01Executive summary
Seven investigations between 1979 and 2010 that changed engineering practice across industries. In every one, the physical mechanism was known or knowable beforehand.
This part is written with care. These events killed people — 167 at Piper Alpha, seven on each Shuttle crew, eleven at Deepwater Horizon, two at Longford, and an uncertain number over time following Chernobyl. The purpose here is neither to assign blame nor to retell the events dramatically, but to set out what each formal investigation established and what changed in consequence. The consistent finding is that the decisive failures were in how organisations handled evidence, not in what engineers understood.
02The seven investigations
Three Mile Island, 1979
A relief valve stuck open after a transient. Control room indication showed the signal commanding the valve shut rather than its actual position, so operators believed it was closed. Reasoning from that, they interpreted rising pressuriser level as excess coolant and reduced injection, when in fact coolant was being lost. The core was partially damaged. Nobody was killed. The investigation established that the operators acted reasonably on the information presented, and that the information was wrong. Control room design, indication of actual rather than commanded state, alarm prioritisation and simulator training all changed as a result.
Challenger, 1986
A solid rocket booster field joint seal failed at low ambient temperature, permitting hot gas to escape. Erosion of these seals had been observed on many previous flights and was known to correlate with temperature. The Rogers Commission found that the physical cause was understood by engineers who had raised it, and that the launch decision proceeded despite an explicit objection. The concept of normalisation of deviance — anomalies recurring without consequence gradually becoming accepted as normal — entered general engineering use from this analysis.
Chernobyl, 1986
A reactor design with a positive void coefficient was operated at low power during a test, in a regime known to be unstable, with safety systems disabled to permit the test. A power excursion destroyed the core and dispersed radioactive material widely. The subsequent international analysis introduced safety culture as a formal concept, and reinforced two design principles this series has already noted: reactivity feedback should oppose excursions inherently, and a shutdown mechanism must not have a phase in which it briefly makes things worse.
Piper Alpha, 1988
A pump was returned to service with a pressure safety valve removed for maintenance, the relevant permit not having been communicated at shift handover. Escaping condensate ignited. Fire escalated because connected platforms continued to pump into the fire, and because the accommodation module provided no protected escape route. 167 people died. The Cullen Inquiry produced the safety case regime: an operator must demonstrate with evidence that hazards are identified and risks reduced so far as is reasonably practicable, to a regulator that assesses the argument rather than checking a prescribed list.
Longford, 1998
A process upset at a Victorian gas plant led to loss of warm oil circulation. Vessels became extremely cold, and when warm oil was reintroduced, a heat exchanger fractured by brittle failure and released hydrocarbon, which ignited. Two workers died and gas supply to the state was interrupted for weeks. The Royal Commission examined the removal of engineering staff from site to a central location, the resulting loss of hazard knowledge among operators, inadequate hazard identification for the specific scenario, and alarm handling. It remains a central Australian case on the difference between a documented safety system and an effective one.
Columbia, 2003
Insulating foam shed from the external tank during ascent and struck the wing leading edge, breaching the thermal protection. The damage was not assessed as flight-critical, and the orbiter was lost during re-entry. The Columbia Accident Investigation Board found organisational causes closely mirroring Challenger seventeen years earlier: a known recurring anomaly reclassified as acceptable, and engineering concerns raised during the mission that did not reach decision-makers with the weight they warranted. The Board stated explicitly that the organisational causes had not been fixed by the previous investigation.
Deepwater Horizon, 2010
A well was being temporarily abandoned. A negative pressure test gave anomalous readings that were interpreted as acceptable. Hydrocarbons entered the wellbore, reached the rig, and ignited. Eleven people died and a prolonged subsea release followed. Investigations addressed cement barrier design and evaluation, interpretation of the pressure test, well monitoring during displacement, and the reliability and testing of the blowout preventer. Barrier management, independent verification of well integrity and the treatment of ambiguous test results were all strengthened across the industry.
03What the seven have in common
| Finding | Where it appears |
|---|---|
| The mechanism was known beforehand | All seven. Seal erosion, foam shedding, brittle transition, void coefficient, valve position ambiguity, permit control and cement evaluation were each documented in advance. |
| Recurring anomalies became accepted | Challenger, Columbia, Deepwater Horizon. Repeated occurrence without consequence was treated as evidence of safety. |
| Ambiguous evidence resolved toward continuing | Three Mile Island, Deepwater Horizon, Challenger. Anomalous readings were given an interpretation permitting the work to proceed. |
| Concerns did not reach the decision | Challenger, Columbia. Objections were raised by people who understood the mechanism and did not carry weight at the point of decision. |
| Escalation, not initiation, caused the deaths | Piper Alpha, Deepwater Horizon, Longford. The initiating event was survivable; what followed was not. |
| Knowledge had drifted from where it was needed | Longford, Deepwater Horizon. Those making decisions did not hold the hazard understanding the situation required. |
Not one of these events was caused by a physical mechanism that engineering did not understand. Every one turned on how an organisation treated information it already had. That is uncomfortable because technical competence, which engineers can develop directly, was not the binding constraint; the handling of evidence under schedule and commercial pressure was. It is also encouraging, because it means the interventions that work — independent verification, authority to stop, treating anomalies as signals, and taking objections seriously — are available to any organisation that chooses them.
04The safety case: from compliance to argument
The regulatory model that emerged, principally from Cullen after Piper Alpha, is the most significant institutional change of this period. Prescriptive regulation lists requirements and an inspector checks them. Its weakness is that a facility can comply fully and still be unsafe, because the list was written for facilities in general and not for this one.
A safety case reverses the burden. The operator must demonstrate, with evidence, that hazards have been identified, that risks are reduced so far as is reasonably practicable, and that the controls relied upon will work. The regulator assesses the quality of that argument.
Major hazard facility provisions in the model Work Health and Safety Regulations, adopted with variation by each state and territory, require a safety case for facilities holding defined quantities of hazardous materials. Related instruments include AS/NZS 61511 for process safety instrumented systems, AS/NZS ISO 31000 for risk management and AS 2885 for pipelines. Offshore petroleum facilities are regulated separately by NOPSEMA. Cited by number for orientation only — verify currency and jurisdictional application.
05Takeaways for current practice
- Treat a recurring anomaly as an unexplained signal. Repeated occurrence without consequence is not evidence of an adequate margin.
- Resolve ambiguous test results toward stopping. In several of these cases an anomalous reading was given a reading that permitted continuation.
- Indicate actual state, not commanded state. Three Mile Island turned on that distinction, and it recurs constantly in instrumented systems.
- Design for escalation, not just initiation. In three of these events the initiating fault was survivable and the escalation was not.
- Keep hazard knowledge where decisions are made. Longford is the clearest case of competence being present in the organisation but absent from the point of decision.
- Give objections a route that reaches the decision. Engineers raised the correct concern before Challenger and during Columbia; the route was the failure.
These three series have covered 1845 to 2020: devices, then systems, then information and process. If there is one thread running the whole length, it is that the profession has learned most from its failures, and that it learned most reliably when those failures were investigated thoroughly, published openly and acted on by competitors as well as by the organisation involved. The Quebec Bridge produced registration, the Comet produced damage tolerance, Tacoma Narrows produced wind engineering, and Piper Alpha produced the safety case. That willingness to publish what went wrong, and to be changed by it, is the profession’s most valuable habit.