Wednesday Reality: The Silence Before Departure

On 6 March 1987, the Herald of Free Enterprise left Zeebrugge for Dover. She was a roll-on/roll-off ferry, built around a deceptively simple idea: vehicles could drive aboard through the bow, cross a largely unobstructed deck and drive off quickly at the other end. The arrangement reduced the time spent alongside. It also placed a large, open space close to the waterline, behind doors whose position mattered more than almost anything else on the ship.

Zeebrugge presented a particular complication. Its loading ramp could not reach the ferry’s upper vehicle deck while the vessel floated in her usual attitude. The crew took on forward ballast to lower the bow for loading, then had to pump that water out. The ballast operation, the loading sequence, the closure of the bow doors and the departure schedule therefore intersected. Each had its own operators and its own rhythm. The ship did not wait for those rhythms to become coherent before physics took over. The formal investigation describes the loading arrangements, ballast capacity and sequence in detail.

The bow doors remained open when the ferry sailed. As speed increased, the bow wave rose across the opening and water entered the vehicle deck. A relatively small depth of water spread across a very broad surface. When the ship heeled, that water ran towards the lower side, shifting its weight in the direction of the heel. The normal righting tendency of the hull could no longer counter it. The investigation concluded that the initial lurch resulted from this free-surface instability. Flooding then continued and the vessel capsized within minutes. The Marine Accident Investigation Branch records 193 lives lost. The 1987 inquiry established 188 deaths at the time of its report.

A wide surface

The open vehicle deck made the ferry useful. A lorry could move through it without negotiating the partitions that would have slowed loading and unloading. The same continuity let incoming water travel laterally. This matters because a ship’s stability cannot be inferred from how much water it contains alone. Its location, the shape of the space it occupies and its ability to move all affect the righting moment. Water held in a narrow, full tank behaves differently from a shallow layer across a broad deck. In a partly filled space, liquid moves as the vessel inclines, and the shifting load reduces the stability available to bring her upright.

Naval architects account for free surfaces explicitly. The International Maritime Organization’s stability framework treats the effect alongside righting characteristics, weather and watertight integrity. Subdivision changes the consequences of flooding because it constrains where water can travel. Yet subdivision also competes with what a vehicle ferry exists to do. A bulkhead across the working deck interferes with the continuous passage of vehicles. The design therefore carried a dependency: the open deck worked as intended only while the boundary at its bow remained secure.

That dependency was easy to obscure in daily operation. Most departures occurred without incident. Every successful crossing supplied evidence that the vessel could sail safely under the conditions that had prevailed. It established little about how she would behave with an open bow door at speed. The danger lay in the interaction of several ordinary features: a low opening, a broad deck, a ballast operation required by the berth and a departure that increased the bow wave. No single feature explained the loss of stability. Their combination defined a condition the routine crossing seldom exposed.

The formal inquiry examined model tests, a full-scale trial with a sister ship and the sequence in which speed, bow wave, inflow and heel interacted. Those investigations identified a threshold: once the bow wave reached the opening, water moved aft onto the deck. As the bow settled deeper, the inflow increased. The geometry that served rapid loading then became the geometry through which the vessel lost stability. The dangerous condition developed faster than an ordinary process of noticing, communicating and correcting it could plausibly operate.

The unreported condition

The bridge had no direct indication that the bow doors stood open. The master could not see them from his position. Closure depended on a person carrying out a task below and on the result becoming known above. The inquiry found that the master had come to treat the absence of a report as sufficient reassurance that the vessel was ready. Yet silence could mean several different things: the task had been completed, the responsible person had not done it, someone thought another person would report it, or the reporting path had failed. Nothing about silence distinguishes among those states.

This was not a risk that nobody had imagined. The inquiry documented earlier occasions on which company vessels had gone to sea with bow or stern doors open. Some had reached management without being shared with other masters. Captains had requested bridge indicators for door position. In 1985 a proposal received dismissive responses. In 1986 another request travelled through the organisation and failed to produce the equipment before the disaster. The point of an indicator would not have been to absolve anyone of responsibility for closing the doors. It would have made the condition of the ship observable at the place where the decision to sail was taken. The inquiry later recommended indicators designed to show danger when their circuit failed, together with proper closing, reporting and logging procedures.

There is a significant distinction between assigning responsibility and making the result of that responsibility visible. The former names a person. The latter establishes a verifiable state. When a proposal for bridge indication was rejected, one management response argued that a person who left the doors open should be disciplined. That response addressed a failure after it had occurred. It did not provide the bridge with information before departure. It treated accountability as though accountability could substitute for observation.

The vessel also operated within a timetable that made delays visible and unverified conditions comparatively quiet. The inquiry recorded pressure around departure and conflicting duties for officers during loading. A late sailing produced an immediate, measurable deviation. A door that had not been positively confirmed produced no equally conspicuous signal on the bridge. The incentives did not need to instruct anybody to ignore safety. They made the cost of waiting certain while leaving the cost of assuming completion uncertain. Across enough departures, the assumption could begin to resemble a procedure. Earlier departures with open doors had supplied warnings, yet those warnings did not become a shared operational constraint. Information had reached the company without necessarily reaching the next person who needed it.

When work crosses a boundary

Consider a change to a customer’s verification journey. The interface collects a new piece of information. An SDK sends it. An API accepts it. A decision service interprets it. Support must recognise the cases that fail.

Each part can complete its assigned work and report a truthful local result. The interface behaves as designed. The SDK passes its tests. The API deploys successfully. The decision service returns the expected answer for the examples it received. Yet a real customer journey can still fail when an old SDK sends a different payload, when a rule interprets a missing field differently, or when support cannot distinguish the new failure from an existing one. No team has necessarily lied. The end-to-end condition has simply never been observed by the people deciding whether the change is ready.

The difficulty arises where a decision depends on work performed elsewhere. Each handover compresses a complicated state into a simpler signal: approved, tested, ready, deployed. Compression helps a large organisation move, but it discards context. Which versions were tested together? Which failure cases remained unexamined? Who can still stop the release when new evidence arrives? If the authorising team cannot inspect the condition on which it relies, it may substitute no outstanding objection, no red ticket or no message from the previous team. Those signals have meaning only if someone owns the obligation to report an incomplete condition and can do so before the decision. Silence in a dependable protocol differs from silence in an undefined one.

Adding another approval box does not necessarily change that information structure. An approval can faithfully certify that someone reviewed the artefacts available to them while leaving the underlying operational state unknown. A checklist can record a tick against a task whose outcome nobody measured. Conversely, a well-placed verification can be small: an observed end-to-end transaction through the combinations that matter, a direct indication of the actual dependency, or an explicit acknowledgement of a condition that remains unknown. The distinction concerns what the signal establishes, where it comes from and whether the decision maker can act on it. A successful build says something precise about the build. It says much less about the customer’s journey.

Nor can every consequential state be reduced to an indicator light. A bridge can display a door’s position because the condition is specific. An executive dashboard cannot represent every dependency in an organisation. The more distant the observer from the work, the more a summary conceals the circumstances under which its signal remains valid. Instrumentation helps when it measures the condition that matters and when people can challenge the instrument. It misleads when a green display becomes a reason to stop asking what it observes. The inquiry’s recommendation for a fail-safe door circuit illustrates the difference: even the indicator’s own failure had to produce a warning rather than another reassuring silence.

The ferry’s wide deck adds a second, less obvious question. Some organisational boundaries deliberately stay open because openness creates speed. A shared platform lets teams build without duplicating infrastructure. A common release train reduces coordination costs. A flexible pool of specialists helps wherever pressure appears. Under ordinary conditions, these arrangements improve flow. Under stress, they can also transmit disturbance across a much larger area: a change in one service affects several journeys, a scarce specialist is pulled between urgent projects, or a production incident consumes the people expected to complete a release. The same connectedness that allows work to pass easily can allow disruption to spread.

Work does not obey hydrostatics, and a missed release does not resemble a maritime disaster in consequence. The structural resemblance concerns dependencies. A connected system gains speed by removing boundaries. It then depends on other boundaries, observations and response times to prevent a local disturbance from spreading. More partitions can reduce propagation but also obstruct the work the system exists to perform. More coordination can provide assurance but also delay decisions until information has gone stale. The question is which condition must remain true for speed to stay useful, and whether anyone can see that condition at the moment it matters.

The quiet crossing

After the capsize, the company fitted door indicators to other vessels in a matter of days. That fact does not make the earlier failure simple. An indicator could have failed or been misunderstood. A procedure could have existed on paper and broken under pressure. The inquiry considered technical design, reporting, supervision, vessel operations and management response together because none of these alone captured the system that sailed from Zeebrugge. The sharpest detail remains the sequence of unanswered warnings. People closest to the vessel had described a missing observation. The organisation had converted their requests into correspondence, cost and questions about personal discipline, while the ships continued to depart.

At the point of departure, the bridge needed to know whether the bow doors had closed. The ship’s silence offered no answer. Alongside the ordinary sounds of engines, loading and the departure routine, it scarcely registered as silence at all. The timetable proceeded as though a condition had been confirmed, while the condition itself remained below, outside the bridge’s view.