America's Cup design philosophy and lightweight failure margins

"If it doesn't fail periodically, you made it too heavy" — the explicit design philosophy quoted by the Navtec engineer. The Navtec case is the instance; this is the design-culture frame around it.

So he came in. On an America's Cup yacht, weight is so critical that they design things to fail periodically. If it doesn't fail periodically, you made it too strong, it's too heavy. That's the design philosophy. Except you don't want it to fail unsafe, you want it to fail safe. This was failing unsafe — it was exploding. What they wanted was a leak before break, as it's called in the literature. A leak before break just means that if this is the wall of your fracture, you want the little fatigue crack to grow all the way through before it gets to critical size, so that you get a weeping leak, rather than an explosion and the whole thing shatter. It doesn't matter whether it's a little hydraulic thing like this or a great big pressure vessel — we want things to leak before break.

Tom's recurring framing: in America's Cup, parts are expected to fail and be replaced. Used here as the bridge from yacht hardware to the cruise-missile-engine analogy.

He brought me this thing and it had failed, it had split. No one got killed but they were worried about the safety. He explained to me: for America's Cup yachts, if the thing doesn't fail every now and then, you made it too heavy as a designer. A different philosophy. You should be shaving it down and making it thinner and thinner until it fails on a regular basis. These are fairly expensive yachts in that you usually are expecting parts to fail and you just replace them, because it doesn't have to last very long. America's Cup has to last for a few hundreds of hours before you trash it and go on to the next America's Cup. There's only one other component that I know — well, there are five things in nuclear weapons that have to last for a fraction of a second before they're no longer useful. But the engine on a cruise missile only has to last for about two hours. They make it out of carbon composites, and they can keep it from oxidizing away at high temperatures, but it won't last for 10 hours because it will oxidize away in 10 hours. It only has to operate for two hours, because then you're going to blow it up.

---