| Autopilot authority — Aeroflot 593: the half-disconnected autopilot | 108 | a state machine, a memory invariant, try / catch |
| Cabin pressurization — Helios 522: the manual-mode takeoff, unrepresentable | 106 | a state machine, a memory invariant, try / catch |
| Cargo door — Turkish Airlines 981: "indicated locked" is not LOCKED | 116 | a state machine, a memory invariant, try / catch |
| Docking approach — Progress / Mir 1997: abort means ABORT | 116 | a state machine, a memory invariant, try / catch |
| Engine fire bottle — one-shot suppression, fuel off FIRST | 117 | a state machine, a memory invariant, try / catch |
| Fuel crossfeed — Air Transat 236: never feed a leak from the good tank | 118 | a state machine, a memory invariant, try / catch |
| Landing gear — weight-on-wheels interlock, made unrepresentable | 99 | a state machine, a memory invariant, try / catch |
| Launch commit criteria — Challenger: no waiver path to ignition | 127 | a state machine, a memory invariant, try / catch |
| Cryo tank heater — Apollo 13: the thermostat that welded shut | 110 | a state machine, a memory invariant, try / catch |
| Parachute sequence — Genesis: the drogue that never fired | 105 | a state machine, a memory invariant, try / catch |
| Range safety — the flight termination system's three one-way doors | 114 | a state machine, a memory invariant, try / catch |
| Stage separation — the ascent sequence as a proven order | 90 | a state machine, a memory invariant, try / catch |
| Tcas resolution advisory — Überlingen: the opposite maneuver is no state | 121 | a state machine, a memory invariant, try / catch |
| Thrust reverser — Lauda Air 004: in-flight deployment, made structural | 100 | a state machine, a memory invariant, try / catch |
| Unreliable airspeed — AF447: the autopilot never flies on bad data | 105 | a state machine, a memory invariant, try / catch |