Case file
- What happened: on 18 June 2023 the experimental submersible Titan lost hull integrity and imploded during a dive to the Titanic wreck, roughly 3,800 m down, killing all five aboard – including OceanGate's CEO.
- Scale: a commercial operation carrying paying passengers to extreme depth at about $250,000 per seat, on a pressure hull with no classification-society certification.
- Root cause: governance failure years before physical failure – a novel carbon-fibre hull under cyclic compression, engineering dissent ignored, prior hull damage, a fired safety director and a standing refusal of independent third-party verification.
- The bill: five lives, the vehicle, the company, and a US Coast Guard Marine Board of Investigation that put the internal record on public display.
Here is an uncomfortable observation from twenty years on both sides of certification audits. Organisations rarely refuse third-party verification because they lack evidence. They refuse it because they already suspect what the finding will be. OceanGate suspected, documented its own warning signs, and chose not to be told. The implosion was the last step in a governance decision renewed on every dive.
The situation
Titan was a five-person submersible built around a cylindrical carbon-fibre hull with titanium end domes – chosen for strength-to-weight and cost over the certified industry default at that depth, the titanium sphere. Classification societies exist precisely for structures like this: independent design review, witnessed testing, in-service survey. OceanGate declined the whole regime, framed classification publicly as a brake on innovation, and carried fee-paying "mission specialists" to 3,800 m on internal judgement alone. That trade – schedule and novelty against independent verification – is the one certification exists to refuse on your behalf.
How it unfolded
The 2024 Marine Board hearings made the paper trail public, and the trail is damning in its calmness. An earlier hull had shown damage and was retired. The director of safety raised concerns in 2018 about hull verification and testing – and was fired for it. That same year, a letter signed by dozens of deep-ocean industry experts warned that the "experimental" approach could end in catastrophe. The company's answer was a real-time acoustic monitoring system: listen to the hull, surface if it starts talking. On 18 June 2023, about an hour and forty-five minutes into the descent, Titan went quiet. A debris field found days later confirmed an implosion. No survivors.
Root-cause anatomy
Start with the physics. Carbon fibre is superb in tension; a deep-pressure hull asks it to live in compression, cycled, for its entire life. Thick wound laminates carry porosity and delamination risk, and the fatigue behaviour of that specific construction under external pressure cycling was a known-unknown – never quantified, no defined cycle life, no test to failure as a qualification baseline. Implosion is also the one failure mode the monitoring could not help. It propagates in milliseconds. No submersible climbs 3,800 m in milliseconds.
Then the organisation. Normalisation of deviance, textbook. Each successful dive was treated as evidence the hull was sound – survivorship mistaken for qualification. Dissent, the cheapest early-warning system any organisation owns, was not merely ignored; it was fired. By 2023 OceanGate was operating on accumulated conviction with the external verification layer deliberately removed.
Conviction is not load-bearing. That is the entire engineering argument for independent verification.
Where the quality system failed
Name the discipline; Titan fails it in sequence. PFMEA discipline: severity was catastrophic, occurrence for a novel laminate under cyclic compression was an assumption rather than a rating, and detection was claimed through acoustic monitoring – a control never demonstrated to create escape time. A proper PFMEA makes that trio undeniable. Here it was never allowed to exist.
The CAPA gate went the same way. Prior hull damage and anomalies were absorbed as operational workarounds – retire one hull, trust the sensors, keep the schedule. A functioning nonconformance loop would have frozen diving and forced an 8D on a single question: why does our pressure hull show anomalies at all? Change control offered nothing to inherit, because no re-qualification baseline existed for the replacement hull to carry forward.
And the audit layer. In VDA 6.3 language the first question is how do you know? In AS9100 language, a process that cannot be verified by inspecting the product must be validated – a one-shot pressure hull is the textbook case. OceanGate's only answer was internal conviction.
What would have caught it
Classification certification, first. DNV- or ABS-type approval forces independent design review, witnessed hydrostatic and cyclic fatigue testing, and a defined pressure-cycle life with mandatory retirement – the same logic that retires aircraft fuselages after a set number of pressurisation cycles. Any one of those steps likely prevents this loss.
Second, an honest PFMEA. Cycle full-scale hulls to failure. Validate the detection control or delete it. Once acoustic monitoring is proven not to buy escape time, the PFMEA demands a different design – not a microphone. Third, independent, non-advocacy design review before the first passenger boarded, the mechanism mature industries use for exactly this class of novel structure. Fourth, stop-work authority with teeth: any hull anomaly means no dive until the 8D closes, and the person who raised it is still employed afterwards.
My take
I have spent two decades on both sides of this argument – IATF 16949 and VDA 6.3 audits in automotive, AS9100/EN 9100 in aerospace. I have been the auditee willing a finding to disappear, and the auditor watching a supplier argue severity down as if the failure mode were a matter of opinion. When I built the quality function for a 900-person greenfield plant, the first structural decision was to bring external surveillance in early rather than let us grade our own homework – not because the team lacked competence, but because no team can audit its own convictions. De-escalating a demanding customer to zero critical escalations within a quarter worked only because bad news reached me faster than it reached the customer. Titan ran that system in reverse: it made dissent expensive, then read the silence as safety. I have met that confidence in boardrooms. My failure modes had smaller blast radii.
What this means on your floor
- If the failure mode is lethal and your detection control has never been proven to create escape time, your PFMEA detection rating is fiction.
- A nonconformance closed by workaround is a postponed failure. Run the 8D before reality runs it for you.
- Novel material plus cyclic load plus no independent qualification equals testing with people inside.
- Judge your speak-up culture by what happened to the last person who used it.
Titan did not fail because carbon fibre was misunderstood; composites fly safely every day under disciplines that quantify fatigue and verify it independently. It failed because an organisation read its own warning signs and then declined the one mechanism built precisely to act on them. Certification is not bureaucracy – it is the institutional memory of every hull, fuselage and pressure vessel that has already failed, so that yours does not have to. Skip it in the name of speed and you have not removed a delay. You have deferred the audit to a counterparty that does not negotiate. On 18 June 2023, that counterparty kept the minutes.
