He Put His Name on My NTSB Crash Investigation — Then Congress Asked for the Classified Fault-Tree Only I Could Read
He Named His NTSB Crash Report After Himself — Then Congress Asked for the Classified Fault-Tree
Diana Marsh was inside the Ashford tail section avionics bay for the ninth time in three weeks when she found connector 7B.
The connector was behind a buckled spar.
The spar had deformed inward on impact, closing off the standard access path to the connector by approximately 40 millimeters.
She had a titanium field probe — thin, collapsible, 200 millimeters at full extension.
She collapsed it to 140 millimeters.
She angled the tip past the spar.
The geometry of the access was not right for 140 millimeters at straight angle.
She tried 12 degrees off the normal axis.
The probe found the connector.
She applied 1.8 Newtons of lateral pressure to seat the reader head.
She heard the click.
The diagnostic read.
She held the position.
She said, without turning: “Soo-Jin. Log connector 7B, avionics bay, tail section. Diagnostic response: active signal on the auto-throttle data bus, 0.83 microseconds latency pre-impact.”
Soo-Jin Park was standing at the access panel with a field notebook.
She was 29 and had been with the NTSB for 18 months.
She had been assigned to the Ashford investigation for eight of those months.
She wrote.
She said: “The 0.83 microsecond latency — is that significant?”
Diana said: “The auto-throttle handshake to the terrain avoidance system should be 0.2 to 0.4 microseconds. At 0.83, the TAWS was receiving the throttle signal 400 milliseconds too late to execute the go-around. That means the automation was asking for altitude when the aircraft was already past the go-around threshold.”
Soo-Jin wrote.
She said: “Is that in the fault-tree?”
Diana said: “It’s node 218. Pull out the working paper.”
Soo-Jin opened the bound working paper on the portable desk she had set up on the hangar floor.
The working paper was 247 pages of printed fault-tree nodes at that point in the investigation.
She located node 218.
It said: TAWS-THROTTLE HANDSHAKE LATENCY — BRANCH CONDITION: IF LATENCY > 0.4ms THEN TAWS ALARM SUPPRESSED — BRANCH CONSEQUENCE: AUTOMATED GO-AROUND INHIBITED.
The branch condition had been a hypothesis at the time of writing.
It was now confirmed.
Diana withdrew the probe from the connector.
She held it.
The tip was bent at 12 degrees where it had angled past the spar.
She had not noticed the bend until after the diagnostic.
The titanium had taken the angle and held it.
She extended the probe to full length.
She looked at the bent tip.
She closed the probe.
She put it in her breast pocket.
She did not try to straighten it.
The probe had gone somewhere it was not supposed to fit.
It had come back with something.
She made a note in the case log.
She moved to the next connector.
—
The fault-tree had 340 nodes by the time the investigation closed, fourteen months after the Ashford cargo jet went down on approach to Louisville.
The cargo jet was a Boeing 767-300F.
It had been on an instrument approach in low-visibility conditions.
The automated systems had suppressed a go-around command because of the handshake latency Diana had found at connector 7B.
The latency was the result of a degraded connector in the auto-throttle bus — a gradual corrosion fault that had taken 14 months to trace to its origin.
She had traced it.
She had built the 340-node fault-tree from the evidence up.
The tree was a logical argument.
It had a root node, branch conditions at every decision point, and terminal nodes that described each outcome.
No one else on the investigation team had worked on the systems group.
No one else on the team could read the full tree.
Soo-Jin had been working on it with Diana for eight months.
She could read the first 180 nodes.
—
The Before was a Thursday, six months before the final report was published.
Donald Reardon, the investigation’s Group Chairman, had finished a press briefing.
He was the public face of the Ashford investigation.
He had conducted eleven press briefings over the fourteen months.
At each briefing, Diana’s fault-tree diagrams had been projected on the screen behind him.
He had explained the diagrams to the press.
He had done so accurately, using the language of her working papers.
He had a particular facility for taking complex logical arguments and explaining them in plain language.
He was good at it.
She had watched him do it eleven times.
On the Thursday, the reporter had asked about the “automation override gap.”
Diana had coined the phrase in her working paper on the node cluster from 190 to 220.
The override gap was the logical space between what the automation was designed to do and what it actually did when the handshake latency exceeded the threshold.
Donald had explained it.
He had used the phrase correctly.
He had described the branch conditions accurately.
He had described the consequence nodes accurately.
He had been in her office at 9 PM on the night she had developed the override gap concept.
She had been at node 196 when he had knocked on the door.
She had explained what she was building.
He had said: “That’s the thing. That’s what the investigation turns on.”
He had left.
He had explained it to the press the next week.
After the briefing on the Thursday, he had stopped by her office.
He had said: “Good work on that override section. Really helped me explain it.”
She had looked at him.
He had meant it as a compliment.
He had explained her work by reading her working paper.
He had not thought those were different activities.
She had said: “Thank you.”
She had gone back to node 221.
—
The final NTSB public report was 600 pages.
The PDF arrived in her email on a Monday morning.
She read the executive summary.
The executive summary described the “Reardon-Ashford Systems Analysis Methodology” as a new approach to investigating automated system failures in commercial aviation — one that began at the moment of mechanical failure and worked backward through the decision logic of the automation, branch by branch.
She read “branch by branch.”
She scrolled to footnote 34.
Footnote 34 said: “Systems working paper contributed by specialist staff: see Appendix D.”
She read “systems working paper contributed by specialist staff.”
She set the PDF down.
She picked up the titanium probe from her desk.
The bent tip caught the overhead light — the 12-degree angle from the Ashford avionics bay, the angle that had found connector 7B.
She put the probe back in its case.
She closed the lid.
She did not open the working paper.
She did not annotate the PDF.
She looked at the closed case.
She went back to work.
(Drop “DIANA” in the comments if you want to read what happened when Congress asked for the classified fault-tree.) 👇
The NTSB report release day was a Thursday.
A colleague stopped Diana in the corridor outside her office at 9:15 AM.
He was an air traffic systems investigator from the Chicago field office.
He was in Washington for an unrelated review.
He said: “Congratulations on the Ashford report. Big investigation.”
She said: “Thank you.”
He said: “Reardon did a great job pulling it together.”
She said: “Yes.”
She continued walking.
He continued to the elevator.
She went to her office.
She sat at her desk.
She had the probe case in front of her.
She had moved it from the corner of the desk to the center of the desk that morning when she came in.
She did not know why she had done that.
She had set it in the center.
She had opened her email.
She had found the report PDF.
She had read footnote 34.
She was at her desk now with the probe case in front of her.
She looked at it.
She had been in the Ashford wreckage for 14 months.
She had spent 3 weeks on the avionics bay alone.
She had driven 400 miles of round trips to the hangar.
She had written a 247-page working paper, then expanded it as the tree grew, until the final document was 340 nodes and 518 pages.
She had delivered the final working paper to Donald two weeks before the report was submitted.
He had read it.
He had said: “This is the whole case. Everything we’ve been building toward.”
He had said “we.”
He had said it the way he always said it.
She had said: “The logical architecture is complete.”
He had said: “It’s the methodology. Fourteen months of methodology.”
He had said “methodology” and meant it as praise.
He had not meant to claim anything.
He had genuinely believed, standing in her office, that the methodology was the thing they had built together — him through synthesis and public communication, her through the nodes.
He had not understood that the nodes were the synthesis.
She had looked at the working paper on her desk.
She had said nothing.
—
The Senate Commerce Committee memo arrived in the NTSB front office on a Tuesday in February.
Soo-Jin brought it to Diana’s desk at 10:45 AM.
She set it on the desk.
She said: “It’s from the Senate staff director. Lawrence Vance. They want the fault-tree for a classified congressional exhibit.”
Diana read the memo.
The memo requested the Ashford fault-tree and Go/No-Go Criteria decision schema as a classified exhibit for the Senate oversight hearing on aviation automation safety.
The memo specified: classified transmittal required via NTSB classification terminal, certified by originating investigator’s digital badge certificate.
She read “originating investigator’s digital badge certificate.”
She knew the classification structure.
The NTSB classification terminal required the badge of the investigator who had originally classified the document when they locked the working paper for agency submission.
She had locked the Ashford fault-tree working paper at 10:47 PM on a Tuesday in month eleven of the investigation.
She had been alone in the office.
She had inserted her badge.
The terminal had read: DM-4471.
The document was classified under her badge.
Donald’s badge was a Group Chairman credential.
It had administrative access to classified documents.
It did not have originating investigator certification authority.
He could read the fault-tree.
He could not certify and transmit it.
She set the memo on her desk.
She looked at the classification timestamp field at the top of the memo’s exhibit list.
The timestamp said: D. MARSH, DM-4471, 22:47.
She did not go to Donald’s office.
She opened the fault-tree working paper on her terminal.
She looked at node 1.
Node 1 said: ASHFORD CARGO JET — APPROACH SEQUENCE — ROOT NODE: IF INSTRUMENT APPROACH CONDITIONS THEN EVALUATE AUTO-THROTTLE FUNCTION.
She had written node 1 on the second day of the investigation.
She had written it in 20 minutes.
She had then spent 14 months writing the 339 nodes that followed.
She looked at node 1.
She waited.
—
Donald read the Senate memo at 11:30 AM in his office.
He was not concerned.
He had transmitted classified NTSB documents to congressional committees twice in his career.
He went to the classification terminal in the secure document room.
He inserted his Group Chairman badge.
He selected the Ashford fault-tree working paper.
He clicked “Certify and Transmit.”
The terminal displayed: “Originating investigator certificate required. Group Chairman credential is insufficient for investigator-classified document transmission. Document classified under: DM-4471. Contact originating investigator.”
He read it.
He read it again.
He pressed the back button.
He looked up the NTSB internal regulation on classified document transmission.
The regulation said: “Classified working papers may only be transmitted to congressional committees by the originating investigator, defined as the investigator whose badge certificate appears in the classification timestamp of the document.”
He looked at the classification timestamp on the working paper’s header.
D. MARSH, DM-4471. TIMESTAMP: 22:47, MONTH 11.
He had been home at 10:47 PM in month eleven.
He had been home in the evenings of most months of the Ashford investigation.
He had been in the office during business hours.
He had attended meetings, press briefings, and coordination calls.
He had reviewed the working papers after Diana had written them.
He had reviewed them during business hours.
She had written them in the evenings and on weekends.
He had known her badge number was on the working paper.
He had known it the way he knew the exhibit numbers in the final report — as a data point in the administrative record, not as a fact with implications.
He was looking at the implications now.
He picked up his phone.
He walked to her office.
Donald appeared in the doorway of her office at 12:03 PM.
He was holding the Senate memo.
He was a man who had been in the NTSB for 28 years.
He had been a Group Chairman for 9 of them.
He had managed 14 major investigations.
He said: “The transmittal is locked to your badge certificate. I need you to classify and transmit the fault-tree to the Senate Commerce Committee.”
He said it flatly.
He had said it correctly: he needed her to do it.
He had not said: “Can you do it for me.”
He had not said: “I don’t understand why this is happening.”
He had walked to her office.
He had stated what he needed.
She opened the secure terminal on her desk.
She inserted her badge.
The terminal read: DM-4471.
She selected the Ashford fault-tree working paper.
She selected “Certify and Transmit.”
The terminal prompted: “Document classification confirmation required. You are certifying: Ashford Investigation Fault-Tree Analysis and Go/No-Go Criteria Decision Schema. Originating Investigator: D. Marsh, DM-4471. Classification timestamp: Month 11, Day 22, 22:47. Certify and transmit to: U.S. Senate Commerce Committee. Confirm: YES / NO.”
She confirmed.
The terminal processed.
The transmittal confirmation read: “Document transmitted. Certified by: D. Marsh, Investigator, DM-4471. Classification Authority: D. Marsh. Senate Commerce Committee exhibit registered.”
She printed the confirmation.
She filed it.
She looked at Donald.
He looked at the confirmation on the screen.
He said: “Thank you.”
He said it the same way he said everything — without visible emotional content.
He was a man who did not perform gratitude.
He left.
Soo-Jin was at the adjacent workstation.
She had been at the workstation since 10:45 AM.
She had been reviewing her section of the working paper — the first 180 nodes, which she had spent eight months learning under Diana’s instruction.
She had seen Donald walk to Diana’s office.
She had heard the door but not the conversation.
She had seen Donald walk out without the memo.
She wrote in her field notebook: “DM — originating investigator of record. Senate exhibit.”
She wrote it as a fact.
She did not write it as an observation.
She had understood, from eight months of working with Diana, that the fact was already true.
The Senate had simply made it visible.
—
Senate Staff Director Lawrence Vance sent the transmittal acknowledgment at 4:17 PM.
Subject: ASHFORD INVESTIGATION — CLASSIFIED EXHIBIT RECEIPT — DR. D. MARSH, DM-4471.
It was addressed to Diana.
The cc line included Donald.
It said: “Dr. Marsh — receipt confirmed. The fault-tree analysis and Go/No-Go Criteria decision schema have been entered into the Senate exhibit record as Exhibit 47. You are listed as the technical authority on both documents. Subcommittee staff will contact you directly for hearing preparation.”
She read “technical authority.”
She read “contact you directly.”
She filed the acknowledgment in the same drawer as the transmittal confirmation.
—
Donald stopped her in the corridor at 5:20 PM.
He said: “I should have listed the fault-tree authorship more clearly in the report.”
She said: “You will in the addendum.”
He said: “Yes. I’ve already drafted it. The records division is processing it now.”
She said: “Okay.”
He said: “The addendum will read: systems fault-tree analysis and Go/No-Go decision architecture, Diana Marsh, Investigator, Systems Group.”
She said: “Okay.”
He said: “I want to be direct. The Reardon-Ashford Methodology description in the executive summary was imprecise. The methodology was yours. My contribution was investigation management and public communication. I want the record to be accurate.”
She said: “Okay.”
He had said it.
He had said “the methodology was yours.”
He had said “imprecise.”
He had said “I want the record to be accurate.”
She said: “Okay.”
She went back to her desk.
Soo-Jin was still at the workstation.
Diana sat down.
She opened a new case file on the terminal.
She did not say anything about the corridor conversation.
She opened the new case file.
She looked at the aircraft registration.
She looked at the failure mode.
She wrote the first node.
Node 1 was always the same structure: the root condition, the first decision branch.
She had written it 14 times on 14 investigations.
She wrote it again.
She went back to work.
—
Before he walked to her office, Donald had spent twenty minutes at the terminal.
He had tried his badge twice.
He had looked up the NTSB regulation on classified transmittal.
He had read: “originating investigator.”
He had gone to the classification log for the Ashford fault-tree.
He had seen: D. MARSH, DM-4471. 22:47.
He had sat at the terminal for five minutes after reading that.
He had been in the NTSB for 28 years.
He had managed 14 investigations.
He had approved the Ashford final report.
He had approved the language in the executive summary that described the “Reardon-Ashford Systems Analysis Methodology.”
He had approved footnote 34 that called the fault-tree a “working paper contributed by specialist staff.”
He had looked at those words in the published report.
He had looked at the regulation.
He had looked at the classification timestamp.
He had understood, sitting at the terminal, the relationship between all three things.
The working paper was not contributed data.
The working paper was the argument.
The fault-tree was the methodology.
Not his synthesis of it.
Not his explanation of it to the press.
The 340 nodes were the methodology, built one at a time, over 14 months, from wreckage evidence, by one person, who had classified the document alone at 10:47 PM on a Tuesday.
He had been home.
He had been home on most Tuesdays.
He had known her badge number was on the document.
He had understood it as an administrative notation.
He had not understood it as a claim of authorship.
He understood it now.
He had stood up.
He had walked to her office.
He had not prepared what to say.
He had said: “The transmittal is locked to your badge certificate. I need you to classify and transmit the fault-tree to the Senate.”
He had said “I need you to” because that was accurate.
He had needed her to.
He had been in the NTSB for 28 years and he had needed a 43-year-old investigator to open a document he could not open because it was hers and had always been hers and he had approved a report that said otherwise.
He had stood in the doorway.
He had said what was necessary.
The Group Chairman nomination letter arrived on a Wednesday morning.
It was from NTSB Deputy Director Chen.
It said: “Donald Reardon has submitted a nomination recommending Diana Marsh for Group Chairman designation on the next major investigation.”
It described the nomination criteria.
It described the review process.
It said the designation, if approved, would be effective within 90 days.
She read it.
She set it in her inbox tray.
She would respond to it after the new site visit.
She had a site visit on Friday.
—
The new investigation was a corporate turboprop that had gone down in Georgia three weeks ago.
The failure mode was different from Ashford.
The Ashford investigation had been about automated system decision logic — the fault-tree had mapped what the automation chose to do and what it should have done.
The Georgia investigation was about a control surface feedback failure.
The logical architecture of the fault-tree would be different.
But the structure of the investigation was the same: start at the physical evidence, find the sequence of decisions the system had made, and map every branch.
She had been assigned to the Georgia investigation as the systems specialist.
Soo-Jin was assigned with her.
She was also in the field now.
They had driven to the wreckage hangar together that morning.
The hangar was outside Savannah.
The aircraft was a Pilatus PC-12.
It was smaller than the Boeing 767.
The avionics bay was more accessible — no buckled spars, no 40-millimeter access gap.
She had the titanium probe in her breast pocket.
She pulled it out.
She extended it to full length.
The tip was bent at 12 degrees.
The bend was from the Ashford avionics bay, eleven months ago, when the probe had angled past the spar to reach connector 7B.
She had not straightened it.
She had used it on four investigations since Ashford.
The 12-degree angle had been useful twice.
Aircraft fuselages deformed in characteristic ways under impact loading.
The angle that had found connector 7B in the Ashford tail section was a geometry that appeared, in different forms, in other access problems.
She had learned the angle.
She had used it.
She pressed the probe into the avionics bay access panel.
The panel was clear — no obstruction, full access.
She found the first connector.
Soo-Jin was behind her with the field notebook.
On the floor of the NTSB field office in Washington, in Diana’s desk drawer, the Senate exhibit acknowledgment and the transmittal confirmation were filed in the same folder.
The Senate hearing was in six weeks.
The subcommittee staff had already sent her the first set of preparation questions.
She had answered them the previous evening.
The questions had been addressed to Dr. Marsh, Technical Authority.
She had answered them in the same tone she used for every technical document: specific, logical, without excess.
The congressional hearing transcript would enter the public record.
Her name would be on it.
She was not thinking about the transcript.
She was at node 1.
She pressed the probe to the first connector.
The connector was intact.
She wrote that down.
She went to node 2.
The hangar smelled of burnt insulation and hydraulic fluid.
It was an ordinary smell for an extraordinary failure.
She had been doing this for 16 years.
She wrote node 2.
She found the connector.
She wrote: node 3.
The fault-tree was beginning.
She had been in this position 14 times.
She would be in this position again.
She pressed the probe to the next connector.
She found it.
She wrote Node 1.
—
The congressional hearing was on a Thursday in April.
The Senate Commerce Committee subcommittee on aviation safety.
Diana had prepared for three weeks.
She had reviewed the full 340-node fault-tree.
She had prepared a visual summary of the Go/No-Go Criteria decision schema for the committee’s non-technical members.
She had written a 12-page technical brief.
She had answered 34 preparation questions from the subcommittee staff.
Donald had also prepared.
He had written the opening remarks for the NTSB.
When the hearing opened, he had read the first two paragraphs of his prepared remarks.
He had then set the papers down.
He had said: “The fault-tree analysis I’ll be discussing today was designed and built by Senior Investigator Diana Marsh. I’ll be presenting her analysis. Questions on the technical architecture of the investigation should be directed to her.”
He had not been prompted.
He had not been asked.
He had put down the papers.
He had said it.
The committee chairman had nodded and noted it in the record.
Diana had been at the table beside Donald.
She had her printed fault-tree in front of her.
She had answered questions for four hours.
The committee members had asked about node 218, the TAWS handshake latency.
They had asked about the automation override gap.
They had asked about the Go/No-Go Criteria.
She had answered all of it.
She had answered it precisely and without excess.
At 4:30 PM, the committee chairman had said: “Dr. Marsh. This analysis is among the most rigorous systems documentation I’ve seen in 12 years on this committee.”
She had said: “Thank you.”
She had meant it.
The hearing transcript was entered into the congressional record at 5:15 PM.
The transcript listed, in the exhibit references: EXHIBIT 47 — ASHFORD INVESTIGATION FAULT-TREE ANALYSIS AND GO/NO-GO CRITERIA DECISION SCHEMA — TECHNICAL AUTHORITY: DIANA MARSH, INVESTIGATOR, DM-4471.
The hearing was a Thursday.
She drove back to Washington Thursday night.
She was at the NTSB office at 7:30 AM on Friday.
She had the Georgia case file open at 8:15 AM.
She had node 1 written.
She had node 2 to write.
She wrote it.
She went to node 3.
She had a fault-tree to build.
The printed copies of the original NTSB Ashford report were on Donald’s office wall.
Two of them.
Framed in black.
She had walked past his office yesterday on her way to the secure document room.
She had seen the frames through the glass panel beside the door.
She had not stopped.
The printed copies did not have the addendum.
The addendum was appended only to the digital version on the NTSB and FAA public databases.
The addendum had been live on the databases for three weeks.
She had read it the day it posted.
It said: “Addendum to Ashford Investigation Final Report, Section 4 — Systems Analysis: The fault-tree analysis of automated system decision logic and the Go/No-Go Criteria decision architecture in the Ashford investigation were designed, built, and completed by Diana Marsh, Investigator, Systems Group, NTSB. These materials constitute the methodological core of the investigation’s systems findings. The original attribution in footnote 34 was insufficient.”
The addendum used the word “insufficient.”
Donald had written it.
She had read “insufficient.”
She had not annotated the addendum.
She had closed the browser window.
She had opened the Georgia case file.
She was at the Georgia site now.
Soo-Jin was working the left side of the avionics bay.
She had a straight-tipped probe — factory-standard, new.
She had been using it since she joined the investigation.
She had not yet had a connector that required an angled approach.
Diana was working the right side.
She had the bent probe.
She had the 12-degree angle that knew where to go when the path was closed.
She collapsed the probe.
She pressed it into the access panel.
The spar here was intact.
She pressed straight.
She found the connector.
She held the probe steady.
She said: “Soo-Jin. Log right-side connector C-12. Diagnostic response: no signal on the control surface bus. Complete bus failure.”
Soo-Jin wrote.
She said: “That’s the root, isn’t it?”
Diana said: “That’s the root.”
She withdrew the probe.
She extended it to full length.
She held it in her hand.
The bent tip caught the hangar light.
She wrote it into the fault-tree.
She found the connector.
She wrote Node 1.
—
Soo-Jin worked the left side of the avionics bay for 90 minutes.
She found two connectors.
Both intact.
She logged them in the field notebook.
She said: “The control surface bus failure on the right side — if that’s the root, why didn’t the redundant bus take over?”
Diana said: “That’s node 2. What do you think the branch condition is?”
Soo-Jin said: “If the redundant bus didn’t activate, either it was also compromised, or the switch-over logic failed to trigger.”
Diana said: “Two branches. Write them both.”
Soo-Jin wrote.
She said: “How do you decide which branch to investigate first?”
Diana said: “Physical evidence. We look at the redundant bus connector before we look at the switch-over logic. The physical tells you which branch is live before you commit to the code analysis.”
Soo-Jin wrote.
She said: “You start with what you can touch.”
Diana said: “You start with what you can touch.”
She moved to the redundant bus connector.
She pressed the probe.
She found it.
She read the diagnostic.
She said: “Redundant bus: no signal. Compromised.”
She logged it.
She said: “Branch 1 confirmed. Node 3.”
Soo-Jin wrote: NODE 3 — REDUNDANT BUS COMPROMISED — CONFIRMED FROM PHYSICAL EVIDENCE.
She said: “So the aircraft had no backup.”
Diana said: “No backup.”
She wrote node 4.
She had been doing this for 16 years.
She had written node 1 on 14 investigations.
She had written hundreds of node 3s and node 4s and node 218s.
She had the titanium probe in her hand.
The tip was bent at 12 degrees from the Ashford tail section.
The 12-degree angle had found the connector today the same way it had found connector 7B eleven months ago.
She extended the probe.
She looked at the bent tip.
She did not think about straightening it.
She closed the probe.
She put it in her pocket.
She had the fault-tree to build.
She went to node 5.
