Controlled Flight Into Terrain
Apple is like a ship with a hole in the bottom and my job is to point it in the right direction.
Steve Jobs
Today we are looking at the other side of the same coin
There is a category of aviation accident with a name so bloodless it sounds like a filing error - Controlled Flight Into Terrain. The aircraft is airworthy. The engines are making thrust. The crew is qualified, rested, and speaking in the flat professional register of people whose day is going perfectly fine. Every gauge is telling the truth. And the aeroplane flies into the side of a mountain, wings level, at cruise power, with the seatbelt sign off.
Nothing failed. That is the horror of it. There is no snapped spar, no fire in the wheel well, no rogue actor at the controls. There is only a competent machine, a competent crew, and a world that declined to be where everyone assumed it was.
If that description gives you an uncomfortable flicker of recognition, congratulations. You have worked in an enterprise organization.
The instruments watch the aircraft, not the ground
Here is the structural flaw, and it is not a flaw of attention or intelligence. A cockpit full of gauges is, almost entirely, a machine for monitoring itself. Oil pressure, fuel flow, exhaust gas temperature, hydraulic quantity, electrical load, airspeed, attitude, heading. Superb instrumentation, all of it inward-facing. It answers one question with extraordinary precision - is this aircraft working. It has almost nothing to say about the far more urgent question, which is is there a mountain ahead.
Your dashboards are built the same way and for the same reason. They measure sprint velocity, ticket throughput, uptime, burn multiple, pipeline coverage, engagement, headcount against plan, and the seventeen tiles nobody has looked at since the quarter they were requested. All of it inward-facing. All of it excellent. All of it answering is this organization working, which is not the question that kills you.
The things that kill organizations are almost always terrain. A single customer that is thirty eight percent of revenue and has just hired a consultant. A regulator quietly redrafting a definition. One engineer who is the sole living document for the billing system and has started taking a lot of Fridays. A cash runway that is fine, fine, fine, fine, and then arithmetic. None of these are on the dashboard, because a dashboard is a device for reporting recurring internal state, and each of these is a rare external fact. Metrics love things that happen weekly. Mountains happen exactly once.
The calm is not a byproduct, it is load-bearing
In Controlled Flight Into Terrain, the calm is not merely present. It is a working component of the accident.
The absence of an alarm is processed by the human nervous system as the presence of safety. It is not. It is the absence of an alarm, which is a statement about your instrumentation and not about the world coming towards you. But no organism can hold that distinction for eight hours a day, so we collapse it, and quiet becomes reassurance, and reassurance becomes a slightly wider allocation of attention to whatever is currently making noise.
Which is how you get the finest illustration of the genre. In 1972 a wide-body jet was holding near Miami while three highly experienced crew members worried at a landing gear indicator light that had failed to illuminate. The gear was down. The bulb was not. Somewhere in the fussing, the autopilot's altitude hold was nudged out and the aircraft began a descent of a few hundred feet per minute, which is a rate so gentle it is essentially polite. Three professionals, a functioning aeroplane, ninety seconds of unbroken quiet, and then the Everglades. They were not negligent. They were just busy with the only problem that was announcing itself.
Every organization has a burnt out bulb. It is usually on the agenda. It is often the agenda.
The social layer makes it worse, because the calm is enforced. All-green is a genre with conventions. The status report where amber has been amber for eleven consecutive quarters and amber is now simply its personality. The risk register, that beautiful mausoleum, where the fatal item sits at row thirty one between a note about parking and an expired vendor contract, rated medium, owner TBC. Nobody is lying. Everybody is participating. Saying the word mountain out loud costs social capital right now, in this meeting, in front of these people, whereas the mountain is hypothetical and several minutes away, and human beings discount the future at a rate that would make a payday lender blush.
What aviation did, which was not what you would expect
Faced with a decade of losing perfectly good aircraft into perfectly well-mapped ground, the industry had every excuse to reach for the obvious remedies. More training. Better checklists. Improved crew discipline. A cultural transformation program. More gauges.
It did some of that. But the intervention that actually moved the numbers was narrower and far more interesting. Engineers built one instrument. It monitored one thing - the closing distance between the aircraft and the ground. It reported that thing to nobody, on no screen, in no summary. And when it decided the situation was fatal it did not report at all. It shouted.
Terrain. Terrain. Pull up.
In the mid 1970s, after a run of crashes that had exhausted everyone's patience, regulators stopped asking and required the thing on large airliners. Controlled Flight Into Terrain losses in that fleet then fell off a cliff, which is the only cliff you want anywhere in this story.
Note what the solution was not. It was not a new tab on the flight engineer's panel. It was not a weekly terrain proximity trend review. It was not a KPI. It was the deliberate design of a single rude interruption for a single unmonitored fatal risk, and the properties that made it work are all copyable and all slightly uncomfortable.
- It measured one thing, and the thing itself. Not a proxy, not an index, not a composite health score. Distance to ground and rate of closure. Composite scores are how you turn a fatal signal into a rounding error.
- It interrupted rather than reported. A dashboard waits to be looked at, which means its usefulness is a function of somebody's calendar. An alarm arrives whether or not you are curious.
- It came with a pre-authorized manoeuvre. Pull up is not an invitation to convene. There is no steering group. The response is scripted, drilled, and available to whoever is holding the controls at the time.
- It was rank-blind. The alarm does not check who is flying, how long they have been flying, or whether the descent was their idea. This is the single hardest property to import into a company and by far the most valuable.
- It accepted false positives as the price of the design. A warning system calibrated to never embarrass anyone is a decoration.
Two ways to ruin it, both popular
The first is alarm fatigue, and aviation walked straight into it. Early systems produced enough nuisance warnings that crews learned to treat the shouting as weather. An alarm that cries wolf becomes wallpaper with a speaker, and wallpaper is worse than nothing because it occupies the slot where vigilance used to live. So the tolerance for false positives has a ceiling. One loud instrument, tuned so that activation is rare enough that nobody has ever learned to ignore it. If you install eleven of these, you have not built eleven alarms. You have built a dashboard that yells.
The second is subtler. The original system looked down. It sensed the ground beneath the aircraft and inferred trouble from closure rate, which means terrain that rose faster than the aeroplane could climb could still win, and occasionally it did. The fix was to give the aircraft a map - a stored model of the world's actual shape, so the warning could be generated from the terrain ahead rather than the terrain already passing underneath. Sensing yourself is not the same as knowing the world. Most organizational risk work is a radio altimeter with strong opinions.
And even a perfect alarm is only an alarm. In a mid-1990s crash in Colombia the system worked exactly as designed and the crew pulled up as trained, but investigators found the speedbrakes had been left extended through the escape manoeuvre. The warning bought them the seconds. The reflex was not clean enough to save them. Which is the whole argument for drilling the response rather than merely documenting it.
The uncomfortable homework
Name the mountain. Singular. Not a register of forty seven risks, because a register is just a dashboard that has given up. One thing that is not currently instrumented, that would be terminal, and that would be quiet right up until it was not.
Then instrument it directly, not by proxy. Give it a threshold you commit to in advance, while calm, in writing, because you will not be calm later and you will be extremely creative about why this time is different. Give the alarm an owner who is permitted to be wrong in public. Give it a manoeuvre that is already approved. Then test it, on purpose, on a schedule, the way you would test a smoke detector rather than the way you would test a hypothesis.
And when it goes off and it turns out to have been nothing, resist with everything you have the sentence that ends this entire discipline in most companies, delivered warmly, by someone senior, in a tone of great reasonableness.
Perhaps we should recalibrate that, it is being a bit dramatic.
The aircraft was airworthy. The crew was competent. Every instrument was green. That is not the exculpation. That is the accident report.