Originally published on Substack, October 7, 2026.
When people investigate an accident, a failed project, a scientific claim, a business collapse, or an alleged fraud, there is a natural temptation to look for the error—the single mistake that supposedly explains everything.
That way of thinking can be dangerous.
There is no general rule of logic stating that a problem can contain only one error. A complicated event can contain dozens of errors, assumptions, omissions, misunderstandings, organizational failures, technical failures, and decisions that interact with one another. Sometimes one error causes another. Sometimes several independent errors converge to produce the same result. Sometimes one error remains hidden because another error attracts all of the attention.
The Boeing 737 MAX disasters and the Theranos scandal illustrate this principle particularly well. They are very different events: one involved commercial aircraft and two fatal crashes; the other involved medical testing, investors, patients, and fraudulent representations. Yet both demonstrate why investigators must look beyond the first apparent problem.
The central question should not merely be: “What went wrong?”
It should also be: “What else had to go wrong for this outcome to occur?”
And perhaps most importantly: “What evidence establishes that we have found all of the significant problems?”
That last question is fundamental to serious problem-solving.
A useful way to investigate almost any problem is to divide it into layers:
Facts → Assumptions → Interpretation → Reasoning → Decisions → Outcome
An error can occur at any level.
For example, imagine an engineer receives an incorrect measurement. That creates:
Incorrect measurement → incorrect assumption → incorrect calculation → incorrect design decision → system failure
If the investigator discovers the incorrect measurement, it would be a mistake to conclude automatically, “We found the cause.”
The measurement may have been one cause, but the investigation should continue.
Why was the measurement accepted? Why wasn’t it independently verified? Was there a second measurement that contradicted it? Did the engineering process contain a verification requirement? Did someone know the measurement was questionable? Did the system contain safeguards that should have prevented the incorrect measurement from producing a catastrophic result?
The deeper investigation may reveal several independent failures.
Consider a simple argument:
A is true.
B follows from A.
C follows from B.
Therefore D is true.
Suppose we discover that A is false.
We have definitely found an error.
But that does not tell us whether B follows from A, whether C follows from B, or whether the final conclusion is independently justified.
There may be multiple errors:
Error #1: A is false.
Error #2: The connection between A and B is invalid.
Error #3: B contains an additional false assumption.
Error #4: The conclusion does not follow from C.
Consequently, correcting Error #1 does not necessarily repair the entire argument.
This distinction is enormously important in real-world investigations.
The Boeing 737 MAX provides a particularly powerful example because official investigations examined multiple contributing factors surrounding the crashes of Lion Air Flight 610 in October 2018 and Ethiopian Airlines Flight 302 in March 2019.
The aircraft’s Maneuvering Characteristics Augmentation System, or MCAS, became a major focus of the investigations. The system could automatically command nose-down stabilizer movement based on angle-of-attack information.
But the investigations did not simply reduce the entire disaster to “MCAS was defective.”
The U.S. House Transportation and Infrastructure Committee’s investigation identified numerous problems involving the design and certification of the aircraft. Among its findings, the committee reported that Boeing had failed to perform certain single- or multiple-failure analyses of MCAS after redesigning the system to increase its authority at lower speeds. The committee also documented concerns during development about faulty angle-of-attack information and MCAS behavior.
The NTSB separately identified a fundamental problem in assumptions used during certification: investigators found a gap between assumptions about how pilots would respond to aircraft warnings and what crews actually encountered in the accidents.
That illustrates the difference between a component failure and a system failure.
The Boeing Error Tree
737 MAX accidents
├── MCAS design
│ ├── AOA input dependence
│ └── System authority
│
├── Pilot/system interaction
│ ├── Multiple alerts
│ ├── Workload
│ └── Training
│
└── Certification process
├── Assumptions
├── Analysis
└── Oversight
This is not saying that every item in the diagram had equal causal importance. Rather, it demonstrates how a complex failure can have multiple branches.
The existence of one failure did not eliminate the possibility of other failures. Indeed, the system’s danger arose partly from the interaction among multiple factors.
Imagine that an investigator had examined the Lion Air crash and concluded:
“The angle-of-attack sensor malfunctioned. Replace the sensor and the problem is solved.”
That would have identified an important fact, but it would not have been a complete investigation.
The deeper questions would be:
• Why could one erroneous sensor input have such authority?
• Why did the software respond the way it did?
• Why was the system designed that way?
• What warnings did the pilots receive?
• What did their training tell them?
• What information did Boeing provide?
• What information did regulators receive?
• What assumptions were made during certification?
• Were those assumptions tested against realistic failure scenarios?
• What happened after the first accident?
• Were similarities between the first and second accident recognized quickly enough?
This demonstrates another important investigative principle:
A first failure can be evidence of a larger system problem rather than the complete explanation for the problem.
Theranos presents an entirely different example.
Theranos claimed that it had developed technology capable of performing a wide range of blood tests using very small samples. Evidence presented in the federal case showed that the technology had significant accuracy and reliability problems, that the system could not perform all of the tests claimed, and that conventional third-party analyzers were used for substantial portions of patient testing.
The logical mistake would be to describe the Theranos collapse simply as:
“The machine didn’t work.”
That is incomplete.
The failure involved technology, validation, representations to investors, representations to patients, business claims, regulatory issues, demonstrations, and internal knowledge.
The federal case documented multiple categories of representations concerning the capabilities of the technology, projected revenue, Department of Defense relationships, pharmaceutical-company validation, and the Walgreens rollout.
This creates another error tree.
The Theranos Error Tree
THERANOS FAILURE
├── Technology
│ ├── Accuracy
│ ├── Reliability
│ └── Capability
│
├── Validation
│ ├── Testing
│ ├── Evidence
│ └── Verification
│
├── Business
│ ├── Revenue forecasts
│ ├── Contracts
│ └── Partnerships
│
└── Claims
├── Investors
├── Patients
└── Business partners
Again, the point isn’t that every item is identical or equally important.
The point is that multiple failure mechanisms can coexist.
Suppose an investigator had discovered:
“The Theranos analyzer cannot perform all the tests claimed.”
That would be a major finding.
But the next question should be:
“What happened after people knew or should have known this?”
Now the investigation changes. We have to examine:
• What testing had actually been performed?
• What validation existed?
• What did employees know?
• What did management know?
• What was demonstrated to investors?
• What was represented to patients?
• What equipment was actually being used?
• What did the company tell regulators?
• What did it tell business partners?
• What financial projections were being presented?
• What happened when contradictory information appeared?
The key lesson is that the investigation cannot logically stop at “the technology failed.” The technology problem may be only one part of the larger causal structure.
Another important logical distinction is that not every problem is the same kind of problem.
There are at least several broad categories.
Technical error: Something doesn’t work as intended. For example, a sensor provides an incorrect measurement.
Reasoning error: Someone draws an unjustified conclusion from available information. For example, “The sensor has never failed before, therefore it cannot fail.”
Information or disclosure failure: Important information isn’t communicated to someone who needs it.
Deliberate deception: A person knowingly communicates something false with the intention of inducing another person’s reliance.
These categories require different questions.
In the Theranos case, the federal jury found Elizabeth Holmes guilty of investor-related conspiracy and three counts of wire fraud. The distinction matters because an investigation should not automatically classify every problem as a “mistake.”
Sometimes there is a technical failure. Sometimes there is an organizational failure. Sometimes there is negligence. Sometimes there is a reasoning failure. And sometimes there is evidence of intentional deception.
One of the most powerful tools for finding problems is to identify assumptions.
Ask:
“What must be true for this conclusion to be correct?”
For example:
“The system is safe.”
What must be true?
• The hardware works.
• The software works.
• The sensors are reliable.
• Failure modes have been considered.
• Operators understand the system.
• Operators respond as expected.
• Training is adequate.
• Documentation is accurate.
• Maintenance is adequate.
• Regulators have accurate information.
• The system remains safe when components fail.
Each assumption is another potential failure point.
The same technique works with Theranos. If the claim is “The company has a revolutionary blood-testing technology,” then the investigator must ask whether the technology exists, performs the claimed tests, has demonstrated accuracy and reproducibility, has independent validation, works outside controlled demonstrations, is actually used for patients, and satisfies applicable requirements.
Once the assumptions are listed, investigation becomes much more systematic.
Another powerful logical technique is the counterexample.
Suppose someone says:
“The system has never failed.”
You ask:
“Can you identify even one documented failure?”
One valid example disproves the universal claim.
But there is an important asymmetry:
One counterexample can disprove a universal claim. It cannot necessarily explain the entire problem.
For example:
“We found one inaccurate Theranos test.”
That proves that at least one inaccurate result occurred. It does not, by itself, establish how frequently errors occurred, why they occurred, whether they were systematic, whether management knew, whether other testing systems were involved, or whether the company’s broader representations were accurate.
Likewise:
“The MCAS sensor was wrong.”
That establishes an important technical fact but does not, by itself, explain every aspect of the MAX disasters.
A good investigator should deliberately attempt to disprove his or her own theory.
Suppose the theory is:
“Cause X produced the failure.”
Ask:
“What else could produce the same result?”
The investigator should construct competing hypotheses and compare the evidence supporting and contradicting each one.
The objective isn’t to find the theory you like best. The objective is to determine which explanations survive the evidence.
Confirmation bias is particularly dangerous during investigations.
Suppose an investigator believes:
“The pilot caused the accident.”
Every pilot action can then be interpreted as supporting that theory.
But the investigator should instead ask:
“What evidence would prove that theory incomplete or wrong?”
The same applies to corporations.
Suppose an investigator believes:
“Theranos was simply a technology startup that failed.”
That hypothesis could cause the investigator to overlook evidence concerning representations made to investors and patients.
Conversely, if the investigator begins with:
“Everything about Theranos was fraudulent from the beginning,”
the investigator may overlook distinctions between technical failures, business failures, individual actions, and the evidence required to establish particular claims.
The best investigative method is therefore question-driven rather than conclusion-driven.
One of the strongest questions an investigator can ask is:
“What evidence would cause me to abandon my current explanation?”
If the answer is “Nothing,” then the investigation has probably become a search for confirmation rather than a search for truth.
A strong hypothesis should expose itself to potential disproof.
Another powerful method is to map dependencies.
Suppose:
A → B → C → D → E
If A fails, E may fail.
But suppose B independently contains another error.
Then:
A (error)
↓
B (error)
↓
C
↓
D (error)
↓
E
There are now at least three errors.
This is why simply fixing A may not fix E.
Complex systems often behave this way.
There are two particularly important types of multiple errors.
Independent errors occur separately:
Error A → Outcome
Error B → Outcome
Fixing A does not necessarily fix B.
Cascading errors occur when one error creates another:
Error A → Error B → Error C → Outcome
The most dangerous situation may combine both:
Error A
↓
├── Error B
└── Error C
↓
Outcome
This is why complex investigations frequently cannot be reduced to a single cause.
A simple but remarkably powerful investigative technique is repeatedly asking:
“Why?”
For example:
Why did the system fail?
Because the control system behaved incorrectly.
Why did it behave incorrectly?
Because it received bad sensor information.
Why could bad sensor information produce that behavior?
Because the system design allowed it.
Why was the design approved?
Because the certification analysis treated certain failure conditions in a particular way.
Why were those assumptions made?
Because of assumptions concerning system behavior, pilot response, and certification requirements.
Each “why” moves the investigation deeper.
The same method can be applied to Theranos: Why did patients receive inaccurate results? Why was the system used? Why was the service presented as capable of doing what it did? Why did investors believe the claims? Each question exposes another layer that must be examined.
Another important principle is:
“The event closest in time to the outcome isn’t necessarily the fundamental cause.”
The last event before an accident is often the easiest thing to identify.
But a more complete chain might look like:
Long-term decision
↓
Design decision
↓
Engineering assumption
↓
Implementation
↓
Warning
↓
Human response
↓
Immediate event
↓
Catastrophic outcome
The immediate event may be only the final link.
A complete investigation examines the entire chain.
Once a failure is identified, ask:
“At what earlier point could this problem have been detected or stopped?”
For Boeing, this question can be applied at design, testing, safety analysis, certification, pilot training, operational warnings, post-accident investigation, and corrective action.
For Theranos, it can be applied to technical development, validation, internal testing, regulatory review, investor due diligence, laboratory operations, and patient testing.
This produces a barrier analysis:
Problem
↓
Barrier 1 — should detect it
↓
Barrier 2 — should stop it
↓
Barrier 3 — should contain it
↓
Outcome
If the outcome occurs, ask why each barrier failed.
The most important investigative question may be the simplest:
“What else?”
You find an error.
Ask:
“What else is wrong?”
You find a false assumption.
Ask:
“What else depends on that assumption?”
You find contradictory evidence.
Ask:
“What else does that contradiction affect?”
You find a technical failure.
Ask:
“What else allowed that technical failure to become consequential?”
You find a misleading statement.
Ask:
“What other statements depended upon the same underlying claim?”
This mindset prevents premature closure.
FACTS
1. What exactly happened?
2. What evidence establishes it?
3. Is the evidence reliable?
4. Has it been independently verified?
5. What evidence contradicts it?
ASSUMPTIONS
6. What assumptions are being made?
7. Which assumptions are documented?
8. Which are merely inferred?
9. What happens if each assumption is false?
10. Are there hidden assumptions?
LOGIC
11. Does the conclusion follow?
12. Is there a non sequitur?
13. Is there circular reasoning?
14. Is correlation being confused with causation?
15. Is possibility being confused with certainty?
CAUSATION
16. What caused the immediate event?
17. What caused that cause?
18. What conditions allowed it?
19. Were there multiple causes?
20. Were any causes independent?
ALTERNATIVES
21. What other explanations exist?
22. What evidence supports them?
23. What evidence contradicts them?
24. What would disprove the preferred explanation?
25. Has anyone actively attempted to disprove it?
HUMAN FACTORS
26. What did people know?
27. When did they know it?
28. What did they believe?
29. What information did they receive?
30. What information did they not receive?
ORGANIZATIONAL FACTORS
31. Were procedures followed?
32. Were procedures adequate?
33. Were warnings ignored?
34. Were incentives creating pressure?
35. Were responsibilities clearly assigned?
VERIFICATION
36. Was the system independently tested?
37. Was the information independently verified?
38. Were assumptions stress-tested?
39. Were failure scenarios examined?
40. Were contradictory results investigated?
COMPLETENESS
41. Have multiple errors been considered?
42. Could one error have hidden another?
43. Could errors have interacted?
44. Could fixing one error leave another?
45. What remains unexplained?
FINAL CHALLENGE
46. What evidence would change the conclusion?
47. What is the strongest argument against the current explanation?
48. What alternative explanation best fits the evidence?
49. What important information is still missing?
50. What else could be wrong?
The fundamental lesson is simple:
Finding one error is not the same thing as finding the whole problem.
A serious investigation must distinguish between an error, a cause, a contributing factor, a failure in the reasoning process, and the complete explanation of an outcome.
The Boeing 737 MAX investigations demonstrate how technical design, sensor information, software behavior, human factors, training, communication, and certification processes can interact. The Theranos case demonstrates how technology limitations, validation, representations to investors and patients, business claims, and management conduct can form a much larger problem than any single defective machine or inaccurate statement.
Neither example supports the idea that there is a logical rule limiting a problem to one error.
The opposite is often closer to reality:
Complex failures should initially be presumed capable of having multiple contributing errors until the evidence establishes otherwise.
The investigator’s job is therefore not merely to locate an error.
It is to systematically search for every significant broken link in the chain.
And after finding one, the most valuable question is often:
“What else?”
• U.S. House Committee on Transportation and Infrastructure, Boeing 737 MAX Final Committee Report (2020).
• National Transportation Safety Board, findings concerning assumptions about pilot response and the certification of the 737 MAX.
• Federal Aviation Administration, congressional testimony and materials concerning the 737 MAX grounding and certification.
• U.S. Department of Justice, United States v. Elizabeth Holmes and related Theranos case materials.
This article first appeared on my Substack. Read it on Substack to comment, share, or subscribe for new posts.