überlingen · Qantas 72 · TransAsia 235
Überlingen Mid-air collision over Lake Constance · 71 dead 2002
Überlingen
2002 ↗
Mid-air collision over Lake Constance · 71 dead, 52 children
PROXController failed to separate the two jets in time.
ROOTTCASTraffic Collision Avoidance System said climb, ATCAir Traffic Control said descend — no rule for who wins; one controller on two desks, conflict-alert and phone lines down for maintenance.
POWERThe gap was no surprise — a near-identical Japan near-miss had flagged TCASTraffic Collision Avoidance System-vs-ATCAir Traffic Control a year earlier, and ICAOInternational Civil Aviation Organization made "follow the RA" mandatory only after this. Yet the lone controller, working two desks after a staffing cut, was charged and later murdered; managers were convicted five years on, lightly.
automation authorityblame gradient
Qantas 72 A330 uncommanded pitch-downs · ~110 injured 2008
Qantas 72
2008 ↗
A330 uncommanded pitch-downs · 0 dead, ~110 injured
PROXNone on the crew — the flight computers commanded the dive.
ROOTOne air-data unit spat bad angle-of-attack spikes; a rare timing case defeated the spike filter. The trigger was never proven.
POWERBlame settled neatly on two components; that automation overrode pilots on data they knew was false stayed in the captain's later book, not the foreground.
automation authoritycorrupt input
TransAsia 235 Wrong engine shut down after an auto-feather · 43 dead 2015
TransAsia 235
2015 ↗
ATR 72 stalled into a Taipei river · 43 dead
PROXThe crew shut down the one good engine.
ROOTA faulty solder joint auto-feathered the other engine; the crew acted before running the identification checklist. The captain had failed an engine-out check.
POWERHeadlines blamed one dead pilot; the report named growth outrunning training, and a regulator that didn't enforce after the same airline's crash seven months earlier.
automation authoritynormalised deviancecommercial
Corrupt input 5 cases Aeroperú 603 · Birgenair 301 · Gimli 143
Aeroperú 603 False air data over the Pacific at night · 70 dead 1996
Aeroperú 603
1996 ↗
757 fed false data, into the Pacific at night · 70 dead
PROXCleaning tape left over the static ports blocked the air-data system.
ROOTNo forcing check that protective covers were removed before flight; the cockpit then drowned the crew in contradictory warnings — and even ATCAir Traffic Control couldn't help, since the transponder fed the controller the same false altitude from the same taped ports.
POWEROnly the cleaner — poorly paid, without the language or legal resources to contest the charge — was convicted; the missing conspicuous cover surfaced in a lawsuit, not the verdict.
corrupt inputmixed signalsblame gradientcommercial
Birgenair 301 Blocked pitot and contradictory airspeeds · 189 dead 1996
Birgenair 301
1996 ↗
757 stalled shortly after takeoff · 189 dead
PROXThe crew didn't recognise the stall warning or recover.
ROOTA wasp-nested pitot fed the autopilot a false high speed; three airspeeds disagreed and were never reconciled. The captain flagged his own dead airspeed during the takeoff roll yet pressed on instead of aborting. No unreliable-airspeed checklist existed.
POWERBlame fell on the dead crew; the "paper" shell-operator and weak oversight that put an uncovered jet in service drew no finding.
corrupt inputmixed signalsautomation authorityget-there-itiscommercial
Gimli Glider · 143 767 fuel miscalculation; dead-stick landing · no deaths 1983
Gimli Glider · 143
1983 ↗
767 ran out of fuel, glided to Gimli · 0 dead
PROXCrew loaded half the fuel — a pounds-to-kilograms slip.
ROOTBlank fuel gauges dispatched under a workaround; no automated fuel check; the cross-check role deleted with the flight engineer.
POWERThe airline demoted the crew first; an external inquiry reversed it onto corporate procedures. The crew later won an airmanship award.
corrupt inputblame gradient
Tuninter 1153 Wrong fuel gauge; ditching off Sicily · 16 dead 2005
Tuninter 1153
2005 ↗
ATR 72 ditched off Sicily · 16 dead, 23 survived
PROXFuel exhaustion the crew didn't catch.
ROOTAn ATR 42 fuel gauge — physically identical, wrongly calibrated — fitted to a 72, over-reading by ~1,800 kg. No interlock, no second signature.
POWERThe crew were jailed for manslaughter despite a ditching investigators praised for saving 23. The interchangeable-but-incompatible part was the enabler.
corrupt inputblame gradient
Alitalia 404 Silent navigation failure on approach · 46 dead 1990
Alitalia 404
1990 ↗
DC-9 CFITControlled Flight Into Terrain — an airworthy aircraft flown into the ground on a Zurich ridge at night · 46 dead
PROXCrew descended below the glidepath into terrain.
ROOTA nav receiver failed silently — a steady, plausible "on path" with no warning flag; the two receivers disagreed and weren't reconciled. The same false signal also blinded the GPWSGround Proximity Warning System — warns of terrain ahead/below's "below glideslope" alert — the one mode that should have caught it. It never sounded; the only warning the whole way down was a radio-altimeter chirp at 200 feet, about a second before impact.
POWERThe maker had warned every operator of this exact failure mode years earlier; Alitalia never passed it to line crews.
corrupt inputauthority gradient
Compliant ≠ safe 4 cases TACA 110 · BA 38 · Delta 191
TACA 110 Dual flameout in hail; levee landing · no deaths 1988
TACA 110
1988 ↗
737 lost both engines in hail, dead-stick on a levee · 0 dead
PROXHail and water flamed out both engines.
ROOTEngines certified to a rainfall standard no real storm matched; hail entered the core far more readily than rain.
POWERA good post-mortem: investigators faulted their own certification standard and credited the crew — who dead-sticked a powerless 737 onto a canal levee without injury, an untestable scenario met with rare airmanship.
compliant ≠ safeunknown unknown
BA 38 Ice restricted fuel to both engines on final · no deaths 2008
BA 38
2008 ↗
777 fuel-iced and fell short of Heathrow · 0 dead
PROXIce restricted fuel to both engines on final approach.
ROOTSoft ice built up over a long cold cruise and released at the heat exchanger — "compliant with the requirements," yet vulnerable.
POWERThe other good post-mortem — candid, no scapegoat, indicting the certification standard and crediting the crew, who stretched a glide from a double-engine rollback to the runway's edge and got everyone out alive — a never-before-seen failure met in seconds.
compliant ≠ safeunknown unknown
Southern 242 Severe weather exceeded the certified envelope · 63 dead 1977
Southern 242
1977 ↗
DC-9 lost both engines in a hailstorm, landed on a highway · 72 dead
PROXMassive water and hail ingestion wrecked both compressors.
ROOTEngines never certified for that water rate; the radar attenuated, hiding the worst cell behind nearer rain.
POWERA dissenting board member blamed the crew for penetrating; the majority named the certification and weather-data gaps. The decision to press into the storm line carried a get-there-itis element, even as the attenuating radar hid how violent the worst cell was.
compliant ≠ safeget-there-itis
Delta 191 Microburst on approach to Dallas · 137 dead 1985
Delta 191
1985 ↗
L-1011 hit a microburst on approach to Dallas · 137 dead
PROXCrew flew the approach into a cell with visible lightning.
ROOTMicroburst science was barely understood; 1985 radar saw rain, not wind — the hazard was invisible to measure.
POWERThe system, not just the crew, was blind; windshear radar and ground sensors took a decade and a fleet's cost to mandate. The microburst itself was unmeasurable in 1985, yet pressing the approach beneath a cell with visible lightning still carried a get-there-itis element.
compliant ≠ safeget-there-itis
No fail-safe 3 cases United 811 · Turkish 981 · Propair 420
United 811 Cargo door opened after takeoff · 9 dead 1989
United 811
1989 ↗
747 cargo door blew out over the Pacific · 9 dead, 327 survived
PROXThe first report blamed the airline's door maintenance.
ROOTA faulty switch drove the latches open; weak lock-sectors let a "locked" door back-drive unlocked — a fail-safe that wasn't, and known weak since the 1970s.
POWERThe cheap (~$2,000/door) reinforcement sat under a low-priority FAAUS Federal Aviation Administration directive with up to a two-year window the airlines had requested — so this jet flew unmodified, until nine deaths cut the deadline to 30 days. Blamed on the mechanics first; the verdict reversed only when the victims' parents made them raise the door from the seabed.
no fail-safeblame gradientcommercial
Turkish 981 Cargo-door failure over France · 346 dead 1974
Turkish 981
1974 ↗
DC-10 cargo door, crash at Ermenonville · 346 dead
PROXA baggage handler "closed" a door that wasn't locked.
ROOTA latch that read locked without being locked; control cables routed where a floor collapse would sever them — known and tested before the crash.
POWERAn engineer's memo warned of exactly this; the regulator took a voluntary "gentlemen's agreement" over a binding order, and operators were blamed first.
compliant ≠ safeblame gradientcommercial
Propair 420 Wheel-bay fire after takeoff · 11 dead 1998
Propair 420
1998 ↗
Metro II brake fire and wing failure · 11 dead
PROXA dragging brake overheated and set the wheel bay alight.
ROOTNo brake-temperature or dragging-brake warning, poor wheel-well venting, fire reaching hydraulics and the wing. The crew flew blind — and read the fire-warning light going dark as "fire's out," when the fire had merely burned through its own circuit. With hindsight the aircraft's reluctance to track straight after takeoff was a cue to land at once; in the moment, with nothing pointing at the brakes, the cause was far from obvious.
POWERA known recurring hazard — dozens of earlier brake-overheat events — but the warning lived in a 1993 maker's newsletter, never the manual, and no fix was mandated for a small-operator turboprop.
compliant ≠ safeget-there-itisblame gradientcommercial
Deferred reliability 6 cases Alaska 261 · Swissair 111 · BA 5390
Alaska 261 Jackscrew failure after deferred maintenance · 88 dead 2000
Alaska 261
2000 ↗
MD-83 jackscrew failure, into the Pacific · 88 dead
PROXInsufficient grease let the jackscrew threads wear away.
ROOTA single non-redundant nut held the stabilizer; both barriers — lubrication and the wear check — were stretched thin.
POWERThe NTSBUS National Transportation Safety Board report pulled no punches — it faulted the regulator's oversight as squarely as the airline — but the conditions ran deep: maintenance intervals extended four-fold with FAAUS Federal Aviation Administration sign-off, and the mechanic who flagged this very screw was overruled, settled with, and resigned.
deferred reliabilityblame gradientcommercial
Air Transat 236 Fuel leak after a mismatched installation · no deaths 2001
Air Transat 236
2001 ↗
A330 fuel leak, longest jet glide, to the Azores · 0 dead
PROXCrew opened the cross-feed, draining good fuel into the leak.
ROOTA mismatched hydraulic/fuel line forced in during an engine change chafed through. With no automatic leak alert, the crew read the loss as a routine imbalance and ran the cross-feed drill — feeding good fuel into the leak; Airbus later added a fuel-balance check.
POWERThe jet flew ~13 sectors with the defect under pressure to return it to service; the airline was fined CAD $250k.
deferred reliabilitycommercial
Swissair 111 In-flight fire from wiring and insulation · 229 dead 1998
Swissair 111
1998 ↗
MD-11 in-flight fire, into the Atlantic · 229 dead
PROXAn electrical arc above the ceiling started an undetected fire.
ROOTFlammable insulation that passed an inadequate test; a bolt-on entertainment system — fitted to make the premium cabin a more desirable product — wired so the smoke checklist wouldn't even de-power it.
POWERThe TSBTransportation Safety Board of Canada's years-long investigation was a model of the craft and drove sweeping wiring- and insulation-flammability rules — but the root sat in plain sight: self-certified via a facility the FAAUS Federal Aviation Administration had cited, and the flammable insulation took until ~2005 and ~$330M to remove fleet-wide.
deferred reliabilitycompliant ≠ safecommercial
Air Midwest 5481 Mis-rigged elevator and inaccurate weights · 21 dead 2003
Air Midwest 5481
2003 ↗
Beech 1900D lost pitch control on takeoff · 21 dead
PROXElevator rigged to half its nose-down travel; aircraft loaded aft.
ROOTA never-trained subcontract trainee did the rigging — and the same person signed it off as the independent inspector.
POWEROutsourced down a three-link chain; the FAAUS Federal Aviation Administration's decades-stale average weights compounded it, revised only afterward.
deferred reliabilitycommercial
BA 5390 Wrong windscreen bolts; explosive decompression · no deaths 1990
BA 5390
1990 ↗
Windscreen blew out; captain half-ejected, survived · 0 dead
PROXThe windscreen was fitted with 84 wrong, undersized bolts.
ROOTIt was a non-plug pane bolted on from outside, so cabin pressure pushed against the bolts alone — a suboptimal, no-fail-safe design, arguably tolerable on older types that flew lower and slower but ill-suited to a pressurised jet, and one that made a routine glass swap safety-critical. A lone night-shift manager had matched the new bolts by eye to the old (also wrong) ones, not the parts catalogue.
POWERThe engineer admitted the deeper cause — overworked, expediting alone on a night shift — and it reached the first draft. BA's lawyers invoked natural justice: he'd given the account without the formal procedure, so using it was unfair. By an investigator's account it was cut — "we had to remove that from the report" — and the published emphasis moved to process.
no fail-safesuboptimal designblame gradientcommercial
Continental 2574 Incomplete maintenance handover · 14 dead 1991
Continental 2574
1991 ↗
EMB-120 broke up in flight near Eagle Lake · 14 dead
PROXScrews left out of the stabilizer's leading edge after a shift change.
ROOTA half-finished task handed over with no written turnover and no captured inspection sign-off — unglamorous work squeezed through a night-shift change under turnaround pressure.
POWERA landmark organisational report — yet a dissenting member argued it still scapegoated mechanics and should have named management as the primary cause.
deferred reliabilityblame gradientcommercial
Normalised deviance 3 cases American 1420 · TransAsia 222 · Crossair 3597
American 1420 Storm approach and runway overrun · 11 dead 1999
American 1420
1999 ↗
MD-82 overran in a thunderstorm at Little Rock · 11 dead
PROXCrew pressed a storm approach and didn't arm the spoilers.
ROOTContinuation bias on a 13-hour duty day; the unarmed spoilers — the load-bearing step — were skipped in the rush.
POWERAmerican tried to pin it on the controller — naming him in lawsuits, arguing he should have turned them from the storm — but the NTSBUS National Transportation Safety Board blamed the crew, and the surviving co-pilot testified the controller did his job. The schedule that raced a tired crew at a closing storm sat only as "contributing."
normalised devianceget-there-itisblame gradientcommercial
TransAsia 222 Below-minimums approach in poor weather · 48 dead 2014
TransAsia 222
2014 ↗
ATR 72 CFITControlled Flight Into Terrain — an airworthy aircraft flown into the ground on a typhoon-edge approach · 48 dead
PROXThe captain descended below minimums without the runway in sight.
ROOTBelow-minimums descent was a habitual, uncorrected fleet practice; fatigue from overscheduling.
POWERProsecutors charged the controllers; the report named the airline's safety culture and rostering — the commercial driver stayed in the background.
normalised devianceget-there-itiscommercial
Crossair 3597 Below-minimums night approach near Zurich · 24 dead 2001
Crossair 3597
2001 ↗
Avro RJ100 into hills short of Zurich at night · 24 dead
PROXThe captain flew below minimums without visual contact; the FOFirst Officer — the co-pilot didn't stop it.
ROOTA captain known to be weak on non-precision approaches; a noise-abatement rule, set to placate residential complaints around the airport, pushed night arrivals onto the harder one.
POWERThe airline kept a flagged pilot flying under hiring pressure; the report's weight stayed on crew error.
normalised devianceauthority gradientcommercial
Fixation 3 cases Eastern 401 · Ansett 703 · Delta 1141
Eastern 401 Crew fixation during a slow descent · 101 dead 1972
Eastern 401
1972 ↗
L-1011 into the Everglades · 101 dead
PROXThe whole crew fixated on a burnt-out gear indicator bulb.
ROOTNo one flew the aircraft; a nudged autopilot let a slow descent go unwatched; one weak altitude chime sounded at an empty seat.
POWERThe canonical case for crew-resource management — which the industry then took ~18 years to actually mandate. Hoping a whole crew simply won't look away at once is not a strategy; high performance needs a systematic guard, not good intentions — and the foresight shouldn't have had to wait for the wreck.
fixation
Ansett NZ 703 Hung-gear fixation and late terrain warning · 4 dead 1995
Ansett NZ 703
1995 ↗
Dash 8 CFITControlled Flight Into Terrain — an airworthy aircraft flown into the ground near Palmerston North · 4 dead
PROXBoth pilots absorbed in a hung-gear drill while the approach drifted down.
ROOTFixation drained monitoring; the terrain warning fired ~4s out instead of ~17 — a malfunction never explained.
POWERThe captain was prosecuted and acquitted; an academic re-analysis argued the report under-weighted the systemic faults.
fixationfailed to alert
Delta 1141 Takeoff configuration omitted; warning failed · 14 dead 1988
Delta 1141
1988 ↗
727 failed to fly off after takeoff · 14 dead
PROXCrew took off with the flaps and slats not set.
ROOTA chatty, non-sterile cockpit skipped the config step with no challenge-response check to force it; the warning horn that should have caught it was silently failed.
POWERThe report leaned on "cockpit discipline"; a fleet check then found the backstop alarm unreliable across ~1,190 aircraft.
fixationfailed to alert
Authority gradient 2 cases Avianca 052 · First Air 6560
Avianca 052 Fuel emergency lost in ambiguous phraseology · 73 dead 1990
Avianca 052
1990 ↗
707 ran out of fuel over Long Island · 73 dead
PROXCrew didn't declare a fuel emergency to ATCAir Traffic Control.
ROOTThey said "priority" and "running out of fuel" — never the word "emergency" that triggers action. No standard low-fuel phraseology.
POWERA safety net that hinged on one magic word and a non-native crew's assertiveness; controllers weren't obliged to probe the ambiguity. A simple fuel-state protocol — Pan-PanUrgency call — serious, one level below a Mayday at one threshold, MaydayDistress call — grave and imminent danger at the next — would have replaced the need to be assertive with a rule that fires on its own.
authority gradient
First Air 6560 Correct dissent had no route to override · 12 dead 2011
First Air 6560
2011 ↗
737 CFITControlled Flight Into Terrain — an airworthy aircraft flown into the ground at Resolute Bay · 12 dead, 3 survived
PROXThe captain continued an unstable, off-track approach into a hill.
ROOTA silently drifting compass while the GPS showed the truth; the first officer read it right and called it ~18 times — the captain waved the discrepancy off as an ILSInstrument Landing System — radio guidance down to the runway or instrument glitch instead of breaking off.
POWERNo procedure let the FOFirst Officer — the co-pilot take control; half-day CRMCrew Resource Management — cockpit teamwork discipline training left the correct dissent with no path to action.
authority gradient
sources → NTSBUS National Transportation Safety Board · AAIBUK Air Accidents Investigation Branch · BFUGermany's Federal Bureau of Aircraft Accident Investigation · TSBTransportation Safety Board of Canada · ATSBAustralian Transport Safety Bureau · ANSVItaly's aviation safety investigation agency · TAICNew Zealand Transport Accident Investigation Commission · GPIAAPortugal's aviation accident investigation authority · DGACDirectorate General of Civil Aviation — each ↗ opens the public record.
read from the series Air Crash Investigation; every root cause re-checked against the official report. none of this is really about aeroplanes.
CONTACT · ./connectexit 0
@_EhsanR ↗ x.com linkedin ↗ github ↗ email ↗