The investigator’s vocabulary.

An immediate error or violation by people at the interface with a system, which occurs close in time to the accident.

Explained in Swiss cheese and causal chains: why single causes mislead. Seen in Hyatt Regency walkway collapse, Apollo 13, 2003 Northeast blackout, Space Shuttle Columbia.

Richards Heuer's method of arranging evidence for and against several explanations in a matrix, so that the explanations can be tested rather than simply confirmed.

Explained in Competing hypotheses in practice: list the rivals, then test them. Seen in Discovery of Neptune, Enigma and the Bombe, Chicxulub impact, Seafloor spreading.

A test that measures how much active substance a preparation contains, which is needed before preparations can be compared or dosed.

Explained in Living with uncertainty: what evidence leaves open. Seen in Tacoma Narrows Bridge, Endurance expedition, 1919 eclipse test of general relativity, Discovery of penicillin.

A record of what a system did, when, and under which version and inputs, so that its output can be checked later. Where such records are missing or can be altered, the output is harder to test.

Explained in When the computer is presumed right: testing system records. Seen in Post Office Horizon scandal, Therac-25 radiation overdoses, Patriot missile failure at Dhahran, Knight Capital deployment.

A moment when an automated system does something its operators did not expect, so they must work out what it is doing before they can act.

Explained in Automation surprise: when a system does something else. Seen in Air France 447 crash (2009), Boeing 737 MAX MCAS crashes (2018–2019), Apollo 11 program alarms (1969), Three Mile Island Unit 2 accident.

A change in what an organization treats as normal, so that a condition once considered abnormal no longer triggers review.

Explained in Normalization of deviance: when warnings become routine. Seen in Space Shuttle Columbia, Challenger disaster, Apollo 13.

The number of machines, accounts or services that a single change can affect before the change is stopped or reverted.

Explained in Trust in the update pipeline: why one file reaches everyone. Seen in CrowdStrike outage (2024), AWS us-east-1 outage (2025), xz Utils backdoor (2024), Knight Capital deployment.

Sudden failure with little plastic deformation, made more likely by low temperature, notches and low toughness.

Explained in Fatigue and fracture: how structures fail without warning. Seen in Hyatt Regency walkway collapse, Liberty ships and T2 tanker fractures, Quebec Bridge collapse.

The obligation to show that a disputed claim is true. Who carries it decides what counts as enough evidence and who must produce it.

Explained in When the computer is presumed right: testing system records. Seen in Post Office Horizon scandal, Therac-25 radiation overdoses, Patriot missile failure at Dhahran, Knight Capital deployment.

Wording whose strength matches the evidence, distinguishing what is established, what is probable and what is still open.

Explained in Living with uncertainty: what evidence leaves open. Seen in Tacoma Narrows Bridge, Endurance expedition, 1919 eclipse test of general relativity, Discovery of penicillin.

Comparing an instrument against a reference of known value and recording the relationship, so that its readings can be corrected or trusted within stated limits.

Explained in When the instrument is wrong: calibration in six cases. Seen in Hubble Space Telescope, OPERA neutrino timing anomaly (2011 to 2012), Patriot missile failure at Dhahran, GPS and relativity.

A sequence in which one failure shifts load onto other elements, causing further failures in turn.

Explained in Feedback loops in structures: when motion feeds its own force. Seen in Tacoma Narrows Bridge, London Millennium Bridge sway, 2003 Northeast blackout.

A steady accumulation of timing error that grows with elapsed time and makes a system's time model increasingly wrong.

Explained in Software timing failures: priority, drift and inherited code. Seen in Mars Pathfinder software resets, Patriot missile failure at Dhahran, Ariane 5 Flight 501.

A single cause that disables two or more components or channels that were expected to fail independently.

Explained in Common-mode failure: when every backup shares one weakness. Seen in Ariane 5 Flight 501, 2003 Northeast blackout, Challenger disaster.

A shared weakness that makes two apparently separate checks fail together, so their agreement is less informative than it looks.

Explained in Provenance and physical traces: testing whether a claim holds. Seen in Piltdown Man hoax, Apollo 13, Chicxulub impact, GW150914 gravitational waves.

A variable associated with both a suspected cause and an outcome, which can create or hide an apparent relationship between them.

Explained in Confounding: why two groups can differ for other reasons, When nature runs the experiment: natural tests of cause. Seen in John Snow and the Broad Street pump, 1918 influenza pandemic, Antarctic ozone hole, London’s Great Smog.

A distortion in which a second difference between groups creates, hides or exaggerates an apparent effect.

Explained in Fair tests before statistics: how comparisons earn their weight. Seen in James Lind's scurvy trial (1747), Semmelweis and puerperal fever, John Snow and the Broad Street pump, Helicobacter pylori and peptic ulcer.

A condition that increased the likelihood or severity of a failure without being sufficient by itself.

Explained in How to read an accident report: findings, causes and limits. Seen in Hyatt Regency walkway collapse, Challenger disaster, Space Shuttle Columbia, Apollo 13.

A comparison group that does not receive the factor being studied, showing what would happen without it.

Explained in Fair tests before statistics: how comparisons earn their weight. Seen in James Lind's scurvy trial (1747), Semmelweis and puerperal fever, John Snow and the Broad Street pump, Helicobacter pylori and peptic ulcer.

Errors that appear together in several measurements because they share a common cause.

Explained in Why replication matters: independent checks before belief. Seen in OPERA neutrino timing anomaly (2011 to 2012), GW150914 gravitational waves, Antarctic ozone hole.

A reasoning exercise about what would have happened under different choices. It must be bounded by the information and constraints of the time.

Explained in Hindsight bias: judging decisions with the ending in view. Seen in Challenger disaster, Endurance expedition, Discovery of pulsars, Antarctic ozone hole.

A guessed stretch of plaintext used to test candidate settings of an encryption machine, because each guess produces constraints that can be checked against the ciphertext.

Explained in Competing hypotheses in practice: list the rivals, then test them. Seen in Discovery of Neptune, Enigma and the Bombe, Chicxulub impact, Seafloor spreading.

The condition at which a warning should trigger a change of plan. It should be defined before the event rather than after it.

Explained in Warnings that did not land: when signals fail to change decisions. Seen in RMS Titanic, Space Shuttle Columbia, Challenger disaster, Johnstown Flood.

A claim that would overturn well-tested knowledge or that ordinary processes do not easily produce. It needs stronger evidence and more independent checks than an everyday result.

Explained in Too good to be true: warning signs before anyone replicates. Seen in LK-99 superconductor claim (2023), Bernard Madoff Ponzi scheme, Theranos blood testing (2013–2018), Cold fusion claim, 1989.

A specific consequence of an explanation that could turn out to be wrong when observed.

Explained in Residuals and discovery: the mismatch that points somewhere. Seen in Discovery of pulsars, Discovery of Neptune, Michelson-Morley experiment, Cosmic microwave background.

Progressive cracking caused by repeated loading, which can occur under loads well below the material's static strength.

Explained in Fatigue and fracture: how structures fail without warning. Seen in Hyatt Regency walkway collapse, Liberty ships and T2 tanker fractures, Quebec Bridge collapse.

A process in which part of a system's output returns as an input that changes the output further.

Explained in Feedback loops in structures: when motion feeds its own force. Seen in Tacoma Narrows Bridge, London Millennium Bridge sway, 2003 Northeast blackout.

Controlled outages that operators order to keep a grid from a wider collapse. The FERC and NERC review counts 23,418 MW of manual firm load shed in Texas in February 2021.

Explained in Why power grids collapse: voltage, frequency and visibility. Seen in Iberian blackout (2025), Texas grid freeze (2021), 2003 Northeast blackout.

A self-sustaining oscillation in which motion changes the aerodynamic forces that feed it, so that a structure can draw energy from the wind.

Explained in Living with uncertainty: what evidence leaves open, Feedback loops in structures: when motion feeds its own force. Seen in Tacoma Narrows Bridge, Endurance expedition, 1919 eclipse test of general relativity, Discovery of penicillin.

The property that a failure in one channel cannot propagate to others through shared inputs, software, power or environmental conditions.

Explained in Common-mode failure: when every backup shares one weakness. Seen in Ariane 5 Flight 501, 2003 Northeast blackout, Challenger disaster.

The tendency, after learning an outcome, to judge it as more predictable than it was when the decision was made.

Explained in Hindsight bias: judging decisions with the ending in view. Seen in Challenger disaster, Endurance expedition, Discovery of pulsars, Antarctic ozone hole.

An investigation by a body that did not operate the system. It reconstructs events from records, testimony and physical evidence, and it can be checked against the company's own account.

Explained in Reading a post-incident review and what it leaves out. Seen in AWS us-east-1 outage (2025), CrowdStrike outage (2024), Alaska Airlines Flight 1282 door plug (2024), Knight Capital deployment.

What a display, light or gauge reports. It may reflect a command sent to equipment, feedback from the equipment, or an inference drawn from other readings.

Explained in Alarm floods and silent failures: signals that mislead. Seen in Three Mile Island Unit 2 accident, 2003 Northeast blackout, Apollo 13, Discovery of pulsars.

The agreed specification of what a boundary carries, including units, reference frames, sign conventions and timing.

Explained in Units and interfaces: where a correct number goes wrong. Seen in Mars Climate Orbiter, Hubble Space Telescope, Apollo 13, OPERA neutrino timing anomaly (2011 to 2012).

A test whose correct output is computed independently from physics, so that a wrong interpretation shows up as a mismatch.

Explained in Units and interfaces: where a correct number goes wrong. Seen in Mars Climate Orbiter, Hubble Space Telescope, Apollo 13, OPERA neutrino timing anomaly (2011 to 2012).

A weakness created earlier by design, organizational or management decisions, which persists until it contributes to an accident.

Explained in Swiss cheese and causal chains: why single causes mislead. Seen in Hyatt Regency walkway collapse, Apollo 13, 2003 Northeast blackout, Space Shuttle Columbia.

The route by which forces travel through a structure to its supports. Changes to connections can change the load path even when the visible members look the same.

Explained in How to read an accident report: findings, causes and limits, Fatigue and fracture: how structures fail without warning. Seen in Hyatt Regency walkway collapse, Challenger disaster, Space Shuttle Columbia, Apollo 13.

The interval of values an instrument reports reliably. A reading at the top of the scale can mean the true value is higher.

Explained in Alarm floods and silent failures: signals that mislead. Seen in Three Mile Island Unit 2 accident, 2003 Northeast blackout, Apollo 13, Discovery of pulsars.

A gap between an operator's belief about the mode a system is in and the mode it is actually in, so that the same input produces an action the operator did not intend.

Explained in Automation surprise: when a system does something else. Seen in Air France 447 crash (2009), Boeing 737 MAX MCAS crashes (2018–2019), Apollo 11 program alarms (1969), Three Mile Island Unit 2 accident.

An ordinary cause, such as an impurity, a loose connector, a calibration assumption or a magnet, that could produce the observation without the extraordinary claim being true.

Explained in Too good to be true: warning signs before anyone replicates. Seen in LK-99 superconductor claim (2023), Bernard Madoff Ponzi scheme, Theranos blood testing (2013–2018), Cold fusion claim, 1989.

A situation in which circumstances, rather than the researcher, determine who is exposed, so that the groups can be compared with less bias.

Explained in Confounding: why two groups can differ for other reasons, When nature runs the experiment: natural tests of cause. Seen in John Snow and the Broad Street pump, 1918 influenza pandemic, Antarctic ozone hole, London’s Great Smog.

The gradual acceptance of a departure from expected performance, often through a series of small decisions that each seem reasonable on their own.

Explained in Normalization of deviance: when warnings become routine, Warnings that did not land: when signals fail to change decisions. Seen in Space Shuttle Columbia, Challenger disaster, Apollo 13, RMS Titanic.

A measurement that does not detect the effect it was designed to find. It is interpreted together with the sensitivity of the apparatus.

Explained in Residuals and discovery: the mismatch that points somewhere. Seen in Discovery of pulsars, Discovery of Neptune, Michelson-Morley experiment, Cosmic microwave background.

Information about how an event ended, which can change judgments about how likely the event had seemed earlier.

Explained in Hindsight bias: judging decisions with the ending in view. Seen in Challenger disaster, Endurance expedition, Discovery of pulsars, Antarctic ozone hole.

A document, usually written by the organization that operated a system, that describes what happened, why, and what will change. Its author and purpose shape its emphasis.

Explained in Reading a post-incident review and what it leaves out. Seen in AWS us-east-1 outage (2025), CrowdStrike outage (2024), Alaska Airlines Flight 1282 door plug (2024), Knight Capital deployment.

The default assumption that a system's output is correct until someone shows otherwise. It is reasonable for many systems, but it becomes a problem when it replaces testing.

Explained in When the computer is presumed right: testing system records. Seen in Post Office Horizon scandal, Therac-25 radiation overdoses, Patriot missile failure at Dhahran, Knight Capital deployment.

A situation in which a high-priority task waits for a resource held by a lower-priority task, while medium-priority work keeps the lower task from finishing.

Explained in Software timing failures: priority, drift and inherited code. Seen in Mars Pathfinder software resets, Patriot missile failure at Dhahran, Ariane 5 Flight 501.

The investigators' best-supported account of what produced a failure. It is usually an inference from evidence rather than a direct observation.

Explained in How to read an accident report: findings, causes and limits. Seen in Hyatt Regency walkway collapse, Challenger disaster, Space Shuttle Columbia, Apollo 13.

The documented history of an object, record or dataset, from its origin through every handling and processing step.

Explained in Provenance and physical traces: testing whether a claim holds. Seen in Piltdown Man hoax, Apollo 13, Chicxulub impact, GW150914 gravitational waves.

The range of conditions, such as voltage, temperature or load, within which a component has been shown to perform safely.

Explained in Normalization of deviance: when warnings become routine. Seen in Space Shuttle Columbia, Challenger disaster, Apollo 13.

Assigning people or units to groups by chance, so that unknown differences are spread across groups rather than aligned with the factor under study.

Explained in Fair tests before statistics: how comparisons earn their weight. Seen in James Lind's scurvy trial (1747), Semmelweis and puerperal fever, John Snow and the Broad Street pump, Helicobacter pylori and peptic ulcer.

A feature of a claim or its evidence, such as an unexplained failure, missing products or unavailable records, that calls for a specific check before the claim is accepted.

Explained in Too good to be true: warning signs before anyone replicates. Seen in LK-99 superconductor claim (2023), Bernard Madoff Ponzi scheme, Theranos blood testing (2013–2018), Cold fusion claim, 1989.

An independent attempt to obtain the same result using different equipment, methods or observers.

Explained in Why replication matters: independent checks before belief. Seen in OPERA neutrino timing anomaly (2011 to 2012), GW150914 gravitational waves, Antarctic ozone hole.

A test that exercises the conditions the system will actually meet, including new operating ranges and boundary values.

Explained in Common-mode failure: when every backup shares one weakness. Seen in Ariane 5 Flight 501, 2003 Northeast blackout, Challenger disaster.

The difference between an observed value and the value a model predicts. A residual signals a problem but does not name its cause.

Explained in Competing hypotheses in practice: list the rivals, then test them, Residuals and discovery: the mismatch that points somewhere. Seen in Discovery of Neptune, Enigma and the Bombe, Chicxulub impact, Seafloor spreading.

A cyclical pattern that is mistaken for, or hides, a long-term change when periods of different seasons are compared.

Explained in Confounding: why two groups can differ for other reasons. Seen in John Snow and the Broad Street pump, 1918 influenza pandemic, Antarctic ozone hole.

Quartz whose internal structure has been altered by the intense, brief pressure of a high-energy impact, one of the physical marks of an impact.

Explained in Provenance and physical traces: testing whether a claim holds. Seen in Piltdown Man hoax, Apollo 13, Chicxulub impact, GW150914 gravitational waves.

A design in which one sensor or input determines the system's behavior, with no independent check against a second source.

Explained in Automation surprise: when a system does something else. Seen in Air France 447 crash (2009), Boeing 737 MAX MCAS crashes (2018–2019), Apollo 11 program alarms (1969), Three Mile Island Unit 2 accident.

An operator's current understanding of what the system is doing and why, including what the instruments cannot show.

Explained in Alarm floods and silent failures: signals that mislead. Seen in Three Mile Island Unit 2 accident, 2003 Northeast blackout, Apollo 13, Discovery of pulsars.

The sources, build steps, signing and distribution that turn source code into the files users install. A defect or an attack can enter at any link.

Explained in Trust in the update pipeline: why one file reaches everyone. Seen in CrowdStrike outage (2024), AWS us-east-1 outage (2025), xz Utils backdoor (2024), Knight Capital deployment.

A release made in stages, starting with a small canary group, so that a defect is seen by few machines before wider groups receive it.

Explained in Trust in the update pipeline: why one file reaches everyone. Seen in CrowdStrike outage (2024), AWS us-east-1 outage (2025), xz Utils backdoor (2024), Knight Capital deployment.

A local rise in stress at a hole, sharp corner, weld, notch or sudden change of shape.

Explained in Fatigue and fracture: how structures fail without warning. Seen in Hyatt Regency walkway collapse, Liberty ships and T2 tanker fractures, Quebec Bridge collapse.

James Reason's description of accidents as hazards that pass through aligned weaknesses in successive layers of defense.

Explained in Swiss cheese and causal chains: why single causes mislead. Seen in Hyatt Regency walkway collapse, Apollo 13, 2003 Northeast blackout, Space Shuttle Columbia.

An error that pushes results consistently in one direction across repeated measurements, so averaging does not remove it.

Explained in Why replication matters: independent checks before belief, Units and interfaces: where a correct number goes wrong, When the instrument is wrong: calibration in six cases. Seen in OPERA neutrino timing anomaly (2011 to 2012), GW150914 gravitational waves, Antarctic ozone hole, Mars Climate Orbiter.

A layer of cooler air beneath warmer air, which suppresses vertical mixing and can trap pollution close to the ground.

Explained in When nature runs the experiment: natural tests of cause. Seen in London’s Great Smog, Antarctic ozone hole, 1918 influenza pandemic.

The documented chain of comparisons that links a measurement to an accepted reference standard, with each link checked.

Explained in When the instrument is wrong: calibration in six cases. Seen in Hubble Space Telescope, OPERA neutrino timing anomaly (2011 to 2012), Patriot missile failure at Dhahran, GPS and relativity.

The event that starts a failure sequence. It is distinct from the conditions that were already present and allowed the trigger to cause harm.

Explained in Reading a post-incident review and what it leaves out. Seen in AWS us-east-1 outage (2025), CrowdStrike outage (2024), Alaska Airlines Flight 1282 door plug (2024), Knight Capital deployment.

A protective device that disconnects generating units when system frequency falls below their trip level. In Texas, about 17,000 MW of units were at risk of tripping on such relays within the nine-minute window.

Explained in Why power grids collapse: voltage, frequency and visibility. Seen in Iberian blackout (2025), Texas grid freeze (2021), 2003 Northeast blackout.

The management of voltage so that it stays within what the plants and the network can absorb. The Iberian panel identified its non-effectiveness as the key phenomenon in the 2025 collapse.

Explained in Why power grids collapse: voltage, frequency and visibility. Seen in Iberian blackout (2025), Texas grid freeze (2021), 2003 Northeast blackout.

A timer that resets a system when the software does not signal, within its expected interval, that it is still working.

Explained in Software timing failures: priority, drift and inherited code. Seen in Mars Pathfinder software resets, Patriot missile failure at Dhahran, Ariane 5 Flight 501.