> ## Documentation Index
> Fetch the complete documentation index at: https://meta.niceshare.site/llms.txt
> Use this file to discover all available pages before exploring further.
# Black Box Thinking
> Black Box Thinking keeps a recoverable record of a failure, reads it before blame closes it, and changes the next system. Learn its origin and limits.
**Category**: Thinking
**Type**: Practice Habit
**Origin**: Matthew Syed, *Black Box Thinking*, John Murray, 2015; the shared record is older, in NTSB-AAR-75-16 (1975) and NASA's Aviation Safety Reporting System (1976)
**Also known as**: Opening the failure record
**Quick Answer** — **Black Box Thinking** is the habit of keeping a recoverable record of a failure, reading it before blame closes it, and changing the next system so a later person can use what the record showed. Matthew Syed gave the habit that name in *Black Box Thinking* (John Murray, 2015). The point is a record someone else can still read, not a mood of being frank about mistakes.
## What is Black Box Thinking?
Black Box Thinking is the habit of recovering a failure record, reading it before blame closes it, and changing the next system.
> In retrospect, the Board finds it most unfortunate that an incident of this nature was not, at the time of its occurrence, subject to uninhibited reporting and subsequent investigation which might have resulted in broad and timely dissemination of the safety message issued by the carrier to its own flightcrews.
The National Transportation Safety Board wrote that in its report on Trans World Airlines Flight 514, adopted on **26 November 1975** (NTSB-AAR-75-16). A near-miss had stayed inside one airline. The next crew did not receive the notice. Black Box Thinking is that gap, turned into a habit you can use outside a cockpit.
The everyday picture is a pot that nearly caught fire. A note on the stove can change the next cook. A speech in the hallway cannot, if the next cook never hears it. The record has to travel.
[Reflective Practice](/thinking/reflective-practice) examines your own move while the work is still open, and again after. Black Box Thinking asks whether the record can leave the room. [Pre-mortem Thinking](/thinking/pre-mortem-thinking) imagines that a plan has already failed. This habit starts from a failure, or a near-miss, that has already happened. [Growth Mindset](/thinking/growth-mindset) is a belief that ability can grow. You can hold that belief and still keep the record in one team's drawer. [Inversion Thinking](/thinking/inversion-thinking) asks, before the event, how a plan would fail. This habit reads an event that already occurred.
W. Ross Ashby's *An Introduction to Cybernetics* (Chapman & Hall, 1956) uses "black box" for a system studied from the outside, by relating inputs to outputs, when the inner mechanism stays closed. That is a different use of the words. Black Box Thinking opens the record.
### Black Box Thinking in 3 Depths
* **Beginner**: The cue is a failure or a near-miss. Before the story hardens, write the time, the condition, and what happened next. A name, without those facts, is not the record.
* **Practitioner**: Send the record to the next person who could meet the same condition, including someone outside your team. Change one condition, and give it an owner and a date. A note that never leaves the team is the gap the 1975 report described.
* **Advanced**: A rise in reported failures is first a question about detection. More reports can mean people will now speak, or that the work got worse, or both. The count does not, by itself, say which. Opening the record is not a pardon. Hiding the record is its own failure.
## Origin
Black Box Thinking, as a public name for this habit, comes from Matthew Syed's 2015 book. The practice he points to is older: recover what a failure recorded, and let that record cross the boundary of the team that already knows.
John Murray published *Black Box Thinking: The Surprising Truth About Success* in **2015**. The ISBN of that edition is 9781473613775. The book offers the habit to readers who do not work in a cockpit. It is not a trial. This page does not treat the book's anecdotes as measured results. A **2017** simplified Chinese edition is titled 《黑匣子思维》. A **2025** Traditional Chinese edition is titled 《黑盒子思維》. Those titles name the same habit. They do not name Ashby's closed box.
The engineering phrase is the contrast. Ashby's **1956** book studies a system whose mechanism you do not open. Aviation's recorders do the other job. The NTSB investigation of Flight 514 included the flight data recorder and the cockpit voice recorder, and the narrative cites the voice recording. Reading a recorder is the machine half of the habit. It does not, by itself, carry a lesson to the next operator.
The sharing half has dates of its own. A footnote in the **1975** report records an FAA advisory circular titled "Aviation Safety Reporting Program," dated **9 May 1975**. NASA's *CALLBACK* number 317 (March/April **2006**) dates the system that followed. A memorandum of agreement in **August 1975** had the FAA fund the program and provide the immunity rules, while NASA set policy and ran operations. The Aviation Safety Reporting System began day-to-day work on **15 April 1976**. The bulletin calls the design voluntary, confidential, and non-punitive, and it says the FAA's enforcement role would have discouraged reports. Those are design choices. They are not a count of crashes avoided.
## Key Points
Black Box Thinking pays when a failure or a near-miss has left facts, and someone who was not there may face the same condition. It stalls when the note never leaves the team, or when the word "learning" stands in for the record.
Write the time, the condition, and what happened next, while those facts are still available. A kitchen near-miss needs the burner, the pot, and the minute, not only a verdict on the cook. The 1975 report could reconstruct the descent because recorders and radios kept a trace. A mood of honesty, with no trace, is not this step.
The carrier in the Flight 514 record did publish a notice to its own crews. The next airline did not receive it. Name the person outside your team who could meet the same condition, and send the record without a name attached if a name would stop the next report. A lesson that stops at the team boundary has not finished the habit.
Pick one condition the record makes visible, give it an owner, and set a date. [Systems Thinking](/thinking/systems-thinking) asks how the parts interact. This step changes one of those parts, such as a chart, a clearance, or a handoff. The record can also show a person's decision. Opening it does not erase that decision. Hiding it is a second failure.
When reported failures rise, ask whether detection changed before you decide the work got worse. A confidential system is built so that more reports can arrive. The same rise can also mean the hazard got worse. Black Box Thinking stops you from treating the count as a verdict in either direction until the records are read.
## Applications
Use Black Box Thinking after a failure or a near-miss that could recur for someone who was not there. Write the record, name who else needs it, and change one condition.
After a failed problem or a rejected draft, write the step that went wrong and the condition you missed. Bring that note to the next session, where another learner can read it. A promise to "try harder" does not give the next person the step.
After a work incident, write what the record shows before the week ends. Send it to the next team that uses the same handoff, tool, or hour. Change one condition, and name the owner. A post-meeting speech inside one team repeats the closed notice in the 1975 report.
When a pot, a lock, a medicine, or a driveway nearly goes wrong, write the condition on the spot the next person will see. Say what to do differently, and skip the character verdict. A story told only to the person who was there does not protect the next shift in the same kitchen.
After a community shift, a clinic hour, or a local event, write the hazard without naming the person if naming would silence the next report. Send it to the neighboring group that runs the same task. A private debrief can teach one roster and still leave the next roster exposed.
## Case Study
On **1 December 1974**, at 11:10 a.m. Eastern Standard Time, Trans World Airlines Flight 514 crashed about **25** nautical miles northwest of Dulles International Airport, near Berryville, Virginia. The airplane was a Boeing 727-231, registration N54328. It was descending for a VOR/DME approach to runway 12 in instrument conditions. The NTSB report, adopted on **26 November 1975**, says the **92** occupants, **85** passengers and **7** crewmembers, were killed, and the aircraft was destroyed.
The majority probable cause is the crew's decision to descend to **1,800** feet before the airplane had reached the approach segment where that minimum altitude applied. The report names contributing factors. The FAA had known of confusion about approach language for several years and had not resolved it in time. The approach clearance came when the flight was **44** miles from the airport, on an unpublished route, without clearly defined minimum altitudes. The profile view of the approach chart depicted altitude restrictions poorly. Members Francis H. McAdams and William R. Haley dissented. They would have named the controller's failure to issue altitude restrictions, and the pilot's failure to hold the charted minimum sector altitude or to ask for clarification. The report is not a single voice. Both readings still leave a decision in the record. Neither reading says that no one was accountable.
About **six weeks** earlier, a related near-miss had already been written down. In **January 1974** a U.S. air carrier had started a Flight Safety Awareness Program. A report could omit names. The carrier said it would not punish people for what the program collected, and it would not hand identifying details to an outside agency. In **October 1974** that program received a report from a crew approaching Dulles. After passing Front Royal, they were cleared for a VOR approach to runway 12. The captain descended to **1,800** feet, about **25** nautical miles from the VOR, before Round Hill, and landed. He later said he had believed an approach clearance allowed an immediate descent to the final-approach-fix altitude. The carrier investigated, spoke with the Dulles tower, and reviewed the chart with several of its own pilots, who read it correctly. It decided it did not need to recommend a change to the FAA, or to change its own procedures. It did publish a notice to its own flightcrews. The notice said that "cleared for approach" generally left the crew on their own, and that crews should not start down until they had reviewed the other minimums.
The report's appendix names the airplane that narrowly missed the same mountain as a United Air Lines airplane. NASA's *CALLBACK* 317 also names United, describes the same six-week gap, and says the cautionary notice went to that airline's pilots. There was then no method for sharing it with TWA. The Board's sentence, quoted above, says a wider investigation might have spread the carrier's own message. The sentence says "might." It does not say the notice would have prevented the crash.
The wider reporting gap was already on the record. Apart from required reports about a navigational or ground facility, the FAA then had no formal system for pilots or controllers to report unsafe conditions in terminal instrument flight. Witnesses said people withheld reports because they feared punishment, and they asked for immunity for the reporter. By the time of the final report, the FAA had set up an incident-reporting system meant to catch unsafe conditions before an accident. The report also lists other actions, including a requirement that air-carrier airplanes carry a ground-proximity warning system by **December 1975**. Those are actions the report records. They are not a measured count of later lives saved.
NASA's bulletin places the Aviation Safety Reporting System in operation on **15 April 1976**, after the **August 1975** agreement. By the system's 30th year, the same bulletin counts more than **4,000** safety-alert messages to decision makers. It counts **7,100** database search requests answered for the aviation community, and **317** issues of *CALLBACK* sent to more than **70,000** addresses. The same list counts publication of more than **70** topical research studies, and that line includes more than **124** quick-response efforts. Its intake table shows **6,634** reports in February and March **2006**. A private pilot, in a letter the bulletin prints, says it is too bad that no one can measure how many saves *CALLBACK* is responsible for. These figures count reports and products. They do not count crashes avoided, and they do not measure the effect of reading one afternoon's notes.
## Boundaries and Failure Modes
Black Box Thinking fails when there is no record left to open, when the habit is used as a pardon, and when a report count is treated as a result it cannot be.
The first boundary is the missing trace. The Flight 514 narrative can say what the crew believed about 1,800 feet because a report, a recorder, and a hearing kept the trace. If nobody writes the condition, and nobody will speak, there is nothing to send. A speech about openness does not reconstruct a descent. Reflective Practice can still examine your own next move. It cannot supply a record that was never kept.
The second boundary is accountability. The majority names the crew's decision as the probable cause. The dissent names the controller and the pilot in a different split. The carrier's own program was already non-punitive, and the message still stopped at that carrier's crews. Removing punishment inside one team is not the same as moving the record. It is also not a reason to skip a consequence when the record shows a decision, a cover-up, or a harm that continues. A recoverable record is not a pardon.
The common misuse is to treat the numbers as a proof they are not. Do not cite the October notice as something that would have saved the 92 people. The Board said a shared investigation might have spread the message. Do not cite the **2006** counts, or the later safety of commercial flying, as a measured effect of this habit, of one workshop, or of one household note. The design is an accident investigation plus a reporting system built afterward. Firms, families, and classrooms that adopt the habit do not inherit a lives-saved figure from that history.
## Common Misconceptions
Three confusions travel with the name. The habit gets mistaken for a closed machine, for a neighboring mindset, and for a proof about lives saved.
Ashby's 1956 use, and a later machine-learning use, leave the inner mechanism closed and watch inputs and outputs. Black Box Thinking opens the failure record and moves it to the next person. The flight recorder's nickname and the closed-system nickname share words. They do not share this habit. Studying a model you cannot inspect is a different task.
Growth Mindset is a belief that ability can develop. Reflective Practice examines your own move while you can still change it, and again after. Pre-mortem Thinking imagines a failure before it happens. Inversion Thinking asks how to produce the failure you want to avoid. You can do any of those and still leave the record in one drawer. This habit is finished only when someone who was not there can use the record, and one condition changes.
The Board's verb is "might," and it applies to spreading the carrier's message, not to a counted save. Two members dissented on the probable cause. The 2006 bulletin counts reports, alerts, and research products, and it prints a pilot's remark that the saves cannot be measured. A rise in reports is not, by itself, proof that a system became safer or proof that it became worse.
## Related Concepts
These neighboring pages cover your own next move, an imagined failure, a belief about ability, the way parts interact, and a question asked backward before the event.
Examines your own action while the work is still open, and again after. Black Box Thinking asks whether the record can reach someone who was not in the room.
Imagines that the plan has already failed, then asks why. Black Box Thinking starts from a failure or a near-miss that has already happened.
A belief that ability can develop through effort. You can hold the belief and still bury the record. The record is this page's habit.
Looks at how parts interact over time. Black Box Thinking uses a failure record to change one of those conditions, with an owner and a date.
Asks, before the event, how a plan would fail, and what to avoid. This habit reads an event that already occurred and asks who else needs the record.
## One-Line Takeaway
When something fails, write the record someone else can still read, and change one condition before the next time.
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.