[Note that this article is a transcript of the video embedded above.]

One of the very first documented engineering disasters happened in 27 AD in the early days of the Roman Empire. A freed slave named Atilius built a wooden amphitheater in a town called Fidenae outside of Rome. Gladiator shows in Rome were banned at the time, so people flocked from all over to the new amphitheater to attend the games. But the wooden structure wasn’t strong enough. One historian put it this way: “[Atilius] failed to lay a solid foundation and to frame the wooden superstructure with beams of sufficient strength; for he had neither an abundance of wealth, nor zeal for public popularity, but he had simply sought the work for sordid gain.” When the amphitheater fell, thousands of people were killed or injured. That historian put the number at 50,000, but it’s probably an exaggeration. Still, the collapse of the amphitheater at Fidenae is one of the most deadly engineering disasters in history.

Engineering didn’t really even exist at the time. Even with the foremost training in construction, Atilius would have had almost no ability beyond rules of thumb to predict the performance of materials, joints, or underlying soils before his arena was built. But there’s one thing about this story that was just as true then as it is today: The people in the amphitheater share none of the blame. They needn’t have considered (let alone verified) whether the structure they occupied was safe and sound. This idea is enshrined in practically every code of ethics you can find in engineering today: protection of the public is paramount. An engineer is not just someone who designs a structure; they are the person who takes the sole responsibility for its safety.

But if that were strictly true that safety is paramount, we would never engineering anything, because every part of the built environment comes with inherent risks. It’s clear that Atilius’s design was inadequate, and history is full of disasters that were avoidable in hindsight. But, it’s not always so obvious. The act of designing and building anything is necessarily an act of choosing a balance between cost and risks. So, how do engineers decide where to draw the line? I’m Grady, and this is Practical Engineering. Today, we’re exploring how safe is safe enough.

You might be familiar with the trolley problem or one of its variations. It’s a hypothetical scenario of an ethical dilemma. A runaway trolley is headed toward an unsuspecting group of five workers on the tracks. A siding only has a single worker. You, a bystander, can intervene and throw the switch to divert the trolley, killing only one person instead of five. But, if you do, that one person lost their life solely by your hand. There’s no right answer to the question, of course, but if you think harder about this ethical dilemma, you can find a way to blame an engineer. After all, someone engineered the safety plan for the track maintenance without an officer or lookout who could have warned the workers. And someone designed the brakes on that trolley that failed.

Hopefully, you never find yourself in such a philosophically ambiguous situation, but a large part of engineering involves making decisions that can be boiled down to a tug-of-war between cost and safety, and comparing those two can be an enormous challenge. On one side, you have dollars, and on the other, you have people. And you probably see where I’m going with this: sometimes you need a conversion factor. It sounds morbid, but it’s necessary for good decision-making to put a dollar price on the value of a human life. More technically, it’s the cost we’re willing to bear to reduce risks such that the expected number of fatalities goes down by one. But that’s not quite as easy to say.

Of course, no one is replaceable. You might say your life is priceless, but there are countless ways people signal how much value they put on their own safety. How much are people willing to pay for vehicles with higher safety ratings versus those that rank lower? How much life insurance do people purchase, and for what terms? What’s the difference in wages between people who do risky jobs and those who aren’t willing to? Economists much smarter than me can look at this type of data, aggregate it, and estimate what we call the Value of a Statistical Life or VSL. The US Department of Transportation, among many other organizations, actually does this estimation each year to help determine what safety measures are appropriate for projects like highways. The 2022 VSL is 12.5 million dollars.

Whether that number seems high or low, you can imagine how this makes safety decisions possible. Say you’re designing a new highway. There are countless measures that can be taken to make highways more safe for motorists: add a median, add a barrier, add rumble strips to warn drivers of lane diversions, increase the size of the clear zones, add guardrails, increase the radius of curves, cover the whole thing in bubble wrap, and so on. Each of these increases the cost of the highway, reducing the feasibility of building it in the first place. In other words, you don’t have the budget to make sure no one ever dies on this road. So, you have to decide which safety measures are appropriate and which ones may not be justified for the reduction in risk they provide. If you have a dollar amount for each fatality that a safety measure will prevent, it makes it much simpler to draw that line. You just have to compare the cost of the measure with the cost of the lives it saves.

But, really, It’s almost never quite so unequivocal. During the construction of the Golden Gate Bridge, the chief engineer required the contractor to put up an expensive safety net, not because it was the law, but just because it seemed prudent to protect workers against falls. The net eventually saved 19 people from plunging into the water below. That small group, who called themselves the Halfway to Hell Club, easily made up for the cost of that net, and that little example points to a dirty truth about the whole idea of weighing benefits and costs in terms of dollars: it’s predicated on the idea that we can actually know with certainty how much any one change to a structure will affect its safety over the long term (not to mention that we’ll know how much it actually costs, but I’ve covered that in a separate video). The truth is that we can only make educated guesses. Real life just comes with too many uncertainties and complexities. For example, in some northern places, the divots that form rumble strips on highways collect melted snow and de-icing salt, effectively creating a salt lick for moose and elk. What should be a safety measure, in some cases, can have the exact opposite effect, inviting hooved hazards onto the roadway. Humanity and the engineering profession have learned a lot of lessons like that the hard way because there was no other way to learn them. Sometimes, we have opportunities to be proactive, but it’s rare. As they say, most codes and regulations are written in blood. It’s a grim way to think about progress, but it’s true.

Look at fires and their consideration in modern building design. Insulated stairwells, sprinkler systems, emergency lights and signs, fire-resistant materials, and rated walls and doors - none of that stuff is free. It increases the cost of a building. But through years of studying the risks of fires through the tragedies of yesteryear, the powers at be decided that the costs of these measures to society (which we all pay in various ways) were worth the benefits to society through the lives they would save. And, by the way, there are countless safety measures that aren’t required in the building code or other regulations for the same reason.

Here’s an example: Earlier this year, a fuel tanker truck crashed into a bridge in Philadelphia, starting a fire and causing it to collapse. I made a video about it if you want more details. Even though there have been quite a few similar events in the recent past, bridge safety regulations don’t have much to say about fires. That’s because the risk of this kind of collapse is pretty well understood to take a bit of time. In almost every case, that timespan between when a fire starts and when it affects the structural integrity of the bridge is enough for emergency responders to arrive and close the road. Bridge fires, even if they end in a collapse, rarely result in fatalities. We could require bridges to be designed with fire-resistant materials, but (so far, at least), we don’t do it because the benefits through lives saved just wouldn’t make up for the enormous costs.

You can look at practically any part of the built world and find similar examples: flood infrastructure, railroads, water and wastewater utilities, and more. You know I have to talk about dams, and in the US, the federal agencies who own the big dams, mainly the Corps of Engineers and the Bureau of Reclamation, have put a great deal of thought and energy into how safe is safe enough. A dam failure is often a low-probability event but with high consequences, and those types of risks (like plane crashes and supervolcano eruptions) are the hardest for us to wrap our heads around. And dams can be enormous structures. They provide significant benefits to society, but the costs to upgrade them can be sky-high, so it’s prudent to investigate and understand which upgrades are worth it and which ones aren’t.

There’s an entire field of engineering that just looks at risk analysis, and federal agencies have developed a framework around dam safety decision-making by trying to put actual numbers to the probability of any part of a dam failing and the resulting consequences. Organizations around the world often use a chart like this, called an F-N chart, to put failure risks in context. Very roughly, society is less willing to tolerate a probability of failure the more people who might die as a result. Hopefully, that’s intuitive. So, a specific risk of failure can be plotted on this graph based on its probability and consequences. If the risks are too high, it’s justified to spend public money to reduce them. Below the line, spending more money to increase safety is just gold plating.

But above a certain number of deaths and below a certain probability, we kind of just throw up our hands. This box is really an acknowledgment that we aren’t brazen enough to suggest that society could tolerate any event where more than 1,000 people would die. The reality is that we’ve designed plenty of structures whose failure could result in so many deaths, but those structures’ benefits may outweigh the risks. Either way, such serious consequences demand more scrutiny than just plotting a point on a simple graph.

All this is, of course, not just true for civil structures, but every aspect of public safety in society. Workplace safety rules, labeling of chemicals, seatbelt rules, and public health measures around the world use this idea of the Value of a Statistical Life to justify the cost of reducing risks (or the savings of not reducing them). A road, bridge, dam, pipeline, antenna tower, or public arena for gladiatorial fights can always be made safer by spending more resources on design and construction. Likewise, resources can be saved by decreasing a structure’s strength, durability, and redundancy. Someone has to make a decision about how safe is safe enough. There’s a popular quote (unattributable, as far as I can tell) that gets the point across pretty well: “Any idiot can build a bridge that stands, but it takes an engineer to build a bridge that barely stands.” But there’s a huge difference between a bridge that barely stands and one that barely doesn’t. When it’s done correctly, people will consider you a good steward of the available resources. And, when it’s done poorly, your name gets put in the intro of online videos about structural failures. Thank you for watching, and let me know what you think.