Introduction
Thank you and good evening.   I owe this invitation to the combination of  14 years interest in the Titanic,  and a life-long interest in puzzling over why so many decisions about public safety are made so irrationally.  In 1995, I read the wonderful book "The Night Lives On", by celebrated Titanic historian Walter Lord.  His description of the long history behind the Titanic design made me realize that the way we blind ourselves to honest assessment of risk goes back a long way.  I wrote an essay on risk management philosophy in general, giving Titanic as the specific example, and put it on the Web.  After the movie came out in 1997, I began to receive thousands of hits and a lot of very kind notice...and here I am.
  1. Ice drawing

  2. First, lets review Titanic's own case, for both of you who have not seen the movie.  Titanic brushed the iceberg with her starboard bow so that it ground against the hull plates.  She was not gashed open, but the pressure on the plates buckled them and popped rivets, opening the hull to a myriad of small leaks at the seams.  The total area opened was only some 12 square feet - but, crucially, it was continued over 250 feet of the hull.
     
  3. Flood drawing

  4. 12 square feet meant more flooding than the pumps could handle - a ton every five seconds.  It was spread over the first five watertight compartments, plus leakage into the sixth up from the floor plates.  Had it only been the first four compartments, they would have filled up to the waterline and it would have stopped there.
     
  5. Whole ship drawing

  6. After the first two, the bulkheads only went up to "E" deck (highlighted by the dark line), a just 10' above the  waterline.  Filling even the first five compartments meant that the bow would be depressed enough for the fifth bulkhead to go below the waterline, spilling water into the sixth compartment, then the seventh, and so on.  Like many engineering disasters, their failure was not of calculation, but of imagination - they just didn't imagine this failure mode.

    The red lines show how much higher these bulkheads were taken in the sister ships, Olympic and Britannic - after the disaster.  It wasn't so much the cost of building them that was a problem - it was that they made movement about the ship more difficult for passengers and serving stewards alike.
     

  7. Period Cutaway Illustration

  8. This period illustration shows the water level rising over the watertight bulkheads and spilling backwards, as people flee towards higher decks.
     
  9. Turbines & Generators Photograph

  10. All 32 of the engineering staff, however, remained at their posts in lower decks.  Right down to the young apprentices with titles like "Assistant Sixth Engineer", and "Extra Assistant Fourth Engineer - Refrigeration", they kept the lights and pumps running until the ship actually broke in half.  Not one survived, not one body was recovered.  Neither did any of the nine-man "guarantee team" of engineers and tradesmen provided by the Harland & Wolff shipyards to assist with the shakedown. All four of the 400kW generating engines shown here were in a special watertight compartment at the rear of the engine room. The engineers locked themselves into it to preserve the seal.  But unlike the 8-man band, these 41 engineering staff were seldom immortalized as heroes in newspapers or movies.
     
  11. Sepia Thomas Andrews Photograph

  12. The head of the guarantee team was the Managing Director of Harland & Wolff, Thomas Andrews. Andrews had lived shipbuilding since he was 16.  A completely dedicated engineer, he often arrived at the yard at 4 AM.  He didn't read novels or even newspapers, just books about mathematics and his profession.
     
  13. Harland & Wolff Yard Photograph

  14. He was something of a hero to the 17,000 Irish workmen of the shipyard despite his upper-class credentials as the nephew of Lord Pirrie, owner of Harland & Wolff. Workers told stories of him back in his twenties saving men from falls, dodging hot rivets and laughing about it, and taking dangerous construction jobs rather than let a married man do them. But he was 39 with a wife and two-year-old daughter when he boarded the Titanic.
     
  15. H&W Design Department

  16. Andrews was promoted from running Harland & Wolff's Design Department, shown here, with the engineers and draftsmen working at huge drafting tables under the skylights in its beautiful barrel ceiling.  He is described as Titanic's builder, and the term is no exaggeration.
     
  17. Interior Design Drawing

  18. He had personally done the overall design, not only for her structure and mechanicals, but even much the interior decor and furnishings; and then went on to manage the whole yard as she was built.  Titanic was his creation more than anyone else's.
     
  19. Great Eastern at Launch

  20. Now let's flash backwards 54 years.  The "Great Eastern" was the last creation of Isambard Kingdom Brunel, England's most celebrated engineer.  The Great Eastern is shown here during her arduous launching from her birthplace by the Thames, there being no drydock in 1858 that could have held her.  At 700 feet long and over 25,000 tons, her length and displacement were not exceeded for almost 50 years.  At the time, she was six times the size of the next biggest ship that had ever been built.
     
  21. The Great Eastern; showing paddle-wheels & winch

  22. This view shows her enormous paddle-wheels - she also had screw propulsion from different engines, and sails, making her immune to immobilization from mechanical failure.  In the foreground is the huge chain-link winch being used to launch her broadside into the Thames.
     
  23. Brunel in front of the chain links

  24. And this is Isambard Kingdom Brunel, posing in front of the 60-pound links of the winch.  He was a hero, not just to one company, but a whole nation. All England resounded with his praises.  Shipbuilding was only one engineering art he advanced with three successive record-breaking liners.  He would have been wealthy and famous for his other accomplishments - tunnels, railroads...
     
  25. Bristol Railroad Station

  26. ...and the some of the most beloved of England's railroad stations, like this one in Bristol.
     
  27. Royal Albert Bridge

  28. And also, of course, the large suspension bridges that the new iron technologies had made practical.  Some still survive, like the Royal Albert Bridge shown here under construction. He was, in a way, a star.
     
  29. The Economist

  30. The photograph of him in front of the Great Eastern appeared again in "The Economist" magazine in May 1998: "Engineering: In Need of Heroes"  - It asks, "Why in this century, are the architects still celebrities and engineers anonymous?"
     
  31. Currier and Ives Lithograph of the Great Eastern

  32. When he designed the Great Eastern, the investors trusted him almost absolutely.  He got nearly every feature he desired.  She was considered the wonder of the age, and thousands of these Currier & Ives lithographs were sold before she was even launched.
     
  33. Great Eastern sections and model

  34. Brunel was obsessive in designing her for safety.  The Great Eastern, like the Titanic, had fifteen transverse bulkheads.  Hers, however, went a full 30' above the water line, right to the top deck in the fore and aft.  In the engine rooms, they were lower, but the engines were further protected by longitudinal bulkheads on either side.  The middle-deck was also watertight, further subdividing the compartments into some 50 in all.  And to even get this far, a breach had to first go through a double hull - the second hull two feet inside the outer.  Engineers of such safety-crucial projects as nuclear plants have borrowed a term from military strategists: "defense in depth".  Redundancy and backup for critical systems. This was defense in depth against flooding.
     
  35. Cofferdam section from 1917 Scientific American

  36. In late August of 1862, the design was put to the test in Flushing Bay, New York.  There was a grinding noise and a slight heel to port - but she made Flushing a few hours later without incident, listing a little to starboard.  The outer hull had been ripped open by rock spire still called Great Eastern Rock on the charts.  The breach was 83 feet long by 9 wide, perhaps 60 times the area of Titanic's damage - but the inner hull was unhurt and the inside was dry.  This diagram from a 1917 article in the Scientific American shows her being repaired using a carved wooden cofferdam clamped to her side with chains so that workmen could climb down this tube for each day for two months of repairs - and it was the two of the worst months of the Civil War at the time.

    With few exceptions, later liners cut these features.  The double hull was extremely expensive and ate up space; longitudinal bulkheads made it difficult for stokers to work, and, as mentioned, watertight decks and bulkheads made it difficult to get around the ship.
     

  37. Cunard Growth Graph

  38. The competitive pressures were intense, and cash flow was the life-blood that made the shipbuilding possible.  This chart shows the outlines of the ships that Cunard developed from 1840 to 1900 - a more than linear growth in length, so more than a cube growth in displacement.  The number of ships grew even faster; Cunard's sum displacement for the line went from 8000 tons to 136,000 during this period. And all the while speed was increasing.  The technological and cost curves were nearly exponential, like the computer industry today, as they went from wood to iron to steel, and paddle-wheels to single-screws to double.   And you had to advance and present the public with the latest, biggest product or lose all market share.   They were perpetually a few percent of their income away from red ink - because when they did make big profits they mostly had to be reinvested in new technology and faster development.
     
  39. Puck Magazine

  40. And the competition was not just between companies, but countries, which often subsidized their lines.  Cunard itself had a subsidy for carrying the mail.  In the 1890's, when Britain's Inman line went broke, she was purchased by Americans who cut a subsidy deal with Congress.  President Harrison himself raised the Stars & Stripes on one of  the two Inman flagships, the City of Paris.
     
  41. Puck Magazine Detail

  42. As this detail from the cover of the popular Puck magazine says, "it came high, but we had to have it"...it was a matter of national pride - and national strategy - to get America back in the Merchant Marine game with the hi-tech British.  Sometimes commerce, like war, is an extension of politics by other means.
     
  43. Paris & New York Illustration

  44. Another cartoon from the same period shows the American flag on both Inman's twin ships, the City of New York, and the City of Paris...
     
  45. Paris & New York Illustration Detail

  46. ... and also shows the British Lion and John Bull being thrown overboard.  As I said, it was a cutthroat business.   The international competition gave the shipbuilders the same cry to the government about regulations that is still heard today: that costly regulation would cause them to lose business to other countries, in this case Germans and the French.
     
  47. Disaster List

  48. Here's a ledger the accountants didn't keep.  I've listed only the major deaths on Atlantic lines, to capital ships, or we'd be here all night.  The question of safety of design was really the least of it - a lot of these ships were lost in  disasters like going onto rocks, that no design would have survived.  Speed was a major competitive advantage, and also a matter of great pride, so they often went at full speed in bad weather.  Everyone wanted to fly the coveted Blue Riband, signifying the current record-holder for the crossing.  You will note that the Cunard line is not mentioned here.  They are the good guys in this story: Samuel Cunard, (born in Halifax, Canada, in 1790) and all his successors were adamant that speed was important, but could be sacrificed to safety - it's all in the nuance of how you instruct your captains.  They were the classic Victorian British: stodgy, careful, conservative.  The line survives to this day, and has yet to lose a passenger to a wreck in peacetime.

    An American line run by Edward Knight Collins in the 1850's was the opposite.  They briefly seized half of Cunard's business by beating them with glamour and speed. They drove their ships near to breakdown, wasting fuel to cut half a day off the trip.  Newspapers lionized them and made fun of stodgy old Cunard.  In 1854, the Collins steamer Arctic had a collision running at full speed in the fog, and only 52 of 330 on board survived.  Among the dead were Collins' wife, son and daughter.

    Undeterred, he bought another wooden paddle steamer the next year.  In 1856, the Pacific was racing the new, faster Cunard Persia to Liverpool.  The Persia was the first iron mail steamer, with two longitudinal bulkheads and seven transverse. She limped in three days late with the bow stove in, having hit an iceberg.  The Collins Pacific, presumed to have done the same, was never seen again.  The newspapers turned against Collins, the line lost its mail subsidy from Congress, and was sold to creditors.

    Twenty years later, the White Star Atlantic had a disaster surprisingly similar to the more famous White Star Titanic forty years after that.  The inquiry said that they ran at full speed upon well-known rocks, at night, in fine weather. Over 500 lives were lost. I also snuck the loss of the White Star Republic onto the list by counting the four lives lost on the Italian ship, the Florida, which collided with her.  While all the passengers were saved, the point is that they were going at full speed in heavy fog, and could not avoid collision even though they heard each other's fog whistles.

    White Star was as good a line as almost any of them; all of them were culpable of such behaviour.  Even Cunard's unbroken record is acknowledged to be partly luck.
     

  49. Arizona photograph

  50. There were some ships where the design worked;  the Guion Line "Arizona" also hit an iceberg going 15 knots in heavy fog in 1879, and it telescoped 25 feet of her bow.  But she had 7 transverse bulkheads that went all the way to the top deck and the collision bulkhead held, letting them make Halifax.  It increased the public perception that iron liners were unsinkable, increasing industry traffic in general, and certainly the Arizona's ticket sales in particular.
     
  51. Servia illustration

  52. Cunard's Servia, in 1881, actually had a double-hull, the only other mention of such in a civilian ship I could find in the era.  There were also 12 transverse bulkheads, 8 of them all the way to the top. The Servia was also the first steel ship, which saved so much weight that the extra cost was well repaid in fuel saved.  I think the pattern here is that when engineers introduced a great new technology that saved money, or brought in business, they could get their way with design features for a while. Then all the lines would get the technology, and competition would bring the cuts again.
     
  53. City of Paris/New York

  54. Another example would be the aforementioned Inman line City of Paris and City of New York twins the Americans bought.  They were the first twin-screw ships, faster, bigger, more luxurious and very lucrative.  The twin screws allowed a single longitudinal bulkhead down the middle, between the engine rooms; and the transverse bulkheads went 18 feet above the water line, in contrast to Titanic's 10; this was just a decade before the Titanic.
     
  55. Lifeboat Advertisement

  56. Naval Architects argue about whether the extra bulkheads are really safer, but you can't argue about the lifeboats.  Lifeboats are the final layer of defense in depth. Without lifeboats, you really have all your eggs in one basket - the worst nightmare of risk management. The British Board of Trade Rules for supplying them were based on cubic feet of lifeboat space per ton of ship...not on the number of people aboard.  By these antiquated regulations, Titanic had more lifeboats than she needed.  But the Board's Advisory Committee was dominated by shipowners, who didn't want the expense and especially not the deck space used up.

    The Managing Director of Harland & Wolff before Andrews, while Titanic was still being designed, was Alexander Carlisle. He ordered these davits that could have held four boats each - but he suggested only faintly and timidly that even two boats per davit actually be supplied.  Bruce Ismay of White Star didn't take the hint, and Carlisle, not wanting to offend the biggest customer, didn't press it.   He did have a chance to alter the regulations themselves after he had retired in favour of Andrews and became part of the Board of Trade Advisory committee.   He argued for more boats behind closed doors, but ultimately signed the regulations under which Titanic sailed - regulations that actually provided further reductions.  Pressed on this point at the inquiry later on, he admitted "I was very soft the day I signed that."   He did not so much sign against all better judgement, as permit himself to be convinced it was better judgement.  This has similarities to a later disaster and I'll come back to it.
     

  57. Lifeboat Lowering Illustration showing almost dropped on another

  58. The lack of lifeboats was exacerbated by poor procedure.  There had been only one lifeboat drill, in dock, with one boat full of the ship's best seamen.  When the time came, there was confusion about how many they could hold and how to lower them.   This drawing shows one lifeboat almost lowered on top of another.   Three years later, this did happen.
     
  59. Lusitania painting showing lifeboats being dropped

  60. Unbelievably, Cunard had not learned from White Star's Titanic when the Cunard Lusitania was torpedoed in 1915 by a German U-boat.  I said they never lost a passenger in peacetime.  The passengers had asked the Captain twice to hold a lifeboat drill for all of them to practice. He refused, holding only a one-boat drill with his own crew.  When they had just 18 minutes to save themselves after the explosions...They had another mob scene trying to load boats, they dropped boats into the sea, they lowered boats onto other boats and crushed people.  In the end, they saved a total of 38% of the almost 2000 people aboard.  White Star had learned.  Three months later, the White Star Arabic was torpedoed only 50 miles from the same spot with 500 aboard.  Over 90% survived, though she sank in only nine minutes.  When seconds count, preparation makes all the difference.   Safe design of the procedure is as important as safe design of the artifact.
     
  61. Mersey Inquiry Extract

  62. Let's turn to the aftermath and the outrage that brought about change.  Even some very conservative and popular Titanic histories openly say that Lord Mersey's British Inquiry was a whitewash, blaming the disaster on unique conditions and exonerating all involved.  This exchange is notable in that a witness correctly says that an unsinkable ship is impossible.  But then they make a logical leap from that to actually laughing at the notion of a double hull, as if it were absurd to even strive for reduced sinkability.
     
  63. Olympic Refit Photograph

  64. Six months later, the idea suddenly wasn't so funny.  The sister ship Olympic was in drydock being fitted with an inner skin and bulkheads that went 20 feet higher.
     
  65. Olympic Double-Hull Detail

  66. The price was a quarter again of her original construction cost.   But competitive positions between lines suffered little, as everybody was suddenly spending on these previously unaffordable features. Other ships in construction in England and Germany went to double hulls and high bulkheads in mid-build.
     
  67. New York Herald, p. 5

  68. Where did the money come from?   It turned out to have been there all along, once the newspapers got to work on the industry.  Carpathia had barely returned with the survivors when the New York Herald was publishing quotes from Admirals and the Secretary of the Navy about greed being responsible for the disaster; and there was a drumbeat of a calls for reforms: lifeboats...
     
  69. New York Herald, p. 6

  70. ...ice patrols, safer southern routes, new wireless procedures.  And most of all, for ships to slow down, especially in fog.
     
  71. New York Globe

  72. But the Herald was one of the more restrained newspapers; the New York Globe broke out the war type.  No other disaster has ever so inflamed public opinion on safety standards issues.

    Any doubts I might have had about the importance of this were set to rest by the introduction to the chapter on watertight subdivision in the classic text "Principles of Naval Architecture", by James Robertson.  A committee of engineers had recommended new subdivision rules in 1891.  They were ignored until the loss of 300 lives on the Elbe in 1897 made a few companies comply. Robertson points out that it was only the Titanic that caused a convention on safety in 1913 where all nations put those rules into law.

    There was another safety of life at sea conference in 1929, But the U.S. only ratified it in 1936 after the loss of the Mohawk to collision, and the Morro Castle, to fire.  Robertson puts it bluntly when he says that a 1948 convention had only slightly stricter requirements because it "did not have behind it the compelling force of recent sea tragedies and aroused public opinion".    It took the shocking loss of the Andrea Doria in 1956 to force a 1960 convention that brought about design standards close to those used today.

    The week in 1995 I wrote the original essay, thousands of semi-trailers in Canada were being pulled off the road to have their outer wheels inspected.  Two cars full of people had been killed in two weeks by semi wheels that had come loose and run wild.  It turned out that such things had been happening every month or two all along; this was just the first time that several fatalities had happened.  As individuals, we may learn from close shaves and warnings; as a society, we only learn from blood.
     

  73. Oil Tanker Bookcover

  74. Thus ends the core of my tale, but Titanic has many correspondences with later history to tell us that the lesson had had to be taught again, over and over.  A web search on "double hull" not only told me about the Cunard Servia, but the Oil Pollution Act of 1990, which mandated double hulls for oil tankers...one year after the Exxon Valdez caused a hundred-fold increase in media and public attention.
     
  75. Report Excerpt

  76. The NRC's report summary on the web mentions that double hulls will increase oil transporation costs by 10%, which to a shipowner is appalling.  But shipping is only a tenth the cost of the oil, so that is increase by only1%.  Oil prices are only a part of the cost of gas: the Coast Guard computed the price of a tank would go up by a nickel.  Speaking of cars, let's remember  that Detroit at first fought Ralph Nader tooth and nail over the addition of $12 seatbelts in cars.  But after Volvo and Mercedes made safer designs a premium feature, and began showing slow-motion crash simulations in their advertising, Detroit began to change, and they now advertise expensive airbags in the same breath as the CD player.  People are happy to purchase safety, both in consumer items and in their taxes - but only if the issue is not hidden under the rug.  Show them the figures, tell them what they're paying to save how many lives, and you'll be astounded at how well the product sells.
     
  77. RINA slide

  78. But the touchiest thing in risk management is the calculation of cost per fatality averted.  It makes perfect sense to an engineer, but in public debate, such numbers can always be twisted in the media.  On the web I found an excellent site at rina.org.uk, the Royal Institution of Naval Architects. (Thomas Andrews joined it in 1901) They've sponsored many conferences, including one on ship survivability.
     
  79. Ship Survivability Article Summary

  80. Public attention had been drawn by recent car ferry disasters.  The problem for the engineer is to tackle these fears with his own art, which involves quantifying things. The summary of one paper in those conference proceedings went right to the heart of this issue - he had calculated the cost per fatality averted for various different approaches of ship subdivision, so as to recommend which design to use.  That's solid engineering thinking and I applaud him, but I predict a dim future for him if he tries to discuss that topic with higher management, let alone in public policy debates.

  81. Doonesbury Strip #1
    The monetary value of human life is an impossible topic for politicians, as Bob Dole found out the hard way from this Doonesbury strip on regulatory reform.  Engineers are indirectly forced to set the value because they must resolve the conflicting directives from above to preserve life at all costs while simultaneously holding costs and schedules under control.  But even they learn quickly never to discuss these matters above a certain level, and indeed not to calculate the figure on specific designs.

  82. Doonesbury Strip #2

  83. A distinguished and now retired vibration engineer at the Shock & Vibration Symposium heard out my thesis and told me of doing some consulting for Marshall Space Flight Centre during the Mercury program.   At the crux of his presentation, he mentioned the dollar figure placed on the astronaut's life.  His contract managers remonstrated with him that the astronaut's life was priceless and he must not set such a figure.   

  84. Doonesbury Strip #3
    He retorted that it was they that had set the figure, he had simply calcuated it from the choices their staff had made in the purchase of certain components and the selection of various test procedures.   He told me they went stone-faced until he finished, remained silent as he left, and he never had another contract from Marshall.

  85.  
  86. Submersible Launching from Boat

  87. Marshall, of course, was later involved in another disaster which has many times been called "the Titanic of our generation".  Just five months after the Titanic was found using U.S. Navy submersibles, they were back in the Atlantic finding more twisted fragments of metal.
     
  88. Challenger Wreckage hanging from wire

  89. These were also examined by the best of metallurgists, who eventually found evidence the booster rockets had been burned through from inside.  Challenger was technological wonder of another age, on a launch expressly planned to show how routine and safe space flight had become.   It, too, put shock waves through an industry and a nation.
     
  90. Rogers Commission

  91. It, too, was investigated by two separate commissions of inquiry, though this time neither was a whitewash.  On the contrary, even the less harsh of the two, the President's "Rogers Commission", put NASA and Morton Thiokol staff of all levels through quite a wringer, with the questions asked on television essentially convicting them on the spot.   Long before the results were handed in, the public mind was again decided on a tale of designs compromised by budget and schedule pressure, concerned engineers overruled by venal middle-management...
     
  92. Iced-up launch pad control panel

  93. ...and, once again, of ice warnings ignored.  To be sure, the facts established were correct.   NASA and Thiokol staff alike were concerned about the temperature from a day before, and a series of teleconferences established that many Thiokol engineers felt strongly that launch should be delayed to the afternoon. The story that remained on the public conciousness was that four Thiokol senior managers agreed that it was a management decision, removing the engineers from the loop - and that one who had supported the engineer's position was told to "put on his management hat", whereupon he voted with the rest.
     
  94. Cover of "Major Malfunction"

  95. This time, it was books and speaking tours that used the word "greed", rather than newspaper headlines.   The two commissions had provided these authors with ammunition that certainly looked damning enough.
     
  96. Thiokol FAX, full-shot

  97. After the Thiokol management decision, the most senior of them then sent the FAX approving the launch.  The much-reprinted document, with a vice-president's signature at the bottom, stuck in the public mind as proof that an engineering decision had been taken away by management.
     
  98. Thiokol FAX, close-up

  99. Less well understood was that this procedure was not an unusual step for the culture in which it occurred.  Joe Kilminster, who signed the FAX, was an engineer; but like all engineer/managers, he sometimes had the tough job of making the call when there was not consensus between a number of engineering subordinates.  And there had not, in fact been full consensus in the teleconference that it was unsafe to fly.  The engineers against it were vocal, but they were not everybody.  It was only after the same pro-and-con arguments had gone into repetition that the managers said "we're spinning our wheels, it's time for somebody to make a decision".
     
  100. Cover of "The Challenger Launch Decision"

  101. The internal culture of complex engineering groups was studied closely by a sociology professor, Diane Vaughn, in a book that came out fully ten years after the disaster. It was the culmination of a vastly more detailed study than the more lurid books.  She had been the author of books on organizational wrongdoing and began her research expecting, to find another case of it.  She had to abandon that line of inquiry when she found that by the standards of the culture investigated, no wrongdoing had ever occurred.
     
  102. Close-up of "Challenger Launch Decision" cover

  103. Instead, she found something much more complex, and in the end, a deeper problem that she made a part of the subtitle.  Deviance - and the normalization of deviance.  That is, not a breaking or even bending of rules, but the slow change of the rules themselves - a deviation from a previous standard turned into the new standard, a new zero point from which further deviance was possible.   From this book, I realized that the correspondences with the Titanic were not superficial, but deep and exact.  Indeed, I think that history not only illustrates the present, but that Professor Vaughn, with access to warehouses of documents about the Challenger, has been able to give me a picture of how the Titanic design happened with greater precision than was possible from material on the 19th century.
     
  104. Diagram of SRB joint

  105. Professor Vaughn not only had to do years of homework to understand the actual engineering problems, but years more studying the mountains of design team communications, understanding the internal culture.  She gradually developed a convincing case that a similar phenomenon had occurred repeatedly in system design and redesign as flights continued and more real-world data came in on the performance of every system.
     
  106. Vaughn's five steps

  107. She formulates the process as five steps:, shown here from her book: New information would come in that signalled danger.   Engineers would document the danger and express concern.  This evidence would be given close examination, but of course by a process that was aware that terrible schedule or money consequences would result from a negative decision.  However, unacceptable risks with life or mission cannot be just accepted; the positive decision would be that the risk itself was in fact tolerable.  What was a deviation at step one would, after further launches, become the new normal.   So the cycle could repeat - a few more percent of change each time.
     
  108. Problem summary

  109. Most of these cases are of course too technical to get into, but the one document about the infamous O-Rings themselves sticks out to me as remarkably similar to the difference between the Titanic and the Great Eastern.  This problem statement was written six months before the Challenger, about a launch on a cold day the previous January.  It relates that hot gases got right past the first O-ring and for the first time, began to erode the backup ring.  "Worst erosion yet", it relates.   And the resolution?   First, that this has happened before, and especially, that there was still over two-thirds of the secondary ring not eroded - the status column says, "Closed".   I try to imagine Isambard Kingdom Brunel closing out a problem report that says the outer hull of his double-hull leaking and the second hull one-third compromised.   Redundant systems are meant to be redundant, kept against surprises, not to be relied upon in expected use.  A remarkable amount of deviation had been normalized at this point.  A question that was controversial the night before the launch probably would have been an open-and-shut-case for the same engineers several years earlier.   However, I can see Alexander Carlisle signing this, and perhaps later reflecting, "I was very soft the day I signed that".
     
  110. Vaughn's Conclusion

  111. The single plainest statement in Vauhn's last chapter caught me because I originally wrote in my own essay that the shipping industry had "methodically blinded themselves" to certain risks.   The professor used the same word, and had amassed evidence how it happens, among close workgroups that are a kind of culture in their own right. Patterns emerge by which rules are changed rather then violated.   At all times, these people were both competent and moral.   There was no intent to do harm.   There were no lies told between Thiokol and NASA, between management levels, between NASA and the public trust.  It was far deeper than that.   They learned how to lie to themselves.
     
  112. Shuttle Program Structure

  113. The shuttle technology made the Titanic look like the bronze age, and the team structure was similarly more advanced. It did succeed in catching a thousand deadly problems and fixing them.  But even with four stages of flight review and a complicated system of checks and double-checks up and down the line...it still didn't make any difference.  The same kind of thing happened eventually.
     
  114. Seven hearses

  115. For the human heart had not changed, and the same desire to not ruin a project over a few percent of disputed safety factor.  The deviations did not stop, despite all the systems, until seven people died.  Wisdom is not conferred by engineering degrees; even NASA only learned it from blood.
     
  116. Thomas Andrews, B&W photo

  117. The builder of the Titanic, of course, was one of the victims whose blood nourishes the tree of wisdom from time to time.  He was seen, just minutes before the final plunge, not by a pair of star-crossed lovers, but by a steward who called at him to come jump for it.  Andrews ignored him, lost in thought.  The steward jumped, swam, and survived.  Andrews did not.
     
  118. Smoking Room, colour drawing

  119. His quick conclusion that the ship was doomed when nobody else would have believed it had given everyone a head start and undoubtedly saved many lives.  After spending the rest of the evening escorting women into lifeboats, he was last seen in the First Class Smoking Room, perhaps the most expensive per square foot in the ship.
     
  120. Smoking Room, photograph towards funnel

  121. It was designed to give the air of the most exclusive of London's gentlemen's clubs, with the richest of furniture, carpets, and artwork.
     
  122. Smoking room closeup

  123. Andrews had done much of the interior design, providing it with heavy mahogany panelling, carved in place, then inlaid with mother-of-pearl. There were leaded glass windows, stained glass artworks.  Money was not merely available for the Titanic; no expense had been spared, not where the customers could see it being spent.
     
  124. Smoking Room, photograph towards fireplace

  125. It was this choice of a place to die that makes me hope that he was lost in a comforting thought as he waited there.  The phenomenon of disaster bringing higher safety standards was clear even before his time.  Perhaps he realized that the loss of the Titanic, with all its millionaires and celebrities, would hit the world like a bombshell, changing standards overnight.

    With the Atlantic trade still expanding exponentially, these changes would almost certainly save hundreds or even thousands of lives from many smaller sinkings averted, losses that each by themselves would have been too small to bring about change.

    So I like to imagine that he was consoled by some idea of all the lives Titanic's death would save, when the sea made the last grand entrance of the evening into that lavish Georgian drawing room, to take away his unbearable shame.
     

  126. Newspaper for sale

  127. Thank you for you kind attention.
Copyright, Roy Brander, 2000.