Known in Advance

1The question this report asks

On the evening of 27 January 1986, engineers at Morton Thiokol recommended against launching the Space Shuttle Challenger. They put it in writing. They were overruled in a management caucus that lasted about thirty minutes, and the following morning seven people died in front of a television audience that included schoolchildren watching a teacher go to space.

The conventional account of Challenger is a story about knowledge: about O-ring resilience at low temperature, about joint rotation, about blow-by observed on earlier flights. That account is accurate and it is also beside the point. The knowledge was present. It was in the room. It had been reduced to charts and faxed to Florida hours before the decision.

What was absent was a structure in which that knowledge could prevail.

This report began as an attempt to rank the worst engineering failures of the modern era. Ranking is a straightforward exercise and we have done it, with a published rubric that any reader may contest. But in scoring one hundred cases against a dimension we called avoidability, defined narrowly as the specific failure mode having been identified in writing before the event and the warning overruled, we found that the band was not selective. It captured two thirds of the list.

That result changed the subject of the report. If catastrophic failures were principally failures of knowledge, the remedy would be research. They are not. They are, overwhelmingly, failures to assemble knowledge that already existed and was distributed across people who never sat in the same room while there was still time to act.

We call this a convening failure, and it is the subject of what follows.

2Method and scoring

One hundred cases were selected from the period 1850 to the present, restricted to engineered, manufactured, constructed and institutional failures in which a decision chain can be traced. Natural disasters without a design component, acts of war, and deliberate mass violence were excluded. Fires attributable to arson were admitted only where the death toll was produced by building or egress deficiencies rather than by the ignition itself.

Each case was scored from 1 to 10 on five dimensions, weighted to a maximum of 100.

Avoidability carries the second heaviest weight by deliberate choice. A ranking driven by body count alone produces a mortality table. It does not produce a failure analysis. The interval between what an organization knew and what it did is the only variable in this dataset that anyone can act upon prospectively, and it is therefore the variable we weighted.

An observed property of the rubric

The instrument systematically understates catastrophes that occurred inside closed political systems. The 1975 Banqiao Dam cascade killed more people than any structural failure in recorded history and ranks fifty-seventh here, because it generated no litigation and remains largely unknown outside China. Bhopal, the worst industrial accident ever recorded, receives a middling financial score because the settlement was 470 million dollars distributed among more than half a million injured people.

We report this as a finding rather than correcting for it. The magnitude of a failure and the magnitude of its consequences to the organization responsible are only loosely correlated. What determines the second is the legal and political system in which the failure occurs, not the harm it caused. Any practitioner who assumes that consequence tracks severity will misjudge risk in most of the world.

3A taxonomy of three failures

Not every catastrophe is the same kind of catastrophe, and the distinction that matters for prevention is what happened to the knowledge. In the first circulation of this report we estimated the split. For this revision we classified all one hundred cases individually. The result is Figure 1, and each assignment is listed in the appendix.

Why the frontier class is nearly empty

One case in a hundred is a startling number, and it deserves scrutiny rather than celebration. Two forces produce it, and both are properties of the list rather than of the world.

First, construction. Our rubric weights avoidability at 2.5, so avoidable disasters outrank unavoidable ones of similar magnitude. A list built this way promotes convening failures by design. Second, selection. Notoriety is also scored, and disasters become famous in part because they are scandalous, which is to say avoidable. The genuinely novel failures of engineering history, the de Havilland Comet's square windows, the aeroelastic flutter of Tacoma Narrows, the software race conditions of Therac-25, killed fewer people, produced less litigation, and sit below this ranking's cut line, where we treat them separately.

The single frontier case inside the hundred is the Boeing 737 rudder reversal sequence of the early 1990s, in which a dual servo valve could jam under thermal shock and command the rudder opposite to the pilot's input. The mechanism defeated two full investigations before a third found it. The expert convened in advance would have been as wrong as everyone else, and would have said so with authority.

The distinction is not academic. It determines whether expertise is a remedy at all. In a convening failure, the people who understood the hazard were available, willing, and in some cases actively trying to be heard. Assembling them would have worked. In a concealment failure, the expertise had already been assembled, frequently by the organization itself and to a very high standard, and the finding was then buried. No external review convened by that organization would have surfaced it, because the organization's purpose in commissioning reviews was the opposite.

We state plainly that roughly a quarter of the cases in this study lay beyond the reach of the intervention we advocate. A method that claims to have prevented everything has explained nothing, and would deserve the scepticism it received.

4The convening failure, in ten patterns and twenty cases

Ten mechanisms recur across the seventy-six convening failures. Each is documented below by two cases, chosen for the clarity of their written record. Where a mechanism appears twice, decades apart, in unrelated industries, it is not an anecdote. It is a structure.

Sixty-seven of one hundred cases meet our strictest avoidability definition. Someone identified the specific mechanism, recorded it, and was overruled. Figure 2 shows how long nine of those warnings sat on the table.

Organizations treat a first occurrence as an outlier and a second as a pattern. The cost of that arithmetic is, on the evidence assembled here, the entire second event.

This is the most consistent quantitative relationship in the dataset. The economy achieved is almost always minute beside the loss that follows it. Table 3 sets out the best documented examples.

Table 3. Figures as reported in inquiry and litigation records; they are orders of magnitude, not audited accounts.

The most technically pure category in the study. A substitution is made for constructability, cost or schedule, it appears trivial on a drawing, and the analysis is never repeated against the new configuration.

In a substantial fraction of process and energy failures, the safety system that would have contained the release was out of service, bypassed, or unmaintained on the day. It is the most reliable diagnostic question in the dataset.

In every mass-casualty fire in this study the ignition source was mundane. The death toll was determined by the building.

This pattern does not appear in engineering reports. It appears in the inquiry that follows them.

The recurring defect is not that a component failed. It is that nothing else was watching when it did.

Diane Vaughan named this normalization of deviance in her study of Challenger. It recurs wherever an anomaly appears often enough to become a condition.

An interval set by analysis is lengthened by economics, or a repair is priced and postponed, and no one recalculates what the clock is doing in the meantime.

5Where convening does not help

Twenty-four of the hundred cases would not have been prevented by assembling experts, and it is important to say why.

Concealment failures

In twenty-three cases the expertise had already been assembled, frequently by the responsible organization, to a standard that would satisfy any external panel. The finding was then withheld.

The asbestos industry commissioned and received medical evidence of the disease in the 1930s. The tobacco industry commissioned its own research assessment in 1953 and received an accurate account of the problem. DuPont identified liver toxicity in workers exposed to C8 in 1961 and detected the compound in public drinking water in 1984. In each instance the convening occurred. The organization simply did not act on what its own experts had told it, and took steps to ensure the finding did not travel.

No review commissioned by such an organization would have surfaced the fact, because the organization's purpose in commissioning reviews was to control the record rather than to inform a decision. The remedies for concealment are legal and regulatory: disclosure obligations, discovery, whistleblower protection, criminal liability. They are not technical, and an institute that claimed otherwise would be overselling.

The frontier

Inside the ranked hundred, one case, the 737 rudder valve, was genuinely beyond the knowledge of its time. The canonical frontier failures of engineering history sit below the ranking line, and belong in any honest account of the subject: the Comet, which taught the industry metal fatigue by immersing a fuselage in a water tank and cycling it to destruction; Tacoma Narrows, which put aeroelastic flutter in every curriculum; Therac-25, which founded software safety; Three Mile Island, which rewrote the human-machine interface. In these cases the expert convened in advance would have shared the era's blindness.

This is worth stating for a specific professional reason. A discipline that cannot identify its own frontier is not offering expertise. It is offering confidence. The value of the boundary in this taxonomy is that it makes the claims inside it checkable.

Cases at the boundary

Sixteen cases resist clean assignment and are marked in the appendix. The Ford Pinto exhibits concealment behaviour, in that the cost of remedy was weighed against expected fatalities in an internal document, and convening deficiency, in that the decision was never exposed to independent review. Grenfell contains documented product-testing dishonesty alongside a straightforward absence of any fire engineering review of the changed facade. We have assigned such cases by dominant mechanism, and we would welcome argument about the assignments.

6What a convened review would consist of

The intervention described throughout this report is unglamorous, and its unglamorousness is the point. In every convening failure examined, the missing element was small, specific and available.

Across the seventy-six cases, the required review shares five properties.

• Independence with respect to schedule and cost. The reviewing party must not report to anyone who bears the consequence of delay. At Challenger and at Surfside the technical judgment was correct and was weighed against a budget by people who held the budget.
• Breadth sufficient to hold the whole load path. At the Hyatt, three organizations each held one third of the answer. The reviewer's function is not superior knowledge. It is possession of the entire question.
• A defined trigger. Reviews that depend on someone deciding to ask do not occur. The triggers evident in this dataset are specific: a change to a primary load path, a change to an external wall system, an in-service structural failure, an extension of a maintenance interval on a non-redundant component, a finding of active deterioration, a repeat anomaly on safety-critical equipment.
• Standing to stop the work. A recommendation that can be overruled by the party being reviewed is a document, not a control. The Thiokol engineers produced an excellent document.
• A presumption in the safe direction. The burden must fall on proceeding rather than on halting. The inversion of that burden is, on this evidence, the single most common proximate cause of catastrophic decisions.

None of this requires new science. In seventy-six of one hundred cases the analysis had already been performed by someone. What did not exist was a table at which that person sat, at the moment the decision was made, with the authority to be heard.

7Limits, and what changed in this revision

We state the following plainly, because this report will be read by people whose profession is to test claims.

• Hindsight bias is the standing objection to any analysis of this kind, and we do not consider ourselves exempt from it. Our defence is structural rather than rhetorical: the strongest claims are restricted to cases in which a dated document exists, written before the event, identifying the mechanism that caused it. Where we cannot cite such a document we have not made the claim.
• The avoidability scores remain generous. Sixty-seven of one hundred cases carry the maximum score. Twenty cases are now tied to named documents in the case studies above; the remaining eighty are pending the same verification, and any score of 10 that cannot be documented will drop to 8 in a subsequent revision. We expect that pass to alter the ranking, and we publish the current figures with that caveat attached rather than delaying.
• Death tolls in mass-exposure cases are epidemiological attributions rather than counts, and several are contested. Figures for tobacco, asbestos, lead, opioids and Vioxx should be read as ranges with named sources.
• Financial figures span 170 years and mix nominal with real values. They are indicative and are not audited.
• The classification is disputable by design. Sixteen boundary cases are marked, and the appendix presents every assignment so that disagreement can be specific.
• Several matters remain in active litigation. Where that is so we have confined ourselves to findings made by a court or admitted by a party.
• Selection is a judgment. One hundred cases from a population of many thousands reflects choices about significance, documentation and geographic coverage. The list is weighted toward jurisdictions that produce public inquiries, which is itself an artefact worth naming.

Changes from the first circulation

• All one hundred cases are now individually classified, and the classification is published in the appendix. The first circulation estimated the split; the estimate was wrong about the frontier class, which classification reduced from roughly ten cases to one. The reasons are analysed in section 3, and we note the correction here because a report about unexamined estimates should not contain one.
• Seven case studies were added, bringing each of the ten patterns to two documented cases.
• Figures 1 to 3 and Table 3 were added.
• A closing section, Older than the industry, places the ten patterns against their antecedents in scripture and literature, from Ezekiel's watchman to Shute's No Highway. It exists because the strongest available answer to the charge of hindsight is a text that predates the technology.
• The count of maximum avoidability scores was corrected from an earlier misstatement of forty-one to the true count of sixty-seven.

We would rather publish an argument that can be attacked than a claim that cannot be checked. Correspondence identifying errors of fact, disputed attributions or misclassified cases is welcome and will be reflected in subsequent revisions.

8Older than the industry

Every mechanism in section 4 was documented from the industrial era, and it would be easy to conclude that the convening failure is a disease of complex technology. It is not. The pattern is legible in the oldest texts we possess, and that matters for a specific evidentiary reason.

The standing objection to a study like this one is hindsight bias: the suspicion that the warnings look clear only because we are reading them backward from the wreckage. The texts below were written centuries, and in some cases millennia, before the technologies whose failures they anticipate. Whatever they capture, it is not hindsight about Bhopal. It is foresight about people.

The office of the watchman

The book of Ezekiel, written in exile in the sixth century BC, contains what may be the first formal allocation of duty for foreseen catastrophe. A watchman is posted on the wall. If he sees the sword coming and blows the trumpet, and the people ignore it, their blood is on their own heads. But if he sees the sword and stays silent, the people still die, and the watchman answers for them. The chapter is not a poem. It is a liability regime, and it turns on a single structural insight: seeing is not a talent, it is an office. Someone must be posted, and the duty attaches to the post.

Nearly every warner in this report was a volunteer. Boisjoly happened to be the engineer on the joint. Applegate happened to design the door. The Morabito report happened to land in front of a volunteer condominium board. Ezekiel's regime would call this the deeper failure: not that the trumpet went unheard, but that no wall in the system had a watchman assigned to it. Section 6 of this report is, in older language, a specification for the watchman's office.

Three reception failures

Greek and Roman literature returns obsessively to a problem this report would call warning reception, and it isolates three distinct failure modes with almost clinical precision.

Cassandra's curse is routinely misremembered as a curse of prophecy. It was a curse of credibility. Apollo left her sight intact and removed only the belief of her listeners, so the information always transmits and never lands. She is the pattern in its purest form: a channel with perfect signal and zero authority.

Laocoön, in the second book of the Aeneid, goes further, because Laocoön runs a test. Doubting the wooden horse, he throws a spear into its flank, and the hull returns a hollow groan. A physical examination, performed in public, returning an anomalous reading. Then serpents come out of the sea and kill him, and the crowd reads his death as proof that the gods disapproved of his doubt. The evidence was not missing. It was collected, witnessed, and then explained away by a theory that preserved the plan. At Macondo, a negative pressure test returned 1,400 psi where it should have read zero, and the rig invented the bladder effect to keep the abandonment on schedule. The bladder effect is the serpents.

And in the third scene Shakespeare gives Artemidorus, the warning achieves what pattern one of this report calls its strictest form: written down, naming the conspirators, physically placed in Caesar's hand in the street. Caesar sets it aside because petitions touching himself should be read last. The document was in the decision maker's grip, and the decision maker had a queueing policy.

Babel, read as an engineering report

Genesis 11 is usually told as a story about punished ambition, but read it as an incident report and something stranger appears. Nothing strikes the tower. No stone fails. The builders simply lose the ability to hold a shared understanding, and the work stops. The catastrophe is coordination itself.

That is the Hyatt Regency, mechanism for mechanism. The engineer of record held the load path, the fabricator held constructability, the reviewer held the code, and each spoke fluently in his own tongue. No one held the whole question, and the fatal change moved between them as a telephone call and a redrawn line. What Babel imposed from outside, the Hyatt achieved by contract structure.

The Jonah problem

The book of Jonah ends on a note that most retellings quietly drop: the prophecy works, and the prophet is furious. Nineveh hears the warning, repents, and is spared, and Jonah sits outside the city wishing he were dead, because a prophecy averted is indistinguishable from a prophecy that was wrong.

This is the commercial physics of prevention, and anyone in the convening business should stare at it until it stops being comfortable. The one full success in our study is Citicorp Center in 1978: a student's question, an engineer who reported his own error, and a skyscraper quietly welded through the nights of a hurricane season. The storm passed. There was no inquiry, no case law, no memorial, and for seventeen years no public record at all. Our list holds ninety-nine disasters and one near-miss, and that ratio is not the world's. It is the archive's.

An institute that convenes well should expect its best work to look, from the outside, like an uneventful Tuesday, and should say so to its clients before the engagement rather than after.

The modern rehearsals

By the industrial era, fiction had begun writing the incident reports in advance.

Ibsen's An Enemy of the People, 1882: a doctor obtains laboratory proof that the town's baths, its whole economy, are contaminated, and the town prices the remediation, finds the truth unaffordable, and votes him an enemy of the people at a public meeting. One hundred and thirty-two years later, Flint received a federal memorandum stating its water chemistry precisely, priced the treatment at roughly one hundred dollars a day, and dismissed the memorandum's author. Ibsen invented nothing but the names.

Melville gives the report its patron saint of the overruled recommendation. Starbuck, first mate of the Pequod, is competent, correct, and certain the voyage is madness, and in the chapter called The Musket he stands outside Ahab's cabin holding a loaded weapon, fully persuaded, and cannot act, because conviction without standing is not a control. He lowers the musket and returns to his watch. Every engineer who has written the memo, been overruled, and gone back to work has stood in that passageway.

The most uncanny rehearsal belongs to Nevil Shute, a working aeronautical engineer who had watched the state airship R101 fly before it was ready, under political pressure, into a hillside in 1930. In his 1948 novel No Highway, a disregarded researcher calculates that a new airliner's tailplane will fail from metal fatigue at roughly 1,440 flying hours, and is treated as a crank. Six years after publication, the de Havilland Comet began breaking up in flight from metal fatigue. Shute had not predicted the future. He had described the standing conditions, institutional, psychological, and structural, under which the future would keep happening.

And one story earns its place by being wrong in an instructive way. Tom Godwin's The Cold Equations, 1954, is celebrated as the purest frontier tragedy in science fiction: a stowaway must die because the ship carries no fuel margin, and physics cannot be argued with. Engineers have spent decades pointing out that the absent margin and the unlocked door were design decisions, which makes the story a frontier failure that dissolves, on inspection, into a convening failure. That is precisely what our classification did to this report's own frontier class, reducing it from an estimated ten cases to one.

The plumb line

In the book of Amos, the Lord stands beside a wall holding a plumb line, and announces that he is setting a plumb line among his people. Not an opinion about the wall. An instrument, set against it in public, that anyone can read and no one can argue with in general, only in specific.

That is what the rubric in section 2 is for. A ranking is an opinion; a published instrument is a plumb line. It converts every disagreement about this report from a dismissal into a measurement dispute, and measurement disputes are the kind the Institute exists to have.

The industry is new. The failure is not. What the modern era changed is the blast radius: the locked stairwell door scaled up into the cladding system, the unread letter into the unread pressure test. The oldest texts we possess already assume the warning will be written and the trumpet blown. What they are waiting for, and what section 6 specifies, is the office.

AAppendix: the hundred, classified

Every case, ranked by weighted score, with its class and the decision that was available at the time. Convening failures, the class this report argues was preventable by assembly, are set in bold. A † marks a boundary case assigned by dominant mechanism. A § links to the documented case study above. For the frontier case, the available decision is stated with the benefit of an investigation that took years, and is marked accordingly.