Observational Data under Uncertainty: Engineering Epistemology, Witness Testimony, and Public Safety ()
1. Legislated Engineering Rules of Evidence and the Duty to
Consider All Relevant Data
In academic discussions of unidentified anomalous phenomena (UAP), eyewitness reports and operational observations are frequently characterized as anecdotal and therefore unreliable or unsuitable as scientific evidence. This reflects one approach to observational testimony; however, it is not universally applicable across all scientific and technical disciplines.
The science discipline of engineering, forensic investigation, and aviation safety provide an important contrasting framework. Professional engineering codes of ethics, including NSPE Code II.3.a and related provincial and state rules of conduct, require engineers to objectively consider relevant facts, data, and observations when evaluating matters within their professional responsibility. Forensic and accident-investigation methodologies similarly preserve and evaluate witness statements alongside physical, documentary, and instrumental evidence rather than excluding them solely because human observation may be fallible. Guidelines such as ASTM E1188 emphasize preservation of witness information as potential evidence, consistent with Feldman’s observation that “evidence of evidence is evidence” (2007, p. 208) [1].
This distinction developed for practical reasons. Engineering frequently operates outside controlled laboratory conditions, where events occur unexpectedly, cannot be reproduced, information may be incomplete, and decisions affecting public safety may be required before causal certainty is available. Witness observations can and have provided the first indications of an emerging hazard(s). Testimony is therefore neither assumed correct nor categorically dismissed; it is retained, compared with other available evidence, and tested for consistency.
This study uses UAP as a contemporary test case through which to examine this difference in evidentiary methodology. It does not attempt to determine the identity, origin, propulsion, or technological nature of UAP, nor does it undertake a case-by-case physical analysis of radar, infrared imagery, or reported flight performance. Instead, it asks a narrower question: how should reports of potentially safety-critical airborne encounters be treated when evaluated under established engineering rules of evidence and public-safety obligations?
UAP provide a particularly useful test case because uncertainty concerning their identity makes the treatment of observational evidence explicit. A pilot report may ultimately prove accurate, partially accurate, misidentified, or incorrect; however, engineering safety methodology requires the reported condition to be evaluated before its evidentiary value can be determined. The possibility of error is therefore a hypothesis to be tested rather than, by itself, a basis for excluding the observation.
Accordingly, this study uses UAP as a contemporary test case to examine a broader question: how should science treat safety-relevant observational testimony when that testimony appears to challenge an accepted model, explanation, or assumption? The argument is not that witness testimony can, by itself, establish or define a new scientific or engineering model. Rather, the historical safety record demonstrates a different evidentiary function. Repeated or credible observations may provide evidence that an existing model is incorrect or incomplete, that the wrong model is being applied to the observed condition, or that important variables have not yet been incorporated. Engineering learned through catastrophic failures that dismissing such observations because they conflict with the accepted explanation can itself become a dangerous failure mode. Witness testimony may therefore be insufficient to define what the correct model is, while still providing important evidence that the model currently being applied is not adequately describing reality.
1.1. Author’s Engineering Perspective
The engineering perspective presented in this paper has been shaped by practical experience in forensic engineering investigations. During the author’s career, engineering reconstructions have involved failures ranging from minor incidents to catastrophic events, including several workplace fatality investigations. Although the details of these investigations remain confidential, one early fatality investigation fundamentally changed the author’s understanding of how the scientific discipline of engineering evaluates evidence.
The investigation involved a complex sequence of events in which construction equipment initiated an unexpected domino-type chain reaction that ultimately caused a worker to be fatally struck by construction material approximately 15 m (50 ft) away. The physical evidence—including the construction vehicle and the construction materials—was available for examination. The principal uncertainty was not what objects were involved, but how the sequence of events had unfolded and whether any criminal or civil liability existed.
At the outset of the investigation, the supervising engineer explained that the most important evidence available was not the damaged equipment nor the construction materials, but the witness testimony describing the sequence of events. Without those observations, reconstructing the accident would have been largely impossible. Rather than dismissing witness accounts because they described an unusual or seemingly improbable sequence of events, the engineering reconstruction began by treating those observations as critical evidence requiring reconciliation with the physical evidence. The objective was to determine whether the reported sequence of events could be explained through engineering analysis and whether the testimony was consistent with the available physical evidence.
This experience revealed that the scientific discipline of engineering evaluates witness testimony differently than many people assume. While all scientific disciplines rely upon empirical evidence, the applied science of engineering is additionally governed by legislated obligations to protect the safety, health, and welfare of the public. Unlike laboratory sciences, whose primary objective is to establish causal understanding through controlled experimentation, engineering must routinely make safety decisions in uncontrolled real-world environments where controlled experiments are often impossible and where the consequences of inaction may involve injury, loss of life, or significant property damage.
Consequently, engineering does not regard witness testimony as evidence to be discarded simply because it is observational. Instead, testimony is assigned evidentiary weight according to established engineering principles, including the credibility and expertise of the witness, the independence and consistency of multiple observations, and its agreement with the available physical evidence. Engineering recognizes that individual observations may contain errors; however, it also recognizes that credible witness testimony frequently provides the only direct evidence describing the sequence of events leading to an accident or identifying an emerging safety hazard. The role of engineering is therefore not to dismiss such testimony, but to reconcile it with the physical evidence and determine whether the observations reveal hazards requiring further investigation or mitigation.
The methodology presented throughout this paper is founded upon that engineering perspective. It reflects the scientific methodology of engineering, where public safety (canon #1) takes precedence over complete scientific certainty, where accepted engineering models are continually tested against real-world observations, and where all materially relevant evidence—including credible witness testimony—is evaluated before conclusions are reached. Although the principles developed herein are applicable to any controversial or emerging engineering problem, unidentified anomalous phenomena (UAP) are used throughout this paper as the primary case study to demonstrate how engineering hazard assessment, engineering epistemology, and legislated public safety obligations operate when observations challenge existing models.
1.2. Scientific Disciplines and Legislated Public-Safety Obligations
Before proceeding, an important distinction must be made. This paper is not a comparison of science versus engineering, nor does it suggest that one scientific discipline is superior to another. Engineering is itself a scientific discipline. The distinction examined throughout this paper is between scientific disciplines whose primary purpose is the advancement of knowledge and scientific disciplines that operate under legislated public-safety obligations. While both employ observation, hypothesis testing, empirical evidence, and model development, they may be required to make different decisions when confronted with uncertainty because their professional responsibilities differ.
Consequently, the issue is not certainty versus safety. Rather, in legislated public-safety disciplines, safety must come before complete certainty whenever credible uncertainty may itself expose people or property to harm. An academic researcher may reasonably conclude that the available evidence is presently insufficient to establish a definitive explanation. An engineer responsible for public safety may simultaneously be required to preserve evidence, evaluate reported hazards, warn affected parties, and implement proportionate risk mitigation while the underlying mechanism remains unresolved. These approaches are complementary, not contradictory.
Importantly, uncertainty cannot be used as an escape mechanism to avoid the engineering hazard assessment process. A reported hazard does not disappear simply because its identity, cause, or mechanism remains uncertain. Engineering requires that the reported hazard be evaluated according to its potential consequences, not dismissed because a complete explanation has not yet been established. In engineering, an unidentified hazard is not the same as a nonexistent hazard.
UAP-aircraft interactions provide a clear example of this distinction. Declaring a pilot’s report of a UAP to be “impossible” does not eliminate the underlying aviation safety issue. If the reported object is ultimately determined to have been a weather balloon, an unauthorized drone, another civil aircraft, a military aircraft, atmospheric debris, or some other conventional object, the operational hazard remains—and in most of these cases becomes even more immediate—because each of these objects is capable of causing a catastrophic mid-air collision. From an engineering perspective, uncertainty regarding the identity of the object does not remove the obligation to investigate the reported hazard, preserve relevant evidence, assess the operational risk, and implement appropriate mitigation where warranted. The engineering obligation exists because of the potential consequences of the reported event, not because its final explanation has already been established.
This distinction explains why engineering evaluates witness testimony differently in safety-critical environments than it may be evaluated in scientific disciplines whose primary objective is establishing causal understanding. In legislated safety disciplines, testimony describing a credible hazard cannot simply be excluded because it is observational in nature. Instead, it must be evaluated alongside the physical evidence, assigned appropriate evidentiary weight according to established engineering principles, and reconciled with all other available information. The objective is not to presume that every observation is correct, but to ensure that potentially significant safety information is not discarded through unverified assumptions.
This distinction forms the central premise of this paper. Using UAP-aircraft interactions as the primary case study, the paper demonstrates how engineering epistemology, engineering model selection, legislated public-safety obligations, and engineering hazard assessment provide a systematic framework for evaluating controversial subjects where observations remain uncertain but the potential consequences of inaction may be severe. Although UAP are used throughout as the principal example, the methodology developed herein is applicable to any controversial engineering problem involving credible public-safety implications.
1.3. The Divergent Treatment of Testimony
This paper is founded upon legislated engineering obligations, established engineering standards, and accepted engineering methodologies governing the professional practice of engineering. These include, but are not limited to, the legislated duty to protect the safety, health, and welfare of the public, the evaluation of materially relevant evidence, the avoidance of unverified assumptions, engineering hazard assessment, and the continual validation of engineering models against real-world observations. Throughout this paper, these engineering obligations are treated as the governing framework within which engineering decisions are made.
Accordingly, this paper does not seek to debate or redefine these engineering obligations. Rather, it examines how those existing legislated requirements apply when engineers are confronted with controversial subjects involving credible public-safety implications. The analysis therefore focuses on the application of established engineering methodology rather than on advocating new engineering rules or professional standards.
Readers may disagree with the interpretation of particular observations or with the engineering models examined later in this paper. Such scientific and engineering debate is both expected and appropriate. However, the engineering methodologies governing evidence evaluation, hazard assessment, model validation, and public-safety obligations are themselves established components of professional engineering practice and form the methodological foundation upon which the analysis is conducted.
Consequently, the principal question addressed by this paper is not whether these engineering obligations should exist, but how they should be applied when observations challenge accepted models in circumstances where uncertainty may itself present a credible risk to public safety.
1.4. Model Blindness
In this paper, model blindness refers to a failure mode in which an accepted model, theory, or assumption becomes sufficiently dominant that contradictory observational evidence is discounted, reinterpreted, or excluded primarily because it does not conform to the model. The resulting error reverses the appropriate relationship between model and observation: rather than testing whether the model adequately represents physical reality, the observations are judged according to whether they conform to the model. In engineering epistemology, persistent disagreement between a model and credible observations requires the model, its assumptions, or its domain of applicability to be re-evaluated.
2. The Divergent Treatment of Testimony
A fundamental divergence exists between how academic science and engineering treat testimony. In scientific culture, testimony is often approached from a presumption of error: “What if the witnesses are wrong? Prove to me beyond a reason of a doubt.” In engineering, particularly in safety-critical domains, the legislated obligatory question is vastly different: “Does the observational data report a safety hazard, if yes, then treat it as real until mitigated.”
Under the legislated engineering rules of evidence embodied in professional engineering statutes, forensic methodologies, and aviation safety practice, all materially relevant testimony and observational data must be evaluated as potential indicators of real-world danger. This precautionary orientation is not optional; it is a legally and professionally mandated duty designed to prevent loss of life in aviation, structural engineering, industrial operations, and other safety-critical environments.
Formal rules of evidence become directly applicable when technical or forensic findings enter judicial proceedings. In Canada, the Canada Evidence Act recognizes professional and other expert opinion evidence, while in the United States Federal Rule of Evidence 702 requires expert testimony to be based upon sufficient facts or data and reliable methods reliably applied to the facts. These legal requirements do not govern every engineering investigation directly; rather, they illustrate the evidentiary scrutiny to which engineering and forensic conclusions may ultimately be subjected. Professional engineering rules independently require objective evaluation of materially relevant information, as discussed in Section 2.3.
A closely related evidentiary principle is that evidence of evidence is itself evidence. A witness reporting an observation constitutes one source of evidence; a second independent witness reporting the same material feature provides additional corroborating evidence. Where witness observations are independently supported by radar, video, photographic, flight-data, or other instrumental records, those records provide further independent evidentiary support. Corroboration does not automatically establish that a particular interpretation or causal model is correct, but convergence among independent sources increases the evidentiary basis for concluding that the reported event or condition warrants investigation.
This distinction is particularly important in safety-critical engineering. The purpose of corroborating evidence is not necessarily to prove the mechanism responsible for an observation. Rather, multiple independent sources may establish sufficient confidence that a potentially hazardous condition exists to require investigation, even while its underlying cause remains unresolved.
Furthermore, within the engineering safety regulations any testimony, no matter how controversial, Canon #1 obligates engineers to retain and evaluate materially relevant witness testimony indicating a credible safety hazard, and UAP interaction, regardless of true nature, represent a potential midair collision risk. For example, if a UAP turns out to be a weather balloon, or some other man-made object, or foreign adversary aircraft, these plausible explanations represent a significant risk for midair collisions.
2.1. Engineering Epistemology
Engineering epistemology is the branch of engineering concerned with how engineers develop, validate, apply, and revise knowledge about real-world systems. One of its foundational principles was articulated by the statistician George E. P. Box, who observed in 1976 (and later expanded in his 1979 work) that: “All models are wrong, but some are useful.” This principle recognizes that every engineering model is a human-created approximation of reality rather than reality itself. Consequently, engineering models are never regarded as final or authoritative descriptions of the physical world; they remain provisional tools whose usefulness depends entirely upon how well they explain and predict observed behavior within their intended domain. Throughout this paper, the engineering safety implications of this principle are referred to collectively as the Engineering Epistemological Rule.
From an engineering safety perspective, this principle requires engineers to recognize that any model may prove incomplete, partially incorrect, entirely incorrect, or simply the wrong model for the phenomenon under investigation. Models must therefore be continually tested against independent observations rather than defended as established truth. This engineering methodology underpins the professional obligation to avoid unverified assumptions, to evaluate all materially relevant observational evidence, and to remain prepared to revise or replace an accepted model whenever repeated observations demonstrate that it no longer adequately represents reality. Closely related engineering concepts include Critical Modeling and Validation, Model Blindness, and the Duty to Avoid Unverified Assumptions.
From an engineering epistemology perspective, a theory or model is never presumed correct simply because it is widely accepted or mathematically elegant. For example, “it takes a chemical rocket 90,000 years to reach the nearest star.” Instead, engineers are required to ask whether the model remains appropriate for the phenomenon being observed. This argument illustrates a classic engineering model-selection error. It is equivalent to arguing that jet aircraft cannot exist because sailing vessels require months to cross the Atlantic. The sailing-vessel model accurately describes sailing vessels, but it is the wrong engineering model for evaluating jet propulsion.
The engineering question is straightforward: does the chemical-rocket propulsion model adequately explain the available observational data, including radar returns, photographs, videos, and pilot observations? The reported flight characteristics do not exhibit the defining operational signatures of chemical propulsion. Consequently, the chemical-rocket model is not the appropriate engineering model for evaluating these observations. When repeated observations conflict with the predictions of the applied model, the Engineering Epistemological Rule requires that the model—not the observations—be re-evaluated. Such re-evaluation may reveal that the model is incomplete, incorrectly applied, missing a necessary mechanism, or that an entirely different engineering model is required.
Engineering history repeatedly demonstrates that catastrophic failures occur when decision-makers defend an accepted model instead of testing it against contradictory observations. In engineering, reality—not theory—has the final authority in safety-critical decision-making.
Engineering must always select the model that best fits the observations, regardless of how unconventional those observations may be.
2.2. Why Do Engineers Think This Way?
The answer lies in the foundational legal principle of professional engineering: engineers are required to hold paramount the safety, health, and welfare of the public above all other considerations. This obligation is codified in professional engineering statutes and in the National Society of Professional Engineers Code of Ethics, which directs engineers to “hold paramount the safety, health, and welfare of the public”.
The legislated engineering rules of evidence exist to fulfill this mandate by ensuring that potentially significant hazards are investigated rather than dismissed. In safety-critical domains, the cost of ignoring a valid warning can be catastrophic. Engineering practice is therefore intentionally structured around the question: What if the witnesses are right?
The rationale for this precautionary approach is not theoretical. Engineering history contains countless numerous examples in which early warnings and eyewitness reports were initially discounted, only to be later confirmed as accurate after catastrophic consequences occurred. The next section presents the historical cases including rogue waves, where mariners reported encounters with unexpectedly large ocean waves for centuries before an engineering sensor recording forced the phenomenon to be formally recognized by the scientific community. This example illustrates why engineering and safety disciplines are structured around the question, “What if the witnesses are right?”, and why potentially life-critical testimony must be investigated rather than dismissed.
2.3. Engineering Evidence and Foreseeable Legal Scrutiny
An additional distinction between professional engineering and many forms of academic scientific research is the foreseeable legal scrutiny attached to engineering decisions. Engineers design, assess, investigate, and approve systems whose failure may cause injury, death, environmental damage, or major property loss. When such failures occur, the engineering work may subsequently become evidence in civil litigation, criminal proceedings, regulatory investigations, professional-disciplinary proceedings, or formal accident investigations. The engineer may therefore be required to defend not only the conclusion reached, but the facts considered, assumptions made, evidence retained, methodology employed, and reasoning by which the conclusion was reached.
This legal exposure helps explain why engineering evidentiary practice places such importance on preservation of relevant information, objective evaluation of contradictory evidence, documented assumptions, verification, and reproducible reasoning. In Canada, the Canada Evidence Act expressly recognizes professional and other experts providing opinion evidence in judicial proceedings [2]. In the United States, Federal Rule of Evidence 702 requires expert testimony to be based upon sufficient facts or data, reliable principles and methods, and reliable application of those methods to the facts of the case [3]. These courtroom requirements are consistent with professional engineering rules requiring engineers to be objective and truthful and to include relevant and pertinent information in professional reports, statements, and testimony [4].
Academic scientists may also appear as expert witnesses, and scientific work can certainly become the subject of litigation. The distinction argued here is therefore not that evidence law applies exclusively to engineers. Rather, foreseeable accountability for real-world consequences is structurally embedded within professional engineering practice. An engineering decision that proves catastrophically wrong may be reconstructed years later in a courtroom or formal investigation from the engineer’s calculations, correspondence, assumptions, reports, and treatment of contradictory observations. Engineering methodology is consequently designed not merely to produce a scientifically plausible explanation, but to produce a documented and defensible professional decision based upon the materially relevant evidence available at the time.
This distinction is directly relevant to the treatment of witness testimony examined in this study. An engineer cannot defensibly exclude materially relevant observational evidence merely because a witness could be mistaken. Possible witness error is itself a hypothesis requiring evaluation. The observation must first be preserved, examined, compared with independent evidence, and assigned appropriate evidentiary weight.
This approach presumes neither that a witness is correct nor that the witness is incorrect. Engineering requires unverified assumptions to be identified and tested; therefore, reasoning that a witness could be incorrect and consequently is incorrect substitutes an unverified assumption for an evidentiary finding and risks confirmation bias. Where the reported condition identifies a credible potential hazard, engineering conservatism imposes an additional requirement: the reported hazardous condition must be treated as potentially real until it has been investigated and adequately mitigated. To dismiss the condition without such evaluation would conflict with engineering Canon #1—the paramount obligation to protect the safety, health, and welfare of the public.
The Engineers and Geoscientists British Columbia (EGBC) Guide to the Code of Ethics is used in this study as a representative Canadian regulatory framework rather than attempting to reproduce the corresponding legislation and professional rules of every Canadian province and U.S. state. The Guide itself identifies and cross-references the governing Professional Governance Act, EGBC Bylaws, applicable enactments, common law, professional standards, and other regulatory requirements. Comparable jurisdiction-specific requirements remain subject to the legislation and professional regulator governing the individual practitioner [5].
Accordingly, references in this paper to “engineering rules” should not be interpreted as suggesting that every jurisdiction uses identical statutory wording. Rather, EGBC provides a documented example of how the broader engineering principles examined here—paramount public safety, distinction between facts and assumptions, due diligence, compliance with applicable law and standards, and duty to report significant hazards—are implemented through a professional regulatory system.
2.4. Historical Ignored Witnesses Parallel Events
Modern engineering increasingly recognizes humans as integral components of safety-critical sensing systems. Across aviation, autonomous systems, industrial control, and defense applications, the concept of the human-in-the-loop recognizes that trained observers frequently detect anomalies, hazards, and unexpected events that automated sensors or existing engineering models may fail to recognize. While individual observations remain subject to human error, repeated independent observations have historically proven to be reliable indicators that a genuine safety hazard exists and warrants investigation.
The purpose of the following historical case studies is not to demonstrate that witness testimony establishes the correct engineering model. Rather, they demonstrate a more fundamental engineering safety principle. Across approximately thirty major engineering and public safety catastrophes, repeated witness reports and precursor observations consistently identified the existence of genuine hazards before the accepted engineering model was revised. In many cases, the observations did not immediately reveal the correct explanation; however, they reliably demonstrated that the prevailing engineering model was incomplete, incorrectly applied, or entirely inappropriate for the phenomenon under investigation.
This historical pattern forms the basis of an engineering epistemological principle. Repeated, independent observations need not identify the correct model to demonstrate that the current model has become unsuitable for safety-critical decision-making. Engineering safety methodology therefore requires that both the reported hazard and the underlying engineering model be re-evaluated whenever credible observations repeatedly conflict with model predictions. The objective is not to prove a replacement model, but to determine whether the existing model remains appropriate for the phenomenon being observed.
Repetition can increase evidentiary confidence; however, neither science nor engineering employs a universal numerical threshold by which a fixed number of observations automatically establishes confirmation or validation. Engineering does not require an arbitrary fixed number of repeated observations before a recurring condition can warrant investigation. Statistical significance depends upon the applicable statistical model, independence of observations, measurement uncertainty, variability, effect size, and analytical method.
Statistical process-control methods likewise demonstrate that relatively small sequences of observations can provide evidence of non-random process change when evaluated within a defined statistical framework; however, these criteria are context-specific and should not be interpreted as universal thresholds for proving a hypothesis. Accordingly, the 28 historical events examined in this study are not claimed to establish statistical significance merely by their number. Rather, their importance lies in demonstrating that the identified safety-related failure mode has recurred across multiple independent historical events.
2.5. Rogue Waves Historical Parallel
For centuries mariners had been reporting large rogue waves, described as on average being three times the size of the surrounding waves coming out of no where and sinking, or damaging ships. Oceanographers rejected these statements and accused the mariners of being drunk or drastically overestimating the size of the waves. They argued that their linear wave theory explained why such waves could not possibly exist. The result, the marine construction codes were never updated to allow ship designs to be capable of coping with being struck by such massive waves. Mariners stepped up and provided photos of rogue waves, which were explained away. Severe structural ship damage was reported and explained away. Here there was a potential legal issue in that oceanographers are not structural engineers and have no legal authority to evaluate, let alone, dismiss these damaged ships as being caused by routine “bad weather”, crew negligence, normal overtopping or shifting cargo & instability.
Historical interviews and institutional records show that scientific authorities responded to rogue wave testimony with conduct that, in engineering terms, would constitute clear professional failure: they were adversarial toward witnesses, dismissive of the data, and refused to examine contradictory evidence or consider alternative models. These behaviors align with recognized epistemological failure modes—model blindness, confirmation bias, and refusal to validate assumptions—that engineering ethics explicitly prohibit because they place the preferred model above real world safety. Had these individuals been acting under engineering licensure, their conduct would have met the formal definition of professional misconduct.
Not even the sinking of the MS München swayed them. The MS München was an ocean-going carrier discovered to have its lifeboats, stored 20 meters or 66 feet above the sea line, ripped off with such force that part of the ships structure was still attached. This event was explained away as a 1 in 10,000-year storm event.
Then in 1995, a downward pointing engineering laser sensor on the Draupner oil platform in the north Atlantic Sea recorded a 25.6 meter (84-foot) wave. It was engineering which recorded and finally showed that rogue waves occur more often than once every 10,000 years. The European Space Agency (ESA) then undertook a satellites radar study and found that there are between 3 and 10 rogue waves in existence on the planet at any given time [6]. This single event showed that the oceanographers had fallen to model blindness, a type of confirmation bias in which the priority of their model was placed above witness testimony and more importantly, above the safety of ocean-going vessels and their occupants. The immediate fall out was two-fold. The marine construction codes were immediately updated to reflect this newly recognized danger, and the oceanographer’s institutions quietly changed their evidentiary rules to adopt the engineers’ rules regarding Critical Modeling and Validation and The Precautionary Principle.
Model Blindness and Unverified Assumptions are known cognitive failure modes in engineering, which historically have led to many catastrophes. This is why the legislated engineering rules of evidence evaluation specifically call them out as know failure modes which can and have led to loss of life.
Science has found that witness testimony is not always accurate. This is point: rogue waves provide an interesting ruler by which to measure that inaccuracy. The reports consistently described the waves as being on average 3 times the height of the surrounding waves. Instrumentation measurements have since shown that the true average is in fact ~2.5 times the average height of the surrounding waves. A dimensional error rate of only 16%. This shows that the expected unreliability or inaccuracy of human observational capabilities was in fact present and recorded in the form of dimensional inaccuracy only. The argument that people overestimated the height was slightly correct, but not the degree used to dismiss the witness data.
Some may suggest that the historical rogue wave analog still doesn’t prove witness testimony can be relied upon because it’s just one example instead of 60 to 200. For this reason, the following section broadens the comparison through additional historical examples of ignored safety-relevant observations.
2.6. Other Historical Parallels
Tables 1-7 present 28 historical examples (including rogue waves). These cases barely scratch the surface of witness ignored failures, but they represent the best known events with the largest numbers of affected people, injured and unfortunately, tragic fatalities. Each table documents situations in which multiple lay witnesses—and expert witnessed events—raised warnings that were ignored. The final column lists fatalities and injuries because, in engineering culture, loss of life is the paramount concern and is always included when describing tragic catastrophic events. To highlight the breadth of the problem, each table briefly describes each event. Each table is separated about by category; scientists, engineers and corporate management in industrial failures, and military command structures in events such as Pearl Harbor. Despite their differences, all these events share a single pattern: one or more witnesses—often expert witnesses—were ignored, and the result was always catastrophic. Table 1 begins with events where science ignored witnesses.
Table 1. Events where science ignored witnesses.
Event Name |
Events where Science Ignored Witnesses |
Description |
Injuries/Fatalities/Witnesses |
Rogue Waves [6] (<1800 to 1994) |
Estimates range from 60 to 200+ individual rogue waves events with 15,000 to 25,000 witnesses who survived to report the events |
Unknown tens of thousands of fatalities |
Apollo 1 Fire [7](1967) |
Astronauts and engineers repeatedly warned about flammable materials and wiring hazards |
3 fatalities |
Space Shuttle Challenger Explosion [8] (1986) |
lead engineer with Morton Thiokol |
7 fatalities |
Space Shuttle Columbia Disaster [9] (2003) |
NASA engineer Rodney Rocha |
7 fatalities |
Titanic Sinking [10] (Atlantic 1912) |
Survivors reported the Titanic breaking in half, scientists argued that the ship’s steel structure was too strong to fail in such a manner and insisted that the vessel must have sunk intact |
705 to 706 surviving witness |
In the aftermath of the Challenger explosion, the Rogers Commission heard testimony from Dr. Richard Feynman, who summarized NASA’s management mindset as one in which assumptions were treated as facts and lack of evidence was treated as evidence of safety. He demonstrated that NASA management had normalized O ring erosion and repeatedly overruled engineering warnings by assuming the risk was acceptable without verification. The Commission concluded that this was a systemic failure of epistemology: decisions were being made on unverified assumptions rather than validated data. As a result, NASA formally adopted what it now calls “assumption based decision error”—a direct analogue to engineering’s legislated Duty to Avoid Unverified Assumptions.
Table 2 presents major infrastructure disasters in which credible warnings from workers, residents, inspectors, and technical specialists were ignored, resulting in catastrophic failures of dams, bridges, spoil tips, and municipal water systems. These events demonstrate how large scale infrastructure carries inherent geotechnical, hydrological, and structural risks that often manifest first through human observations: muddy leaks at a dam face, shifting spoil piles, unstable temporary supports, or abnormal water coloration and odor.
Table 2. Infrastructure Disasters where witnesses were ignored.
Event Name |
Infrastructure Disasters |
Description |
Injuries/Fatalities/Witnesses |
St. Francis Dam [11] Collapse (1928) |
Tony Harnischfeger, noticed deep muddy leaks |
~430 fatalities |
Second Narrows Bridge Collapse [12] [13] (1958, Vancouver) |
Under designed temporary supports complained about & ignored, after collapse, the police were called, first 9 calls were ignored as pranks |
79 workers fell into the water, 18 instant fatalities (including the engineers), 1 rescuer drowned days later |
Aberfan Landslide [14] (1966) |
Local villagers, parents, and school officials |
144 fatalities, including 116 children |
Banqiao Dam Failure [15] (1975) |
Chen Xing, China’s leading hydrologist |
171,000 to 240,000 fatalities |
Flint Water Crisis [16] (2014-2015) |
A local parent and EPA regulation expert |
Thousands of children suffered from lead poisoning |
The Aberfan disaster occurred because a large coal waste spoil tip was placed directly on a natural hillside above a school in the village of Aberfan, resting on layers of porous sandstone and groundwater channels that made the foundation unstable. For months before the collapse, miners and residents reported that the tip was shifting. Each witness saw the spoil pile from a different location in the valley—from the mine yard, from homes, from the school road, or from the opposite slope—and on different days, under different weather and lighting conditions. As a result, their descriptions varied: some said the pile was “slumping”, others “creeping”, “bulging”, “sinking”, or “moving downhill”. These differences were normal perspective based variations, not contradictions. When positional and dimensional errors are removed, the common signal is clear: multiple independent witnesses were observing the same unstable spoil tip in motion above the town. The catastrophe occurred because authorities dismissed these differing descriptions instead of recognizing them as corroborating evidence of a single, dangerous phenomenon.
The Second Narrows Bridge Collapse stands as one of Canada’s most instructive examples of how ignored warnings can compound into catastrophe. During construction, ironworkers repeatedly reported that the temporary steel bracing members supporting the partially completed span appeared dangerously under designed. These concerns were dismissed by the junior engineer responsible for the bracing calculations, and the supervising senior engineer accepted this assurance without independently verifying the math—an explicit violation of engineering verification principles. When the structure failed, seventy nine workers fell into Burrard Inlet, killing eighteen (including the two engineers) instantly and a nineteenth rescuer days later. The second ignored warning occurred moments after the collapse: multiple eyewitnesses phoned the Vancouver police to report that “the bridge has fallen”, but officers assumed they were receiving prank calls and disregarded the first nine reports. Only after tenth phone call did it dawn on the authorities that a disaster occurred. The Second Narrows event therefore illustrates two independent failures of evidentiary judgment—one engineering, one institutional—both rooted in the dismissal of credible observational data, and both contributing directly to one of the deadliest structural failures in Canadian history.
Table 3 describes events in which corporate managers ignored repeated witness warnings, resulting in four catastrophic failures. These cases illustrate a recurring pattern: workers, technicians, and community members identified clear precursor hazards, yet management decisions prioritized production, cost, or schedule over safety. The consequences were mass casualty events that were entirely preventable. In Canada, the 1992 Westray Mine Disaster prompted the creation of Bill C 45, commonly known as the Westray Law, which amended the Criminal Code to impose criminal liability on corporations and managers who disregard safety warnings. This legislation formally recognizes that ignoring witness testimony in industrial environments is not merely a management failure but a prosecutable breach of duty. The events in Table 3 demonstrate why such laws became necessary: when corporate leadership dismisses credible warnings, the result is predictable, repeated, and often fatal.
Table 3. Corporate Disasters where witnesses were ignored by corporate managers.
Event Name |
Corporate Disasters |
Description |
Injuries/Fatalities/Witnesses |
The Great Boston Molasses Tank [17] (USA, 1919) |
Local residents and workers testified for years |
150 injured, 21 fatalities |
Westray Mine Disaster [18](Canada, 1992) |
Miners repeatedly warned of methane buildup, coal dust hazards, and unsafe ventilation; concerns were ignored by management |
26 fatalities; led to Canada’s Bill C 45 (Westray Law) establishing criminal liability for unsafe corporate practices |
The Deepwater Horizon Oil Spill [19] (2010) |
Technicians and external contractors raised red flags regarding unstable gas pressures |
11 fatalities |
Table 4 documents major engineering and industrial disasters in which credible warnings from workers, inspectors, and technical personnel were ignored, resulting in catastrophic failures across multiple sectors. These events illustrate how engineering level hazards emerge long before the final collapse, often through repeated precursor observations such as structural distress, abnormal readings, malfunctioning safety systems, or visible signs of impending failure. In each case, the witnesses were not just lay observers, but individuals embedded directly within the operational environment—fabricators identifying unsafe design changes, operators reporting faulty indicators, and technicians warning of unstable process conditions. Their testimony represented materially relevant engineering data, yet management structures dismissed or minimized these warnings.
Table 4. Engineering & Industrial Disasters where witnesses were ignored.
Event Name |
Engineering & Industrial Disasters |
Description |
Injuries/Fatalities/Witnesses |
Hyatt Regency Walkway [20] Collapse (1981) |
Fabricators and inspectors raised concerns about the hanger rod design change |
114 fatalities, 216 injured |
Texas City Refinery Explosion [21] (USA, 2005) |
Operators reported malfunctioning level indicators and unsafe startup procedures |
15 fatalities, 180 injured |
Bhopal Gas Tragedy [22] (India, 1984) |
Workers and journalists reported repeated leaks and failing safety systems |
3,000 - 8,000 immediate fatalities, up to 20,000 long term |
Table 5 presents major aerospace and aviation disasters in which pilots, mechanics, controllers, and internal technical specialists provided clear precursor warnings that were ignored, minimized, or overridden, resulting in catastrophic loss of life. Aviation is a domain where human in the loop sensing is critical: pilots report unreliable instruments, mechanics identify component fatigue, controllers warn of visibility or radio communication hazards, and engineers flag unstable flight control logic. In each case documented here, these warnings represented materially relevant operational data, yet institutional, managerial, or regulatory structures failed to act. The consequences were severe—from the runway visibility and radio confusion failures preceding the Tenerife Airport Disaster, to pilots’ repeated reports of unreliable pitot tubes before Air France 447, to internal Boeing engineers and technical pilots warning about MCAS behavior before the 737 MAX crashes. Additional cases such as the Concorde Crash and Alaska Airlines Flight 261 further demonstrate how ignored maintenance warnings and known component fatigue risks can escalate into full loss events.
Table 5. Aerospace & Aviation Disasters where witnesses were ignored.
Event Name |
Aerospace & Aviation Disasters |
Description |
Injuries/Fatalities/Witnesses |
Tenerife Airport Disaster [23] (1977) |
Ground controllers and pilots reported visibility issues and radio confusion |
Two 747s collided, killing 583 |
Air France 447 [24] (2009) |
Pilots repeatedly reported unreliable pitot tubes |
The tubes froze, the aircraft stalled, 228 fatalities, no survivors |
The Boeing 737 MAX Crashes [25] (2018-2019) |
Internal Boeing flight technical pilot Mark Forkner and multiple factory engineers |
346 fatalities from two airplane crashes, no survivors |
Concorde Crash [26] (2000) |
Air France mechanics warned about tire fragmentation risks |
113 fatalities, no survivors |
The Alaska Airlines Flight 261 Crash [27] (2000) |
A veteran mechanic named John Liotine reported unsafely maintenance intervals |
88 fatalities, no survivors |
Volcanology represents a uniquely revealing scientific field because it is one of the few disciplines in which scientists must rely on initial observational data from civilians to detect the earliest signs of a volcano becoming unstable. Instruments, seismic arrays, and gas flux sensors are often sparse, delayed, or unable to capture localized precursor activity. As a result, the first indications of an awakening volcano frequently come from villagers, farmers, hikers, and local workers who observe ground cracking, unusual fog, bubbling lakes, sulfur odors, rumbling, or changes in springs and animal behavior. These observations are often described using cultural or non technical language, which historically led volcanologists to dismiss them as superstition or misinterpretation. Yet when positional, linguistic, and perspective differences are removed, the common signal is clear: multiple independent witnesses were reporting the same physical precursors. Table 6 lists cases which illustrate how ignoring these early observations has repeatedly resulted in catastrophic loss of life.
Table 6. Volcanology Disasters where witnesses were ignored.
Event Name |
Volcanology Disasters |
Description |
Injuries/Fatalities/
Witnesses |
Mount St. Helens Eruption [28] (Washington 1980) |
Volcanologists warned that the North Fork Toutle River valley and surrounding logging areas needed full evacuation; recommended exclusion zone was reduced by state officials |
57 fatalities |
Nevado del Ruiz/Armero Tragedy [29] (Colombia, 1985) |
Residents reported rumbling, ash fall, sulfur smells, unusual fog; volcanologists issued formal warnings |
~23,000 fatalities |
Lake Monoun Limnic Eruption [30] (Cameroon, 1984) |
Villagers reported bubbling water, rumbling sounds, dead animals near the lake, and “bad winds” rising from the surface |
37 fatalities |
Lake Nyos Limnic Eruption [31] (Cameroon, 1986) |
Villagers reported unusual fog, bubbling water, rumbling, sick livestock, and “the lake breathing” weeks before the eruption |
~1,746 fatalities; ~4,000 injured or displaced |
In the Lake Monoun and Lake Nyos cases, villagers provided early warnings by reporting unusual lake behavior, but their descriptions were framed in cultural terms rather than scientific language. People spoke of the lakes “breathing”, releasing “bad winds,” or acting “angry,” while pointing out dead livestock, strange fog, and changes in water behavior. Because these descriptions did not match volcanological terminology, officials and scientists dismissed them as superstition rather than recognizing them as observations of CO2 degassing precursors. When the cultural phrasing is stripped away, the underlying pattern is clear: multiple independent witnesses were identifying the same hazardous physical process. The catastrophe occurred because authorities relied on model expectations instead of treating witness testimony as operational data, allowing a preventable mass fatality event to unfold.
The Mount St. Helens (1980) and Nevado del Ruiz/Armero (1985) disasters share a critical pattern: in both cases, expert volcanologists issued clear, technically supported warnings, and in both cases government authorities chose to override or minimize those warnings for political or economic reasons. Before Mount St. Helens erupted, USGS scientists mapped the lahar pathways and requested a large exclusion zone that included the entire North Fork Toutle River valley. State officials approved a much smaller safety radius, leaving loggers, residents, and workers in areas the volcanologists had explicitly identified and was later proved to be lethal. Five years later in Colombia, volcanologists warned that Nevado del Ruiz was entering a dangerous phase and that lahars would follow established channels directly toward the town of Armero. Their evacuation recommendations were delayed or never communicated to the public. In both events, expert witnesses were ignored, not because their science was uncertain, but because their warnings conflicted with political priorities. The result was the same: preventable mass fatality disasters caused by the failure to treat expert hazard assessments as operational safety data.
Table 7 presents major military and defense failures in which credible warnings from intelligence analysts, radar operators, reconnaissance personnel, and field observers were ignored or dismissed, resulting in catastrophic strategic or tactical outcomes. Unlike industrial or infrastructure environments, military systems operate under compressed timelines, high-stakes uncertainty, and complex multi sensor data streams. In these contexts, human observations—early radar returns, intercepted communications, reconnaissance sightings, and field level reports—often provide the first indication of an emerging threat. Yet in the cases documented here, these warnings were overridden by command level assumptions, institutional biases, or rigid adherence to preexisting models of adversary behavior. Table 7 therefore illustrates that witness ignored failures are not limited to civilian domains; they also occur in defense environments where the cost of disregarding credible warnings is measured in strategic defeat, loss of life, and long-term geopolitical consequences.
Table 7. Government, Military and Intelligence Failures where witnesses were ignored.
Event Name |
Government, Military and Intelligence Failures |
Description |
Injuries/Fatalities/Witnesses |
Pearl Harbor (1941) Ignored Radar Warning [32] |
Radar operators detected incoming aircraft, confused for friendly B-17s |
1178 wounded, 2403 fatalities |
Pearl Harbor (1941)Ignored Mini Submarine Sighting [33] |
USS Ward reported sinking a Japanese midget sub hours before the attack |
1178 wounded, 2403 fatalities |
Six Day War [34] (Israel 1967) |
Israeli intelligence was initially surprised by the Egyptian military deployment into Sinai because prevailing assessments held that Nasser was unlikely to risk war. The intelligence model was subsequently revised as evidence of escalation accumulated |
800 to 1,000 Israeli personnel |
Yom Kippur War [35] (1973) |
Multiple intelligence officers warned of imminent attack. Leadership dismissed warnings as “Arab bluff” |
2,500 to 2,700 Israeli personnel |
Across the 28 historical events documented in Tables 1-7, the significance of repetition is not that the number of cases crosses an arbitrary numerical threshold for proof. Rather, the cases demonstrate recurrence of the same safety-relevant failure mode across independent events, different industries, historical periods, and classes of hazard. The historical record therefore provides evidence that dismissal of credible precursor observations is not an isolated phenomenon, but a recurring safety problem.
The cases also illustrate an important distinction between model construction and hazard identification. Witness testimony may be insufficient, by itself, to establish the correct scientific or engineering model. However, credible observations can still provide materially relevant evidence that a hazardous condition exists or that an existing model is incorrect, incomplete, or misapplied. In safety-critical engineering, either condition warrants investigation; identification of the correct causal model may occur later.
There is a longstanding saying in the engineering and safety professions that “the rules were written in blood—someone had to die for them to be written down”. Engineering has institutionalized these lessons through legislation, professional rules, codes of ethics, and technical standards. Their incorporation into professional practice reflects accumulated experience demonstrating that safety-relevant observations cannot be dismissed merely because they are uncertain or conflict with an accepted model. Accordingly, requirements to evaluate materially relevant evidence, avoid unverified assumptions, and protect public safety are not merely theoretical principles; within their applicable jurisdictions and professional contexts, they form part of the rules and standards governing engineering practice.
The fatality and injury totals in Tables 1-7 are therefore not presented as a statistical measure of witness reliability. They document the consequences that can follow when credible safety-relevant observations are excluded or inadequately investigated. The engineering lesson is narrower but more consequential: observations need not identify the correct model to indicate that the current model may be inadequate for safety-critical decision-making, and uncertainty concerning cause or identity does not justify excluding a credible potential hazard from investigation.
2.7. Historical Witness Testimony Discussion
The preceding catastrophes represent only a small sample of a known recurring engineering failure mode. In each case, credible observations conflicted with the accepted model, yet the observations were discounted because the prevailing theory or engineering model was presumed to be correct. Engineering recognizes this as a known dangerous assumption and has introduced rules to direct engineers to be aware of this safety issue and how to avoid it, called the epistemological rule. Engineering models and scientific theories are human-developed constructs intended to represent reality; they are not reality itself. Consequently, there is no guarantee that any accepted model is complete, correct, or even the appropriate model applied to represent the phenomenon under investigation. History further demonstrated that the correct explanation may require modification of an existing model or the development of an entirely new model. From an engineering safety perspective, presuming the correctness of an accepted model (prime example, rogue waves) in the face of repeated contradictory observations constitutes a recognized failure mode because it can prevent timely recognition of genuine hazards.
In layman’s terms, Engineers are taught that there is no guarantee that any man-made theory or model is correct, or complete. This means that in engineering when repeated witness reports (called “observational data”, not anecdotal) contradicts a preferred theory or model, the theory must then be considered as the incorrect variable, as incomplete, as completely incorrect, or the completely wrong model being used to describe reality.
The UAP debate reveals a contemporary example of the epistemological failure modes described above. Two distinct engineering models are routinely invoked in scientific commentary: the UAP flight characteristics dismissal model (“objects cannot maneuver that way without crushing the occupants”) and the NHI travel model assumption (“they cannot get here from there due to chemical rocket limitations”). Neither model reflects the reality of the over 1000 pilot reports (Americans for Safe Aerospace), a figure which does not include the MUFON and other organizations databases. Yet both are treated with a presumption of correctness. Under engineering epistemology, these are textbook cases of model blindness—the failure mode in which an accepted model is defended despite contradictory observations—and a direct violation of the legislated Duty to Avoid Unverified Assumptions. The assumption that UAP cannot exhibit advanced maneuvering is an unverified engineering propulsion model, not a physics rule. Likewise, the assumption that chemical-based rocket interstellar travel is impossible is a second unverified engineering model derived from performance limits. Engineering requires the opposite stance: when a model has not been validated for the domain in question, it must be treated as provisional, incomplete, and potentially inappropriate. The listed historical catastrophes demonstrate that presuming the correctness of unverified models—whether in volcanology, structural engineering, industrial safety, or aerospace—has repeatedly led to loss of life. The same epistemological pattern now appears in the UAP domain, making it essential to apply the engineering rules of evidence rather than continue with unexamined unverified assumptions as the paper proceeds into its main analysis.
Let’s examine example where engineers treated reported safety observations as true until mitigated; the de Havilland Comet airliner. After several aircraft were lost, engineers did not continue flying the fleet until they had proven the exact cause of the accidents. Instead, the aircraft were grounded and extensive testing began. Only later did engineers discover the previously unknown problem of metal fatigue caused by repeated cabin pressurization around the square windows. The safety mitigation came first; the scientific and engineering explanation followed.
The same engineering principle applies to UAP. The argument that UAP cannot exist because chemical rockets require approximately 90,000 years to reach the nearest star applies only to one propulsion paradigm. Engineering has already demonstrated multiple fundamentally different propulsion concepts, including nuclear and plasma-based systems, that operate according to different engineering principles. Moreover, the UAP flight characteristics analyzed in this paper do not exhibit the defining operational signatures of chemical propulsion. Applying the chemical-rocket model to these observations is therefore a classic engineering model-selection error, equivalent to evaluating jet aircraft using the performance characteristics of sailing vessels. Engineering epistemology requires selecting the engineering models that best fit the available evidence rather than forcing the evidence to fit an inappropriate model. Accordingly, this paper examines the two propulsion models that most closely correspond to the reported UAP flight characteristics and evaluates their implications for aircraft safety.
3. Application of Engineering Epistemology to UAP Hazard
Assessment
The preceding historical examples demonstrate why engineering developed formal safeguards for evaluating observations under uncertainty. Across aviation, maritime operations, industrial accidents, structural failures, and other safety-critical fields, potentially important observations have at times been discounted because they conflicted with accepted models, lacked an immediately understood mechanism, or appeared improbable under the prevailing scientific understanding. Engineering legislation, standards, and professional rules are intended in part to prevent this failure mode. Under Canon #1, the engineer’s obligation to hold paramount the safety, health, and welfare of the public requires credible indications of potential danger to be evaluated even when their cause remains uncertain.
Unidentified anomalous phenomena (UAP) provide a contemporary example in which these principles can be applied. Pilots may incorrectly perceive, remember, or identify individual observations, just as any human observer can. History has shown that individual reports are often evaluated in isolation, one at a time, with the objective of determining whether the individual observation can be explained or rejected. However, the complete observational dataset must also be examined collectively. When numerous independent reports are compared, individual errors, unusual circumstances, and inconsistent observations can be identified as outliers, while characteristics that repeatedly occur across otherwise independent events become increasingly apparent. In this way, the noise associated with individual human observations can be reduced and the larger operational pattern becomes clearer. Evaluating UAP reports only one event at a time therefore risks obscuring a recurring hazard pattern that may only become evident when the reports are examined as an aggregate dataset. The relevant engineering question is not whether every reported UAP has been correctly identified, nor whether every individual observation is accurate, but whether the collective observational record reveals repeatable characteristics or a recurring operational pattern indicative of a potential aviation hazard. Where such a pattern exists, engineering requires the complete body of observational data to be evaluated rather than permitting uncertainty or error within individual cases to invalidate the dataset as a whole.
This distinction separates hazard identification from object identification. A reported object does not cease to represent a potential hazard merely because its identity is uncertain, and identifying it as conventional does not necessarily resolve the safety issue. If a reported UAP is subsequently identified as a weather balloon, drone, civil aircraft, military aircraft, or another physical object operating dangerously close to an aircraft, the extraordinary identification question may have been resolved, but the aviation-safety problem has not. The event may instead have been reclassified as a conventional but potentially serious near-miss or collision hazard. Similarly, if an atmospheric explanation is proposed, engineering must determine whether that phenomenon can reproduce the reported observations and, if so, what atmospheric, electrical, visibility, or operational hazard it presents.
This leads to a fundamental principle applied throughout the following assessment: identification determines the appropriate hazard classification and engineering model; it does not determine whether a reported hazard deserves evaluation. Uncertainty therefore cannot be used as an escape mechanism from a safety obligation. Each credible candidate explanation must be followed to its corresponding safety consequence.
The following subsections apply this methodology to reported UAP-aircraft interactions using consequence-based risk assessment and the hazard decision tree presented in this paper. The objective is not to establish the ultimate origin of UAP. Rather, it is to demonstrate how the scientific discipline of engineering can evaluate the reported observations under uncertainty, classify the potential hazard independently of origin, and subsequently compare candidate explanatory models against the available observational data. In engineering terms, it is not necessary to know what something is before determining that it may be dangerous.
3.1. Consequence-Based UAP Hazard Decision Tree
The engineering treatment of UAP observational data can be demonstrated through a consequence-based hazard decision tree. Figure 1 shows the decision tree is specifically intended to evaluate the class of UAP observations reported by pilots as apparently discrete objects: during daylight, objects described as having coherent physical form, including objects appearing metallic or constructed; and at night, discrete luminous objects whose reported motion gives the appearance of independent or controlled flight. The tree therefore does not attempt to encompass every atmospheric or optical phenomenon that might produce an unusual visual observation. Atmospheric explanations incapable of reproducing the defining characteristics of the observation under examination are excluded as inappropriate engineering models. A candidate atmospheric explanation must be capable of reproducing the reported appearance, persistence, relative motion, and apparent maneuvering before it can reasonably be considered explanatory.
The purpose of the decision tree is not to determine the ultimate identity or origin of a reported UAP, but to determine the safety consequence associated with each plausible explanation. Consistent with Canon #1, the initial engineering question is therefore not simply “What is it?” but “Does the reported observation describe a condition capable of endangering the aircraft, crew, passengers, or other users of the airspace?” Each viable candidate identification must then be followed to its corresponding engineering safety consequence.
Figure 1. Consequence-based UAP hazard decision tree.
The decision tree produces an important engineering result: none of the viable explanatory branches automatically resolves the aviation-safety concern. Identification changes the classification and potentially the severity of the hazard, but does not necessarily eliminate it. A weather balloon, drone, civil aircraft, military aircraft, or other physical object operating within unsafe proximity represents a potential collision or near-miss hazard. If an atmospheric or electrical phenomenon capable of reproducing the reported observation is proposed, its corresponding electrical, physiological, visibility, or operational effects must instead be evaluated. If the object remains unidentified, the potential hazard likewise remains unresolved. Thus, identifying a UAP as conventional does not necessarily rescue the event from the safety problem; in some cases it converts an uncertain hazard into an identified and established class of aviation hazard.
This result makes determining the actual nature of recurring UAP reports more important, not less. Engineering epistemology requires candidate explanations to be compared against the complete observational record—including pilot testimony, radar, photographs, video, flight data, and other available evidence—and requires models that fail to reproduce the observations to be rejected or revised. The objective is not to select the most familiar explanation, nor the most extraordinary one, but to determine which model or combination of models best accounts for the available observational data while preserving the safety obligation during the period of uncertainty.
The scale of the reported observations further elevates the importance of this determination. Americans for Safe Aerospace (ASA) reported in February 2026 that it had collected more than 1,000 UAP reports and was working to improve the reporting and technical validation of pilot observations. ASA has separately stated that its database contains more than 1,100 documented encounters from a broader population that includes commercial and military aviators, flight instructors, aerospace professionals, civilian observers, and others [36]. ASA itself characterizes UAP reporting as an aviation-safety concern and emphasizes the need for increased reporting, validation, and analysis [37].
When considered through the consequence-based decision tree, the frequency of these reports creates an engineering question independent of any conclusion regarding UAP origin. If a significant portion represents balloons, drones, conventional aircraft, military activity, atmospheric or electrical phenomena, or genuinely unidentified physical objects, each explanation carries different but potentially consequential implications for aviation safety. Determining which explanations actually account for the recurring observations should therefore be treated as a high-priority engineering and aviation-safety problem rather than deferred until certainty concerning UAP origin has been achieved.
When engineering Canon #1—the obligation to hold paramount the safety, health, and welfare of the public—is applied to the consequence-based decision tree, an important conclusion follows. Every viable explanatory pathway retains a potential aviation-safety hazard. Consequently, uncertainty regarding the identity or origin of a reported UAP cannot, by itself, eliminate the identified safety concern. Whether the reported object is ultimately determined to be a balloon, drone, conventional aircraft, military or classified technology, foreign-adversary system, atmospheric or electrical phenomenon, or remains unidentified, the corresponding pathway retains a potential collision, near-miss, electrical, or other operational hazard.
Once a credible potential safety hazard has been identified, the engineering response is therefore not to dismiss the event because its cause remains uncertain, but to investigate and characterize the hazard sufficiently to determine appropriate mitigation. Causal identification and hazard mitigation may proceed in parallel; complete knowledge of origin is not necessarily required before reasonable safety measures can be considered. Organizations such as Americans for Safe Aerospace (ASA), through the collection and analysis of aviation observations and advocacy for improved reporting systems, illustrate the type of systematic investigation required to determine the frequency, characteristics, and ultimately appropriate mitigation of these reported hazards.
3.1.1. Treatment of UAP Reports as Reported Aviation Safety Events
The evidentiary methodology applied to UAP-aircraft encounters in this study is not unique to UAP. The same engineering approach applies to any reported near-miss or potentially safety-critical condition identified by a technically competent observer. The unresolved nature of the reported cause does not create a separate evidentiary standard.
Witness testimony is neither accepted uncritically nor dismissed as anecdotal. The reported condition is evaluated against available independent evidence, including the witness’s opportunity and technical competence to observe; independent witnesses; contemporaneous communications; radar, telemetry, imagery, flight data, or other instrumentation; and applicable physical and engineering models. Contradictory evidence is retained and evaluated rather than removed from the dataset. Applied to aviation, a pilot therefore functions as a technically trained operational witness whose report may identify a condition requiring safety assessment.
Importantly, hazard recognition and causal identification represent different evidentiary thresholds. Evidence may warrant investigation without establishing cause; stronger convergent evidence may establish a physical aviation hazard without identifying it; and substantially greater evidence would be required to infer unconventional technology or a particular origin. Safety assessment therefore does not require final causal identification before it begins.
A simple aviation example illustrates this distinction. Consider a pilot taxiing for departure who observes a large dark airborne mass near the runway and reports what appears to be a dense flock of birds. An air-traffic controller observing the same condition from the tower instead interprets it as smoke from a nearby fire. The pilot refuses takeoff because a dense flock of birds could create a serious bird-strike hazard, while the controller temporarily prevents aircraft from landing because smoke could obscure the runway or approach path and contribute to a landing accident. The two witnesses disagree about the identity and cause of the observation, yet both identify credible aviation hazards requiring immediate action.
In the moment, were both observers correct about what they were seeing? They could not both be correct if the observed condition had a single cause, and subsequent investigation might establish that one—or even both—had incorrectly identified it. But were their safety decisions correct based upon the information available at the time? From an engineering-safety perspective, the answer is yes. Both responded conservatively to a credible condition capable of producing serious consequences. The correctness of those safety decisions does not depend upon which observer ultimately identified the phenomenon correctly. Later identification cannot retroactively negate the potential emergency confronting the pilot and controller when an operational decision had to be made. Safety action is required in the moment; causal identification may follow after the immediate risk has been controlled.
The same distinction applies to UAP-aircraft encounters. The relevant initial question is not whether the pilot has correctly identified the phenomenon, but whether the reported condition reasonably indicates a potential aviation hazard requiring action. Subsequent identification as a balloon, drone, conventional aircraft, military or foreign technology, atmospheric phenomenon, or another cause may explain the event, but it cannot retroactively determine whether the safety decision made with the information available at the time was appropriate.
The engineering sequence is therefore: identify the hazard, mitigate the risk, and determine the cause or identity if the evidence permits. Identity is neither a prerequisite nor a requirement for safety audit, hazard mitigation, or appropriate safety action.
3.1.2. UAP Examples: JAL 1628 and Stephenville
Two documented UAP events illustrate how the engineering methodology described above can be applied where witness testimony is accompanied by independent instrumental evidence. Japan Airlines Flight 1628 (1986) and the Stephenville, Texas event (2008) are particularly useful because both contain technically experienced witnesses together with radar evidence subsequently available for civilian examination. Neither event is used here to establish the origin or technological nature of UAP; rather, they demonstrate how observational testimony can be compared with independent instrumental records when evaluating a reported aviation-safety condition.
Japan Airlines Flight 1628. On November 17, 1986, the three-person flight crew of a Boeing 747 reported unidentified airborne objects while operating over Alaska. The subsequent FAA record contains separate crew interviews, contemporaneous air-traffic-control communications, flight-path information, aircraft-radar observations, ground-radar records, controller statements, and extensive radar tracking data [38]. The radar evidence has been subject to differing interpretations, which is itself relevant to the present methodology. Engineering evaluation does not require every evidence source to agree upon before a reported safety condition can be investigated. Instead, independent observations and instrumental records are compared, disagreements are retained, and the conclusions are limited to what the combined evidence supports.
For the crew of JAL 1628, however, causal identification was not the immediate operational problem. The pilots did not have the time or opportunity during the encounter to debate competing explanations with scientists or determine the ultimate identity of what they were reporting. Their responsibility was the immediate safety of their aircraft, crew, and passengers. Based on the information available to them in the moment, they were reporting an external condition they believed could affect the safe operation of their aircraft. The appropriate safety response therefore had to occur during the encounter, while causal identification could only follow afterward through examination of the testimony, radar records, ATC communications, and other available evidence. Subsequent disagreement over what caused the observations cannot retroactively remove the safety concern that existed when the crew was required to make operational decisions.
Stephenville, Texas. A second example occurred on January 8, 2008, when numerous witnesses in the Stephenville-Dublin area reported unusual airborne observations. Witnesses included technically or operationally experienced observers, including private pilot Steve Allen and law-enforcement personnel. Powell and Schulze subsequently obtained FAA radar data and conducted a civilian investigation comparing witness observations with radar information from five radar sites [39]. Their analysis incorporated witness locations and reported observations, military-aircraft activity, and unidentified radar returns. The present study does not independently adopt their conclusions concerning the identity of the phenomenon; Stephenville is included because it demonstrates the evidentiary process relevant here: human observations can be retained as data and tested against independently recorded instrumental evidence.
Together, JAL 1628 and Stephenville illustrate the distinction between observation, corroboration, and identification. Witness testimony is neither accepted uncritically nor dismissed categorically. Radar, ATC records, additional witnesses, flight information, and other available evidence provide independent means of testing what was reported. Agreement may strengthen particular aspects of an observation, while disagreement identifies uncertainty requiring further investigation. Neither outcome requires an investigator to infer an extraordinary origin.
From an engineering-safety perspective, this distinction is decisive. Origin does not determine whether the initial safety hazard exists. Canon #1 and the consequence-based decision tree require the potential safety consequences of the reported condition to be evaluated irrespective of which causal explanation ultimately proves correct. The engineering sequence therefore remains: identify the hazard, mitigate the risk, and determine the cause or identity if the evidence permits. Identity is neither a prerequisite nor a requirement for safety assessment and action.
3.2. The UAP Reporting Paradox: Safety Reporting and
Professional Consequences
The consequence-based assessment in Section 3.1 identifies an additional aviation-safety problem independent of UAP origin: the reporting system may discourage collection of the observational data required to identify and mitigate the hazard. Current FAA procedures require pilot and air-traffic UAP observations to be reported and specify collection of aircraft position, UAP position, description, direction and speed, and available radar information. Where life or property may be endangered, additional reporting is required [40]. Aviation safety therefore depends upon pilots reporting potentially hazardous observations.
In practice, however, significant professional disincentives to reporting have been identified. Americans for Safe Aerospace (ASA) reported in January 2026 that only approximately 5% - 10% of pilot UAP observations are formally reported and identified career and aeromedical consequences—including possible evaluation, certification consequences, grounding, and loss of income—as important reporting barriers [41]. This creates a UAP Reporting Paradox: aviation safety requires potentially hazardous observations to be reported, while the perceived or actual consequences of reporting may provide pilots with a powerful incentive not to report them.
A historical example occurred following the 1986 Japan Airlines Flight 1628 incident over Alaska. Captain Kenju Terauchi and his crew formally reported unidentified airborne objects, resulting in an FAA investigation involving crew interviews, radar examination, and operational records. Following subsequent publicity, Terauchi was reportedly removed from flight duties by Japan Airlines and reassigned to a desk position before eventually returning to flight duties [42]. Although the available evidence does not establish that this resulted from an FAA medical determination, the case demonstrates that professional consequences associated with reporting unusual aviation observations are not merely hypothetical.
A second potential gap occurs after a report is made. FAA procedures direct UAP reports through an operational-security pathway associated with air security, national defense, homeland security, and law-enforcement coordination [40]. Such evaluation is appropriate where an unidentified object may represent a security threat; however, national-security evaluation and engineering hazard investigation answer different questions. Determining whether an observation represents a security threat does not necessarily establish what produced the observation, whether similar encounters are recurring, or what engineering mitigation is required to prevent future aircraft interactions.
Consequently, potentially important safety data can be lost at two points: a pilot may elect not to report because of professional consequences, or a reported observation may not receive the independent engineering analysis required to characterize the recurring hazard. This is particularly significant because the decision tree in Section 3.1 demonstrates that the viable explanatory pathways—including balloons, drones, conventional or military aircraft, atmospheric or electrical phenomena, and unidentified physical objects—retain potential aviation-safety consequences. The observation must therefore first be investigated as an observation rather than used as evidence against the observer.
This paper consequently recommends a protected UAP aviation-safety reporting pathway in which good-faith pilot reports are initially treated as observational safety data. Reporting an unidentified or anomalous object should not, standing alone, constitute evidence of psychological impairment or medical unfitness. Medical evaluation should remain available where independent evidence raises a legitimate concern regarding pilot fitness, while UAP reports should undergo engineering safety investigation separate from, but capable of exchanging relevant information with, national-security investigations.
The objective is not preferential treatment for UAP reports, but the same fundamental treatment expected of other aviation hazards: collect the observation, protect the reporter, aggregate the data, investigate the hazard, determine the cause where possible, and implement appropriate mitigation. Until such a process exists, underreporting itself remains an additional uncertainty in determining the frequency and safety significance of UAP-aircraft interactions.
3.3. Engineering Safety Does Not Require Origin Certainty
The methodology presented in this paper leads to one practical recommendation. Whenever a controversial subject also presents a credible potential risk to public safety, the investigation should include qualified engineering professionals with expertise in engineering hazard assessment, forensic engineering, and safety-critical decision making.
Unlike many areas of scientific inquiry, safety-critical engineering investigations operate under legislated public-safety obligations. In such environments, witness testimony cannot simply be dismissed because it is observational in nature. Rather, when testimony describes a credible hazard to aircraft, infrastructure, workers, or the general public, engineering standards and applicable safety regulations require that the observations be documented, evaluated, reconciled with the available physical evidence, and formally dispositioned through the appropriate hazard assessment process. The objective is not to presume that every observation is correct, but to ensure that potentially hazardous observations are neither ignored nor excluded as “anecdotal” before they have been properly evaluated.
This distinction is important. If witnesses report an unusual biological observation, such as unexpected feeding behavior in wildlife, there is generally no legislated engineering obligation requiring immediate action while additional scientific evidence is collected. By contrast, when workers report a dangerous situation such as, pilots reporting unidentified objects operating in controlled airspace near commercial aircraft, the potential consequences include loss of separation, collision, or disruption to safe flight operations. Regardless of the object’s eventual identification, the report describes a potential aviation hazard and therefore falls within engineering and aviation safety processes designed to protect the public.
Accordingly, controversial subjects involving credible public-safety implications should be investigated by multidisciplinary teams that include both subject-matter scientists and qualified engineers. Scientists contribute expertise in establishing causal mechanisms and advancing theoretical understanding. Engineers contribute methodologies specifically developed for evaluating hazards under uncertainty, assessing operational risk, reconciling witness testimony with physical evidence, and implementing appropriate mitigation measures before complete scientific certainty has been achieved. The combined application of these complementary methodologies provides a more robust framework for protecting the public while scientific understanding continues to evolve.
4. Discussion: Implications for Scientific Investigation under
Uncertainty
The historical examples and UAP hazard assessment examined in this paper demonstrate that different scientific disciplines may legitimately approach uncertain evidence differently because their objectives and professional obligations differ. Scientific research may seek sufficient evidence to establish identity, mechanism, or causation, while engineering in safety-critical applications must additionally determine whether observations indicate a credible hazard requiring action before causal certainty has been achieved. These approaches are not contradictory; they address different questions and can operate simultaneously.
The historical record also demonstrates why this distinction matters. Repeated catastrophic events have shown that dismissing, minimizing, or excluding observational reports because they conflict with accepted models can itself become a dangerous failure mode. Engineering and other safety-critical disciplines learned through experience that reports indicating potential danger must be evaluated rather than rejected merely because their cause is uncertain or their implications appear improbable. These lessons are now reflected in engineering literature, professional rules, standards, and, where applicable, legislation and regulation. The resulting safeguards are therefore not intended to lower evidentiary standards, but to prevent uncertainty from becoming justification for ignoring a potentially serious hazard.
4.1. Models Must Be Tested against Observations
George E. P. Box’s observation that “all models are wrong, but some are useful” provides the epistemological basis for this approach. Models are simplified human representations of physical reality rather than reality itself. Their engineering value depends upon their ability to reproduce observations, make useful predictions, and support defensible decisions.
Consequently, when repeated independent observations conflict with a model, engineering requires the discrepancy to be investigated rather than automatically rejecting the observations. The model may be incomplete, incorrectly applied, outside its intended domain, missing a necessary mechanism, or require replacement. This principle applies equally to conventional and unconventional explanations. Atmospheric phenomena, balloons, drones, conventional aircraft, sensor effects, perceptual errors, and proposed advanced technologies must each be compared against the complete observational dataset. The observations test the model; the model does not determine which observations are permitted to exist.
The same principle applies to witness testimony. Individual observations may contain errors, but those errors must be identified and characterized rather than used to invalidate an entire dataset. When numerous independent observations are compared, inconsistent cases can be separated from characteristics that repeatedly occur across otherwise independent events. Case-level analysis determines whether individual observations can be explained; aggregate analysis determines whether the complete dataset reveals a recurring pattern. Both are required.
4.2. Safety and Causal Identification Are Parallel Processes
Engineering hazard assessment and scientific causal investigation should therefore proceed in parallel. One asks, “What is producing the observation?” The other asks, “What potential hazard does the observation indicate while its cause remains uncertain?” In a legislated safety discipline, the second question cannot necessarily wait for the first to be answered.
The UAP decision tree in Section 3 demonstrates this distinction. Identification as a balloon, drone, civil aircraft, military aircraft, atmospheric or electrical phenomenon, or unresolved object changes the nature of the potential hazard but does not automatically eliminate it. Similarly, uncertainty regarding identity does not eliminate the safety question. Identification and hazard resolution are therefore separate engineering determinations.
This principle also explains why observational testimony cannot be categorically excluded from safety-critical investigations simply because witnesses are fallible. Where repeated independent reports indicate potentially dangerous conditions, those observations constitute safety data requiring evaluation. The appropriate response to uncertainty is investigation, comparison with independent evidence, and proportionate mitigation—not exclusion of the observation solely because its cause has not yet been established.
4.3. Broader Implications
The methodology examined in this paper is not limited to UAP. Multidisciplinary research involving controversial or poorly understood phenomena with credible public-safety implications may benefit from including engineers or other professionals trained within legislated safety disciplines. Their role is not to replace physics, astronomy, meteorology, psychology, biology, or other sciences, but to contribute complementary expertise in hazard identification, consequence assessment, model validation, treatment of uncertainty, and safety decision-making.
Non-legislated scientific disciplines may similarly choose to incorporate these safeguards voluntarily, particularly procedures requiring contradictory observations to be retained and investigated, assumptions to be explicitly identified, competing models to be compared against complete datasets, and credible safety observations to be evaluated before causal certainty has been achieved.
The central lesson of this paper is therefore twofold. First, engineering does not possess a superior scientific methodology; it has developed a different set of safeguards because it carries a different responsibility—the protection of public safety under conditions where complete certainty is often unavailable. Second, the historical record demonstrates that these safeguards were learned through repeated and sometimes catastrophic failures. Ignoring credible observational testimony that indicates a potential hazard is itself a known safety failure mode. Engineering literature, professional rules, standards, and applicable legislation preserve these lessons so that uncertainty, accepted models, institutional assumptions, or disbelief do not again override observations warning that people may be in danger.
Scientific investigation and engineering safety assessment should therefore complement rather than compete with one another. One seeks to determine what is true; the other must additionally determine how to protect people while the truth remains uncertain.
Engineering epistemology and the 28 historical events examined in this study demonstrate a simple principle: the opinion that anecdotal testimony doesn’t count, doesn’t count. Possible witness error is a hypothesis to be investigated, not a conclusion that can be presumed.
4.4. Conclusion
A central distinction emerging from this study is that witness testimony need not be capable of defining or validating a new scientific model in order to possess significant evidentiary value. Across scientific disciplines, observational testimony alone is generally insufficient to establish the physical mechanism responsible for an observation. However, the historical record of engineering and public-safety failures has demonstrated that credible observations can reveal when an accepted model no longer adequately represents physical reality. Engineering rules, standards, and safety methodologies therefore require contradictory observational evidence to be investigated rather than discarded merely because the observations cannot themselves provide the replacement model. In safety-critical applications, witness testimony may therefore be insufficient to establish what the correct model is, while still providing important evidence that the existing model is not correct or is being applied outside its valid domain.
This principle operates constructively with engineering epistemology, which requires selection of the model appropriate to the physical reality being evaluated. The UAP example demonstrates the importance of this distinction. Using the performance limitations of chemical rockets to dismiss observations of UAP is not a test of the observations; it is the application of one propulsion model to a phenomenon whose propulsion mechanism has not been established. Just as the performance limitations of a sailing vessel cannot be used to determine the possible performance of a jet aircraft, the limitations of chemical propulsion cannot establish the performance limits of an unknown propulsion system. If repeated observational, radar, photographic, video, or other evidence is inconsistent with the chemical-propulsion model, engineering epistemology requires reconsideration of the model being applied—not exclusion of the observations because they fail to conform to it.
Acknowledgements
Thank you to Ryan Graves, a former U.S. Navy F/A-18 pilot, and founder of Americans for Safe Aerospace (ASA), who is also an engineer following the legislated Duty to Notify the public of a serious public safety issue.