A disaster does not happen on the day it happens. It was written long before.

Theodore Cooper was the most celebrated bridge engineer in North America, and his contract gave him final authority over every drawing of the Quebec Bridge. He was nearly seventy, in poor health, and visited the site exactly once during the entire build. To cut costs the main span was stretched from 1,600 to 1,800 feet (549 m, the longest cantilever span in the world at the time) — and the dead-load estimate was never recalculated. Design and construction both sat with a single firm, Phoenix Bridge.

From June 1907 the resident engineer Norman McLure reported repeatedly that compression chords on the south arm were visibly bent, and the bend was growing; Phoenix insisted it was old deformation from shipping. The argument dragged on for two months. On 27 August Cooper wired from New York to add no further load — the telegram never became a stop-work order. At half past five on 29 August, nineteen thousand tons of steel fell into the St. Lawrence in fifteen seconds. Seventy-five men died, thirty-three of them Mohawk ironworkers from Kahnawake.

A critical design signed off by one remote "architect", with the review living in an email thread rather than in a process; a floor where doubts exist but nobody holds the right to stop the line.

In 1894 the British Board of Trade required ships above ten thousand tons to carry sixteen lifeboats. The rule went unchanged for eighteen years while ships kept growing. Titanic measured 46,328 gross tons, carried twenty boats with capacity for 1,178, and had 2,224 people aboard — she was not merely compliant, she exceeded the legal minimum. The reason is that lifeboats were not modelled for full evacuation at all, but for ferrying people to a rescue ship coming alongside.

On 14 April the ship received at least six ice warnings. At 23:40 the berg was sighted; the officer ordered hard-a-port and engines astern. The impact fell along the starboard bow, opening roughly 90 metres of intermittent damage and flooding six watertight compartments — the design margin was four. The bulkheads rose only to D and E decks and were not capped, so water spilled over each divider in turn. She sank at 02:20; more than 1,500 died.

Compliant ≠ safe: regulatory metrics lock in the previous generation's failure modes. Autonomous driving judged by disengagements per thousand miles, and finance measuring risk by historical volatility, can both fail well above the passing line.

The segmented joints of the shuttle's solid rocket boosters were sealed against hot gas by two O-rings. Roger Boisjoly, an engineer at contractor Morton Thiokol, had written a memo in July 1985 warning that the joint could fail catastrophically, and that cold stiffens the rubber and slows its rebound. Recovered boosters from earlier flights repeatedly showed O-ring erosion by hot gas — each time judged to be "within the acceptable range of experience."

On the night of 27 January a cold front hit Florida; launch temperature was forecast at about 2℃, against a previous coldest launch of 12℃. On the teleconference the engineers recommended delay. NASA's Larry Mulloy shot back: "My God, Thiokol, when do you want me to launch — next April?" After a five-minute caucus, executive Jerald Mason told engineering vice-president Robert Lund: take off your engineering hat and put on your management hat. The company then signed off under management's name. Liftoff came at 11:38 the next morning; the vehicle broke apart 73 seconds later, killing all seven. At the hearings Richard Feynman pressed a piece of O-ring into ice water and it failed to spring back. In Appendix F he recorded another number: management put the odds of failure at one in a hundred thousand, working engineers at one in a hundred.

Alert fatigue in SRE practice: each near-miss logged as "nothing happened" ratchets the tolerance up a notch, and the consumption of margin fires no alarm of its own.

The Soviet RBMK-1000 graphite-moderated boiling-water reactor had two lethal properties: a positive void coefficient — when coolant boils into steam, reactivity rises rather than falls, a positive feedback loop — and control rods tipped with graphite, so that the first stage of insertion increases reactivity. In 1975 Unit 1 at the Leningrad plant had already suffered partial fuel melting from the first of these. The accident report was classified, and operators at other stations knew nothing of it.

In April 1986 Unit 4 was to complete a test postponed for years before shutdown. On the 25th the Kyiv grid called for power, delaying the test ten hours and handing it to a night shift untrained for it. During the power reduction xenon-135 built up and output fell unexpectedly to 30 MW thermal, far below the planned 700. Procedure required abandoning the test; deputy chief engineer Anatoly Dyatlov ordered it continued, and operators withdrew a great many control rods to drag output back to 200 MW — the core was now in a state the procedures expressly forbade. The test began at 01:23:04; coolant boiled and the positive void coefficient amplified itself. Thirty-six seconds later the AZ-5 emergency scram was pressed, the graphite tips entered first, and reactivity rose another step. Two explosions lifted a thousand-ton lid. Thirty-one died at the scene or of acute radiation sickness.

Civil aviation is the inverse case: accident reports published worldwide and anonymous reporting make one lesson binding across the whole industry. Where safety incidents stay in-house, every firm must fall into every hole itself.