In June 2023, OceanGate¡¯s Titan submarine and its crew perished while exploring the wreckage of the RMS Titanic. A review of the hazards the company overlooked holds many lessons for engineers working in process safety.

The Titan, an experimental submersible that was designed, constructed, and operated by OceanGate with the intent to visit deep-sea locations, lost communication with its surface support vessel on June 18, 2023, during a dive to the wreck of the RMS Titanic. This wreck is approximately 3,800 m (12,500 ft) deep, where the pressure is almost 380 times atmospheric pressure at sea level. The Titan was later confirmed to have catastrophically imploded under this extreme pressure (approximately 38 MPa, or 5,500 psi), resulting in the near-instantaneous deaths of all five occupants, including OceanGate¡¯s Chief Executive Officer (CEO), Stockton Rush (1). This dive was designated Dive 88, and it was Titan¡¯s 18th descent to this depth.

The repercussions of this event included:

• loss of the five lives aboard, and the resultant impacts on their families, friends, and coworkers
• the additional cost, time requirement, and risk to personnel during the search and recovery efforts
• impact on the reputation of the submersible industry
• cessation of all OceanGate exploration and commercial operations.

The U.S. Coast Guard¡¯s Marine Board of Investigation identified two specific parts of the design as being the most likely points of initial failure (2); however, the specific failure mode is unimportant to the process safety learnings that must be heeded from this incident. There were several potential points of failure in the way the Titan was designed, constructed, and operated, and protecting against all potential sources of failure is an important part of process safety in any chemical process industry.

This article discusses several key process safety lessons engineers must heed in order to safely design, develop, and operate hazardous systems and processes ¡ª especially those that are novel or innovative ¡ª and identifies the elements of the Center for Chemical Process Safety¡¯s (CCPS¡¯s) Risk Based Process Safety (RBPS) framework that apply to each lesson (3).

Design, development, and structure of the Titan

A diagram of the main components of the Titan pressure hull is shown in Figure 1 (4). The pressure hull was composed of a cylinder made of a wound carbon fiber epoxy matrix with a titanium hemisphere bonded to each end with adhesive. An acrylic viewport was incorporated into the front (fore) hemisphere, and the cylinder and rear (aft) hemispheres were covered by a white fiberglass shell. The tail portion of the shell was not pressurized (1).

---

¡øFigure 1. The body of the Titan submersible featured a carbon fiber body between titanium rings and hemispheres (4).

Carbon fiber is a lightweight but strong material, consisting of strands of carbon embedded in an epoxy material that adheres them together and provides structural support. The hull cylinder was manufactured by wrapping carbon fibers in epoxy around a metal cylinder, followed by curing in an autoclave, causing the epoxy to bind the carbon fibers together (5).

This material was used by OceanGate to limit manufacturing costs and achieve a more rapid manufacturing schedule, as well as to assist with the buoyancy of the vessel since carbon fiber is lighter than steel and aluminum (6). Carbon fiber was originally investigated by OceanGate as a material for the end domes; however, testing of four 1/3-scale models showed that titanium was required for these components (7).

Carbon fiber¡¯s high strength and light weight are extremely useful qualities for industries such as aerospace. Stockton Rush, OceanGate¡¯s CEO and the pilot of Dive 88, stated, ¡°I have great confidence in this process because many of the systems and procedures we are using are directly lifted from the aviation industry¡± (7). However, there are two fundamental differences between aerospace applications and submersible applications: the orientation of the pressure difference between the inside and outside of the hull, and the magnitude of that pressure difference.

Carbon fiber is strongest in cases where the forces are in tension. The fibers can be considered similar to very small strings that, when pulled on, resist pulling and stretching with a high degree of strength. In an aerospace application, such as an airplane, the pressure inside the craft is greater than the pressure outside, and this puts the carbon fibers into tension due to the forces pushing outward from inside the craft.

However, carbon fiber is not as strong under compressive forces (6). The carbon fiber ¡°strings¡± are not nearly as effective against a force pushing on them, in the same way that a string or rope does not provide much resistance against being pushed, and so under compressive forces, much of the strength comes from the epoxy matrix holding the fibers together. The difference in force direction on the carbon fibers is illustrated in Figure 2. Note that Stockton Rush incorrectly stated that it was the inverse and that carbon fiber became stronger under compressive loads, similar to concrete (8).

---

¡øFigure 2. The carbon fiber frame used in the Titan submersible was inspired by aerospace technology. However, the effects of the pressure differential on the fibers within a carbon fiber matrix in an aerospace application in internal pressure service (left) and a submersible application in external pressure service (right) vary dramatically.

The other key difference between aerospace applications and deep-sea applications is that, in the case of aerospace, the maximum pressure difference between the inside and outside of a vessel is 1 atmosphere, as a vacuum outside the vessel would be 0 atm. Commercial airliners in the U.S. are required to pressurize the cabin to only 0.74 atm (9). Compare this to the pressure differential of approximately 380 atm experienced by a submersible at the Titanic¡¯s depth with an internal pressure of 1 atm (10).

Lesson 1: Innovation increases risk

Innovation is at the core of many industries, including both the submersible industry and the chemical process industries (CPI). Specialists in each are always looking for new materials, processes, equipment, and technologies that can improve operations. However, whenever an innovation is being developed, it is important that it is implemented in a way that provides a reasonable assurance of safe operation, and that any risks are reduced to a level that is as low as reasonably practicable (ALARP).

It appears that Stockton Rush was keen to maintain a high degree of safety. He stated in an email that ¡°I cancelled last year¡¯s expedition and will cancel this year¡¯s, or even shut down the company, before I will operate an unsafe sub¡± (11). He stated that ¡°I can come up with 50 reasons why we have to call it off, and we fail as a company. I¡¯m not dying. No one is dying under my watch, period¡± (8).

However, Rush also saw codes and regulations as overly restrictive and stifling to innovation. He wrote of the American Society of Mechanical Engineers (ASME) specifications that, ¡°¡­everyone knows that they are hyper over-conservative¡± (8), and he wrote, ¡°I have grown tired of industry players who try to use a safety argument to stop innovation and new entrants from entering their small existing market¡± (12).

The carbon fiber cylinder design of the Titan was not covered by existing codes and regulations; therefore, the vessel would have required careful design and testing to ensure the material¡¯s safe applicability in this service. However, there were industry-standard steps that were not performed. The vessel was not certified by an independent authority because Rush believed that the vessel design was so different from existing systems that it could not be certified. It was the only submersible in the world performing commercial work that was not certified (12). Furthermore, the hull was tested to operational pressures only five times those of an onshore facility, and only one dive to significant depths was conducted with this hull before full crews were taken on board (1). However, a significant source of stress on the hull is the cyclical service of the external pressure increasing by 38,000% and decreasing again during each dive, which substantially increases the stress on the vessel. It is unlikely that six pressure tests could adequately represent this cyclic effect.

A CCPS RBPS element that applies here is ¡°Compliance with Standards¡± (3). The purpose of any standard is to provide reasonable assurance of the safety and adequate operation of a task, piece of equipment, process, or facility. It includes information on what has been found to work safely, and provides instructions on how to maintain safety by staying within known limits. It is said that they are ¡°written in blood,¡± because they are usually implemented in response to a catastrophic incident that occurred in the past. For example, today, boilers and pressure vessels are covered by many codes, standards, and regulations, but these were developed in response to numerous explosions of early boilers, including a 1905 explosion at the Grover Shoe Factory in Brockton, MA, that killed 58 people and injured 117 more (13). If there is a requirement to operate outside of existing standards, a further burden of proof must be placed on the design and operation to ensure that there is a reasonable certainty of safe operation, as described in the following section.

Lesson 2: Innovating safely

It is true that new innovations by their nature exceed the limits of current knowledge and, therefore, may exceed existing codes and standards. Operating outside of those limits, however, means that there is no pre-existing knowledge to provide assurance of safety, and the risk of a hazardous event is substantially increased.

Whenever developing a technology, material, or process outside of the known envelope, a verification, validation, and uncertainty quantification (VVUQ) approach must be taken (6). This VVUQ process is intended to provide a path for innovating outside of well-established processes, conditions, and materials while managing the potential risks. VVUQ includes predicting and modeling the conditions the new design will experience and performing an incremental experimental approach to predict, test, and validate each step on the path to the end goal.

As an example of regulations supporting innovation, ASME Boiler and Pressure Vessel Code (BPVC) Section VIII, Div. 2, Part 5, ¡°Design by Analysis¡± contains a method of conducting VVUQ, which includes consideration of how far outside the known safe design limits the new innovation is trying to reach and adjusting the approach accordingly to provide that reasonable assurance of safety (6).

It is important that anyone making a risk decision is as well-informed as is reasonably practicable. In the case of the Titan, OceanGate was transparent about the fact that the vessel had not been classed and was an experimental vessel. The waiver and release of liability agreement explicitly stated, ¡°The experimental submersible vessel has not been approved or certified by any regulatory body and is constructed of materials that have not been widely used for manned submersibles¡± (14). This appears to be providing the information required for passengers to provide informed consent. However, it appears that some of those who dove in the Titan were not fully aware of the level of risk involved. According to two people who were part of the last dive before the implosion, they misunderstood the level of risk they were taking. They believed that every submersible capable of reaching such ocean depths would be considered experimental due to the small number of vessels capable of such a feat, and so assumed that the Titan was similar in risk to those other vessels (15). They were seemingly unaware that the Titan was the only submersible in the world performing commercial work that was not certified (12), that an engineering company¡¯s preliminary analysis had shown that the window could possibly fail with repeated dives (6), or that design codes do not cover carbon fiber materials in this service (6).

Through the innovation process, it is important to pay heed to the regulations that are in place and consider their purpose. It is also important to bear in mind that if there is a hazardous incident, it becomes more likely that new regulations, rules, laws, or other requirements will be put in place. The quickest way to ensure a new regulation or restriction is created and strictly enforced is by people getting hurt.

Lesson 3: Safeguards and protection layers

The design of the Titan included a real-time monitoring system, which was intended to assist with monitoring the condition of the hull and provide warning of an impending hull failure. This system included strain monitoring devices and acoustic monitoring devices that were incorporated into the hull.

The acoustic monitoring system used eight acoustic sensors that were installed on the hull to detect sounds that could be related to carbon fiber material fracturing or otherwise becoming damaged. An acoustic event of a certain threshold decibel level was considered a hit, and warnings were initiated if a certain cumulative hit threshold was reached during a dive. Note that hit counts did not accumulate between dives (5).

Rush considered acoustic monitoring to be instrumental in ensuring the Titan¡¯s safety, because he believed that the system would alert him before the hull failed, based on his comment that, ¡°I will know [through the acoustic monitoring system] before it fails, well before it fails, and we will also know that it¡¯s starting to get weak¡­¡± (8). The U.S. Coast Guard¡¯s Marine Board of Investigation, however, concluded that ¡°¡­the company¡¯s reliance on [this system] was dangerously misguided¡± due to ¡°limited testing, overlooked failure modes, malfunctioning sensors, lack of cumulative data tracking, and the dismissal of critical acoustic warnings¡± (2).

In order to understand why this system was not as reliable as OceanGate thought, we can assess it in the same way as we must for any safeguard. When determining effective safeguards and protection layers, it is critical to consider the full set of requirements of such protection:

• Specific. Is it designed to detect and prevent the scenario in question?
• Independent. Is it adequately independent of the initial failure mode and of other protection layers?
• Dependable. Can it be reasonably expected to be effective at preventing the hazardous event?
• Auditable. Can it be tested and documented to provide assurance that it will respond as required when necessary?

These requirements vary between sources, but many of the core elements and concepts remain the same. The CCPS book Layer of Protection Analysis (16) lists three criteria for adequate protection layers. The CCPS book Guidelines for Initiating Events and Independent Protection Layers in Layers of Protection Analysis (17) lists seven core attributes. Both of these sources contributed to and informed the content of this article.

The acoustic monitoring system was designed specifically to detect issues with the carbon fiber shell, and for the purposes of this discussion, it can be considered adequately independent. Therefore, this layer can be considered to meet the requirements of specificity and independence.

The dependability of this safeguard includes the ability of the operator to respond to an alarm. One of the concerns with the safeguard as implemented was that the number of ¡°hits¡± counted did not accumulate between dives. The hits would be registered in the event of damage occurring within the carbon fiber cylinder, which could include fibers breaking, cracking, delaminating (i.e., the separation between carbon fiber layers), or other failures. This damage is permanent and accumulates between dives. Because the hit count was reset to zero before each dive, that knowledge of cumulative damage was lost. Therefore, the acoustic monitoring system could not be considered a dependable safeguard, as it could not be known how many more hits the system would detect before hull failure.

A critical and often overlooked consideration for safeguards and, in particular, alarms that require a personnel response is ensuring that there is adequate time for someone to take the system to a safe state once they get the alarm, and that the hazardous event will not happen before the operator is able to do so. As failures accumulated in the carbon fiber matrix, they increased the stress on the remaining matrix, and, once a critical quantity of the matrix failed, the stress was high enough that the remainder catastrophically failed in rapid succession (18). OceanGate¡¯s former Director of Marine Operations, whose employment was terminated in 2018 for refusing to accept OceanGate¡¯s research and development plans going forward based on safety concerns (19, 20), stated, ¡°this type of acoustic analysis would only show when a component is about to fail, often milliseconds before an implosion¡± (21), which is another reason that this safeguard could not be considered dependable.

This is addressed within the CCPS RBPS framework through ¡°Process Knowledge Management¡± (3). As part of this element, an organization is required to acquire, store, use, and update knowledge within the organization to support safe operation.

Finally, safeguards must be audited to ensure they are working correctly and can reasonably be expected to be available and effective when they are required to act to prevent a hazardous event (Figure 3) (22). If a safeguard is found to not be working correctly, the reason for it needs to be investigated and a solution implemented to restore it to working order. If this is not possible or practicable, an alternative means of protection must be implemented to address the risk gap created by this safeguard not working correctly. Although accessing the sensors for inspection, testing, and maintenance may not have been possible, one way to audit the sensors for accurate detection would have been by comparing the recorded output of different sensors together to see if they detected similar acoustic events. It was determined that three out of the eight sensors likely were not detecting or reporting acoustic events (Figure 3) (22), indicating that there may have been a systematic issue that needed to be investigated to prevent the failure of the remaining sensors (22).

---

¡øFigure 3. This comparison of acoustic monitoring Sensor 2 (left) and Sensor 1 (right) during Dive 76 indicates that Sensor 1 did not appear to register the acoustic events detected by Sensor 2 (22).

By following the CCPS RBPS element of ¡°Measurement and Metrics,¡± combined with adequate ¡°Process Safety Knowledge¡± (3), signs and signals that critical equipment may not be functioning correctly must be identified and tracked. In the example of Titan, a post-dive view of the acoustic and stress data could be plotted together on the same time scale, and a comparison of the data collected from the acoustic and stress monitors could be used to provide confidence in the correct operation of each instrument. Whenever an instrument is found to potentially not be performing correctly, an action plan could be developed and implemented to restore the device to full function and address the potentially increased risk during this restoration time.

Lesson 4: Weak signals

Weak signals, in the context of process safety, are signs that something may be wrong, which may contribute to the occurrence of a hazardous event. Sometimes they can be clearly identified as something that is not correct or a hazardous potential that has not yet been realized. Other times, they may be a minor item that by itself does not appear to be hazardous, and yet in hindsight may be an obvious sign of a building hazardous event. Identification and investigation of weak signals is an essential part of an effective process safety program because it provides an opportunity to prevent a future hazardous event.

These weak signals are especially critical when innovating and moving beyond the known safe operating boundary, because it might not be clear what signals are revealing. In the case of the Titan, there were signals, both weak and strong, leading up to the implosion that, had they been followed up on, could potentially have prevented the implosion and loss of life. One of the most significant, in hindsight, is a loud bang sound that was heard shortly after surfacing from Dive 80 on July 15, 2022 (1). A comparison of the acoustic and strain monitoring data (Figure 4) shows that the sound coincided with a sudden change in the longitudinal and hoop strains of the hull (23).

---

¡øFigure 4. A comparison of acoustic and strain data at the end of Dive 80 reveals an enormous momentary increase in acoustic activity at the same moment personnel heard a loud bang inside the submersible (23).

This indicates a significant change in the operation of the vessel; data from the strain gauges on previous dives does not show this sudden change in hull strain. Furthermore, this event appears to have impacted the response of the hull strain to pressure changes on subsequent dives. Figure 5 shows how the strain recorded during Dives 75 and 80 ¡ª prior to when the bang sound was heard ¡ª was different from the strain on Dives 81 through 83 ¡ª after the bang sound was heard (23). The difference in the response of the strain monitors indicates a persistent change in the hull¡¯s response to pressure, which should have been detected and investigated. Instead, the noise was dismissed by Stockton Rush as caused by a shift of the Titan¡¯s frame, and he directed that no further investigation was required. The U.S. Coast Guard¡¯s Marine Board of Investigation later determined that the most likely cause of the ¡°bang¡± sound was separation between layers of carbon fiber within the cylinder walls, significantly compromising the material strength (2).

---

¡øFigure 5. A comparison of hull strain response before and after the loud bang was heard reveals a significant difference in the way the hull responded to pressure changes (23).

This incident is clearly outside the intended operation of the vessel and required an incident investigation, as detailed in the CCPS RBPS element ¡°Incident Investigation¡± (3). Each time an event happens that could threaten the integrity of the system, it must be adequately investigated and any findings resolved as soon as reasonably practicable. In some cases, an incident may be significant enough that operations are suspended until it can be proven that the problem has been resolved and that safe operations can continue.

The CCPS RBPS element ¡°Conduct of Operations¡± (3) requires an organization to develop a culture that supports and encourages observations and attention to detail, as well as a questioning and learning attitude to help personnel identify potential warning signs. By training personnel to recognize these weak signals and supporting the growth and utilization of these skills, an organization has a better chance of identifying an upcoming hazard before it occurs, thereby having an opportunity to prevent it.

Furthermore, the element ¡°Process Safety Culture¡± (3) tells us that leadership sets the organizational culture and direction, especially with regard to process safety. Leadership ultimately decides what is communicated and listened to, how resources are allocated, and which people are hired or let go. Without the support of leadership, organizational employees and contractors usually cannot have a significant impact on process safety. Therefore, it is the job of leadership to ensure that they are performing proper due diligence in their roles, including fostering a culture that prioritizes process safety as a core value.

Lesson 5: Incident investigation

The CCPS RBPS element ¡°Incident Investigation¡± (3) addresses the reporting, investigation, data collection and analysis, and communication of incidents and recommendations to prevent their recurrence or escalation. An incident includes so-called near-misses, as well as events that cause harm.

One incident that warned that there was a potential concern with the submersible¡¯s design was the failure of the initial Version 1 (V1) hull. The V1 carbon fiber cylinder, which was manufactured as one continuous layer, developed a large crack (Figure 6) that was identified by an OceanGate pilot in June 2019, leading to the hull being retired in October of that year (1).

---

¡øFigure 6. A large crack in the internal hull surface of Version 1¡¯s (V1¡¯s) carbon fiber hull could have alerted engineers to inherent flaws in their design strategy (1).

This was clearly a signal that the pressure and cyclic operation of diving and surfacing were causing fatigue and damage to the carbon fiber hull. The reason that OceanGate used five separate layers of carbon fiber in the Version 2 (V2) hull, which was installed on the Titan at the time of implosion, was an attempt to prevent reoccurrence of this failure, as it was believed that wrinkles that formed in the single continuous layer contributed to the V1 hull failure (3). However, the new five-layer structure was not tested prior to development of the final V2 hull, and no scale models were developed using this process to test this theory (2).

Another significant incident occurred during Dive 87 on June 7, 2023, which was the final dive conducted before the vessel imploded on Dive 88. An issue with the variable ballast system was identified shortly after descending below the surface, and the dive was aborted without the vessel descending to depth. When recovering the Titan to its launch and recovery platform, an error caused the platform to tilt significantly. The Titan was only connected to the platform at one end, creating a lever effect, and as the waves hit the platform and submersible, it caused the Titan¡¯s front end to pivot up approximately 1.8 m (6 ft) above the platform, subsequently slamming back down onto the platform. This slamming continued repeatedly for about an hour until the problem could be resolved (1, 15). There was no indication that the vessel was inspected for potential damage after this incident prior to its final dive (15).

If these incidents had been more thoroughly followed up on through a robust and effective incident investigation program, it is possible that the potential failure mode would have been identified prior to the implosion. This would have provided an opportunity to make changes to prevent the implosion from occurring.

In conclusion

Innovation is necessary for continually improving systems and processes, as well as commercializing new ones. It allows businesses to provide new goods and services and to maintain a competitive edge within industry. Therefore, it is essential that industries investigate ways to innovate with a reasonable level of safety and reduce the risk, especially to personnel.

Throughout the innovation, design, implementation, and operation of any process or piece of equipment, the following questions must be considered to reach this level of safety.

The relevant elements within the CCPS RBPS framework are also indicated.

• ¡°Compliance with Standards¡± and ¡°Process Safety Culture.¡± Are we innovating in a way that pushes the boundaries of established knowledge in a reasonable increment and with a reasonable level of safety?
• ¡°Process Safety Knowledge,¡± ¡°Process Knowledge Management,¡± and ¡°Measurement and Metrics.¡± Can we be reasonably sure that the safeguards and protection layers we are using will be effective in detecting and preventing a hazardous incident?
• ¡°Conduct of Operations¡± and ¡°Incident Investigation.¡± What weak signals of an impending catastrophe are we currently overlooking, and how can we better identify and respond to them?
• ¡°Incident Investigation¡± and ¡°Process Safety Competency.¡± Are we adequately investigating and learning from our own incidents?

As Dr. Trevor Kletz, one of the founders of modern process safety management, would say, ¡°If you think safety is expensive, try an accident¡± (24). A new technology or material may show great promise, but if there is a hazardous incident during its development, it may be impossible to continue due to organizational, regulatory, or public restrictions.

By regularly reviewing these questions and investigating our answers to them, we can continually maintain and improve process safety within any process in the design, implementation, or operating phase, and we can prevent future hazardous incidents that result in damage to equipment, environmental impacts, and, most importantly, injury to people and loss of life.