The journal · 26 field notes
Field notes on how things go wrong, and how we find out.
Long reads on the methods and mechanisms behind the cases: common-mode failure, residuals, replication, warnings that never landed. Each note links to the investigations where you can test the idea yourself.
Photograph: The Information Bureau at New York City Police Department headquarters. George Grantham Bain Collection · Public domain · Wikimedia Commons. Object: A Remington Streamliner portable typewriter, about 1935. Daderot · CC0 · Wikimedia Commons.
Show
Competing hypotheses in practice: list the rivals, then test themA favored explanation can make every observation look like support. Learn how listing rivals and seeking evidence against them worked in four cases.
Confounding: why two groups can differ for other reasonsComparing groups can reveal causes or mislead about them. Learn how confounders, natural experiments and seasonal patterns change what a comparison shows.
Fair tests before statistics: how comparisons earn their weightStatistics cannot rescue an unfair comparison. Learn how controls, natural contrasts and exceptions separated real effects from coincidence.
Hindsight bias: judging decisions with the ending in viewKnowing how an event ended makes earlier choices look obvious. Learn how hindsight bias distorts investigations and how to rebuild what was known.
How to read an accident report: findings, causes and limitsOfficial investigation reports separate what was measured from what was concluded and what should change. Learn to read each layer and test its claims.
Living with uncertainty: what evidence leaves openSome conclusions stay partly open. Learn to state what evidence supports, what remains disputed, and why a sound mechanism can have contested details.
Provenance and physical traces: testing whether a claim holdsClaims earn trust through documented history and independent evidence. Learn to test provenance, dating and physical traces before accepting them.
Swiss cheese and causal chains: why single causes misleadJames Reason's layered model shows how several defenses fail together. Learn to build causal chains and resist single-cause stories.
Why replication matters: independent checks before beliefA striking result can come from one instrument, one team or one shared assumption. Learn what replication does, what it cannot do, and how to design it.
Alarm floods and silent failures: signals that misleadWarnings fail in two ways: they flood operators, or fall silent while trouble grows. Learn to test whether an indicator shows a state or only a command.
Common-mode failure: when every backup shares one weaknessRedundant parts can fail together when they share a cause. Learn to find shared assumptions, environments and infrastructure before trusting a backup.
Feedback loops in structures: when motion feeds its own forceSome structures change the forces acting on them. Learn to spot feedback loops in bridges, crowds and power grids before they grow.
Normalization of deviance: when warnings become routineDiane Vaughan's concept explains how anomalies become acceptable one flight at a time. Learn to recognize the pattern and what would reopen the question.
Residuals and discovery: the mismatch that points somewhereSmall gaps between prediction and observation have led to Neptune, pulsars and a cosmic background. Learn how to test a residual before explaining it away.
Units and interfaces: where a correct number goes wrongMany failures happen at boundaries between teams, units and tools. Learn to test each handoff and the meaning of every value that crosses it.
Warnings that did not land: when signals fail to change decisionsWarnings often exist before disasters. Learn why ice reports, foam strikes and cold-weather concerns failed to change decisions, and how to test reach.
When nature runs the experiment: natural tests of causeWeather, seasons and epidemics sometimes change conditions for us. Learn to read such events as tests, and to see what they cannot prove on their own.
When the instrument is wrong: calibration in six casesPrecise instruments can still mislead. Learn to ask what each measurement was compared against, and whether that comparison was itself checked.
Fatigue and fracture: how structures fail without warningMetal can crack under repeated loads, break when cold or fail where stress concentrates. Learn the main patterns and the questions that expose them early.
Software timing failures: priority, drift and inherited codeSoftware can be correct at each step and still fail through timing: a task that never runs, a clock that drifts, or code reused where it no longer fits.
Reading a post-incident review and what it leaves outA company's own post-incident review can be accurate and still incomplete. Learn to check who wrote it, when, in which time zone, and what it cannot show.
Too good to be true: warning signs before anyone replicatesA claim that looks too good to be true can be tested before anyone rebuilds it. Ask for the raw data, the independent check and the ordinary explanation.
Automation surprise: when a system does something elseWhen an automated system changes mode or acts on a bad input, the crew must work out what it is doing. Five cases show what made that hard.
Trust in the update pipeline: why one file reaches everyoneSoftware reaches users through tests, staging and review. Four cases show what those steps assume, and why one bad update can spread at once.
When the computer is presumed right: testing system recordsAn organization that treats a system's output as proof can turn a software fault into a loss for whoever disputes it. Learn how to test records instead.
Why power grids collapse: voltage, frequency and visibilityA grid collapses when voltage, frequency or margins pass their limits faster than operators and protection can respond. Three case files show how.
Photographs on these cards come from the investigations each note draws on. Image credits
Every term these notes define is collected in the glossary.