Opening the Hood

The Swedish warship Vasa sank twenty minutes into its maiden voyage in Stockholm harbor. A stability test conducted before launch — men running side to side across the deck — was making the ship visibly rock so badly the test was stopped. King Gustav II Adolf had ordered the ship built with an extra gun deck against the advice of the original designer. Nobody with authority wanted to be the one to say it was not seaworthy. The hood was there. Opening it fully was the problem.

The original Tacoma Narrows Bridge in Washington State collapsed four months after opening, oscillating itself apart in a 42 mph wind. Concerns about the bridge's slender, aesthetically elegant design had been raised before construction. The signal — it looked beautiful and modern — won over structural caution. The aerodynamic resonance failure mode was, in hindsight, predictable from known physics. Film footage of the collapse is among the most-watched engineering failure documentation in history.

Not a disaster, but a controlled laboratory demonstration of the mechanism itself. Stanley Milgram at Yale showed that ordinary people would administer what they believed were lethal electric shocks to another person, simply because an authority figure in a lab coat said to continue. The signal — authority, procedure, institutional context — overrode the mechanism — a person apparently in severe pain and distress. Approximately 65% of participants went to the maximum voltage level. The experiment has been replicated in multiple countries with broadly similar results.

Thalidomide was marketed in Europe and elsewhere as a safe sedative and treatment for morning sickness. Frances Kelsey at the US FDA refused to approve it for the American market because she found the safety data inadequate — particularly regarding peripheral neurotoxicity and the absence of reproductive safety data. Every signal said approve: European approval, manufacturer confidence, professional consensus, market success. She read the mechanism. The US was largely spared. An estimated 10,000 children were born with severe limb malformations in countries where it was approved.

In 1972, a DC-10 cargo door failed in flight over Windsor, Ontario. The aircraft landed safely. An internal memo — the "Applegate memorandum" — written by a Convair engineer described the exact failure mode in detail and predicted it would eventually cause a crash. McDonnell Douglas issued a service bulletin rather than an Airworthiness Directive, making compliance voluntary. In 1974, a Turkish Airlines DC-10 suffered the identical failure over Paris. All 346 people aboard died. It remains one of the deadliest aviation accidents in history.

Ford's internal cost-benefit analysis — later made public in litigation — explicitly weighed the cost of fixing a fuel tank design flaw against the projected cost of lawsuits from deaths and injuries. The fix was estimated at $11 per vehicle. The analysis concluded it was cheaper not to fix it. This is the rare case where the hood was opened, the mechanism was understood, and the decision was made to close the hood again for financial signals. Multiple people died in rear-impact fires.

The Therac-25 was a radiation therapy machine that killed at least three people and seriously injured others through massive radiation overdoses. The failure was a software race condition — a bug that only manifested under specific rapid-input sequences. Previous Therac models had hardware safety interlocks; confidence in the new software-only design meant those interlocks were removed. When patients and operators reported problems, the manufacturer's initial response was that the machine was safe. The mechanism — a timing-dependent software defect — was invisible behind the signal of institutional confidence and prior successful operation.

Engineers at Morton Thiokol — the manufacturer of the solid rocket boosters — explicitly and formally recommended against launch. The O-ring seals had a known temperature sensitivity, and the overnight temperature at Cape Canaveral had been below freezing. NASA management overruled the engineers. The signal — schedule pressure, prior successful launches, institutional momentum — overrode the mechanism. All seven crew members died 73 seconds after launch. Richard Feynman's appendix to the Rogers Commission report is essential reading: he found NASA's internal risk estimates for engine failure were orders of magnitude more optimistic than engineers' own private estimates, and demonstrated the O-ring failure simply by dropping a piece of the material into a glass of ice water at a press conference.

The explosion at Reactor No. 4 of the Chernobyl Nuclear Power Plant occurred during a safety test — specifically a test to see whether the reactor could be safely powered down in a controlled way. The test was run by operators who did not fully understand the reactor's physics, particularly a design characteristic called positive void coefficient that made the reactor unstable at low power. Soviet institutional culture made stopping or questioning the test politically unacceptable. The signals — procedure, schedule, authority — overrode the mechanism. The long-term death toll from radiation exposure remains contested, ranging from tens to potentially hundreds of thousands depending on methodology.

The Union Carbide pesticide plant in Bhopal, India, released approximately 40 tonnes of methyl isocyanate gas into a densely populated area. Safety systems at the plant had been documented as failing for months. Cost-cutting had disabled or degraded multiple backup systems. Local management knew. The signal — profitable operation, schedule, cost reduction — drowned out the mechanism. Immediate death toll estimates range from 3,800 to over 15,000. Long-term health impacts continue to affect the surrounding population.

Nick Leeson was simultaneously executing trades and reporting on them from Barings' Singapore office — a fundamental separation-of-duties failure. He was also generating implausibly consistent profits that should have raised immediate questions about how. Nobody in London's management asked mechanistic questions. The dashboard — growing profits, a star trader — was too comfortable to interrogate. Barings lost £827 million, more than its entire capital, and collapsed in 1995. It was Britain's oldest merchant bank, established 1762.

The partial meltdown at Three Mile Island Unit 2 in Pennsylvania began with a stuck valve that operators believed — based on an indicator light — was closed. The light indicated the valve had been commanded to close, not that it had actually closed. Operators received contradictory instrument readings and a warning light was physically obscured by a maintenance tag. They interpreted the situation through their existing mental model rather than the actual state of the system. The map overrode the territory for hours until the situation became undeniable.

Bethany McLean at Fortune published "Is Enron Overpriced?" in March 2001, asking a simple mechanistic question: how exactly does this company make its money? She could not get a clear answer from management. Most analysts continued to rate Enron a strong buy. The signals — charismatic leadership, soaring stock price, analyst consensus, Fortune's "Most Innovative Company" award six consecutive years — were overwhelming. Enron filed for bankruptcy in December 2001. Thousands of employees lost their retirement savings. It was, at the time, the largest corporate bankruptcy in US history.

A piece of foam insulation struck Columbia's left wing during launch on 16 January 2003. Engineers at NASA requested satellite imaging to assess the potential damage. Management declined, concluding — partly based on the fact that previous foam strikes had caused no fatal damage — that it was probably fine. On re-entry, hot gases penetrated the damaged wing. All seven crew members died. The Columbia Accident Investigation Board was explicit: NASA's organizational culture, which discouraged bad news traveling upward, was as much a cause of the accident as the physical damage to the heat shield.

Residents of Grenfell Tower in London had been raising fire safety concerns for years through their tenant association blog, the Grenfell Action Group. The cladding installed during a recent renovation — aluminium composite panels with a polyethylene core — was known within the construction industry to present fire risk. Internal manufacturer documents acknowledged this. Seventy-two people died. Every warning had been read as complaint rather than as mechanistic signal. The subsequent public inquiry ran for five years.

The 737 MAX's engines were repositioned forward and upward to accommodate their larger diameter, changing the aircraft's handling characteristics. Boeing introduced MCAS — Maneuvering Characteristics Augmentation System — to compensate, but did not fully disclose its existence to pilots or regulators during certification. MCAS relied on a single angle-of-attack sensor with no redundancy, and could override pilot inputs repeatedly. Lion Air Flight 610 crashed in October 2018, killing 189. Ethiopian Airlines Flight 302 crashed in March 2019, killing 157. The signal: certified by the FAA, trusted manufacturer, familiar aircraft type. The mechanism: a control system whose failure mode had not been adequately disclosed to anyone flying the aircraft.

Wirecard was a German fintech company listed on the DAX index, valued at over €24 billion at its peak. In June 2020 it was revealed that €1.9 billion supposedly held in escrow accounts in the Philippines did not exist. Auditors at EY had accepted confirmations from a third-party trustee without independently verifying the accounts. The Financial Times, specifically reporter Dan McCrum, had spent years publishing investigative stories about accounting irregularities. Short sellers who looked at the actual cash flows were investigated by German regulators and accused of market manipulation. The signal — DAX-listed, government-endorsed, growing, officially audited — was so strong it was used as a shield against the people reading the mechanism.

The tsunami risk to the Fukushima Daiichi plant had been assessed and raised internally. The seawall height was based on historical records that excluded the most extreme events in the geological record. Prior survivals — previous smaller earthquakes and tsunamis — had created confidence. When the 2011 Tōhoku earthquake generated a tsunami far exceeding design parameters, the seawall was overtopped, backup diesel generators flooded, and three reactor cores melted down. The knowledge that the design basis tsunami was too conservative had been present in the system. It did not change the decision.

In the hours before the blowout, a negative pressure test — designed to confirm well integrity — produced anomalous results. Workers on the rig interpreted the anomalous readings as acceptable, under conditions of significant schedule pressure (the rig was 43 days behind and costing $533,000 per day). The mechanism — a compromised well casing — was trying to communicate. Eleven people died. The resulting oil spill — the largest accidental marine oil spill in history — released approximately 4.9 million barrels of oil into the Gulf of Mexico.

Credit rating agencies assigned AAA ratings to mortgage-backed securities whose underlying default correlations had not been correctly modeled. The models assumed housing prices did not fall nationally and simultaneously — a assumption that was historical artifact rather than physical law. Investors who looked at the actual constituent mortgages — Michael Burry, Steve Eisman, and a small number of others — saw the mechanism clearly and shorted the market. The signal — AAA rating, trusted institutions, the longest housing bull market in US history — was so overwhelming that the people reading the mechanism were treated as eccentrics until they were proven right. The resulting crisis cost an estimated $22 trillion in lost household wealth in the United States alone.

Pacific Gas and Electric's internal inspections had flagged aging transmission infrastructure across northern California for years. The financial signal — deferring maintenance is cheaper than performing it — consistently won. PG&E equipment was responsible for igniting multiple catastrophic wildfires, including the 2018 Camp Fire that destroyed the town of Paradise and killed 85 people. PG&E filed for bankruptcy in January 2019, the first utility in US history to do so citing wildfire liability. The mechanism — aging equipment in a drying climate — had been visible in inspection reports for years.

Internal research at Nokia showed that touchscreen smartphones were the future and that Symbian, Nokia's operating system, was falling critically behind. Middle management filtered bad news upward because the organizational culture punished the messenger. Leadership made strategic decisions based on a dashboard curated by fear. Nokia went from controlling approximately 40% of the global mobile phone market in 2007 to selling its handset division to Microsoft in 2013 for €5.44 billion — a fraction of its former value. A peer-reviewed study based on 76 interviews with Nokia managers documented the psychological safety failure explicitly.

Knight Capital Group deployed new trading software on the morning of 1 August 2012. A misconfiguration left a legacy system — containing an obsolete order-routing function — running alongside the new code. Nobody had a complete map of what the deployed production system actually contained. Within 45 minutes, Knight had executed millions of unintended trades and lost $440 million — more than its net capital. The company was sold within days. Structural knowledge of the system had not kept pace with the signal that the software was working and ready.

This is the largest and most well-documented case of this pattern in human history, and it has layers the others do not.

The mechanism has been understood since Eunice Newton Foote described the heat-trapping properties of CO₂ in 1856. Svante Arrhenius calculated a rough climate sensitivity number in 1896 that is not embarrassingly wrong by modern standards. Exxon's own internal research in the late 1970s and early 1980s correctly modeled what was coming — and then the company spent decades and hundreds of millions of dollars manufacturing signal noise to prevent that finding from competing with the dashboard.

That is what distinguishes this from most other entries on this list. In Challenger, the signals organically drowned out the mechanism through authority gradient and schedule pressure. In global warming, the signal pollution was industrially manufactured and deliberately targeted at the epistemic infrastructure itself — funding think tanks, seeding doubt in journalism, lobbying scientific institutions, and later, optimizing social media engagement around polarization. The hood was not just ignored. A well-funded industry built a second, fake hood and pointed at that instead.

We now have over 150 years of mechanistic data — temperature records, ice cores, sea level measurements, ocean acidification, permafrost methane release, coral bleaching — all confirming the original model, while the political dashboard in many countries still reads "disputed" or "too expensive to fix." The engine and the dashboard have almost completely decoupled.

What makes it the hardest case is the timescale. Every other entry on this list had a moment of obvious, concentrated failure. Global warming's feedback loops operate on decades to centuries, which means the people generating the signals bear almost none of the cost of being wrong, and the people who will bear the cost are not yet born and have no vote.

The hood has been open for 170 years. We keep looking at the dashboard.