On March 27, 1977, two Boeing 747s collided on the runway in Tenerife, killing 583 people. The cause? An ambiguous radio transmission that was interpreted differently by the pilot and air traffic control.
Ambiguity Kills at Scale
On November 12, 2025, Cloudflare's global edge network went dark for 4 hours. The cause? An ambiguous configuration propagation state that was interpreted differently by control plane and data plane.
The KLM captain radioed: "We are now at takeoff."
Did that mean:
Air traffic control interpreted it as the latter. The captain meant the former. 583 people died.
The edge orchestrator received: "Config propagation complete."
Did that mean:
The control plane assumed all three. Only the first was true. The internet went dark.
After Tenerife, aviation made ambiguous communication impossible. Every phase of flight has exact, unambiguous phrases:
These aren't suggestions. They're requirements. Violating them is a safety violation.
Cloud providers publish "best practices" for safe config propagation. But they're optional. The control plane still accepts ambiguous states. The deployment pipeline still allows implicit assumptions.
When those assumptions break — and they always do — we get global cascading outages.
Tenerife taught us: In safety-critical systems, ambiguity kills.
Cloud providers in 2025: Still operating with ambiguous state machines, implicit contracts, and "usually works" assumptions.
Aviation fixed this in 1977. We're still debugging the same class of failure 48 years later.
The KLM captain radioed: 'We are now at takeoff.' Air traffic control interpreted it as waiting. The captain meant in progress. 583 people died.
The technology to make ambiguous states impossible exists. We choose not to use it.
Want to see how RCP solves this?
Email us at bparanj@zepho.com.