Breaking Safe: Delta Flight 4819

“No Watson, this was not done by accident, but by design.”  — Sherlock Holmes

On Monday, February 17, 2025, after being cleared for landing at the Toronto Pearson International Airport, Delta Flight 4819, a Bombardier CRJ-900, crashed. Buffeted by wind gusts up to 37 mph, the plane hit the runway hard, lost its right wing, and flipped onto its roof.

There were eighty people aboard: 76 passengers and four crew members. Everyone escaped from the aircraft as it burned — it caught fire after touching down — despite it being upside down. Twenty-one people were injured, but no one died, either at the crash site or later in the hospital.

As of March 13, 2025, three of the passengers had decided to sue Delta Airlines and its subsidiary, Endeavor Air. Their lawyers claimed negligence, as plaintiffs’ lawyers feel they must. Much has been made of the right wing’s “failure”. Guilt, or liability in the case of civil suits, is a matter for the courts to decide. For anyone concerned with safety and saving lives, however, there are technical issues in this case that may offer guidance, especially in regard to so-called failures.

The Right Wing “Failed”

In one early report, an expert explained, “You see, the right wing fails, but the airplane is still going quite fast, and that left wing is generating a tremendous amount of lift. So, that immediately causes the airplane to roll inverted. That’s quite clear.”

In truth, it’s probably too early for anything to be “quite clear.” We do know that when the plane slammed into the ground in the gusty winds, it came apart and then caught fire as it slid down the runway.

The CJ-900 Came Apart

When the CJ-900 crashed, it came apart. The vertical stabilizer, what most of us think of as the tail, detached as designed, “so the airplane can lie flat to ease evacuation.” More importantly, the right wing detached as designed, “separating fuel tanks from passengers to reduce fire risk.”  These were not failures, but design features.

Both of these features are important. The role of the flight attendants cannot be understated, but it was vitally important that the plane was resting on its roof when they assisted passengers in evacuating. The ease of evacuation saved lives. And while the plane was burning as it skidded down the runway, injuries were consistent with flipping the plane—head lacerations and back sprains—and nausea from aviation fuel fume inhalation.

Not smoke inhalation—which is often the cause of death in a fire.

Fires After Crashing During Takeoff or Landing

The chemical industry has long recognized that the most hazardous time to operate a facility is during startup and shutdown. For aircraft, this is equivalent to takeoff and landing. Wikipedia, as part of its lists project, has created a list of accidents and incidents involving commercial aircraft, Since 1962, there have been 27 incidents where a plane caught fire after crashing during takeoff or landing. Before 2013, two-thirds of these fiery crashes were fatal. Since then, only one of the six fiery crashes resulted in the death of someone on board.

We can thank improved designs for that dramatic reduction in fatal fires on takeoff or landing. When planes crash, they break. Modern designs choose where they break, so they break safely.

Breaking Safe

It is not just separating the fuel from the passengers that made for a safer crash at Toronto International. The vertical stabilizer also came off. On June 7, 1989, Surinam Airways Flight 764, flipped while landing in a heavy fog. Of the 187 people on board — passengers and crew — 176 died. Being able to evacuate from a flipped plane is essential to safety, as the people aboard Delta Flight 4819 discovered.

The idea of designing equipment to break safe is not novel to aircraft. Cars are designed with crumple zones to protect drivers and passengers in the event of a crash. Patented by Béla Barényi in 1937, Mercedes-Benz first incorporated the concept in 1953. Since then, the concept has also been incorporated into trains and railcars. The crumple zone doesn’t prevent the crash, but it picks the place where the car or train breaks, so that it is not where people are.

Transportation is not the only industry where equipment is designed to break as a protective measure. Thomas Edison patented the first electrical fuse in 1890. The concept of using low melting wire to protect against electrical overload is still in wide use in electrical equipment to this very day. A fuse doesn’t prevent the electrical overload; it defines where in the circuit the electrical overload breaks something.

Before Edison and Barényi, Sir Humphry Davy invented sacrificial anodes to prevent corrosion in ships in 1824. This concept, called cathodic protection, relies on zinc, aluminum, or magnesium to oxidize, protecting steel from corrosion. Cathodic protection is still in use, not just to protect marine vessels, but to protect steel structures.

Also in construction, especially in this time of heightened terrorist threat, designers have begun to turn to sacrificial cladding for blast protection of structures. The cladding uses a core between two layers that mashes during a near-field explosion. This way, it absorbs the explosive force and protects the underlying structure.

Breaking Safe in the CPI

The chemical process industries also rely on breaking safe. Early in my career, a wise process safety engineer explained to me that when a piece of process equipment experiences pressure that is too high, the pressure is going to relieve, whether there is protection or not. The point of pressure relief is not to prevent the high pressure, but to pick the place where it relieves.

Johann Rudolf Glauber, alchemist and considered by some as the first chemical engineer, invented the first pressure relief valve in the early 17^th century to protect chemical equipment. Since then, there have been hundreds of improvements on the pressure relief valve.

Rupture disks came much later. “The first use of rupture discs occurred sometime in the mid-1930’s. The oil field industry used a flat piece of metal, typically lead, between flanges in a pipeline to prevent piping and vessels from exploding.”

Instead of Reinforcing

In the aftermath of an incident, especially in a disaster, we are often tempted to turn to reinforcement to protect us in the future. Sometimes that is a good approach, but we should never lose sight of the fact that reinforcements in one place simply push the failure to another place in the process, like squeezing a balloon.

Instead of reinforcing processes, consider a weak spot and designing it so that is where the process breaks in a catastrophe. That way, we’ve picked the breaking point, causing the least harm. As the passenger and crew aboard Delta Flight 4819 can attest, breaking safe saves lives.