Air France 4590: the words were "sufficiently low"
Air France 4590 and the Concorde tire burst: what the 1979 analysis rested on, why the trend line was not enough, and what a particular risk analysis is for.
737 MAX: the number that changed and the analysis that didn't
The 737 MAX MCAS change from 0.6 to 2.5 degrees, and the seven places it needed to reach but did not. The case for a digital thread in safety assessment.
United 232: the word was independent
United 232 lost all three DC-10 hydraulic systems to one fan disk. Why independence is a geometric claim first, and what a particular risks assessment asks.
Nimrod XV230: the hazard was on the list
Nimrod XV230: a fuel leak met a hot duct in one bay. Hazard H73 was identified, left open and called tolerable. Why no single analysis failed.
TWA 800: two things nobody drew together
TWA 800 was lost between two correct statements: a low energy gauging circuit and a nearly empty tank. The AND gate nobody had to defend, under ARP4761A.
See it on your own program
Bring your certification basis and one system. We will show you what one connected model looks like on your aircraft.