For more than a century, the Elevador da Glória was much more than a means of transport: it was an icon of Lisbon. Eleven decades of uninterrupted operation and millions of passengers transported safely, attest to absolute reliability. This narrative of excellence and normality was, however, tragically interrupted on September 3, 2025. The unthinkable happened.
In light of the accident that shocked the country, a question arises that demands an urgent answer: how was such a catastrophe possible? The excellent preliminary report from the GPIAAF (Office of Prevention and Investigation of Aircraft Accidents and Railway Accidents) provides a chronology of the immediate causes of the accident, pointing to a faulty cable and brake failure.
However, this is the proximate cause, not the root of the problem. The real explanation is deeper. It constituted a systemic collapse of imagination, governance and security culture, leaving a deeper question unanswered: how did a system, in operation for more than a century, become so dangerously vulnerable, without Carris’ main decision-makers anticipating or acting in the face of the risk that tragically came to fruition?
To understand the true roots of the accident, we will turn to Nassim Nicholas Taleb’s Black Swan Theory. This concept describes rare, impactful events
extreme and unpredictable a prioribut which, once they occur, seem obvious in retrospect. The accident perfectly fits this definition, revealing how a long
period of success fueled a fatal complacency. Nassim Taleb was inspired by a simple change in a historical paradigm to create the metaphor for his innovative theory.
For millennia, the inhabitants of the Old World believed that all swans were white. Each sighting, over generations, confirmed this indisputable truth, until a discovery in Australia revealed the existence of black swans. A single observation was enough to collapse a reality built over millennia of empirical evidence. The Black Swan represents the unthinkable, until it manifests itself.
The Elevador da Glória accident was the Black Swan, for an organizational system that believed only in White Swan events. The preliminary investigation creates a narrative that makes the accident seem obvious and avoidable in retrospect. Analysis of the GPIAAF report, in light of Taleb’s ideas, exposes five critical flaws in thinking that led to the accident:
1. The Illusion of Past Success (Turkey Problem): Taleb uses the metaphor of the “Turkey Problem” to illustrate the fallacy of induction. A turkey is fed by a farmer
for 1000 days. Each day that passes reinforces his belief in the benevolence of the farmer. On the 1001st day, the eve of Christmas Day, the turkey has his belief catastrophically refuted. The 111 years of operation of the Elevador da Glória were the 1000 days of the turkey. The “absence of failures” was wrongly interpreted as “proof of safety”. This long history of success was not proof of safety; it was just the absence of flaws. This “epistemic arrogance” blinded decision-makers to the possibility of a catastrophic event, which Taleb calls the Peru Problem.
2. Tunnel Vision: Management focused exclusively on known and controllable risks (“White Swans”), neglecting unknown and systemic risks (“Black Swans”). Warnings about a catastrophic cable failure were likely ignored because they represented a scenario outside of past experience, implying immediate and certain costs to avoid a risk considered remote.
3. The illusion of Models (the Ludic Fallacy): Security was evaluated based on restricted models and predictable metrics, such as periodic cable replacement, treating the complex real world as a game with fixed rules. This ignored the uncertainty inherent in complex systems. It is this illusion of predictability, which Taleb calls the Ludic Fallacy. The cascading failure of emergency systems and the discovery of painted (inoperative) brake pawls are symptoms of a “normalization of deviance”, where informal practices silently replace safety standards.
4. The Problem of Silent Evidence: The catastrophe was the culmination of a process of degradation, preceded by ignored signs. The absence of accidents for 111 years was, paradoxically, the most dangerous silent evidence, reinforcing complacency. The report notes that an identical, non-conforming cable was in operation for 601 days before the accident, without any incident. This apparent “success” was, paradoxically, one of the most powerful pieces of evidence reinforcing the complacency of decision makers. For them, the absence of failures implicitly validated the safety of the new cable, obscuring the real risks, such as fatigue and torsional stresses that accumulated invisibly within the system; the cable ended up breaking inside the swivel, a component inaccessible to visual inspection without complex disassembly. The absence of visible signs (the so-called “lack of negative evidence”) has been mistakenly interpreted as positive evidence of safety. A 2023 inspection report noted only “minor and acceptable corrosion.”
5. Systemic Fragility and lack of Antifragility: The Elevador da Glória accident revealed a profound structural fragility, worsened by the inaction in modernizing safety measures. The elevator design, a relic from 1914, was structurally inadequate for contemporary reality. Designed for short and infrequent trips, it began to transport thousands of tourists, making around 160 daily trips, an operational load that introduced fatigue/torsion stress cycles, far beyond the original design parameters. The cabins, with wooden structures, are beautiful anachronisms from an era before the design of impact-resistant structures (they did not possess what are currently known as impact-resistant properties). crashwortinessas in modern automobiles), offering virtually no protection in the event of a collision. This is a second-order weakness: not only did the primary safety barrier (the cable) fail, but the secondary barrier (the vehicle structure) was not designed to absorb the impact energy, converting a potentially controllable incident into a disaster. The initial impact of cabin 1 on the left sidewalk wall resulted in the destruction of the wooden box. A head-on collision followed with a public lighting pole and a support pole for the elevator’s electrical network, both made of cast iron, causing very significant damage to the structure, causing casualties and serious injuries, due to the total lack of structural resistance to the impact of the cabin.
The structure did not guarantee vital survival space in the event of a collision/rollover. The decision-makers failed to adapt the system to its new tourist vocation, failing to promote the modernization of the elevator’s passive safety, despite the significant increase in occupant exposure, making the system fragile. This scenario illustrates Taleb’s criticism of “naive interventionism”, superficial changes in operations that ignore structural vulnerabilities. Technical failures were compounded by human and governance failures. The accident also revealed agency problems: responsibility was so dispersed that, in practice, no one felt truly responsible.
On the other hand, regulators remained inert, paralyzed by an unusual legal void. The elevator’s classification as a “traditional cable-powered electric car” excluded it from the strict oversight applied to railway or cable car systems. Using Taleb’s terminology, no one coins “skin in the game” (skin in the game). The absence of effective accountability allowed unsafe practices to become institutionalized, while the real risks remained ignored.
So what to do? The fundamental lesson is not to try to predict the next Black Swan, but to build resilient and antifragile systems. For historic infrastructures like the
Elevador da Glória, this involves identifying and removing known weaknesses, as described in the text and which the final report will reinforce. But these technical changes will not be enough.
The Elevador da Glória accident teaches us that operational procedures, in themselves, are a fragile defense against the unknown. True security arises from a culture of constant vigilance, a kind of collective “permanent intelligent alert”, which questions stability, even in the most routine operations. It is this culture that transforms written rules into active and disciplined surveillance (mindfulness).
For Carris and all organizations that manage complex systems, this means fostering an environment where each employee, from administration to maintenance, feels responsible and safe to raise questions. It’s the difference between an organization that blindly follows a security manual and one that rewrites it every day, based on constant, attentive listening and constant adaptation to the subtle signs of the next crisis. In a world where the next Black Swan is not a matter of “if” but “when,” transitioning from a culture of complacent compliance to one of dynamic resilience and constructive doubt is not just good practice, it is the only real defense for organizations dealing with the unknown.
Ultimately, the Elevador da Glória accident reveals that Carris’ decision-makers failed, not through deliberate negligence, but because they were trapped in an organizational culture that confused past success with future safety. Looking for scapegoats is a simplistic response to a systemic failure.
The true tribute to the victims lies in a collective commitment, rooted in humility and oriented towards transformation, which avoids new tragedies, abandoning a culture of mere conformity and adopting a culture of discipline, resilience and mindfulness (mindfulness), where doing what is right becomes an instinct, even when no one is watching.
This is how you honor the past. This is how you protect the future.