An aircraft comes down, a team arrives within hours, and a year or two later a report appears naming a probable cause. Understanding how are plane crashes investigated means grasping one structural decision that shapes everything else: the inquiry is built to find out what happened, and it is deliberately prevented from deciding who pays.
In the United States that work belongs to the National Transportation Safety Board, an independent agency that investigates accidents across every mode of transport — air, rail, road, marine and pipeline — and issues recommendations afterwards.
It cannot fine anyone, prosecute anyone or order a single change. That is not a weakness in the design. It is the design.
The job is causes, not culprits
The governing regulation is unusually plain about the purpose. The board conducts investigations to determine the facts, conditions and circumstances relating to an accident, and uses those results to determine one or more probable causes and to issue safety recommendations intended to prevent a similar accident.
Note the plural. An accident is allowed to have several probable causes, which matters because catastrophic failures in aviation almost never have one.
The characteristic finding is a chain rather than a culprit: a maintenance error that would have been harmless on its own, a procedure that made it invisible to anyone checking, a warning system that behaved exactly as designed but not as the crew expected, and a response shaped by training written years earlier for a different scenario entirely.
A process aimed at assigning blame would stop at the first link that could carry it. A process aimed at prevention keeps going, because every link is a place where the chain could have been broken.
The findings cannot be used in court
Here is the provision that makes the rest possible, and it surprises almost everybody. Under federal law, no part of a board report relating to an accident may be admitted into evidence or used in a civil action for damages arising from a matter mentioned in the report.
The most authoritative account of what happened is therefore unavailable to the people suing over it. Litigation goes ahead, using its own experts and its own discovery, and the official conclusion sits outside it.
The reasoning is straightforward once stated. If a finding of probable cause could be read out to a jury, everybody with an interest would fight the investigation rather than help it, and the flow of candid technical information would stop within days of the first accident.
So the statute buys honesty by removing the stakes. Truth-finding and liability are separated on purpose, and the separation is the reason the reports can be as direct as they are.
The manufacturer is inside the investigation
The arrangement that follows from that looks alarming until the logic is clear.
Investigations run on what is called the party system. The investigator-in-charge may designate organisations as parties, and party status is limited to those whose employees, functions, activities or products were involved in the accident, and who can supply suitably qualified technical personnel to actively assist.
Read that again. The airline whose aircraft crashed, the manufacturer that built it and the union representing the crew are not merely interviewed — they work inside the investigation.
The justification is capability. Nobody understands a specific engine variant like the people who designed it, and no government agency could maintain that depth across every aircraft type, component and airline procedure in service anywhere in the country.
The safeguard is narrow but real. Parties supply the technical work that establishes the facts, and they take no part whatever in determining probable cause, which the board reserves entirely to itself and writes without them in the room.
Who is kept out
The exclusions are as revealing as the inclusions. No party representative may occupy a legal position, or be a person who also represents claimants or insurers, which locks the lawyers out of the room by regulation rather than by custom.
Parties are also restricted in what they may say. Information released at an accident scene does not authorise a party to comment publicly during the investigation, and dissemination of factual information is permitted only through the channels the rules specify.
An organisation that ignores the instructions, withholds information or behaves in a way prejudicial to the inquiry can lose party status altogether, which removes its access to the process examining its own product.
That combination — deep technical access, no control over conclusions, no public commentary and no lawyers — is what keeps a conflicted arrangement workable.
The board cannot make anyone do anything
The output of all this is a report and a set of safety recommendations, and a recommendation is exactly what the word suggests.
Recommendations go to regulators, manufacturers, operators, unions and local authorities. The regulator decides whether to turn any of them into a binding rule, and the two agencies disagree often enough that the disputes have their own long paper trail.
Recommendations can also address problems that had nothing to do with the probable cause, because an investigation examines a whole system and finds things nobody was looking for.
The board’s only real power is publication. It records what it recommended, records whether the recipient accepted or rejected it, and leaves any disagreement sitting in public view — a weaker instrument than a rule, and a considerably stronger one than nothing at all.
Splitting investigation from regulation avoids an obvious conflict. A regulator investigating an accident is partly investigating its own certification decisions, and the arrangement removes that problem by giving the inquiry to somebody with nothing to defend.
What happens in the first days
Speed matters at the start because evidence decays. A go-team travels immediately, and each specialist on it leads a working group in their own area:
- Structures — the airframe, and what the wreckage distribution says about how it came apart
- Powerplants — engines, propellers and their control systems
- Systems — hydraulics, electrics, flight controls and avionics
- Operations and human performance — crew actions, training, rosters and fatigue
- Weather and air traffic control — conditions, clearances and the recorded exchanges
Wreckage position, ground scarring, witness memory and volatile data are all perishable in different ways, and some of it disappears with the first heavy rain or the first well-meaning attempt to clear the site.
The recorders are recovered and read in a laboratory rather than in the field, because a damaged unit can be destroyed by a clumsy first attempt. The flight data recorder supplies hundreds of parameters and the cockpit voice recorder supplies the context around them, and the two are correlated against radar returns and air traffic communications to build a single timeline.
Cockpit voice recordings receive their own statutory protection. The full audio is not released publicly and a transcript is published instead, a restriction that exists so crews are not deterred from speaking normally in the cockpit by the prospect of their last words being broadcast.
Why the design produces better information
The contrast with other safety systems is instructive. Aviation investigation is mandatory, independent and insulated from the adversarial process: somebody with no stake in the outcome is compelled to look, and the people who could be embarrassed by what is found are required to help find it.
Medical device safety, by comparison, runs largely on passive reporting after the fact, where somebody must notice a problem, attribute it correctly and choose to file — the arrangement described in how medical devices are approved.
The results differ accordingly. Aviation has a documented record of turning individual disasters into systemic changes, and the reason is less about engineering than about a process designed so that admitting a problem carries no immediate legal cost.
International accidents follow a different map
Most crashes are not neatly domestic, and the framework for that is international. Under the global convention on civil aviation, the state where the accident occurred normally leads the investigation, with the states of registry, of the operator, of design and of manufacture entitled to appoint accredited representatives.
So a crash of an American-built aircraft, flown by a European carrier, in a third country, produces an investigation led by the third country with everybody else formally present.
The quality of that leadership varies considerably. Where the leading state lacks either the technical capacity or the independence from its own carriers and regulators, the resulting report can be thin or slow, and that is one of the few genuinely weak points in an otherwise sturdy international arrangement.
What to watch when a report lands
Preliminary reports arrive within weeks of an accident, and they are routinely misread as conclusions by people who have every reason to know better.
A preliminary report states what is known so far and contains no analysis and no probable cause. It exists to put verified facts into circulation quickly, mainly to displace speculation, and treating it as a finding is the most common error in coverage.
The final report is where analysis appears, usually a year or more later, and it will name probable causes in the plural along with contributing factors.
Read the recommendations separately from the cause. That section is where the investigation says what should change, and it is the part that survives after the specific accident has left the news, in the way that consumer aviation rules quietly shape ordinary flying — as they do in how airline overbooking works.
Then check what the regulator did with them. The gap between a recommendation issued and a rule adopted is where the real argument about aviation safety takes place, and it is entirely public.
