Swiss Cheese Model (of Accident Causation)

The Titanic Tragedy, in Summary: An RCA and Systems Analysis Perspective

The Swiss cheese model represents defenses as layers with gaps. An accident can occur when weaknesses across the layers leave a path for a hazard to cause harm. The Titanic case shows both the value and the limit of this picture: it identifies failed defenses, but explaining how those failures arose requires a fuller root cause analysis.

To examine the risk of encountering icebergs, start with the route: (1) winter and summer tracks were established because (2) a southern track was intended to avoid icebergs at certain times of year. However, (3) icebergs affected that track in April 1912, and (4) the routing arrangements did not produce a timely change. Safety therefore depended heavily on (5) the crew spotting ice, particularly in April 1912, and (6) warnings reaching other ships and the people who needed to act on them.

So, one way of ‘seeing’ what happened is to think of the preventative, detective and recovery measures that were put in place, which were supposed to act as ‘lines of defence’ to stop a disaster (i.e. as shown in Diagram 12.1), and see how these were undermined.

Diagram 12.3 illustrates how the Swiss cheese perspective (or a hairline cracks perspective) can explain what happened. As we can see, so many measures were in place to stop the worst from happening, and yet we still ended up with a terrible disaster.85

This illustration of all the measures that nearly worked, but didn't, highlights how little it would have taken to – most likely – drastically reduce the death toll. It is a powerful reminder that doing lots of good things does not prevent something terrible from happening – it all depends on what you did or did not do and how useful this turns out to be when it really counts.

Diagram 12.3 The Titanic tragedy – many lines of defence in place

The Swiss cheese model in Diagram 12.3 shows how defenses failed together. It does not explain why the gaps existed or how they came to align. For that, we need to examine the decisions, assumptions, communications, and physical conditions behind each layer.

Continuing from point (6), the analysis asks about (7) the expectation that the bridge crew would act quickly and (8) the ship’s ability to turn in time. It also considers atmospheric conditions as a proposed explanation for difficulty seeing the iceberg. These factors need to be examined together rather than reduced to a single failure.

And what we find is that:

• it's sometimes the threats that might impact us the most, that are the most painful to envisage, that we can block out,86 and for this reason,
• an unexamined threat may therefore lack a specific defense, although general safeguards can still help.

As a result, it can often be a ‘home run’ for the catastrophic outcome, unless we are fortunate with the recovery measures available.

To illustrate how such a ‘fault line’ can arise, I have chosen some of the salient causes and effects and mapped them out in Diagram 12.4.87 It should not be a great surprise to see that all eight of the eight ways to understand why were ‘in play’.

What also becomes clear, from the high‐level analysis, is to see how much the risks facing the Titanic (and other shipping at the time) increased hugely because the original purpose of the southern track (to provide a largely ice‐free route during certain times of the year) was no longer holding true.

However, to alter the southern track route so it was even further south would have resulted in a longer journey. This would mean extra time at sea, extra cost for the shipping companies and an even longer journey for passengers, something most would have been reluctant to agree to without a good reason. So, sadly, the Titanic tragedy became the ‘good reason’, after which the southern track was moved further southwards, with the international ice patrol providing extra information to mariners about the location of the ice.

Diagram 12.4 Titanic tragedy – reducing the risk of encountering ice

The parallels with what happens today should not be lost on readers. Time and time again, it takes a disaster to bring home that a low‐likelihood, but high impact risk can nonetheless occur. The Grenfell Tower fire of 2017, which killed 72 people, in London, was another example of this happening. The fire happened eight years after the Lakanal fire of 2009, also in London, which killed six people and gave explicit warnings about high‐rise fire risks before Grenfell.88

Here, we can see that the mindset that says ‘It's incredibly unlikely that this could happen; what we have done is surely good enough’ is the equivalent of saying ‘We don't need to wear seatbelts in the car’ or ‘We don't need fire insurance’. But, again, the fact that the probability of an incident occurring is very low does not mean something terrible cannot happen.

An additional factor that should be borne in mind is the asymmetry that often arises between the people who make decisions and those affected by their decisions. Very often, those who make important decisions are not the same people as those who will be directly and immediately affected by those decisions. This is not to say that most decision‐makers do not sincerely try to make the right decisions based on the information given to them. However, people may be more likely to ‘err on the side of caution’ if they know that they, or ones they love, might be directly impacted by a decision.89

And, going back to what happened in April 1912, there was a mindset (i.e. a human factor) at the time that said: ‘Why should ships go slower when there is ice? It's been decades since the last major disaster involving a passenger ship across the Atlantic!’

However, the momentum of the Titanic, or another super‐sized ship, could have been calculated at a given speed at that time. So, the Board of Trade (as the regulator) would have been able to establish that if it did hit something at speed, it could have severely damaged the hull and breached many of the watertight compartments. As a result, through a stress test analysis, such as this, it could have been determined that the speed of the ship really did matter, especially in the vicinity of ice.

To highlight that it really didn't need to turn out this way, note that the Titanic was not the White Star Line's only super‐sized passenger ship at that time. A sister ship, almost identical to the Titanic, the RMS Olympic, was built just before the Titanic. After the Titanic sank, she was refitted between October 1912 and April 1913, implementing a range of extra safety measures, including:

• Increasing the number of lifeboats from 20 to 68;
• Adding an inner watertight skin between the boiler and engine room;
• Extending five of the watertight bulkheads up to B‐Deck;
• Adding an extra bulkhead to subdivide the electrical dynamo room, bringing the total number of watertight compartments to 17;
• Improving the ship's pumping equipment.

The Olympic remained in service until 1935. Her refit shows that additional protections could be incorporated into a closely related ship. It does not establish that the Titanic’s original design was adequate for the conditions she encountered; the added protections are part of the comparison.

It's for this reason, and the memory of Captain Edward Smith and the crew and passengers of the Titanic and Captain Stanley Lord and those on the Californian, that I feel sad about simplistic, blame‐oriented, accounts of the Titanic tragedy, which I still hear and read. Worse still, while you might understand a blame mindset in the days, weeks, months or early years after the tragedy; to have a relatively poor popular understanding of the root causes of the Titanic tragedy more than 100 years after highlights the step change we need to see in people's mindsets around root causes, which is why I have written this book.

The case shows why counting safeguards is not enough. Ask which hazard each safeguard addresses, what can defeat it, and whether several layers depend on the same assumption.

A hazard need not wait until a system has gained experience or its operators are ready. A first voyage can expose a weakness just as a later one can.

The Titanic tragedy is an archetypal example of many things that were well done. Still, regarding some critical factors, a key, catastrophic type of risk was underestimated for a host of what seemed to be understandable reasons at that time.

While the world in which we now live seems relatively remote from 1912, I hope this explanation has provided a helpful reminder of why the Titanic story still has such a powerful hold on our collective imagination and why the lessons to be learned are still relevant in the twenty‐first century. As discussed, the 9/11 attacks, the 2007–2008 financial crisis and the COVID‐19 all highlight the problems that can arise when you think, ‘That'll never happen’.

Time and time again, people prepare for a ‘reasonable worst case’ that is undercooked. This is why ‘stress testing’ techniques are so important. They are, rightly, a cornerstone of regulations in building and construction, engineering projects, financial services, etc.90 However, stress tests, and reverse stress tests (where we test things to breaking point), are needed in a wider range of contexts because, too often, we see organisations run into problems and then hear, ‘No one thought that something that bad could happen’.

Alongside this, as mentioned, there can be shortcomings in how accountabilities work when decision‐makers say, ‘We have done enough’, when they may not be impacted by the consequences of their decisions. There are also questions about the role of regulatory frameworks and regulatory oversight because there is a growing list of examples where insufficient regulatory attention has been a factor in crises.

Even if a nightmare scenario would not arise 99% of the time, its consequences may still justify preparation. There are cost-benefit tradeoffs. Scenario analysis helps make those tradeoffs explicit before people have to choose under pressure.91

If Captain Smith had had the opportunity to be in a realistic but challenging bridge simulation in advance of the Titanic's maiden voyage, one can wonder what might have happened in April 1912. Sadly, that is in the past. However, future tragedies and setbacks that will arise after I have written this book are not.

No simulation can prevent every disaster. It can give leaders, managers, and regulators practice recognizing a threat, testing their assumptions, and acting before recovery becomes impossible. Afterward, examine what the exercise revealed about the defenses and who is responsible for improving them.