The Case Studies

Tenerife Airport Disaster — Canary Islands, March 27, 1977

The deadliest accident in commercial aviation history began with an ambiguous phrase spoken in fog, received through radio interference, and resolved by a mind too committed to departure to hold the gap open.

Avianca Flight 52 — Long Island, New York, January 25, 1990

A crew running out of fuel over JFK Airport told controllers they needed priority. The word they needed was emergency. One word, precisely defined, would almost certainly have saved 73 lives.

Battle of Karansebes — Habsburg Empire, 1788

A multinational army, diverse in language and without a common working idiom for orders and challenges, mistook its own vanguard for the enemy in darkness. The Ottomans arrived the following morning to find the field abandoned.

Battle of the Imjin River — Korea, April 1951

A British brigadier reported a desperate situation to his American superior with the phrase ‘things are a bit sticky.’ Both men were native English speakers. Neither recognized they were not speaking the same professional language.

Patriot Missile System — Dhahran, Saudi Arabia, February 25, 1991

The decimal value 0.1 cannot be represented exactly in binary. After 100 hours of continuous operation, the accumulated rounding error was large enough to place the predicted Scud location several hundred meters from its actual position. Twenty-eight soldiers died.

Battle of Balaclava — Crimea, October 25, 1854

A vague staff order, a messenger who could not be questioned, and a cavalry commander who interpreted the order based on what he could see from his position. Six hundred men rode toward the Russian guns.

Mokusatsu Incident — Tokyo, late July 1945

A single Japanese word whose meaning depended entirely on context was translated into English carrying a nuance that fed Washington’s conclusion that Japan had rejected the Potsdam Declaration with contempt.

Space Shuttle Challenger — Database Contradiction, 1985–1986

NASA documentation inconsistently classified the solid rocket booster O-rings as both critically failure-prone and safely redundant. The contradiction was never resolved. The shuttle kept flying.

Saturn V Flutter Test — NASA Marshall Space Flight Center, 1964–65

A junior engineer working on his doctorate discovered that the Saturn V third stage panels were susceptible to aeroelastic flutter. His supervisor backed him. Von Braun stopped the schedule and ran the test. They fluttered.

USS Vincennes Incident — Strait of Hormuz, July 3, 1988

Multiple independent data streams were fused into a single internally consistent picture that was tactically alarming and catastrophically false. Iran Air Flight 655 carried 290 people. There were no survivors.

Black Hawk Shootdown — Northern Iraq, April 14, 1994

Nearly three years of uneventful peacetime operations had quietly dissolved the mandatory procedures designed for exactly the scenario that unfolded on a clear April morning. Twenty-six people died because every safety margin had eroded simultaneously.

Mars Climate Orbiter — September 23, 1999

One team calculated thruster corrections in pounds of force. The other assumed newtons. The mismatch was never verified across the single interface that connected them. A $327 million spacecraft was lost.

Ariane 5 Rocket — Guiana Jungle, June 4, 1996

Software verified as safe for the Ariane 4 was transplanted to the Ariane 5 without revalidation. The Ariane 5 had a significantly higher horizontal velocity. The software crashed 37 seconds after liftoff.

Air Canada Flight 143 — Gimli, Manitoba, July 23, 1983

The crew calculated fuel load using the wrong conversion factor. The number was specific, internally consistent, and wrong by a factor of 2.2. The Boeing 767 glided without power to a decommissioned airstrip in Manitoba.

Knightrider 06 — USS Eisenhower, Arabian Gulf, 1988

A helicopter pilot under pressure calculated payload capacity using the density of jet fuel. He was carrying milk. The aircraft settled toward the ocean 90 feet above the Arabian Gulf with rotor RPM drooping toward the limit.

Spanish S-80 Submarine — Navantia Shipyard, Spain, 2010s

A calculation error propagated through the weight and buoyancy analysis of an entire submarine class. The vessels were 70 tons heavier than designed — too heavy to resurface once submerged. Spain spent hundreds of millions of euros on corrections.

Therac-25 Radiation Machine — North America, 1985–1987

Designers replaced the hardware failsafes of the predecessor machine with software-based interlocks — and assumed the software was equivalent without testing it. At least six patients received lethal radiation overdoses.

Thalidomide Safety Review — Washington, D.C., 1960–1962

Frances Kelsey refused to approve thalidomide for the American market not because the data showed it was dangerous, but because the data was insufficient to show it was safe. She held that position under two years of sustained institutional and commercial pressure. In the countries that approved the drug, an estimated 10,000 to 20,000 children were born with severe limb deformities.

Deepwater Horizon Disaster — Gulf of Mexico, April 20, 2010

The pressure gauge read 1,400 psi when it should have read zero. The crew had an explanation for this. The explanation led to the answer everyone needed — that the well was secure and the work could continue. Eleven men died. The well discharged five million barrels of oil into the Gulf of Mexico.

Eastern Airlines Flight 401 — Miami, December 29, 1972

Three of the most experienced aviators in the industry became collectively fixated on a $12 landing gear indicator bulb while their fully airworthy L-1011 descended imperceptibly toward the Florida Everglades. The altitude warning chimed. No one investigated the chime.

RMS Titanic — North Atlantic, April 14–15, 1912

Seven separate ice warnings arrived before the Titanic struck the iceberg. Officers logged them, partially transmitted them, and gave them exactly the weight North Atlantic shipping culture demanded — which was not much.

BP Texas City Refinery Explosion — Texas City, Texas, March 23, 2005

The refinery’s personal safety metrics had been improving for years. Process safety — the condition of the equipment and procedures that determined whether the refinery would explode — was not being systematically tracked. Fifteen workers died.

I-35W Bridge Collapse — Minneapolis, Minnesota, August 1, 2007

The bridge had been inspected regularly for decades. The undersized gusset plates at the heart of the truss structure had existed since 1967. Thirteen people died.

Vioxx Risk Assessment — 1999–2004

The VIGOR trial was designed to demonstrate Vioxx’s gastrointestinal advantage. The cardiovascular signal was present in the same dataset. The frame through which the data was examined maintained a lens designed for the question that had been asked rather than the question the data was answering.

Hyatt Regency Walkway Collapse — Kansas City, Missouri, July 17, 1981

A fabricator proposed a design modification that appeared structurally equivalent to the original. It was not. It doubled the load on a connection that had not been designed for the combined weight. One hundred fourteen people died.

Quebec Bridge Collapse — Quebec City, Canada, August 29, 1907

The most respected bridge engineer in North America managed the project from his New York office. The field engineer had the eyes on the problem. The consulting engineer had the authority to stop the work. The two were never in the same place at the same time during the critical weeks. Seventy-five workers died.

Banqiao Dam Failure — Henan Province, China, August 8, 1975

A hydraulic engineer submitted a formal analysis showing the dam’s design parameters did not account for the meteorological conditions possible in the region. He was removed from the project for insufficient revolutionary zeal. Between 170,000 and 230,000 people died.

Tacoma Narrows Bridge Collapse — Puget Sound, November 7, 1940

The deflection theory that had produced a generation of successful suspension bridges had never been tested against aeroelastic flutter. Galloping Gertie collapsed into Puget Sound four months after it opened.

Air France Flight 447 — South Atlantic Ocean, June 1, 2009

The stall warning sounded 73 times in the 4 minutes and 23 seconds that remained from crisis to impact. It was correct every time. The crew never assembled the information into the picture it was making. All 228 people aboard died.

Naval Air Systems Command — Patuxent River, Maryland

A structured design review identified a 20-pound data inconsistency between two engineering analyses of a proposed aircraft modification. The program stopped, traced the error to its source, corrected the design, and accepted a six-month delay. The case study demonstrates what institutional attention to Significance, Relevance, Depth, and Breadth looks like when it functions correctly.

Space Shuttle Challenger — Cape Canaveral, January 27–28, 1986

The engineers had the data on O-ring temperature sensitivity. They presented it. They made the recommendation. Management asked them to reconsider. One senior manager told his Vice President of Engineering to take off his engineering hat and put on his program hat. Seven astronauts died the following morning.

Space Shuttle Columbia — Over Texas and Louisiana, February 1, 2003

Diane Vaughan extended her Challenger analysis to Columbia in a new preface to her 2016 edition. The same normalization of deviance, the same structural secrecy, the same culture of production — seventeen years later.

Vioxx Study Suppression — 2000–2004

Between the VIGOR cardiovascular signal and the APPROVe confirmation, Merck continued marketing Vioxx. An estimated 88,000 to 139,000 heart attacks worldwide have been linked to Vioxx use during the period between its approval and its withdrawal.

Swedish Warship Vasa — Stockholm Harbor, August 10, 1628

The stability test worked — 30 men running back and forth across the deck showed an alarming roll rate. The test was halted early. The ship was declared ready. The Vasa capsized and sank within sight of the dock it had just left.

Chen Xing — Henan Province, China, 1921–2009

Chen Xing identified the flood risk, documented it precisely, submitted it formally through official channels, and put his name on it in a political environment that had already signaled it would not be welcome. He was removed from the project. He lived to see his analysis vindicated. Between 170,000 and 230,000 people did not.

Vajont Dam Disaster — Northeastern Italy, October 9, 1963

The survey stakes on the slope above the reservoir showed consistent, measurable, one-directional movement for months. Approximately 1,900 people died when the slope fell into the reservoir at 10:39 PM on October 9, 1963.

Thalidomide Approval Denial — FDA, Washington, D.C., 1960–1962

Frances Kelsey’s story appears in Chapter II as a study in Completeness. It appears again here because the same behavior that meets an evidentiary standard also demonstrates what intellectual courage looks like in its most common, least dramatic form: a professional refusing, day after day, to say what she did not know.

Michael Faraday — London, 1791–1867

Faraday kept meticulous records of his failures alongside his successes. He published both. He declined a knighthood and the presidency of the Royal Society, preferring to remain, as he put it, plain Michael Faraday. The farad and the faraday carry his name into every laboratory and every circuit board ever built.

Ada Lovelace — London, 1815–1852

In 1843, Lovelace published the first algorithm intended for execution by a machine, and articulated the founding insight of general-purpose computing. She published under her initials because her name would have undermined the work’s reception. The US Department of Defense named its standard programming language Ada after her in 1980.