Federal investigators are examining the circumstances surrounding a fatal runway overrun involving an Amazon cargo aircraft at Miami International Airport, USA, that killed five people and injured five others.

The Boeing 767-300 cargo aircraft, operated by North Carolina-based carrier 21 Air for Amazon Air, was returning to Miami from San Juan, Puerto Rico, when it overran the runway on 6 September 2026. The aircraft continued around 1,300 feet (396 metres) beyond the paved surface, crossing airport grounds and striking vehicles before coming to rest near a roadway.

All five fatalities occurred among people travelling in a van carrying seven employees of an airline cleaning contractor and an SUV struck outside airport property, according to the National Transportation Safety Board (NTSB). Three people were critically injured and two others sustained less severe injuries.

Emergency responders encountered heavy flames and smoke following the crash. The pilot and co-pilot were trapped in the cockpit, while several people were trapped in vehicles struck by the aircraft and required extrication.

Investigators examine the landing

A central question for investigators is where the aircraft touched down and whether sufficient runway remained for it to stop safely.

Video footage appears to show the Boeing 767 remaining airborne for a considerable distance along the runway before touching down. Investigators are expected to examine the aircraft’s touchdown point, speed and braking performance, as well as the actions of the flight crew.

Weather conditions will also form part of the investigation. Although it was not raining at the time, strong winds were reported in the area. Aviation experts cited in the source reports noted that a tailwind could increase an aircraft’s groundspeed and contribute to it travelling farther along the runway before and after touchdown.

Air traffic control audio reviewed by CNN indicated that the pilots did not declare an emergency before landing, suggesting that any contributing problem may not have been apparent before the aircraft reached the runway.

Investigators are also examining the condition and maintenance history of the aircraft. The 32-year-old Boeing 767 was originally built as a passenger aircraft and operated for more than two decades before being converted for cargo operations in 2015.

Runway overrun protection under scrutiny

The accident has also drawn attention to the physical safeguards available beyond the runway.

Miami International Airport does not have an Engineered Material Arresting System (EMAS) at the end of the runway involved. EMAS uses beds of lightweight, crushable material designed to slow and stop an aircraft that overruns a runway.

According to the US Federal Aviation Administration (FAA), such systems have been installed at more than 120 US airports and have helped protect hundreds of people during runway overruns. However, Miami International Airport appears to meet existing requirements without EMAS because its runways have a 1,000-foot safety buffer.

The NTSB and FAA are investigating the accident, with investigators considering the flight crew’s actions, weather, airfield conditions, aircraft performance and mechanical condition. Information from the aircraft’s flight data recorder is expected to help establish its speed and other parameters during the landing and subsequent overrun.

The accident also caused significant disruption at one of the United States’ busiest airports. Two of Miami International’s four runways remained closed into Monday, while hundreds of flights were delayed or cancelled following the crash.

Systems Engineering Perspective

The Miami accident highlights the importance of viewing aviation safety as a system-level property rather than the responsibility of any single component or stakeholder. Safe landing depends on the interaction of the aircraft, flight crew, weather conditions, runway characteristics, air traffic operations, infrastructure and emergency response capabilities.

From a systems engineering perspective, the investigation demonstrates the value of analysing interfaces and interactions. Factors such as touchdown position, aircraft speed, wind conditions, braking performance and available stopping distance may each be acceptable or manageable individually, yet their interaction can produce a very different overall system outcome.

The discussion surrounding runway overrun protection also illustrates the role of defence in depth. Defense in depth can be understood as a system-level allocation of risk controls across multiple barriers. Operational procedures, aircraft systems, runway safety areas and technologies such as EMAS represent different layers intended to prevent an abnormal event from escalating into a catastrophic one. The presence of one safeguard does not eliminate the value of considering others, particularly where consequences extend beyond the aircraft to people, vehicles and infrastructure surrounding an airport.

Defense in depth can be regarded as one aspect within the practise of Loss-Driven Systems Engineering (LDSE). LDSE is an approach within systems engineering in which the focus of the engineering is primarily on seeking to understand and control the losses that the system of interest could cause, complementing and integrating with the usual focus on engineering to satisfy a substantially predetermined set of system requirements and goals, each of which, when satisfied, adds value.

The central idea is that a system is engineered to prevent unacceptable losses. A loss is an undesirable outcome such as death, injury, environmental damage, loss of mission capability, financial loss, damage to equipment, or loss of important information. The approach therefore starts by asking:

What must not be allowed to happen, and what system behaviour is necessary to prevent it? Behaviour embraces what the system must do to this end, together with what the system must not do, to the same end.

This gives LDSE a notably different starting point from conventional requirements based on value added, in which the process often begins with stakeholder needs and requirements that add value and proceeds towards design and implementation. LDSE usually gives rise to negatively expressed system requirements, the satisfaction of which avoids loss, and also proceeds towards design and implementation. Since we are engineering the one system, the two approaches must be integrated and be mutually supportive.

For system engineering practitioners, accidents such as this reinforce the importance of examining not only whether individual elements meet their requirements, but also how the complete system behaves when conditions deviate from the expected operating scenario. Effective safety engineering requires understanding dependencies, anticipating failure paths and designing multiple layers of protection so that a single adverse event is less likely to propagate into a wider system failure.