DG10130 9X2H4N

Topic Subtopic
Science Engineering & Technology
Epic Engineering Failures

and the Lessons They Teach
Course Guidebook
Stephen Ressler
LEADERSHIP
President & CEO. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . PAUL SUIJK
Chief Financial Officer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . BRUCE G. WILLIS
Chief Marketing Officer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . CALE PRITCHETT
SVP, Marketing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . JOSEPH PECKL
SVP, Content Development. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . JASON SMIGEL
VP, Content Production. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . KEVIN BARNHILL
VP, Marketing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . EMILY COOPER
VP, Customer Engagement. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . KONSTANTINE GELFOND
VP, Technology Services. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . MARK LEONARD
VP, Content Strategy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . KEVIN MANZEL
VP, General Counsel. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . DEBRA STORMS
VP, People . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . AUDREY WILLIAMS
Sr. Director, Content Operations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . GAIL GLEESON
Director, Talent Acquisition. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . WILLIAM SCHMIDT
Director, Creative. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . OCTAVIA VANNALL
PRODUCTION
Studio Operations Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . JIM M. ALLEN
Video Production Director. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ROBERTO DE MORAES
Technical Engineering Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . SAL RODRIGUEZ
Quality Assurance Supervisor. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . JAMIE MCCOMBER
Sr. Post-Production Manager. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . PETER DWYER
Sr. Manager of Production. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . RIMA KHALEK
Executive Producer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . JAY TATE
Sr. Producer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . JAMES BLANDFORD
Content Developer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . BRANDON HOPKINS
Assistant Content Developer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . EZRA COOPER
Image Rights Analyst. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . KATE MANKOWSKI
Post-Production Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . OWEN YOUNG
Editor. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ANDREW VOLPE
Audio Engineer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . GORDON HALL IV
Camera Operators. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . JUSTIN THOMAS
DANIEL BLOOM
Production Assistant . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . LAKE MANNIKKO
EDITORIAL & DESIGN SERVICES

Director. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . FARHAD HOSSAIN
Sr. Managing Editor. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . BLAKELY SWAIN
Editorial Associates. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . MOLLY LEVY
MARGI WILHELM
Editorial Assistant. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . WILLIAM DOMANSKI
Research Associates. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . L. VIOLA KOZAK
RENEE TREACY
Graphics Manager. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . JAMES NIDEL
Sr. Graphic Artist. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . BRIAN SCHUMACHER
Graphic Designer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . RHOCHELLE MUNSAYAC
Editorial Services. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . PROOFED
Stephen Ressler
Stephen Ressler is a Professor Emeritus from the United States
Military Academy at West Point, where he taught for 21 years. He
holds an MS and PhD in Civil Engineering from Lehigh University
and is a registered professional engineer in Virginia. He served
in a variety of military engineering assignments in the United
States, Europe, and Central Asia. He has focused his scholarly and
professional work on engineering education and has won numerous
national awards for engineering education and service.
i
Table of Contents
About Stephen Ressler . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . i

Scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
1 Learning from Failure: Three Vignettes . . . . . . . . . . . . . . . . . . . 3
2 Flawed Design Concept: The Dee Bridge . . . . . . . . . . . . . . . . . . 11
3 Wind Loading: The Tay Bridge . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
4 Rainwater Loading: Kemper Arena . . . . . . . . . . . . . . . . . . . . . . . 32
5 Earthquake Loading: The Cypress Structure . . . . . . . . . . . . . . 40
6 Vehicle Collisions: Land and Sea . . . . . . . . . . . . . . . . . . . . . . . . 51
7 Blast Loading: The Murrah Federal Building . . . . . . . . . . . . . . 60
8 Structural Response: The Hyatt Regency Walkways . . . . . . . 69
9 Bridge Aerodynamics: Galloping Gertie . . . . . . . . . . . . . . . . . . 79
10 Dynamic Response: London’s Wobbly Bridge . . . . . . . . . . . . . 91

11 Dynamic Response: Boston’s Plywood Palace . . . . . . . . . . . 101
12 Stone Masonry: Beauvais Cathedral . . . . . . . . . . . . . . . . . . . . . 111
13 Experiment in Iron: The Ashtabula Bridge . . . . . . . . . . . . . . . 122
14 Shear in Concrete: The FIU Pedestrian Bridge . . . . . . . . . . . 133
15 House of Cards: Ronan Point . . . . . . . . . . . . . . . . . . . . . . . . . . . 143
16 Brittle Fracture: The Great Molasses Flood . . . . . . . . . . . . . . 152
ii
Table of Contents
17 Stress Corrosion: The Silver Bridge . . . . . . . . . . . . . . . . . . . . . 161

18 Soil and Settlement: The Leaning Tower of Pisa . . . . . . . . . 170
19 Water in Soil: Teton Dam and Niigata . . . . . . . . . . . . . . . . . . . 178
20 Construction Engineering: Two Failed Lifts . . . . . . . . . . . . . . 187
21 Maintenance Malpractice: The Mianus River Bridge . . . . . . 195
22 Decision-Making: The Challenger Disaster . . . . . . . . . . . . . . 205
23 Nuclear Meltdown: Chernobyl . . . . . . . . . . . . . . . . . . . . . . . . . . 216
24 Blowout: Deepwater Horizon . . . . . . . . . . . . . . . . . . . . . . . . . . . 228
25 Corporate Culture: The Boeing 737 MAX . . . . . . . . . . . . . . . . 240
26 Learning from Failure: Hurricane Katrina . . . . . . . . . . . . . . . . 252
Quiz . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 264
Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 273
Bibliography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 302
iii
Table of Contents
iv
Scope
Engineering is the application of math, science, technology, and experience

to create technological solutions that serve human needs. Throughout the
history of human civilization, the engineering enterprise has greatly enhanced
our prosperity and quality of life. Yet this process has sometimes gone awry,
resulting in disastrous failures that have claimed many lives and caused
extensive damage to property and our environment.
In this course, you will explore 33 examples of engineering failures ranging

from the collapse of a medieval cathedral to the crash of a 21st-century
jetliner. The disasters in these case studies are all very different in terms of
time, place, scope, severity, cause, and technologies involved, yet they all
exhibit three important commonalities:
1 All these failures occurred because one or more aspects of the

engineering process went terribly wrong. Thus, to understand how and
why these engineering failures happened, you must first understand the
engineering process itself.
2 These failures demonstrate that engineering is a fundamentally human

endeavor. Engineers are human, and humans make mistakes. More
importantly, engineering failures are often profoundly influenced by the
social, political, economic, and organizational contexts within which
technological solutions are developed.
3 These case studies demonstrate that engineering failures often result

from the pursuit of technological advancement itself. Anytime an
engineer designs something fundamentally new, they are venturing
into the unknown—and therefore incurring some risk. This sort of
risk inevitably leads to failures. Yet, when such failures occur, they
invariably stimulate the development of new knowledge, tools, and
standards aimed at preventing similar failures in the future. These
new developments strengthen the engineering design process and thus
1
Scope
enable further technological advances. In this sense, failure is integral to

the advancement of engineering. Learning from failure is the principal
theme of this course.
Because every engineering failure results from one or more breakdowns in

the engineering process, the process itself provides a powerful framework
for analyzing these events and gleaning deep insights from them. Thus, the
case studies in this course are organized according to their primary cause of
failure, and these causes are sequenced according to the phases of the design
process. You will consider a series of structural failures caused primarily by:
` a fundamentally flawed design concept;
` failure to properly account for particular types of loading;
` unanticipated structural responses;
` inadequate resistance of structural members, connections, and foundations;
` flawed construction technologies; or
` inadequate maintenance.
The first 21 lessons address engineering failures that are primarily structural
in nature. Many involve traditional structures like buildings, bridges, towers,
and dams. But you will also explore the failures of aircraft, ships, and a huge
storage tank filled with molasses—all of which are structures in the sense that
they must safely carry loads to fulfill their respective functions.
Then, in the final five lessons, you will consider a series of fascinating
cases that are not structural in nature, but rather involve mechanical,
electrical, nuclear, and systemic failures—often exacerbated by the flawed
organizational dynamics of corporations or governmental bodies.
Many of the case studies covered in this course are quite familiar. The collapse
of the Tacoma Narrows Bridge (“Galloping Gertie”), the explosion of the space
shuttle Challenger, the nuclear meltdown at Chernobyl, and the failure of the
New Orleans hurricane protection system during Hurricane Katrina are prime
examples. Others—such as the Dee Bridge disaster, the Kemper Arena roof
collapse, and the Teton Dam failure—are less familiar but equally important.
In each of these cases, engineers learned from failure—and you will too!
2
1
Learning from
Failure: Three
Vignettes
This course examines a series of historical
case studies, each involving an engineering
failure that’s been instrumental in advancing
technological progress. In each case, the
engineering design, relevant scientific
principles, causes of failure, and impacts on
future engineering practice will be explored.
The human dimension of each case—the
historical context, key players’ decisions,
and the human cost of these tragic events—
will also be considered. Overall, you’ll learn
about engineering failures caused by flawed
design concepts, unanticipated structural
responses, and inadequate maintenance,
among other aspects.
3
1. Learning from Failure: Three Vignettes
Hurricane Katrina
On August 28, 2005, in New Orleans, Louisiana, Hurricane Katrina crossed
the Gulf of Mexico, attaining Category 5 strength. The next morning,
Katrina made landfall about 55 miles southeast of New Orleans. It had
weakened to Category 3 (with sustained winds of 125 mph). Katrina’s eye
would pass within 20 miles of New Orleans before continuing inland.
New Orleans had been preparing for this since Hurricane Betsy in 1965.
Congress had passed flood control legislation directing the US Army Corps
of Engineers to develop a comprehensive hurricane protection system for the
city and surrounding region. New Orleans received special attention because
of its vulnerable location on low-lying ground, sandwiched between a river
and a lake and protected only by earth embankments (called levees). The new
hurricane protection system would consist of floodwalls and enhanced levees,
forming a continuous barrier. It would line the shore of Lake Pontchartrain
and the canals extending from the lake into the city. This system was only
90% complete by August 2005 but had still survived near misses by major
hurricanes in 1974, 1985, and 1992.
But as Katrina’s winds swept across Lakes Borgne and Pontchartrain, they
drove a massive storm surge toward the city. Several levees along the Gulf
Intracoastal Waterway were overtopped and washed away. As the surge
4
reached its peak, floodwalls along the Industrial Canal, 17th Street Canal,
and London Avenue Canal toppled. Ultimately, the hurricane protection
system was breached at more than 50 locations.
For example, along the London Avenue Canal, the floodwall comprised
sheet piling linked together at the edges, driven into the ground along a
levee, and capped with a wall made of reinforced concrete. The canal was
built on a thin layer of local marsh soil, underlain by a thick layer of sand. As
the storm surge started building, the pressure caused by the water’s weight
caused seepage into the sand, beneath the sheet piling, and then back up
to the surface on the downstream side. The water lifted the soil particles
upward, counterbalancing the soil’s weight. Thus, the forces of internal
friction holding the soil particles together dropped to zero, and liquefaction
occurred. As the floodwall was supported only at its base, when the soil on its
downstream side washed away, the entire structure was toppled by the wall of
water behind it. With Lake Pontchartrain pouring into New Orleans through
many such breaches, 80% of the city was flooded.
The Hyatt Regency

Walkway Collapse
On July 17, 1981, Kansas City’s new Hyatt Regency Hotel was hosting a
tea dance in its four-story-tall atrium. About 100 guests were observing
the festivities from the three walkways suspended from the roof at the
second‑, third‑, and fourth-floor levels. At 7:05 pm, the second- and fourth-
floor walkways sagged sharply and plummeted to the floor. In total, 114
people died.
This disaster was caused primarily by organization and communication

failures among the people who designed and built the hotel. However, the
key engineering issue was simple. Each deck of the second- and fourth-floor
walkways was supported on a series of box beams made of steel, which were
suspended from the roof structure by steel hangers, running continuously
down through the fourth-floor to the second-floor beams. A nut retained the
beam at each level.
5
At the upper beam, the only way to get the nut to its required position was
to thread the entire lower portion of the rod 30 feet into the actual structure.
When this design was communicated to the steel fabricator, he recognized
its impracticality and proposed an alternative. Rather than using full-length
continuous hanger rods, this modified configuration used pairs of half-length
rods—one running from the roof structure to the upper beam and a second
running from the upper to the lower beam. Only a few inches at the ends of
each rod had to be threaded.
But this revised configuration was also structurally problematic. Gravity load
refers to any load caused by weight. Here, the gravity loads were the weights
of the walkway and the people standing on it. In the alternative configuration,
the upper beam carried both the fourth- and second-floor loads. The lower
walkway’s weight was transmitted through the lower hanger rod and the
outer segment of the upper beam to the upper hanger rod and then to the roof
structure. Subjected to twice as much load as they were designed to carry,
the upper rods pulled through the ends of the upper beams, causing both
walkways to break free and fall.
The Dee Bridge Collapse

At 6:20 pm on May 24, 1847, a passenger train on the Shrewsbury & Chester
Railway departed from Chester Station en route to Ruabon, Wales. Outside
of Chester, the railroad line crossed the River Dee on a three-span iron bridge
constructed eight months earlier and designed by Robert Stephenson.
The train—a 30-ton locomotive pulling its tender and five carriages—crossed
the first two spans of the Dee Bridge without incident. But as it reached the
middle of the third span, the driver felt the machine sinking beneath his feet.
He applied full steam, and the locomotive barely managed to reach terra
firma as the bridge collapsed behind him. The passenger carriages broke free
and plunged to the river below. In total, 5 people died, and the remaining 19
were injured.
The most likely cause of the collapse was fatigue. Fatigue failures originate at
defects in metal. In structures of cast iron from the mid-19th century, such
flaws resulted from the crude fabrication process. Say there is a small cut on the
6
bottom surface of a cast-iron girder. Repetitive loading causes that small defect
to gradually grow into a crack. The crack enlarges with each subsequent loading
until it reaches a critical length, at which point the girder fractures suddenly.
The Engineering Process

These tragedies were engineering failures that occurred because one or more
aspects of the following engineering process went wrong:
` Every engineering challenge begins with a need. In the Hyatt Regency

case, the building’s architectural plan comprised a 40-story tower, a service
block, and a central atrium. The suspended walkways were included in the
design so that people could walk between the tower and service block on
the upper levels.
` PHASE 1: In response to this need, the engineer develops a design

concept. The Hyatt Regency walkway concept comprised concrete decks
supported on steel box beams suspended from hangers.
` PHASE 2: The designer estimates the loads—the maximum forces the

structure is expected to carry throughout its lifetime. The Hyatt walkways
were designed to carry two principal gravity loads—the structure’s own
weight plus the weight of people standing shoulder-to-shoulder across its
full length and width. This was specified in the local building code as 100
pounds per square foot of floor area. But code-specified loading can only be
estimated during design because the actual worst-case loading is an unknown.
` PHASE 3: When loads are applied to a structure, they cause a response,

which includes internal forces developed within the individual structural
members and associated deformations. If a structural member is being
stretched or elongated, the internal force is tension. If the member is being
shortened, it is compression. If it undergoes angular distortion, it is shear.
The design engineer analyzes the structural response to calculate the

internal forces caused by the estimated loads. For example, in the Hyatt
Regency design, when the estimated total weight of the structure and
people was applied to the second‑ and fourth-floor walkways, the internal
force in each upper hanger rod was calculated as about 41,000 pounds.
7
` PHASE 4: The engineer chooses the material, size, and shape of the
structural members, connections, and foundation elements such that they’re
strong enough to resist the calculated internal forces. For example, the
structural engineer who designed the Hyatt walkways determined the hangers
could be fabricated from 1.25-inch-diameter steel rods, each of which could
carry about 74,000 pounds of internal force before failing in tension.
The internal force at which a structural element fails is called its strength.
The strength of these rods was significantly larger than the actual internal
force they were expected to experience. The ratio between these two
numbers is the safety factor—the failure condition divided by the actual
condition. It represents the extent to which a design can accommodate
uncertainties. The safety factor must always be greater than 1; for the
Hyatt Regency hanger rods, it was 1.8, corresponding to an 80% margin
of error. This is a respectable safety level, but unfortunately, the weak
link was the steel box beams. For these beams, the safety factor was never
checked because of communication breakdowns and management issues.
` PHASE 5: The design consists of a set of plans and specifications

provided to a general contractor, who will fabricate and construct the
facility. For major projects, the general contractor typically employs many
subcontractors to perform specialized tasks.
This is where the Hyatt Regency walkway design went awry. The steel
fabricator determined that the engineer’s concept for the fourth-floor
rod-to-beam connection was impractical. He changed the connection
and inadvertently doubled the internal force applied to the walkway’s
supporting beams, radically altering the structural response. Then, the
engineer approved the fabricator’s change without scrutinizing it.
` PHASE 6: The structure is operated and maintained. One year into this
phase, the Hyatt Regency walkways collapsed under a routine loading that
was substantially less than the structure was designed to carry due to a
flawed steel connection and flawed organizational dynamics.
Our understanding of an engineering failure can be enhanced by considering

the design process. For example, the immediate cause of the Dee Bridge
collapse was probably inadequate fatigue resistance of a cast-iron girder—a
8
shortcoming in phase 4. However, there were also significant contributing

factors in several other phases, most importantly in phase 1, with Stephenson’s
fundamentally flawed design concept.
Human Influence
Although the engineering process relies on math and science, most
engineering designs are at least as strongly influenced by social, political, and
economic considerations.
` The flawed New Orleans floodwall design was strongly influenced by local
residents’ opposition to a more effective but intrusive design solution.
` The Hyatt Regency disaster resulted from organizational dysfunction

exacerbated by the building owner’s demand for an accelerated
construction schedule.
` Stephenson’s Dee Bridge design would have been a traditional brick arch
structure if local navigation interests hadn’t protested that it would impede
vessel movement on the River Dee.
Failure Stimulates Development

Many engineering failures also result from the pursuit of technological
advancement itself. An engineer might apply all available knowledge, tools,
and standards to ensure a design fulfills its purpose and is safe. But if the
technological product is unique or unprecedented, there’s a nonzero chance that
some unanticipated or poorly understood phenomenon will cause a failure.
Nonetheless, such failures invariably stimulate the development of new

knowledge, tools, and standards aimed at preventing similar failures. These
new developments strengthen the engineering design process and enable
further technological advances.
` After the Dee Bridge disaster, British engineers instituted substantially

higher safety factors for the use of cast iron in bridges.
9
` After the Hyatt Regency walkway collapse, the US engineering profession

instituted policies that more clearly delineate responsibilities for structural
connection design.
` After Hurricane Katrina, the US Army Corps of Engineers improved their

processes for hurricane protection system design—and rebuilt the New
Orleans system to a substantially higher standard.
Reading
Akesson, Understanding Bridge Collapses.
Delatte, Beyond Failure.
Levy and Salvadori, Why Buildings Fall Down.
Petroski, Design Paradigms.
———, To Engineer Is Human.
———, To Forgive Design.
Wearne, Collapse.
10
2
Flawed Design
Concept: The
Dee Bridge
The Dee Bridge disaster of 1847 was one
of the most serious railroad accidents to
have occurred during the era when railroad
technology was only just coming of age.
This lesson will take a deep dive into the
disaster, for which the primary cause was a
flawed design concept. Here, you will learn
about the collapse mechanism and causes of
this engineering failure and also explore the
lessons learned and implemented for future
engineering practice.
11
2. Flawed Design Concept: The Dee Bridge
The Dee Bridge Disaster

Background
At 6:20 pm on May 24, 1847, a passenger train on the
railway line from Chester, England, to Ruabon, Wales,
was crossing the recently constructed three-span iron
bridge across the River Dee. As the 30-ton locomotive
reached the middle of the third span, the bridge
collapsed. The train’s five carriages plunged to the
river below, killing 5 of the 25 people on board and
injuring 19.
The steam locomotive was invented in 1802, but

it took 10 years before a commercially successful Robert Stephenson
engine went into operation. In 1825, the Stockton
& Darlington Railway became the world’s first public railroad to use steam
locomotives. In the next few years, Robert Stephenson designed and built
12
some of the most iconic locomotives of the era, including the famous Rocket.
With the acquisition of Stephenson’s Rocket, the Liverpool and Manchester
Railway went into operation in 1830 as the world’s first true intercity
passenger railroad.
Over the next two decades, small private railway companies established
independent local rail links across Great Britain. Eventually, these links
coalesced into a national rail network. This railway mania was rapid,
decentralized, and largely unregulated. Perhaps inevitably, accidents
happened with increasing frequency and severity. In response, Parliament
passed the Railway Regulation Act of 1840, which provided for railroad
safety inspections and established a new agency—Her Majesty’s Railway
Inspectorate—charged with investigating accidents and making
recommendations to prevent future occurrences.
The Dee Bridge disaster was among the first major accident investigations
performed by the inspectorate. Captain John Lintorn Simmons conducted
the inquiry at the bridge site, examining the wreckage and documenting it
with detailed drawings. He performed a series of physical tests by having
locomotives drive onto the surviving spans and measuring their structural
response. He interviewed eyewitnesses, survivors, and the engineer who
designed the bridge and documented their testimony. Based on the
information he collected, Simmons reconstructed the sequence of events and
wrote a final report identifying the probable causes of the failure.
The Dee Bridge Girders

The bridge was designed to carry two parallel lines of the Chester and
Holyhead Railway across the 250-foot-wide River Dee. Robert Stephenson’s
initial plan was to use a series of five 60-foot-long brick arches to cross
the river. But local navigation interests protested this because the arches
might obstruct the passage of boats on the river. After his site investigation
suggested the load-carrying capacity of the soil beneath the riverbed was
inadequate, Stephenson changed his design concept to three iron spans
supported on two stone abutments built into the riverbanks and two stone
piers constructed in the channel. Spanning the 98-foot gap between each pair
of supports was the longest iron girder attempted at that time.
13
A girder is a main load-carrying beam in a structural system. A beam is a

member loaded perpendicular to its axis that carries a load by bending (or
flexure). All three types of internal force—tension, compression, and shear—
are present in this beam. The shape we see when viewing a beam from the end
is called its cross section. A more efficient alternative to a rectangular cross
section is an I shape, comprising two horizontal elements called flanges and
a vertical element called the web. When the beam is loaded, the top flange is
in compression, the bottom flange is in tension, and the web carries most of
the internal shear. A beam with an I-shaped cross section resists bending more
efficiently than a rectangular beam. A larger proportion of the I-shaped cross
section is farther away from the beam’s neutral axis.
Both beam types use the same amount of material, but the I shape is nine
times stronger than the rectangular shape. The Dee Bridge girder was
I-shaped, but the cross section was asymmetrical, with the bottom flange
much larger than the top flange. Cast iron is about five times weaker in
tension than in compression. Thus, Stephenson designed this girder with its
bottom flange five times larger than its top flange. He wanted to distribute
the internal tension force over a larger area, reducing its intensity by a factor of
five to compensate for cast iron’s weakness in tension. In short, Stephenson’s
asymmetrical cross section was matched to cast iron’s asymmetrical properties
to optimize the girder’s load-carrying efficiency.
The profile of Stephenson’s Dee Bridge girder is also unusual. The iron
foundries of this era couldn’t cast a 100-foot-long structural element. Thus,
each girder was cast in three shorter segments, bolted end to end, and
strengthened with elaborate splices to provide continuity across the joints.
Similar curved castings were bolted to the ends of the girder to serve as
attachment points for a pair of chains, each composed of three main links
made from wrought iron. Each link comprised eight parallel elements called
eyebars, connected with heavy iron pins.
These eyebar chains served two purposes. Most importantly, they were
intended to strengthen the girder. At the time, cast-iron bridge girders had
been in use for less than a decade but had already demonstrated a tendency to
fail unpredictably after extended periods of trouble-free service—apparently
14
due to the repetitive, dynamic nature of railroad loading. Today, we recognize

this as metal fatigue, but back then, these failures could be explained only as
an unpredictable weakening of cast iron over time.
Recognizing this vulnerability, Stephenson added the wrought-iron eyebar

chains to supplement the girders’ bending strength—and to provide
redundant load-carrying capacity in case the girder failed. Because fatigue
failures always occur in materials experiencing tension, the chains were
placed near the bottom of the girder’s middle segment, where the largest
internal tension force occurs. The chains were made of wrought iron, which is
substantially stronger than cast iron in tension.
The second purpose of the eyebar chains was to provide a mechanism for
eliminating the inevitable sag caused by the bridge’s weight. In a simplified
model, each eyebar chain is pinned to the outer ends of the girder. The inner
pins pass through oversized holes in the web and are connected to the girder
only by vertical bolts, which extend down through the lower flange and are
secured with nuts. When a load is added, the girder sags, which would be
problematic for trains crossing the bridge. However, tightening the two nuts
lifts the girder at the two points of attachment, eliminating the sag. The Dee
Bridge design used two vertical bolts at each connection.
Girder Fractures
Each bridge span comprised two girders, placed 12 feet apart and linked with
wrought-iron tie bars. Timber crossbeams were laid across the girders’ bottom
flanges, supporting a wooden deck. Three such spans were required to carry
one set of railroad tracks from abutment to abutment, and an identical set
of three spans constituted an essentially independent bridge for the second
railway line. Along each bridge, the main rails were supplemented by a pair of
guardrails designed to prevent trains from derailing. The guardrails restrained
the flanges on the train’s wheels from moving laterally in both directions.
During the two months between its completion and the initiation of
passenger service, the bridge was used extensively by trains carrying
construction materials to support ongoing work farther up the line. From
opening day onward, numerous trains crossed the bridge daily. On the
morning of May 24, 1847, six trains crossed without incident. Then, the
15
railway was temporarily closed as Stephenson supervised the placement of a

five-inch layer of crushed stone over the entire bridge deck. This new stone
layer would prevent the deck from catching on fire from sparks from a passing
locomotive. That evening, the bridge was reopened. As the next train to cross
passed the center of the westernmost span, one of the span’s two main girders
fractured and fell, spilling the deck, the rails, and the train’s five carriages into
the river.
Three days later, Captain Simmons began his investigation to identify the
causes of failure from the perspective of railway safety. A week later, a jury
trial was convened to determine responsibility for the five deaths. In his
testimony, Stephenson claimed the collapse must have been caused by the
train derailing and colliding with one of the girders. The jury rejected this
based on eyewitness testimony that the fracture had occurred while the train
was still on the rails—and because the guardrails included in the design
reduced the likelihood of derailment.
Hammer Blow
It’s important to distinguish between the collapse mechanism, or the physical
phenomenon that caused the problem, and the underlying causes of failure,
which typically involve human errors, omissions, or lack of knowledge during
the design process. Concerning the collapse mechanism, no one could make
a definitive determination, and the crucial physical evidence—the fractured
girder—wasn’t preserved. The only theory that can explain why the Dee
Bridge carried three 30-ton locomotives successfully in September 1846 and
then failed under the weight of a single 30-ton locomotive eight months
later is fatigue—a failure mode to which cast iron is particularly susceptible.
According to this theory, repeated train crossings caused a small defect in the
cast iron to grow into a crack, which elongated with each successive crossing
until it reached the critical length for a sudden catastrophic fracture.
Focusing on load estimation, Stephenson designed the Dee Bridge to carry

two types of gravity loads: the bridge’s own weight and a vehicular load.
He accurately estimated the weight of each span as 90 tons, and he used a
vehicular load of 90 tons, assuming that the structure’s worst-case loading
condition would be three locomotives crossing a given span simultaneously.
The locomotives of that era weighed approximately 30 tons; thus, 90 tons
16
was a reasonable estimate of the total static vehicular load. However, it failed
to consider the substantial additional dynamic loading associated with steam
locomotives—hammer blow.
The wheels of a steam locomotive are driven by a pair of pistons, enclosed

within cylinders on either side of the engine and driven by steam pressure in
a reciprocating motion. As the pistons reciprocate, the locomotive rotates
in the opposite direction. These rotational oscillations could damage the
locomotive and railway. Thus, locomotive designers attempted to minimize
the effect by adding counterweights to the drive wheels. The horizontal
motion of the counterweights is always opposite the piston’s motion, and the
two moving masses effectively cancel each other out horizontally.
However, with each turn of the unbalanced drive wheels, the upward and
downward acceleration of these counterweights causes cyclic vertical
forces—or hammer blow. The magnitude of these dynamic forces can
approach 20% of a locomotive’s static weight—meaning a 30-ton locomotive
might apply a peak loading of 36 tons to a bridge. Hammer blow also
contributes substantially to fatigue damage. Because the cyclic vertical force
is applied with each turn of the drive wheels, a locomotive crossing the Dee
Bridge would have applied four or five load cycles per span rather than one—
and each cycle would cause fatigue cracks to grow.
Estimated Vehicular Load

In the 1840s, the sole computational tool available to analyze the structural
response and design for adequate resistance for a cast-iron girder was
Hodgkinson’s formula. This formula predicts the breaking load of a cast-
iron beam—the force, W (in tons), at which the beam could be expected to
fail. The other terms of the equation include A, the cross-sectional area of
the bottom flange; D, the depth of the cross section; and L, the beam’s length.
Stephenson used this formula to determine the dimensions of the Dee Bridge
girders such that the two girders supporting each span would have a total
breaking load of 280 tons.
Remember that the safety factor is the failure condition divided by the
actual condition. Thus, with a failure load of 280 tons and (estimated)
actual loads comprising the bridge’s 90-ton weight plus a 90-ton vehicular
17
load, the girders’ nominal safety factor was 1.6, providing a 60% margin
of error. Today, a safety factor of 1.6 might be minimally adequate in some
circumstances. For a cast-iron railroad bridge in the 1840s, it was certainly
too low.
First, Stephenson’s estimated vehicular load didn’t account for hammer

blow—which increased the effective loading up to 20%. Second,
Hodgkinson’s formula itself was problematic in several respects. Hodgkinson
derived his formula from laboratory experiments on only 10 cast-iron beam
specimens, and the scatter in his data was large. Most disturbingly, the
experimental breaking load was 26% below the predicted value. Moreover,
Hodgkinson’s experiments were performed on small-scale beams, measuring
only four to seven feet long. Large iron castings tend to be weaker than
small ones, making the applicability of these data to Stephenson’s massive
girders questionable. Third, the safety factor was further compromised by
Stephenson’s addition of stone fireproofing to the bridge on the day of the
disaster. The stone weighed 18 tons per span. He had designed the bridge
to carry three 30-ton locomotives. Thus, as long as no more than two
were allowed to cross the bridge simultaneously, the structure would never
experience its full design load, even with the additional 18 tons of stone. In
reality, the structure failed under the weight of a single locomotive, meaning
the added stone must have contributed significantly to the collapse.
Evidently, these three issues eroded much of the 60% margin of error
incorporated in the design, and fatigue damage claimed the rest. According
to Captain Simmons’s report, a safety factor of 3 was the norm for cast-iron
girders during this era. But this unofficial standard of practice didn’t account
for Stephenson’s inclusion of supplemental eyebar chains in the design, and
neither did Hodgkinson’s formula.
The Fatal Flaw

The fundamental cause of the Dee Bridge disaster was a major design flaw—
the eyebar chains simply didn’t work. When a beam bends, its outer ends
rotate inward. Because the eyebar chains were attached several feet above the
girder’s upper flange, these points of attachment would have moved inward
by about an inch whenever the girder flexed under the load of a passing train.
18
To fulfill their purpose, the eyebar chains were supposed to stretch in tension,
but this inward movement of their attachment points caused them to go slack.
Consequently, they contributed little or nothing to the girders’ strength.
Note that the general concept of using tension reinforcement to strengthen

a brittle material is valid. In Stephenson’s design, the fault was the
implementation. Also, note that Stephenson’s eyebar chains would have
worked fine if their outer ends had been attached at the beam’s neutral axis.
The attachment points wouldn’t move inward when the beam flexed, and the
chains could develop the tension force necessary to strengthen the girders.
In summary, Stephenson’s Dee Bridge design was fatally compromised by

its low safety factor—which was eroded by locomotive hammer blow, the
inaccuracy of Hodgkinson’s formula, and 18 tons of stone fireproofing.
Stephenson expected his eyebar-chain reinforcing system to compensate for
such shortcomings, but the system didn’t work. Ultimately, the jury ruled
that the deaths were accidental and that Stephenson wasn’t negligent. This
reflected a recognition that the design was largely within the norms of mid-
19th-century engineering practice. More importantly, the jury saw a larger
issue—the widespread use of cast iron.
Two months later, Her Majesty’s Government established the Royal

Commission into the Application of Iron to Railway Structures. The
commission surveyed existing iron bridges, conducted experiments, and took
testimonies from many of Britain’s most accomplished engineers. In its final
report of July 1849, the commission condemned the use of eyebar-reinforced
cast-iron girders and recommended that cast-iron beams in railroad bridges
be designed for a safety factor of 6—an increase attributed to cast iron’s
vulnerability to fatigue and the dynamic effects of moving locomotives.
Lessons Learned
First, this case demonstrates that failure is a powerful stimulus for engineering
advancement. It took the Dee Bridge disaster to focus attention on the risk
of using cast-iron girders and to mobilize the political will and governmental
resources to deal with it.
19
Second, this case is typical of most engineering failures in that it resulted

from the combined effects of multiple causes. Because engineering is a human
endeavor, engineers inevitably make mistakes. Yet, in most cases, isolated
errors don’t cause failures because of the ample safety factors built into most
designs. Disasters happen only on the rare occasions when so many things go
wrong that the safety factor can’t compensate for them simultaneously.
Reading
Gagg and Lewis, “The Rise and Fall of Cast Iron in Victorian Structures.”
Lewis and Gagg, “Aesthetics versus Function.”
Simmons and Walker, “Report to the Commissioners of Railways.”
Taylor, “Iron, Engineering and Architectural History in Crisis.”
20
3
Wind Loading:
The Tay Bridge
The engineering advances stimulated by
the Dee Bridge disaster engendered a new
spirit of confidence among British engineers.
This newfound confidence led to the design
of vastly more ambitious structures, and
that overconfidence then led to a disaster
of even greater proportions. This lesson will
consider wind loading and the Tay Bridge
collapse. This course has advanced to phase
2 of structural design with a case where the
engineer’s flawed estimation of loads resulted
in catastrophe.
21
3. Wind Loading: The Tay Bridge
The Tay Bridge Collapse

On December 28, 1879, in eastern Scotland, around 5:00 pm, a fierce gale
moved in from the west. By 7:00 pm, the wind was gusting at 80 mph across
the Firth of Tay. At 7:08 pm, a North British Railway train carrying 70
passengers and 5 crewmen from Edinburgh to Dundee departed from its
next-to-last stop, two miles south of the Firth. To reach Dundee, the train
would cross the 86-span Firth of Tay Bridge.
The two-mile-long bridge carried one rail line; thus, the railway had instituted
a token system to manage two-way traffic. The driver of a northbound train
had to pick up a baton from a signal cabin located on the southern approach
to the bridge and deposit it at a cabin on the northern side after crossing.
No train could cross without the baton. Therefore, two trains traveling in
opposite directions could never occupy the bridge simultaneously.
That evening, signalman Thomas Barclay was on duty at the southern cabin
with his friend John Watt. At 7:13 pm, as the Edinburgh-to-Dundee train
came by, Barclay handed the baton to the driver. Watt was standing at the
window, watching the train. As it moved onto the bridge, he saw sparks flying
from its iron wheels—indicating the wind was pushing the train sideways
with such force that its wheel flanges were grinding against the iron rails’
22
sides. About three minutes later, as the train approached the middle of the
bridge, Watt saw a bright flash of light—and then nothing. Watt told Barclay
that the train seemed to have derailed. When the men went to the shoreline,
they saw that a 3,000-foot section of the bridge had vanished.
The Tay Bridge Design

In the mid-1840s, the newly established North British Railway began
expanding its reach in eastern Scotland. In 1862, North British Railway
acquired the Edinburgh-to-Dundee line, which was constrained by the need
to carry its trains across the Firth of Forth and the Firth of Tay on steam-
powered ferryboats. To ensure the line’s long-term economic viability, the two
firths had to be bridged. Finally, in 1870, an act of Parliament authorized
North British Railway to bridge the Firth of Tay. Thomas Bouch was named
chief engineer for the project. He had already designed innovative ferry
systems, built several major railways, and pioneered the use of lattice girders
in railroad bridges.
A lattice girder is a structural framework comprising horizontal elements

called chords at the top and bottom, interconnected by a lattice of
intersecting diagonals. The lattice girder’s chords correspond to the flanges
23
of a solid girder, and the lattice corresponds to the girder’s web. These two
structural elements carry load in essentially the same way. When subjected
to a transverse load, they bend, resulting in compression on top, tension on
the bottom, and shear in the lattice or web. However, the lattice girder carries
load more efficiently because the lattice uses less material than a solid web.
Bouch’s design concept for the Tay Bridge was to carry a single rail line across
the two-mile-wide estuary on 86 wrought-iron lattice girder spans supported
on masonry piers. For most spans, the rail line was mounted on top of the
girders, but for the longer spans crossing the estuary’s navigable channel, the
rails were supported on the girders’ bottom chords. The trains would pass
through the girders rather than above them. These spans—the high girders—
provided the required 88-foot overhead clearance for tall ships passing
beneath the bridge.
By 1871, Bouch’s design was complete, and the project commenced with
construction of the masonry piers, starting at the southern shore and working
northward. To build the foundations underwater, the key technology was an
iron enclosure called a caisson. Open on the top and bottom but otherwise
watertight, the caisson was prefabricated on shore, barged to its designated
position, and lowered to the riverbed. Temporary cylindrical segments were
bolted on top; thus, the upper rim would always extend above the water
level. Then, the water was pumped out, allowing workers to descend into the
caisson to excavate the soft sand and mud from the riverbed. As this soil was
removed, the caisson gradually sank until it reached bedrock. It was then
lined with brick and filled with concrete to create a firm foundation for the
pier. Finally, the temporary segments were removed, and the pier was built on
this foundation.
This process worked well for the first 14 piers. But in May 1873, as the 15th
caisson was being emplaced, the excavators found no bedrock but rather a
four-foot-thick stratum of conglomerate rock, below which was more sand
and mud. Bouch had to redesign the entire bridge. He decided to replace the
planned brick-and-concrete piers with lightweight iron towers so that the
bridge could be supported safely on that stratum of conglomerate.
24
Construction of the Bridge

Construction began with emplacement of the pier foundation, using the same
process discussed previously but with a larger cylindrical caisson. This larger
foundation distributed the bridge’s weight across a broader area, reducing the
pressure on the underlying conglomerate stratum. Once the caisson was lined
with brick and filled with concrete, a plinth was built on its upper surface.
The plinth was a brick shell filled with concrete and capped with four courses
of sandstone masonry, bringing its top surface above the high water level—
and allowing the caisson’s upper segments to be removed.
Points of attachment for the iron towers were installed in the plinth by
drilling holes through the top two courses of stone and securing wedge-
shaped wrought-iron anchor bolts into these holes with concrete. These bolts
were used to secure six cast-iron baseplates, to which cast-iron columns were
attached. Each column segment was an 11-foot-tall pipe, with integrally cast
flanges and lugs at the upper and lower ends. Each lug was a projection with a
bolt hole to which additional structural elements could be fastened.
These columns were laterally supported by a network of wrought-iron

members—horizontal struts and diagonal tie bars—bolted to the lugs on
the columns. To achieve the required height, six more of these modules were
bolted on top of the first. Each three-column grouping was capped with an
L-shaped wrought-iron box girder, a longitudinal box girder, and cast-iron
bearings. These supported the high girders while allowing for the bridge’s
thermal expansion and contraction.
Each high girder comprised two main trusses, laterally connected with
transverse struts and diagonals. The railway was supported on closely spaced
fish-bellied beams. Mounted on top of the bottom chords, these beams
supported the wooden deck on which the railroad rails were mounted. Most
of the adjacent high-girder spans were connected with riveted iron plates to
increase their load-carrying efficiency.
Construction was completed in early 1878. The bridge was inspected and load
tested by the UK’s Board of Trade and placed into service in June. At that time,
North British Railway retained Bouch as maintenance manager for the bridge.
25
The Inquiry
After the disaster, the Board of Trade established a three-man court of
inquiry, which began on January 3, 1880. The court’s presiding officer
was Henry Rothery, a lawyer who also served as the UK’s Commissioner
of Wrecks, and the other two members were engineers—Colonel William
Yolland, Inspector of Railways, and William Barlow, president of the
Institution of Civil Engineers.
In addition to taking testimony from eyewitnesses and experts, the court

initiated a salvage operation to recover the wrecked bridge from the Tay,
appointed engineer Henry Law to perform an independent structural
analysis, contracted for materials testing of salvaged bridge components, and
commissioned a photographic survey. A key witness before the inquiry was
Bouch. He testified that the gale-force winds on the evening of December
28 must have caused the train to derail and strike one of the high girders,
triggering the collapse. However, the salvaged high girders didn’t exhibit
collision damage.
The physical evidence strongly indicated that the high girders fell because
their supporting piers had been toppled by the force
of the wind. Thus, the court examined Bouch’s
consideration of wind loading. In structural
engineering, a wind load is typically defined
as a pressure. For example, modern building
codes specify that structures built in
California must be able to withstand a wind
pressure of about 20 pounds per square foot
(psf), meaning a force of 20 pounds is applied
to every square foot of surfaces facing the wind.
This code-specified loading can vary widely
depending on geographic location.
When the court of inquiry asked

what wind pressure was used in the
Tay Bridge design, Bouch said he
had made no special allowance for
Thomas Bouch
26
wind loading. He explained that this was justified by guidance from the
Astronomer Royal of the UK, Sir George Airy. Bouch had consulted with
Airy in 1873, when designing the bridge across the Firth of Forth. Airy had
reported that Scotland’s localized wind pressure might exceed 40 psf over a
short distance; however, the average pressure over the 1,600-foot spans of the
proposed Firth of Forth suspension bridge could reasonably be estimated at
10 psf. Thus, Bouch concluded that wind loading could be ignored in his Tay
Bridge design. The court rejected this as a misapplication of Airy’s guidance
because the bridge’s individual spans were much shorter than 1,600 feet and
wouldn’t benefit from the averaging effect Airy had described. The court also
heard testimony that, at the time, engineers abroad were designing bridges for
wind loadings of 50–55 psf.
The court struggled with determining the actual wind pressure at the time of
the accident because methods for measuring wind pressure were still in their
infancy. The experts’ testimonies varied widely, with estimates ranging from
15 to 45 psf. Thus, the court asked Law to estimate how much wind pressure
the bridge should have been able to withstand if constructed exactly as Bouch
designed it.
Wind Pressure
Wind pressure is manifested primarily as a horizontal force. A truss is a
rigid framework composed of slender members connected at their ends and
arranged in interconnected triangles. When a truss is loaded, its members
experience either tension or compression. If wind loading causes the diagonals
to stretch, they must be in tension. If the wind blows in the opposite
direction, the diagonals shorten, and they must be in compression. Because
these diagonal bars are so slender, they buckle under a small compressive
force. An efficient solution involves adding a second set of slender diagonals
oriented in the opposite direction. Thus, regardless of which direction the
wind blows, one diagonal in each pair will always carry the load in tension,
while the other goes slack.
Law’s analysis of the wind pressure at which the Tay Bridge piers would
collapse considered two possible failure modes. A wind pressure of
approximately 64 psf acting on both the bridge and the passing train might
cause one of these diagonal members (or its connections) to fail, and a collapse
27
would ensue. Alternatively, the wind might cause the pier to overturn. The
wind pressure required to cause overturning depended on whether the anchor
bolts could prevent the column baseplates from lifting off the plinth. If not,
the wind pressure required to cause overturning was 33 psf. But if the anchor
bolts effectively prevented uplift, the pressure required to cause overturning
would be much higher—the diagonals would fail before overturning became
an issue.
Although the baseplates were secured with anchor bolts, they were not
sufficiently effective at restraining uplift. Law found that numerous anchor
bolts had pulled out of the plinth and that several overturned columns had
lifted the top two stone courses off the plinth as they toppled. In both cases,
the anchor bolts did little to prevent the pier from overturning. Thus, given
the numerous known anchor bolt failures, wind pressure ranging from 33 to
45 psf could easily have caused the bridge to collapse, even if the structure had
been built exactly as designed.
The Connecting Lugs

But the Tay Bridge had not been built exactly as designed. The court found
that the as-built structure had deficiencies in fabrication, construction, and
maintenance—all of which would have lowered its wind resistance and
increased its likelihood of failure. The most important deficiency concerned
the connecting lugs on the cast-iron columns. During this era, cast-iron
objects were fabricated using a mold. The mold was a wooden box filled with
a special type of sand, which was used to form an internal cavity with the
same shape as the desired casting. Molten iron was poured into a small hole to
fill that internal cavity. After it cooled, the mold was split open to reveal the
completed casting.
To cast a bolt hole into this lug, a temporary core was inserted into the mold
prior to casting. The molten iron flowed around the core in two streams that
joined together on the far side of the core to form the lug. If these two streams
didn’t join fully, a defect called a cold shut was created, and the lug’s strength
was compromised. The court found evidence of many cold shuts in the Tay
Bridge column lugs.
28
Moreover, the temporary core had a slightly conical shape to facilitate its
withdrawal from the mold, but this shape caused the bolt holes to be slightly
conical too. This was serious from the perspective of structural integrity.
When inserting the bolt into a hole, it fit snugly on one side—but on the
opposite side, there was a substantial gap between the bolt and hole because
of the hole’s conical shape. Thus, when the bolt was loaded by the structural
member to which it was attached, the bolt bore entirely on this narrow edge
on one side of the lug. This increased the intensity of internal force on the
lug—and greatly increased its susceptibility to failure. In laboratory tests of
columns salvaged from the Tay Bridge wreckage, many lugs failed at about
one-third of their expected strength, largely because of these conical bolt
holes. This weakness could have been remedied by drilling out the holes after
the columns were cast.
Final Report
Another contributor to the Tay Bridge collapse was the loosening of the
diagonal braces over time. The braces loosened partly because the conical
bolt holes deformed excessively under load but also because the mechanism
intended to keep these braces tight—a double-wedge connection—was
badly designed and poorly fabricated. As the braces loosened over time, the
resulting sidesway of the piers increased their susceptibility to overturning
and amplified the vibrations caused by locomotives crossing the bridge. These
vibrations surely contributed to fatigue damage in the critical cast-iron lugs,
accelerating their eventual fracture under load.
The court of inquiry described these and other probable causes of failure in its
final report to the Board of Trade. The report also hypothesized the sequence
of events leading to the collapse, as follows:
` Before the structure was placed into service, many of its cast-iron column
lugs were weakened by fabrication defects.
` These lugs had probably incurred further damage during previous windstorms.
` Over time, the loosening tie bars increased the piers’ lateral sway,
decreasing their stability.
29
` During the storm of December 28, gale-force winds acting on both the
structure and the train caused enough lug failures to fatally compromise
one pier’s lateral stability.
` As each lug failed, loss of the associated diagonal brace caused the adjacent
lugs to be overloaded, leading to the collapse of the pier and the two high-
girder spans it supported.
` The remaining high girders and piers were dragged down by the
interconnections between the spans.
This reconstruction is reasonable, though there were likely two additional

contributors to the collapse: fatigue damage to the lugs and inadequacy of the
column anchor bolts.
The court members focused on the UK’s lack of common standards for wind
loading and recommended that the Board of Trade address this issue. But
Rothery, the lawyer, maintained that assigning blame was integral to the court’s
charge. Largely because of this judgment, Bouch was discredited, and his
contract to design a suspension bridge across the Firth of Forth was cancelled.
Bridges he had built previously were scrutinized, and several were condemned
and torn down. But Bouch’s Tay Bridge had stood long enough to demonstrate
its economic value to North British Railway. Thus, work began almost
immediately on a replacement—a double-track structure still in use today.
In response to the court of inquiry, the British Board of Trade established

a commission to study the issue of wind loading on railway structures.
Ultimately, it recommended that all bridges be designed to withstand a
wind loading of 56 psf, with a safety factor of 4. This would result in wind
resistance at least seven times greater than that of Bouch’s Tay Bridge.
Lessons Learned
In engineering, details matter. Central to this disaster was a seemingly
minor single-bolt connection. This also illustrates the need for redundancy
in engineering design. A small, localized failure should never be allowed to
propagate into systemic collapse. Finally, this case demonstrates that after
a major failure, public perceptions often have a stronger influence than
technical considerations on the subsequent course of events.
30
Reading
Board of Trade, “Report of the Court of Inquiry.”
Lewis and Reynolds, “Forensic Engineering.”
Martin and MacLeod, “The Tay Rail Bridge Disaster Revisited.”
Petroski, Engineers of Dreams.
31
4
Rainwater
Loading:
Kemper Arena
Welcome to the second in a series of lessons
addressing engineering failures caused
primarily by inadequate estimation of loads—
the second phase of the structural design
process. In this case study, we’ll investigate
the influence of rain loading on the collapse
of the Kemper Arena roof. We will explore the
arena’s innovative design and then discover
how several disparate phenomena, some of
which were related to the design, combined
to lead to the roof collapse.
32
4. Rainwater Loading: Kemper Arena
The Kemper Arena Roof Collapse

In April 1973, construction began on a multipurpose arena west of downtown
Kansas City, Missouri. The 18,000-seat Kemper Arena was one of the first
major works by Helmut Jahn. His design for the arena was so innovative that it
earned an Honor Award from the American Institute of Architects in 1976. But
three years later, on June 4, 1979, the arena’s reputation for design excellence
was shattered. That evening, a fierce storm lashed Kansas City, with winds
exceeding 70 mph and rain falling at a rate of more than four inches per hour.
Shortly after 7:00 pm, a 43,000-square-foot section of roof structure collapsed
onto the arena floor. As the roof slab fell, it acted like a giant piston, generating
a sudden air pressure increase that blew out several exterior walls. Time would
tell that the problem was caused by the structure itself.
The Kemper Arena Design

The arena consists of two essentially independent structures: a concrete
substructure that incorporates two tiers of seating, and an elaborate steel
framework that supports the roof and upper level of the exterior façade.
The principal components of this steel framework are three portals—
each 380 feet long and 90 feet high—oriented in the east-west direction
and supported on concrete
foundations extending 60 feet
into the earth. Each portal
comprises massive cylindrical
steel tubes, arranged in a
structural configuration called
a space truss.
A space truss is composed

of interconnected triangles,
with the structural geometry
defined not in a single plane
but in three-dimensional space
(length, width, and height).
This configuration provides
33
greater stability than a traditional planar truss and can be more structurally
efficient. When a planar truss is loaded, the top chord tends to buckle
sideways. This is why structural systems that use planar trusses typically
require two or more of them, interconnected with a bracing system that
prevents the top chord
from buckling. But in a
space truss, the three-
dimensional orientation
of the diagonals prevents
the top chord from
buckling laterally—no
supplemental bracing
needed.
The arena’s steel roof

framing is suspended
from the portals by 42
hangers—steel pipes
extending from the 14
lower chord joints of
each portal truss down
to the top chords of seven planar roof trusses. Each truss runs the full length
of the building in the north-south direction. Spanning 54 feet between these
main trusses are smaller trusses, called bar joists, spaced 9 feet apart. The bar
joists directly support the roof slab, which comprises corrugated steel decking
topped with concrete.
Load Paths
Engineers conceptualize a complex structural system like this one in terms of
load paths, which represent the flow of internal forces through the system.
The principal load path for this structure originates with the weight of
accumulated snow or rainwater on the roof surface. The snow and rain loads
applied to this surface are directly supported by the roof slab. These loads,
combined with the slab’s weight, are supported by the bar joists, carrying load
in flexure (or bending). The joists transmit the associated internal forces to
the main trusses, which also carry load in flexure, up through the hangers in
34
tension, and then out through the portal trusses to the supports and down
into the foundations. For the structure to carry load successfully, every link
in this chain must be strong enough to carry its internal forces with an
appropriate safety margin.
The hangers constitute an important link in this chain because they carry the
entire 1,500-ton roof plus the total weight of accumulated rain or snow on the
four-acre roof surface. With 42 hangers sharing this load nearly equally, the
internal tension force in each hanger is about 140,000 pounds. As the hangers
carry this tension force, they must also accommodate substantial horizontal
movements of the roof, caused by wind loading and the roof system’s thermal
expansion and contraction. In Kansas City, the average temperature difference
between January and July is about 70°F. This change causes the arena’s
concrete roof slab to change in length by about two inches.
The structural system accommodates this movement through the connections

at the top and bottom of each hanger. The top connection is a hinge, which
can rotate freely. The bottom is a baseplate bolted to the top chord of the
roof truss—but with a sheet of laminated plastic sandwiched between the
steel surfaces to provide rotational flexibility. Through this mechanism,
small horizontal movements of the roof are accommodated by rotation of the
hangers. Thus, the roof structure is like a pendulum suspended from the
main portals. Because the three external portals support the roof from above,
the interior space has no supporting columns. Therefore, all spectators have
uninterrupted sight lines.
The Roof Drainage System

Another important aspect of this design is its roof drainage system. When
rain falls on undeveloped land, a large proportion of the water infiltrates the
soil and is either absorbed by plants or retained in the soil as groundwater.
The remaining stormwater flows over the surface as runoff, eventually
collecting in water bodies. But when land is developed, impervious surfaces
like pavements and rooftops replace absorbent soil and vegetation. This results
in drastically reduced infiltration and increased runoff during rainstorms.
This increased runoff is typically captured in street-level storm drains and
channeled into underground pipes to prevent flooding. But every storm
drainage system has a maximum capacity. As continued development claims
35
more land surface, the corresponding increase in storm runoff will eventually
overwhelm and inundate a storm drainage system. A common preventive
technology is a stormwater detention pond—an earthen enclosure designed
to store such runoff temporarily and release it into the storm drainage system
at a controlled rate to prevent flooding.
The Kemper Arena designers recognized that the rainfall captured by the
building’s four-acre concrete roof would overwhelm the local storm drainage
system during intense storms unless they provided a means of temporarily
storing the runoff. Their ingenious solution was to use the roof itself. The arena
roof included drains designed to capture accumulating rainwater and channel it
through a five-inch-diameter pipe to the local storm drainage system.
To meet Kansas City’s building code requirements, the arena’s four-acre roof
should have had 55 such drains—but only 8 were provided in the design.
This was not a design error but rather an intentional means of stormwater
management. During an intense storm, the limited capacity of the eight
roof drains would prevent the local storm drainage system from being
overwhelmed and cause the excess runoff to accumulate on the roof. After the
storm subsided, this accumulated rainwater would slowly drain away. Thus,
the arena roof would function as a de facto stormwater detention pond.
The inherent danger here is that an extreme storm could cause so much
rainwater accumulation that its weight might overload the structure. To
prevent overloading, the designers provided additional stormwater outlets
called scuppers, which are openings in the parapet wall along the roof
perimeter. On the arena roof, the scuppers were positioned two inches above
the roof surface, ensuring that the water depth could never exceed two inches.
Logically, it could never be overloaded. Yet, during the storm of June 4, 1979,
the center section of the arena roof was overloaded by accumulated rainwater.
How could this have happened? Responsibility for the collapse was decided
through the adjudication of civil lawsuits in the courts. In preparation for
these suits, all involved parties hired experts to investigate the collapse on
their behalf. These consultants—each representing a particular organization’s
interest—tended to focus on different aspects of the failure and thus reached
somewhat different conclusions.
36
The Causes of the Collapse

An adequate consensus states that four major factors contributed to the
Kemper Arena roof collapse. The first was a phenomenon called ponding.
When rainwater accumulates on a flat roof, its weight causes the roof
structure to bend into a bowl shape. This is called deflection. The water
naturally accumulates at the bottom of the bowl, and this load concentration
increases the deflection. This also increases the bowl’s capacity to hold water,
further increasing the deflection. This mutually reinforcing cycle of load and
deflection is called ponding and can continue until the structure fails. For
a column-supported roof, only the deflections of the concrete slab and its
supporting bar joists contribute to ponding; the resulting increase in load is
usually insignificant. But in addition to these local deflections, the Kemper
Arena roof also experienced global deflections due to the bending of the main
trusses and portals. This greatly amplified the ponding effect and contributed
to the structural failure.
The second factor contributing to the collapse was wind. As the storm
raged, the 70-mph wind drove an ever-growing pool of rainwater toward
the southern end of the roof. The result was a storm surge. At the time of
the collapse, the depth of water at the downwind roof drains was more than
eight inches—a fourfold increase over the two-inch depth limitation that
should have been enforced by the scuppers. Astonishingly, this increase in
rain loading didn’t cause the collapse by itself because the safety factor used
in the structural design was large enough to accommodate the unanticipated
overload. This observation is supported by weather records, which indicate
that Kemper Arena had experienced numerous storms with more rainfall and
higher winds during the previous five years. Thus, the collapse didn’t occur
until two additional factors manifested themselves.
The third contributing factor was metal fatigue. Because fatigue involves
the gradual accumulation of damage, this is the only phenomenon that can
logically account for the arena roof’s failure after it had survived greater
storms. Today, fatigue is always considered in the design of structures
subjected to multiple load cycles. But it is rarely considered in building design
because these structures typically experience relatively few large load cycles.
37
This is probably why the connections between the arena roof structure’s
42 hangers and its 7 main roof trusses used an A490 bolt, which has high
strength but is considered unsuitable for cyclic loading.
This proved to be a poor choice. Because of the structural system’s unique

configuration, the hanger connections were subjected to severe cyclic loading.
Recall that the arena’s roof system was suspended from the main portals like
a pendulum, such that horizontal movements could be accommodated by
slight rotations of the hangers. In the lower hanger connection, each of these
rotations caused a sharp increase in bolt tension because the hanger baseplate
acted like a lever as it rocked back and forth. This lever effect was disastrous
in the Kemper Arena roof.
This was the fourth contributing factor. These hanger rotations occurred
many times each day due to wind gusts and temperature changes. By the
time of the collapse, the A490 bolts in the lower hanger connections had
experienced about 24,000 cycles of internal tension—a repetitive loading for
which they were never intended. This loading caused fatigue cracking in the
bolts, significantly reducing their strength. The collapse began when one of
these bolts fractured. By one expert’s estimate, the internal tension in this bolt
was only about one-quarter of its factory-specified strength when it failed.
The roof was supported by 42 hangers, and each lower hanger connection
used four bolts. These bolts should have had sufficient reserve strength that
the loss of one wouldn’t overload the remaining three, but they didn’t—partly
because they had suffered fatigue damage but also because the combined
effects of ponding and wind had increased the bolt tension far beyond
the designers’ expectations. Once all four bolts in one hanger connection
fractured, the loss of support from the associated hanger instantly overloaded
the adjacent hangers, which also failed. All 14 hangers suspended from the
central portal then failed in rapid succession. Deprived of support, the entire
center section of the roof fell.
Lessons Learned
Back in 1879, lack of redundancy in the design of the Tay Bridge caused a
localized fracture of a single bolted connection to propagate into the collapse
of 13 spans. In 1979, the similar progressive collapse of the Kemper Arena
38
roof suggests engineers had not yet embraced redundancy as an essential

criterion for structural safety. The Kemper Arena case had three other
important commonalities with the Tay Bridge and Dee Bridge cases:
` First, all three cases demonstrate that in engineering, details matter.
` Second, fatigue was a major contributor to all three failures.
` Third, the Kemper Arena collapse demonstrates once again that

engineering failures usually result from multiple causes.
Moreover, this case demonstrates that the interactions between multiple

causes of failure can produce a significant combined effect. For example,
ponding represents a dangerous interaction between a load (rainwater
accumulation) and a structural response (deflection of the roof), with each
tending to amplify the other. Similarly, the hangar bolts’ inadequate fatigue
resistance was only a problem because of a design concept that allowed the
entire roof to sway like a pendulum.
Perhaps the most important lesson here is that innovative design solutions can
provoke unanticipated modes of failure. In response to this risk, engineers
have only two viable choices: either don’t innovate or be prepared to learn
from failure. Fortunately, the continuing story of Kemper Arena has followed
the latter path. After the collapse, the structure was rebuilt with substantially
stronger hangers, a crowned roof surface to prevent ponding, and 14 additional
drains around the perimeter. These improvements have inspired sufficient
confidence to justify the arena’s continued use well into the 21st century.
Reading
Goldberger, “Kansas City Arena Loses Roof in Storm.”
39
5
Earthquake
Loading: The
Cypress Structure
Welcome to the third in this series of case
studies exploring failures caused primarily
by inadequate load estimation. This lesson
investigates the earthquake-induced collapse
of the Cypress Structure in 1989. This case
study is pertinent to the course for three
reasons. First, it provides interesting insights
on the historical development of earthquake
engineering. Second, it is an excellent vehicle
for learning about earthquakes and their effects
on structures. And third, it provides a good
opportunity to learn about reinforced concrete.
40
5. Earthquake Loading: The Cypress Structure
The Cypress Structure Collapse

At 5:04 pm on October 17, 1989, an earthquake measuring 6.9 on the
Richter scale rocked the California coast from Monterey to San Francisco.
The epicenter was Loma Prieta. Although Candlestick Park, San Francisco,
sustained only minor damage, the quake triggered numerous bridge and
building collapses, fires, power failures, and landslides, causing nearly 4,000
injuries and 63 deaths. Two-thirds of these fatalities were caused by the
collapse of the Cypress Street Viaduct, or Cypress Structure.
This two-level elevated highway was built in 1957 to carry the Nimitz
Freeway (Interstate 880) west of downtown Oakland. The structural system
comprised 124 reinforced-concrete frames, spaced about 80 feet apart and
supporting two decks, one above the other. Each deck segment was a hollow
reinforced-concrete box beam, extending continuously across three adjacent
41
frames and connected to the adjacent deck segments at expansion joints. The
upper deck carried four lanes of southbound traffic, and the lower carried
four northbound lanes.
When the quake struck, the viaduct oscillated wildly for a few seconds. Then,
48 of its 124 frames collapsed along a 400-foot stretch of the freeway. As these
frames splayed outward, the upper deck fell onto the lower one, crushing
many vehicles in the northbound lanes and killing 42 motorists.
Reinforced Concrete
Concrete is the world’s most common construction material. It’s made by
combining a fine gray powder—Portland cement—with sand and gravel,
mixing them together, adding water and mixing again, pouring the mixture
into a mold, consolidating the wet concrete, and then finishing the surface.
This process is called casting, and the mold is called formwork. Within the
42
concrete mixture, the water and cement form a paste. This will eventually
harden into a rocklike mass through a chemical reaction called hydration.
Concrete can be cast into any shape for which formwork can be fabricated.
The use of concrete as a structural material is strongly influenced by its

high strength in compression and its relatively low strength in tension and
shear. Although a bending beam experiences tension on the bottom and
compression on top, a similarly loaded concrete beam fails by fracturing
in tension somewhere along its bottom surface. Because of this weakness
in tension, concrete structural members are always strengthened with steel
reinforcing bars, or rebars. During construction, rebars are positioned inside
the formwork at appropriate locations; then, the formwork is filled with
concrete. When the concrete hardens, the raised ridges on the rebar form a
rigid, mechanical bond between the concrete and reinforcing steel.
When a concrete beam bends, the bottom is in tension; thus, it must be

reinforced with longitudinal rebars positioned near the bottom face. But if
this beam also bends the opposite way, it needs longitudinal reinforcement on
top. A bending beam has convex and concave sides. The convex side is always
in tension, meaning longitudinal reinforcement is always required on that
side. In addition to these longitudinal bars, most concrete beams also require
transverse reinforcement via U-shaped bars called stirrups, which help resist
the internal shear forces.
By definition, a column carries load primarily in compression. In practice,

however, all columns experience some bending. Thus, they’re always
reinforced with longitudinal rebars—typically placed around the perimeter
of the column. These bars increase the column’s compressive strength
because steel is stronger than concrete. Columns also experience internal shear
and thus also use transverse reinforcement. In columns, the transverse bars
are usually formed into complete loops called ties. In addition to carrying
shear, ties also help confine the concrete laterally to prevent it from bursting
outward under severe compressive loading. A concrete column is highly
dependent on well-designed ties for its compressive strength.
43
Reinforced-Concrete Frames
The reinforced-concrete frames of the Cypress Structure are what failed
during the Loma Prieta earthquake. Each frame comprised three major
components, which were cast separately:
` The foundation was constructed by driving two groups of concrete piles

deep into the ground and casting a three-foot-thick pile cap on top of
each group.
` Next, a bent—consisting of two columns and a beam—was cast as a

single, monolithic unit on top of the foundation.
` Above this was another bent, also consisting of two columns and a beam.
The placement of longitudinal rebars in a reinforced-concrete member

depends on how it bends; thus, we need to examine the deformation of these
frames under load. In the Cypress Structure, these frames were designed to
carry both gravity loads and lateral loads.
` Gravity loads include the weight of the structure and the weight of vehicles
traveling on its two roadways.
` Lateral loads are caused by wind and earthquake effects. Because such
loads can be applied from either direction, we must consider the mirror
image of these deformations too.
The steel reinforcement in the frame must be capable of resisting the internal
tension caused by these loading conditions. Thus, longitudinal rebars are
required on both sides of all beams and columns. In a typical frame of the
Cypress Structure, the dense arrangement of rebars reflected the substantial
structural demands associated with heavy loads applied to the frame’s 50-foot
spans. Interestingly, there were two locations where the steel reinforcement
was both sparse and discontinuous—two column stubs that extended above
the lower bent and incorporated the connections between the lower and
upper bents.
44
Hinged Column Stubs

When the lower bent was constructed, a rectangular socket was cast into the
upper surface of each column stub, and four short lengths of rebar, called
dowels, were extended up through the socket. After the concrete hardened, a
compressible fiberboard pad was placed on the column stub. When the upper
bent was cast on top of this stub, concrete filled the socket and encased the
four dowels. This created an interlocking mechanical connection between the
upper and lower bents.
This type of concrete connection is called a shear key because the

interlocking mechanical connection restrains the upper column from sliding
horizontally, or shearing, with respect to the lower column. Because of the
fiberboard pad, the upper column can still rotate with respect to the lower
one. Because it allows rotation, this structural connection is classified as
a hinge.
Hinges were incorporated into the Cypress Structure frames for two reasons.
First, they greatly simplified mathematical analysis of the structure. Second,
they facilitated the construction process by allowing the upper and lower bents
to be cast separately. However, the flawed design of these hinged column stubs
would prove to be a major factor in the Cypress Structure’s collapse.
Earthquakes
Earth’s outer shell (the lithosphere) comprises seven large, rigid plates and
dozens of smaller ones, which float on the asthenosphere, a soft layer of
Earth’s mantle immediately below the lithosphere. These tectonic plates are
constantly moving at speeds ranging from a fraction of an inch to about five
inches per year. The boundaries between tectonic plates are called faults.
Most occur along the coastlines of continents—like the San Andreas Fault
along the coast of California.
At a fault, the adjoining tectonic plates often move with respect to each
other—sometimes horizontally, sometimes vertically. But because the
interface between these plates is irregular, friction can restrain their motion,
resulting in a buildup of internal forces along the fault. When this stored
45
energy becomes large enough to overcome the friction between the plates,
they undergo a sudden, violent slip. As this stored energy is released, it’s
manifested as a series of seismic waves, which propagate out from the
epicenter. As they move through the lithosphere, they cause rapid, cyclic
ground motions—an earthquake.
A reinforced-concrete frame is a massive object physically connected to the

earth by its foundation. During an earthquake, the ground moves, and the
foundation must move with it. But, according to Newton’s first law, an
object at rest tends to remain at rest. Thus, even as the foundation moves,
the structure’s aboveground portion wants to stand still. The structure
reluctantly follows along behind the moving foundation, but by the time it’s
in motion, the ground is already moving back in the opposite direction. Thus,
the motion of the structure lags behind the ground motion, causing severe
bending of beams and columns. This is a manifestation of Newton’s second
law—force equals mass times acceleration.
Acceleration is the rate of change of velocity. Thus, in an earthquake,

every time the earth’s movement speeds up or slows down, it undergoes
acceleration—and the structure responds as if a horizontal force were pushing
it in the opposite direction. This loading is often conceptualized as an
inertial force because it results from the structure’s own inertia.
Earthquake-Resistant Design
In designing a structure to resist earthquakes, the engineer’s challenge is
to ensure the structural system is strong enough to resist the inertial forces
caused by the largest earthquake the structure is expected to experience in its
lifetime. According to Newton’s second law, inertial force can be calculated
as the mass of the structure times the ground acceleration associated with the
earthquake for which the structure is being designed.
More specifically, for a two-level frame like those used in the Cypress
Structure, this loading is idealized as two horizontal forces applied at
the elevations of the two decks, where most of the structure’s mass is
concentrated. The lower force, F1, is equal to the mass of the lower half of the
structure times the ground acceleration. The upper force, F2 , equals the mass
of the upper half times the ground acceleration. In 1949, when the Cypress
46
Structure was designed, the ground acceleration specified in California’s

building code was 0.06 g—6% of the acceleration of gravity. Using this code-
specified acceleration, the frame would have been designed for inertial forces
of approximately 84,000 pounds and 80,000 pounds.
These loads, along with the gravity and traffic loads, would have been used
as the basis for an analysis of the structural response—a calculation of the
internal forces in the beams and columns of each frame. These calculated
internal forces would be the basis for determining the number and size of
rebars required in these members.
Rigorous post-collapse analyses suggest that the engineers who designed

the Cypress Structure implemented this process quite competently. Their
structural design was consistent with the era’s codes and standards. Post-
collapse testing also indicated that the quality of construction was satisfactory.
There were no indications of significant problems with the viaduct’s
maintenance or operation.
What Caused the Collapse?

For the first cause, during the Loma Prieta earthquake, measured ground
accelerations in the Cypress Structure’s vicinity were between 0.2 and 0.3
g—four to five times higher than the California code-specified acceleration of
0.06 g used as the basis for the design in 1949. Clearly, that design standard
was inadequate. Indeed, by the time of the 1989 quake, the California code
had already been drastically revised in response to lessons learned from the
1971 San Fernando earthquake.
For the second cause, the Cypress Structure’s response to the Loma
Prieta earthquake was greatly amplified by a dynamic phenomenon
called resonance. Like all structures, when a frame is displaced from its
equilibrium position and released, it vibrates at a characteristic frequency,
measured in cycles per second (or hertz). The natural frequency of this frame
happens to be approximately one cycle per second. One cycle of vibration for
each second equals 1 hertz.
47
Earthquake-induced ground motions are caused by seismic waves—and like

all wave phenomena, a seismic wave can be characterized in terms of one or
more frequencies. If an earthquake has the same frequency as a structure,
the result is resonance—an amplification of dynamic oscillations that occurs
when the frequency of the ground motion equals the natural frequency of the
structure. Under these conditions, each cycle of ground motion reinforces the
structure’s existing natural vibrations, resulting in an uncontrollable increase
in the vibrations’ magnitude.
A complex, two-level, three-dimensional structural system like the Cypress

Structure has many different modes of vibration. The three most important
are the transverse mode, longitudinal mode (with motion parallel to the
highway), and vertical mode (with the decks moving primarily up and down).
Each mode has its own unique natural frequency. The natural frequency
of the vertical mode was almost identical to the dominant frequency of the
earthquake-induced ground motions caused by the Loma Prieta earthquake.
The eyewitness who reported that the bridge’s motion was “like a big, giant,
long ocean wave” provided vital corroborating evidence that resonance in this
mode contributed significantly to the collapse.
However, resonance can’t explain why some of the Cypress Structure’s

supporting frames collapsed while others didn’t. Only the third cause
can solve this mystery. Through extensive research, seismologists have
demonstrated that soft sediment can greatly amplify the ground motions
caused by seismic waves. As seismic waves cross the boundary between a stiff
geological material like bedrock and a loose sediment, the waves slow down,
and the magnitude of the associated ground motion increases. Moreover,
seismic waves can be reflected repeatedly between the ground surface and
a geological boundary. This further amplifies the ground motion as the
reflected waves reinforce each other. This phenomenon—sediment-induced
amplification—can easily increase ground acceleration by a factor of 5 to 10.
In the region around Oakland, California, the three soil types are sandstone
bedrock to the east, a deep stratum of soft sediment (“bay mud”) along the
San Francisco Bay, and relatively firm alluvial sand and gravel in between.
The Cypress Structure was built partially on sand and gravel and partially
48
on bay mud. The extent of the collapsed spans corresponds exactly to the
boundary between these soil types. Thus, sediment-induced amplification was
a decisive factor in the collapse.
The Weak Link

The structure’s weakest link was at the column stubs where the upper and
lower bents were connected. When transverse oscillation of the frame began,
significant internal shear forces were transmitted across these stubs. Their
steel reinforcement was inadequate to carry this force, and a large diagonal
crack opened along a plane of weakness at the base of the stub. When the
direction of the oscillation reversed, a similar crack formed on the opposite
side. When the resonant vertical vibrations of the upper deck began, the
resulting cyclic vertical force caused the column stubs to crush and break
away. Deprived of support, the upper bent dropped, and its columns were
wedged outward. This outward splay of the columns caused the upper beam-
to-column connections to fail. At this point, the upper deck was in free fall
until it came to rest on the lower deck.
We can’t fault the designers for using an inadequate ground acceleration as the
basis for their design—or for specifying too little shear reinforcement in the
column stubs. The design was in full compliance with the standards of the
era. But we should question the most fundamental decision they made during
the first phase of the structural design process—to use a double-decked
configuration in a seismically active area.
Essentially, there’s no such thing as an earthquake-proof structure. We can

never know if a quake of unprecedented strength will happen in the future.
Thus, in an earthquake-prone region, designers must always acknowledge
a nonzero probability of failure—and attempt to minimize the adverse
consequences in the design process. The Cypress Structure’s two-level
configuration virtually guaranteed that an earthquake-induced collapse
would have dire consequences. Thus, it’s reasonable to conclude that the
design concept was fundamentally flawed in this respect.
49
Lessons Learned
The collapse of the Cypress Structure could have been prevented. In the
aftermath of the 1971 San Fernando earthquake, researchers gained a deeper
understanding of the vulnerabilities associated with reinforced-concrete
structures designed according to the inadequate standards of earlier eras. As a
result, two seismic retrofits of the Cypress Structure were planned—but only
one was implemented.
The retrofit involved strengthening the deck expansion joints. Here, U-shaped
steel cables were installed inside the box beams, extending across each expansion
joint, so that the beams wouldn’t pull apart during an earthquake. During the
Loma Prieta earthquake, despite the tremendous horizontal forces transmitted
across the expansion joints, none of them separated.
The second planned retrofit involved strengthening the columns to

compensate for their inadequate shear reinforcement by installing an
enclosure of supplemental steel rebars—called a jacket—around each
column. This vital modification was never implemented because the limited
funds available for seismic retrofits were allocated to higher-priority projects.
This reinforcement might have prevented the collapse if it had been installed.
Reading
Hough, et al., “Sediment-Induced Amplification and the Collapse of the
Nimitz Freeway.”
Nims, et al., “Collapse of the Cypress Street Viaduct as a Result of the
Loma Prieta Earthquake.”
50
6
Vehicle Collisions:
Land and Sea
The last three lessons have examined cases
in which forces of nature—wind, rainfall,
and earthquakes—have contributed to
engineering disasters. This lesson examines
the failures caused by extreme loads for
which humans, rather than nature, were
primarily responsible. Here, you will learn
about two different cases, the Sunshine
Skyway Bridge collapse and the Skagit River
Bridge collapse, both of which demonstrate
the need for systematic assessment and
modernization of our civil infrastructure—
before such tragedies occur.
51
6. Vehicle Collisions: Land and Sea
The Sunshine Skyway Collapse

In the Gulf of Mexico, at 6:20 am on May 9, 1980, harbor pilot John Lerro
and his pilot trainee, Bruce Atkins, boarded the freighter Summit Venture to
guide it into the Port of Tampa. Summit Venture was a 609-foot, 34,000-ton
bulk carrier. Aided by the ship’s magnetic compass and radar, the men would
steer the ship through Tampa Bay’s main shipping channel, making a series
of turns marked by pairs of numbered buoys. They would pass between two
barrier islands and then beneath the 864-foot main span of the Sunshine
Skyway Bridge.
The Sunshine Skyway was a 15-mile-long multi-span steel truss bridge carrying
Interstate 275 across Tampa Bay. It comprised two independent structures. The
first was built in 1954 to carry two lanes of traffic—one in each direction. Its
twin was added in 1971 when the highway was reconfigured to four lanes—two
northbound on the eastern bridge and two southbound on the western bridge.
Each parallel bridge consisted of a three-span through truss crossing the
navigation channel, a pair of deck trusses on either end of the through truss,
and a series of shorter girder spans connecting these trusses to the shorelines.
In a through truss, the deck and roadway are positioned at the truss’s bottom
chord, such that traffic passes through the bridge. The through trusses were
used above the navigation channel to provide additional overhead clearance
for the ships passing beneath. A deck truss has its deck and roadway at the top
chord such that vehicles drive on top of the bridge.
52
Summit Venture proceeded into the shipping channel. The weather was cloudy
with intermittent light rain, but visibility remained good. The National
Weather Service had issued no storm warnings. However, at 7:21 am, the
rainfall intensity increased significantly. Lerro ordered the engine speed reduced
to “half ahead.” Minutes later, as Summit Venture was about one nautical mile
from navigation buoys 1A and 2A—and the final 18-degree turn that would
take the ship beneath the bridge—they were suddenly enveloped in a fierce
squall. As an unexpected line of thunderstorms swept across Tampa Bay, 60-
mph winds blasted the vessel from astern. Intense rain reduced visibility to zero,
rendering the ship’s radar ineffective. Steaming at half speed directly toward the
bridge, the pilots were completely blinded by the squall.
At this crucial moment, Lerro had three options:
` He could order the engine reversed and the anchors dropped in an effort
to stop the vessel before it reached the bridge. But given the wind, the ship
couldn’t be stopped in time.
` He could cut power, drop anchors, and steer the ship hard to starboard,
out of the channel and parallel to the bridge. In retrospect, this probably
would have worked—but only if Lerro had initiated the turn immediately
upon the onset of the squall. However, by the time Lerro and Atkins
realized they might never spot buoys 1A and 2A, the window of
opportunity for a turnout had already passed. Even if Lerro could complete
the turn successfully, the strong wind might still drive the vessel sideways
into the bridge.
` The sole remaining option was to remain in the channel and attempt to
navigate beneath the bridge. But at that moment no one could even see the
bridge.
Moments later, a lookout sighted buoy 2A just off the starboard bow—
meaning the ship was still in the channel and had reached the required
turning point. Lerro immediately ordered a turn to port and a further
reduction in speed. But the massive vessel was slow to come around. Both
its inertia and the wind drove it out of the navigation channel to the south.
One of the bridge piers finally came into view, dead ahead, less than one ship
length away. Lerro immediately reversed the engine, steered hard to port, and
dropped both anchors—but it was too late.
53
At 7:34 am, Summit Venture collided with the southernmost pier of the
western three-span through truss. The pier had a protective crash wall
extending 15 feet above the waterline—but the ship’s flared bow struck
the pier 40 feet above the crash wall. This sheared off both of the pier’s
reinforced-concrete columns and toppled 1,300 feet of the Sunshine Skyway
into Tampa Bay. Several vehicles were on the falling spans, and several others
drove over the edge. Thirty-five people died.
Cantilever Bridges
The Sunshine Skyway’s three main spans constitute a cantilever bridge. The
structure consists of six concrete piers, three on either side of the navigation
channel, and two inner deck trusses. These trusses are classified as simply
supported spans because each is supported only at its outer ends. To bridge
the three center spans, a single three-span truss extends continuously across
the two intermediate piers. However, because this three-span continuous truss
is supported at four points rather than two, it’s more challenging to analyze
and design than simply supported spans would be. Fortunately, the designers
of the Sunshine Skyway had a third alternative at their disposal—the
cantilever configuration.
A typical cantilever bridge comprises two exterior spans, each consisting of

an anchor arm and a cantilever arm. A cantilever is any structural element
fixed at one end and unsupported at the other. In this type of bridge, the
cantilever arm extends across the intermediate support and partway out across
the center span. The final component of the structural system, the suspended
span, is suspended from the two cantilever arms and connected with pins.
Because of this continuity across the intermediate support, the cantilever
configuration provides essentially the same structural efficiency as the three-
span continuous alternative. But because it consists of three separate entities,
each supported at only two points, it’s no more difficult to analyze than the
simply supported alternative.
Nonetheless, in the 1950s, the cost of the reduced computational complexity

was a significant increase in the structure’s vulnerability to the loss of a
support. The loss of only one support triggered the progressive collapse of
the Sunshine Skyway’s approach span, anchor arm, cantilever arm, and
suspended span—and also severely damaged the remaining cantilever arm. If
54
the three-span continuous configuration had been used instead, it’s possible
that none of the spans would have fallen. This configuration would have been
significantly more redundant than the cantilever.
The cantilever’s inherent lack of redundancy explains why engineers chose

to build a new bridge using a different structural configuration. The new
Sunshine Skyway Bridge was a cable-stayed bridge, and its configuration
offers the following:
` a 40% longer center span, which provides a greater margin of safety against
navigational errors
` massive double piers, which are significantly more resistant to collisions

than their predecessors
` protective structures called dolphins, which are designed to withstand direct

impact by a 90,000-ton vessel while protecting the main piers from impacts
The Skagit River Bridge Collapse

On May 23, 2013, a tractor-trailer truck loaded with a 44,000-pound
segment of a steel shed was driving southbound on Interstate 5, en route from
Alberta, Canada, to Vancouver, Washington. When secured on the flatbed
trailer, the shed was 15 feet, 11 inches high and 11 feet, 6 inches wide—nearly
2 feet taller and 3 feet wider than Washington state’s statutory maximum
vehicle sizes. The previous day, the vehicle’s owner, Mullen Trucking LP,
had requested and received the required oversized-vehicle permits from
Washington state and from Alberta and British Columbia.
The Washington permit required that the truck be led by an escort vehicle
equipped with a height pole—a flexible rod fixed to the vehicle’s front
bumper to warn its driver of any overhead obstructions lower than the
pole’s height. Mullen hired G&T Crawlers to provide the escort vehicle in
Washington state. G&T’s escort vehicle linked up with the Mullen truck
as it crossed the border from Canada into the United States around 6:30
pm on May 23. The escort vehicle’s height pole was set at 16 feet, 2 inches,
extending 3 inches above the height of the truck’s oversized load to provide an
55
additional margin for error. After their successful link-up, the G&T escort led
the Mullen truck onto Interstate 5. Fifty miles ahead, the highway crossed the
Skagit River on a four-span steel through-truss bridge.
Each span of the Skagit River Bridge consisted of two main trusses. Their
bottom chords were interconnected by a system of beams that supported the
deck, and their top chords were connected by sway braces. Each sway brace
was a truss, with a curved bottom chord forming an arched portal through
which traffic passed. Because of their arched shape, these portals provided
overhead clearance of 17 feet for vehicles traveling in the highway’s inner
lanes. However, at the extreme right edge of the outer lanes, the clearance was
only 14 feet, 9 inches.
As they approached the bridge, both the G&T escort and the Mullen truck
were driving in the right lane at 60 mph, about 400 feet apart, in radio
contact with each other. After the incident, the G&T driver would claim her
height pole did not make contact with the overhead portals as she crossed
the bridge. However, an eyewitness testified that the pole did strike several
portals—and phone records demonstrated that the G&T driver was talking
on her cell phone as she drove across the bridge. In any case, the escort should
have notified the Mullen driver about the approaching overhead obstruction
56
because the truck’s oversized load was so much wider than the escort vehicle.
The highway was straight and level at this location; thus, the escort should
have seen the bridge when it was still a quarter mile away.
Meanwhile, as the Mullen truck approached the bridge, another 18-wheeler

overtook and passed it in the left lane. Because of his wide load, the Mullen
driver steered slightly to the right to put more distance between the two
trucks—and sealed the fate of the Skagit River Bridge. As the Mullen truck
crossed the bridge, the upper right-hand corner of the heavy steel shed struck
all six sway braces of the northernmost span and the first five braces of the
second span before the driver could stop the truck. These impacts initiated a
sequence of events that culminated in the collapse of the northern span.
According to the National Transportation Safety Board, the Skagit River

Bridge collapse had various causes—including shortcomings in the permitting
process, inadequate planning by the trucking company, procedural failures by
the drivers of both the truck and escort vehicle, inadequate signage, regulatory
issues, training issues, and a few engineering issues.
The Principal Engineering Issues

In 1955, the Skagit River Bridge was built fully consistent with the era’s
design standards; by 1983, it was declared functionally obsolete by the US
Federal Highway Administration (FHWA). But three decades later, it was
still carrying heavy interstate highway traffic 24/7. The FHWA’s declaration
of functional obsolescence was based on three deficiencies in the bridge’s
geometric and structural design:
` Its traffic lanes and shoulders were too narrow.
` Its overhead clearance was too low.
` Its structural system was nonredundant.
These deficiencies contributed directly to the disaster. The first two created the
conditions for the truck’s impact with the overhead portals. The third resulted
in the structure collapsing—even though the impact didn’t directly damage any
of the bridge’s principal load-carrying members. These deficiencies were caused
by a major change to the bridge’s function after it had already been built.
57
The bridge was originally designed to carry only two traffic lanes 12 feet
wide with 10-foot shoulders. Because there were only two lanes, the 14-foot,
9-inch overhead clearance constraint affected only the extreme outer edges
of the shoulders. But one year after the bridge was opened, President Dwight
Eisenhower signed the Federal Aid Highway Act of 1956, which created
the US Interstate Highway System. To accommodate all four lanes of the
newly created Interstate 5, the Skagit River Bridge was reconfigured with
substandard 11-foot, 4-inch lane widths, virtually nonexistent shoulders, and
overhead obstructions that impinged upon the traveled way.
After the collapse, the failed truss span was replaced with a girder span. The
remaining three simply supported truss spans were modified to replace the
arched lower chord of the sway braces with a horizontal chord, providing
a uniform 16-foot clearance across the entire roadway. However, the
substandard lane and shoulder widths of the original trusses remain.
Buckling Failure
To understand the fourth reason for the Skagit River Bridge’s functional
obsolescence—structural nonredundancy—the collapse of the northernmost
span must be considered. According to the National Transportation Safety
Board investigation, when the truck impacted the portal on the northern
span, it caused a vertical member of the main truss to bend sharply inward.
As such, the vertical member could no longer brace the top chord of the truss
against buckling. The top chord’s consequent buckling failure precipitated the
collapse of the entire span.
Recall that when a slender structural member is subjected to compression, it

fails by buckling—a sudden lateral deflection typically resulting in total loss
of the member’s load-carrying capacity. Buckling only occurs in compression.
One way to strengthen a compression member against buckling is to reduce
its length. All other things being equal, a shorter member is substantially less
susceptible to buckling than a longer one. There may be no way to make a top
chord shorter without totally changing the geometry of the truss, but it can
effectively be shortened by adding a vertical member that braces the top chord
at its center. The vertical brace effectively transforms the single top-chord
member into two members half as long. Theoretically, this should increase the
buckling strength by a factor of four.
58
In the Skagit River Bridge, the top chord was designed to take advantage of
the strengthening effect provided by the vertical brace. But when the brace was
compromised by the collision, the resulting loss of strength triggered a buckling
failure of the top chord—and a structural collapse. This is the epitome of a
nonredundant structural system. Damage to a secondary member—the lower
element of a portal—triggered a progressive collapse of the entire structure.
Lessons Learned
In many cases, accidents are the direct result of human negligence. This was
true for the Skagit River Bridge collapse. However, in the Sunshine Skyway case,
the occurrence of an unexpected squall at the worst possible moment made the
catastrophe practically unavoidable. In either case, “accidents happen” is not a
legitimate excuse for an engineering failure. High-quality engineering design
purposefully accounts for the possibility of accidents, seeks to prevent them
from happening when possible, and minimizes their adverse consequences when
prevention isn’t possible. As engineers learn from failure, materials are replaced
by safer alternatives, and design methods are improved to account for new, better
understandings of physical phenomena. Failures also cause well-established
structural forms, such as the cantilever bridge, to fade into obsolescence.
Advances in engineering knowledge, changing societal needs, and long-term

deterioration are continually rendering older infrastructure systems obsolete,
and the resulting demands always seem greater than the resources available to
address them. But it makes more sense to deal with obsolescence proactively
through systematic upgrades and replacement than to wait for obsolete
systems to fail, with tragic consequences.
Reading
National Transportation Safety Board, Collapse of the Interstate 5 Skagit
River Bridge.
———, Marine Accident Report.
59
7
Blast Loading:
The Murrah
Federal Building
During the past few decades, terrorism
has profoundly influenced our worldviews,
lifestyles, and sense of security. In 1995, a
heinous act of domestic terrorism set the US
engineering community on a path toward the
purposeful incorporation of blast resistance
into the design of important structures.
This lesson will focus on the collapse of the
Murrah Federal Building due to the Oklahoma
City bombing. You will learn about blast
loading, the failure mechanisms that led
to the building’s collapse, and the design
insights gained from the analysis of this
collapse.
60
7. Blast Loading: The Murrah Federal Building
The Oklahoma City Bombing

On April 19, 1995, Timothy McVeigh carried out the deadliest act of
domestic terrorism in US history. After extensive planning and preparation,
McVeigh rented a truck, packed more than three tons of explosives into its
cargo bay, and drove it into downtown Oklahoma City. His destination was
the Alfred P. Murrah Federal Building, which had been constructed in close
proximity to Northwest Fifth Street, with a dedicated drop-off lane that
would allow McVeigh’s truck to approach within 10 feet of the structure.
The building’s entire northern façade was a glass curtain wall, which would
greatly increase the bomb’s destructive effects.
As he approached his target, McVeigh lit two fuses in the truck’s cab,
then parked the truck in the planned location and fled to his getaway car.
Moments later, at 9:02 am, the bomb detonated. The explosion shattered
the curtain wall, sending glass shards flying through the building’s interior.
The blast knocked out several structural columns, triggering a collapse that
61
destroyed about half of the building’s occupied space. The force of the blast
also destroyed or damaged 324 other structures within a 16-block radius.
Overall, over 700 people were injured and 168 killed, including 15 children.
Immediately after the collapse, first responders began to locate and extract the
victims from the debris. Structural engineers advised the rescue teams on how
to stabilize and temporarily support both the wreckage and the portions of the
structure that remained erect. Moreover, the Federal Emergency Management
Agency (FEMA) deployed an assessment team to investigate the building’s
collapse and formulate strategies for improving the blast resistance of new and
existing buildings.
The Murrah Building’s Design

The Murrah Building was a conventional nine-story office block. Its
structural system was a conventional cast-in-place reinforced-concrete frame,
comprising vertical columns, horizontal beams, and flat slabs constituting the
floors and roof. The term cast-in-place means these columns, beams, and slabs
were cast as a single, monolithic unit, with no discrete joints or connections
between them. The overall geometry of this structural system was defined as
a rectangular grid. It comprised 11 parallel lines of columns spaced 20 feet
apart in the east-west direction, and 3 lines of columns spaced 35 feet apart in
the north-south direction. Spanning the columns in the north-south direction
were 4-foot-wide beams that directly supported the floor and roof slabs.
The outer edges of these slabs were strengthened by fascia beams positioned
around the perimeter of each floor.
This structural system was effective for resisting gravity loads—the weight of
the building and its occupants. However, the local building code also required
the structure to resist the lateral forces caused by wind. As the system wasn’t
particularly effective at this, the building designer filled select rectangular
panels with a shear wall on each story. This provided the frame with the
required stability and lateral load-carrying capacity. The shear walls were
placed around the elevator shafts and stairwells at the center of the building’s
south side, providing a structural core capable of resisting wind loads in
the north-south and east-west directions. Massive cylindrical pillars at the
building’s corners enclosed the vertical air ducts of the ventilation system.
62
Two other important architectural features of the Murrah Building were

the glass curtain wall covering the entire northern façade and the setback
of the first and second stories, which provided a covered entry plaza along
Northwest Fifth Street. To facilitate this setback, the structural system
included a transfer girder running the full length of the building at
the third-floor level. This type of girder transfers the load carried by the
intermediate columns outward to the adjacent columns that run continuously
down to the building foundations. The Murrah Building had six main
columns running continuously from the roof down to the foundations and
five intermediate columns supported on the third-floor transfer girder.
This structural design was developed by Paul Kirkpatrick in 1974, consistent

with the era’s codes and standards. FEMA’s laboratory tests and analyses
demonstrated that the concrete and steel used to build the structure were of
high quality and that the building was constructed in strict compliance with
the engineer’s plans and specifications. In short, the collapse of the Murrah
Building could be attributed entirely to the blast loading it experienced on
April 19, 1995.
Blast Loading
Blast loading is the effect of an explosion on a structure. There are three
different categories of explosions—physical, chemical, and nuclear. The
one that destroyed the Murrah Building was a chemical explosion, defined
as a large, rapid release of energy caused by a chemical reaction—the rapid
oxidation of fuel elements contained within the explosive material. For a
typical high explosive like trinitrotoluene (TNT), this oxidation reaction
generates enough heat to raise the air temperature at the point of detonation
by over 5,000°F. This near-instantaneous temperature increase generates
extremely high pressure. This causes the hot gases to expand violently
outward in all directions at the speed of sound. As this sphere of hot gas
expands, a layer of compressed air—the blast wave—forms at its outer edge.
The blast wave contains much of the energy released by the explosion and is
responsible for most of the resulting destruction. As the wave passes through
a given point in space, that point experiences an instantaneous increase in
pressure—called the incident peak overpressure—for a fraction of a second.
The peak overpressure can be in the order of 1 million pounds per square inch
63
(psi) at the point of detonation, but decreases sharply as the wave propagates
outward. However, an overpressure as low as 2 psi can cause significant
structural damage. When the blast wave encounters a solid object, its reflection
off that surface significantly increases the pressure applied to the object.
The Blast Wave’s Effects

McVeigh’s truck bomb comprised approximately 5,000 pounds of ammonium
nitrate fertilizer, 1,200 pounds of nitromethane, and 350 pounds of
conventional explosives—all packed into 16 55-gallon steel drums and
initiated by commercial blasting caps. The FEMA investigation determined
that this had the explosive power of about 4,000 pounds of TNT. The crater
was 28 feet in diameter, and it penetrated through 18 inches of concrete and
asphalt pavement to reach a depth of 7 feet.
The blast wave that produced this crater also propagated upward and outward
through the Murrah Building. When the wave had traveled 10 feet—the
shortest distance between the point of detonation and the northern façade—
the peak overpressure was about 10,000 psi. By the time it reached the
building’s upper northwest corner, the wave had dissipated to 9 psi, but the
structural system had been fatally damaged.
The first structural member affected by the blast was an exterior column
located 16 feet away from the point of detonation. Subjected to an estimated
peak overpressure of 5,600 psi, the concrete column—36 inches wide, 20
inches thick, and 21 feet tall—was obliterated. The technical term for this
failure mode is brisance—the shattering effect of an explosion acting upon a
brittle material like concrete. The next two closest columns were 37 feet and
50 feet from the point of detonation. The blast wave’s intensity was sufficiently
diminished that brisance didn’t occur. Nonetheless, the peak overpressure still
bent the columns laterally until their upper ends failed in shear.
With the catastrophic loss of three adjacent exterior columns, the transfer
girder—designed to span the 40 feet between columns—was suddenly
spanning 160 feet. With this loss of support, the immense weight of all the
beams, columns, and slabs caused the girder to fail in flexure. As it sagged and
fell, the beams, columns, and slabs of the northern wall collapsed along with it.
This sequence of events, from explosion to collapse, took about seven seconds.
64
Of the 11 exterior columns that originally supported the northern wall, only
1 on the east end and 3 on the west end survived. One interior column also
failed, though the cause of this failure remains uncertain. One plausible
theory is that it was knocked out by flying debris. Another is that the blast
destroyed the surrounding floor slabs at the second-floor level and that loss of
the lateral bracing doubled the length of the compression member, causing a
buckling failure.
Regardless of its cause, the failure of this interior column had dire
consequences—the progressive collapse of all columns, beams, and slabs
immediately above it and thus the loss of an additional 11,000 square feet of
occupied space on eight floors. However, the structural core on the south side
of the building was essentially undamaged by the blast, partly because of the
added strength provided by the shear walls.
The Failure Mechanism

As the FEMA investigators attempted to reconstruct the precise mechanism
by which the building collapsed, they discovered several of the lower-story
floor slabs had failed by bending upward. Remember that flexure of a
concrete structural element under load determines how its steel rebars are
positioned. When a beam or slab bends, surfaces that deform into a concave
shape experience compression, and those that deform into a convex shape
experience tension. Steel rebars are used primarily as tension reinforcement
and placed along convex surfaces. This configuration works as long as the
load is being applied downward.
As the blast wave propagated upward through the Murrah Building, the peak
overpressure below each slab greatly exceeded the pressure above the slab for a
few milliseconds. This resulted in a net uplift force that significantly exceeded
the slabs’ own weight, causing them to flex upward—exactly opposite the
bending mode for which they were designed. Thus, tension occurred in the
regions without steel reinforcement, causing the concrete to fracture in these
areas. Once the blast wave had passed, the fractured slabs could no longer
support their own weight—and collapsed.
65
The FEMA investigation determined that 12 slab panels experienced uplift-

induced failure because of their proximity to the detonation point. These
slabs would have failed anyway as their supporting columns collapsed along
with the transfer girder. Nonetheless, recognizing this phenomenon proved
important in guiding the FEMA investigators’ recommendations for the
future design of blast-resistant structures.
These recommendations arose from the investigators’ careful analysis of the

Murrah Building’s various failure modes—the failure of columns by brisance
and overpressure-induced shear, the flexural failure of the transfer girder after
the loss of its supporting columns, and the failure of floor slabs by uplift. Once
these failure modes were understood, the next step was to determine whether
any modifications to the design of these members might have hypothetically
prevented their failure. The FEMA team concluded that the blast resistance of
this reinforced-concrete structural system would have been significantly greater
if its critical columns, beams, and slabs had used reinforcement details developed
for the design of earthquake-resistant structures.
FEMA Analysis Results

Our modern standards for the design of earthquake-resistant structures were
developed under the auspices of the National Earthquake Hazards Reduction
Program (NEHRP), established in 1977. The first set of NEHRP-recommended
standards was published in 1985. An important provision of these standards is a
recommendation to use spiral reinforcement in concrete columns.
Recall that reinforced-concrete columns typically use discrete loops of steel

rebar—called ties—that strengthen a column by confining its concrete core
and increasing its resistance to internal shear forces. The Murrah Building’s
columns used this type of reinforcement. In contrast, spiral reinforcement
uses a single long bar formed into a helix that encircles the flexural
reinforcement along the column’s full length. Because spiral reinforcement
is more effective at containing the concrete core, it greatly enhances the
column’s capacity to dissipate energy during an earthquake. The FEMA
investigators noted that this capacity to dissipate energy would have similarly
enhanced the column’s resistance to an explosion and improved its capacity to
continue carrying load after sustaining blast damage.
66
FEMA’s analysis suggested that the use of spiral reinforcement in the

Murrah Building would not have saved the column that failed by brisance
but probably would have saved the two columns that failed due to blast
overpressure. With the loss of only one exterior column, only 80 feet of the
transfer girder would have failed rather than 160 feet, significantly reducing
the extent of the resulting structural collapse.
Moreover, FEMA suggested that the transfer girder might have survived the
loss of a single column but for one reinforcement detail. Based on the girder’s
deformed shape, we know the rebars were appropriately placed in regions
that experience tension—along all surfaces that deform into a convex shape.
The crucial reinforcement detail was the discontinuity in the bottom rebars
at the supporting columns. In the intact structure, this discontinuity wasn’t
problematic because it occurred in a region experiencing compression. But
when a column was removed, the transfer girder’s bending changed, and the
girder suddenly experienced substantial tension in a region with no flexural
reinforcement. This resulted in a catastrophic fracture through this plane of
weakness, prompting the girder’s collapse.
But if this same girder were designed according to the NEHRP standards
for earthquake-resistant structures, this problematic reinforcement
detail wouldn’t have been permitted. The standards specify that flexural
reinforcement must run continuously through column supports. Had the
Murrah Building’s transfer girder been reinforced in this way, it probably
would have retained sufficient load-carrying capacity to survive the loss of one
column. Similarly, the NEHRP standards require continuous top and bottom
reinforcement in slabs. If the building’s floor slabs had been reinforced like
this, blast-induced uplift would have caused significantly less damage.
The implication of these observations was that a few modest changes to the
Murrah Building’s steel reinforcement might have provided a structural system
with enough resilience to survive the bombing with only localized damage.
Lessons Learned
The FEMA team’s crucial insight—that there’s a strong commonality between
blast resistance and earthquake resistance—led to a new engineering design
philosophy called multi-hazard mitigation. This attempts to account for a
67
wide range of extreme loads caused by earthquakes, intense storms, and blast
effects in a holistic way that is both effective and cost-efficient. According
to FEMA’s investigation report, inclusion of these NEHRP-recommended
reinforcement details—which would have protected the Murrah Building
from both earthquakes and blast effects—would have added only 1% to 2%
to the total building cost.
The Oklahoma City bombing investigation also led to enhanced standards

for the security of government buildings—including the use of vehicle
barriers to increase standoff, use of blast-resistant window glass, and inclusion
of blast loading in the structural design process. Provisions like these will
certainly make government buildings safer by reducing their vulnerability to
explosions. But hopefully, they’ll also deter attacks by convincing potential
attackers their efforts are unlikely to be successful.
Reading
Federal Emergency Management Agency, The Oklahoma City Bombing.
Mlakar, et al., “The Oklahoma City Bombing.”
Sozen, et al., “The Oklahoma City Bombing.”
68
8
Structural
Response: The
Hyatt Regency
Walkways
The past five lessons have explored
engineering failures caused primarily by
extreme loads—wind, rainwater, earthquakes,
vehicle collisions, and blast effects—that were
larger than expected or entirely unexpected
when the structure was designed. This lesson
focuses on failures associated with phase 3 of
the design process—analysis of the structural
response. The case study concerns the Hyatt
Regency Hotel walkway collapse. Here, you
will explore the collapse mechanisms as
well as the communication breakdowns that
contributed to them.
69
8. Structural Response: The Hyatt Regency Walkways
Underestimated
Structural Response
When loads are applied to a structure, the structure responds by experiencing
internal forces and deforming. In engineering design, this structural
response must be calculated and used as the basis for choosing the sizes and
configurations of structural members and connections such that they’ll carry
the load safely and won’t deform excessively. Underestimating the structural
response can be a major contributor to engineering failures.
The quintessential example of a failure caused by underestimated structural

response occurred on July 17, 1981, when two suspended walkways in Kansas
City’s Hyatt Regency Hotel collapsed, killing 114 people. This simple issue
was overlooked by the engineers who designed the walkways because of a
series of communication and coordination failures.
Design-Bid-Build
The three principal players in the planning and delivery of a construction
project are the owner, the design professional, and the constructor.
` The owner is a person, corporation, or government entity that identifies

the need for a project and provides the required money and land.
` For a commercial building, the design professional is usually an

architectural firm. If this company has no in-house engineering capability,
the engineers who will design the building’s structural, mechanical, and
electrical systems are typically hired as consultants to the architect.
` The constructor is typically a general contractor. This company hires and

manages various vendors and subcontractors that perform the specialized
tasks required to build the project.
The organizational and contractual relationship between these parties is

called the project delivery system. Several different types of such systems are
used in the US. The most common is called design-bid-build. In this system,
the owner hires the design professional, who leads a multidisciplinary team
70
that develops a complete design for the facility. The principal product of the
design process is a set of plans and specifications. These describe the project
in sufficient detail so that potential constructors can prepare accurate cost
estimates for building the planned facility.
The owner then advertises the project, and interested general contractors
submit bids for the job. A bid is the price the contractor will charge if selected
to construct the project. The owner usually selects the lowest bid that is
responsive to all specified project requirements. The selected constructor
enters a contract with the owner, hires the appropriate subcontractors, builds
the project for the agreed-upon price, and then turns over the completed
facility to the owner.
The design-bid-build system is popular because competitive bidding tends

to drive down the upfront cost of construction. It also eliminates many
uncertainties in the project cost and scope because the design must be 100%
complete before the constructor is selected. However, it’s relatively slow and
provides few—if any—opportunities for the designer and constructor to
coordinate.
Design-Build
These disadvantages are addressed in the design-build system. Here, the
owner hires one company to assume full responsibility for both design and
construction. This single corporate entity—which might be an architectural
or engineering firm, a construction company, a project management firm, or
a consortium of companies—hires all consultants and subcontractors required
for the project. This system saves time and provides better opportunities for
coordination. However, it can also create significant uncertainties about the
project cost and scope because the contract between the owner and company
is signed before the project is even designed.
Hyatt Regency Kansas City was implemented as a design-build project

between 1978 and 1980. The owner was the Crown Center Redevelopment
Corporation, and the design-build company was a consortium of architectural
firms called PBNDML Architects, Planners, Inc. The architects hired Jack
Gillum as the structural engineer of record—the licensed professional
engineer with legal responsibility for the structural design.
71
In such commercial projects, the owner starts incurring finance costs as soon
as the project begins, but the facility doesn’t start generating income until
it’s completed. In the Hyatt Regency case, the owner addressed this using
a management technique called fast-tracking, in which construction is
begun before the design is complete. Fast-tracking can save time, but it’s also
susceptible to problems with coordination, communication, and delineation
of responsibilities. Such management issues would contribute substantially to
the Hyatt Regency disaster.
The Hotel Design

The hotel’s architectural design comprised a
40-story tower housing 750 guest rooms and
a rotating rooftop restaurant; a service block
housing hotel services and conference facilities;
and a large atrium housing the reception
area, bar, and lobby. The modules’ differing
architectural requirements posed an interesting
structural engineering challenge for Gillum.
The tower and service block would be designed
as conventional reinforced-concrete frames,
but the atrium could be implemented only as a
steel structural system. Heavy steel roof trusses
would span 120 feet between the tower and
service block to enclose the four-story-tall space
and support 12 large skylights set into the roof.
A system of vertically oriented trusses would
support an all-glass façade, sunshades on two
levels, and a second-floor exterior deck.
The most distinctive feature of the atrium interior was a set of three elevated
walkways, suspended from the roof and designed to facilitate movement
between the tower and service block at the second‑, third‑, and fourth-floor
levels. Each walkway comprised a reinforced-concrete deck supported on
transverse steel I-shaped beams. These were supported on larger longitudinal
beams called stringers. The outer ends of the outer pairs of stringers were
supported on shelf angles anchored to the reinforced-concrete frames of the
72
tower and service block. Their inner ends were framed into steel box beams.
Each beam was fabricated from two C-shaped elements called channels,
welded together at the tips of their flanges.
These box beams extended outward beyond the deck to provide attachment
points with steel hangers from which the entire walkway was suspended. In
Gillum’s design, the upper end of each hanger would be secured to the roof
structure; the lower end would be threaded, inserted through a hole at the end
of its associated box beam, and secured with a nut. The third-floor walkway
was supported independently on its own set of six hangers. However, the
second- and fourth-floor walkways were supported—one directly beneath
the other—on one set of hangers. Each hanger would run continuously from
the second-floor box beam and up through the fourth-floor beam to its
connection with the roof structure. This apparent simplicity belied a serious
flaw in the configuration of these vital beam-to-hanger connections.
The Connection Issue

In his structural drawings, Gillum communicated his concept for this
connection with a sketch but didn’t design the connection. Designing it
would have entailed checking that the beam and its welded joints were
strong enough to support the estimated 22,000-pound force applied by the
hanger to the beam’s bottom flange. If the strength were found inadequate,
supplemental reinforcement would be devised to address this. But Gillum did
none of this.
In the 1970s and 1980s, structural engineers typically delegated the design
of most structural connections to the project’s steel fabricator. This way, the
steel fabricator gained the flexibility to choose connection configurations best
suited to the company’s capabilities and preferred fabrication methods. This
often yielded improved economy and constructability.
Any risk associated with this delegation of responsibility was mitigated

by a quality-control process. Before any fabrication work could begin, the
fabricator had to prepare shop drawings that showed how each piece of
steel would be cut and drilled. These drawings had to be approved by the
73
structural engineer of record before the first piece of steel was cut. Therefore,
the engineer had both the opportunity and obligation to identify and fix any
problems during the shop drawing review.
Consistent with this well-established process, the steel fabricator for the Hyatt
Regency atrium—Havens Steel Company—assigned a technician to prepare
shop drawings for the project, starting in December 1978. Shortly thereafter, this
technician encountered an ambiguity in Gillum’s sketch of the beam-to-hanger
connection. Gillum’s sketch was appropriate for the second- and third-floor
connections, where the hanger terminated immediately below the box beam. But
it didn’t address the unique configuration at the fourth floor, where the hanger
was supposed to run continuously through the beam. The only feasible way to get
the nut to its proper position on the hanger would be to thread the entire bottom
30 feet of the rod. However, these threads would be susceptible to damage when
the fourth-floor walkway was lifted into position during construction.
In an attempt to resolve this issue, the Havens technician developed an

alternative two-rod configuration, with each rod threaded only at its end and
secured with a nut. In early January 1979, he called the structural engineer’s
office to request approval for this change. Speaking with Gillum’s project
manager—structural engineer Daniel Duncan—the technician explained
the issue and his proposed design change. Duncan gave his verbal assent but
asked that Havens Steel submit a fully documented request for the change to
Gillum’s office for formal review and approval. Duncan had endorsed a change
that would fundamentally alter the structural response of the fourth-floor
box beams and cause their failure. In the modified configuration, the upward
force applied to the fourth-floor box beam was twice as high as in the original
configuration—and the beam had to be twice as strong to prevent a failure.
Missed Prevention Opportunities

After Duncan verbally approved Havens’ proposed change, at least three other
systemic processes should have prevented this fatally flawed connection from
getting built. All three failed. First, recall that Duncan asked the Havens
technician to submit a formal written request for the change. With a better review
of this modified connection, the engineers would have recognized its fundamental
flaw. But Havens failed to submit the request, and Duncan never followed up on
it. Meanwhile, Gillum probably never even knew about the change.
74
Second, Havens should have checked the reconfigured connection for

structural adequacy in conjunction with the shop drawing preparation. But a
few days after the phone conversation with Duncan, Havens landed a lucrative
contract to do steel fabrication for another major construction project.
The Hyatt Regency job was smaller, and Havens couldn’t do both jobs
simultaneously. Thus, it hired an outside engineering firm to finish the Hyatt
Regency shop drawings. When the firm received the partially completed
shop drawings, it assumed the beam-to-hanger connection had already been
designed and never checked it for structural adequacy. The firm completed
the drawings and sent them back to Havens.
Third, in mid-February 1979, Havens sent the completed shop drawings

to Gillum’s office for final review and approval. As the project was behind
schedule, the construction contractor requested expedited approval of the
drawings. In response, Gillum assigned the review to a senior technician who
hadn’t previously worked on this project. The technician was unaware of the
changed connection configuration and didn’t raise any concerns about it.
Gillum signed off on the shop drawings and returned them to Havens.
Even during construction, there were warning signs and missed opportunities.
On several occasions, workmen noticed the recently erected walkways were
sagging excessively—indicating that the box beams were already in distress
when carrying only the walkways’ own weight. The contractor reported these
excessive deformations to the architect’s on-site representative, but no one
passed this report to the structural engineer.
Around this time, Gillum requested to perform on-site inspections of the

construction work. The owner denied his request to avoid paying the extra
cost of his inspection services. Had Gillum been allowed on-site, his trained
eye would surely have noticed that the box beams were failing in slow motion.
Even worse, a mandatory design review by the Kansas City Public Works
Department did not identify the connection deficiency but did mandate that
the walkways’ steel framing be fully encased in gypsum board to improve
its fire resistance. Once this fireproofing was installed, the box beams were
entirely hidden from view. The possibility that anyone might notice their
abnormal deformations dwindled to zero.
75
The Walkway Collapse

In July 1980, the Hyatt Regency opened for business. A year later, on the
evening of July 17, 1981, a dance party was in full swing, and about 100 people
were observing the festivities from the overhead walkways. At 7:05 pm, guests
heard a loud bang, and the second-floor walkway lurched downward a few
inches. Then, it sagged sharply and plunged to the atrium floor. Many people
were crushed beneath the falling structure; others were struck by flying debris.
The reconfiguration of the fourth-floor beam-to-hanger connection had

caused the upper hanger to apply an unexpectedly large, concentrated force
to the bottom of the box beam. This force, estimated at more than 20,000
pounds, caused the bottom flanges of the steel channels to bend upward
until the weld fractured. With the joint between the two flanges broken,
the nut at the bottom of the hanger pulled through the gap. The box beam
dropped about eight inches, stopping only when the nut impacted the beam’s
upper flange. The impact immediately fractured the upper weld of the box
beam, allowing the hanger and nut to pull completely through the two
channels. This failure mode was attested by the distorted fourth-floor box
beams recovered from the wreckage—and by the upper hanger rods, which
remained, fully intact, dangling from the ceiling.
Once one beam-to-hanger connection failed, the adjacent connections were

instantaneously overloaded and failed in quick succession. In a few seconds,
the chain reaction was complete, and the fourth-floor walkway had broken
free of all six supporting hangers. The fourth- and second-floor walkways fell
as a unit to the atrium floor.
Contributions to the Collapse

Numerous investigations were initiated by various parties. Recognizing the
need for an authoritative external perspective, Kansas City’s mayor also
requested an investigation by the National Bureau of Standards. In addition
to confirming the collapse mechanism discussed, the bureau’s investigation
made four important observations.
76
First, the walkways were not overloaded when they failed. An analysis of
videotapes shot before the collapse verified that there were, at most, 64 people
on both the second- and fourth-floor walkways at the time. Had the structure
been properly designed to support its code-specified loads, each walkway
could have carried more than 400 people with an ample margin of safety.
Second, the walkways didn’t fail because of resonant vibrations caused by
people dancing to the music, as reported in the media.
Third, Gillum’s decision to fabricate the box beams by welding pairs of steel
channels together was a major contributor to the failure. A high-quality weld
can be as strong as the pieces of steel it joins. However, in the Hyatt box
beams, the welds were too small—and large holes for the hangers were drilled
directly through the welds, weakening them. This weakness could easily have
been remedied, such as by adding steel bearing plates on the top and bottom
of the box beams. Had an engineer designed the connection, the need for such
reinforcement would have been obvious. Fourth, the disaster’s severity was
exacerbated by a lack of redundancy in the design of the walkway structural
system. The localized failure of one connection shouldn’t have triggered a
progressive collapse of the entire system.
A grand jury considered charges of criminal negligence against Gillum

and Duncan but ultimately found them not guilty due to lack of evidence.
Undeterred, the Missouri Board for Architects, Professional Engineers,
Professional Land Surveyors, and Professional Landscape Architects charged
both men with gross negligence, misconduct, and unprofessional conduct. The
board found them guilty and revoked their licenses to practice engineering.
Many aspects of the Hyatt Regency disaster involved extenuating

circumstances beyond the engineers’ control. Yet, if any aspect of this design
warranted special attention, it was the critical connection supporting a
nonredundant, multilevel suspended pedestrian walkway. Duncan knew
Havens had changed the connection configuration but failed to follow
up when Havens didn’t submit a written request for the change. Most
importantly, Gillum approved the final shop drawings without checking
them personally. Thus, he failed in his paramount responsibility as the
structural engineer of record—to ensure public safety. However, many other
organizations contributed substantially to the catastrophe.
77
` Havens Steel proposed the flawed connection configuration, failed to

submit a written request for the change, and failed to fulfill its design
responsibility.
` Crown Center Redevelopment Corporation set the conditions for the

disaster by fast-tracking a complex project and refusing Gillum’s request to
perform on-site inspections.
` The architect—PBNDML—failed to inform the engineer about the

contractor’s observations of excessive deformations in the walkway
box beams.
` The city’s Division of Public Works failed to identify the structural

deficiency in its design review or on-site inspections.
Lessons Learned
The Hyatt Regency walkway collapse exposed deep, systemic flaws in the
processes by which owners, design professionals, and constructors were
managing complex projects in the US during this period. Consequently, the
disaster stimulated new laws, policies, and technical standards to improve the
delineation of professional responsibilities, design change processes, and use of
independent design reviews.
This case reveals an important insight about how the engineering enterprise
has changed over the past few centuries. Today, the development of
constructed works has become a corporate endeavor, performed by large
ad hoc organizations composed of many specialized companies. Now,
management issues are as important as engineering issues. Failures are as
likely to result from coordination and communication breakdowns as from
design and construction errors.
Reading
Bernhardt, “Hyatt Regency Skywalk Collapse Remembered.”
Marshall, et al., Investigation of the Kansas City Hyatt Regency Walkways
Collapse.
78
9
Bridge
Aerodynamics:
Galloping Gertie
This lesson continues this course’s
exploration of engineering failures caused
by an unanticipated structural response. In
the early 1800s, a science-based analysis
tool inspired the design of bridges that were
increasingly optimized for gravity loads but
increasingly vulnerable to wind-induced
vibration—suspension bridges. This case
study chronicles the trials and errors of the
first suspension bridges, the subsequent
advances made in their construction, and the
folly of the Tacoma Narrows Bridge design,
which led to its collapse.
79
9. Bridge Aerodynamics: Galloping Gertie
The Issue with

Suspension Bridges
Even before the Tacoma Narrows Bridge opened in July 1940, it had earned the
nickname Galloping Gertie for its unexpectedly large wind-induced vibrations.
Four months later, the suspension bridge tore itself to pieces in a 42-mph wind.
At the heart of a typical suspension bridge are its main cables. These run
continuously from anchorages on both shorelines, up over the tops of two
towers, and then between the towers—falling naturally into an approximately
parabolic shape. The bridge deck, which supports the roadway, is suspended
from the main cables by smaller vertical cables called suspenders.
The suspension bridge is an efficient structural form for carrying uniform

loads. However, it isn’t particularly well suited for carrying concentrated
loads, like a heavy truck or locomotive. Because the cables are flexible, the
concentrated load distorts their shape, and consequently, the deck experiences
extreme vertical deflections. Because of this inherent flexibility, suspension
bridges are also susceptible to vibrations caused by wind. Both challenges
can be addressed by adding a stiffening truss to the structural system. With
the stiffening truss in place, concentrated load no longer causes extreme
deflections, nor is the deck susceptible to excessive vibrations. The stiffening
truss prevents the cables from changing shape under load.
80
The Birth of Suspension Bridges

In 1801, the world’s first suspension bridge capable of carrying vehicular
traffic was built in Uniontown, Pennsylvania, by James Finley. The main
“cables” on this bridge were forged iron chains. After patenting his design
in 1808, Finley built (or licensed the construction of) up to 40 iron-chain
suspension bridges throughout the northeastern US. Finley had no formal
engineering training; thus, these structures reflected a trial-and-error design
process that included nearly as many errors as trials. Most of these bridges
collapsed within a few decades of their construction.
Although Finley’s bridges were ultimately unsuccessful, his idea caught on in

Great Britain, where Royal Navy officer Samuel Brown invented a new type
of iron chain and used it to build the Union Bridge over the River Tweed.
Thus began a long, proud British tradition of empirically designed iron-
chain suspension bridges—a tradition that rejected the newfangled scientific
theories of structural analysis taking hold in France at that time.
Among the principal proponents of those newfangled theories was French

engineer Claude-Louis Navier, who published the world’s first scientific
treatise on suspension bridges in 1823. In this publication, Navier applied
the principles of Newtonian physics to develop mathematical equations
for predicting the structural response of a parabolic cable. Of particular
importance was the equation for the deflection of an unstiffened cable with
span length L and sag s, loaded by both bridge weight w and concentrated
load P. This equation had an influential implication for 19th-century bridge
engineers—d can be decreased by increasing w and L. In other words, a
cable’s deflection due to a concentrated load can be minimized using a long,
heavy span.
To test Navier’s equation, say two cables are suspended side by side—one
loaded with a series of equal weights that approximate a uniform loading
and one with no loading at all (other than the weight of the cable itself).
If we hang a concentrated load from the center of each cable and compare
the magnitudes of the resulting deflections, the midspan deflection of the
uniformly loaded cable is noticeably less than that of the cable without
uniform loading. This demonstrates that the deflection due to a concentrated
load can be reduced by increasing the bridge’s overall weight.
81
Based on this mathematical formulation, Navier concluded that long-span

suspension bridges didn’t need stiffening trusses because the bridge’s weight
would control deflections more economically than any structural solution.
His theory highly influenced the design of unstiffened suspension bridges
for more than three decades—even though its fatal flaw should have been
apparent much sooner.
Recall that a stiffening truss serves two functions—it controls deflections

under concentrated loading, and it prevents wind-induced vibration. The
fundamental problem with Navier’s equation was that it addressed only the
former. Thus, the progressively longer unstiffened suspension bridges built
during this era could carry concentrated loads, but as their lengths increased,
they became increasingly vulnerable to wind-induced vibration. Between
1818 and 1889, windstorms destroyed or seriously damaged at least 10 major
suspension bridges, including Charles Ellet’s bridge over the Ohio River in
Wheeling, West Virginia.
Roebling’s System
This and other mid-19th-century collapses were so traumatic that they might
have led to the demise of the suspension bridge as a structural idea. But then
came John Roebling, who started building great suspension
bridges—including the Niagara Falls Suspension Bridge
in 1855, the Cincinnati-Covington Bridge in 1866, and
the Brooklyn Bridge, the design of which was still
in progress when Roebling died in 1869. Through
these projects, Roebling developed a highly effective
system for preventing wind-induced vibration.
Roebling’s system consisted of substantial stiffening

trusses augmented by diagonal stays—steel cables
radiating out from the towers to the trusses.
The analysis methods of the day couldn’t
predict the structural response of
this interconnected web of cables,
suspenders, stays, and trusses. But
Roebling relied on his extraordinary
John Roebling
82
engineering judgment and experience to develop this system, and refined it

through a series of bridge projects and careful observation of their in-service
performance. In doing so, he solved the wind-induced vibration problem.
Elastic Theory
Meanwhile, proponents of science-based engineering were pursuing new
theoretical approaches to suspension bridge analysis. These efforts came to
fruition in 1888, when Austrian engineer Josef Melan proposed the first
practical science-based analysis method for a parabolic cable structurally
connected to a stiffening truss. Called the elastic theory, it avoided excessive
mathematical complexity by making several simplifying assumptions—most
importantly, that the shape of a stiffened parabolic cable doesn’t change
in response to concentrated loads. As this simplification was conservative,
bridges designed according to this theory tended to have excessively robust
stiffening trusses.
The elastic theory worked and was generally seen as a step forward from
Roebling’s empirical system because it was grounded in scientific principles.
But the ungainly proportions of the Williamsburg Bridge also demonstrated
that the theory’s simplifying assumptions would produce excessively
conservative, uneconomical designs.
Deflection Theory
In response to the need for a more sophisticated analysis method, Josef
Melan developed the deflection theory, which accounts for the load-induced
deflection of both the cable and stiffening truss. Thus, it could predict a
suspension bridge’s response to uniform and concentrated loads with much
greater accuracy. Both Melan’s deflection theory and Navier’s equation led
engineers to essentially the same conclusion—longer, heavier spans require
less stiffening. Thus, 20th-century engineers responded to the deflection
theory by designing a series of suspension bridges with progressively longer
spans and progressively less stiffening, without considering their increasing
susceptibility to wind-induced vibration.
83
Deflection theory was popularized in the US by Leon Moisseiff. After

earning his civil engineering degree, Moisseiff began his career with the New
York City Bridge Department and helped design the Manhattan Bridge—the
world’s first major structure designed according to the deflection theory.
By the 1930s, he had become America’s leading expert on the application
of this powerful tool. During this era, suspension bridges were going up
across the US, even as the Great Depression placed severe constraints on
their construction cost. The deflection theory seemed perfectly suited to the
moment, as it allowed for the economical design of longer spans.
Because of his unique expertise, Moisseiff was hired as a consulting engineer

for nearly every great suspension bridge built during this era, including
the San Francisco–Oakland Bay Bridge, Golden Gate Bridge, and Bronx-
Whitestone Bridge. In 1938, he learned that the Washington State Toll
Bridge Authority had petitioned the federal Public Works Administration for
$11 million to build a suspension bridge across Puget Sound at the Tacoma
Narrows. This cost estimate was based on a preliminary design developed
by Clark Eldridge, one of the state’s in-house engineers. Eldridge’s design
included a robust, 25-foot-deep stiffening truss, appropriately proportioned to
resist the extreme winds that often blow through the Narrows.
But Moisseiff had other ideas. Exploiting the deflection theory, he prepared
an independent alternative design proposal with an estimated cost of only
$8 million. Thus, the state had no choice but to hire Moisseiff to design the
bridge. Through further refinements, he reduced the project cost to $6.4
million—58% of the state’s original estimate.
Moisseiff’s Design
The overall configuration of Moisseiff’s design was similar to Eldridge’s
original proposal—two 425-foot-tall steel towers supporting two main
cables, each a 17-inch-diameter bundle of more than 6,000 galvanized
steel wires. Suspended from these cables were a 2,800-foot main span and
two 1,100-foot side spans. Moisseiff achieved his low cost primarily by
replacing Eldridge’s heavy stiffening truss with a pair of slender, 8-foot-
deep girders—large enough to provide the strength and stiffness required
by the deflection theory. These stiffening girders were 39 feet apart, held in
alignment by transverse beams. Stringers spanning between these transverse
84
beams supported the reinforced-concrete deck, which carried a two-lane

roadway and two sidewalks. Underneath, V-shaped braces were added to resist
wind loads.
During this era, it was standard practice to idealize wind loading as a static
pressure applied to the structure’s vertical surfaces—and resisted entirely by
the deck structure bending sideways. In this mode, the stiffening girders,
beams, and V braces function essentially as a truss turned on its side. But
for the Tacoma Narrows Bridge, this approach proved problematic. Because
the two-lane deck was so narrow, it didn’t provide adequate lateral bending
strength to resist the wind. Indeed, during a routine review of Moisseiff’s
design, an independent consultant expressed grave concerns about this narrow
width—and recommended that the girders be moved significantly farther
apart. But Moisseiff used the deflection theory to justify the narrow width
specified in his original design.
Recall that Melan developed the deflection theory strictly for predicting
a bridge’s response to gravity loads. But Moisseiff reasoned that just as
deflection theory takes advantage of the cables’ vertical deflection to resist a
concentrated gravity load, it can also take advantage of the cables’ horizontal
deflection to resist wind loads. When applied in this way, deflection theory
predicts the cables will support about half of the total wind load applied to
the stiffening girders. Thus, Moisseiff justified retaining the deck’s original
39-foot width—and not strengthening the wind bracing. The result was a
deck structure of unprecedented slenderness, with a depth-to-span ratio of 1
to 350 and a width-to-span ratio of 1 to 72—much thinner than any other
major bridge. The deck was also significantly more flexible than that of any
long-span bridge in existence.
A bridge’s flexibility can be manifested in three different modes of

deformation—vertical bending, horizontal bending, and torsion. Moisseiff’s
design was flexible in vertical bending because of its shallow stiffening
girders, flexible in horizontal bending because of its narrow width, and
flexible in torsion because of its open H-shaped cross section. The extreme
flexibility of Moisseiff’s stiffening girder system became an issue during an
external design review required for obtaining federal project financing. The
85
consulting engineer performing the review expressed strong reservations about

the system’s slenderness. But Moisseiff’s stellar reputation won the day, and
financing was approved over the consultant’s objection.
The Tacoma Narrows

Bridge Collapse
Construction began in September 1938, and even before the bridge was
completed, it started experiencing substantial flexural oscillations, even
during moderate winds. After completion, the Toll Bridge Authority hired
a consultant—Professor Frederick Burt Farquharson from the University
of Washington—to study the issue. Farquharson built a scale model of the
bridge, tested it in a wind tunnel, and used the results to devise strategies for
reducing these vibrations. Farquharson’s fixes included heavy steel tie-down
cables attached to the side spans and anchored to massive concrete blocks and
diagonal stays at the midspan to restrain the longitudinal movement of the
86
main cables. These measures were partially effective, but the tie-down cables
kept breaking—an indicator that the forces driving these vibrations were
larger than expected.
In conjunction with Farquharson’s research, a movie camera was mounted

on top of the toll collector’s building to document the bridge’s motion. This
camera captured the collapse of the Tacoma Narrows Bridge on November
7, 1940. Early that morning, Kenneth Arkin, an official from the Toll Bridge
Authority, arrived at the bridge. A stiff wind was blowing, and the deck
was undulating noticeably in the vertical bending mode. Around 10:00 am,
the wind speed increased to 42 mph, and one of Farquharson’s mid-span
stays broke loose. This triggered a change in the mode of oscillation—from
relatively benign bending undulations to increasingly violent torsional
oscillations. Arkin immediately closed the bridge. Suspender cables started
snapping, and moments later, several more suspenders failed. The deck could
no longer support its own weight, and the entire main span collapsed.
In the immediate aftermath, the Public Works Administration organized

a three-person investigative panel. Two of the panelists were noted bridge
engineers—Othmar Ammann, who designed the George Washington and
Bronx-Whitestone bridges, and Glenn Woodruff, who designed the Oakland
Bay Bridge. The third member was Theodore von Kármán, director of the
Guggenheim Aeronautical Laboratory at Cal Tech and the world’s preeminent
aerodynamicist. After much analysis, the panel exonerated Moisseiff for the
failure on the grounds that his design was consistent with the current state of
knowledge and all governing design standards. The collapse, they reported,
was caused by aerodynamic effects that only became evident because of the
bridge’s great flexibility.
Vortex Shedding
But was this an adequate basis for exonerating Moisseiff? Granted, since
the time of the Tay Bridge disaster of 1879, bridge design standards had
only considered wind as a static pressure, with no explicit consideration of
the structure’s dynamic response to moving air. But the aerodynamic effect
observed at Tacoma Narrows had been plainly evident in the many wind-
induced failures of 19th-century suspension bridges. And the great flexibility
of Moisseiff’s design was his own choice, motivated primarily by his desire
87
to win the design contract by undercutting his competition. He justified this

choice by an extreme, untested application of the deflection theory, defying
the well-reasoned objections of an independent design reviewer. Nonetheless,
the panel’s final report included a far-reaching recommendation for more
research on the aerodynamics of suspension bridges.
Von Kármán attributed the collapse to vortex shedding. A vortex is a region

of turbulent air swirling in a nearly circular path. When air flows around a
blunt object, a series of vortices form and then detach from alternating sides
of the object. Each vortex is a region of low pressure—thus, the object is
momentarily pulled toward the vortex as it forms. In vortex shedding, the
alternating vortices cause alternating forces, oriented perpendicular to the
airflow. Like a flag flapping in the breeze, the object responds by oscillating.
Aeroelastic Flutter
Today, most experts agree that vortex shedding caused the benign vertical
bending vibrations the Tacoma Narrows Bridge had been experiencing since
its construction. However, the violent torsional oscillations that destroyed it
resulted from aeroelastic flutter—a complex, dynamic interaction between
moving air and a flexible structure.
When the bridge’s H-shaped stiffening girder system was oriented

horizontally, two small vortices formed immediately behind the upwind
stiffening girder. Because they were symmetrically positioned above and
below the deck, their associated low-pressure regions were essentially in
balance and exerted no net force on the deck. But on the morning of the
collapse, the broken diagonal stay cable apparently initiated a small torsional
oscillation. As the deck twisted, the changing airflow caused the upper vortex
to get larger and the lower one to move downwind. Thus, their associated
forces were positioned such that they increased the deck’s rotation.
When the girders’ elasticity finally stopped this rotation and sent the deck
rebounding back in the opposite direction, the upper vortex detached. As it
moved downwind, its associated force further accelerated the rebound. The
second half of each oscillation was a mirror image of the first. New vortices
88
formed behind the upwind girder, reinforcing its rotation, and then broke free
and reinforced the rebound. These self-excited oscillations continued to grow
until the structure broke apart.
This is aeroelastic flutter. When the wind speed is just so, the forces caused by
the moving vortices are perfectly synchronized with the motion of the girder
system in a way that reinforces the structure’s natural torsional oscillations.
But the most fundamental cause of the disaster was not an aerodynamic
effect; rather, it was Moisseiff’s decision to use stiffening girders of
unprecedented slenderness—a decision that relied too heavily on an unproven
science-based analysis tool and failed to consider ample historical evidence of
past wind-induced failures.
Lessons Learned
Fortunately, Moisseiff’s failure had a positive impact on subsequent
engineering practice. By the time of the Tacoma Narrows collapse, many
other bridges designed using deflection theory were also experiencing
unexpected wind-induced oscillations. The collapse prompted substantial
structural modifications to the Golden Gate Bridge, Bronx-Whitestone
Bridge, and other spans—all of which are performing well today.
The first major American suspension bridge built after the Tacoma Narrows
disaster was a new Tacoma Narrows Bridge, completed in 1950. With its
robust 33-foot-deep stiffening truss and several research-based mechanisms
for reducing wind-induced vibrations, this structure clearly reflects the lessons
learned from the failure of its predecessor.
The Tacoma Narrows investigation also led to the field of bridge

aerodynamics. Consequently, today, no long-span bridge is built anywhere
in the world without extensive wind-tunnel testing of scale models. A
streamlined box girder—first used in the UK’s Severn Bridge—is an
elegant and effective solution to the challenge of wind-induced vibration. In
comparison with the open H-shaped cross section of the original Tacoma
Narrows Bridge, its closed cross section provides greatly increased torsional
resistance. And when the wind blows, its streamlined shape significantly
reduces the formation of vortices and thus is significantly less susceptible to
oscillation than the blunt shape of Galloping Gertie.
89
Reading
Billah and Scanlan, “Resonance, Tacoma Narrows Bridge Failure, and
Undergraduate Physic Textbooks.”
Buobopane and Billington, “Theory and History of Suspension Bridge
Design.”
Griggs, “Tacoma Narrows Bridge Failure 1940.”
Kawada, History of the Modern Suspension Bridge.
Morgenthal, “Fluid-Structure Interaction in Bluff-Body Aerodynamics and
Long-Span Bridge Design.”
Myerscough, “Suspension Bridges.”
Washington State Department of Transportation, “People of the 1940
Narrows Bridge.”
90
10
Dynamic
Response:
London’s
Wobbly Bridge
In June 2000, a new state-of-the-art pedestrian
bridge over the Thames was opened to the
public, but an unanticipated dynamic response
to pedestrian loads became immediately
apparent. Many aspects of the Millennium
Bridge design presented unprecedented
structural engineering challenges. This lesson
explores the unique design of the Millennium
Bridge versus conventional suspension bridges
and introduces several phenomena, such as
vibrational modes and synchronous lateral
excitation, to explain why the bridge wobbled—
and how it was fixed.
91
10. Dynamic Response: London’s Wobbly Bridge
The Wobbly Bridge

The Millennium Bridge was the product of a unique design competition.
Teams of architects, engineers, and artists had developed creative proposals
for a structure destined to become a London landmark. The winning design
was this unconventional three-span suspension bridge developed by Foster
and Partners (the architect), the Arup Group (an engineering firm), and Sir
Anthony Caro (a sculptor).
On June 10, 2000—opening day—90,000 people crossed the bridge, with as

many as 2,000 on the structure at any one time. At first, everything was fine.
But whenever a large number of people concentrated on the bridge’s center
or south spans, the deck began swaying noticeably from side to side. As the
bridge oscillated, the pedestrians seemed to fall into step with the oscillations,
and the sway grew larger. Eventually, the amplitude of these vibrations—
the amount of movement in either direction—grew to about three inches.
Two days later, after an unsuccessful attempt to address the problem by
92
limiting the number of people crossing at any one time, authorities closed
the Millennium Bridge, now dubbed the Wobbly Bridge, and initiated an
investigation of the unexpected vibrations. The crossing would remain closed
for nearly two years.
The Bridge’s Structural System

To begin understanding why the bridge wobbled, consider its unique
structural system.
` The bridge’s position is defined by massive concrete abutments on the

Thames’ north and south banks. Their different configurations were
driven by the local topography: The north abutment is squeezed between
two existing buildings, its height controlled by the hill on which St. Paul’s
Cathedral stands. The southern terminus is a low, open plaza adjacent to
the Tate Modern gallery.
` In the river, each of the two towers consists of a solid concrete pier
surmounted by a V-shaped tubular steel superstructure.
` At the heart of the structural system are eight main cables, four on each
side, that are clamped to the towers and anchored at the abutments. The
towers and abutments delineate spans of 81, 144, and 108 meters.
` The south-side anchorage is a strut-and-tie system that converts the cables’

significant horizontal tension into an upward force applied to the massive
concrete foundation below.
` A series of transverse steel frames are clamped to the cables. Because these
frames must accommodate the cables’ sag, each has its own unique shape.
` These frames support two longitudinal steel tubes, which function as

beams to support the deck—a series of aluminum planks spanning
transversely between streamlined aluminum fairings.
` The longitudinal tubes also support elegantly curved handrail stanchions,

which contribute significantly to the structure’s unique appearance, as does
the Needle—a dramatic V formed by the deck splitting into two halves
93
at the southern anchorage. The Needle provides a smooth walkway down

to the plaza area below the bridge. Its design required several transverse
frames to be divided in half.
The bridge’s innovative structure differs from that of a conventional

suspension bridge in four respects:
` First, to comply with regulatory height restrictions associated with the

St. Paul’s Cathedral and maintain clear sight lines for pedestrians using
the bridge, the main cables’ sag is roughly six times less than that of a
conventional suspension bridge.
` Second, the cables sag downward and inward, contributing significantly to

the structure’s lateral stiffness.
` Third, the bridge uses no suspenders; rather, the deck is rigidly connected
to the cables by the transverse frames.
` Finally, the main cables’ inward sag provides enough lateral strength and
stiffness that no diagonal bracing is needed to resist wind loading.
Vibrational Modes
After the bridge was closed on June 12, 2000, Arup was called in to
investigate the problem and devise a solution. The firm developed a
comprehensive research program for designing a targeted structural retrofit.
This program began with on-site testing using a mechanical shaker to vibrate
the bridge and measuring its dynamic response with accelerometers mounted
on the structure. These tests were intended to validate the sophisticated
computer model used to design the original structure, ensuring that the same
model could be used to design the retrofit.
These tests also verified the specific modes of vibration that had occurred
on opening day. Recall that a bridge can experience different vibrational
modes—vertical, lateral, and torsional—and that each mode has its own
characteristic natural frequency, measured in cycles per second (or hertz).
Arup’s tests of the Millennium Bridge determined that pedestrians were
exciting the lateral vibrational mode in the south span at a frequency of 0.8
hertz and in the middle span at a frequency of 1 hertz. These frequencies were
94
significant because they closely match the average frequency of the human
gait at a normal walking pace. Three left and right steps in three seconds
corresponds to a frequency of 1 hertz.
Since the two bridge spans had natural frequencies nearly equal to the
frequency of the human gait, it seems possible that the structure’s unexpected
dynamic response was caused by resonance. Resonance occurs when a
periodically applied force matches the structure’s natural frequency and causes
the vibrations’ magnitude to increase with each successive cycle. Logically,
the Millennium Bridge could have experienced lateral resonance only if the
pedestrians crossing the bridge were imparting a significant, periodic lateral
force to the deck.
Lateral Force
In 2000, there were no reliable research data on lateral forces imparted by
people walking. Thus, Arup collaborated with two universities to conduct
laboratory tests aimed at quantifying these lateral forces. For example, in
one series of tests, pedestrians walked on a specially instrumented treadmill
operating at a normal walking pace while also being subjected to lateral
vibrations at a controlled frequency and amplitude. These tests produced two
important findings.
First, even if a person is walking on a stationary surface, each step imparts

a small lateral force—typically about 4% of the person’s body weight,
directed outward. When we walk, our body weight is being supported on
one foot most of the time, and this foot is never directly below our center of
gravity. Thus, a small lateral force is needed to maintain balance. Second, if
the surface is oscillating laterally at a frequency close to the natural human
walking pace of 1 hertz, the lateral force increases as the oscillation amplitude
increases. At amplitudes comparable to those experienced by the Millennium
Bridge on opening day, these pedestrian-induced lateral forces could exceed
10% of a person’s body weight. The average human body weighs about 140
pounds, making the associated lateral force about 14 pounds per person. The
Millennium Bridge’s shortest span can accommodate about 700 people. If
most people were walking in step, the total periodic lateral force applied to the
span could be about five tons.
95
Arup’s investigators hypothesized the following sequence of events, based

on their test results and an analysis of videos taken on opening day: With a
sufficiently large number of people on a span, a moderate number of random,
simultaneous footfalls caused the bridge to slightly sway horizontally. People
who perceive this motion instinctively begin synchronizing their steps with
the oscillations. This synchronization occurs because people subconsciously
feel more comfortable walking in step with a moving surface. This provides
more predictability and a better sense of balance.
Because of this instinctive response, the pedestrians walking in sync with the
bridge’s motion were also inadvertently applying periodic lateral forces to the
bridge at its natural frequency. These forces caused the oscillation amplitude
to increase, which had two consequences. First, the increasing amplitude
caused the pedestrian-induced lateral forces to increase. Second, as the
oscillations become more perceptible, more people fell into step with them.
These effects caused further increases in the vibrations’ amplitude. This self-
reinforcing process continued until the system reached frequency lock-in, with
nearly everyone walking in step with the ever-increasing oscillations.
To prove this hypothesis, Arup organized large groups of volunteers and

had them walk across the Millennium Bridge. These experiments were
choreographed, with separate tests for each span and with the number of
pedestrians being increased at controlled time intervals. Initially, the span’s
motion was minimal, and the effect of the increasing number of pedestrians
was small. But when the number of pedestrians reached 166, the oscillation
amplitude increased dramatically—and the bridge’s motion became so violent
that the test had to be stopped. The results from the other spans showed a
similar threshold number of pedestrians, beyond which sudden, unstable
resonant vibrations began.
Synchronous Lateral Excitation

This experimental validation of Arup’s hypothesis was sufficiently definitive
that the phenomenon received an official name—synchronous lateral
excitation. It was soon addressed in a new provision of the UK’s bridge
design standards. Researchers were also successful in modeling synchronous
lateral excitation mathematically so that other bridges’ vulnerability to this
phenomenon could be determined analytically.
96
To demonstrate this phenomenon, imagine four mechanical metronomes on

a platform supported on two beverage bottles, which serve as rollers allowing
the platform to move from side to side. The metronomes are started randomly
so that their motion is not synchronized. The metronomes gradually
synchronize their independent movements to the platform’s oscillation until
they’re perfectly in sync. This is frequency lock-in—the condition at which
synchronous lateral excitation is fully developed, with everyone walking in
step. The phenomenon’s mathematical predictability is useful for engineers
attempting to prevent synchronous lateral excitation in pedestrian bridges.
Synchronous lateral excitation can also occur in more conventional bridges.

As Arup’s research demonstrated, only two conditions are necessary for it to
occur: (1) a natural frequency below 1.3 hertz in the lateral vibration mode,
and (2) a sufficiently large number of people walking on the span. A literature
search performed during Arup’s investigation revealed that over the past few
decades, numerous bridges in the UK, Germany, Japan, and New Zealand
have experienced synchronous lateral excitation. Most were isolated incidents
resulting from unique circumstances.
Because synchronous lateral excitation is a self-limiting phenomenon,

these oscillations will likely never destroy a bridge. As a bridge experiences
increasing pedestrian-induced oscillations, the pedestrians will feel
increasingly uncomfortable and will eventually stop walking to gain
more stability. When enough people have stopped walking, the associated
pedestrian-induced excitation will also stop.
Fixing the Millennium Bridge

Based on Arup’s estimate, the peak lateral acceleration experienced by
pedestrians crossing the Wobbly Bridge on June 10, 2000, was more than
0.25 g—25% of the acceleration of gravity. Thus, for a 180-pound person,
the bridge’s motion felt like a lateral force of roughly 45 pounds pushing from
side to side. That’s at least five times higher than the magnitude of lateral
acceleration known to cause physical discomfort in humans.
97
Thus, after identifying and quantifying the effects of synchronous lateral

excitation, Arup’s engineers set about fixing the Millennium Bridge.
Their goal was to devise a structural retrofit that would reduce the lateral
acceleration of all three spans by a factor of 10—to 0.025 g or less. To achieve
this goal, they considered three alternative remedies:
Alternative 1—the simplest and least expensive—was to place a permanent

limit on the number of people using the bridge at any time, ensuring that the
threshold for triggering lateral excitation was never exceeded. But this option
would have significantly compromised the bridge’s function and was rejected.
Alternative 2 was to stiffen the bridge sufficiently to increase its natural

frequency above 1.3 hertz—the threshold of vulnerability to this
phenomenon. This was theoretically viable. The easiest way to stiffen a
structure laterally is to add diagonal braces between the bridge’s transverse
frames. The result would be a horizontal truss, which would stiffen the
structural system with respect to this sort of side-to-side motion. However,
the bracing system required to achieve this natural frequency would have
unacceptably altered the bridge’s appearance.
The engineers were left with alternative 3—to increase the structural
system’s damping. Damping is the tendency of vibrations to die out over
time. For example, if you stretch a spring-mass system and then release it,
the oscillations get slightly smaller with each cycle, eventually dying out. In
this case, the damping is caused primarily by air resistance on the moving
mass. Because the damping effect is small, it will take a long time for these
oscillations to die out completely.
Damping
All structures exhibit this sort of intrinsic damping due to air resistance,
friction in the connections, etc. But it’s also possible to add artificial damping
to improve a structure’s dynamic performance. Arup’s analytical studies
demonstrated that adding sufficient artificial damping to the Millennium
Bridge could prevent resonant vibrations from occurring. Furthermore, this
strategy could be applied without compromising the bridge’s function or
drastically altering its appearance.
98
Thirty-seven highly specialized, industrial-strength shock absorbers—called

linear viscous dampers—were incorporated into the structural retrofit.
Seventeen were mounted underneath the bridge deck. Longitudinal tubes
supported the bridge deck. To implement the retrofit, pairs of chevrons
were installed on every other transverse frame, with a linear viscous damper
connecting their apexes. When the deck structure oscillates laterally, its
rectangular panels distort into parallelograms. With this retrofit installed,
the distortion from rectangle to parallelogram causes the damper to extend or
compress, and the associated damping prevents the oscillations from growing.
Sixteen more dampers were mounted at the piers, and four connected the
deck structure to the ground at the Needle, near the southern abutment.
The retrofit also included 52 tuned mass dampers, intended primarily to
prevent excessive vertical oscillations. The Arup engineers had been concerned
that once the lateral oscillations were suppressed by the dampers, vertical
or torsional vibration modes might manifest themselves. Once they became
perceptible, synchronous excitation might cause them to grow uncontrollably,
just as the lateral oscillations had.
Arup’s comprehensive retrofit of the Millennium Bridge was installed between

May 2001 and January 2002. After extensive testing, the bridge was reopened
on February 22, 2002. Since then, synchronous lateral excitation has not
recurred.
Lessons Learned
Considering the Millennium Bridge case, three important insights come
to mind:
First, this case demonstrates that engineering failures don’t always involve
catastrophic events. The closure of the original Millennium Bridge was a
temporary engineering failure because the structure couldn’t perform its
primary function following the discovery of its unexpected dynamic response.
Thus, an “engineering failure” encompasses not only technological systems
that break but also those that don’t perform as their designers intended.
99
Second, this case illustrates why our structural design process doesn’t end with
the completed structure. The engineering process can (and should) continue
through the operation and maintenance phases—both to remedy problems
that have been discovered and to anticipate and prevent future problems.
Finally, engineering failures often result in long-term benefits to society by

stimulating the development of new engineering knowledge that can be
applied to prevent future failures. But sometimes, this process also works in
the micro sense. After the Wobbly Bridge’s initial failure, the designers did
an admirable job of mobilizing the required expertise, conducting rigorous
research, designing and validating an effective retrofit, and implementing it.
The knowledge gained from these efforts has been immensely beneficial—not
only for the Millennium Bridge but also for society.
Reading
Dallard, et al., “The London Millennium Footbridge.”
Newland, “Vibration of the London Millennium Bridge.”
100
11
Dynamic
Response:
Boston’s Plywood
Palace
Welcome to this lesson on the John Hancock
Tower—a case study that incorporates
three epic engineering failures, including
falling window panels, wind-induced sway,
and P-delta-related structural deficiency.
This serves as an important transition point
in this course. The past four lessons have
focused on failures caused primarily by an
unanticipated structural response. But in
the Hancock Tower case, you’ll discover that
the window failures were caused not by an
unanticipated structural response but by
inadequate resistance.
101
11. Dynamic Response: Boston’s Plywood Palace
The Plywood Palace

Completed in 1976, the 62-story
John Hancock Tower was among the
first skyscrapers to use an all-glass
façade—an array of more than 10,000
floor-to-ceiling window panels of
mirrored, blue-tinted glass obscuring
the tower’s underlying steel skeleton.
However, this façade was also central
to a series of embarrassing engineering
failures that plagued the tower’s
early years.
On the night of January 20, 1973,

with the building still under
construction but nearly complete, a
winter storm hit Boston. As 75-mph
winds lashed the tower, the façade’s
glass panels started breaking free
from their mountings. By morning, at
least 65 lay shattered on the ground.
Subsequent windstorms caused
more windows to fail. As they did,
construction workers patched up the
openings with sheets of plywood.
By April 1973, over an acre of the
façade was covered with plywood,
and Bostonians began referring to
the Hancock Tower as the Plywood
Palace. For the next few months,
when wind speeds approached 45
mph, the streets around the tower
were closed off to prevent injuries
from falling glass.
102
Around this time, construction workers began reporting that during high
winds, the structure’s sway was so pronounced that it was causing motion
sickness on the uppermost floors. Everyone immediately drew the only logical
conclusion—that the excessive wind-induced sway was the cause of the
window failures.
The Tower’s Design

Consider one typical story of the tower, which can be visualized as a grid
of intersecting two-dimensional frames. Two frames—each consisting of
nine rectangular bays—are oriented in the north-south direction. These
are interconnected by eight east-west frames, each comprising five bays and
sharing their outermost columns with the north-south frames. Each east-
west frame incorporates a pair of diagonal braces. The north-south frames
are offset from each other by two bays. With the addition of supplemental
beams and columns and a reinforced-concrete floor slab, the floor plan is not
a rectangle but rather an elongated parallelogram, with a V-shaped notch cut
into each of its shorter sides. There are openings in the center of the floor slab
for elevator shafts, stairwells, and utilities ducts that pass vertically through
the building’s core. The diagonal braces are also placed within this core area
so that they won’t block doorways or corridors.
To depict the full structural system, replicate this module 61 more times. This
790-foot-tall steel skeleton is clad in a glass curtain wall—a nonstructural
building façade comprising individual panels hung in a way that purposefully
accommodates structural movements caused by loads and temperature
changes. Each of these 10,344 glass panels measures 4.5 feet wide by 11.5 feet
tall and weighs 500 pounds.
As each east-west frame incorporates two diagonal braces, the aggregate effect
of this 62-story stack of bracing is to form a vertically oriented truss that
effectively stabilizes the east-west frames and resists horizontal wind forces in
this direction. These east-west frames that resist lateral forces through the use
of diagonal bracing are called braced frames.
The Hancock Tower’s two main north-south frames provide stability

and wind-load resistance by a different mechanism. They are called rigid
frames because they attain their lateral stability from specially designed
103
rigid connections that join the beams and columns together. In a simple
connection, typically used in braced frames, only the web of the I-shaped
beam is fastened to the column. In a rigid connection, the web and both
flanges are rigidly fastened to the column.
Because of their different configurations, these connections carry load in

different ways. In the simple connection, the lack of flange fastenings allows
the beam to rotate with respect to the column—it behaves like a hinge. In the
rigid connection, the beam can’t rotate with respect to the column. Thus, the
two members remain perpendicular to each other, even as the frame bends
in response to applied loads. The fundamental difference between these
lateral load-carrying systems is that the braced frame carries load primarily
through tension and compression in the braces, while the rigid frame carries
load primarily through bending of the beams and columns. Therefore, a rigid
frame is inherently more flexible than a braced frame. For a given horizontal
force, a rigid frame typically experiences significantly more lateral sway.
Architectural considerations probably drove the decision to use rigid frames

in the Hancock Tower. Diagonal braces on the exterior frames would have
marred the building’s sleek appearance, and interior diagonals would have
impaired the building’s function by obstructing interior spaces. This is
why the east-west braces are enclosed within the walls of the building’s
central core.
The Tower’s Structural

Deficiency
When the tower’s rigid frame sways in response to wind loading, its
rectangular panels deform into parallelograms. Thus, it’s reasonable to
expect that the frame’s angular distortion might have caused the rigid glass
panels to break loose from their mountings. In a sense, this presumed causal
relationship between wind-induced sway and window failures was good news.
The sway problem could be addressed with a structural retrofit, and the
window problem would go away.
104
Based on this presumption, the building’s owner—the John Hancock Mutual

Life Insurance Company—retained two world-class experts to investigate
the issue and devise a remedy. Professor Alan Davenport would develop and
conduct wind tunnel tests on an instrumented scale model of the Hancock
Tower and the surrounding buildings. Professor Bruno Thürlimann would
analyze the structure’s dynamic response to wind loads. This collaborative
investigation produced three significant findings:
` First, the professors identified the underlying cause of the structure’s wind-
induced vibrations and verified that these vibrations were large enough to
cause the occupants of the upper floors to experience physical discomfort.
` Second, they demonstrated conclusively that the window failures had not
been caused by wind-induced deformation of the tower or by aerodynamic
effects associated with the tower’s unusual geometric shape.
` Third, Thürlimann reported that because of a previously unrecognized

flaw in the structural design, the tower was in grave danger of a
catastrophic collapse.
P-Delta
Given its potentially disastrous consequences, this newfound structural
deficiency had to be addressed aggressively and expeditiously. In his analysis,
Thürlimann had discovered that the design of the Hancock Tower failed to
account for the P-delta effect—an interaction between gravity loads and
wind loads that makes their combined effect greater than the sum of its parts.
If a frame is subjected to a gravity load, designated as force P, this loading

causes a structural response that includes internal compression in the
columns and some bending of the beams and columns—but no lateral sway.
If, instead of a gravity load, there is a horizontal wind load, this load causes
a different structural response, including substantial lateral sway. As the
rigid frame sways, its upper level displaces horizontally by this distance, a
direct measurement of lateral sway. If the gravity and wind loads are applied
simultaneously, the P-delta effect occurs. Under gravity load alone, the frame
doesn’t sway because vertical force P is applied parallel to the columns’ axes.
But after the wind load causes some initial sway, P is no longer aligned with
105
the columns. It causes an overturning effect that increases the sway and
increases the structure’s susceptibility to collapse. The P-delta effect tends to
be larger in rigid frames than in braced frames because rigid frames typically
experience more lateral sway.
In the 1960s, when the tower was designed, the P-delta effect wasn’t addressed in
structural design codes because it is typically insignificant in low-rise buildings.
In fact, the Hancock Tower was in full compliance with the Boston building
code in effect at the time. However, its unprecedented combination of great
height, a lightweight glass façade, and a rigid-frame structural system caused the
normally insignificant P-delta effect to become frighteningly significant.
Thürlimann’s analysis showed that because of P-delta, the Hancock Tower’s

safety factor with respect to wind-induced collapse in the north-south
direction was approximately 1—meaning there was no margin of safety. In
early 1975, the Hancock Company initiated a structural retrofit, which added
robust diagonal bracing in the north-south direction on all stories. With this
supplemental bracing, the danger of structural collapse was eliminated.
In the meantime, a solution to the structure’s excessive wind-induced

vibration was also in the works. Thürlimann and Davenport identified the
underlying cause of the problem and recommended a solution. Recall that
all structures vibrate in multiple modes and that each vibrational mode has
its own characteristic natural frequency. For the Hancock Tower, the two
dominant modes were flexural oscillation in the east-west direction and
torsional oscillation. Both vibrational modes were partly attributed to the
building’s narrow width in the east-west direction. Most importantly, the
natural frequencies associated with these vibrational modes were nearly
identical. Thus, when the wind set this building in motion, the two modes
could occur simultaneously and reinforce each other, resulting in lateral
accelerations much larger than either mode would have caused by itself.
Tuned Mass Dampers

Because the tower’s east-west frames already incorporated robust diagonal
bracing, adding more bracing wouldn’t have fixed this problem. Thus,
the engineers turned to the tuned mass damper (TMD) to solve this
problem. Today, TMDs have become common in many different structural
106
applications, but in 1975, the use of TMDs in high-rise buildings was

practically unprecedented. At that time, structural engineer William
LeMessurier had just incorporated a TMD into his design for the Citicorp
Center in New York City. But this skyscraper was still under construction in
1975 and wouldn’t be completed until two years later. Thus, the Hancock
Tower would become the world’s first operational TMD-equipped skyscraper.
The challenge of employing this technology was all the greater because the
Hancock Tower would have its TMDs retrofitted to an existing structure
rather than being incorporated into the original design. Given the magnitude
of this challenge, the Hancock Company turned to William LeMessurier.
Consider a simple model of a rigid-frame structure, which is susceptible to

wind-induced vibrations. Mounted on the frame’s horizontal beam is a TMD,
temporarily disabled by having been fastened to the beam with a bolt. Most
TMDs have a large mass, one or more springs, and one or more dampers.
In this model, the mass is mounted on wheels and can move freely in the
horizontal direction. Two springs hold the mass in its central equilibrium
position; when the mass displaces, the springs will pull it back toward its
equilibrium position.
Damping is the natural tendency of mechanical vibrations to die out over

time. This tendency can be increased through artificial damping, such as with
linear viscous dampers. Most TMDs use similar devices to provide artificial
damping. The system’s most important characteristic is that it has springs
with sufficient stiffness so that the mass will vibrate at the same natural
frequency as the frame. This is what it means for a TMD to be tuned.
Because the TMD’s natural frequency is closely matched to the structure’s

natural frequency, the tuned mass can counteract the frame’s lateral sway.
When a large wind gust sets the frame in motion, the mass initially remains
at rest. But when the mass is no longer in its equilibrium position, the springs
force it to start moving as well—though with a lag of one-half cycle such that
the frame and mass are now vibrating in opposition to each other. Through
this mechanism, kinetic energy is transferred from the frame into the mass,
resulting in significantly reduced motion of the frame.
107
This reduction in sway would only be temporary if not for the artificial
damping provided by the TMD. Without this damping effect, the moving
mass would eventually transfer its kinetic energy back into the frame—and
the frame’s motion would again increase. But the damping provided by the
TMD dissipates this energy before it can be transferred back into the frame.
William LeMessurier designed and installed two TMDs in the Hancock

Tower because vibrations in two different modes had to be controlled. When
the tower sways in the flexural mode, the devices work together; when the
tower twists, they work in opposite directions. The TMDs were installed at
opposite ends of the 58th floor. Each mass is an 18-foot-square steel box filled
with lead, weighing 600,000 pounds, and resting on a polished stainless-
steel plate. It floats on a thin oil film so that it can slide back and forth with
practically zero friction. Thanks to LeMessurier’s TMDs, the wind-induced
accelerations felt by the Hancock Tower’s occupants were reduced by 40%
to 50%—and the system has worked reliably since its installation more than
four decades ago.
The Window Flaw

But how could two 300-ton masses be added to the top of a structure not
designed to carry such a substantial additional load? This was a major
concern in LeMessurier’s design of the TMD retrofit. To address it, the
engineers carefully surveyed the building’s upper floors and determined
that the expected occupancy loads would be much less than the original
structural design had assumed. Thus, the structure had enough reserve
capacity to support the TMDs and the local floor reinforcements required to
support them.
After the analysis by Davenport and Thürlimann demonstrated that wind-

induced vibrations were not causing the window failures, the Hancock
Company hired another consultant—Simpson, Gumpertz, & Heger (SGH).
The firm provided the requisite expertise in curtain wall systems. After
laboratory tests in which window panels from the Hancock Tower were
vibrated, blasted in a wind tunnel, and subjected to extreme temperature
changes, SGH determined the failures had occurred because of a fundamental
flaw in the window design—an excessively strong joint.
108
The tower’s windows were double-glazed. Each window panel comprised two
quarter-inch-thick glass panes, called lights, with a half-inch insulating air
gap in between. The windows’ mirrored appearance was achieved by applying
a metallic coating to the inner face of the outer light. The half-inch gap
between the lights was maintained by a lead spacer fastened to the edges of the
lights with soldered joints running around the panel perimeter. The window
manufacturer intended these joints to be relatively flexible to accommodate the
expansion, contraction, and bending of the glass in response to temperature
changes and wind pressure. The problem was that the soldered joint between
the spacer and the outer light bonded not only to the edge of the glass but also
to the metallic coating on its inner face. Thus, the joint became too rigid. After
repeated thermal and wind loading cycles, the joint cracked. Because the bond
was so tenacious, the crack propagated into the glass, causing the outer light to
fracture and break free from its mountings.
At the time, this type of window was widely used in commercial buildings
and had experienced no major problems. However, it had never been used for
such large window panels. It was the tower windows’ unprecedented size (and
the consequent increase in thermally induced deformations) that brought the
design flaw to the fore. Because this flaw was integral to the window design,
it couldn’t be fixed. All 10,344 panels had to be removed and replaced with
single-pane, heat-treated windows.
Lessons Learned
The three structural engineering issues associated with this case demonstrate
that any departure from established engineering practice incurs a risk that
unforeseen problems will emerge. The Hancock Tower’s departures from
established practice included its narrow east-west dimension, its use of an all-
glass curtain wall with a rigid frame structural system, and the application of a
double-glazed window system to panels of unprecedented size. Each departure
caused a crisis, yet rigorous responses to these crises resulted in a better building.
The tower’s crises also strongly influenced future engineering practice through
revised design code provisions—and validation of TMD technology as a tool
for controlling wind- and earthquake-induced sway in skyscrapers.
109
Reading
Campbell, “Builder Faced Bigger Crisis Than Falling Windows.”
Connor, Introduction to Structural Motion Control.
Dupre, Skyscrapers.
Lago, Trabucco, and Wood, Damping Technologies for Tall Buildings.
Schwartz, “When Bad Things Happen to Good Buildings.”
110
12
Stone Masonry:
Beauvais
Cathedral
Major architectural developments usually
happen in an evolutionary, rather than
revolutionary, manner. But a dramatic
exception to this rule occurred with the
consecration of the reconstructed Abbey
Church of Saint-Denis, viewed as the
originator of Gothic architecture. This
lesson focuses on the subsequent evolution
of Gothic architecture and the Beauvais
Cathedral collapse. The case study explores
typical elements of Gothic structures and the
most likely causes of the cathedral collapse,
which were discovered through techniques
such as photoelastic analysis.
111
12. Stone Masonry: Beauvais Cathedral
The Birth of Gothic Architecture

The original 8th-century Church of Saint-Denis had been built in an early
version of the Romanesque style, in the form of a Latin cross. The long arm
of the cross is called the nave and is oriented generally east to west, with
the main entrance and an elaborately decorated façade at the western end.
At the eastern end is the chancel—the front of the church, where the high
altar is located. The perpendicular arms, called transepts, intersect the nave
and chancel at a square bay called the crossing. By the early 12th century,
the 400-year-old structure had fallen into disrepair. Fortunately, during this
period, the Abbey of Saint-Denis was led by Abbot Sugar, who directed a
major reconstruction of the church.
Abbot Suger’s rebuilding program—which focused first on the church’s

western façade, then on the chancel—had a higher goal than refurbishing
the structure. On June 11, 1144, when the rebuilt chancel was consecrated,
the style we call Gothic was born. Saint-Denis has all the essential features
of Gothic architecture—a tall interior space delineated by slender piers,
pointed arches, and ribbed vaulting, illuminated by natural light streaming
through immense stained-glass windows. Suger combined these features in an
unprecedented way, using verticality and ethereal light to draw worshippers’
eyes and minds upward, closer to God.
Within three decades, all 20 dioceses represented at the consecration of

Saint-Denis had begun work on Gothic cathedrals. As the style spread, it
continued to evolve toward greater heights, larger windows, and more refined
proportions. This evolution reached its zenith in the Cathedral of Saint-
Pierre at Beauvais. Construction began in 1225, under the supervision of an
unnamed master builder. When the cathedral was consecrated nearly five
decades later, it was still incomplete, yet it was already renowned as the tallest
Gothic church ever built—its vaults towering 157 feet above the floor.
Unfortunately, 12 years after Beauvais Cathedral’s consecration, on the evening

of November 29, 1284, the chancel vaults and much of their supporting
structure collapsed. Over the next five decades, the structure was rebuilt, but
no taller Gothic cathedral was ever attempted. Thus, the Beauvais Cathedral
collapse is viewed as a pivotal event in architectural history, prompting a turn
toward smaller, less ambitious structures from the 14th century onward.
112
Some historians have even claimed no taller cathedral

was ever attempted because Beauvais had exceeded
the inherent maximum height of a stone structural
system. This notion apparently originated with
19th-century French architect Eugène Viollet-
le-Duc. This claim is somewhat ambiguous, and
Viollet-le-Duc provided no justification for it.
However, the idea of an inherent limit in the height of
stone construction has persisted until today in many
accounts of the Beauvais collapse.
The Beauvais
Cathedral’s
Design Eugène Viollet-le-Duc
Consider the configuration of Beauvais Cathedral as of 1284, just before the

collapse. At that time, only the chancel and a portion of the transept had been
completed, meaning a substantial portion of the building plan didn’t yet exist.
Beauvais is typical of French High Gothic cathedrals in that it is subdivided
into three distinct stories—the arcade, triforium, and clerestory. The lowest
story—the arcade—is a series of large, pointed arches supported on tall piers.
Each arcade opens into two aisles, which run parallel to the choir, the central
space in which the choir stalls are located. At the chancel’s eastern end is the
chevet, consisting of a semicircular apse, surrounded by an aisle—called the
ambulatory—and seven chapels projecting out from the semicircle. The
aisles, ambulatory, and chapels are enclosed overhead by stone vaulting.
The second story is the triforium, an open gallery that encircles the choir
and apse above the arcade. The third level is the clerestory, in which large
arched windows fill the spaces between the piers. From the tops of these piers,
transverse arches span the choir. They provide structural support for the
ribbed vaults comprising the cathedral’s curved stone ceiling.
113
Groined Vaulting
In a general sense, a vault is an arch extruded into the third dimension to
create a curved surface that encloses space. But this structure, called a barrel
vault, is architecturally problematic because it must be supported on solid
walls and admits light from only two directions. These limitations can be
overcome by intersecting two barrel vaults and removing the unwanted
material to create a groined vault. This allows for natural illumination on all
four sides and can be supported on piers rather than on walls.
Groined vaulting was not a Gothic-era invention; it was used extensively in

ancient Roman and early medieval structures. But Gothic builders improved
upon the concept in two important ways:
` First, they used pointed arches, which provide greater architectural

flexibility. For example, the arcade arches at Beauvais have widely
different spans but the same height—an effect impossible to achieve with
semicircular arches.
114
` Second, they added diagonal ribs along the intersections between the vaults’
curved surfaces. These ribs enhance structural efficiency because their
strengthening effect allows for thinner, lighter vaulting.
The Arch
In Gothic cathedrals, vaults serve as the ceiling of the interior space but
not the roof of the building. The roof is an elaborate timber truss structure
that supports a wooden deck covered with an outer layer of lead sheeting—
all designed to protect the underlying stonework from weather-related
deterioration and leaks.
The system’s central element is the arch. A temporary wooden structure—

called centering—supports the arch while it’s being assembled. Then,
wedge-shaped stones, called voussoirs, are added in pairs until the arch is
complete. The centering can now be dropped and removed, leaving behind a
self-supporting stone arch capable of carrying substantial additional load. The
arch carries load entirely in compression. If there were any internal tension,
the voussoirs would pull apart, but they don’t because internal compression is
clamping them together.
Therefore, the arch can span a large horizontal distance with many stones of
relatively small size, making it ideal for masonry construction. But when an
arch is loaded, its outer ends tend to splay outward. This tendency—lateral
thrust—must be rigidly restrained, or the arch won’t be capable of carrying
load. Thus, with two blocks restraining its lateral thrust, an arch can easily
carry thousands of pounds; yet, when you remove one restraint, a slight
application of load is enough to trigger a collapse.
This is how an arch works when supported on a rigid surface, but in a Gothic
cathedral, the arches are perched on top of tall piers. If you erect two piers,
prop the centering on top of the piers, and assemble the arch, even with the
centering in place, the arch’s lateral thrust will cause the piers to tip outward.
If you try to drop the centering, the arch cannot stand.
One solution is to reinforce the piers with external elements called buttresses,
which add width and mass to prevent the piers from tipping outward in
response to the arch’s lateral thrust. Now, when you rebuild the arch and
115
remove the centering, the arch remains stable. This approach was often used
in smaller Gothic churches. In this structural system, the slender interior
piers are integrated with heavy external buttresses that support the arches
and vaults. But this is architecturally unsuitable for a large cathedral because
buttresses wide enough to resist the thrust of a cathedral’s high vaults would
block the aisles on either side of the central space.
The Flying Buttress

Gothic builders devised an ingenious solution to this challenge—to move the
buttresses outward, beyond the aisles, and connect them to the piers with half
arches called flyers. This characteristic feature of Gothic architecture is the
flying buttress. Once installed, flying buttresses provide effective external
restraint against lateral thrust while also contributing significantly to the
structure’s ability to resist wind loads. The latter is important because wind
speed increases with elevation. Thus, for a tall cathedral like Beauvais, the
horizontal force imparted by a moderately severe windstorm can exceed the
horizontal thrust of the arches and vaults.
The flying buttresses of Beauvais Cathedral must function in three

dimensions rather than two. Thus, the flying buttresses of the chevet are
arranged radially and must work in two directions—incorporating two
perpendicular sets of flyers to support both the chancel and transept. Each
flying buttress has two vertical elements—a heavy outer buttress and a lighter
intermediate buttress.
This arrangement was used because Beauvais Cathedral has two aisles on either
side of the choir. Rather than having each flyer span across both aisles, the
designer added the intermediate buttresses to cut the flyers’ span in half. These
intermediate buttresses are the upward extensions of the interior piers that separate
the two aisles. This structural system is impressive because it was implemented
with a construction material that has essentially zero strength in tension.
Stone does have moderate tensile strength. But in stone masonry, the weak
link is the mortar used to join the stone blocks together. Medieval mortar was
a mixture of lime, sand, and water, used to join stone blocks together in a way
that effectively transmitted compressive forces down through the structure.
But if stone masonry is subjected to any significant internal tension, it pulls
116
apart. Thus, the medieval master builders’ greatest engineering achievement

was devising a structural skeleton that could support the building’s immense
weight and substantial wind loads entirely through internal compression. But
along this entire load path, one small, isolated occurrence of internal tension
could trigger a collapse.
Assessing the Beauvais

Cathedral Disaster
After the collapse of 1284, Beauvais Cathedral was rebuilt with substantial
changes from its original configuration. Fortunately, because of stylistic
differences, we can readily distinguish the rebuilt elements from the original
ones. The most important element of this post-collapse reconstruction was
the addition of 10 new piers—3 in each choir arcade and 4 in the aisles. These
additions drove major changes to the arcades, with each original arch split
into two smaller arches. They also necessitated a major change to the choir
vaulting, with the original four-part vaults being replaced by six-part vaults.
Although the post-collapse reconstructions prevent us from knowing the exact

configuration of the pre-collapse structure, they also provide a valuable source
of information. Because the new piers were added as a direct response to the
collapse, they must reflect the medieval builders’ assessment of its cause.
Thus, we can assess modern theories about the Beauvais collapse based on
their consistency with the medieval reconstruction.
The physical evidence also indicates that several original elements of the
structural system were rebuilt after 1284, presumably because they failed or
were damaged during the collapse. Specifically, all six vertical elements in one
transverse frame—two main piers, two intermediate buttresses, and two outer
buttresses—were repaired or reconstructed after the failure. This strongly
suggests that the collapse involved a structural failure somewhere within
this frame. Of the four transverse frames that supported the original choir
vaulting, this is the only one that didn’t receive supplemental lateral support
from either the chevet or transept.
117
The most famous theory on the cause of the Beauvais collapse was proposed
by Viollet-le-Duc. He hypothesized that prior to 1284, the exterior portion of
the clerestory piers had incorporated an open niche located immediately below
the lower flyer. This feature, he claimed, was the point of weakness at which
the collapse originated—because the slender stone columns were too weak
to bear the weight of the statue placed in a similar niche immediately above
the flyer. As proof, Viollet-le-Duc noted that the lower niches had been filled
in with solid stone after the collapse—presumably to correct the structural
weakness that caused the collapse.
Viollet-le-Duc’s theory has since been refuted by several 20th-century

scholars—most convincingly by Dr. Robert Mark, a civil engineering
professor at Princeton University.
` First, Mark could find no clear physical evidence that the proposed niches
ever existed. In other words, the piers are solid stone today because they
have always been solid stone.
` Second, his structural analysis showed that even if the niches had existed,
they wouldn’t have compromised the piers’ stability.
` Third, he noted that the post-collapse addition of 10 new piers would

not have been a logical response to Viollet-le-Duc’s proposed failure
mechanism.
` Finally, he demonstrated that Viollet-le-Duc’s theory didn’t adequately

explain how the collapse could have occurred 12 years after construction
had been completed.
In an attempt to address this final issue, art historian Paul Frankl has
suggested that the collapse might have been caused by settlement of the
cathedral’s foundations. This explanation is plausible because settlement
can occur over a long period of time and cause structural distress in stone
masonry. But Frankl’s theory also fails for lack of physical evidence.
Archaeological investigations have probed the cathedral’s 30-foot-deep
foundations and found no signs of settlement or settlement-induced cracking.
118
Photoelastic Analysis
Mark performed a structural analysis of Beauvais Cathedral using
photoelastic modeling. In this technique, a two-dimensional scale model
of the structure is fabricated from a special type of transparent plastic and
subjected to scaled loads representative of the actual loads applied to the full-
scale structure. Under polarized light, the plastic model displays a pattern of
colors that can be mathematically interpreted to determine the internal forces
in the structure.
Mark’s photoelastic analysis supports a convincing explanation of the

collapse. With the structure subjected to only its own weight, the intermediate
buttresses developed internal tension on the inside face, above the aisle
vaulting, and on the outside face, below the lower flyer. The magnitude of
the tension at these locations was enough to crack the mortar joints—though
probably not enough to cause a failure of the buttress. But when the effects
of a moderately strong wind load were added into the analysis, the situation
worsened. On the downwind intermediate buttress, the same two points
experienced significantly higher tension. On the upwind buttress, net internal
tension developed on the opposite faces of the buttress at these same locations.
Based on these results, Mark proposed that over time, occasional strong
windstorms caused the cracks at these locations to extend progressively farther
inward from both sides. Eventually, the mortar joints of one intermediate
buttress deteriorated so badly that the buttress broke away from its support
and toppled, carrying its four supported flyers along with it. Deprived of
resistance to lateral thrust, the choir vaults collapsed. Four aspects of the
medieval post-collapse reconstruction would be perfectly logical responses to
Mark’s proposed collapse mechanism:
` First, the added piers are now carrying a portion of the vaults’ lateral thrust
and have reduced the horizontal loads applied to the original buttresses.
` Second, the rebuilt intermediate buttresses are significantly wider than the
surviving originals.
119
` Third, several surviving original buttresses have been reinforced by

widening their shafts at the locations where Mark’s analysis predicted
mortar joint cracking.
` Finally, the entire flying buttress system has been reinforced with iron rods
that restrain the buttresses’ tendency to tip outward.
Mark’s proposed failure mechanism is also consistent with a well-documented

flaw in the design of the flying buttresses. The intermediate buttresses
extend upward from the interior aisle piers but overhang the inner faces of
the piers. This misalignment—which measured about three feet in the actual
structure—would have induced additional bending in the buttress, greatly
exacerbating the cracking caused by wind loads.
The consistency between Mark’s photoelastic analysis and these observations

of the actual structure strongly suggests that his theory about the Beauvais
collapse is correct. If so, Beauvais likely did not collapse because it exceeded
an inherent maximum height for stone masonry structures. The failure was
caused by two simple design flaws—the intermediate buttresses were too
slender, and they were misaligned with their supporting piers. If these minor
issues had been addressed, Beauvais probably wouldn’t have collapsed, and
taller Gothic cathedrals could have been built.
Future Construction Attempts

After the collapse of 1284, repairs commenced immediately, and the chancel
was rebuilt by 1339. The Hundred Years’ War then brought construction to a
prolonged halt, but work resumed around 1500. The cathedral’s Flamboyant
Gothic transepts were completed in 1548. But rather than initiating the
logical next step—building the nave and completing the cathedral’s overall
cross-shaped plan—the bishop of Beauvais directed the construction of a
500-foot-tall stone tower over the crossing. Because the nave hadn’t yet been
built, the piers of the crossing lacked the lateral restraint necessary to support
such a heavy tower. This spire collapsed soon after its completion.
After this second catastrophe, resources ran dry, and construction of the
Beauvais Cathedral stopped forever. However, Beauvais Cathedral is a
monument to the empirical engineering tradition of the medieval master
120
builders. The cathedral is a rare example of an experiment that failed. But

even in this case, the builders made appropriate adjustments and created an
enduring structure now seen as a paragon of its genre.
Reading
Courtenay, The Engineering of Medieval Cathedrals.
Eakin, “Cybersleuths Take On the Mystery of the Collapsing Colossus.”
Mark, Experiments in Gothic Structure.
Mark and Clark, “Gothic Structural Experimentation.”
Murray, “The Choir of the Church of St.-Pierre, Cathedral of Beauvais.”
Wolfe and Mark, “The Collapse of the Vaults of Beauvais Cathedral
in 1284.”
121
13
Experiment
in Iron: The
Ashtabula Bridge
Welcome to the second in this course’s series
of case studies involving failures to design
for adequate resistance—phase 4 of the
structural design process. The Ashtabula
Bridge disaster is worth studying as an
important milestone in the ongoing transition
of engineering from a craft-based occupation
to a learned profession. This lesson covers
the bridge’s design, the multiple problems
that occurred in its conception and
construction, and the collapse mechanisms
that led to the disaster.
122
13. Experiment in Iron: The Ashtabula Bridge
Ashtabula Bridge Disaster

At 5:00 pm on December 29, 1876, the Pacific Express departed from Erie,
Pennsylvania, en route to Ashtabula, Ohio. Around 7:30 pm, the train
reached the 11-year-old iron truss bridge over the Ashtabula River. The
lead locomotive had nearly crossed the bridge when its driver heard a loud
crack and felt himself falling. He applied full throttle and barely reached
the western shore as the bridge collapsed behind him. The train’s second
locomotive and first four cars fell with the span, dragging the remaining seven
cars down with it. Then, coal-fired heating stoves in the passenger coaches set
the wreckage on fire. The official death toll was 92—but the actual number
might have been larger.
Amasa Stone
The central figure in this case is Amasa Stone. At age 21, he started working
for his brother-in-law, William Howe, a construction contractor. The
following year, Howe earned great notoriety for developing and patenting a
123
new type of wooden truss for use in railroad

bridges—the Howe truss. Stone acquired
financial backing from local businessman
Azariah Boody and purchased the rights
to Howe’s patent for $40,000. Stone and
Boody established a bridge-building firm and
achieved great success constructing hundreds
of Howe truss bridges across New England.
In 1850, Stone relocated to Cleveland, Ohio,

William Howe to become the construction superintendent for
the Cleveland, Painesville, and Ashtabula Railroad
(CP&A). After building the CP&A’s main line, Stone
was named director of the railroad in 1853 and president five years later. In
1863, he decided to replace the CP&A’s existing wooden bridge at Ashtabula
with an all-iron structure. Stone’s brother, Andros, operated an iron rolling
mill in Cleveland, and his company received the contract to supply the
bridge’s iron components. The mill’s limited product line would significantly
influence Stone’s design for the structure.
Although iron was still a relatively unfamiliar

structural material in 1863, Stone might have
followed several precedents in developing his
design:
` America’s first iron bridge had been designed

more than two decades earlier by Captain
Richard Delafield of the US Army Corps
of Engineers. Completed in 1839, this
innovative cast-iron arch carried the
National Road across Dunlap Creek
in western Pennsylvania.
` America’s first successful

iron truss bridge was
patented in 1841 by
Capt. Richard Delafield
124
Squire Whipple, who also developed the science-based

method of truss analysis still taught in engineering
schools today.
` By the early 1850s, Albert Fink was building iron

trusses strong enough to carry railroads.
The only tool Stone had was the Howe truss. Thus,
he decided that the new, all-iron Ashtabula Bridge
would be a Howe truss structure. But he lacked the
fundamental scientific knowledge needed to
adapt a characteristically wooden structural
system to a different structural material.
Squire Whipple
The Howe Truss

Consider a model composed of four rectangular panels, defined by top and
bottom chords, verticals, and crossed diagonals. The verticals are wrought-
iron rods, and the connection fixtures, called angle blocks, are cast iron. To
prevent the diagonals from being too loose, Howe’s invention incorporates
post-tensioning. Tightening the nuts at the ends of each vertical induces
tension in the rod, which is counterbalanced by compression in the adjoining
diagonals. This compressive force in the diagonals clamps them firmly against
the angle blocks, tightening the joints and enhancing the truss’s rigidity. This
post-tensioning feature was integral to the Howe truss’s success.
Recall that in a conventional truss with crossed diagonals, one diagonal in

each panel is always in tension and the other in compression. However, Howe’s
post-tensioning feature eliminates all tension in the diagonals, simplifying the
connections and reducing their cost. Apart from this, the Howe truss was quite
conventional. When subjected to gravity loads, it bent like a beam. Thus, its
bottom chord was in tension, and its top chord was in compression.
125
Stone’s Bridge Design

Stone’s Ashtabula Bridge design comprised two main trusses spanning
154 feet between masonry abutments and interconnected with lightweight
diagonal bracing. Oddly, the braces connected only to every other top-chord
joint on the main trusses. Thus, the even-numbered joints were not laterally
braced. To support the bridge’s wooden deck, closely spaced iron beams were
clamped to the top chords of the main trusses. The deck consisted of heavy
longitudinal pine stringers overlaid with smaller oak ties, to which two sets of
rails were fastened.
In designing the main trusses, Stone made an unconventional decision.

Contemporary engineers like Squire Whipple and Albert Fink designed
structures by determining the size of each individual member such that it
would be strong enough to resist its estimated internal forces. But Stone
configured his trusses of small, equally sized elements and used the number
of elements, rather than their size, to provide the required strength. For each
top-chord member of the bridge, Stone used five small, parallel I beams. For
the main diagonals, he used four of the same I beams in the outermost panels
and varying numbers in the interior panels. The verticals and bottom chords
also consisted of multiple parallel elements.
For the verticals and bottom chords, this configuration was appropriate
because these are tension members. A tension member’s strength is directly
proportional to its total cross-sectional area. Thus, subdividing one tension
member into several parallel elements doesn’t reduce its total strength and has
the advantage of improved redundancy. But for compression members—like
the top chords and diagonals of a Howe truss—strength is controlled by the
buckling failure mode. This depends on both the member’s cross-sectional
area and its geometric shape.
A hollow tube and a subdivided member consisting of four parallel elements

have the same total cross-sectional area; their strengths in tension are
essentially identical. But under a substantial compressive loading, the tube
shows no tendency to buckle, while the subdivided member buckles easily. At
best, this configuration is inefficient; at worst, it’s potentially disastrous.
126
Stone’s decision was likely influenced by the limited range of wrought-iron

products available from his brother’s mill. Andros only made small I beams;
thus, that’s what Stone used. More importantly, Stone was apparently unaware
that these slender compression members were so vulnerable to buckling. He had
hired an experienced bridge engineer named Joseph Tomlinson to assist with
structural computations for the project, but the two men clashed on this issue.
Tomlinson insisted on designing the compression members more conservatively,
and Stone refused. Stone then fired Tomlinson and completed the design on his
own—without allowing for buckling and without supervision.
The Problematic
Top-Chord Connections
Another unorthodox feature of Stone’s design was the configuration of the
top-chord connections. Conventional iron trusses of that era used mechanical
fasteners—pins or rivets—to connect the members and transmit internal
forces between them. But in Stone’s design, internal forces were transmitted
between the top-chord I beams and the remainder of the truss by rectangular
lugs, projecting upward from the cast-iron angle blocks. Each I beam
extended across two panels of the truss. Thus, its internal compression was
transmitted into the truss at every other angle block. The I beams were held
in position only by the post-tensioned verticals, which applied a downward
clamping force through gib plates. These connections relied entirely on
friction between the I beams and angle blocks and were less reliable than
conventional mechanical fasteners.
To understand the problematic nature of Stone’s design, consider a simplified

model of one main truss. Because a Howe truss cannot support itself until
it’s completely assembled, it must be built supported on temporary wooden
falsework. The bottom chord, angle blocks, and vertical rods are already in
place on the falsework. Then, the diagonals are added, held in position only
by small lugs on the angle blocks. Next, the top-chord elements are added—
each extends across two panels of the truss, with its ends bearing on lugs
projecting upward from the top angle blocks. These four top-chord elements
127
bear only on the first, third, and fifth angle blocks. Thus, two additional top-
chord elements, extending between the second and fourth angle blocks, must
be added.
If the falsework was removed right now, the structure would fall apart. To
prevent this, all of the chords, diagonals, and verticals must be tied together
by adding a gib plate on top of each vertical rod and securing these plates with
nuts. Now, the vertical rods must be post-tensioned. As each rod is tightened,
it compresses the adjacent diagonals, as intended. But because the top-chord
angle blocks aren’t locked into the top chord, post-tensioning also causes the
entire truss to arch upward slightly.
This upward bending causes the top-chord angle blocks to move apart—and
this causes the top-chord elements to loosen. A gap forms between the top
chord and its supporting angle block. The only way to bring these top-chord
elements back into bearing on the angle block lugs is to remove the falsework
and allow the bridge’s weight to bend the truss downward. This structure is
now assembled and capable of carrying additional loads. However, there are
three significant issues:
` The truss is held together almost entirely by friction. The only mechanical
connections in the entire structure are the vertical rods passing through
the angle blocks.
` The friction force required to hold the critically important top-chord

elements in place is dependent on the structure’s weight. Thus, the dynamic
bounce caused by passing locomotives will inevitably loosen these elements.
` The truss’s load-carrying capacity is dependent on the lugs, which transmit

the top chords’ compressive force into the angle blocks. The lugs in
Stone’s bridge were made of cast iron—another vulnerability that would
contribute significantly to the collapse.
Problems in Bridge Construction

The process of erecting the bridge (in 1865) was also problematic. To
supervise the work on-site, Stone hired a construction superintendent named
A. L. Rogers—a carpenter with no previous experience in iron construction.
Fortunately, Rogers was well qualified for the project’s first phase—building
128
the timber falsework that would support the iron trusses as they were
assembled. Initially, assembly of the trusses went well thanks to the high-
quality detailing Tomlinson performed before he was fired. Tomlinson had
specified that the trusses would have a six-inch camber to offset the estimated
six-inch sag that would occur after the falsework was removed and the bridge
began supporting its own weight. To camber the trusses, the top-chord
members had to be fabricated slightly longer than their planned final length.
Tomlinson had worked out the required dimensions before he was fired.
But with Tomlinson gone and the trusses nearly complete, Stone decided that
the planned six-inch camber was too large. He ordered it reduced to three
inches. This reduction should have been accomplished by shortening the top
chords, but instead, the vital angle block lugs were shaved down. This reduced
their thickness by about one-quarter inch—and reduced their strength by
about 15%.
After the trusses were post-tensioned and the falsework removed, the bridge
sagged six inches, just as Tomlinson had predicted. But because Stone had
reduced the camber, the deck was now sagging nearly three inches below
horizontal. Stone ordered the falsework reinstalled and the camber restored
to six inches. But now, because the lugs had been reduced in thickness, iron
shims had to be driven into the gaps between the lugs and top-chord I beams,
guaranteeing that these members would work loose over time.
Post-tensioning Issues
The construction workers also experienced difficulty implementing the post-
tensioning process. Consider the use of a threaded rod with a steel angle at
each end to post-tension four parallel wooden bars, one of which is slightly
shorter than the others. Wood is about 20 times more flexible than iron,
meaning it deforms more in response to a given load. Thus, when a modest
post-tensioning force is applied to the metal rod, the three longer wooden
bars shorten enough to close the gap. The shorter bar is brought into bearing
against the end angles to create a tight joint. But with four iron bars, one of
which is slightly too short, it is physically impossible to apply enough post-
tensioning force to close the gap and bring the shorter member into bearing.
In a truss, either the slightly short element would remain loose and eventually
129
fall out, or an ironworker would keep tightening until the three longer
elements buckled under compressive loading. Both problems occurred during
the Ashtabula Bridge’s construction.
Moreover, when the falsework was removed for the second time, several
diagonals buckled under the bridge’s own weight. Stone restored the falsework
again and increased the number of diagonal I beams from four to six in the
trusses’ outermost panels. To accommodate this change, the I beams had to be
rotated 90 degrees to allow for closer spacing. Portions of their flanges had to
be cut away to prevent interference with the vertical rods. More importantly,
the small lugs—which had been cast into the angle blocks to hold the I beams
in position—had to be chiseled off to accommodate the 90-degree rotation.
The diagonals would now be held in position by friction alone.
At this point, the structural inadequacy of Stone’s design was undeniable.

Several diagonals composed of four I beams each had buckled under the
bridge’s weight. The subsequent addition of two I beams per panel had
strengthened these members by no more than 50%. This was a grossly
inadequate margin of safety, especially because it didn’t consider the weight
of heavy locomotives. But when Stone had the falsework removed, the bridge
held. He then load-tested it with three locomotives and, satisfied with its
performance, placed it into service.
However, the successful load test masked deep structural flaws. As the years
passed, there were warning signs. A railroad inspector discovered that a
diagonal brace had worked loose. Locomotive operators reported hearing
snapping sounds while crossing the bridge. But these warnings went unheeded
until the bridge collapsed.
The Collapse Mechanism

The collapse prompted three investigations—one by a coroner’s jury, one by a
state legislative committee, and one by Charles MacDonald, representing the
American Society of Civil Engineers. MacDonald’s investigation convincingly
identified the structure’s collapse mechanism. While inspecting the wrecked
bridge, MacDonald discovered a top-chord angle block that had one of its lugs
130
sheared off. Based on its position within the wreckage, he identified it as the
second block from the western end of the southern truss. And on the failure
surface, he noted a large internal air void—a common defect in cast iron.
On this particular angle block, it was a fatal flaw. The two lugs on the
second angle block from the end of each truss were the most heavily loaded
in the entire structural system. The large internal shear force, casting defect,
and thickness reduction during construction caused extreme stresses in
this structurally critical lug. These stresses inevitably initiated a fatigue
crack that elongated slightly with each passing locomotive until it reached
a critical length and fractured. The extremely low temperature on the night
of the disaster made the cast iron even more brittle than usual, increasing its
susceptibility to fracture.
When one lug broke off, its associated top-chord element was disconnected
from the truss and could no longer carry load. Consequently, this parallel
element was instantly subjected to twice the compressive force—and buckled.
At this point, the truss might still have survived if not for the fact that the
lateral bracing system was only connected to every other angle block. Thus,
the block with the failed lug was laterally unbraced. Because it was now
asymmetrically loaded, it displaced violently outward as its overloaded I beam
buckled. Once the angle block displaced sideways under the weight of two
locomotives, the southern truss folded up, came apart at the joints, and spilled
the remainder of the structure into the gorge.
Inquiry Results
The Ashtabula disaster was triggered by a set of circumstances for which
Stone cannot legitimately be blamed. An internal, undetectable fabrication
defect caused a single cast-iron lug to fail by fatigue, which no one fully
understood at the time. Yet Stone certainly was responsible for the bridge’s
inadequate margin of safety, ill-conceived structural concept and connection
configurations, poorly designed bracing system, ad hoc modifications during
construction, and consequent inability to survive the loss of a single lug.
The coroner’s jury reached a similar conclusion—that the bridge was poorly
designed and poorly built and that Stone was principally responsible for
its collapse. But MacDonald wrote that Stone shouldn’t be vilified because
131
knowledge about iron bridges was limited at the time he designed the
structure. Furthermore, Stone had responded decisively to the many problems
encountered during construction, and his completed bridge passed its load
test and all subsequent inspections.
Lessons Learned
The Ashtabula disaster had little impact on subsequent engineering practice.
Stone’s design was so uniquely and obviously flawed that contemporary
engineers could learn little from its failure, nor were government bodies
willing to enact legislation to prevent future failures of this sort. The Ohio
legislative committee that investigated the collapse drafted a bill that
specified bridge design standards, required an expert review of all designs,
and mandated periodic inspections of in-service bridges. But the Ohio
legislature declined to take it up. Meanwhile, within a year of the disaster, the
Lake Shore and Michigan Southern Railway had designed and constructed
a replacement bridge at Ashtabula. Stone’s iron bridge was replaced with a
wooden Howe truss structure.
Prior to the mid-19th century, an experienced builder with no formal

engineering training could successfully design major structures that didn’t
deviate too far from established norms. But the rapid industrialization of the
19th century presented new challenges that could be met only by engineers
with a specialized technical education. During this era, engineers were also
organizing professional societies to establish standards, promote research, and
disseminate technical information.
Reading
Gasparini and Fields, “Collapse of Ashtabula Bridge on December
29, 1876.”
Griggs, “Charles Macdonald.”
Macdonald, “The Failure of the Ashtabula Bridge.”
132
14
Shear in
Concrete: The FIU
Pedestrian Bridge
It seems that even as engineered systems
have changed over time, their underlying
causes of failure tend to recur. Today’s
powerful tools imbue engineers with the
confidence to try unorthodox design
concepts, which exposes unexpected
vulnerabilities. Addressing these challenges
requires the most sophisticated engineering
tool of all—human judgment. And as
the Florida International University (FIU)
Pedestrian Bridge case demonstrates, this
tool remains as fallible as ever. This lesson
concerns the various engineering and
organizational oversights that led to the FIU
Bridge collapse.
133
14. Shear in Concrete: The FIU Pedestrian Bridge
The FIU Pedestrian

Bridge Collapse
In early 2016, FIU initiated a project to build a pedestrian bridge across
Southwest 8th Street, an eight-lane thoroughfare. To design it, FIU chose
bridge engineering firm FIGG. FIGG’s proposal for the FIU Pedestrian
Bridge was a cable-stayed reinforced-concrete truss with a 175-foot main
span crossing over 8th Street and a 99-foot back span crossing the adjacent
Tamiami Canal. The structure would also provide enhanced resistance to
hurricane-force winds.
Accelerated bridge construction was used, in which traffic disruptions are

minimized by fabricating the bridge off-site and moving it as a single unit
onto previously prepared supports. On March 10, 2018, the bridge’s 950-
ton main span was transported into position on its supporting piers. But
reports of unexpected cracks in the concrete truss soon arose. FIGG couldn’t
immediately determine the reason but stated there was no cause for concern.
At 1:46 pm on March 15, the truss collapsed without warning, crushing five
vehicles beneath it and seriously damaging three more. One construction
worker and 5 vehicle occupants were killed, and 10 others were injured.
Project Organization
This project was organized using the design-build system. FIU hired MCM (a
Miami-based construction management firm) to implement the entire project
from concept through completion. MCM contracted with FIGG to design
the structure. FIGG selected Louis Berger, a large engineering company, to
perform a peer review of the final design. FIU didn’t have any engineers on
staff and hired another engineering consultant—Bolton Perez & Associates—
to provide construction oversight and inspections. Because the bridge would
cross a public highway, the Florida Department of Transportation (DOT) and
the Federal Highway Administration provided governmental oversight.
134
The Bridge’s Construction

The construction project began with excavation and construction of the
reinforced-concrete foundations and piers. The main span was prefabricated
on temporary falsework in a staging area immediately adjacent to the bridge
site. The truss comprised a 32-foot-wide deck, which also served as the
bottom chord; an overhead canopy, which doubled as the top chord; and a
series of diagonals and verticals zigzagging between the deck and canopy.
After prefabrication, the truss was moved to the bridge site by self-propelled
modular transporters and placed onto the piers. Once in position, the bridge’s
weight was transmitted down into the piers through thickened ends of the
deck, called diaphragms.
The second truss was

similarly configured.
But because it spanned
a canal rather than an
active roadway, it could
be constructed directly on
the piers. The two spans
were then structurally
interconnected, and
concrete closures were
poured to fill the gaps in
the deck and canopy. Next,
the concrete pylon was cast in place, and 10 diagonal stays—made of steel
pipes—were bolted in place. The pylon and stays were not part of the primary
load-carrying system. Integral to this aesthetic was the alignment of each
stay with one of the truss diagonals, which accounted for the trusses’ unusual
asymmetrical geometry.
Finally, the landings, stairways, and elevators were constructed. The spans
were completed with the installation of curbs, expansion joints, and drainage
fixtures. The drainage system included catch basins. These channeled
rainwater into a drainpipe running along the bottom of the deck, through the
diaphragms, and into the local storm sewer.
135
Post-tensioning
The most challenging design aspect was the use of long-span trusses made of
reinforced concrete. Concrete is strong in compression but has zero strength
in tension. Thus, in modern structures, concrete is always strengthened with
rebars. If you load a reinforced-concrete member in tension, it carries the
load—but the rebar does all the work. As the steel stretches, the concrete
cracks and can no longer participate in load-carrying. Thus, in a reinforced-
concrete tension member, the concrete is structurally superfluous. This
issue can be overcome using post-tensioning to prevent the cracking. When
the rod is tensioned, the concrete is compressed. Now, when the member is
loaded, both materials participate in load-carrying. As long as the applied load
doesn’t exceed the initial post-tensioning force, the concrete will remain in
compression—and won’t crack. This is what made the FIU bridge’s innovative
concrete trusses possible.
Concrete structures are sometimes post-tensioned with threaded rods, but

more often with high-strength steel cables called tendons. In either case, the
steel element is inserted through a plastic duct embedded in the concrete and
tensioned with a hydraulic jack before being anchored at its ends. Because of
their adjustability, threaded rods are useful in circumstances where the post-
tensioning force must be changed during the construction process.
Post-tensioning
Members 2 and 11
As a general principle, any member that will experience internal tension
under any circumstance must be post-tensioned. Because of the FIU Bridge’s
complex construction sequence, four different circumstances determined
which members required post-tensioning. First, with the main truss
supporting its own weight, tension would occur in the bottom chord and in
the members numbered 3, 5, 8, and 10 on the engineering drawings. Second,
while the truss was being moved into position, members 2 and 11 would
temporarily experience tension due to the outer panels of the truss extending
out beyond the transporters. Third, when the two spans were subsequently
136
interconnected, tension would occur in a portion of the top chord. Finally,

when the bridge was in service, members 6 and 7—though normally in
compression—could experience a net tension force if large numbers of
pedestrians congregated at one end of the deck.
Thus, FIGG’s design specified that these members would be post-tensioned.

However, because members 2 and 11 would experience tension only during
the transport operation, they would be temporarily post-tensioned prior to the
move and de-tensioned after the truss was in its final position. Once the truss
was placed on its supports, they would experience substantial compression due
to normal in-service gravity loads. If they weren’t de-tensioned after the move,
the compression caused by the post-tensioning process would add to the
compression caused by in-service loads—reducing their margin of safety.
The cylindrical caps on the outer ends of the span and the angular blisters
on top of the canopy were anchorage points for post-tensioning tendons
in the deck and canopy and post-tensioning rods in the diagonals. All
diagonals would also receive three types of conventional steel reinforcement—
longitudinal and transverse rebars and shear reinforcement at the interfaces
between the diagonals and chords. In the truss, the most severe internal
shear force occurred at the ends of the span, where the vertical and diagonal
members joined the deck.
Consider the joint designated as node 11/12 on the engineering drawings

because members 11 and 12 are joined here. If node 11/12 fails in shear when
the truss is loaded, a horizontal crack forms at the base of the members.
Members 11 and 12 slide horizontally with respect to the deck—a sure sign
of a shear failure. The truss is severely weakened by this condition because
the outer panel is now supported largely by the bending of the deck rather
than by the transmission of internal forces through the truss members. This
problem can be fixed by inserting two dowels up through the cracked joint.
Because the dowels project upward across the plane of weakness, they prevent
members 11 and 12 from sliding with respect to the deck, restoring the truss’s
load-carrying capacity. In FIGG’s design, four loops of steel rebar reinforced
node 11/12 against a possible shear failure along a horizontal plane passing
through the joint.
137
Cold Joints and Cracking

With the design complete, construction of the FIU Pedestrian Bridge began in
March 2016. Because of its unique configuration, the truss was cast in three
separate concrete pours—one for the bottom chord, one for the diagonals and
verticals, and one for the top chord. Through this process, cold joints were
created at the interfaces between successive pours. A cold joint creates a plane of
weakness, and in the FIU Bridge, these discontinuities were located at the nodes
where high shear forces would occur. Thus, these nodes’ shear strength would
depend almost entirely on their steel reinforcement.
By mid-February 2018, all pours were complete, and the concrete had cured
sufficiently for the post-tensioning to be applied. Then, on February 24,
the supporting falsework was removed. As the truss began carrying its own
weight for the first time, workers heard a loud noise and discovered that large
cracks had developed along the cold joint at node 11/12 and at the equivalent
location on the opposite end of the truss. Bolton Perez reported the problem
to MCM. MCM emailed photos of the cracks to FIGG’s Tallahassee office
and requested guidance. FIGG responded that the cracking wasn’t significant
and could be patched up later.
On March 10, immediately after the main span was transported to the bridge
site, members 2 and 11 were de-tensioned as planned. During this operation,
the existing cracks along node 11/12 opened significantly wider, and a
network of finer cracks developed on the outer faces of member 12 and the
diaphragm. The cracking was particularly severe at five penetrations through
the concrete—a drainpipe, which passed horizontally through the diaphragm,
and the two vertical ducts on each side of member 12.
MCM didn’t report these issues to FIGG for two full days. But after receiving
the MCM report on March 13, the engineers assured the contractor that the
cracking was “not a safety issue.” Indeed, some cracking is to be expected in
reinforced concrete. Steel reinforcement must elongate in tension, which often
causes small cracks in the adjoining concrete. Design codes specify that such
cracks are permissible if small. A typical standard is a maximum permissible
crack width of 0.016 inches. But by this time, the cracks in the FIU Bridge
were 40 times larger than this standard.
138
Ill-Advised Re-tensioning
On the evening of March 13, FIGG’s engineers recommended to MCM that
member 11 be re-tensioned—even though it had been de-tensioned three
days earlier. The reasoning was that de-tensioning member 11 had made
the cracking worse. Thus, re-tensioning should restore the member to its
previous, less dangerous condition. But it wasn’t reasonable to expect that
the application of a large post-tensioning force would have the same effect as
it did when the concrete was in pristine condition and the bridge was fully
supported on falsework.
It wasn’t until the morning of March 15 that the post-tensioning

subcontractor could get his crew back on the project site to perform this
unplanned task. Meanwhile, MCM had arranged a 9:00 am meeting with
FIGG, FIU, Bolton Perez, and the Florida DOT to discuss the cracking
problem. At the meeting, FIGG’s lead engineer reported that although he
hadn’t yet identified the cause of the problem, it would be resolved when the
second span was constructed. The concrete closure between the spans would
strengthen the cracked node.
Around noon, on the bridge, the post-tensioning crew began applying

280,000 pounds of tension to the two steel rods in member 11. At 1:46 pm,
as their hydraulic jack applied the final increment of force, node 11/12 failed
explosively. With members 11 and 12 severed from the truss, the deck folded
like a hinge at the adjacent node, and the truss collapsed across 8th Street.
Inquiry Results
The National Transportation Safety Board (NTSB) was immediately called
in to investigate and released its final report in October 2019. Thanks to a
dashcam video that captured the entire incident, the investigators confirmed
that the collapse was triggered by a catastrophic shear failure in the node
11/12 region of the truss. The cause of this failure was equally clear—the
design of the shear reinforcement in the node’s cold joint was inadequate.
As the NTSB’s analysis demonstrated, the internal shear force predicted
by FIGG’s structural analysis was too low. Moreover, due to a subtle
misinterpretation of the governing bridge design code, FIGG’s prediction
139
of the shear strength was too high. Both the structural response and node
resistance were incorrectly calculated. Consequently, the joint was overloaded
by about 60%. This was exacerbated by poor detailing of the critical node.
The node’s strength was also compromised by flawed construction of the cold
joint. Design codes specify that the lower surface of the joint should have
been artificially roughened before the concrete above it was cast to improve
the mechanical bond between the two layers of concrete and help resist
shearing. But investigators found that the cold joint at node 11/12 hadn’t been
roughened. FIGG blamed MCM for this error. However, as the NTSB report
noted, the engineering drawings didn’t specify that roughening was required
at this joint, and FIGG must also bear some responsibility for this deficiency.
Also, the failure sheared off only three of the four rebar loops. The fourth
loop was contained within a small wedge of concrete that remained attached
to the deck. Cracks are adept at exploiting weaknesses—and this one found a
trajectory that bypassed 25% of the vital shear reinforcement. Better detailing
of the rebar would have prevented this issue too.
The Florida DOT policy requires an independent peer review of all new,
complex, or nonstandard bridge types. Fulfillment of this requirement should
have averted the disaster, but this opportunity was squandered though flawed
implementation of the peer-review process.
Contributing Factors
MCM was required by contract to provide verification of the design at its own
expense. To minimize this expense, MCM and FIGG agreed that FIGG would
do the peer review in-house, achieving the required independence by assigning
the task to a FIGG office other than the one designing the bridge. However,
Florida DOT informed FIGG that the independent review had to be done by
an outside engineering firm with no project involvement. Neither MCM nor
FIGG had included the cost of an outside consultant in their project planning.
FIGG requested bids for the job and received proposals from three different
firms. Louis Berger initially submitted a bid to perform the work in 10 weeks
for $110,000 but agreed to a reduced fee of $61,000 and a project time frame
of 7 weeks. Faced with these significant constraints on their compensation and
time, Berger’s engineers reviewed only the design of the completed structure
140
and not the intermediate stages of construction. Their structural evaluation

addressed only the truss members and not the nodes. Thus, the fatal flaws in
the design of node 11/12 went unnoticed. The NTSB concluded that Berger’s
inadequate peer review was a significant contributing factor in the collapse.
Another important contributing factor was FIGG’s conduct during the

unfolding crisis. The engineers’ repeated assurances of “no safety concerns”
were inconsistent with the situation’s severity. They convinced the project
managers that simple precautions like stopping traffic were unnecessary. And
FIGG’s re-tensioning of member 11 proved to be the proximate cause of the
collapse, as the resulting increase in internal shear triggered the blowout of the
structurally compromised node. According to the NTSB, the re-tensioning
plan constituted a fundamental change to FIGG’s original design—and thus
should have been independently peer-reviewed before implementation.
Although the NTSB found FIGG primarily responsible for the collapse, it
also faulted MCM, Bolton Perez, FIU, and the Florida DOT for continuing
construction activities and failing to stop traffic as soon as the unexplained
cracking reached unacceptable levels. Despite having eyes on the developing
crisis—and the authority to make independent judgments about public safety—
they repeatedly deferred to the structural engineer. In this sense, the FIU Bridge
disaster was as much an organizational failure as an engineering failure.
` Like the Millennium Bridge, the FIU case featured a daring structural
concept from which unanticipated problems emerged.
` Like the Ashtabula Bridge, the FIU Bridge was an unorthodox, post-
tensioned truss made of a material ill-suited to the structural configuration.
` Like the Cypress Structure, the FIU Bridge had serious deficiencies in the
shear reinforcement of a concrete connection.
` Like the Tay and Ashtabula bridges, the FIU case involved a construction
flaw at which the collapse originated.
` Like the Kansas City Hyatt case, structural distress was observed and
reported by construction workers—to no avail.
` Finally, lack of redundancy allowed a localized failure to propagate into a

global collapse.
141
Reading
National Transportation Safety Board, Pedestrian Bridge Collapse over SW
8th Street, Miami, Florida.
US Department of Labor, Investigation of March 15, 2018 Pedestrian Bridge
Collapse at Florida International University.
142
15
House of Cards:
Ronan Point
Modular building systems comprising
reinforced concrete were popularized in
post–World War II Europe as a low-cost
solution to a severe housing shortage. The
use of one such system in the UK led to the
next epic engineering failure studied in this
course—the Ronan Point tower collapse. This
lesson introduces the Larsen-Nielsen system
and discusses how its various construction
discontinuities and vulnerabilities, such as
lack of redundancy, led to the May 1968
collapse of Ronan Point.
143
15. House of Cards: Ronan Point
Modular Buildings
The Larsen-Nielsen system was used extensively in the UK through the 1960s.
Its modular reinforced-concrete components were manufactured in a factory,
transported to the project site, and assembled into complete building structures.
Wall panels were fastened to floor slabs using various mechanical connectors.
These modules were then stacked to create multistory buildings. The system’s
most distinctive aspect was its lack of a traditional structural frame. It used no
beams or columns—only walls and floor slabs joined edge to edge.
Ronan Point was a typical late-1960s application of this system. The 22-story
tower housed 110 compact apartment units, 5 per floor. On each floor, two
reinforced-concrete walls formed a north-south corridor that also served as a
structural spine. Perpendicular walls extended outward from the spine to create
interior partitions, exterior walls on the building’s north and south faces, and
enclosures for the elevators and stairwell. These walls were all load-bearing. Each
story also included secondary non-load-bearing partition walls and non-structural
east and west façades, composed largely of windows and balconies. When these
modules were stacked, the load-bearing walls
formed uninterrupted vertical load paths for
the transmission of gravity loads down to the
ground-floor podium and foundation.
The Ronan Point

Collapse
Ronan Point was erected in under two years
and completed in March 1968. By mid-May,
most apartments were occupied. Ivy Hodge
lived in Flat 90—the southeast-corner unit
on the 18th floor. On May 16, at 5:45 am,
she struck a match to light her gas stove.
A gas explosion occurred, and the pressure
wave generated blew out both of her exterior
walls—the nonstructural east wall and the
144
load-bearing south wall. With its structural support compromised, the floor
slab immediately above her flat—the 19th floor—failed along this line and
collapsed. This initiated a chain reaction that propagated all the way to
the roof.
The five failed slabs pancaked onto Hodge’s living room floor in rapid
succession, initiating a second chain reaction in the opposite direction.
The impact of the falling slabs collapsed the 18th-floor slab, sending six
slabs crashing down onto the 17th floor, seven slabs onto the 16th, etc. The
destruction continued down to ground level. In the end, the entire southeast
corner of Ronan Point lay in a heap of rubble.
The Griffiths Inquiry

The UK government immediately initiated a formal investigation, conducted by
a panel of engineering experts and led by Barrister Hugh Griffiths. Five months
later, the Griffiths inquiry issued their findings. They had traced the gas leak
that caused the explosion to a single brass fitting that connected Hodge’s
stove to the building’s gas-supply pipe. When Hodge had moved into Flat 90,
the friend who installed her stove had used a substandard brass fitting and
overtightened it, causing a small crack from which the gas leak originated.
The Griffiths inquiry also determined that Ronan Point’s design was in full
compliance with the governing building code, Building Regulations. But the
code was out of date in several ways that contributed directly to the disaster.
One indicator of its inadequacy was that the gas explosion that brought down
Ronan Point wasn’t particularly powerful. The blast overpressure in Hodge’s
kitchen was less than 10 psi. Several pieces of physical evidence helped
characterize the explosion’s nature and severity. Three biscuit tins, which had
been stored in Hodge’s kitchen cupboard, were found to be buckled inward.
Laboratory experiments demonstrated that an overpressure of 3 to 9 psi would
have been required to cause this damage. A fuse box cover in the hallway
was also severely buckled. This level of damage was found to have required a
pressure of 12 psi—the highest blast overpressure generated by the explosion.
145
The Explosion Path

Based on the magnitude of the blast overpressure, the explosion was fueled by
approximately 50 cubic feet of natural gas. It would have taken only about 30
minutes for this quantity of gas to escape from the cracked fitting. During this
period, the gas rose to the kitchen ceiling, mixing with the air as it accumulated
there. As this layer thickened, it eventually flowed through the upper portion of
the kitchen doorway and into the hall, where it continued to accumulate.
By the time Hodge got out of bed, the gas concentration at the hallway ceiling
had reached about 5%—high enough to be ignitable. When Hodge struck
her match, the resulting burst of flame followed the same path as the gas into
the hall. As the flame front advanced, the combustion process accelerated,
and the blast overpressure increased. Thus, initially, the explosion was mostly
flame and relatively less blast pressure. The pressure didn’t reach its peak of 12
psi until the flame front was well into the hallway.
The exterior walls on the opposite side of the apartment were completely
dislodged from the structure. But the interior wall between the kitchen and
living room wasn’t damaged by the blast that originated only a few feet away
because the explosion was centered in the hallway. As the blast propagated
outward from this location, it produced nearly equal overpressures in the
kitchen and living room. These pressures counterbalanced each other; thus,
the net lateral force on the interior wall was small. But the overpressure
was applied to only one side of the exterior wall panels, more easily
dislodging them.
Indeed, testing demonstrated that the exterior walls of Hodge’s flat would
have been blown out by an internal overpressure of less than 3 psi. Force
equals pressure times area. The load-bearing south wall measured 8 feet tall
and 27 feet wide. Thus, the outward force due to a pressure of 3 psi acting on
this wall would have been more than 93,000 pounds. But from a structural
engineering perspective, it shouldn’t be possible for a minor gas explosion to
dislodge a load-bearing wall on which an entire high-rise structural system
depends. It happened at Ronan Point because of a design flaw in the Larsen-
Nielsen system—an inadequate connection between the exterior wall panels
and floor slabs.
146
Story Construction
To erect each story of the tower, the nine-foot-wide wall panels were first
lifted into position, suspended from two embedded steel lifting rods. Adjacent
wall panels were joined by inserting a steel rebar through steel loops and
filling the gap between the panels with cast-in-place concrete. The floors
comprised hollow-core slabs—so named because cylindrical cavities were
cast into each unit to reduce its weight. These slabs were positioned on a shelf
at the top of the wall panels and joined edge to edge with rebar and concrete.
Each slab was mechanically fastened to its supporting wall panel by two
factory-installed steel ties. The ties were anchored to the lifting rods within
each wall panel and secured to the slab with a bolt driven into an embedded
metal sleeve.
To provide additional structural continuity across the joints between adjacent

wall panels and slabs, two twisted steel bars were set into the gap between the
slab and wall. Then, this gap was filled with concrete. A two-inch topping of
cast-in-place concrete was also placed over the slabs to create a finished floor
surface. The wall panels of the next story were then temporarily supported on
the nuts at the top of the lower wall panels’ lifting rods. These nuts could be
screwed up or down to level the upper panels. Mortar was packed into the gap
between the upper and lower panels. Once this mortar hardened, the leveling
nuts were screwed down. Thus, the upper wall panel was supported uniformly
on the bed of mortar rather than on the lifting rods.
The gas explosion’s blast overpressure created a large outward force—nearly

50 tons applied to the three adjacent panels constituting the south wall of Flat
90. This caused the panels’ upper ends to break free from the structure along
a path corresponding to the discontinuities between the floor slab and the
upper and lower wall panels. Several different mechanisms might have resisted
this failure—but all were ineffective.
Failed Resistance Mechanisms

First, the steel ties should have resisted the wall’s outward movement. However,
the lifting rods (to which the ties were anchored) were positioned only one-
quarter inch from the inner face of the wall panel. As the wall was forced
147
outward, this thin concrete layer burst, allowing the rods to bend inward and
rendering the ties largely ineffective. Second, the upper ends of the lifting
rods extended into the bottom of the upper wall panels, creating a mechanical
connection that should also have resisted the wall’s outward displacement. But
the rods’ inward bending compromised this mechanism too. Thus, the only
remaining source of resistance was friction along these two horizontal surfaces.
But friction is a highly unreliable source of structural resistance.
The interface at which frictional resistance might have prevented the blowout
comprised two horizontal surfaces—one between the 18th- and 19th-floor
wall panels and one between the 18th-floor wall panel and the 19th-floor
slab. In general, frictional resistance at the interface between two surfaces
depends on the compressive force applied perpendicular to the surfaces.
More compression causes more frictional resistance. The compressive force
transmitted across this interface resulted from the gravity loads applied above
that level—the weight of wall panels and slabs on these four stories, plus
all associated occupancy loads. Thus, you might expect that the resulting
frictional resistance to outward movement of the wall panel would have been
large enough to prevent a blowout.
Unfortunately, the blast in Flat 90 didn’t only push Hodge’s living room
wall outward—it also pushed her ceiling upward. And an upward force on
the ceiling at any given level effectively lifts the entire structure above that
level, causing a corresponding reduction in the compressive force across this
interface. Consequently, in the Larsen-Nielsen structural system, frictional
resistance to a blowout varies with elevation. On the 18th floor, the weight
of only four higher-level floors wasn’t sufficient to generate enough frictional
resistance to prevent a wall panel blowout.
Lack of Continuity
and Redundancy
The investigators recognized that the entire tower was highly vulnerable not
just to internal blast loading but also to the effects of wind and fire. When a
tower is subjected to wind loading, it bends—resulting in compression on the
148
downwind side and tension on the upwind side. And if the tower is made of
discrete elements, these elements tend to pull apart on the upwind face and
along the sides.
To some extent, this tendency is offset by the building’s weight. Yet, even
if wind loading doesn’t cause a net tension force at the interfaces between
segments, it does reduce the gravity-induced compression across these
interfaces. Reduced compression causes a corresponding reduction in
frictional resistance along the slab-to-wall connections. This is worrisome
for two reasons: First, as wind flows around a building, it can create a strong
outward suction force on some wall surfaces. Second, at that time, the
governing 1952 edition of the UK Building Regulations specified design wind
loads that were far too low. It failed to consider that wind speed increases
significantly at higher elevations.
Therefore, even though Ronan Point’s design complied fully with the
regulations, an extreme windstorm could create the same conditions that
caused the wall panel blowout of May 1968—an outward force (caused by
wind-induced suction) and reduced frictional resistance at the slab-to-wall
connections (caused by wind-induced bending of the tower). As the blast-
induced failure demonstrated, loss of a few wall panels could easily bring
down the entire structure.
The investigators also found that the slab-to-wall connection was similarly
vulnerable to fire. In an intense fire, the interior faces of concrete walls and
floor slabs heat up and expand; the surfaces oriented away from the fire
remain cooler. This differential heating causes an arching effect, which could
cause enough rotation at the ends of the walls and slabs to compromise the
connections. In this condition, the structure would also be vulnerable to a
wind-induced wall panel blowout—also triggering a global structural collapse.
These issues suggest that beyond the details of its connections, Ronan Point
suffered from two fundamental design deficiencies—lack of continuity
and lack of redundancy. The Larsen-Nielsen system was characterized by
discontinuities at the joints between the floor slabs and wall panels. This
could have been addressed by robust steel interconnections, but the existing
ties were inadequate. The discontinuities inevitably became points of failure.
Furthermore, a single connection failure propagated into a large-scale collapse
149
because the structural system was nonredundant. There were no alternative

load paths that might have allowed the structure to survive the loss of a few
wall panels.
Webb’s Campaign
After the disaster, the collapsed portion of the tower was rebuilt. In response
to a recommendation by the Griffiths inquiry, steel blast angles were added to
the floor-to-wall connections throughout the building. By providing greater
continuity at these joints, this retrofit improved structural safety. The inquiry
also prompted a major revision to the Building Regulations, which incorporated
improved wind-load provisions and new requirements for blast resistance and
structural redundancy. Furthermore, as these new regulations wouldn’t affect
existing structures, the government also prohibited the use of natural gas in all
Larsen-Nielsen structures and similar modular building systems.
However, an architect named Sam Webb, who had testified in the Griffiths
inquiry, believed many of the tower’s structural inadequacies still hadn’t been
addressed. He embarked upon a campaign to convince the building’s owner—
the Newham Council—that Ronan Point remained a disaster waiting to
happen. In 1986, the council decided to condemn the tower.
The council directed that Ronan Point would be disassembled piece by piece.
Webb witnessed and documented this entire “forensic demolition.” As he
reported, not a single connection in the entire structure had been built in
full compliance with the design specifications. Most of the steel ties hadn’t
been bolted to the floor slabs—and in those that were connected, the bolts
were loose. The concrete fill between the slabs and wall panels was full of
construction debris and air voids. Most seriously, the leveling nuts used to
position the wall panels during construction had never been screwed down
after the mortar fill had hardened. Consequently, each wall panel was
supported on the two leveling nuts. The resulting concentrations of internal
force had caused severe cracking—particularly in the lower-story wall
panels—and compromised the entire structure’s safety.
Webb’s efforts stimulated intense demands for systematic corrective actions

that were decisive and far-reaching. In succeeding years, the remaining
Larsen-Nielsen system buildings in the UK were condemned and demolished.
150
Many structures using similar modular systems were evaluated, and some
were also demolished. Most importantly, research programs were initiated
in the UK and elsewhere to study redundancy, progressive collapse, and
internal blast effects. This yielded improved building-code provisions
worldwide. Today, a major section of the UK Building Regulations is devoted
to specifications for reducing the sensitivity of buildings to “disproportionate
collapse in the event of an accident.”
Lessons Learned
First, this is another cautionary tale about the inherent risk in structural
engineering innovation, where it’s often not feasible to validate new ideas
by testing full-sized prototypes. In trying to solve a severe housing shortage
quickly and inexpensively, the developers inadvertently created a unique
vulnerability to internal blast loading. Imagine how different the case would
have been if the structural system had been a traditional steel or reinforced-
concrete frame, clad with a lightweight curtain wall. Moreover, the Larsen-
Nielsen system was originally developed for buildings no more than six stories
tall. Thus, its use in high-rise towers like Ronan Point was an extrapolation of
an extrapolation.
Second, building codes always lag new technologies. Engineers who

extrapolate beyond well-established norms incur a heightened ethical
responsibility to anticipate and design against potential new failure modes—
and to recognize situations in which the consequences of failure dictate
greater diligence.
Reading
Griffiths, Pugsley, and Saunders, Report of the Inquiry into the Collapse of
Flats at Ronan Point.
151
16
Brittle Fracture:
The Great
Molasses Flood
One of the most bizarre structural failures
in history, the Great Boston Molasses
Flood, occurred on January 15, 1919, on the
waterfront of Boston’s North End. The rupture
of a storage tank caused a powerful wave of
more than 2 million gallons of molasses to
rapidly take out at least two city blocks. This
lesson discusses the various phenomena that
led to the tank’s structural failure, including
fatigue, fracture, stress, and strain, as well as
fracture mechanics.
152
16. Brittle Fracture: The Great Molasses Flood
The Great Boston

Molasses Flood
United States Industrial Alcohol (USIA), a manufacturing company,
purchased bulk molasses from the Caribbean, shipped it to affiliated East
Coast distilleries, and processed it into ethanol for industrial purposes.
Because USIA’s Boston-area distillery was a mile inland from Boston Harbor,
the company constructed a storage tank along the North End waterfront to
store the incoming molasses shipments. Built in 1915, the tank was 50 feet
high, 90 feet in diameter, and constructed of riveted steel plates. No engineers
were involved in its design. Construction was rushed, and no significant
testing was performed on the completed structure.
It seemed certain that the 18th Amendment to the US Constitution would be

ratified in January 1919. The prohibition of “intoxicating liquors” wouldn’t go
into effect until one year after ratification. Meanwhile, there would surely be a
pre-Prohibition spike in demand for alcoholic beverages; USIA would exploit this
153
narrow window of opportunity by quickly retooling its distilleries to facilitate

large-scale alcohol production for the liquor industry. To support this strategy, the
company ordered a large shipment of molasses to top off its Boston storage tank.
A steamer delivered this shipment to the Commercial Street wharf on January

12, 1919. Because of temperatures near 0°F, the molasses had to be heated
before it could be pumped from the ship into the storage tank. The transfer
went smoothly, and the tank was filled to its 2.3-million-gallon capacity. By
midday on January 15, the weather had warmed considerably. At 12:41 pm,
survivors reported hearing “a deep growling” noise followed by “a thunderclap”
as the storage tank ruptured. A hail of steel fragments was followed by a 25-foot-
high tidal wave of molasses. Ultimately, the Great Boston Molasses Flood killed
21 people, injured 150, and caused enormous property damage.
A three-year legal proceeding determined that the incident stemmed from

a structural failure caused primarily by an inadequate design. This verdict
has since been confirmed by a modern engineering analysis—which added
that the “thunderclap” that initiated the flood was almost certainly a fatigue-
induced brittle fracture of the steel tank.
Fatigue and Fracture

Fatigue and fracture are best understood within the broader context of the
mechanical properties of materials, many of which are determined through
the uniaxial tension test. Consider a structural steel bar that is 10 inches
long and has a cross section measuring 0.25 by 0.25 inches. This specimen is
clamped into a powerful hydraulic machine that applies a gradually increasing
tension force to the bar until it breaks. As this load is applied, the bar’s
elongation is measured. The data can be plotted as a graph of load versus
elongation. From the start of the test through a load of about 2,250 pounds,
the curve is steep—meaning the elongation for a given load is small. Within
this region of the curve, the material behavior is said to be elastic—if the load
is removed, the bar will spring back to its original length.
But beyond this elastic region, the curve changes dramatically. A horizontal
plateau indicates that the bar is experiencing substantial elongation with no
increase in load. The steel is stretching like taffy—a phenomenon called yielding,
which marks the onset of material failure. When yielding begins, the specimen’s
154
behavior changes from elastic to plastic. All subsequent elongation is permanent.

Beyond this yield plateau, the curve again rises, though only gradually. Thus, it is
continuing to experience large plastic deformations. Eventually, the curve peaks,
then drops off. At an elongation of about 2.5 inches, the specimen fractures.
Stress and Strain

To characterize the material behavior of structural steel more generally, the
load-deformation curve must be converted into a stress-strain curve. Stress
is the intensity of internal force in a member. For a tension specimen, stress
is the load divided by the member’s cross-sectional area. For example, the
stress at which the bar yields is the load—2,250 pounds—divided by the
area—0.25 inches times 0.25 inches. This equals 36,000 psi. This stress is
distributed uniformly over the bar’s cross section.
Strain is a nondimensional measure of deformation. It equals the measured

elongation divided by the member’s original length and is usually expressed as
a percentage. For example, the strain at which the test specimen fractured is the
elongation—2.5 inches—divided by the original length—10 inches. This equals
25%. That is, when the bar broke, its length had increased by one-quarter.
By doing these calculations for each data point in the load-deformation curve
and plotting the results, the stress-strain curve is created. Although the shape
of this curve is identical to that of the load-elongation curve, the numerical
values on the axes characterize the generalized mechanical properties of the
material rather than the properties of a specific test specimen. Two properties
are vital for the understanding of this case study:
` First, the stress at which a material yields is called the yield strength—
which, for this type of steel, is 36,000 psi.
` Second, the strain at which the material ruptures is a measure of its

ductility—defined as a material’s capacity to undergo large plastic
deformation before breaking. With a fracture strain of 25%, this particular
steel is quite ductile.
155
Brittleness
The opposite of ductility is brittleness. A brittle material—like cast iron—
never yields. It elongates elastically and fractures suddenly. The fracture strain
of cast iron is in the order of 0.1%—250 times smaller than that of structural
steel. The concept of ductility is important to this case study because brittle
fracture—which doomed the Boston molasses tank—is defined as the non-
ductile failure of a material subjected to tension. In structural engineering,
non-ductile failure is anathema because it occurs without the large plastic
deformations that should provide warning of impending failure.
Under certain conditions, a ductile material like steel can also fail in a brittle
manner—often at a level of stress significantly below the material’s yield
strength. The most important condition under which an otherwise ductile
material might experience a brittle fracture is the presence of an internal
defect or crack. Fracture mechanics was developed to predict the strength of
materials that have preexisting defects.
Fracture Mechanics
The basic principles of fracture mechanics are embodied in a mathematical
model developed by Alan Griffith. The mathematical derivation of Griffith’s
model is based on this idealization—a metal plate that’s subjected to a uniform
tension stress (sigma) and has a through-thickness crack with a length of 2a.
This equation defines the stress intensity factor, K, which equals sigma
times the square root of pi times a. It also defines a material property called
fracture toughness, KC . This is determined by experimental measurement and
represents the critical value of K at which fracture will occur.
Griffith’s criterion states that any time K exceeds KC , the material can
be expected to fail by brittle fracture. We can also apply this equation
qualitatively to identify the three main factors that directly influence a
structural element’s susceptibility to brittle fracture—the tension stress in the
element, the maximum size of a crack or defect, and the material’s fracture
toughness. Griffith’s criterion predicts that the presence of a preexisting
crack will cause a member to fracture at a substantially lower stress than an
156
uncracked specimen. In addition to stress and crack size, susceptibility to

brittle fracture is strongly influenced by fracture toughness. In structural
applications, low toughness is never good.
There are three more indirect influences on susceptibility to brittle fracture:
` First, stress concentrations can increase stress.
` Second, fatigue can increase crack size.
` Finally, low temperature can reduce fracture toughness.
Stress concentrations occur at discontinuities, like a bolt hole in a structural

element. When a load is applied, the horizontal lines distort to varying
degrees. The locations where the lines stretch farthest apart are along the
inner edges of the hole. This large distortion indicates that the tension stress
at these locations is much larger than anywhere else in the specimen. These
are stress concentrations—points at which the local stress is measurably
higher than the average stress in the element. If a crack occurs near a stress
concentration, the likelihood of fracture is greatly increased.
Moreover, fatigue is caused by repetitive tensile loading, which can cause a

defect to become a crack—and then to elongate slightly with each successive
cycle of stress. The resulting increase in crack size also increases susceptibility
to fracture. Finally, some metals have a distinct ductile-to-brittle transition
temperature below which the material’s fracture toughness drops sharply. The
transition temperature for modern structural steel is typically around 0°F—
but it can be significantly higher in older steels not manufactured to modern
standards. Exposure to temperatures below the transition temperature can
cause a normally ductile metal to fracture like glass.
In summary, based on the principles of fracture mechanics, there are six

worst-case conditions for vulnerability to brittle fracture: high tension stress,
significant flaws or cracks, low fracture toughness, low temperature, stress
concentrations, and repetitive loading. The Boston molasses tank had all of
these vulnerabilities.
157
Mayville’s Analysis
Consider a plastic bag filled with molasses to simulate the cylindrical tank.
The liquid exerts outward pressure on its container, and the container stretches.
Because this tension is causing the cylinder’s circumference to increase, it’s
called circumferential stress. The container also stretches more on the bottom
than on top. This indicates that the circumferential stress is highest at the
bottom of the cylinder due to the accumulated weight of all the fluid above.
Recently, Ronald Mayville performed an extensive analysis of the molasses

tank failure using modern techniques and structural analysis tools. He
demonstrated that the tank’s maximum circumferential stress was 67% higher
than the era’s design standards specified. Moreover, because this stress was
caused by the weight of molasses in the tank, it was applied repetitively—with
one stress cycle occurring every time the tank was filled and then emptied.
Thus, the overstressed steel also experienced long-term damage due to fatigue.
Based on the physical evidence recovered during the post-failure investigation,

the fatal fracture likely began at the circular hatch located near the bottom of
the tank. Of all the recovered fragments, this hatch was found farthest away
from its original location. The circular hatch opening would have caused
major stress concentrations within the region of maximum circumferential
stress, and the rivet holes would have caused stress concentrations within
a stress concentration. Moreover, the rivet holes were created by punching
through the steel. This resulted in rough edges with many imperfections that
could easily have initiated the crack.
The quality of the steel used to build the tank was probably consistent with
early-20th-century standards, with a chemical composition low in manganese.
Consequently, the steel would have had a relatively high transition
temperature—possibly more than 50°F. The temperature in Boston at the
time of the disaster was about 40°F. Thus, the tank’s fracture toughness
would have been dangerously low at that moment.
158
Why the Failure Occurred

The prevailing theory on why the failure occurred on a 40°F day—and not
when the tank had been topped off and the local temperature was near 0°F—
is that the mixing of warm molasses from the ship with the cold molasses in
the tank caused a fermentation reaction that produced carbon dioxide gas.
Over the next two days, the buildup of gas pressure inside the sealed tank
increased the tension stress in the steel. According to Griffith’s equation, this
higher stress would have increased the tank’s susceptibility to brittle fracture
without any change in crack size. Thus, at midday on January 15, an existing
crack became critical, and the Great Boston Molasses Flood was unleashed.
Unfortunately, even though this catastrophe was caused by a fatigue-induced

fracture, it did nothing to raise awareness of these phenomena. The three-year
legal proceeding identified no specific cause beyond “inadequate design.” Later in
the 20th century, individual industries were forced to confront the challenges of
fatigue and fracture by major failures in their respective technological domains.
Fatigue-Related Cracking:
Shipbuilding
In the shipbuilding industry, the wake-up call came during World War II,
when mass-produced welded steel cargo vessels began experiencing structural
failures at an alarming rate. At least 16 of these ships broke in half and sank,
and more than 1,000 developed serious fatigue-related cracking problems.
` Repetitive stresses were caused by the hulls flexing as they moved across
rough seas.
` Cracks originated at stress concentrations caused by the sharp corners of

rectangular hatch openings.
` Welding embrittled the steel, and these same welded joints also allowed
cracks to propagate easily from one hull component into the next.
` The frigid North Atlantic waters lowered the steel’s fracture toughness to
perilously low levels.
159
Fortunately, a few of these failures occurred in port. The causes could be

diagnosed and then addressed through improved shipbuilding practices.
Fatigue-Related
Cracking: Airliners
The aerospace industry had its wake-up call in the case of the de Havilland
Comet, the world’s first jet-propelled commercial airliner—and also one of
the first to use a pressurized cabin. Within two years of its debut, five Comets
crashed, three under circumstances that suggested in-flight structural failures.
Consequently, the entire fleet was grounded.
After an extensive investigation, the causes of these failures were identified.

Pressurization of an aircraft fuselage causes circumferential tension. In the Comet,
repeated pressurization and depressurization caused fatigue cracking at the corners
of rectangular windows and hatches. When these cracks reached their critical
length—typically after about 1,000 pressurizations—the tension stress caused a
brittle fracture. This split the fuselage open and caused the airframe to break apart.
These crashes stimulated intensive, industry-wide efforts to address fatigue

and fracture in aircraft design. Nonetheless, the challenges of fatigue and fracture
persisted. On April 28, 1988, the pressurized fuselage of an Aloha Airlines Boeing
737 ripped open as the aircraft was approaching cruising altitude over the Hawaiian
Islands. Miraculously, the pilots landed the crippled aircraft safely. On the one
hand, this incident was an encouraging indicator of progress. The Aloha 737 had
survived a catastrophic fracture that occurred after 90,000 pressurized flights—90
times more than the early Comets had experienced when they crashed. On the other
hand, the failure served as a reminder that metal never improves with age.
Reading
Brown, “Details of the Failure of a 90-Foot Molasses Tank.”
Mayville, “The Great Boston Molasses Tank Failure of 1919.”
Puleo, Dark Tide.
Schworm, “Nearly a Century Later, Structural Flaw in Molasses Tank
Revealed.”
160
17
Stress Corrosion:
The Silver Bridge
Welcome to the sixth in this course’s series
of case studies involving failures caused by
inadequate structural resistance. The Silver
Bridge collapse is an especially fascinating
case because the structure was so unique,
the failure investigation was so challenging,
and the long-term consequences were so
profound. In this lesson, you will explore
the bridge’s unconventional design and
the National Transportation Safety Board’s
(NTSB) analysis of the incident, which found
that mechanisms such as chain failure and
corrosion contributed to the collapse.
161
17. Stress Corrosion: The Silver Bridge
The Silver Bridge Collapse

On the evening of December 15, 1967, traffic was jamming the Silver Bridge,
which carried US Route 35 across the Ohio River between Virginia and
Ohio. At 5:00 pm, 23 automobiles and 6 tractor-trailers were halted in the
westbound lane due to a traffic light. In the eastbound lane, 2 fully loaded
dump trucks and 6 cars were crossing near mid-span. At that moment, a
violent shudder occurred, and the Silver Bridge toppled, starting near the
Ohio end. It spilled 24 vehicles into the Ohio River and 7 more onto the
shore. Forty-six people died. It would take a three-year investigation to solve
the mystery of the Silver Bridge collapse.
The Silver Bridge’s Design

In the late 1920s, the West Virginia–Ohio River Bridge Company hired
an engineering consultant to design a conventional suspension bridge with
an estimated construction cost of $825,000. However, a substantial bonus
would be paid if the construction contractor developed an alternative design
that could be built for less than $800,000. In response, the American Bridge
Company submitted a proposal for a hybrid truss-suspension bridge that
met the specified cost criterion. At the time, there was only one structure
of this type in the world—the Hercilio Luz Bridge in Florianópolis,
Brazil, designed by David Steinman and constructed in 1926. Steinman’s
construction contractor for this project was the American Bridge Company,
whose engineers adapted
Steinman’s design for the
Silver Bridge proposal.
The bridge would carry two

traffic lanes and a sidewalk
across the 1,000-foot-wide
river on seven spans. The
700-foot main span and two
380-foot side spans were
steel trusses, supported on
concrete piers and linked to
162
the approach ramps by two short girder spans at each end of the bridge. The
truss spans were suspended from two steel chains secured at anchorages on
both shores and draped between two steel towers.
These chains comprised eyebars, each about 50 feet long, arranged in pairs,
and interconnected with massive steel pins to which the vertical suspenders
were also connected. The eyebars were secured by steel caps, fastened to both
ends of each pin with a bolt. The American Bridge engineers could use so
little material because their eyebar chains were made of a new type of heat-
treated steel that was more than twice as strong as conventional structural
steel. This product had been used in only one previous bridge—Steinman’s
bridge in Florianópolis.
Steinman’s design also inspired the Silver Bridge’s innovative structural

configuration. In a conventional suspension bridge, the cables and stiffening
trusses are distinct structural entities, interconnected only by the vertical
suspenders. But in the Silver Bridge, these elements were combined. The eyebar
chains also served as the top chords of the trusses—in the middle of the main
span and in the outer half of the side spans. The structural efficiency of this
hybrid configuration—and of the high-strength steel eyebars—produced the
cost savings that won the construction contract for American Bridge.
When the Silver Bridge was built in 1928, it was regarded as an engineering
triumph. The design was so successful that an identical bridge was built in St.
Marys, West Virginia. But 39 years later, its acclaimed innovations became its
fatal flaws. Uncovering these flaws was the job of the NTSB, which initiated
its investigation immediately after the collapse.
The NTSB Analysis

The Army Corps of Engineers conducted the recovery of the wreckage from
the Ohio River. They photographed each piece of the structure in place
and then used barge-mounted cranes and divers to retrieve the wreckage
and relocate it to a nearby field for further study. The NTSB began its
investigation by identifying all possible causes and applying the process of
elimination to narrow the list down. The possible causes of failure were
organized into several major categories.
163
First, a failure in the foundation category could have been caused by scour—
the undermining of a foundation by flowing water—or by movement of the
piers or anchorages. However, divers and surveyors found no evidence of scour
or movement. Second, neither the NTSB’s examination of the wreckage nor
eyewitness testimony found any evidence that an external event—a vehicle
collision or sabotage—could have initiated the collapse.
Third, local weather data indicated that at the time of the disaster, the wind
was blowing parallel to the bridge at only 6 mph. This couldn’t have caused
a wind-load failure or wind-induced vibration. Fourth, overstress could have
resulted from several different causes. A design error seemed unlikely because
the bridge had stood for 39 years. Nonetheless, the NTSB reviewed American
Bridge’s original design calculations and found no significant errors or
omissions. The design was in full compliance with the standards of the 1920s.
Failure due to excessive load seemed more likely because the average weights
of automobiles had nearly tripled in the four decades since the bridge
was designed. However, the NTSB’s structural analysis revealed that the
stresses caused by the actual vehicles on the bridge when it collapsed were
significantly less than the stresses for which it had been designed. In short,
there wasn’t enough traffic on the bridge to have caused an overload. The
investigators also noted that the original design hadn’t accounted for the
dynamic effects of moving traffic—for example, the jolt caused by vehicles
crossing an expansion joint. Thus, the NTSB conducted dynamic testing
of St. Marys Bridge. These tests demonstrated that the dynamic structural
response wasn’t large enough to have triggered the collapse.
Chain Failure
Finally, the NTSB focused on the remaining category—a superstructure
defect. The term superstructure refers to the portion of a bridge above its
foundations—in this case, the towers, eyebar chains, suspenders, and trusses.
Each possible cause listed in this category corresponded to a failed component
found in the salvaged wreckage. For example, a suspender designated as
member 17N was found to have fractured; thus, this was considered a possible
cause of the collapse in the logic framework.
164
The challenge was distinguishing between the one component failure that
caused the collapse and the many caused by the collapse. The investigators
used the physical evidence and eyewitness accounts to reconstruct the collapse
sequence and trace this sequence back to its point of origin. They discovered
that both towers had fallen toward the east. The Silver Bridge towers were
mounted on pivoting supports designed to accommodate unbalanced loads.
As such, they were held erect entirely by the eyebar chains. Any chain failure
would have caused both towers to fall.
The failure of a truss member or suspender couldn’t have toppled both towers,
suggesting that a chain failure was the culprit. But a chain failure in the
center span would have caused the towers to fall in opposite directions. Only
a chain failure within the western side span could have caused both towers to
fall toward the east. This insight was a significant breakthrough—especially
because there was only one broken eyebar within the entire western side span.
Designated as eyebar 330 on the design drawings, it had fractured through its
outer pin hole.
Eyebar 330
The emerging hypothesis—that the fracture of eyebar 330 had initiated the
collapse—was confirmed by the NTSB’s analysis of the collapsed structure.
It demonstrated that the positions, deformations, and local failures of all
structural components were fully consistent with a collapse sequence that
began with the fracture of eyebar 330. To determine what had caused the
fracture, the NTSB retained five testing laboratories to perform mechanical
and metallurgical tests on the eyebar material. The results were conclusive.
Eyebar 330 failed when a tiny existing crack, located on the inner surface
of the pin hole, became critical and initiated a brittle fracture. The crack
was only one-quarter inch long and one-eighth inch deep. According to the
principles of fracture mechanics, a crack with such a short length, a, could
only become critical if the stress, sigma, was extremely high, or the fracture
toughness, KC , was extremely low. Eyebar 330 had both of these conditions.
165
The stress at the crack location was high because of a severe stress
concentration caused by the hole in the eyebar. Its effect was seen in large
distortions along the sides of the hole. More importantly, the innovative steel
used for these eyebars had dangerously low fracture toughness—especially at
the subfreezing temperatures the structure experienced on December 15, 1967.
Corrosion
The NTSB’s structural analysis showed that the stress in eyebar 330 was
caused primarily by the bridge’s unchanging weight. Ultimately, metallurgical
testing revealed that the crack in eyebar 330 was caused by stress corrosion
cracking. Corrosion—often encountered as rust—is the gradual destruction
of metal by a chemical reaction with its environment. In steel structures, the
resulting destruction of intact material can severely weaken a member.
Stress corrosion requires not only corrosion but also sustained tension stress.
At the microscopic level, metals are composed of crystals, called grains.
When a metal is subjected to tension, the grain boundaries pull apart slightly.
Under certain environmental conditions, corrosion can develop within the
voids between the grains. As the by-products of corrosion accumulate, they
force the grain boundaries farther apart, creating tiny cracks. Corrosion can
also promote the long-term growth of the cracks, even under low levels of
repetitive stress.
The NTSB’s metallurgical testing demonstrated that the innovative high-

strength steel used for the Silver Bridge eyebars was especially susceptible
to stress corrosion. The corrosive environment that drove this process
was provided primarily by the air pollution caused by local industries. In
summary, the Silver Bridge collapse was a four-decade-long process. In 1928,
while construction was still under way, corrosion-sensitive steel eyebars
were subjected to high stress in a corrosive environment. They developed
stress corrosion cracks. Over the next 39 years, one of these cracks grew to
its critical length. On that cold December evening, the material’s fracture
toughness dropped to its critical level, and the existing crack triggered a
brittle fracture of the lower half of eyebar 330’s outer eye. The other half
was instantly overloaded, and it failed in bending. With eyebar 330 severed,
166
the asymmetrically loaded pin rotated sideways, the pin cap broke off, and
the remaining eyebar slipped off the pin. With the chain now broken, a
progressive collapse of the entire structure was inevitable.
The NTSB’s final report also cited two additional factors that contributed
significantly to the disaster. First, the eyebar connection configuration was
deeply flawed. The narrow gaps between the eyebars and pin were breeding
grounds for corrosion—and their interior surfaces were inaccessible and
hidden from view. Thus, neither corrosion nor cracking could have been
detected without disassembling the connection. Under these conditions, a
connection failure was inevitable. Second, with its pivoting tower supports,
hybrid truss configuration, and use of eyebar chains with only two eyebars per
link, the structural system was nonredundant for no reason. Steinman’s bridge
at Florianópolis used four eyebars per link rather than two. Thus, it would
almost certainly survive the failure of one eyebar.
The Yellow Mill Pond Bridge

The consequences of the Silver Bridge disaster were far-reaching. St. Marys
Bridge was immediately closed and then demolished in 1971. More importantly,
President Lyndon Johnson created the President’s Task Force on Bridge
Safety—charged with reviewing the Silver Bridge failure and developing a
standards-based system to ensure the long-term safety of the nation’s bridges.
National Bridge Inspection Standards were implemented as a federal regulation
in 1968. This regulation established a National Bridge Inventory, required
biennial inspections of all US bridges, provided an inspection protocol, and
mandated the federal certification of bridge inspectors.
The Silver Bridge disaster also stimulated university-based research on

fatigue- and fracture-related issues in all types of structures. This paid off
a few years later, when a new generation of bridge failures began appearing.
In the post–World War II years, the traditional use of rivets to assemble
steel structures had given way to the less expensive use of welding. Riveted
structures are relatively fatigue-resistant because they’re composed of many
discrete elements, fastened with multiple connectors. Thus, a crack that forms
in one element can’t propagate into adjacent elements. If one element fails, the
adjacent ones can usually take up the slack. In this sense, riveted structural
members are internally redundant.
167
Welded joints are generally stronger but

also have unique vulnerabilities. In the
welding process, steel elements are fused
by depositing additional molten metal
along the interface between the pieces. As
the welded metal cools, it shrinks, locking
residual tension stress into the joint.
Welds are also prone to internal defects
and often have low fracture toughness.
Thus, welded members are especially
susceptible to both fatigue and fracture.
These vulnerabilities didn’t become apparent until a decade or more after

the first-generation welded steel bridges were built. Such was the case with
the Yellow Mill Pond Bridge. When built in 1958, this bridge consisted of
14 spans, each supported by 14 to 16 standard-sized factory-produced steel
beams. To increase their load-carrying capacity, each beam was augmented
with two steel cover plates welded to its bottom flange. Between 1970 and
1981, more than 30 of these beams developed fatigue cracks at the welded
ends of the cover plates.
As such a beam bends, the abrupt termination of the cover plate causes a
major stress concentration at the transverse weld. This stress concentration—
combined with internal defects and residual tension in the weld itself—
practically guaranteed that fatigue cracks would develop at this location. In
the Yellow Mill Pond Bridge, one of these cracks was so severe that it fractured
and nearly severed the beam. But the span didn’t collapse because its multi-
beam structural system was highly redundant. When one beam fractured, the
adjacent beams had enough reserve capacity to continue supporting the concrete
deck and traffic loads safely. Thanks to routine inspections, the cracks in the
bridge were discovered and repaired using methods developed through the
research programs spawned by the Silver Bridge collapse. This research has also
contributed enormously to improved bridge design codes, which now specify
effective provisions for designing fatigue-resistant steel bridges.
168
Reading
Fisher and Roy, “Fatigue Damage in Steel Bridges and Extending
Their Life.”
Kwon and Frangopol, “Bridge Fatigue Assessment and Management.”
National Transportation Safety Board, Collapse of U.S. 35 Highway Bridge,
Point Pleasant, West Virginia.
Passaglia, A Unique Institution.
169
18
Soil and
Settlement:
The Leaning
Tower of Pisa
The past six lessons have examined
engineering failures caused by inadequate
structural resistance in many different
forms—from unstable vaulting in a medieval
cathedral to an inadequately reinforced
connection in a 21st-century pedestrian
bridge. This lesson continues with this
theme but shifts the focus below ground—to
failures associated with foundations and the
structural resistance provided by soil. You
will explore the construction of the Tower of
Pisa and discover the mechanisms behind its
characteristic lean.
170
18. Soil and Settlement: The Leaning Tower of Pisa
Foundation Types
A foundation transmits the weight of a structure (and the loads applied to
it) safely down into the earth. The most structurally desirable foundation
is one constructed directly on bedrock. If no bedrock is within reach, piers
can be built on a firm stratum of soil. This requires larger foundations and
a lighter bridge to reduce the downward pressure exerted on the soil. If no
firm stratum of soil is within reach, a pile foundation is the most common
alternative. Piles are long shafts of steel, concrete, or wood driven deep
into the ground. A point-bearing pile foundation reaches the bedrock and
supports the structure through a concentrated bearing force at the lower tip
of each pile. If the bedrock is too deep for point-bearing piles, friction piles
are used instead. This foundation type supports a structure by the friction
force developed at the interface between the outer surface of the piles and the
surrounding soil.
Designing foundations is often challenging because soil has a broad range of

mechanical properties—and because its behavior can be drastically affected
by the presence of water in the soil. Moreover, the soil beneath a building site
typically comprises many unique layers, or strata. The only way to determine
these layers’ mechanical properties is to dig or drill down through them
and pull up samples for testing. However, this process provides information
only at a few discrete points. Thus, determining what’s down there requires
considerable interpolation and educated guesswork.
The Leaning Tower of Pisa

The Tower of Pisa is the bell tower of a cathedral located in Pisa’s Piazza
dei Miracoli. The tower’s structural system is simple—a hollow masonry
cylinder with an outer facing of fine marble blocks, an inner facing of
lesser-quality stone, and, in between, a filler of mortar and rubble. A spiral
stairway within the core provides access to the tower’s seven main stories. The
first story is solid stone, while the second through seventh are delineated by
exterior galleries, supported by Romanesque arcades running around the full
circumference of the tower. At the top is a cylindrical belfry, which brings the
tower’s total height to 200 feet.
171
The foundation is a thick ring of solid stone blocks, assembled without

mortar, and about twice as wide as the bottom-story wall. This is a
spread footing, intended to distribute the building’s ample weight across
a sufficiently broad area so that the soft soil underneath will support it
adequately. If the tower were built directly on the soil, the soil would
experience substantial settlement—or downward displacement.
The Tower’s Construction

Construction of the tower
began in 1173. Even while
the first story was still under
construction, the structure
started leaning to the north.
The masons attempted to
compensate by angling the
courses of stone slightly in
the opposite direction. After
five years, three and a half
stories had been completed.
But then construction was
interrupted and didn’t
resume until 1272. Over
the next several years, as
construction proceeded
upward through the seventh
story, something strange
happened—the tower tipped
toward the south.
In 1284, construction was

halted for nearly seven
decades. By the time it
resumed around 1350,
the southward lean had
become so pronounced that
the builders realigned the
172
belfry to bring its axis closer to vertical. However, this realignment couldn’t
compensate for the belfry’s substantial weight—which caused the tower’s lean
to increase from about 2.5 degrees to 4.5 degrees over the following century.
The tower was sinking too. By the 19th century, even the high side of the
foundation had settled more than six feet. Thus, in 1838, the Pisans decided
that visitors to the tower should be able to view the substantial portion of the
structure that had sunk below ground level. They excavated a trench around
the tower’s base and built a below-ground walkway—called the catino, or
basin. This nearly destroyed the tower.
The soil surrounding a building foundation largely adds to the foundation’s

strength by providing lateral confinement. Removing this large mass of soil
from around the foundation caused another increase in the tower’s lean—by
about a half a degree. The bottom of the catino was also below the water table,
meaning continuous pumping was required to keep it from flooding.
Burland’s Committee
In the early 20th century, the Italian government established several
commissions to study the problem and monitor the tower’s movement. In
1935, convinced that the perpetual flooding of the catino was destabilizing
the tower, government engineers attempted to stop the water infiltration
by injecting concrete grout into the foundation and surrounding soil. This
slowed the infiltration—but caused the tower’s rate of tilt to increase again.
The period from the 1960s through 1990 saw a succession of new government
commissions, which proposed a series of bizarre solutions that were rejected because
they were too architecturally intrusive. By the late 1980s, the tower’s increasing
lean was also causing structural distress. There was a severe stress concentration
where the structural core was already weakened by the doorway connecting the
second-level gallery to the internal stairway. The stone in this area was dangerously
close to crushing in compression—a local failure that would surely have triggered a
catastrophic collapse. By this time, the tower’s lean had reached 5.5 degrees.
In 1989, an 11th-century tower in Pavia collapsed without warning, killing

4 people and injuring 15. This finally stirred the government to action. An
international committee of recognized experts in geotechnical engineering,
173
structural engineering, art history, and historic

preservation was established to fix the Tower
of Pisa problem. The committee was led by
Professor John Burland, a geotechnical
engineer from Imperial College, London.
Over the next 11 years, Burland’s committee

conducted a scientific study of the problem and
John Burland developed both short- and long-term solutions that
effectively saved the Tower of Pisa. They began by
doing extensive subsurface exploration and testing to
produce an accurate characterization of the soil beneath the tower. The tower
rests on three major geological layers—an upper layer of alluvial sand and silt, a
middle layer with three different strata of clay and one of sand, and a lower layer
of sand. Clearly, the fundamental cause of the tower’s tilt was in the stratum of
soft clay at the top of the middle layer. The severe reduction in thickness there
provided clear evidence of a phenomenon called consolidation.
Soil Mechanics
Soil is a granular material in which individual particles interact with each
other at discrete points of contact. This structure is conceptualized as a soil
skeleton. It carries load by transmitting internal forces—compression and
friction—between the particles at their points of contact. The larger these
internal forces, the stronger the soil. The friction between particles prevents
them from sliding with respect to each other.
Within the soil skeleton, the voids between the particles can be filled with
either air or water. When completely filled with water—called porewater—
the soil is saturated. In general, the presence of porewater makes a soil weaker
because the water causes buoyancy, which reduces the friction forces between
the particles. With less friction, the particles slide more easily across each
other, and the soil fails at a lower stress.
Of the four main soil types—sand, gravel, silt, and clay—clay is the most affected
by porewater. Clay is composed of fine, plate-shaped grains, which bond together
in the presence of water. Thus, saturated clay is uniquely cohesive and practically
impermeable to water. When saturated clay is subjected to long-term compressive
174
loading, the soil’s low permeability initially prevents the porewater from being
squeezed out. Because water is essentially incompressible, the water initially carries
most of the applied load with no significant change in the volume of the soil mass.
But the resulting increase in porewater pressure eventually causes the water to
diffuse away to surrounding regions under less pressure. As the water is squeezed
out, the clay particles carry an ever-increasing share of the load. As they compress,
the voids get smaller, and the soil decreases in volume.
This volume change is called consolidation—a process that has occurred

repeatedly beneath the Pisa tower. As each new construction phase increased
the structure’s weight, consolidation of the upper clay stratum increased, and
the tower settled more. The initial construction phase caused a small tilt to
the north, but then the tower “went south” during the remaining phases.
Each new construction phase caused an abrupt increase in the angle—as
did the excavation of the catino. Then, the rate of increase declined over the
following decades. This pattern is characteristic of consolidating clay.
Leaning Instability
In analyzing the implications of this pattern, Burland’s committee concluded that
if construction had not been interrupted multiple times, the tower would have
collapsed. At the time of each interruption, the downward pressure exerted by the
incomplete structure was nearly equal to the clay’s undrained strength. Thus, if
construction hadn’t paused, the continued increase in the tower’s weight would
have caused a soil bearing capacity failure—and the tower would have toppled.
But in each case, the long pause allowed the clay to drain, resulting in a significant
increase in its strength prior to the resumption of construction.
The tower’s tilting suggested it was experiencing differential settlement—

greater settlement on the south side than on the north. This would be the
case if the clay stratum were thicker on the south side than on the north. But
the soil profile indicated that this stratum was initially uniform in thickness.
The tower had become a victim of leaning instability. This phenomenon can
be modeled mathematically; the tendency to topple depends on the tower’s
height, weight, and diameter, and the soil’s flexibility.
175
The committee’s analysis demonstrated that the Tower of Pisa and its
underlying soil were dangerously close to the theoretical threshold of leaning
instability. A 6% increase in the tower’s height and weight would render
it physically incapable of standing erect. In short, the Leaning Tower was
leaning because a tall, heavy tower standing on a flexible base has an inherent
tendency to lean. As of 1990, it had reached a state of equilibrium. Under static
conditions, the angle of tilt was no longer increasing. However, occasional
natural events—like fluctuations in the level of the local water table—were
still causing small, discrete increases in the angle. If this process continued, the
tower would inevitably reach its point of instability and collapse.
Under-Excavation
The committee determined that reducing the angle of tilt would greatly enhance
the tower’s stability. The first phase of the committee’s strategy was to pile stacks
of lead weights around the north side of the tower’s base. This would ensure
that the angle of tilt wouldn’t increase while the team was developing a more
permanent solution. Also, it had the advantage of being easily reversible. For the
long-term solution, the committee decided on under-excavation, which involved
extracting soil from underneath the tower foundation’s north side, causing localized
settlement that would decrease the tower’s lean. The under-excavation would be
performed with an auger rotating within a tubular casing. This can bore into a
soil stratum and extract soil in carefully controlled quantities. The strategy was to
remove enough soil to reduce the tower’s angle of inclination by one-half degree—
enough to stabilize the structure without significantly altering its appearance.
Before implementing this strategy, the committee constructed a temporary

stay cable system to prevent the tower from toppling if something went
wrong. Then, after a series of tests and trial extractions, the full program of
under-excavation was implemented from February 2000 to June 2001. Each
extraction removed less than one cubic foot of soil, and the tower’s movement
in response was carefully monitored. Through these measurements, the
committee found that they could effectively steer the tower’s realignment with
precise placement of the soil auger. Ultimately, more than 1,300 cubic feet of
soil was removed. As the operation progressed, the lead blocks were removed
from the north side of the tower. Upon completion, the temporary stay cables
were also dismantled—leaving the tower’s appearance entirely unchanged.
176
Finally, a comprehensive modeling study was performed to validate the

endeavor’s success. Although this study predicted that the tower will remain
stable for at least 300 years, structural monitoring will continue. Through this
extraordinary engineering intervention, the Tower of Pisa was restored to its
position as of the early 19th century, before the excavation of the catino.
The Leaning Tower of

San Francisco
The Millennium Tower in San Francisco is an ultramodern 58-story
condominium skyscraper that has become the “Leaning Tower of San Francisco.”
It was built between 2006 and 2009 and is supported on a pile foundation.
Because the bedrock is about 200 feet below the surface, driving piles this deep
would have been expensive. Thus, the project’s geotechnical engineer chose to use
950 friction piles driven 80 feet down to a stratum of dense sand. The engineer
estimated that the tower would settle uniformly—about 4 to 6 inches over time.
But by 2019, it had settled 18 inches and was tilting to the northwest by 15 inches.
An engineering solution is currently being implemented. Along the tower’s north

and west sides, 52 additional piles are being driven more than 200 feet down to
the bedrock and tied to the existing foundation. This will halt the settlement
along the sides corresponding to the tower’s direction of tilt. After about 10 years,
the continued settlement of the south and east sides will remove much of this tilt.
Then, additional point-bearing piles will be driven down to the bedrock along
these sides to fully stabilize the foundation. Though different from the Tower of
Pisa’s rescue project in many ways, this solution is conceptually similar in the sense
that it uses controlled settlement as a tool to correct uncontrolled settlement.
Reading
Burland, et al., “The Leaning Tower of Pisa.”
Burland, Jamiolkowski, and Viggiani, “The Stabilisation of the Leaning
Tower of Pisa.”
177
19
Water in Soil:
Teton Dam
and Niigata
Welcome to this exploration of engineering
disasters caused primarily by inadequate
resistance to the adverse effects of water
in soil. This lesson will primarily concern the
Teton Dam catastrophe, where the decision
to build on geologically flawed ground led
inexorably to disaster. In this case study, you
will explore the design of the Teton Dam,
which was influenced by the site geology,
and the mechanism that led to its failure—
liquefaction, which then led to piping and
dam failure.
178
19. Water in Soil: Teton Dam and Niigata
The Teton Dam Catastrophe

By 1932, the US Bureau of Reclamation recognized the need for a dam across
the Teton River in eastern Idaho to control flooding, supply water for irrigation,
and generate hydroelectric power. The bureau conducted preliminary site
investigations between 1946 and 1961. However, the Teton Dam project
didn’t receive congressional authorization until 1964. The project would be
challenging, primarily because of the local geology. The upper Teton River cuts
through extensive formations of rhyolitic tuff—an igneous rock formed from
flows of volcanic ash. These formations are deeply jointed and fractured and are
generally considered unsuitable for dam foundations. However, the proposed
dam site was the only feasible one in the region. Thus, the bureau’s engineers
designed a massive earth embankment dam more than 300 feet high and
spanning 3,100 feet across the Teton River Canyon.
Construction began in early 1972, and by October 1975, the embankment

was sufficiently complete to begin filling the reservoir. By June 3, 1976,
the water level was nearing the dam’s crest. On that day, workers noticed
179
small springs of water emerging from the canyon wall a few hundred feet
downstream from the dam. But all dams experience some seepage—and the
water was clear, indicating it wasn’t carrying any sediment eroded from the
dam’s core. Thus, the engineers weren’t concerned.
But at around 7:00 am on June 5, a survey crew noticed two new leaks—one
about 130 feet below the crest, near the western canyon wall, and another
emerging from the base of the embankment down below. This time, the
water was muddy. Both leaks were small, but over the next three hours,
their flow rate increased steadily. Around 10:30 am, the upper leak quickly
developed into a large sinkhole, which started eroding upward, toward the
crest. Bulldozers were dispatched to plug the leak but were quickly swallowed
up by the expanding sinkhole. As the sinkhole continued to erode upward,
a whirlpool appeared in the reservoir. This indicated that water was being
drawn into an opening in the embankment’s upstream face, below the
reservoir’s surface.
At 11:55 am, the sinkhole reached the crest—which collapsed, opening a major
breach. Within two minutes, the entire reservoir had poured through the
breach, carrying much of the embankment with it—and sending an 80-billion-
gallon tidal wave thundering down the valley. Overall, 11 people were killed,
thousands of cattle were swept away, 300 square miles were inundated, and the
towns of Wilford and Sugar City were wiped from the map.
Liquefaction
In general, moving water exerts a drag force on individual soil particles. If
the flow is downward, this drag force acts in the same direction as gravity.
Thus, it pushes the particles into a denser configuration, increasing the
friction between them and strengthening the soil. But if the flow is upward,
the drag force works against gravity—lifting the particles, reducing the
friction between them, and making the soil weaker. If the upward flow is
strong enough, the soil loses its strength and effectively becomes liquid—a
phenomenon called liquefaction.
A difference in pressure causes water to move through soil. Water always

flows from high to low pressure. Darcy’s law describes the seepage of a fluid
through a permeable material, like soil. Consider a soil sample placed into a
180
container connected to two water tanks. When one tank is filled with fluid,
the resulting difference in pressure, delta-p, causes water to seep through the
soil at flow rate Q, measured in units of volume per time. The term Q is also a
function of four additional factors:
` the material’s permeability—a quantitative property that’s high for coarse-

grained soils (like sand and gravel) but low for fine-grained soils (like clay
and silt)
` the fluid’s viscosity—a measure of its resistance to flow
` the cross-sectional area of the material through which the fluid is moving
` the length of the flow path
The flow of water through soil increases with pressure and the permeability
of the soil and decreases with the length of the flow path. Consider a
floodwall holding back water. Raising the water level on the upstream side
of the floodwall creates a pressure difference on opposite sides of the wall.
As Darcy’s law predicts, this pressure difference drives seepage beneath the
floodwall. As the water advances beyond the base, it turns upward. Thus,
liquefaction occurs at the downstream end of the flow path. Once liquefaction
begins, piping leads to failure of the floodwall.
Piping
When liquefaction begins, it shortens the flow path, which causes the
flow rate to increase. A higher flow rate causes more liquefaction, which
further shortens the path. This cycle continues until the entire flow path
has liquified. At this point, the water is flowing freely and carrying the soil
particles along with it. This is piping, or internal erosion—the transport
of soil particles by water flowing under pressure along an internal pathway
through soil or rock. Seepage-induced piping caused the Teton Dam’s failure.
According to Darcy’s law, increasing the length of the flow path and reducing
the cross-sectional area of soil through which seepage can pass substantially
reduces the seepage flow rate and ensures that the upward seepage pressure
181
on the downstream side of a dam isn’t large enough to cause liquefaction.

Although seepage generally can’t be prevented, careful application of Darcy’s
law in the design of a dam can ensure that seepage won’t cause a failure.
Embankment Dams
A major embankment dam is a sophisticated technological system, composed
of four major components:
` First, the embankment is an engineered structure designed to resist

the immense hydrostatic pressure applied by the reservoir while also
controlling seepage through the embankment itself.
` Second, the foundation supports the embankment’s weight while also

controlling seepage beneath it. The term foundation applies only to
the interface between the embankment and the canyon floor. The two
interfaces along the canyon walls are abutments.
` Third, the outlet works include an intake structure, a tunnel capable of

carrying the river’s normal flow around the dam to a downstream outlet,
and a gate that controls the flow rate. The outflow can be routed through
the facility’s hydroelectric generating plant or directly into the river.
` Finally, the spillway provides an alternative means of discharging excess

water from the reservoir. Because its gate is slightly lower than the dam’s
crest, the spillway protects the embankment from being overtopped during
a flood.
The Teton Dam’s Design

The Teton Dam’s design was strongly influenced by the site geology. The
rhyolitic tuff comprising the canyon walls also extends beneath the canyon
floor. There, it’s overlain by a formation of volcanic basalt and a 100-foot-
thick bed of alluvium. Because this deposit of alluvium is permeable, the
embankment couldn’t be built on top of it. To prevent seepage beneath the
dam, the foundation incorporated a cutoff trench—a V-shaped excavation
that cut through the alluvium to the bedrock, across the full width of the
canyon floor.
182
The bedrock at this site is also excessively permeable. Thus, the designers
sought to reduce its permeability by incorporating a grout curtain into their
design. A grout curtain is constructed by cutting a small trench into the rock
surface, drilling a series of closely spaced bore holes deep into the rock mass,
setting steel pipes into the tops of these holes, sealing them in position with a
concrete cap, and injecting grout into the bore holes at high pressure. Thanks
to this pressure, any subterranean cracks that intersect with the bore holes are
supposed to be filled by the grout.
The Teton Dam’s design called for the construction of a grout curtain beneath
the foundation and both abutments to create a seepage barrier along the dam’s
full length. The Bureau of Reclamation conducted an on-site grouting test in
1969, while the design was still in progress. The rhyolitic tuff within 70 feet
of the surface proved to be so deeply fractured and permeable that it couldn’t
be effectively sealed, even with an excessive quantity of grout. However, the
bureau’s engineers simply modified their design, adding 70-foot-deep key
trenches beneath both abutments. The purpose of these trenches was to
remove the badly fractured rock near the surface and to relocate the grout
curtain to the less-fractured rock at the bottom of the trenches.
The design of the rest of the Teton Dam was mostly conventional. The
embankment was configured with shallow slopes to enhance its stability. Like
most earth dams, its internal structure consisted of well-defined zones—each
built from a different type of soil or rock and performing a distinct function.
The most important zone was the core—the dam’s principal water barrier.
To achieve its purpose, the core extended through the dam’s full height
and would need to be constructed of a low-permeability material. The ideal
soil for this purpose is clay. However, the economics of dam construction
typically dictate the use of locally available materials. In eastern Idaho, the
only suitable soil available in sufficient quantities was a fine-grained silt
called loess. When properly placed and compacted, loess has good strength
and relatively low permeability; however, it lacks the plasticity of clay and is
susceptible to erosion and cracking.
In the Teton embankment design, this fragile core material was protected
on both sides by a casing of well-compacted sand and gravel quarried from
the Teton riverbed. The casing was also vital for controlling seepage through
the dam. The irregularly shaped zone of permeable sand and gravel on the
183
downstream side of the core was designed to capture any water that seeped
through the core and channel it safely out of the embankment through a
horizontal sand-and-gravel bed called a blanket drain. The downstream
casing also functioned as a filter. It allowed porewater to pass easily from the
core into the casing but prevented the fine-grained core material from being
transported along with the seepage.
Downstream of the casing was a zone of lower-quality fill, which served to

enhance the dam’s stability by adding mass. It also provided a place to make
use of low-quality excavated material that couldn’t be used in any of the other
zones. Finally, the dam’s outer faces were covered with a shell of heavy stone to
armor the embankment against erosion and (on the upstream side) wave action.
The Failure Mechanism

A panel of experts was commissioned by the US Department of the Interior
and the State of Idaho immediately after the Teton Dam catastrophe
to determine why the dam failed so rapidly upon the first filling of its
reservoir. Ultimately, the panel determined that the failure was initiated by
piping through the loess core material within the key trench of the western
abutment. They couldn’t provide a definitive answer as to what caused the
piping failure because the critical physical evidence—the embankment
itself—had been washed away. But the panel did identify several plausible
alternatives consistent with three observed shortcomings in the Bureau of
Reclamation’s design.
First, the number and placement of the bore holes specified for the grout curtain
were inadequate to seal the highly fractured rhyolitic tuff beneath the dam’s
abutments. Thus, the grout curtain was ineffective as a seepage barrier. Second,
the key trenches’ walls were too steeply sloped. Thus, the soil near the top of
the trenches probably experienced arching. That is, the weight of the overlying
material was transmitted laterally to the trenches’ rigid stone walls, leaving the
underlying soil more lightly loaded. As the soil at the bottom of the trenches
settled, cracks opened up, providing pathways for internal erosion.
Most importantly, even though the embankment design included a casing and
filter to protect the fragile core material, the key trenches received no such
protection. Thus, water could enter and exit these trenches through fissures in
184
the stone walls—with nothing to prevent the soil particles from being carried
off by the moving water. Had the key trenches been provided with sand-and-
gravel filters to protect the loess core material, the failure would probably
never have happened.
According to the panel, the most probable failure mechanism was a

straightforward application of Darcy’s law. As the reservoir filled, water
moved under increasing pressure through cracks in the rhyolitic tuff to the
upstream face of the key trench. Then, it penetrated the base of the trench
along one or more cracks in the trench floor—or possibly through cracks in
the core material itself. This intrusion was stopped by the concrete cap of
the grout curtain. But the water soon found a new path downward, through
gaps in the grout curtain, and back up to the trench on the opposite side
of the concrete cap. As this high-pressure seepage moved upward, the loess
experienced liquefaction. The liquefied soil was transported out of the key
trench though cracks in its downstream wall. Eventually, increasing erosion
on both sides of the grout cap caused a breakthrough. Once uninterrupted
piping through the key trench had begun, failure of the dam was inevitable.
The Niigata Earthquake

The fundamental physical phenomenon underlying the Teton Dam
catastrophe was the movement of water through soil under pressure. But
there’s another set of conditions that can cause liquefaction—and these
conditions can be even more destructive than a dam failure. On June 16,
1964, a magnitude 7.5 earthquake struck the northwest coast of Honshu,
Japan. The city closest to the epicenter was Niigata, about 30 miles to the
south. Although it experienced relatively low levels of ground acceleration,
Niigata was devastated by the quake. More than 3,500 houses were destroyed,
and 11,000 were damaged. Landslides destroyed highways and buried homes.
Five spans of the Showa Bridge collapsed into the Shinano River, and nearby,
a development of four-story apartment buildings failed in an astonishing
manner. These incidents were all caused by liquefaction.
In loose, sandy soil, the ground motions associated with an earthquake can
compress the soil particles—causing a reduction in their volume. But if that
soil is saturated, the porewater can’t undergo a similar volume reduction
because water is essentially incompressible. As a result, the pore pressure
185
increases. If the ground motion is strong and the water can’t quickly diffuse
away to an area of lower pressure, the pore pressure can increase to the point
where the porewater is carrying all the applied stress. As a result, the friction
between soil particles drops to zero—and liquefaction occurs.
Liquefaction was so prevalent in Niigata because the entire city is built

in an earthquake-prone region on a coastal alluvial plain. The plain is a
geological formation composed of sediments, mostly loose sand deposited
by the Shinano and Agano Rivers as they flow into the Sea of Japan. Given
the city’s seaside location, this loose, sandy soil is perpetually saturated.
Thus, Niigata was—and is—a liquefaction disaster waiting to happen.
Well-designed structural foundations can mitigate the hazard associated with
earthquake-induced liquefaction, but in places like Niigata, this hazard can’t
be eliminated entirely.
Reading
King, “Tuff.”
Seed and Duncan, “The Teton Dam Failure.”
US Department of the Interior, Failure of Teton Dam.
186
20
Construction
Engineering: Two
Failed Lifts
In the US, more than 1,000 construction
workers die on the job in a typical year. Many
of these incidents involve operational or
procedural issues on the job site; therefore,
they shouldn’t be classified as engineering
failures. But some of the worst construction
disasters have indeed been engineering
failures, where some aspect of the
construction process was addressed by an
engineered solution that went badly awry. In
this lesson, you’ll learn about two such cases.
187
20. Construction Engineering: Two Failed Lifts
The Senior Road Tower

In 1982, the Senior Road Tower Group was organized to construct a
broadcast tower near Missouri City, Texas. The Senior Road Tower would top
out at nearly 2,000 feet, but otherwise its design was quite conventional. The
mast was a welded steel truss comprising three heavy tubular columns and a
web of lighter horizontal and diagonal members. It was laterally supported by
27 steel cables, called guy lines, arranged in groups of 3, and it was anchored
to concrete blocks set into the ground. To prevent the tower from swaying,
each guy line was post-tensioned with a force of roughly 20,000 pounds. At
the top of the mast was a two-module antenna unit, on which an array of
parabolic antenna baskets was mounted.
The three key participants in the Senior Road Tower project were
` Harris Corporation, a telecommunications company that designed the antenna;
` Stainless, Incorporated, a steel fabricator that also served as general

contractor for the project; and
` Worldwide Tower Services, a small company that specialized in erecting

communications towers.
The Tower’s Construction

Working as a subcontractor to Stainless, Worldwide Tower Services fielded
a crew of seven riggers to erect the tower. The mast was assembled from
prefabricated modules, each of which was trucked to the job site, hoisted into
position, and bolted to the existing structure. When these tall guyed towers are
erected, the first few modules can be positioned with a conventional crane. But
when the height of the mast exceeds that of the crane, a gin pole is temporarily
mounted at the top of the mast to hoist and position the remaining modules.
The lifting force is provided by a ground-mounted winch, winding a steel
cable (the load line). The load line extends from the winch through a pulley at
the base of the tower and all the way to the top of the gin pole, where it runs
through another pulley and then back down to its attachment with the module.
As new modules are added to the mast, the gin pole must be periodically
188
repositioned upward. Here, the same ground-mounted winch pulls a second

cable (the jump line) that runs through a pulley at the top of the mast and down
to its attachment with the bottom of the gin pole.
The process of erecting the Senior Road Tower went smoothly until the final
task—lifting and installing the two antenna modules on top of the completed
mast. The six-ton antenna modules had been fitted with lifting lugs—fittings at
which a crane’s hoist cable could be attached to lift each module off the bed of a
truck in a horizontal orientation. However, the modules would then need to be
rotated into a vertical orientation for installation on the mast. In this orientation,
the cable would interfere with—and damage—several of the antenna baskets.
A supervisor from Worldwide contacted the design engineer at Harris Corporation

and asked if the riggers could remove the baskets for the lift and reinstall them after
the module had been bolted to the top of the mast. The engineer refused, insisting
that removing the baskets would invalidate the antenna’s warranty. Thus, the riggers
devised their own solution to the problem—an outrigger, fabricated by attaching a
steel channel temporarily to the antenna module with four U-bolts. With the load
line now attached at the end of the outrigger, there was no possibility of interference
between the cable and the antenna baskets.
Worldwide didn’t have an engineer on staff. Thus, it asked Harris if one of

its engineers could check the structural adequacy of the proposed outrigger.
Harris refused, insisting that as the erector, Worldwide had full responsibility
for lifting and installing the antenna. If Harris—the designer—got involved
in this construction task, it could incur legal liability for any mishaps that
might occur during the process. Time was short; thus, Worldwide decided to
go ahead with no further verification.
The Senior Road Tower Collapse

The lift was implemented on December 7, 1982. Two riggers were stationed
at the top of the mast, while three others rode along on the antenna module,
secured by safety harnesses. Pulled upward by the winch-driven load line, the
antenna module rose steadily until it reached the 1,500-foot level, where the
lift was paused. Suddenly, the antenna module broke free from its load line
and fell. As it fell, the antenna module struck one of the guy lines. The force
of the impact significantly increased the tension in this steel cable, which
189
snapped. The combined effect of this instantaneous release of energy and the
unbalanced tension in the two remaining intact guy lines caused the mast to
displace violently away from the point of impact. This lateral deflection was
large enough to buckle the mast—and the entire structure collapsed. All five
riggers from the Worldwide crew were killed in the fall. Amid the wreckage,
investigators found the mangled outrigger, with all four U-bolts sheared off.
The failure of these bolts was pinpointed as the event that initiated the collapse.
The riggers likely reasoned that to lift six tons, four U-bolts
would work because each had a manufacturer-specified
capacity of two tons. This would have been a reasonable
solution if all four U-bolts had been carrying an equal share
of the antenna’s six-ton weight. Unfortunately, they weren’t.
This assumption would have been correct if the lift point
were equidistant between the two columns, but the load line was
actually attached at the end of the outrigger. From this point, the outrigger
effectively became a lever. The purpose of a lever is to magnify an applied force,
and that’s exactly what this one did. Indeed, the force in the two U-bolts was more
than four times higher than the riggers’ simplistic assumption predicted.
Liability
There’s no doubt that the riggers’ faulty outrigger design caused the
failure. However, it seems unfair to blame Worldwide, which identified a
construction issue, notified the design engineer, got rebuffed, developed a
solution, asked the engineer to review it, got rebuffed again, and then decided
to assume the risk and proceed with the lift. It feels more satisfying to blame
the engineers at Harris for refusing to allow removal of the antenna baskets
or even to look at the riggers’ proposed outrigger design. However, Harris’s
refusal to help resolve a construction-related issue was consistent with the
company’s contractual obligations as the project’s design professional.
In February 1985, in a civil trial convened to determine responsibility for

the five deaths, the jury imposed 100% liability on Stainless. In addition to
being the steel fabricator, Stainless was also the project’s general contractor.
In this capacity, it had full contractual responsibility for safe operation of the
construction site and was negligent in fulfilling this responsibility.
190
L’Ambiance Plaza
The structural design of L’Ambiance Plaza, an apartment building in
Bridgeport, Connecticut, included a foundation consisting of concrete
footings, which supported the basement walls, and a forest of steel columns,
which supported 17 reinforced-concrete slabs, 3 floors of the underground
parking garage, 13 residential floors, and the roof. The structural system was
configured as two independent towers, linked together at a shared elevator
shaft. Because this structural system consisted of only columns and slabs—
with no supporting beams—it was called flat slab construction. Reinforced-
concrete shear walls stabilized the frame and provided lateral resistance to
wind and earthquake loading.
The Lift-Slab Method

L’Ambiance Plaza was designed to be erected using the lift-slab method. To
understand how this contributed to the plaza’s collapse, consider the process
of lifting a hypothetical five-story structure. The lift-slab process begins
after the foundation has been built and the lower-level columns have been
erected. All five of the floor and roof slabs are then cast at ground level in a
vertical stack, with a lubricant applied between the slabs to prevent them from
adhering to each other. Casting the slabs in a stack eliminates 90% of the
formwork and temporary bracing normally required in the traditional process
of casting slabs aboveground. After the concrete has hardened, hydraulic jacks
are mounted on the tops of the columns. These jacks will be used to lift the
slabs—typically in “packages” of two or three slabs.
We’ll start with a steel column supported on its concrete footing. The
concrete slabs cast in this position at ground level have a rectangular opening
through which the column passes. Within this opening is an integrally cast
steel fixture called a shearhead. The hydraulic jack comprises a base, which
sits on top of the column, and a hydraulic ram, which pushes upward on
the crossarm. The crossarm will lift the slab by pulling upward on a pair of
threaded rods—called lifting rods—each of which has a nut at its lower end.
The lifting rods are inserted into slots in the shearhead.
191
Lifting a massive concrete slab is a slow process. In the actual system, the hydraulic
rams have a stroke of only one-half inch—meaning they can lift a slab only
one-half inch before they need to be reset back down to their retracted position.
Thus, a lift of 40 feet is actually performed as 960 individual lifts of one-half inch
each. After each half-inch lift, two nuts are screwed down to hold the lifting rods
in place; then, the ram is lowered for the next stroke. The upper nuts are screwed
down to bring the rods back into bearing on the crossarm, and the cycle begins
again. Through this process, the slab is raised slowly—typically at about five inches
per hour. In an actual lifting operation, multiple jacks are working simultaneously
to lift one large, continuous package of slabs. These jacks must operate at precisely
the same rate to minimize bending of the slabs as they’re being lifted.
When the first package of slabs reaches the top of the lower-level columns, it’s
temporarily “parked” there by inserting steel wedges between the bottom slab
and bearing blocks, which were previously welded to the column flanges. At
this time, the wedges are temporarily fastened in position with light welds.
The lifting rods are then lowered, and the remaining package is lifted in the
same way. But this time, the individual slabs are dropped off and secured at
the second- and third-floor levels. With these slabs in their final positions, the
first-story shear walls can be constructed.
Next, the jacks are removed, the upper-level column segments are erected, and
the jacks are repositioned for the next lift. As the three-slab package is raised,
individual slabs are again dropped off and wedged into position at their final
locations. To preserve the frame’s stability, shear wall construction follows
one or two levels below the highest slabs. Once the roof slab is in position,
the jacks are removed. The slab-to-column connections are strengthened by
permanently welding the wedges to the bottom of the shearheads and filling
the gaps between the slabs and columns with concrete.
The L’Ambiance Plaza Collapse

At L’Ambiance Plaza, the above process proceeded as planned until April 23,
1987, when the structure was about half complete. As of that morning, the
columns had been erected up to the seventh-floor level. In the east tower,
floor slabs had been secured at their final positions from the underground
parking garage up through the sixth floor. The remaining eight slabs were
temporarily parked at the seventh-floor level. In the west tower, the floor
192
slabs were in position from the parking garage through the third floor, six
slabs were parked at the fourth floor, and five were parked at the seventh. The
shear wall construction was lagging five to six stories behind the highest slabs,
which placed both towers at increased risk of instability.
At 11:30 am, workers in the west tower had raised the package of three slabs
from the fifth- to the seventh-floor level and were adjusting its position and
installing wedges. Other crews were working several levels below. At that
moment, a worker installing wedges at this location heard a loud bang and saw
the slab above him shatter like glass. The entire package of slabs then sagged
and dropped onto the floors below, initiating a chain-reaction collapse. As the
west tower fell, the east tower was dragged down with it. Within five seconds,
the entire structure had been reduced to rubble. Twenty-eight workers died.
Shearhead Failure
The likely plaintiffs and defendants immediately hired consultants to
investigate the collapse on their behalf. The Occupational Safety and Health
Administration also requested an independent investigation by the National
Bureau of Standards. In their final report, the National Bureau of Standards
investigators identified seven possible causes of the collapse and concluded
that the most probable cause was the failure of a shearhead.
The shearheads were rectangular steel collars embedded within the concrete
slabs—one at each column location—to serve as points of attachment
between the slabs and lifting rods. Each shearhead comprised four steel
channels with two stiffened angles welded to their inner faces. To raise the
slab, the two lifting rods—each with a heavy nut threaded onto its lower
end—were inserted into slots in these angles. As the hydraulic jack pulled the
rods upward, these lifting nuts transmitted the slab’s weight into the rods.
In the wrecked structure, the investigators identified the shearhead that

had been located closest to the point where the failure began, as reported
by eyewitnesses. This shearhead was severely distorted, with its two lifting
angles bent substantially upward. On the undersides of these angles, evidence
of scraping suggested that the lifting nuts had slid out of their slots. The
column to which this shearhead was connected had large dents immediately
adjacent to the shearhead slot openings. These observations suggested that the
193
shearheads were excessively flexible. As a result, the lifting angles had flexed
upward enough to allow the lifting rods to slip out of their slots. The loud
bang that workers heard immediately prior to the collapse was probably a
lifting nut striking the column—with sufficient force to leave a visible dent.
The investigators corroborated their theory by replicating this failure mode in the
laboratory. They demonstrated that the loss of support at one shearhead caused
the lifting rods at the adjacent shearheads to break loose as well. Deprived of
support across several consecutive spans, the entire package of slabs then failed
in bending. Its impact with the slabs below triggered the chain-reaction collapse
of the west tower. The east tower was either dragged down by its interconnection
with the west tower or knocked down by falling debris. In either case, the tower’s
marginal stability—resulting from the slow pace of shear wall construction—
probably contributed to the speed and totality of the collapse.
The findings of the National Bureau of Standards investigation were convincing

but far from unanimous. Consultants performing independent investigations
proposed several alternative failure hypotheses, none of which could be
dismissed with certainty. Thus, more than 100 parties to the dispute eventually
agreed to an out-of-court settlement. A two-judge panel mediated the settlement
and identified the parties that had contributed to the disaster through
negligence or carelessness. Then, the panel assigned levels of contribution to and
disbursement from a $41 million settlement fund and closed the case.
Reading
Culver, et al., Investigation of L’Ambiance Plaza Building Collapse.
US District Court for the Southern District of Texas, “Channel 20, Inc. v.
World Wide Towers Services, Inc.”
194
21
Maintenance
Malpractice:
The Mianus
River Bridge
This case study of the Mianus River Bridge
collapse concludes this course’s wide-ranging
exploration of structural failures. In this
lesson, you’ll examine a tragic failure caused
primarily by poorly managed inspection and
maintenance of a major highway bridge.
Phase 6 of the engineering design process—
operation and maintenance—can be heavily
dependent on policy and on resource
allocation. This case also shows that there’s
an interdependence between maintenance
and the preceding phases of the process.
195
21. Maintenance Malpractice: The Mianus River Bridge
The Mianus River

Bridge Collapse
Early on June 28, 1983, Billy Anderson was driving northbound on Interstate
95 (I-95) with a friend. Around 1:25 am, they crossed from New York into
Connecticut. Here, the highway was illuminated with overhead lighting, and
Billy could clearly see a car and two tractor-trailers driving a short distance
ahead. Suddenly, the overhead lighting went dead, and both trucks’ brake
lights came on. Billy hit the brakes too. By the time he had skidded to a
halt, the three vehicles had vanished. He stepped out of the car to investigate
and saw that six feet ahead, the roadway was gone. A 100-foot segment
of the multi-span bridge on which he was standing had dropped into the
Mianus River.
Although the number of deaths was small, the impact of the Mianus River
Bridge collapse was immense. Locally, it created a traffic nightmare, as tens of
thousands of vehicles per day were diverted onto local streets. This traffic jam
196
lasted for six months until construction of a temporary span finally allowed
the interstate to reopen. The permanent replacement bridge wasn’t completed
until nine years later.
The National Transportation Safety Board (NTSB) set out to determine

the cause of the failure to restore public confidence in the nation’s highway
bridges. Initial evidence suggested that the bridge had failed due to
inadequate maintenance. This would have placed blame for the collapse on
the state of Connecticut. But the state’s engineering consultant advanced a
plausible alternative failure theory that attributed the collapse to a unique
aspect of the bridge’s design, which would shift blame to the engineer who
had designed the structure.
Building a Girder Bridge

Designed in 1955 and completed three years later, the half-mile-long Mianus
River Bridge consisted of two essentially independent bridges—one carrying
three northbound lanes and the other carrying three southbound lanes. Each
bridge consisted of 24 steel girder spans, supported on concrete piers. The five
principal spans across the Mianus River constituted a cantilever structural
system that used cantilever girders rather than trusses.
There are three ways to build a girder bridge across four supports. First, it
can use three individual spans—a configuration called simply supported.
Because each span is supported only at its two ends, mathematical analysis of
this structure is relatively easy. But this structure is also relatively inefficient.
Under load, each independent span bends sharply in the middle but less so at
the ends. The deflected shape is concave upward along the full length of each
individual girder.
Second, the supports can be bridged with a single girder, extending

continuously from one abutment, across the two intermediate piers, to the
opposite abutment. This configuration is more difficult to analyze because
the girder has four unknown support forces rather than two. But it’s also more
structurally efficient. When the girder is loaded, it bends in a more complex
way—concave upward in the middle of each span but concave downward
over the intermediate supports. This double curvature results in less intense
bending than the simply supported alternative, making it more efficient.
197
The third alternative is the cantilever configuration. Here, two anchor spans
extend across the intermediate supports to form cantilever arms from which
the center span is suspended. This bridge is composed of three discrete
spans, each supported at only two points. Thus, mathematical analysis of
this structure is comparable to that of a simply supported bridge. Yet when
it’s loaded, it bends in double curvature—and thus has structural efficiency
comparable to that of a continuous bridge.
The structural cost of the cantilever configuration is found at two

connections, which must meet two structural requirements. First, they
must operate like hinges, allowing the ends of the suspended span to rotate
freely with respect to the cantilever arms. Second, they must accommodate
the longitudinal movements associated with the bridge’s temperature-
induced expansion and contraction. The connections devised to meet these
requirements lie at the heart of the Mianus Bridge disaster.
Cantilever Systems
The bridge’s five principal spans constituted two cantilever systems. It
consisted of a center span that functioned as two symmetrical anchor spans,
plus two additional anchor spans, four cantilever arms, and two suspended
spans. The main load-carrying members were plate girders. Girders are
large beams with an I-shaped cross section fabricated by welding steel plates
together to form the web and two flanges. Each girder had a curved profile.
This improved structural efficiency by providing greater depth over the
intermediate piers, where the tendency to bend was greatest.
One end of each suspended span was seated upon its cantilever arm, mounted
such that it was free to pivot on a heavy steel pin. The opposite end was
suspended from the cantilever arm by a pin-and-hanger assembly. This
comprised two steel hangers connected to the girder webs with seven-inch-
diameter pins and held in position by spacer washers, pin caps, and a one-inch
bolt—all made of steel. These connection configurations satisfied the key
structural requirements for a cantilever bridge.
In each bridge, the two main girders were interconnected with heavy,
diagonally oriented beams and trusses to create a parallelogram-shaped frame.
This geometric configuration—called a skewed structural system—was
198
necessary because I-95 crossed the Mianus River at an oblique angle. The
supporting piers had to be aligned with the river flow. Within this skewed
frame, additional transverse beams and longitudinal stringers were provided
to support the concrete deck, composed of parallelogram-shaped panels
separated by expansion joints. The Mianus Bridge was skewed at an unusually
large angle—54 degrees. This feature would play an important role in the
failure investigation, which began immediately after the span collapsed.
The NTSB’s Investigation

As the NTSB began its work, the investigators were aided by eyewitnesses
who had observed the collapse. These eyewitness accounts—and the position
and disposition of the wreckage—confirmed that the span was essentially
intact as it fell, east end first. Thus, the investigators concluded that the
collapse could have been initiated only by the failure of one or both pin-and-
hanger assemblies at the east end of the fallen span. Furthermore, after the
collapse, one hanger remained attached to its supporting anchor arm. It wasn’t
bent or broken—meaning it must have disconnected from the suspended span
before the collapse began. Therefore, the NTSB determined that the collapse
was initiated by this hanger slipping off its lower pin.
In probing this issue, the investigators noted that all four of the bridge’s pin-
and-hanger assemblies were severely corroded. Recall that corrosion is the
gradual destruction of a metal by a chemical reaction with water and oxygen.
It’s also greatly accelerated by the presence of salt. In the Mianus River Bridge,
the chemical preconditions for severe corrosion were provided by rainwater
and melted snow flowing through the expansion joints and washing over the
pin-and-hanger assemblies. This runoff was laden with salt, which was used
extensively for deicing in the wintertime and was present year-round in the
marine environment of Long Island Sound. As moisture and salt accumulated
between the pins, hangers, washers, and pin caps, the narrow gaps became
breeding grounds for corrosion.
The designers had foreseen this problem and equipped the bridge with a
drainage system that should have prevented storm runoff from ever touching
the pin-and-hanger assemblies. Because the deck surface was slightly crowned
and sloped longitudinally, stormwater flowed first outward and then along
the curbs, until it was captured by regularly spaced curb drains and routed
199
into drainpipes that emptied into the river. These curb drains ensured that
only a small proportion of the storm runoff could reach the expansion joints.
Any water that flowed through these joints was captured by a copper gutter
mounted beneath each expansion joint and channeled to another downspout.
This system was well designed, but it required frequent cleaning to keep the
drains and gutters from clogging with debris. This task fell to the Connecticut
Department of Transportation (ConnDOT), which was responsible for
bridge maintenance throughout the state. But because of repeated budget
cuts, ConnDOT found it increasingly difficult to fulfill this responsibility. In
1973, the department initiated a project to repave the Mianus River Bridge.
During this project, the curb drains were covered with steel plates, and the
deck was paved with asphalt. The drains were never uncovered. Thus, for
the next 10 years, 100% of the precipitation falling on a 10,000-square-
foot section of the deck flowed through the expansion joints, overflowed
the copper gutters, and poured onto the structural components below. The
gutters overflowed because they were too small to handle this increased flow
and were nearly always clogged with sand and debris.
Rust occupies more physical space than the steel from which it formed. If
rust accumulates within a confined space, it can exert thousands of pounds
per square inch in outward pressure. Thus, in the Mianus River Bridge, the
rust buildup in the gaps between the girders, washers, hangers, and pin caps
generated enough outward pressure to force the joint apart—a phenomenon
called corrosion pack-out. The investigators found that several of the steel
pin caps had dished outward by as much as an inch—even on pin-and-hanger
assemblies that hadn’t failed.
The Hypothesized
Failure Mechanism
Having determined that corrosion pack-out could easily push a hanger off its
supporting pin, the NTSB formulated a comprehensive failure hypothesis.
Over the years, the inside hanger at the southeast corner of the suspended
span was displaced about 1.25 inches by corrosion pack-out. At this point, the
stress on the narrow contact surface between the hanger and pin was so severe
that the steel yielded, the bolt fractured, and the hanger broke free. Instantly,
200
the tension in the outside hanger doubled. Immediately, the asymmetrical

loading on this hanger caused it to bend, and the suspended span dropped
and shifted sideways by about one-half inch.
Meanwhile, corrosion pack-out continued to force the outside hanger farther

outward on the upper pin. Eventually, the combined effects of concentrated
stress and cyclic loading caused a fatigue crack to form near the end of the
pin. Additional load cycles caused this crack to elongate until it fractured,
and the outside hanger broke free from the pin. With the loss of this second
hanger, the suspended span was now supported on only three corners. The
unsupported corner dropped a few inches, but the span still didn’t collapse.
Two trucks had crossed the bridge between midnight and 1:15 that morning,
and both drivers later reported having struck a diagonal bump in the roadway.
By 1:28 am, the sag of the suspended span had increased enough to be visible
from some distance away because the two tractor-trailers driving ahead of
Billy started braking before reaching the span. Once they were both on the
span, their combined weight overwhelmed the remaining pin-and-hanger
assembly. When it failed, the span fell.
Every aspect of the NTSB’s proposed failure sequence was consistent with all
the available evidence. Yet an engineering consultant hired by ConnDOT
advanced a competing failure hypothesis. Based on a three-dimensional
structural analysis, the consultant determined that the unusually large skew
of the structural system had subjected the pin-and-hanger assemblies to lateral
forces large enough to push a hanger off its pin.
Inquiry Results
If the cause was corrosion, the blame would fall on ConnDOT. But if the
structure collapsed because of its skewed configuration, the designer would
be primarily responsible. The ConnDOT consultant’s theory was plausible.
Consider a simplified model of a two-girder bridge. An applied load causes
both girders to bend equally. But if the bridge is skewed, the same loading
causes significantly more bending in one girder than in the other. The result
is a global twisting of the entire structural system. In a cantilever bridge, this
twist would cause significant lateral forces at the pin-and-hanger assemblies.
201
Ultimately, the NTSB dismissed this failure hypothesis and attributed the
collapse to “corrosion-induced forces, due to deficiencies in the State of
Connecticut’s bridge safety inspection and bridge maintenance program.”
The board acknowledged that the bridge’s skewed configuration had caused
unanticipated lateral forces that might have contributed to the collapse.
However, these forces weren’t large enough to have been its primary cause.
Nonetheless, the NTSB did find one significant design flaw in the bridge.
The pin caps meant to hold the hangers in place were only about half as
thick as the relevant code required. Thus, corrosion pack-out caused them
to deform excessively, which might have accelerated the failure. But the
board concluded that thicker pin caps wouldn’t have prevented the pin-
and-hanger assemblies from failing. The accumulating corrosion product
would eventually have broken the retaining bolt, even if the pin cap hadn’t
deformed. However, the thin pin caps’ large deformations could have
provided a visible indicator of the impending failure. Had the dished pin caps
been noticed during the state’s routine bridge inspections, the catastrophe
might have been averted.
ConnDOT
For two decades prior to the collapse, ConnDOT had inspected the Mianus
Bridge every two years, as required by the National Bridge Inspection
Standards. The most recent inspection was in September 1982. This 12-hour
inspection was performed by an experienced technician and a well-qualified
assistant—yet both failed to discern any condition that would have justified
closing the bridge or initiating emergency repairs.
As the NTSB report makes clear, the inspection was compromised by

inadequate access to the critical pin-and-hanger connections. The Mianus
Bridge was equipped with three catwalks mounted beneath the deck.
However, from these vantage points, the hangers that eventually failed could
only be inspected visually, from more than 20 feet away—too far for the
inspectors to detect corrosion pack-out behind the pin caps and hangers. To
inspect otherwise inaccessible bridge components, ConnDOT normally used
a truck-mounted hydraulic arm called a snooper. However, at the time of the
1982 inspection, ConnDOT’s only snooper was inoperable.
202
The NTSB also noted various ConnDOT management issues, including the
following:
` The allocation of 12 hours to inspect a 6-lane, 24-span bridge was

inadequate.
` ConnDOT’s system for allocating inspectors to high-priority bridges was

flawed.
` The department ignored national advisories about the unique

vulnerabilities of pin-and-hanger connections—and didn’t train inspectors
on these vulnerabilities.
` The engineers in charge of the inspection program exercised minimal

supervision—and didn’t follow up on inspection reports that identified
significant issues.
The two best ways to prevent a steel bridge from corroding are to keep it
clean and to give it a fresh coat of paint every few years. But, because of
budget shortfalls, the Mianus Bridge was neither washed nor painted for
many years prior to the collapse. Clearly, ConnDOT’s lack of funding
contributed substantially to the Mianus Bridge disaster. To a large extent, this
situation resulted from two questionable policy decisions. First, Connecticut
chose to charge tolls on this segment of I-95, making it ineligible for federal
maintenance funds. Second, Connecticut had decided not to set aside its toll
revenues exclusively for highway and bridge maintenance; rather, this money
went into the state’s general fund, where it was used for other purposes.
Lessons Learned
The disaster provided a wake-up call for the state of Connecticut—and for
the nation. The state embarked upon a 10-year, $5.5-billion program of
bridge inspection, maintenance, and rehabilitation. The cantilever spans
of the Mianus River Bridge were replaced with a continuous multi-girder
configuration that eliminated the problematic pin-and-hanger assemblies
while increasing structural redundancy. The state also removed its tolls
on I-95 and became eligible for more than $10 million per year in federal
maintenance funds. Additionally, Connecticut initiated an immediate retrofit
of more than 60 pin-and-hanger spans; other states implemented similar
203
programs. Meanwhile, the Federal Highway Administration instituted

substantially improved procedures for bridge inspections—including detailed
guidelines for inspecting pin-and-hanger assemblies.
In this case, a seemingly trivial change to the catwalk design could have
prevented a catastrophic collapse 25 years later by providing inspectors with
better access to the pin-and-hanger assemblies. From the perspective of civil
infrastructure, the case also reminds us that “you can pay me now or pay me
later.” In 1982, ConnDOT couldn’t afford to wash the pigeon dung off a
major interstate highway bridge. But a year later, the state legislature was eager
to spend $5.5 billion to prevent another failure like the one at Mianus River.
Reading
Balakrishna and Linzell, “Examination of Steel Pin and Hanger Options.”
National Transportation Safety Board, Highway Accident Report.
204
22
Decision-Making:
The Challenger
Disaster
This course now turns to a series of case
studies involving mechanical, aerospace,
electrical, and nuclear systems. Because
these systems are often developed and
operated by large organizations, these cases
provide new opportunities to explore the
complex relationships between organizational
decision-making and engineering failures.
This lesson focuses on the Challenger
disaster, which killed seven astronauts. Here,
you’ll learn that the disaster was as much a
failure of organizational decision-making as it
was an engineering failure.
205
22. Decision-Making: The Challenger Disaster
The Challenger Disaster

January 1986 was a pivotal time for the National Aeronautics and Space
Administration (NASA). It had ramped up its launch schedule from five missions
in 1984 to nine in 1985. By 1988, NASA’s four shuttles—Columbia, Challenger,
Discovery, and Atlantis—were expected to be flying 24 missions per year (2 per
month) through the end of the 20th century. But the Columbia mission designated
as STS-61C, originally scheduled for December 18, 1985, had been postponed
seven times before it finally launched from Kennedy Space Center on January 12,
1986. The next mission, STS-51L Challenger, was scheduled to launch on January
24. This flight attracted a large amount of attention because it inaugurated NASA’s
Teacher in Space Project. Crew member Christa McAuliffe, a social studies teacher
from Concord, New Hampshire, would be teaching several lessons from space.
206
But the unexpected launch postponements continued—on January 24, due

to high winds at an emergency landing site in Africa; on January 25, due to
poor weather at Kennedy; and on January 27, due to a stuck door handle. Just
as this problem was fixed, a cold front swept across eastern Florida, and the
accompanying high winds prompted yet another postponement. That night,
the local temperature plummeted to 18°F. Because the launchpad used large
quantities of sprayed water for sound suppression, there were concerns about
ice buildup on the pad and the shuttle. Throughout the night, ground crews
worked to remove as much ice as possible. On the morning of January 28,
NASA imposed a two-hour delay to allow the rising sun to finish the job.
The countdown then resumed—and at 11:38 am, STS-51L Challenger lifted

off, rolled onto its planned trajectory, and soared away. About 40 seconds into
the flight, Challenger’s main engines were throttled back to 65% as the vehicle
passed through the altitude at which maximum aerodynamic loading would
occur. As the engines were subsequently throttled back up to full power,
Mission Control informed the crew, “Challenger, go at throttle up.”
Mission Commander Dick Scobee’s response—“Roger, go at throttle up”—

was the final transmission received from STS-51L. One second later, the
vehicle broke apart. There were no survivors. Tragically, the underlying
engineering design flaw had been identified long before the first space shuttle
ever flew—and was well-understood at the time of Challenger’s launch.
The Space Transportation

System
Formally named the Space Transportation System (STS), the space shuttle
was developed as the successor to NASA’s Apollo program. The shuttle
program’s principal goal was to reduce the cost of space flight through the
development of a reusable launch vehicle comprising four major components:
` the orbiter, powered by three liquid-fueled main engines
` the external tank, which held 1.6 million pounds of liquid hydrogen and
liquid oxygen to power the orbiter’s engines
` two solid rocket boosters (SRBs), which supplied additional thrust

207
On a typical mission, the orbiter’s main engines and both SRBs were used to
propel the vehicle off the launchpad. After the SRBs expended most of their
propellant, they were jettisoned, returned to the earth by parachute, and
recovered for reuse. Then, about eight minutes into the flight, the orbiter’s
main engines were shut down, and the external tank was jettisoned. The
orbiter’s two small maneuvering engines were then fired to insert the vehicle
into orbit. Finally, upon completion of its mission, the orbiter reentered
Earth’s atmosphere and landed at either Kennedy Space Center, Florida, or
Edwards Air Force Base, California.
Although the shuttle design was based on detailed NASA specifications,

the system was built entirely by contractors—the orbiter by Rockwell
International, the main engines by Rocketdyne, the external tank by Martin
Marietta, the solid-rocket motors by Morton Thiokol, and the remaining SRB
components by United Space Boosters. Each SRB was 109 feet long, 12 feet
in diameter, and composed of
` the nose cap and frustum, which enclosed the booster’s parachutes;
` the forward skirt, which contained avionics;
` the aft skirt, which was bolted to the launchpad to hold the shuttle in
position as its engines were powered up prior to liftoff;
` the solid rocket motor, consisting of four cylindrical steel cases filled with
solid propellant; and
` a bell-shaped nozzle, which was integral with the motor’s aft segment.
The motor segments were fabricated at Thiokol’s factory in Utah. Then, they
were shipped by rail to the Vertical Assembly Building at Kennedy Space
Center, where they were stacked and connected together at three field joints.
These field joints connected the steel case segments together structurally and
prevented hot, high-pressure propellant gases from leaking out of the motor
during its two-minute burn. A failure of either function would likely cause a
catastrophic loss of the entire shuttle.
208
Field Joint Configuration

The field joint configuration was a tang-and-clevis connection. The bottom
edge of the upper case—the tang—was inserted into the U-shaped upper edge
of the lower case—the clevis—and locked in position with 177 steel pins. The
small gap between the tang and clevis was sealed with two O-rings, made
of heat-resistant synthetic rubber, which were mounted within two grooves
in the inner half of the clevis. The purpose of these O-rings was to prevent
propellant gas from leaking out of the motor. Each steel case segment was
insulated from the propellant by a thick rubber coating. At the field joint, the
gap in this insulation layer was filled with heat-resistant zinc chromate putty.
This provided a thermal barrier to protect the O-rings from the propellant
gases that would fill this open space between the case segments once the
rocket motor ignited.
The O-rings (and the grooves in which they were mounted) were designed to
provide a redundant pressure-actuated seal. When the rocket motor ignited,
the resulting internal pressure would be transmitted through the putty. Then,
it would force the primary O-ring across its groove and flatten it against the
groove’s downstream face. This would cause the O-ring to extrude into the
gap between the tang and clevis, creating a robust seal. The O-ring was also
sealed by this same internal pressure. If the primary O-ring failed to seal, the
secondary O-ring would seal by the same dynamic process.
Field Joint Issues

From the time it was designed in the early 1970s until the Challenger disaster
in 1986, this joint was plagued by increasingly serious problems. The first
problem surfaced in 1977 when Thiokol was conducting tests to verify
that the SRB’s steel case could withstand the internal pressure generated
by propellant combustion. In these tests, internal pressure caused a slight
outward ballooning of the SRB segment’s steel case. This deformation caused
the gap between the tang and clevis to open by a few hundredths of an inch.
This opening—called joint rotation—prevented the O-rings from sealing
reliably.
209
Both Thiokol and NASA ultimately concluded that this could be managed
by using slightly larger O-rings and inserting metal shims between the tang
and clevis to reduce joint rotation. Subsequent testing demonstrated that
the primary O-ring could be expected to seal within 0.2 seconds of ignition.
Maximum joint rotation didn’t occur until 0.6 seconds after ignition. As long
as the joint sealed before it rotated, the seal would be maintained. On this
basis, NASA approved Thiokol’s SRB design in 1980.
The first shuttle mission, STS-1 Columbia, launched in April 1981, and the
field joints performed well. But when Columbia flew again seven months later,
the post-flight examination of the recovered boosters revealed that one of the
primary O-rings had been partially burned through. This phenomenon—
called O-ring erosion—was eventually attributed to a jet of propellant gas
passing through a tiny blowhole in the zinc chromate putty and impinging
upon the primary O-ring. The blowhole had probably formed during the pre-
launch assembly process, when air was trapped within the putty as the rocket
motor segments were being joined.
Thiokol determined that the resulting risk was minimal. A gas jet capable
of causing O-ring erosion could occur only during the fraction of a second
between ignition and the establishment of a pressure seal. The jet wouldn’t
have enough energy to burn completely through an O-ring. Consistent with
this finding, three of the next nine shuttle missions experienced some O-ring
erosion, but the field joints functioned normally in all cases.
O-Ring Blow-By
In September 1984, the recovered boosters from STS-41D Discovery revealed
a phenomenon called O-ring blow-by. In one of the factory-assembled nozzle
joints, a small deposit of black soot was discovered between the primary and
secondary O-rings. This meant that the primary O-ring had initially failed to
seal and that hot propellant gases had blown by it. Fortunately, the secondary
O-ring had sealed properly and prevented a catastrophe. But had the same
incident occurred in a field joint, the delay in attaining a primary O-ring seal
might have allowed enough joint rotation to prevent the secondary O-ring
from sealing.
210
Both NASA and Thiokol recognized the dire implications of this new
problem. But there was a schedule to meet, and this blow-by seemed like
another manageable risk. Thus, the launches continued while Thiokol’s
engineers studied the problem. After three trouble-free missions, STS-51C
Discovery launched on January 24, 1985. In the post-flight examination of
the recovered boosters, one field joint in each SRB showed evidence of both
erosion and blow-by. This was the first instance of blow-by in a field joint,
the first time thermal distress had occurred in two different field joints on the
same flight, and the first occurrence of blow-by and joint erosion at the same
location.
After eliminating all other possibilities, the engineers determined that low
temperature was the culprit. This launch from the Kennedy Space Center
had been preceded by the coldest three-day period ever recorded in Florida.
At ignition, the O-ring temperature was estimated to have been 53°F—10°F
lower than on any previous launch. The low temperature had several adverse
effects on the field joint, but the most important was a significant reduction
in the O-ring’s resilience. During the launch, this loss of resilience slowed the
sealing process. This allowed hot propellant gases to blow past the primary
O-ring for such an extended period that a substantial portion of the O-ring
was burned away. Again, the secondary O-ring had prevented a disaster.
This O-ring distress didn’t provoke a decisive response by Thiokol or NASA

because the low temperature experienced during the launch was viewed as
a unique event. The next mission, STS-51D Discovery, launched at 67°F
and experienced no blow-by. However, a small group of Thiokol engineers
remained concerned. Led by Roger Boisjoly—Thiokol’s most knowledgeable
O-ring expert—this group continued working diligently to understand and
address these persistent O-ring issues.
Their concern was warranted. On the next flight, STS-51B Challenger, a

primary O-ring failed to seal, and its associated secondary O-ring experienced
significant erosion. Boisjoly immediately wrote to his boss, warning that the
situation demanded immediate action. Thiokol responded by establishing
an internal O-ring task force to conduct additional testing and ultimately
develop and implement a modified field joint design. Although this new
design had great promise, it was disapproved by NASA in September 1985
because of its cost.
211
The January 27 Teleconference

When Thiokol’s engineers learned that the
temperature at Kennedy Space Center would fall
to 18°F on January 27, 1986, and would climb
only to 28°F by launch time, they immediately
concluded that the launch had to be
postponed. They notified Allan McDonald,
Thiokol’s on-site representative at Kennedy
Space Center. He set up a conference call in
which the Thiokol engineers could present
their recommendation to the NASA program
managers from Marshall Space Flight Center.
Allan McDonald
The call began at 8:45 pm The key participants
from Marshall were Stan Reinartz, Larry Mulloy, and
George Hardy. Participants from the Thiokol plant in Utah
were engineers Roger Boisjoly, Arnie Thompson, and 11 other members of the
engineering staff; Bob Lund, vice president for engineering; and three other
corporate vice presidents—Joe Kilminster, Cal Wiggins, and Jerry Mason.
McDonald also joined the call.
Boisjoly and Thompson summarized the history of the SRB O-ring

problems, supplemented by recent test data showing the adverse effect of cold
temperatures on O-ring resilience. They emphasized that one year earlier,
STS-51C had experienced severe O-ring distress at 53°F and noted that the
next day’s launch temperature would be 25°F lower. Lund concluded the
presentation with Thiokol’s recommendation—that the launch of STS-51L be
delayed until the temperature reached 53°F.
Although reasonable, this recommendation provoked a harsh reaction from

NASA. Reinartz argued that it was inconsistent with the SRB’s design
specifications, which required an operating range of 40°F to 90°F. Mulloy
then asked Joe Kilminster for his recommendation. When Kilminster
supported his engineers’ position, Mulloy claimed the data were inconclusive
and ought not be used as the basis for postponing a launch. Reinartz then
demanded a response from Kilminster, who requested a five-minute offline
caucus to discuss the issue with the Thiokol team in private.
212
The caucus lasted more than half an hour. The teleconference then resumed,
and Kilminster stated that they’d decided the temperature effects were
inconclusive. Therefore, Thiokol recommended going ahead with the launch.
But this rationale made no sense. If the data were inconclusive, the effects of
low temperature were uncertain, which should have dictated a postponement.
But the NASA team approved the decision with no further discussion.
McDonald remained convinced that the launch should be postponed. As
Thiokol’s senior on-site representative, he would have been the appropriate
official to sign the launch recommendation, but he refused to do so. But
Kilminster had no such reservations. He faxed the signed document to
NASA, and the fate of Challenger was sealed.
Organizational Dysfunction
McDonald would later testify that NASA’s conduct during this teleconference
was out of character. In all previous launch decisions, NASA would
challenge a contractor’s recommendation to launch if there were unresolved
technical issues. But NASA had never previously challenged a contractor’s
recommendation not to launch. Evidently, there was pressure to maintain
NASA’s ambitious launch schedule. There’s also evidence that Marshall Space
Flight Center was suffering from a dysfunctional organizational culture, in
which senior management had come to view no-fly recommendations as
admissions of failure.
Moreover, Thiokol’s lucrative business with NASA was in jeopardy. Several

months earlier, Thiokol had negotiated a billion-dollar sole-source contract
to supply 66 solid-rocket motors for future launches. But days prior to the
Challenger launch, NASA had refused to sign this contract and announced
that Thiokol’s competitors would be invited to bid on future contracts.
Thiokol had made significant capital investments to expand its production
facilities in support of this new contract. Faced with such a severe blow to
their business, Thiokol management had decided that “the customer is always
right”—despite all evidence to the contrary.
213
Failure Investigation
No one saw it at the time, but films of the launch would later reveal puffs of
black smoke emerging from the aft field joint on the right SRB, within one
second after ignition. We now know that both O-rings in this joint had failed
to seal and were being incinerated by hot propellant gas streaming through
the joint. This failure should have caused an immediate explosion. But when
the hot gas contacted the cold steel of the field joint, molten aluminum oxide
in the gas solidified and temporarily sealed the joint.
This almost saved the Challenger. But at T+59 seconds, high-altitude

aerodynamic loads on the vehicle apparently caused this fragile seal to
fracture. At that instant, a tracking camera captured a plume of flame
emerging from the SRB’s aft field joint. The plume grew quickly. At T+72
seconds, it severed a strut that connected the booster to the external tank,
causing the SRB to pivot outward and collide with the tank. One second later,
a structural failure of the tank triggered a massive explosion. The explosion
sent the orbiter veering violently away from its planned trajectory—and the
resulting aerodynamic forces broke Challenger apart in midair.
President Reagan immediately established a presidential commission to

investigate the failure. During the commission’s second hearing, McDonald
interrupted the proceedings and exposed the truth about the pre-launch
teleconference. This opened the door to subsequent testimony by Boisjoly and
other Thiokol engineers—without whom the commission could never have
achieved its most important findings:
` The Challenger disaster was caused by an SRB O-ring failure resulting

from fundamental flaws in the field joint design.
` The low temperature at launch time contributed substantially to the

failure.
` NASA’s organizational culture and decision-making processes were deeply

flawed and had also contributed to the failure.
214
Lessons Learned
After the Challenger accident, NASA’s entire shuttle fleet was grounded for
nearly three years, McDonald led a Thiokol team that redesigned the SRB
with robust triple-O-ring joints that enabled the shuttle program to resume,
and NASA implemented improvements to its decision-making processes.
Unfortunately, a similarly flawed decision led to the loss of Columbia during
reentry on February 1, 2003.
Although the Challenger disaster involved a significant engineering

design error, its most fundamental cause was a failure of organizational
decision-making. Evidently, NASA’s long string of successful launches had
engendered a growing sense of complacency among key decision-makers.
This complacency led to overly ambitious goals. Over time, the fact that
previous O-ring problems hadn’t caused a mission failure became the implicit
justification for accepting ever greater levels of risk.
Reading
McDonald, Truth, Lies, and O-Rings.
Rogers, et al., Report to the President by the Presidential Commission on the
Space Shuttle Challenger Accident.
215
23
Nuclear Meltdown:
Chernobyl
The Chernobyl disaster, the world’s worst
nuclear accident, was a complex, multifaceted
event. This lesson focuses primarily on its
scientific and engineering aspects. However,
you’ll also see that this technological
catastrophe was profoundly influenced by
human and organizational failures. As this
case study shows, the design flaws in the
RBMK nuclear reactor that led to the disaster
were the product of a dysfunctional Soviet
bureaucracy that was willing to prioritize low
cost, military utility, and propaganda ahead of
public safety.
216
23. Nuclear Meltdown: Chernobyl
Chernobyl
In the 1970s, the Soviet Union developed a major nuclear power complex near
Chernobyl. Construction of the Vladimir Ilyich Lenin Nuclear Power Station
began in 1972, and by 1986, four 1,000-megawatt RBMK reactor units were
in operation and two more under construction. At the time of its design, the
RBMK nuclear reactor dwarfed its Western counterparts in both physical
size and power output and could also produce weapons-grade plutonium for
nuclear warheads. The Soviet nuclear establishment had serious concerns
about the design. But even after two RBMKs experienced partial meltdowns,
the reactor’s design flaws were concealed even from the power plant operators
and managers. The cost of this secrecy became apparent on April 26, 1986,
when Chernobyl reactor number 4 exploded during a routine safety test.
Although the explosion killed only two workers, hundreds of plant personnel,
firefighters, and residents of nearby Pripyat were exposed to intense radiation—
and 28 died of acute radiation poisoning within weeks. Ultimately, 40,000
square miles were contaminated by radioactive fallout, and thousands of cancer
cases were attributed to its effects. The area within a 30-kilometer radius of the
Chernobyl plant was declared unfit for human habitation.
217
Nuclear Physics
The word nuclear refers to the nucleus—the center of an atom, composed
of positively charged particles called protons and uncharged particles called
neutrons. The number of protons in an atomic nucleus defines what that
element is. For example, the nucleus of a hydrogen atom always has one
proton. But the number of neutrons in a given element’s atomic nucleus can
vary. The most common form of carbon has 6 neutrons, but alternative forms
can have 2 to 16. These alternative forms of the same element are called
isotopes. An isotope is identified by its atomic mass number, which equals
the number of protons plus the number of neutrons in the nucleus. Thus, the
uranium isotope with 92 protons and 143 neutrons is uranium-235 (U-235).
An isotope can be stable or unstable. Those that have too many or too few neutrons
must emit particles to attain a more stable form—and thus are unstable. This
process of emitting particles is known as radioactive decay. The rate at which an
unstable isotope undergoes radioactive decay is its half-life, defined as the time
required for half of a quantity of the substance to decay into a different element.
Radioactive decay is one type of nuclear reaction. The others are fusion and
fission. Nuclear fission occurs when one atom splits into two or more pieces,
called fission products. When an atom splits, the total mass of the fission
products is slightly less than the mass of the original atom because a tiny bit
of mass has been converted into energy. The amount of energy associated with
this lost mass is substantial—the mass times the speed of light squared. This
energy is the basis for nuclear power.
The fuel used to generate nuclear power must be a fissile material, or a material
capable of self-sustaining fission, such as U-235. When the nucleus of a U-235
atom is struck by a neutron, it breaks apart, releases energy, and emits several
free neutrons. If there are other U-235 atoms nearby, the neutrons emitted
by one nucleus can strike adjacent nuclei, causing them to become unstable,
split apart, release energy, and emit more neutrons. As this process repeats
itself, progressively more free neutrons cause the fission of progressively more
nuclei. The resulting chain reaction is self-sustaining nuclear fission, which can
provide an abundant source of usable energy if properly controlled. The most
fundamental aspect of controlling nuclear fission is controlling the number of
free neutrons available to sustain the nuclear chain reaction.
218
Controlled Fission
To achieve controlled fission, a nuclear reactor must have nuclear fuel, coolant,
control rods, and a moderator. Nuclear fuel is prepared by molding uranium into
small pellets, which are sealed inside a tube made of zirconium. Large numbers
of these fuel rods are loaded into the reactor core in sufficiently close proximity
for self-sustaining fission to occur. The resulting heat would quickly melt the fuel
rods if not for the coolant—usually water. It is continuously circulated through
the reactor core to remove heat and transfer the associated thermal energy to
turbogenerators that convert thermal energy into electrical power.
The fission reaction is controlled by movable control rods made of a neutron-

absorbing material, such as boron. When a control rod is inserted into the reactor
core, it absorbs free neutrons, reducing the number of neutrons available to
sustain fission. This decreases reactivity. As the reactivity decreases, the reactor
power output also decreases. Conversely, when a control rod is withdrawn, fewer
neutrons are absorbed; thus, reactivity and power increase. In an emergency, all
control rods can be inserted simultaneously to stop the fission reaction completely.
This emergency response—called a scram—can be initiated automatically (by
the reactor’s computer control system) or manually (by a human operator).
Finally, the moderator is a substance that surrounds the fuel rods and facilitates
self-sustaining fission by slowing down neutrons. Moderation is necessary because
the fission of U-235 emits neutrons at such high speeds that they can’t be captured
by other uranium nuclei. This is why neutrons emitted by fission must be slowed
down. The moderator performs this function through elastic collisions between
fast-moving neutrons and the nuclei of the moderator atoms. This process is most
effective if the moderator’s atomic mass is comparable to that of a neutron.
Consider an elastic collision between a neutron and a moderator nucleus

with the same mass. The collision stops the neutron, indicating that the
moderator is effective. But if the moderator atom is significantly heavier than
the neutron, the neutron rebounds with little loss of speed—indicating that
the heavier moderator atom is ineffective. Therefore, the ideal moderator
is hydrogen because its atomic mass of 1 is nearly identical to the mass of a
neutron. A user-friendly source of hydrogen is readily available in ordinary
water, which has two hydrogen atoms in each molecule. This is one reason
most nuclear power reactors are moderated with water. Another reason is that
219
such reactors can use a single water circulation system for both moderation
and cooling. Water-cooled, water-moderated reactors are safe in the sense
that any accident involving a catastrophic loss of coolant will also remove the
moderator from the reactor core—and stop the fission process instantly.
Note that the purpose of the moderator is to slow down the motion of
neutrons and therefore increase reactivity. Thus, the moderator doesn’t
moderate nuclear fission; it promotes nuclear fission by moderating neutrons.
Unfortunately, water has a relatively high tendency to absorb neutrons,
which reduces reactivity. In a water-moderated reactor, even as the water
enables fission by slowing down neutrons, it also inhibits fission by absorbing
neutrons. Thus, water-moderated reactors can’t use natural uranium for fuel.
Alternative Moderators
Natural uranium is primarily a mixture of two isotopes. Fissile U-235 constitutes
less than 1% of this mixture, and the remainder is mostly U-238, a non-fissile
isotope. In a water-moderated reactor, this small proportion of U-235 can’t supply
enough free neutrons to offset neutron absorption by the water. Thus, water-
moderated reactors must be fueled with enriched uranium, processed to increase
its proportion of U-235, which is expensive. Thus, to facilitate the use of cheaper
natural uranium, two alternative moderators are also in common use.
The first is heavy water. Each hydrogen atom in a heavy water molecule
has one proton and one neutron in its nucleus. That is, heavy water uses the
hydrogen isotope H-2. Because of these added neutrons, heavy water is about
500 times less likely than ordinary water to absorb free neutrons. Thus,
heavy-water reactors can use natural uranium fuel and avoid the high cost of
enrichment. Unfortunately, producing heavy water is itself quite expensive.
The other alternative moderator, and the one the Soviets chose for the RBMK
reactor, is graphite. A crystalline form of pure carbon, graphite has a larger
atomic mass than hydrogen and provides less effective moderation than
water. However, it is less expensive than heavy water, and its tendency to
absorb neutrons is much lower than that of ordinary water. Thus, a graphite-
moderated reactor can run on natural (or slightly enriched) uranium fuel,
220
which also facilitates the production of weapons-grade plutonium. This

was a major factor in the Soviets’ decision to use graphite moderation in the
RBMKs; however, it also created a major vulnerability.
The RBMK’s Design

The RBMK’s core comprises graphite blocks, each measuring 10 inches
square by 24 inches high and pierced by a vertical hole. These blocks are
stacked into 26-foot-tall columns capped with steel fittings on the top and
bottom and bundled into a 46-foot-diameter cylinder. Within this cylinder,
nearly 2,000 zirconium alloy tubes—called channels—are mounted in the
vertical holes in the graphite blocks. Overall, 1,661 of these channels hold the
uranium fuel rods, while 211 are for the control rods. The core is surrounded
by a multilayered radiation shield, comprising a steel shell and a double-walled
steel vessel filled with water. The top and bottom shields are concrete-filled
steel disks incorporating vertical pipe segments that allow the channels
to extend through the shields (to be connected to the cooling system). At
Chernobyl, the 2,000-ton upper shield was named the pyatachok.
The reactor vessel is mounted on steel supports at the bottom of a concrete-

walled pit, which is filled with sand for additional radiation protection.
The reactor pit lies at the heart of a concrete-framed reactor building.
This building also houses the reactor cooling system, consisting of two
independent circuits that circulate water through the core whenever the
reactor is operating. Each circuit is equipped with four electric pumps—three
for normal operations and one for backup. They pressurize the circuit at about
1,000 psi. These pumps move the coolant water into a horizontal header
pipe, where it’s distributed through more than 900 parallel feeder pipes that
connect to the channels running vertically through the core.
As the water flows upward through these channels, it’s heated by the fissioning
fuel rods. Near the top of the core, the water starts boiling. The resulting mixture
of high-pressure steam and hot water then flows through another maze of 900
pipes to two steam separators—large cylindrical drums in which the steam rises
to the top and the water collects at the bottom. The water is piped down to the
main pumps to complete the cooling circuit. The high-pressure steam is fed to the
adjacent machine hall, where it drives a pair of turbogenerators—each comprising
a three-stage steam turbine spinning an electrical generator. The total electrical
221
power output from these generators is 1,000 megawatts. However, because of

inherent inefficiencies in the energy conversion process, the reactor must produce
3,200 megawatts of thermal power to achieve this output.
After passing through the turbines, the spent steam is collected in

condensers, where it’s cooled and restored to the liquid state. This water is
then pumped to deaerators—which remove dissolved gases—and back to the
steam separators, where it’s returned to the cooling circuit.
Three Fatal Flaws

The RBMK’s design had three fundamental flaws that contributed substantially
to the Chernobyl disaster. The first flaw was the lack of a containment vessel
to prevent radioactive material from being released during an accident. In the
RBMK, containment was sacrificed for a device that could replace individual
fuel rods without having to shut down the reactor. This refueling machine
greatly improved operational efficiency but also occupied a vast space above
the reactor. Enclosing this space within a containment vessel would have been
enormously expensive, if not impossible. Thus, the Soviet authorities simply
declared that the RBMK was inherently safe and didn’t require containment.
The second flaw resulted from the RBMK designers’ decision to use graphite
moderation. The elevation at which the reactor’s coolant begins boiling is
controlled by the pressure in the cooling circuit and the temperature of the
water entering the core. If the pressure gets too low or the water temperature
gets too high, boiling can begin at a lower elevation. Because steam absorbs
fewer neutrons than water, this premature boiling causes decreased neutron
absorption and increased reactivity. Higher reactivity generates more heat,
which causes more boiling, more neutron absorption, and even higher
reactivity. This can quickly provoke an uncontrollable spike in reactor power.
This is the principal reason Western engineers considered graphite moderation
too dangerous and opted for water instead. When water changes to steam,
it becomes ineffective as a moderator; thus, the unexpected formation of
steam reduces reactivity. In a graphite-moderated reactor, steam increases
reactivity—and too much can easily trigger a power spike.
222
The RBMK’s third design flaw was its control rod configuration. The rods were
made of boron carbide, which has a strong tendency to absorb neutrons. But
the lower end of each rod was extended with an open sleeve and a 15-foot-long
cylinder of graphite. This extension—called a displacer—was configured such
that the graphite segment was centered within the reactor when the control rod
was fully withdrawn. Without it, whenever a control rod was withdrawn, its
channel would fill with water, reducing the rod’s effectiveness. The displacer
addressed this issue by replacing most of the water in the channel with graphite.
Because graphite enhances reactivity, the displacer ensured that withdrawing a
control rod would achieve the largest possible effect.
When a control rod is inserted, reactivity is supposed to decrease as the

neutron-absorbing boron enters the core. But in the RBMK, as the displacer
moved downward, the displacement of the water by graphite caused a brief
but significant increase in reactivity at the bottom of the reactor. On April 26,
1986, when more than 200 control rods were simultaneously inserted into the
core of Chernobyl reactor number 4, the effect was catastrophic.
Emergency Reactor Shutdown

When a nuclear reactor is shut down, its cooling system must continue to
operate for many hours because the radioactive decay of fission products
continues to generate substantial residual heat even after nuclear fission has
stopped. But a shut-down reactor can’t generate electricity. Its coolant pumps
must be powered either by the power plant’s other reactors or by the local
electrical grid. If a natural disaster triggered an emergency shutdown of the
entire power plant and a simultaneous outage of the local grid, the reactor cores
would quickly melt down. To address this contingency, the RBMK designers
provided each reactor with three diesel-powered generators. These could
produce enough electricity to run the pumps in an emergency. But the time
required for them to start up and attain full power was about 50 seconds—more
than enough time for the reactor’s residual heat to do serious damage.
The Soviet nuclear authorities proposed a possible solution. Immediately

following an emergency reactor shutdown, the turbines would continue
spinning for a short period of time. Their momentum might generate
enough power to keep the pumps running until the diesel generators kicked
in. An experimental procedure had been developed to test this hypothesis;
223
however, the first three attempts to run the test failed. The fourth attempt
was scheduled for 2:15 pm on April 25, 1986, in conjunction with a planned
maintenance shutdown of Chernobyl reactor number 4.
The Fourth Test Attempt

First, the reactor power would be gradually reduced from 3,200 megawatts to
700 megawatts—enough to keep one turbogenerator running at normal speed.
Then, with this generator supplying power to four of the eight coolant pumps,
the steam supply to the turbine would be manually cut off. As the generator
stopped, its ability to power these four pumps would be measured. Meanwhile,
the other four pumps would receive steady power from the grid to ensure that
the reactor received adequate cooling throughout the test. Once the generator’s
performance had been measured, the shutdown would be completed as planned.
The test protocol also required the operators to disable the Emergency Core
Cooling System (ECCS). When activated, it would dump thousands of gallons
of cold water from a storage tank directly into the core. Because the safety test
might inadvertently trigger the ECCS, the system had to be manually disabled.
Implementation of the test protocol began around 1:00 am on April 25. Over the
next 12 hours, the reactor operators reduced power by half, then shut down one
of the two turbogenerators. At 2:00 pm, they disabled the ECCS. But minutes
before the scheduled shutdown, the regional grid controller in Kiev requested a
delay. The test resumed after 11:00 pm, but within an hour, it was interrupted
again by the midnight shift change at Chernobyl. The newly arrived reactor
operator was Leonid Toptunov, who had served in this position for only three
months. His shift supervisor was Aleksandr Akimov, a mechanical engineer whose
prior experience at Chernobyl had been with turbines, not reactors. And the senior
man was Anatoly Dyatlov, Chernobyl’s deputy chief engineer. Dyatlov’s only prior
nuclear experience had been with the small reactors on nuclear submarines.
The Iodine Pit

Shortly after midnight, Toptunov brought the reactor power down to 700
megawatts. But then the power suddenly plummeted to 30 megawatts.
Reactor number 4 had “fallen into the iodine pit.”
224
A fission product of U-235 is iodine-135, an

unstable isotope. Iodine-135 decays into
xenon-135, which is regarded as “reactor
poison.” If xenon-135 accumulates in a
reactor core, it will quickly absorb enough
free neutrons to choke the fission reaction.
Fortunately, one xenon-135 atom can capture
only one neutron, at which point it becomes
xenon-136—a stable isotope that doesn’t
absorb neutrons. Thus, a reactor running at
steady high power can produce enough excess
neutrons to destroy xenon-135 at the
same rate it’s being created, and reactor
power can be held steady. Aleksandr Akimov
But when an operator reduces reactor

power, creation of iodine-135 declines too. However, because of iodine-135’s
6.6-hour half-life, xenon-135 is still being produced by radioactive decay at a
high rate for several hours after the power reduction. The result is a buildup of
xenon-135, which can kill reactivity and cause reactor power to plummet. This
phenomenon—the iodine pit—is what happened to reactor number 4. Once
reactivity has fallen to such an abnormally low level, the fission process can’t
produce enough free neutrons to burn off the reactor poison. The only safe solution
is to shut the reactor down and wait for the accumulated xenon-135 to decay away.
Resuming the Test

Recognizing what had happened, Dyatlov demanded the power be restored to
700 megawatts so that the test could be resumed. Under duress, Akimov and
Toptunov began withdrawing control rods but could only get the poisoned
reactor up to 200 megawatts. However, test preparations continued. Just after
1:00 am, with six circulation pumps operating normally, the two backup
pumps were switched on. This had two adverse consequences:
` First, with all eight pumps now operating, the increased coolant pressure
reduced the steam formation in the fuel channels. This caused reactivity to
decrease, forcing the operators to withdraw even more control rods to keep
the power level steady.
225
` Second, the increased rate of coolant flow caused the temperature of the
water entering the reactor core to rise. The faster-moving water now had
less opportunity to lose heat as it flowed through the cooling circuit.
These unintended effects placed the reactor into a dangerously unstable state.
The operators struggled to maintain the coolant flow and steam pressure
within acceptable limits. To ensure that these fluctuations didn’t trigger an
automatic reactor scram, they disabled another emergency shutdown system.
By now, more than 200 of the 211 control rods had been fully withdrawn
from the core, which prompted the computer control system to recommend
an immediate shutdown. At this point, the reactor was still producing only
200 megawatts, and the test was guaranteed to fail. But Dyatlov directed his
subordinates to initiate the final phase.
The Reactor Explosion

At 1:23 am, the operators shut off steam flow to the single operating
turbogenerator. As the four pumps powered by this generator slowed, the
decreasing coolant pressure caused more steam to form in the fuel channels.
As the coolant temperature was already abnormally high, the water at the
bottom of the reactor core began boiling. The resulting increase in reactivity
generated more heat, steam, and reactivity. The increased reactivity quickly
burned off the xenon-135, accelerating the power spike. At some point, one of
the operators hit the button to initiate an emergency shutdown.
This response might have saved the day if not for the flawed control rod
design. As the 200-plus control rods started downward, they displaced the
neutron-absorbing water at the bottom of the channels, causing a significant
spike in reactivity. Reactor power was now more than 30,000 megawatts and
climbing. Overheated fuel rod and control rod channels started rupturing,
and the control rods jammed before most of the neutron-absorbing boron
entered the core. Less than a minute later, a steam explosion blew the
pyatachok through the roof of the reactor building, severing all coolant pipes.
The remaining coolant instantly flashed to steam, and the core got even
hotter. Seconds later, a more powerful explosion blew the reactor apart.
226
This latter blast dispersed the nuclear fuel, terminated the fission reaction, and
ejected immense quantities of uranium, fission products, and graphite into the air.
Within the ruined reactor pit, the heat generated by the continuing radioactive
decay started a fire so intense that it could only be extinguished by helicopters
dropping thousands of tons of sand, lead, and boron directly into the pit. Because
the RBMK had no containment vessel, the smoke billowing from this inferno
spread radioactive contamination across the continent for two weeks.
Radiation claimed the lives of Toptunov, Akimov, and several other members
of the Chernobyl operating staff. Dyatlov suffered from radiation effects but
survived. He was subsequently tried, convicted, and imprisoned by the Soviet
authorities for failure to follow regulations, although he repeatedly claimed
that the explosion had been caused entirely by the flawed design of the
RBMK reactor and thus was the fault of the Soviet nuclear establishment.
The RBMK design was indeed flawed, and these flaws were indeed the
product of a dysfunctional Soviet bureaucracy that was willing to prioritize
low cost, military utility, and propaganda ahead of public safety. But the
RBMK’s design flaws only created vulnerabilities. It was Dyatlov who pushed
reactor number 4 into the dangerously unstable state that caused these
vulnerabilities to become the world’s worst nuclear accident. A stubborn,
narrow-minded authoritarian, Dyatlov was very much a reflection of the
bureaucracy he served—so in this sense, there was some truth to his claim
that the Chernobyl disaster was a failure of the Soviet system.
Reading
International Nuclear Safety Advisory Group, INSAG-7.
Mahaffey, Atomic Accidents.
Plokhy, Chernobyl.
227
24
Blowout:
Deepwater
Horizon
Welcome to this analysis of the Macondo
blowout—one of the most devastating
engineering failures of the 21st century
and the worst environmental disaster in
US history. As this case study shows, the
disaster was caused by corporate decisions
that prioritized profits over well-established
safety procedures, engineering judgment, and
the laws of physics. This lesson explores the
technological system used to drill an offshore
well like Macondo and then discusses the
various issues that led to the blowout.
228
24. Blowout: Deepwater Horizon
The Macondo Blowout

Offshore drilling rig Deepwater Horizon was owned by Transocean, a
drilling contractor, and leased to BP to conduct oil exploration in the Gulf
of Mexico. For 10 weeks, the Horizon had been drilling an exploratory well
into a geological formation named the Macondo Prospect, located 13,000
feet below the seafloor, in 5,000 feet of water. BP’s geologists had estimated
that Macondo held 60 million barrels of hydrocarbons—oil and natural
gas. This exploratory well would determine whether the hydrocarbons were
down there. If so, Macondo would be secured, temporarily abandoned, and
later reactivated as a production well. After various difficulties, the Horizon
successfully drilled into a substantial oil-bearing stratum.
On the evening of April 20, 2010, the Horizon’s crew was engaged in
securing the well, transferring leftover drilling fluid to their support vessel,
and preparing for their next job at the Kaskida Prospect. But at 9:45 pm,
crew members felt a sharp jolt and noticed an inexplicable shower of seawater
falling onto the rig floor. Nearly an hour earlier, three miles below the
rig, highly compressed liquid hydrocarbons had started leaking from the
surrounding rock formation, through a recently installed cement seal, and
into the bottom of
the well shaft. As this
volatile liquid moved
upward through the
shaft, the resulting
decrease in pressure
allowed dissolved
methane to start
boiling out of the
liquid. Now a free
gas, the methane
expanded violently
upward, pushing a
column of seawater
and drilling fluid
ahead of it. The
229
resulting uplift force jolted the entire rig. But only when crew members saw
the geyser of drilling fluid jetting above the derrick did they finally realize
that a massive blowout was underway.
Seconds later, methane blanketed the rig. Two massive explosions then knocked
out power and engulfed the rig in a 300-foot fireball. After burning for 36
hours, the Horizon capsized, sank, and ruptured the mile-long pipe that
connected the rig to the well—initiating the world’s largest marine oil spill. The
well wasn’t successfully sealed until September 19, 86 days after the blowout. By
then, Macondo had discharged more than 200 million gallons of oil.
230
Drill System Design

The drill is a toothed steel bit attached to the lower end of the drill pipe, which
is a hollow steel shaft comprising 30-foot segments screwed together at their
ends. The drill pipe is rotated by an electric motor called the top drive. This
is suspended from the derrick. During drilling operations, the top drive moves
downward, along with the drill. When the apparatus reaches the rig’s operating
deck, or drill floor, the drill pipe is temporarily clamped in position; the top
drive is disconnected and hauled back to the top of the derrick. New segments
of pipe are then added to the string, and drilling resumes.
Below the rig, the drill pipe is enclosed within a segmented pipe called the
riser. The bottom of the riser is attached by a flexible joint to the blowout
preventer (BOP). The BOP is mounted on a steel fixture called the wellhead,
which is supported on a structural foundation composed of three concentric
large-diameter steel pipes—called casing—sealed with cement. The drill pipe
is lowered through the wellhead. As it grinds through virgin rock, it creates a
hole called the wellbore.
Whenever the drill is in operation, drilling fluid—commonly called drilling

mud—is continuously pumped from storage pits in the rig, down through
the drill pipe, out through the bit, and back up through the annulus—the
ring-shaped space between the drill pipe and the wellbore. The mud continues
flowing upward through the BOP and the riser and back to the rig, where
it’s cleaned and returned to the mud pits for reuse. Thus, during drilling
operations, the well is filled with mud.
Drilling Mud
The drilling mud used at Macondo was a synthetic oil mixed with varying
quantities of barite—a powdered mineral used to control the mixture’s
density. Drilling mud lubricates the bit, carries the rock cuttings out of the
wellbore, and serves as an essential tool for well control. Any fluid held
within a container exerts outward pressure on the container. At any given
point, the magnitude of this hydrostatic pressure is equal to the density of the
fluid times the depth of that point below the surface of the fluid.
231
Consider a hypothetical exploratory well located at the Macondo site. Here,

the drill floor is 5,067 feet above the seafloor. The pay zone—an oil-bearing
stratum of sandstone—is 18,000 feet below the drill floor. The hydrocarbons
trapped within it are subjected to approximately 13,000 psi of pressure. The
hypothetical well is a uniform-diameter wellbore, running from the wellhead
down to the pay zone. If mud with a density of 100 pounds per cubic foot
is used for drilling, the hydrostatic pressure exerted at the pay zone by this
18,000-foot column of mud is 100 pounds per cubic foot times 18,000 feet.
This equals 1.8 million pounds per square foot, which converts to 12,500 psi.
Fluid naturally flows from higher to lower pressure; thus, the 13,000-psi
hydrocarbons will flow into the 12,500-psi wellbore when the bit encounters
the pay zone. This well is said to be underbalanced. The flow of hydrocarbons
into an underbalanced well is called a kick. If a kick isn’t detected and brought
under control, the hydrocarbons will flow at ever-increasing speed upward
through the well. When an uncontrolled kick reaches the surface, it becomes a
blowout. Using the formation pressure to assist with bringing hydrocarbons up
to the surface is the job of the production well—which is established after the
exploratory well has been completed.
To address the vulnerability associated with drilling an underbalanced well,

let’s increase the mud density from 100 to 110 pounds per cubic foot by
adding more barite to the mixture. Now the hydrostatic pressure at the pay
zone is 110 times 18,000, which equals 13,750 psi. Because this pressure
exceeds the formation pressure, the well is now overbalanced—and no longer
vulnerable to kicks from the oil-bearing formation.
Controlling Kicks
Because the geology of a well site is always uncertain, kicks can’t always be
prevented. The principal tool for controlling kicks is the BOP—a vertical
stack of controllable barriers individually operated from the drilling rig’s
control room. Only two of the Deepwater Horizon’s BOP barriers are
relevant here:
` First, the annular preventer uses a hydraulically actuated expandable

rubber “donut” to close off the annulus without affecting the drill pipe.
232
` Second, the blind shear ram uses a hydraulically powered blade to slice
through the drill pipe and disconnect the riser from the wellhead. By
closing off the annulus and pinching the lower portion of the drill pipe
shut, the ram also seals the well.
During drilling, kicks are detected by monitoring the circulation of mud

through the well. The quantity of mud flowing out of the riser must always
match the quantity being pumped into the drill pipe. If outflow ever exceeds
inflow, it means fluid is entering the well from below—a sure sign of a kick.
In response, the operator closes the BOP’s annular preventer and pumps
higher-density mud into the well through a pipe called the kill line, which is
fastened to the outside of the riser. This heavier mud restores the overbalanced
condition and stops the kick.
However, the use of dense mud as a tool for well control is subject to an
important limitation. Every type of rock has a characteristic pressure at which
it will fracture. In our hypothetical Macondo well, a fragile stratum with a
fracture strength of 5,000 psi is located at a depth of 8,000 feet. At this depth,
our 110-pound-per-cubic-foot mud exerts a hydrostatic pressure of more than
6,000 psi—more than enough to fracture the rock. This would cause large
quantities of mud to flow into the fractured formation rather than returning
to the rig. These lost returns present a major challenge.
Lost Returns
Operators attempt to minimize lost returns by pumping a viscous substance
called lost circulation material (LCM) into the well to plug the fractured
rock. However, a more effective approach is to keep the mud density low
enough that its hydrostatic pressure won’t damage fragile formations. In our
hypothetical well, a reduction in mud density sufficient to prevent fracturing
at 8,000 feet would also cause the well to be dangerously underbalanced
down at 18,000 feet. The solution is to drill the well in intervals and use steel
casing and cement to isolate the intervals from each other. This strategy was
reflected in BP’s design for the Macondo well. The well would be drilled in
four intervals (below the wellhead foundation)—with a smaller-diameter
wellbore and casing at each successively lower level.
233
The first interval extends down to a depth of 8,983 feet—just beyond

that fragile rock stratum. Here, the lower-density mud required to prevent
fracturing should be heavy enough to prevent kicks from unanticipated
hydrocarbon deposits. Once this interval has been drilled, the wellbore is
reinforced with 18-inch-diameter steel casing—installed with its upper end
suspended from the 22-inch casing above and its lower end sealed into the
wellbore via cementing. This cement has chemical additives that control
its density, curing time, strength, and flow properties. It is more fluid than
normal concrete because it must be pumped to great depths.
In the cementing process, a rubber plug is inserted into the casing, followed
by a carefully calculated quantity of cement and a second plug. This
“package” must be pumped down through the casing—with the plugs above
and below the cement protecting it from contamination. At the bottom
of the casing, the lower plug collides with a float collar, which ruptures a
membrane in the lower plug. This creates an opening that allows the cement
to flow through the float collar, down into the shoe track at the bottom of
the casing, and back up into the annulus.
When the pumping stops, a one-way valve in the float collar prevents
backflow up into the casing, and the cement is allowed to harden. This seals
the bottom of the casing into the bore hole. The casing will now protect any
fragile rock strata located within this entire interval. Thus, higher-density
mud can be used to drill subsequent intervals. The lower-level intervals are
constructed in the same way but with progressively smaller casing diameters.
Therefore, each new string of casing can be lowered through the one above
it. The final element of this design is the production casing, which forms
a continuous conduit through which oil will flow upward in the future
production well.
Deepwater Horizon
Built in 2001 by Hyundai, the Horizon was classified as a dynamically
positioned semisubmersible rig.
` The term dynamically positioned means the rig can maintain its position
over a well using only its own thrusters, guided by a computer system that
receives input from GPS satellites, sensors, and gyrocompasses.
234
` The term semisubmersible indicates that the rig floats on variably ballasted
pontoons, which can change the rig’s elevation with respect to sea level.
On the Horizon, four heavy columns extended up from these pontoons to the
business end of the rig—the derrick and top drive; the drill floor and control
room; storage racks for the drill pipe, riser, and casing; two large cranes; a
helipad; and the captain’s bridge. Below the main deck were the mud pits, a
cement plant, pumps, crew accommodations, and six diesel engines driving
electrical generators that powered the rig.
Drilling Struggles
The Horizon arrived at Macondo in January 2010, and after several days of
preparations, lowered its BOP and 5,000-foot riser to the seafloor and latched
up with the previously installed wellhead. On April 9, after many difficulties,
drilling was halted at a depth of 18,360 feet. The design had called for a final
depth of 19,650 feet—but in the final interval, the sandstone pay zone was so
fragile that the heavy mud required to prevent kicks was disappearing into the
porous formation.
Lost returns ultimately cost BP more than 500,000 gallons of expensive

mud and significant quantities of LCM, and unanticipated kicks disrupted
progress. Thus, two unplanned casing intervals had to be added, and the
resulting reduction in the bottom casing diameter dictated the use of an
unorthodox tapered production casing. BP planned only to temporarily
abandon the well. It wasn’t willing to forego the cost savings expected from
Macondo’s later reactivation as a production well.
As the Horizon’s crew prepared to install the production casing, BP engineers

were still struggling to design the final cement job that would seal the bottom
of this casing to the wellbore—and provide the principal barrier against
hydrocarbons entering the well after its abandonment. The high pressure
required to pump cement up into the annulus of the production casing
would fracture the fragile rock in the pay zone. The engineers decided to
use a special lightweight foamed cement, with tiny bubbles of nitrogen gas
entrained into the mix to reduce its density. But foamed cement is weaker
than normal cement. Thus, the cement job was designed as a three-layer
composite with
235
` a cap of normal-weight cement at the top of the annulus,
` lightweight cement sealing the interface with the pay zone,
` and another normal-weight cap sealing the bottom of the annulus and the
shoe track.
Consistent with this plan, on April 19, precise quantities of these cements
were pumped into the well—and an equal quantity of mud emerged from
the riser. Because there were no lost returns, it was clear that the pumping
pressure hadn’t caused any fracturing in the pay zone. BP’s two onboard
representatives—the Company Men—concluded that the cement job had
been successful and directed that the temporary abandonment should
proceed. But the lack of lost returns didn’t guarantee that the cement
job had no voids or defects. This determination could only be made by
lowering a sensitive sonic instrument into the well to scan for voids in the
cement. However, this would have been expensive, and the Company Men
shortsightedly decided it was unnecessary. Today, there’s broad agreement that
flaws in this cement job permitted hydrocarbons to enter the well, initiating a
chain of events that ended in catastrophe.
Cement Flaws
First, upon the completion of drilling, the 56-foot space at the bottom of
the wellbore was full of mud less dense than normal-weight cement. During
cementing, some of the heavier cement would have sunk down into this space,
while the lighter mud rose up to replace it. The intermingling of cement and
mud created channels through the hardened cement. This could have been
avoided by pumping extra-heavy mud into the bottom of the wellbore prior to
the cementing operation.
Second, experts testified that nitrogen-based foamed cement is chemically

incompatible with the oil-based mud used at Macondo. When these two
products intermingled, the oil in the mud caused the nitrogen bubbles to
collapse, creating additional voids in the cement. Third, evidence suggests
that the float collar at the bottom of the production casing was improperly
installed. The one-way valve that should have prevented upward flow into
the well was stuck in the open position. The overall result was a cement job
236
riddled with possible pathways for hydrocarbons to leak into the well. On
April 20, there were numerous squandered opportunities for BP and the
Horizon’s crew to discern the well’s vulnerability and take corrective action.
The Temporary
Abandonment Procedure
As designed, the temporary abandonment procedure would include the
following four tasks:
1 checking the well for leaks by conducting positive and negative

pressure tests
2 setting a cement plug near the top of the well
3 removing the mud from the riser by displacing it with seawater
4 disconnecting the BOP from the wellhead, then hauling the BOP and
riser aboard the rig
The first task began with a successful positive pressure test. The BOP was closed,
and the production casing was pressurized to 2,700 psi. When the pressure held
steady for 30 minutes, it was clear that the production casing had no leaks. Thus,
BP’s Company Men tried to cancel the planned negative pressure test—but were
overruled by the Horizon’s senior drilling manager. A positive pressure test can
verify that the casing is leak-free. However, it doesn’t test the cement job because
the bottom of the casing is already sealed from the inside by rubber plugs.
The cement job can only be leak-checked with a negative pressure test. This
procedure simulates the hydrostatic conditions the well will experience after
abandonment, when removal of the mud-filled riser will also remove the
beneficial effect of the mud’s weight. First, the drill pipe is pumped full of
seawater, displacing the heavier mud down to the elevation where the final
cement plug will be installed. Next, the BOP’s annular preventer is closed to
seal off the riser’s mud-filled annulus. The pumps are shut off, and the top of
the drill pipe is opened. As the column of fluid adjusts to its new equilibrium
state, a small amount of seawater should be discharged from the top of the
drill pipe—then, all flow should stop.
237
At this point, the hydrostatic pressure throughout the well is identical to the
pressure it will feel after the riser has been disconnected—when the entire
8,000-foot space above the top plug is occupied by seawater. Under these
conditions, the well is significantly underbalanced. Its sole defense against a
kick is the cement seal at the bottom of the production casing. Thus, if there’s
no additional outflow from the top of the open drill pipe, the cement must be
providing an effective barrier, with no leaks.
The Negative Test

At Macondo, there were problems with the negative test. First, as preparations
were under way, one of the Company Men directed that a large quantity of
leftover LCM be inserted into the drill pipe as a spacer between the mud and the
seawater. This was a cynical attempt to bypass federal environmental regulations,
which prohibit the disposal of unused LCM at sea. Then, during the first attempt
at executing the negative test, the BOP operator didn’t apply enough closing
pressure on the annular preventer. This caused a large quantity of mud (and
LCM) in the annulus to leak down past the BOP after the pumps were stopped.
After this false start, the closing pressure was increased, the mud in the riser
was topped off, and the test was repeated. This time, the annular preventer
held. But when the drill pipe was opened, seawater flowed continuously
from it, even though the flow should have stopped after a few gallons. Then,
when the drill pipe was valved shut, its internal pressure rose to 1,400 psi
even though it should have remained at 0 psi. The underbalance induced by
the negative test had clearly allowed hydrocarbons to start flowing into the
well. Yet the Company Men and drilling supervisors declared these results
“anomalous” and decided to repeat the test.
Because the drill pipe was still valved shut (and experiencing a 1,400-psi pressure),
they decided to use the kill line for this second attempt. This was a legitimate
decision, as the kill line and drill pipe run parallel to each other and should be
hydrostatically identical under the test conditions. With the kill line pumped full
of seawater, the BOP closed, and the pumps stopped, there was no flow from the
opened kill line. Based on this result, the negative pressure test was proclaimed
a success. But because the kill line and drill pipe were interconnected and
measuring the same column of fluid, it would be physically impossible for one line
to be open and experiencing zero flow while the other was closed and experiencing
238
1,400 psi. The kill line must have been blocked at its connection to the BOP,
most likely by the LCM. Clearly, this second attempt had produced an anomalous
result; yet no one attempted to reconcile these conflicting results.
The Final Kick

With testing complete, the next logical step in the abandonment process
would have been to set the upper cement plug. This plug would provide a
redundant barrier against hydrocarbons flowing up through the well when
displacing mud from the riser. But BP decided to perform the displacement
before setting the plug. Once the pumped seawater had replaced the heavier
mud in approximately two-thirds of the riser, Macondo passed the tipping
point from overbalanced to underbalanced, and the final kick began.
As soon as hydrocarbons began flowing into the well, the quantity of mud
flowing out of the riser would have increased noticeably—which should have
prompted the operator to close the BOP and reassess the situation. But the
increased flow went unnoticed. In their haste to finish the job, the crew had
started transferring the Horizon’s stockpile of mud from the rig to the support
vessel—and no one was tracking the outflow. The kick became evident only
when the methane arrived at the drill floor. Shortly after the explosions, crew
members attempted an emergency disconnect by activating the BOP’s blind
shear ram. The ram closed partially but failed to sever the drill pipe—the
upward force of the blowout had buckled the pipe inside the BOP.
Yet, even if the ram had operated perfectly, the Horizon was already doomed. At
that moment, there were 63,000 gallons of hydrocarbons in the riser, above the
BOP, flowing upward to feed the inferno. The blowout was caused by flawed
design decisions, careless oversights, and deliberate procedural shortcuts. The
BOP malfunction was only the final link in a long, ugly chain of events.
Reading
Boebert and Blossom, Deepwater Horizon.
Shroder and Konrad, Fire on the Horizon.
Turley, From the Podium.
239
25
Corporate
Culture: The
Boeing 737 MAX
This case study considers the troubled
history of the world’s most controversial
airliner—the Boeing 737 MAX. A few years
ago, within months of each other, two 737
MAX flights, one in Indonesia and one in
Ethiopia, inexplicably dove into the ground,
killing everyone on board. This lesson primarily
focuses on the former flight, Lion Air Flight
610. Here, you will explore the conception of
the 737 MAX and discover the circumstances
that led to the aforementioned tragedies.
240
25. Corporate Culture: The Boeing 737 MAX
The Lion Air Flight Crash

At 6:20 am on October 29, 2018, Lion Air Flight 610 lifted off from
Soekarno-Hatta International Airport in Jakarta, Indonesia, for a routine
flight across the Java Sea to Pangkalpinang. The weather was clear, and the
captain and first officer were both experienced pilots. The aircraft was a
brand-new Boeing 737 MAX. About two minutes into the flight, as the jet
was approaching an altitude of 2,000 feet, the first officer contacted Jakarta
air traffic control and requested a holding point due to an unspecified “flight
control problem.” The controller approved a hold at 5,000 feet.
After climbing normally for a few more seconds, the aircraft abruptly entered
a violent 700-foot dive but then recovered and resumed its ascent. At 5,000
feet, it leveled off but began erratic altitude changes. Although the first officer
requested to return to the airport, the aircraft continued its erratic flight path
and never turned back toward Jakarta. Soon after, it disappeared from radar.
Seconds later, workers on an offshore oil rig saw the jet hit the water in a near-
vertical dive.
241
The crash was tentatively attributed to a sensor failure and a flaw in the
airplane’s flight control system. Boeing and the US Federal Aviation
Administration (FAA) issued worldwide advisories describing a simple
procedure pilots should use if a similar sensor failure occurred. But five
months later, another 737 MAX crashed under similar circumstances. Six
minutes after a normal takeoff from Addis Ababa, Ethiopian Airlines Flight
302 began flying erratically and then dove into the ground at 600 miles per
hour. Within a week, the entire 737 MAX fleet was grounded indefinitely.
Boeing 737
The original Boeing 737 was conceived in 1964 in response to market
demand for a small twin-engine jet. Because Boeing’s main domestic
competitor was already producing the twin-engine DC-9, Boeing engineers
sought to distinguish the 737 through three innovative design features:
` First, the 737 would use the same cabin cross section as the 707 and 727,
allowing all three models to use many of the same parts while providing
more seating capacity.
` Second, the engines would be mounted on the wings, providing increased

cabin space, better access, and less interior noise.
` Third, the engines would be positioned close to the ground for ease of
engine maintenance.
The 737 program was formally launched in 1965. The original model, the 737-
100, was completed in 1966 and type-certified by the FAA the following year. But
Boeing was already developing a new “stretched” version in response to a request
from United Airlines for more seating capacity. This 737-200 was 76 inches longer
and could seat up to 130 passengers—27 more than the Dash-100.
Over the next 30 years, this process of design evolution continued with three
new generations of 737s—the Classic, Next Generation (NG), and MAX. Each
generation included three to five individual models or variants. Improvements
such as a longer range and larger seating capacity were enabled by enhanced
aerodynamic features and advances in the power and fuel efficiency of jet
engines developed during this period. The engines used on the Dash-900
produce more than twice as much thrust as their Dash-100 ancestors.
242
The Engine Problem

The more powerful late-model engines are also substantially larger. The
engine used on all modern commercial airliners is called a turbofan. It
combines a turbine, which generates power, and a ducted fan, which produces
most of the engine’s thrust. This trend toward larger engines has presented
an increasing challenge for the Boeing engineers. In the 1965 design, the
engines were positioned close to the ground to facilitate maintenance. But by
the 1980s, the larger engines required to achieve competitive performance
wouldn’t fit between the wing and the ground.
Lengthening the landing gear wouldn’t solve the problem. The main landing
gear was mounted on the wings and had to retract inward. If the landing
gear legs were any longer, the wheels would interfere with each other in the
retracted position. The landing gear couldn’t be repositioned farther outward
because the engines were in the way. And the engines couldn’t be repositioned
outward without a major structural redesign of the wings. The engineers’ only
243
recourse was to shift the engines forward—ahead of the wings—and upward.

The engine enclosures also had to be flattened on the bottom to provide
adequate ground clearance.
Boeing’s Rival
Because airlines invest heavily in maintenance infrastructure and pilot
training systems, they prefer to buy airplanes that retain a high degree of
commonality with existing fleets. Thus, a variant that uses many of the same
parts as its predecessor and has similar flight characteristics is often preferred
over a new type. More importantly, the process of attaining an FAA-type
certification for a variant of a previously certified type is simpler and quicker.
Thus, aircraft manufacturers have a strong regulatory incentive to update
their existing models.
Boeing’s need for frequent product improvements has also been driven by
intense competition with its principal European rival, Airbus. Airbus built its
first airliner, the A300, in 1972 and slowly gained market share. The A300
and A310 were wide-body airplanes that competed with larger Boeing models
like the 767. But in 1982, Airbus announced that it would design a new 150-
seat jet—the A320—aimed directly at the 737. Boeing was already working
on the 737-300 and didn’t expect the A320 to be a serious competitive threat.
In 1986, Northwest Airlines—previously an exclusive Boeing customer—

ordered 100 A320s. By this time, the A320 was regarded as a masterpiece of
aeronautical engineering. Boeing responded with the 737NG—a conventional
update that achieved enough performance improvements to convince most
Boeing customers not to abandon the brand. Nonetheless, the A320 continued
to gain market share and, in 2002, surpassed the 737 in annual deliveries.
Then, in late 2010, Airbus launched a major update—the A320neo—with two

new high-efficiency turbofans that would improve the A320’s fuel efficiency
by 15% to 20%. This made the A320neo the world’s fastest-selling commercial
aircraft. In February 2011, CEO Jim McNerney announced that Boeing
would take on the A320neo by developing an entirely new airplane rather than
attempting to re-engine the 737 again. But several airlines stated that waiting
for a new airplane might not be possible. Then, in July, American Airlines
forced Boeing’s hand by ordering 460 new jets—including 100 re-engined 737s
244
that Boeing hadn’t even committed to developing. Boeing had to move forward
with a new generation of 737s—called the 737 MAX—which would use the
same high-efficiency CFM LEAP engine as the A320neo.
Stalling
Boeing quickly designed the 737 MAX but was hindered by the challenge of
fitting modern engines to a nearly five-decade-old airframe. The CFM LEAP
engine had a 14% larger fan diameter than the engine used in the earlier
737NG. Thus, the engines had to be repositioned even farther forward and
upward. Nonetheless, Boeing predicted that the MAX would equal or exceed
the A320neo’s range while improving upon its fuel efficiency by about 4%.
Flight testing began in January 2016. However, because of its repositioned
engines, the aircraft exhibited unexpected performance characteristics when
flying at a high angle of attack with the wing flaps retracted.
The purpose of the wing is to produce an upward force, called lift, which
supports the airplane’s weight while in flight. The angle of attack is the angle
between the wing and the oncoming air. As the angle of attack increases, lift
also increases—but only to a point. Every wing has a characteristic angle of
attack at which an aerodynamic stall occurs. A stall is a sudden loss of lift
that occurs when an excessive angle of attack causes the airflow to separate
from the wing’s upper surface. When a wing stalls, it stops flying.
Commercial aircraft are equipped with a stall warning system, which receives
input from two angle-of-attack sensors, mounted on the airplane’s nose.
The sensors operate independently to provide redundancy. If both sensors are
working properly, both stall warnings occur simultaneously. An airplane’s
susceptibility to stalling can be controlled with flaps—movable panels along
the wing’s aft edge. When the flaps are extended, they increase the wing’s
curvature and area, allowing the airplane to fly more slowly without stalling.
Flaps are typically extended during takeoff and landing but retracted during
normal flight.
During 737 MAX flight testing, at high angles of attack and with the flaps
retracted, the aircraft tended to pitch upward to a greater degree than the
737NG. This placed Boeing’s plan for expedited certification of the 737
MAX at risk. Under the FAA rules, expedited certification is permissible
245
only if a modified aircraft exhibits the same flight characteristics as its

type-certified predecessor. The 737 MAX didn’t meet this standard because
its behavior at high angles of attack was different from that of the 737NG.
Boeing decided that this could be inexpensively addressed with a modification
to the airplane’s flight control system—the Maneuvering Characteristics
Augmentation System (MCAS).
Aircraft Control
An airplane in flight can rotate in any of three directions—pitch, roll, and
yaw. In Boeing airliners, the pilots control the airplane’s pitch by moving a
control yoke forward or backward. The yoke moves the elevators—hinged
surfaces mounted on the aft side of a winglike element called the horizontal
stabilizer. A rearward pull on the yoke raises the elevators, forcing the tail
downward and causing a climb. A forward push on the yoke lowers the
elevators, which raises the tail and causes a dive.
The elevators are typically used for short-term changes in pitch—for example,
during takeoff. But if the elevators are used to maintain a constant rate
of ascent or descent for a long period of time, the pilot must apply steady
pressure on the control yoke—which can be quite fatiguing. Thus, long-term
pitch adjustments are typically made by repositioning the entire horizontal
stabilizer. This is called trimming, and it has the same aerodynamic effect as
moving the elevators but doesn’t require any pressure on the control yoke.
Boeing 737 pilots can trim the airplane in either of two ways—with a thumb
switch located on each control yoke and with large manual trim wheels. The
thumb switches activate powerful electric motors that move the horizontal
stabilizer to the desired position. The manual trim wheels achieve the same
effect through a direct mechanical linkage. However, the electric trim-
control system is susceptible to runaway trim, which can occur if an electrical
malfunction activates a trim motor without input from the pilot. This causes a
sudden, unexpected climb or dive. Given this danger, all aircraft are equipped
with cutout switches that will instantly disable the electric trim motors. Pilots
are trained to use these switches immediately in the event of a runaway trim—
and then to use the manual trim wheels for subsequent pitch adjustments.
246
The MCAS
The MCAS receives its input from the same angle-of-attack sensors that
support the stall warning system. In the original MCAS implementation, any
time either sensor measured an excessive angle of attack while the flaps were
retracted and the autopilot was disengaged, the MCAS would command an
automatic 10-second application of nose-down trim. This would counteract
the 737 MAX’s tendency to pitch upward as it approached a stall—and
achieve the desired equivalence with the 737NG.
The 737 MAX entered service in May 2017. During the following year,
130 were delivered to 28 customers. But then the Lion Air and Ethiopian
Airlines accidents occurred. Given the erratic flight path that preceded both
crashes, investigators and Boeing engineers suspected the MCAS. Information
obtained from the flight data recorders and cockpit voice recorders confirmed
this suspicion. In both incidents, a malfunctioning angle-of-attack sensor
had erroneously signaled an excessive angle of attack to the airplane’s flight
control computer. The MCAS then activated, causing repeated applications
of nose-down trim, which the pilots were unable to overcome. Post-accident
investigations confirmed that the system was deficient in three main respects:
` First, the logic of the MCAS software allowed input from either of the two
angle-of-attack sensors to activate the system. Thus, a malfunction of a
single sensor could cause the system to activate erroneously.
` Second, the system logic allowed for repetitive MCAS activations. Thus,
even though the pilots regained control after the initial MCAS activation,
the system relentlessly reasserted control in response to continuing inputs
from the faulty sensor.
` Third, in support of its marketing strategy to emphasize the commonality

between the 737 MAX and NG, Boeing had decided not to mention the
MCAS in the 737 MAX flight manuals or training materials. Thus, the
pilots weren’t even aware that the MCAS existed.
Boeing had justified this decision to the FAA by claiming that the MCAS
was an internal element of the airplane’s flight control system; thus, pilots
didn’t need to know about it. More importantly, if the MCAS ever activated
247
erroneously, the behavior of the system would be indistinguishable from

a runaway trim incident. The well-established response to a runaway trim
would also disable the MCAS and allow the pilots to regain control.
The Lion Air 610 Crash’s

Sequence of Events
On October 27, 2018, a Lion Air maintenance crew in Bali replaced an angle-
of-attack sensor on the ill-fated 737 MAX. The sensor was a used device that
had been rebuilt and returned to service—but was out of calibration by 20
degrees. The next day, this airplane was used for a routine flight from Bali
to Jakarta. Immediately after takeoff, the captain received a stall warning.
Because the aircraft obviously wasn’t stalling, he recognized that the left
angle-of-attack sensor was malfunctioning. He transferred control to the first
officer, and the airplane continued ascending normally.
Throughout this period, the faulty angle-of-attack sensor was sending

erroneous input to the flight control system, but the MCAS didn’t activate
because the flaps were still extended. But as the aircraft approached its
cruising altitude, the pilots retracted the flaps. The MCAS kicked in—
applying a 10-second burst of nose-down trim and causing the aircraft to
pitch violently downward. The first officer used his trim switches and elevator
controls in a battle against repeated MCAS activations. Finally, another pilot
on board concluded that they were experiencing a runaway trim incident and
suggested using the cutout switches to disable the trim motors. The problem
was immediately resolved, and the pilots completed the flight normally using
their manual trim controls. Upon arrival at Jakarta, the captain reported
instrumentation problems but didn’t record anything about the runaway trim
in his logbook. The maintenance crew made perfunctory adjustments but
didn’t do anything to address the malfunctioning angle-of-attack sensor.
The next morning, Captain Suneja took command of the aircraft for the
flight to Pangkalpinang. Immediately after takeoff, the faulty sensor triggered
a stall warning, but neither pilot recognized the cause. The first officer,
Harvino, requested a holding point at 5,000 feet to diagnose the problem. As
the aircraft climbed past 2,000 feet, Harvino retracted the flaps, triggering a
248
burst of nose-down trim from the MCAS. Suneja reasoned that retracting the
flaps had initiated the problem—and ordered Harvino to extend the flaps.
This disabled the MCAS and allowed the pilots to regain control.
Instead of returning to Jakarta, they continued climbing to 5,000 feet and

then, inexplicably, retracted the flaps—again triggering the MCAS. For the
next five minutes, Suneja fought off at least 20 successive applications of nose-
down trim. Eventually, Suneja became so physically fatigued that he passed
control to Harvino. At any time, either pilot could have ended the crisis by
flipping the cutout switches to disable the trim motors—or even by extending
the flaps. Ultimately, Harvino gave up the fight, and Flight 610 entered its
terminal dive.
Resulting Conclusions
Based on this sequence of events, three main conclusions can be drawn. First,
Boeing’s claim that pilots had no need to know about the MCAS was false.
Ignorance of the MCAS clearly contributed to the pilots’ flawed response to
the crisis. Second, although Boeing’s implementation of the MCAS is often
criticized for its lack of redundancy, this isn’t precisely correct. The system
logic was designed such that if one angle-of-attack sensor had stopped sending
data, the MCAS would continue operating normally based on input from the
second sensor. In this sense, the MCAS was redundant—with respect to false
negative inputs.
But this logic also caused the MCAS to be nonredundant regarding false
positive inputs. If either sensor provided erroneous input indicating an
excessively high angle of attack, the MCAS would activate. Thus, Boeing
provided the wrong sort of redundancy. An MCAS failure due to false negative
input would cause a slight change in the airplane’s performance characteristics,
but an MCAS failure due to false positive input caused the system to seize
control of the aircraft and fly it into the ground. Clearly, the MCAS should
have been programmed to respond only when both sensors agreed.
Third, pilot error played an important role in the 737 MAX debacle.
Aviation writer William Langewiesche has argued that any well-trained
pilot should have been able to respond effectively to the circumstances that
caused the crashes. He stated that the pilots’ confusion and repeated failures
249
reflect deficiencies in their training. Many rapidly growing airlines in the

developing world are meeting their ever-increasing demand for pilots through
assembly-line training programs that emphasize rote learning and adherence
to standard procedures at the expense of critical judgment and airmanship.
This systemic problem—he claims—is what brought down the 737 MAX.
But the design of a complex system must account for the human operators’
capabilities. Boeing sells thousands of airplanes to developing-world airlines
and must be familiar with their training programs and pilot proficiency. Yet
the MCAS design was grounded in an underlying assumption that all 737
MAX pilots would perceive an MCAS failure as a routine incident of runaway
trim and respond accordingly.
Aftermath
After the crashes, Boeing fixed the MCAS relatively quickly, and the MAX
was finally recertified in November 2020. But more than 100 airplanes
worldwide still had to be repaired, tested, and returned to service; flight crews
required additional training; the production line had to be restarted; and an
inventory of 400 aircraft had to be cleared—all during a global pandemic.
Meanwhile, Boeing was charged with fraud and ordered to pay $2.5 billion
in criminal penalties and damages. Moreover, 1,200 737 MAX orders were
canceled, and the company posted its largest-ever annual loss for 2020.
Boeing’s future in the commercial aircraft industry may depend on its

willingness to return to its engineering roots. Until the late 1990s, Boeing was
an engineering company that focused on building high-quality airplanes. But
then this engineering-focused culture began to change.
` In 1997, Boeing acquired McDonnell Douglas to become the world’s

largest integrated aerospace company—and adopted much of Douglas’s
business-oriented corporate culture.
` In 2001, Boeing relocated its corporate headquarters from Seattle—where

the airplanes were designed and built—to a Chicago skyscraper.
` In 2005, Boeing hired a CEO and several other senior executives with no
background in engineering or aviation.
250
The Boeing 737 MAX crisis began with this strategic shift in focus—
from building great airplanes to cutting costs and increasing share price.
Prioritizing the corporate bottom line over technological excellence proved
disastrous.
Reading
Langewiesche, “What Really Brought Down the Boeing 737 Max?”
Robinson, Flying Blind.
Simons, Boeing 737.
251
26
Learning from
Failure: Hurricane
Katrina
Welcome to the final lesson of this course—a
case study that tries to find cause for hope
despite unimaginable tragedy. The flooding
of New Orleans during Hurricane Katrina
on August 29, 2005, was the costliest
engineering failure in American history and
involved systematic failures by the US Army
Corps of Engineers. Yet the lessons learned
from this tragedy led to a paradigm shift from
controlling nature to accommodating nature,
providing an excellent example of learning
from failure.
252
26. Learning from Failure: Hurricane Katrina
Hurricane Katrina
When Katrina’s storm surge poured through the floodwalls of the New
Orleans hurricane protection system, 80% of the city was inundated. More
than 1,000 people died. Tens of thousands more waited for a promised
evacuation that took six days to complete.
The flooding caused $70 billion in property
damage. And although President George
W. Bush had declared a state of emergency
two days before Katrina made landfall,
the federal disaster response was slow and
poorly managed. Katrina caused so much
devastation that two years later, New
Orleans’ population was still only about half
of its pre-storm level.
Hurricane Katrina was a natural event that

became a disaster only when it came into
contact with humans and human-built
infrastructure along the Gulf Coast. Before
the hurricane was a 300-year saga of human
efforts to reshape the natural landscape of
southern Louisiana in pursuit of economic
development—in a way that significantly
increased the disaster’s severity.
The Importance of Alluvial Soil

As a river flows, the moving water scoops up soil particles from the riverbed
and carries them along as sediment. In general, the faster the water moves, the
more sediment it can carry. Thus, whenever sediment-laden water slows down,
its capacity to carry sediment is reduced, and some of this material settles
out. This deposited sediment is called alluvium or alluvial soil—and it often
creates distinctive landforms.
253
Consider a piece of sandy coastal terrain, with high ground that gradually
slopes down to the ocean. Water percolates down through the sand, picking
up sediment along the way, and emerges as a sediment-laden river. The river
initially flows at a relatively high speed but slows down as it reaches the
flatter ground along the coastline. It stops entirely as it flows out into the
ocean. Soon, two distinctive landforms begin to emerge. First, as particles
of relatively coarse alluvium are deposited along the riverbanks, they create
low ridges, or natural levees. Second, as the entire flow slows down near the
ocean, a large quantity of alluvium accumulates near the river mouth. This is
the beginning of a delta. As this alluvium piles up, it increasingly restricts the
river’s flow. Eventually, when the volume of flow is high, the river will break
out of its channel to find a less-restricted path to the sea. This new channel
is called a distributary. This process eventually creates a fan-shaped web of
distributaries that constitute one lobe of a delta.
Between these distributaries are low-lying areas called wetlands. Because

wetlands are underlain by thick layers of loose, fine-grained alluvium, they’re
constantly subsiding as the soil consolidates. But whenever the river floods,
sediment-laden floodwater overflows the natural levees and deposits a new
layer of alluvium onto the adjacent wetlands. Thus, there’s a natural balance
between subsidence and deposition. This keeps the ground elevation relatively
constant as long as periodic flooding continues to replenish the soil.
But as alluvium deposition continues at the river mouth, the delta lobe
extends progressively farther into the ocean. This causes a continual reduction
in the channel’s slope. Eventually, the slope becomes so shallow that during a
flood event, the river abandons its main channel and finds a shorter, steeper
path to the sea. This new channel starts building a new delta lobe, while the
old lobe gradually subsides beneath the sea. In the Mississippi River Delta,
this dynamic process over the past 5,000 years created the bays, estuaries,
barrier islands, and wetlands of the Louisiana coastline. It also built up the
strata of alluvial sand, silt, clay, and organic marsh soil on which New Orleans
was built.
254
Building New Orleans

New Orleans was established in 1718 as a port on the Mississippi River. The
original settlement—the French Quarter of the modern city—was built
atop a natural levee along the river’s north bank. About five miles north of
the river is Lake Pontchartrain—a large, shallow estuary connected to the
Gulf of Mexico through the Rigolets Strait and Lake Borgne. At the time of
New Orleans’ founding, the ground between the natural levee and lakeshore
was a wetland. It was interrupted only by the Metairie and Gentilly Ridges,
remnants of a natural levee created by a former distributary of the Mississippi.
From the city’s earliest days, the natural levee was only about 10 feet above sea
level, and the Metairie and Gentilly Ridges were only 3 to 4 feet higher than
the surrounding swampland—which was essentially at sea level. The wetland
was drained by a network of slow-moving bayous, which flowed generally
northward into the lake.
The city was built more than 100 miles upriver from the mouth of the
Mississippi on the Gulf of Mexico because this location was better suited
for waterborne commerce. Goods shipped down the Mississippi could be
offloaded at New Orleans, hauled overland to Bayou St. John, and shipped
across Lakes Pontchartrain and Borgne to the Gulf. From here, ships could
sail to other Gulf ports behind the barrier islands, protected from storms.
This route was so advantageous that it would later be extended, deepened, and
named the Gulf Intracoastal Waterway.
Storm Surge
If New Orleans had been located at the mouth of the Mississippi, the sailing
route to the eastern Gulf ports would have been longer and more treacherous.
More importantly, if the city had been located on the coast, it would have
been extremely vulnerable to hurricanes. The most dangerous aspect of a
hurricane is its storm surge. As a hurricane moves across a body of water, its
counterclockwise winds cause water to pile up ahead of the storm. The storm’s
low atmospheric pressure raises the water level even further. The resulting
water surge resembles an abnormally high tide, which can exceed 20 feet
255
above sea level in a large Gulf Coast hurricane. In low-lying regions like the
Mississippi Delta, a surge of this magnitude can reach far inland, swallowing
everything in its path.
Because New Orleans was built on a natural levee only about 10 feet above
sea level, the city was theoretically vulnerable to large storm surges from the
Gulf. In practice, however, it enjoyed an effective natural form of storm surge
protection—its surrounding wetlands. Experts estimate that a one-mile-wide
band of cypress trees can reduce the height of a storm surge by about one
foot. In the 18th century, the 40-mile expanse of delta lowlands between New
Orleans and the Gulf Coast was a vast cypress swamp. During the 18th and
19th centuries, the only significant storm surges experienced by New Orleans
were from Lake Pontchartrain. These were effectively attenuated by the
cypress swamps and low ridges between the lake and the city. But by the 20th
century, the city’s vulnerability to hurricane-induced flooding had increased
significantly due to three major infrastructure development initiatives.
The Mississippi River Gulf Outlet

The first was a long-term program of canal building intended to enhance
New Orleans’ shipping connection to the Gulf Intracoastal Waterway. This
program began in 1794, when the Carondelet Canal was dug to connect the
headwaters of Bayou St. John to the city. In the 1830s, a parallel waterway,
the New Basin Canal, was constructed to enhance the growing city’s access
to Lake Pontchartrain. During this era, the newly invented steamboat
greatly increased river-borne commerce. After the Civil War, however, the
city’s prominence declined, as larger ships required the better access offered
by other Gulf ports. This trend was accelerated by the construction of the
Houston Ship Channel.
In 1918, New Orleans built the Industrial Canal, which provided the
first direct connection between Lake Pontchartrain and the Mississippi
River. It also served as an inner harbor for the city. The elevation of Lake
Pontchartrain is about one foot above sea level, while the river’s elevation is
significantly higher and more variable. Thus, the Industrial Canal required
a large lock to accommodate the elevation change between these two bodies
of water. With its completion in 1923, the Industrial Canal became part of
the Gulf Intracoastal Waterway. Its use by oceangoing ships was initially
256
constrained by the need to maintain a dredged channel through the shallow

Lake Pontchartrain. But during World War II, a new channel was dredged
from Lake Borgne directly into the Industrial Canal.
For decades, the city’s business leaders had been advocating for a canal
connecting the Port of New Orleans directly to the Gulf. Louisiana’s political
leaders lobbied for its construction by the Corps of Engineers, using federal
funds. In 1936, the Corps rejected this proposal as economically unjustified.
However, after World War II, a revised benefit-cost analysis convinced both
Congress and the Corps that the project should proceed. The resulting
waterway was named the Mississippi River Gulf Outlet (MRGO).
The MRGO was completed in 1968, despite fierce opposition from

environmental groups, Louisiana’s Wildlife and Fisheries Commission,
and residents of the county through which the canal would be built. These
opponents argued that dredging a canal through this ecologically fragile
region would provoke an environmental catastrophe. Moreover, the combined
influence of the MRGO and Intracoastal Waterway could increase the
region’s vulnerability to storm-induced flooding.
Wetland Loss
The second infrastructure initiative that increased New Orleans’ vulnerability
was the hardening of the Mississippi River channel. In 1927, prolonged heavy
rainfall caused a destructive flood of the Mississippi. Congress responded
by directing the Corps of Engineers to construct an expanded system
of enhanced artificial levees and channel improvements along the lower
Mississippi River. In succeeding years, this system was generally successful at
reducing flood damage, but it also substantially altered the natural processes
associated with delta formation.
By preventing flooding, the higher, hardened artificial levees also prevented

the deposition of alluvium onto the coastal wetlands. Thus, the natural
equilibrium between subsidence and deposition was lost. Many wetlands are
now sinking into the Gulf. This process has been greatly accelerated by the
extraction of oil and natural gas throughout the region. In addition to its
adverse environmental effects, this steady loss of coastal wetlands is seriously
degrading the natural buffer against hurricane-induced storm surges.
257
Northward Expansion
The third initiative that increased New Orleans’ vulnerability was the city’s
northward expansion. In the mid-19th century, yellow fever outbreaks
prompted the city to initiate a long-term program of increasingly sophisticated
drainage improvements. The 17th Street, Orleans, and London Avenue
Canals were excavated to facilitate the flow of surface water into Lake
Pontchartrain. Steam-powered pumps were built to lift water over the
Metairie and Gentilly Ridges, permitting the low-lying areas south of the
ridges to be pumped dry. Around 1900, the city built a six-foot-high artificial
levee along the shore of Lake Pontchartrain to improve protection against
storm surges.
This levee sealed off the swampland north of the Metairie and Gentilly
Ridges from the lake, allowing this land to be pumped dry for the first time.
In 1913, a new high-capacity electric pump was integrated into an ever-
expanding network of drainpipes, canals, and pumping stations. This system
was intended only to improve drainage. But by the mid-20th century, the
wetlands were gone, and dense residential developments had taken their place.
As the former wetland dried out, the ground started sinking. Because the
entire urban area was now enclosed within protective levees, there was no
flooding to replenish the soil. By the time of Katrina, about half of New
Orleans had subsided below sea level. Moreover, because New Orleans had
become a bowl, the rain falling on the city had to be captured, routed to
pumping stations, and pumped up into the canals or into Lake Pontchartrain.
Finally, the extreme subsidence of many residential neighborhoods created a
new vulnerability. If any of the city’s levees were breached, the bowl would fill
rapidly with water to a depth of nine feet or more in some areas.
The US Congress first acknowledged this vulnerability by authorizing a

small-scale federally funded hurricane protection project in 1946. But it
wasn’t until 1965, when Hurricane Betsy caused several levee breaches and
extensive flooding, that the need for a more comprehensive approach became
clear. Later that year, Congress directed the Corps of Engineers to design and
build a comprehensive hurricane protection system for New Orleans and the
surrounding region. The system’s general configuration incorporated a series
of surge-protection barriers—along Lake Pontchartrain and the four main
258
canals, encircling New Orleans East, along the Intracoastal Waterway and the
MRGO in St. Bernard Parish, and interconnected with the Mississippi River
flood-protection levees at four points.
Raising the Barriers

At many of the planned barrier locations were previously constructed
earthen levees, typically six feet high. The Corps of Engineers’ project
would need to raise these levees to achieve a higher level of protection. The
Corps used historical weather data to define the most severe combination of
meteorological conditions corresponding to a typical major storm in the New
Orleans region. The designers then used numerical modeling to predict the
maximum storm surge height each system element would experience. They
used these predictions to determine the elevation of each storm surge barrier.
The resulting design specified all barriers would be raised to 13 feet above sea
level or higher.
The Corps of Engineers’ preferred method of raising an existing earthen levee

is to make the levee larger. However, regardless of a levee’s height, the faces
of its embankment must use the same shallow slope to maintain stability.
Thus, a larger levee requires more land. Along the canals, these larger levees
would have required the demolition of many private homes. In these space-
constrained areas, the Corps used an alternative barrier configuration called
an I-wall, constructed by driving sheet piling through the existing levee to
a depth of 15 to 20 feet. On top of the sheet piling, they cast a reinforced-
concrete wall that extended upward to the same elevation an enlarged levee
would have achieved. Forty years later, the project was only 90% complete
yet had survived three near misses by Gulf Coast hurricanes. But in 2005, the
system would fail catastrophically.
Floodwall Failure
On August 28, 2005, Hurricane Katrina became the strongest storm ever
recorded in the Gulf of Mexico as it reached Category 5 status, with sustained
winds of 175 mph. At 6:10 the following morning, Katrina made landfall
about 55 miles southeast of New Orleans. It would eventually pass 20 miles
259
east of the city. By this time, its intensity had dropped to Category 3, but
it was still generating a 28-foot surge that destroyed many towns along the
Gulf Coast.
As Katrina advanced northward, its counterclockwise winds pushed a smaller

storm surge across Lake Borgne from east to west and then across Lake
Pontchartrain from north to south. Both surges were aimed directly at New
Orleans. Along the shore of Lake Pontchartrain, the peak surge was measured
at 12 feet above sea level around 9:30 am Given that this was one foot lower
than the hurricane protection system’s minimum elevation, the system should
have held.
But the floodwall system began failing even before Katrina made landfall.
Around 5:00 am, levees along the upper MRGO and Intracoastal Waterway
were overtopped and breached, flooding St. Bernard Parish and New Orleans
East. One segment of the Industrial Canal I-wall toppled while the water level
was still several feet below the top of the wall. This initiated the flooding of
New Orleans’ Lower 9th Ward. By 7:00 am, I-walls along the 17th Street and
London Avenue Canals also failed—again with the water level well below the
top of the walls. And shortly thereafter, the growing surge in the Industrial
Canal overtopped the entire floodwall and collapsed a substantial portion of it
along the Lower 9th Ward.
Shear Failure
The initial breaches on the Industrial and 17th Street Canals exhibited the
same failure mechanism. In both cases, the sheet piling had been driven
through the existing levee and a thin stratum of marsh soil into an underlying
layer of soft clay. This type of structure is designed by assuming its most likely
mode of failure and ensuring that the design provides adequate resistance
to this failure mode under the expected loading conditions. In the Corps
of Engineers’ design, I-walls built on clay soil were assumed to fail like this:
When the canal filled with water, hydrostatic pressure applied to the wall
and levee would cause an entire block of soil to slide outward along a curved
failure surface. This is classified as a shear failure because it involves sliding
along a failure surface. The structure’s resistance to this failure mode is
provided primarily by the clay’s shear strength.
260
But as the floodwater rose, the I-wall deflected outward, and a gap opened
at its base. When this gap filled with water, the hydrostatic pressure on the
wall increased substantially. Shear failure occurred. Because the actual failure
surface was much shorter than the assumed failure surface, the structure’s
actual strength was about 30% less than the designers had estimated—and
the I-wall toppled.
This failure could have been prevented by driving the sheet piling deeper
into the ground—or using a T-wall. This alternative configuration eliminates
any possibility of a water-filled gap forming at the base of the wall. Thus, it
isn’t susceptible to the failure mode that caused the initial breaches on the
Industrial and 17th Street Canals. The London Avenue I-wall failed in a
distinctly different way because it was built on sand rather than clay. The
pressure difference on opposite sides of the I-wall caused seepage into the
sand, beneath the sheet-piling, and back up to the surface. This resulted in a
liquefaction failure that eliminated the wall’s lateral support. This could also
have been prevented by driving the sheet piling deeper into the ground.
Overtopping
In contrast, the other breaches began with overtopping because many of the
MRGO levees had been constructed of poor-quality soil. When the storm
surge poured over these weak embankments, they washed away. When the
storm surge overtopped the Industrial Canal I-walls along the Lower 9th
Ward, the resulting waterfall gouged a trench on the wall’s downstream side,
causing a loss of lateral support. Under intense horizontal pressure, the walls
displaced violently outward. This could have been prevented by armoring the
downstream face of the levee with rock.
In the 1960s, the engineers who designed the system failed to consider
that New Orleans was (and is) continuously sinking. The levees along the
Industrial Canal were built three decades prior to Katrina—and, during that
period, they settled about two feet. Moreover, there’s compelling evidence that
the confluence of the MRGO and the Gulf Intracoastal Waterway acted like a
funnel, channeling the storm surge from Lake Borgne into the western reach
of the Intracoastal Waterway and then into the Industrial Canal. This funnel
effect significantly amplified the surge height.
261
This unexpectedly high storm surge was probably also influenced by the
long-term loss of the wetlands throughout the region and the environmental
degradation attributed to the MRGO project. Soon after this waterway
was opened to the Gulf of Mexico in the 1960s, saltwater intrusion began
destroying the freshwater marshes along its length. As the cypress trees died
off, their roots no longer stabilized the soft marsh soil. The banks of the
MRGO excavation began collapsing into the channel. As a result, near-
continuous dredging was required to keep the channel open. By 2005, the
600-foot-wide waterway had grown to nearly half a mile wide. This ruptured
the natural storm surge buffer provided by the cypress swamp.
Lessons Learned
After the storm, the Corps of Engineers rebuilt the New Orleans hurricane
protection system to a significantly higher technical standard—and added
impressive new features. These include the Lake Borgne Surge Barrier, which
closes off the funnel that caused so much trouble during Katrina.
This case teaches us that we must reassess the relationship between our built
environment and the natural world. Well-meaning but shortsighted attempts
to control nature have disrupted beneficial natural processes in ways that
proved to be self-destructive over the long term. In the future, as we grapple
with climate change, the need to accommodate nature rather than trying to
dominate it will become ever greater. Luckily, the imperative for sustainable
engineering has gained considerable traction in the past few years.
Meanwhile, in the Mississippi River Delta, the Corps of Engineers has

permanently closed the MRGO to ship traffic and, in 2009, completed the
construction of an earthen dam across the waterway, near the Gulf, to stop
saltwater intrusion. The Corps has also completed a comprehensive plan to
fill in the MRGO and restore its badly disrupted ecosystem. The planned
50,000 acres of restored marshland will improve the environment and restore
a much-needed outer layer of hurricane defense for New Orleans.
262
Reading
Andersen, et al., The New Orleans Hurricane Protection System.
Brinkley, The Great Deluge.
Freudenburg, Catastrophe in the Making.
Link, et al., Performance Evaluation of the New Orleans and Southeast
Louisiana Hurricane Protection System.
Mlakar, “The Behavior of Hurricane Protection Infrastructure in New
Orleans.”
Rogers, “History of the New Orleans Flood Protection System.”
263
Quiz
1 A structural member in a bridge truss experiences a maximum internal

tension force of 8,000 pounds due to the weight of the structure and
12,000 pounds due to its maximum vehicular loading. The member has
a tension strength of 25,000 pounds. What is the safety factor for this
member?
a 1.25 d 0.80
b 2.08 e none of the above
c 3.13
2 In the Dee Bridge case study, what was the fundamental flaw in Robert
Stephenson’s design concept?
a Stephenson failed to account for fatigue in his design.

b The wrought-iron eyebar chains were weak in tension.
c The eyebar chains were positioned such that they were
ineffective.
d The strength of the eyebar chains could not be predicted by
Hodgkinson’s formula.
e all of the above
3 Which of the following was not a cause of the Tay Bridge collapse?
a failure to account for wind load in the design

b defects in the fabrication of cast-iron columns
c failure to provide guardrails to prevent a train derailment
d column anchor-bolt connections that were incapable of
resisting uplift
e conical bolt holes in the cast-iron column lugs
264
Quiz
4 Which of the following was not a cause of the Kemper Arena roof
collapse?
a fatigue in the hanger rods from which the roof was suspended
b ponding of rainwater on the roof
c an inadequate roof drainage system
d the effect of wind in causing an excessive accumulation of
rainwater at one end of the roof
e lack of redundancy
5 Given that the Cypress Street Viaduct failed over three decades after
it was built, for which of the following decisions can the designer
legitimately be faulted?
a using an excessively low ground acceleration as the basis for

the design
b failure to account for the effect of resonance
c inadequate shear reinforcement in the column stubs
d using a two-level deck configuration in an earthquake-
prone region
e failure to account for sediment-induced amplification of
ground motion
6 How have the collapses of the original Sunshine Skyway Bridge and the
Skagit River Bridge influenced the subsequent practice of engineering?
a Bridge piers near navigation channels are now protected with

dolphins.
b Cantilever bridges are rarely, if ever, designed.
c Through trusses are rarely, if ever, designed.
d All interstate bridges with substandard lane widths have been
replaced.
e all of the above
265
Quiz
7 Which of the following was not a lesson learned from the Murrah
Federal Building collapse?
a Government buildings must be designed to withstand terrorist

attacks.
b A well-placed explosion can cause structural loading conditions
that engineers typically do not consider in creating a structural
design.
c Reinforced-concrete columns must be designed such that they
are strong enough to prevent failure by brisance.
d Design details intended to improve the resistance of a structure
to earthquakes can also be highly effective in resisting blast
loading.
e The effects of blast loading can be mitigated simply by increasing
standoff (i.e., by preventing vehicles from getting close to the
structure).
8 Who are the three principal participants in the planning and delivery of
a construction project?
a owner, architect, and engineer

b owner, design professional, and constructor
c engineer, contractor, and fabricator
d owner, engineer, and general contractor
e owner, design professional, and project manager
9 What contributed to the collapse of the walkways in the Kansas City

Hyatt Regency Hotel?
a the Havens Steel technician’s flawed concept for the fourth-floor

beam-to-hanger connection
b Daniel Duncan’s verbal approval of the proposed design change
c Jack Gillum’s failure to scrutinize the shop drawings before
approving them
266
Quiz
d the architect’s failure to inform the structural engineer about

construction workers’ observations of distress in the beam-to-
hanger connections
e all of the above
10 Which of the following was not a lesson learned from the Tacoma
Narrows Bridge collapse?
a Designing a suspension bridge with a minimally stiffened deck is

a bad idea.
b Those who ignore past engineering failures are doomed to
repeat them.
c Long-span bridge design must account for the aerodynamic
interaction between moving air and a flexible structure.
d Long-span bridge design must account for wind-induced
resonance.
e The issue of wind-induced vibration in suspension bridges can be
addressed by using either robust stiffening trusses or streamlined,
torsionally stiff deck girders.
11 What concept was demonstrated by the excessive pedestrian-induced

vibrations of the Millennium Bridge?
a Synchronous lateral excitation is a form of dynamic resonance.

b The phenomenon of synchronous lateral excitation is not unique
to the Millennium Bridge.
c An engineered structure can “fail” even if it does not collapse or
cause physical injuries.
d The structural design process does not end with a completed
structure, nor should it.
e all of the above
267
Quiz
12 Which statement about the John Hancock Tower is true?
a The wind-induced sway of the building was canceled out by the

combined effect of flexural and torsional oscillations.
b There were deficiencies in the design of the double-glazed
windows that made them overly sensitive to temperature and
pressure changes.
c The P-delta effect was too insignificant to have contributed to
the sway.
d The installation of a tuned mass damper fixed the structural
deficiency caused by the P-delta effect.
e The window failures were primarily caused by excessive wind-
induced sway of the structural system.
13 Which of the following did not help in understanding the collapse of

the Beauvais Cathedral?
a the post-collapse addition of new piers

b the post-collapse reinforcement of several original buttresses
c the post-collapse installation of iron reinforcing rods
d evidence of foundation settlement
e modern structural analyses of the building
14 Why was Amasa Stone ultimately unsuccessful as the designer of the

Ashtabula Bridge?
a He was unable to adapt a wooden structural concept to a new

and unfamiliar structural material.
b He lacked the scientific knowledge that would have been
required to design such an experimental structure.
c He was a stubborn man who refused to accept the advice of a
better-qualified engineer.
d He failed to recognize that the many difficulties encountered
during construction reflected fundamental problems with the
design of the bridge.
e all of the above
268
Quiz
15 Which of the following did not contribute to the loss of life caused by
the Florida International University Pedestrian Bridge collapse?
a the decision to design the bridge as an unorthodox reinforced-

concrete truss
b inadequate shear reinforcement at the critical node
c failure to erect the pylon and stay cables immediately after
placing the main span on its supports
d failure to recognize the severity of the cracking observed in
the bridge
e failure to stop traffic before initiating the re-tensioning operation
16 What was the most important takeaway from the Ronan Point collapse?
a a greater awareness of the destructive effect of gas explosions

b the need for stronger regulations on the use of natural gas in
high-rise buildings
c the need for closer supervision of construction quality
d the need for a building code requirement for redundancy in
structural design
e the need to improve the connection configurations used in the
Larsen-Nielsen system
17 According to Griffith’s criterion, what are the three main factors that
directly influence the susceptibility of a structural element to brittle
fracture?
a the tension stress in the element, the temperature, and the

existence of a stress concentration
b the maximum size of a crack or defect, the enlargement of cracks
by fatigue, and the fracture toughness of the material
c the tension stress in the element, the maximum size of a crack or
defect, and the fracture toughness of the material
d the tension stress in the element, the stiffness of the material, and
the temperature
e none of the above
269
Quiz
18 How could the Silver Bridge collapse have been prevented?
a The design engineers should have used a type of steel that was
not vulnerable to stress-corrosion cracking.
b The design engineers should have used a more redundant
configuration for the eyebar chains.
c The bridge should have been more scrupulously maintained.
d The bridge should have been inspected more frequently.
e A weight restriction should have been placed on vehicles crossing
the bridge.
19 Which of the following was not part of the project to save the Tower of
Pisa from collapse?
a a comprehensive program of subsurface exploration and testing

to characterize the soil beneath the tower
b a reversible, short-term measure to stabilize the tower while a
long-term solution was developed
c injection of grout to stabilize the soil beneath the tower
d excavation of soil from beneath the tower
e real-time monitoring of corrective actions to ensure that they
were producing the desired effects
20 According to Darcy’s law, which of the following would cause the rate
of seepage through soil to increase?
a a longer flow path

b higher viscosity of the fluid
c lower permeability of the soil
d a greater pressure difference
e all of the above
270
Quiz
21 Which party to the Senior Road Tower project was held legally
responsible for the collapse—and why?
a the riggers from Worldwide Tower Services, because they

designed the outrigger that failed during the lift
b the designer, Harris Corporation, because they designed the
antenna modules without proper lifting lugs
c the designer, Harris Corporation, because their engineers refused
to assist the riggers with the outrigger design
d the steel fabricator, Stainless Incorporated, because they supplied
faulty steel components for the tower
e the steel fabricator, Stainless Incorporated, because they also had
the contractual responsibility to serve as the general contractor
for the project
22 Which of the following did not contribute to the Mianus River Bridge
failure?
a fatigue cracking in the main girders

b poor maintenance
c inadequate inspections
d a nonredundant structural configuration
e policy decisions by the state government
23 Which of these components can be found in a nuclear reactor core?
a fuel rods
b control rods
c coolant
d moderator
e all of the above
271
Quiz
24 Which of the following was not a major flaw in the implementation

of the Boeing 737 MAX Maneuvering Characteristics Augmentation
System (MCAS)?
a If the MCAS failed to activate, the aircraft would become

uncontrollable in a stall.
b The logic of the MCAS software allowed input from either of the
two angle-of-attack sensors to activate the system.
c The system logic allowed for repetitive activations of the MCAS.
d Boeing chose not to address the MCAS in the 737 MAX flight
manuals or training materials.
e Boeing assumed that pilots would respond to an erroneous
MCAS activation as if it were a routine incident of runaway trim.
25 Which statement does not apply to both the Deepwater Horizon and
Chernobyl disasters?
a Both involved complex technological systems developed to satisfy

the demand for cheap energy.
b Both involved flawed engineering designs.
c Both were exacerbated by the pursuit of corporate profits.
d Both were exacerbated by key decision-makers’ unwillingness to
recognize clear warning signs.
e Both caused unprecedented environmental damage.
Answer Key
1.a, 2.c, 3.c, 4.a, 5.d, 6.d, 7.c, 8.b, 9.e, 10.d, 11.e, 12.b, 13.d, 14.e, 15.c, 16.d,
17.c, 18.b, 19.c, 20.d, 21.e, 22.a, 23.e, 24.a, 25.c
272
Glossary
Note: The scope of definitions provided in this glossary is limited

to the context of this course. For example, the term stall has
many meanings; however, in this glossary, only the definition
associated with aerodynamics is provided, because the term is
only used in the aerodynamic context in this course.
abutment: A structural foundation element that supports one end of a

bridge or dam.
accelerated bridge construction: A construction method in which

traffic disruptions are minimized by fabricating the bridge off-site and then
moving it as a single unit onto previously prepared supports.
acceleration: The rate of change of velocity.
aeroelastic flutter: A complex, dynamic interaction between moving air

and a flexible structure, which can lead to uncontrolled oscillations.
alloy: A metal made by combining two or more metals or by combining a

metal with one or more nonmetallic elements.
alluvium (or alluvial soil): Sediment deposited by flowing water in a river

valley or delta.
ambulatory: A semicircular aisle that provides access to the chapels

radiating out from the chevet of a Gothic cathedral.
amplitude: The maximum displacement of an oscillating object, measured

from its static equilibrium position.
anchorage: A structure at which one end of a suspension bridge cable is

anchored.
273
Glossary
anchor bolt: A bolt used to connect a column baseplate to a structural

foundation.
angle block: A cast-iron connector used in the Howe truss.
angle of attack: The angle between the wing of an aircraft and the
oncoming air.
angle-of-attack sensor: A sensor that measures the angle between the

wing of an aircraft and the oncoming air.
annular preventer: In well-drilling, a type of controllable barrier used in

a blowout preventer (BOP). The annular preventer is used to close off the
annulus without affecting the drill pipe.
annulus: In well-drilling, the ring-shaped space between two concentric

objects (for example, between the drill pipe and the wellbore).
arcade: A series of arches supported on piers and forming the lower story of a
Gothic cathedral interior.
arch: A structural element that carries load primarily in compression and

must have its outer ends laterally restrained in order to carry load successfully.
arching: A phenomenon that occurs in soil when internal force is

transmitted laterally to stiffer soil or rock, reducing the downward stress on
the underlying soil.
atomic mass number: The number of protons plus the number of

neutrons in the nucleus of an atom.
bar joist: A lightweight, factory-built truss, typically used in a roof support

structure.
baseplate: A horizontal metal plate at which anchor bolts are used to

connect a column to a footing or other structural foundation element.
bayou: A marshy, slow-moving stream that is tributary to another body

of water.
beam: A structural member that carries load primarily in flexure or bending.
274
Glossary
bearing: The transmission of compressive force across the interface between

two solid objects.
bedrock: The solid rock that constitutes the earth’s crust.
bent: A transverse frame, used as a structural support for a bridge.
blast loading: The effect of an explosion on a structure.
blast overpressure: An instantaneous increase in pressure caused by a

blast wave.
blast wave: A layer of highly compressed air that propagates outward from
the point at which an explosive detonates.
blind shear ram: In well-drilling, a type of controllable barrier used in a

blowout preventer (BOP). A blind shear ram uses a hydraulically powered
blade to slice completely through the drill pipe and disconnect the riser from
the wellhead. By closing off the annulus and pinching the lower portion of the
drill pipe shut, the ram also seals the well.
blowout: In well-drilling, a violent event that occurs when an uncontrolled

kick reaches the drilling rig.
blowout preventer (BOP): In well-drilling, a vertical stack of controllable

barriers, used to connect the riser to the wellhead. The BOP functions as a
valve, which allows for rapid closure of the well if any problems with well
control occur.
boron: An element that is often used in nuclear control rods because of its
strong tendency to absorb neutrons.
box beam: A beam with a hollow rectangular cross section.
braced frame: A structural frame that uses diagonal braces as its principal
means of carrying lateral loads.
brisance: The shattering effect of an explosion acting upon a brittle

material, such as concrete.
brittle fracture: The non-ductile failure of a material subjected to tension.
275
Glossary
brittleness: The tendency of a material to fail suddenly, with little or no

plastic deformation. Brittleness is the opposite of ductility.
buckling: A failure mode in which a member subjected to compression

suddenly and catastrophically displaces laterally and collapses.
buckling strength: The largest compression force a member can carry

before buckling.
building code: A set of rules specifying minimum standards for

construction. Building codes are normally enacted through legislation.
buttress: A thickened section of a wall that increases the lateral stability of

the wall.
cable-stayed bridge: A bridge in which the main spans are supported by

diagonal stay cables radiating out from one or more towers, called pylons.
caisson: An open-bottomed enclosure used to excavate a riverbed and

construct the foundation of a bridge pier underwater.
camber: A slight upward arc, built into a truss or beam during construction
and designed to offset the estimated deflection that will occur after the
structural element begins carrying load.
campanile: A freestanding bell tower, often used in medieval Italian

architecture.
cantilever: Any structural element that is fixed at one end and unsupported
at the other.
cantilever bridge: A bridge in which one or more suspended spans are

supported from the ends of cantilever arms, each of which is formed by the
extension of an anchor span across an intermediate support.
casing: A pipe inserted into an oil or natural gas well to prevent the walls of
the wellbore from collapsing.
cast iron: An alloy of iron and carbon that is heated to a molten state, then
poured into a mold. Because of its relatively high carbon content, cast iron is
more brittle and weaker in tension than wrought iron.
276
Glossary
catastrophic failure: A sudden failure of an entire structure or system.
catwalk: A suspended walkway that provides access to otherwise inaccessible

portions of a structure, for the purpose of inspection and maintenance.
cement: (1) In conventional construction, a fine gray powder that is mixed

with aggregates and water to make concrete; (2) in well-drilling, a mixture of
Portland cement, water, and chemical additives, used to seal the bottom of a
well casing into its wellbore.
cementing: In well-drilling, the process of sealing the bottom of a well

casing with cement.
centering: A temporary framework that supports an arch while it is being

constructed.
chancel: The front arm of the cross-shaped plan of a church or cathedral.
channel: (1) In structural engineering, a metal beam with a C-shaped cross

section; (2) in nuclear engineering, a hollow tube in which a fuel rod or
control rod is enclosed and through which coolant is circulated.
chevet: The semicircular apse of a Gothic cathedral, characterized by an

ambulatory and radiating chapels.
chevron: A pair of diagonal braces forming a V shape.
choir: The central space within the apse of a church or cathedral.
chord: The top or bottom longitudinal structural member in a truss.
circumferential stress: Tension stress caused by internal pressure in a

cylindrical or spherical vessel.
cladding: The outer nonstructural façade of a building.
clay: An extremely fine-grained, cohesive, and impermeable soil, formed

from the weathering of silicate-bearing rocks.
clerestory: The upper story of a Gothic cathedral interior.
277
Glossary
cold joint: A discontinuity at the interface between two successive

concrete pours.
cold shut: An internal casting defect caused by the failure of two streams of
molten metal to join fully.
column: A structural member—usually oriented vertically—that carries load

primarily in compression.
compression: An internal force or stress that causes a structural element to

shorten.
compressive strength: The largest internal compression force a member

can carry before failing.
concentrated load: A load applied at a single point.
concrete: A rocklike structural material formed by mixing Portland cement,

aggregate (typically gravel and sand), and water.
condenser: A device that changes vapor into liquid by cooling it.
consolidation: A long-term volume reduction of soil that occurs when

compressive loading forces porewater out of the soil.
constructor: A company or organization that assumes principal

responsibility for building a project.
containment vessel: A massive concrete enclosure that surrounds the core

of a nuclear reactor to protect the reactor and to prevent radioactive material
from being released during an accident.
control rod: A movable nuclear reactor component that slows or stops

the nuclear chain reaction by absorbing neutrons when inserted into the
reactor core.
coolant: A fluid (usually water) circulated through a nuclear reactor core to

keep the fuel rods from overheating and to transfer the associated thermal
energy to the turbogenerators.
corrosion: The gradual destruction of metal via a chemical reaction with

water and oxygen.
278
Glossary
corrosion pack-out: A phenomenon in which the gradual buildup of

corrosion product (rust) in a narrow gap between structural elements applies a
large outward pressure to these elements.
cover plate: A plate that is fastened to one or both flanges of a beam to

increase the flexural strength and stiffness of the beam.
crest: The top edge of an embankment dam.
cross section: The shape defined by passing a plane through a structural

member perpendicular to its longitudinal axis.
cross-sectional area: The area of a cross section.
curtain wall: A lightweight, non-load-bearing exterior wall.
cyclic loading: Repeated application of a load.
dam: An engineered structure designed to impound water, generally by

blocking the flow of a natural waterway, for the purposes of water supply,
irrigation, flood control, and/or hydroelectric power.
damping: The tendency of vibrations to die out over time.
Darcy’s law: An empirical equation that describes the seepage of a fluid

through a permeable material.
deaerator: A device that removes dissolved gases from a fluid.
deck: A structural element that forms the floor of a bridge, on which vehicles
and pedestrians are supported.
deck truss: A truss bridge on which the deck and roadway are located at the
top chord of the truss.
deflection: The vertical distance a beam or truss bends in response to its

applied loads.
deflection theory: A mathematical method for analyzing suspension

bridges.
279
Glossary
deformation: A change in the physical shape or dimensions of a structural

element.
delta: A landform created by the deposition of alluvium near the mouth of

a river.
derrick: The tall tower located at the center of a drilling rig.
design-bid-build: A project delivery system in which the owner hires the

design professional and constructor separately and sequentially. The design
professional prepares the project plans and specifications, which are then used
as the basis for competitive bidding to choose the constructor for the project.
design-build: A project delivery system in which the owner hires one

company to assume full responsibility for both design and construction.
design professional: An individual or company that assumes principal

responsibility for the design of a project.
diagonal brace: A diagonally oriented structural member that carries lateral

loads in a braced frame.
differential settlement: A condition that occurs when a structure

experiences significantly different amounts of settlement at different locations.
displacer: A graphite extension on the end of a control rod, used to improve

reactor control in an RBMK nuclear reactor.
distributary: A branch of a river or stream that splits away from the main
channel.
distributed load: A load that is applied over an area (rather than at a single
point), typically expressed in units of force per length or force per area.
drain: A basin, covered with a grating, which captures storm runoff and
routes it into a storm drainage system or downspout.
drill floor: The operating deck of a drilling rig.
drilling mud: In well-drilling, a fluid used to lubricate the drilling bit and to
carry rock cuttings back up to the surface.
280
Glossary
drilling rig: A complex technological system used to drill deep into the
earth’s crust to extract hydrocarbons (oil and natural gas).
drill pipe: A series of hollow pipes connected together with threaded

couplers, used to drill the wellbore for an oil or natural gas well.
ductility: The capacity of a material to undergo large plastic deformations

before rupturing. Ductility is the opposite of brittleness.
earth embankment dam: A dam that uses an embankment of compacted

soil as its primary structural material.
elasticity: Material behavior characterized by a loaded element returning to

its original shape after being unloaded.
elastic theory: A mathematical method for analyzing suspension bridges.
elevator: On an aircraft, one of multiple hinged surfaces that are mounted

along the aft edge of the horizontal stabilizer and used for pitch control.
Emergency Core Cooling System (ECCS): An automated safety system

designed to prevent a nuclear reactor core from overheating if its primary
cooling system fails.
engineering: The application of math, science, technology, and experience

to design a technological system, component, or process that serves a
human need.
enriched uranium: Uranium that has been processed to increase its

proportion of fissile uranium-235 for use as a nuclear fuel.
epicenter: The point at which an earthquake originates.
equilibrium: The condition in which all forces acting on a body or system

are in balance.
estuary: A partly enclosed coastal body of water in which river water is

mixed with seawater.
eyebar: A structural element, usually made of metal and consisting of a flat

bar with rounded ends. An eyebar is fastened to other structural elements
(including other eyebars) with pins that pass through holes in its ends.
281
Glossary
fabricator: A manufacturing company that specializes in cutting, shaping,

and drilling steel components for a construction project.
fast-tracking: A project management technique in which construction is

begun before the design is complete.
fatigue: A process by which the strength of a structural element is reduced

due to the gradual growth of one or more cracks from repetitive loading.
fault: A boundary between two tectonic plates.
fissile material: A material (e.g., uranium-235) that is capable of sustaining

the chain reaction associated with nuclear fission.
fission: A process in which an atomic nucleus splits into lighter nuclei and
releases energy.
flange: (1) One of two horizontal elements forming the top and bottom of an
I-shaped structural member; (2) the raised edge on the wheel of a locomotive
or railcar.
flap: On an aircraft, a movable panel mounted along the aft edge of a wing.
When the flaps are extended, they increase the curvature and area of the
wing, thus allowing the aircraft to fly more slowly without stalling.
flexibility: The amount of deformation for a given load.
flexure: Structural behavior characterized by bending.
float collar: In well-drilling, a fixture installed at the bottom of a well

casing to facilitate the cementing process. The float collar incorporates a one-
way valve that allows the pumped cement to flow downward but prevents the
backflow of cement into the casing when the pumping stops.
floodwall: A wall built to prevent inundation by high water.
fluid: A liquid or gas.
flying buttress: A buttress that is physically separated from the wall it

supports. A flying buttress is connected to the wall with one or more half-
arches (flyers), which provide the support.
282
Glossary
footing: A foundation element that distributes load from a structural column

or wall to the soil below.
force: A push or pull applied to an object, defined in terms of both

magnitude and direction.
formation pressure: In well-drilling, the pressure of hydrocarbons within

a subsurface reservoir (pay zone).
formwork: Temporary supports used to contain fluid concrete and hold its
shape until it hardens.
foundation: One or more elements that transmit loads from a structural

system down into the earth.
fracture: A material failure mode in which a loaded element physically

breaks when subjected to internal tension.
fracture mechanics: A branch of engineering mechanics focused on

predicting the strength of materials that have preexisting defects.
fracture toughness: An experimentally determined material property that

characterizes the capacity of the material to resist brittle fracture.
frame: A structural system, typically composed primarily of beams and

columns.
frequency: For any cyclic phenomenon, the number of alternating cycles

occurring within a given period of time. Frequency is expressed in hertz
(cycles per second).
friction: A resisting force developed at the interface between two bodies.

The friction force is oriented parallel to the contact surface, in the direction
that opposes motion. Frictional resistance increases with the compressive force
transmitted across the interface.
friction pile: A pile that supports a structure primarily by the friction

force developed at the interface between the outer surface of the pile and the
surrounding soil.
283
Glossary
frustum: A truncated conical enclosure that connects two circular

components of different diameters on a rocket.
fuel rod: A nuclear reactor component consisting of pellets of fissile material

sealed within a zirconium alloy tube.
fuselage: The body of an aircraft.
generator: A device that converts the kinetic energy of a rotating shaft into
electrical energy.
geotechnical engineer: A civil engineer who specializes in the use of soil

as an engineering material.
gib and cotter: A double-wedged connection, used to tighten a tension

member. (A gib-and-cotter connection is the 19th-century equivalent of a
modern turnbuckle.)
gin pole: A portable device that uses a pulley on its upper end to lift loads.
girder: A main beam, to which load is transmitted from other elements of a

structural system.
graphite: A crystalline form of pure carbon, used as a moderator in the

Soviet RBMK reactor.
gravity load: Any load caused by weight—for example, the weight of

vehicles and people crossing a bridge, the weight of building occupants and
their furniture, or the weight of a structure itself.
groined vault: A vault formed by intersecting two barrel vaults at right

angles to each other.
grout: A mortar made from Portland cement, used for filling crevices.
grout curtain: A seepage barrier created by injecting high-pressure grout

into drilled boreholes to seal the fissures in a fractured rock mass.
guy line: A diagonal cable that supports a tower.
half-life: The time required for half of a given substance to undergo

radioactive decay into a different element.
284
Glossary
hammer blow: A dynamic loading effect caused by the counterweighted

drive wheels of steam locomotives. The effect of hammer blow can approach
20% of the static weight of a locomotive.
hanger: A structural member from which a portion of a structure is

suspended.
header: A large pipe that is used to collect fluid flowing from many smaller
pipes, or to distribute fluid to many smaller pipes.
heat: Thermal energy transferred from a region of higher temperature to a

region of lower temperature.
heavy water: Water in which each hydrogen atom in the molecule has one
proton and one neutron in its nucleus. Heavy water is more effective than
normal water as a nuclear moderator, because it has significantly less tendency
to absorb free neutrons.
Hodgkinson’s formula: An experimentally derived equation developed by

the 19th-century English engineer Eaton Hodgkinson to predict the breaking
load of a cast-iron beam.
hollow-core slab: A concrete slab with cylindrical cavities that reduce its
weight.
horizontal stabilizer: An aircraft component consisting of a horizontal

planar surface that enhances pitch stability.
hydraulic jack: A machine that uses fluid pressure to apply a

controlled force.
hydrocarbon: A chemical compound composed entirely of hydrogen and

carbon. Petroleum and natural gas are composed primarily of hydrocarbons.
hydroelectric power: Electric power produced by water flowing through

a turbine. The source of energy for hydroelectric power is the potential energy
stored in water contained at a relatively high elevation, such as behind a dam.
hydrostatic pressure: Pressure caused by the weight of water. Hydrostatic

pressure acts uniformly in all directions, and perpendicular to the surface of
any submerged body.
285
Glossary
incident peak overpressure: An instantaneous increase in pressure that

occurs when a blast wave passes through a given point.
inertial force: An equivalent force, acting opposite the direction of an

accelerating mass.
infrastructure: Large-scale technological structures and systems that

enhance societal functions, facilitate economic development, and enhance
quality of life.
instability: A condition in which a small disturbance or displacement can

result in a large displacement or collapse.
internal force: A force developed within a structural element in response

to one or more applied loads. Internal forces include tension, compression,
and shear.
iodine pit: A slang expression referring to the loss of reactivity in a nuclear

reactor core due to the unintended accumulation of xenon-135.
isotope: One of multiple forms of the same element, distinguished by the

number of neutrons in the nucleus.
jacket: An enclosure of supplemental reinforcing bars, designed to improve

the seismic response of a reinforced-concrete column.
joint: A node at which two or more structural members are connected

together.
joist: One of a series of parallel beams that directly support a floor or deck.
key trench: A V-shaped excavation designed to increase the strength and

reduce the permeability of a dam foundation or abutment.
kick: In well-drilling, the unwanted flow of hydrocarbons into an

underbalanced well.
kill line: In well-drilling, a small-diameter pipe that runs from high-pressure

pumps on the drilling rig down to the blowout preventer, parallel to the riser.
The kill line can be used to control a kick by pumping high-density mud into
the well while the top of the drill pipe is closed off.
286
Glossary
kinetic energy: The energy associated with a mass in motion.
lateral earth pressure: The horizontal pressure of soil acting on a vertical

surface.
lateral load: A predominantly horizontal force associated with wind or

earthquake effects.
lateral thrust: The tendency of an arch to spread outward under load.
lattice girder: A 19th-century term for a parallel-chord truss that

incorporates a lattice of intersecting diagonal members.
leaning instability: The natural tendency of a tower to lean when it has

been built on a flexible base and exceeds certain threshold values of weight,
height, and width.
levee: An earth embankment along the edge of a river or canal.
lever: A simple machine that converts an applied force to a larger force

through rotation about a fulcrum.
lift: The upward force that holds an aircraft aloft.
lift-slab method: A building construction method in which reinforced-

concrete floor and roof slabs are cast at ground level and then lifted into
position with hydraulic jacks mounted on the tops of the structural columns.
light: One pane of a glass window.
linear viscous damper: A shock absorber, used to reduce the load-induced

motion of a structure.
liquefaction: A condition in which the internal friction that holds soil

particles together is reduced to zero, causing the soil to lose all its strength.
Liquefaction can be caused by the movement of water through soil (seepage)
or by earthquake-induced ground motion.
load: A force applied to a structure. Most structures are designed to resist

both gravity loads and lateral loads.
287
Glossary
load path: A pathway through which internal forces are transmitted. The
path begins where the load is applied, passes through the elements of the
structural system, and ends at the structural foundation.
lobe: A landform created when a network of distributaries split away from a

river channel in the region where the river flows into a larger body of water. A
delta is often composed of multiple lobes.
loess: A windblown deposit of loose, yellowish-gray silt, common in the

American Midwest.
lost circulation material (LCM): In well-drilling, a viscous substance

pumped down into a well to seal fractured rock and thus prevent the loss of
drilling mud (lost returns).
lost returns: In well-drilling, the loss of drilling mud through porous strata
or fractures in a rock formation.
lug: A projecting element that serves as a point of attachment.
Maneuvering Characteristics Augmentation System (MCAS): A

software augmentation to the flight control system of the Boeing 737 MAX,
intended to eliminate an unwanted disparity between the flight characteristics
of the 737 MAX and its predecessor, the Boeing 737 NG.
masonry: Stones or bricks joined together with mortar to create a load-

carrying structural element.
mechanical properties: Characteristics of a material that describe how it

responds to forces.
mechanics: A branch of science that deals with the effects of forces acting
on physical bodies.
meltdown: A nuclear reactor failure that occurs when nuclear fuel rods
are heated beyond their melting temperature, usually due to a failure of the
reactor cooling system.
methane: A hydrocarbon with the chemical formula C1H4. Methane is the

principal constituent of natural gas.
288
Glossary
moderator: A substance that surrounds the fuel rods in a nuclear reactor

core and facilitates self-sustaining fission by slowing down neutrons.
mud: In well-drilling, a fluid used to lubricate the drilling bit and to carry
rock cuttings back up to the surface.
multi-hazard mitigation: A structural design philosophy that accounts

for a wide range of extreme loads caused by earthquakes, intense storms, and
blast effects in a holistic way that is both effective and cost-efficient.
nacelle: A streamlined housing that encloses an aircraft engine.
natural frequency: The frequency at which an elastic object vibrates.
natural levee: An earth embankment formed by the natural deposition of

alluvium along the banks of a river or stream.
natural uranium: The form of uranium found in nature—a mixture

of mostly non-fissile uranium-238 and less than 1% fissile uranium-235.
(Natural uranium must be enriched before it can be used as nuclear fuel in a
water-moderated reactor.)
nave: The long arm of the cross-shaped plan of a church or cathedral.
neutral axis: In flexure, a horizontal line along which there is no

longitudinal deformation, and therefore no stress due to bending.
neutron: An uncharged particle found within the nucleus of an atom.
Newton’s first law: A body at rest remains at rest, and a body in motion at
a constant velocity remains in motion at a constant velocity, unless acted upon
by an external force.
Newton’s second law: The total force acting on a body is equal to its mass
times its acceleration.
nozzle: The bell-shaped opening at the bottom of a rocket engine, which

increases engine thrust by accelerating the exhaust gases flowing from the
combustion chamber.
nuclear energy: A form of energy associated with the bonds between the
particles that constitute the atomic nucleus.
289
Glossary
nuclear fission: A process in which an atomic nucleus splits into lighter

nuclei and releases energy.
nuclear reactor: A technological system designed to initiate and control

nuclear fission.
nucleus: The center of an atom, composed of protons and neutrons.
O-ring: A gasket in the form of a ring with a circular cross section, typically
made of a pliable material and used to seal a connection.
outlet works: A conduit and associated equipment (intake structure, gates,

valves, etc.) used to control the release of water from a reservoir around or
beneath a dam.
outrigger: A beam that is anchored to, and extends outward from, an object
to provide a point of attachment for lifting with a crane or other device.
overbalanced: In well-drilling, a condition that occurs when the formation

pressure (the pressure within a subsurface hydrocarbon deposit) is less than
the pressure of the drilling mud in the wellbore. The overbalanced condition
prevents hydrocarbons from flowing into the well.
overpressure: An instantaneous increase in pressure caused by a blast wave.
owner: A person, corporation, or government entity that identifies the need

for a construction project and provides the required money and land.
pay zone: In well-drilling, a geological stratum containing economically

recoverable hydrocarbons.
P-delta effect: An interaction between gravity loads and lateral loads that
makes their combined effect on a structural system greater than the sum of
its parts.
pendulum: An object that oscillates by rotating about its upper end.
penstock: In hydroelectric power generation, a pipe that transmits water at

high velocity from the reservoir to a turbine.
290
Glossary
photoelastic modeling: A structural analysis method in which a two-

dimensional scale model of a structure is fabricated from a special type
of plastic, loaded, and then viewed under polarized light to determine its
internal forces.
pier: (1) An intermediate bridge support, located between the two abutments;
(2) a main load-bearing column in a monumental building.
pile: A long shaft of steel, concrete, or wood that is driven deep into the
ground to increase the load-bearing capacity of a structural foundation.
pin: A structural connector that permits rotation but restrains both horizontal
and vertical movement of the connected elements.
pin-and-hanger assembly: A type of connection used to support the

suspended span of a cantilever bridge.
piping (or internal erosion): The transport of soil particles by water

flowing under pressure along an internal pathway through soil or rock.
pitch: A change in the angle of an aircraft corresponding to climbing or

diving.
plans and specifications: The drawings and instructions prepared by

the design professional as the principal product of the design process for a
construction project.
plasticity: Material behavior characterized by a loaded element not

returning to its original shape after being unloaded.
plate girder: A girder fabricated by welding or riveting individual steel

elements together, typically into an I-shaped or rectangular cross section.
plinth: A heavy base that serves as a structural support.
point-bearing pile: A pile that extends down to bedrock or to a firm

stratum of soil or rock, and thus supports a structure primarily through a
concentrated bearing force at the lower tip of the pile.
291
Glossary
ponding: A potentially unstable condition that occurs when the

accumulation of rainwater on a flat roof causes excessive deflection, which
allows an increasing amount of rainwater to accumulate on the roof.
porewater: Water that fills the voids between particles of soil.
portal: In structural engineering, a simple rectangular frame formed by two

columns and a beam.
Portland cement: A fine gray powder manufactured from limestone, clay,

and other ingredients; used as one of the principal constituents of concrete.
post-tensioned concrete: A structural material that uses stretched steel

reinforcing rods or cables (called tendons) to control cracking and reduce
deflections.
post-tensioning: The process of applying tension to a structural element

after the structure has been constructed or erected. Post-tensioning
compresses the element or elements to which the post-tensioned element is
attached.
principle of equilibrium: A law of physics that states that, for a body at

rest or moving at a constant velocity, the sum of all forces acting on the body
is zero.
production casing: In well-drilling, a casing string that extends down to

the pay zone and is used to carry hydrocarbons to the surface when the well is
placed into production.
proton: A positively charged particle found within the nucleus of an atom.
pulley: A simple machine that changes the direction of a rope or cable.
pylon: The tower on which the diagonal cables of a cable-stayed bridge are
mounted.
radioactive decay: The process by which an unstable atomic nucleus loses

energy through radiation or the emission of particles.
reactivity: The intensity of the fission reaction in a nuclear reactor. As

reactivity increases, the power output of the reactor also increases.
292
Glossary
reactor core: In a nuclear reactor, the vessel in which the nuclear reaction
takes place. The reactor core contains nuclear fuel rods, control rods, coolant,
and a moderator.
rebar: A reinforcing bar, usually made of steel and used to strengthen

concrete, particularly with respect to internal tension and shear.
reciprocating motion: Cyclic back-and-forth motion, characteristic of a

piston in a cylinder.
redundancy: The capacity of an engineered system to sustain a localized

failure without experiencing a global failure or collapse.
reinforced concrete: Concrete that has been strengthened with

reinforcing bars (rebars).
resistance: The capacity of a structural element or structural system to

carry loads without experiencing failures or excessive deformations.
resonance: A phenomenon in which an external force is applied at or near

the natural frequency of an elastic object, resulting in vibrations of greatly
increased amplitude.
rhyolitic tuff: An igneous rock formed from flows of volcanic ash.
rigger: An occupation that deals with the application of pulleys, cables,

cranes, and other specialized equipment to lift heavy objects or erect
structures above ground level.
rigid frame: A structural frame that uses rigid connections between the
beams and columns as its principal means of carrying lateral loads.
riser: In offshore drilling, a segmented pipe that connects the drilling rig to
the wellhead and encloses the drill pipe.
runoff: Stormwater flowing across the surface of the land or an impervious

surface.
rupture: A material failure mode in which a loaded element physically breaks

when subjected to internal tension.
293
Glossary
safety factor: A number, always greater than 1, that provides a margin of

error to account for sources of uncertainty inherent in structural design—e.g.,
unanticipated loads, natural variability in material properties, or fabrication
errors.
sag: (1) For a cable suspended between two supports, the difference in
elevation between the supports and the lowest point along the cable; (2) the
deflection of a beam or truss.
saturated soil: Soil in which the voids between soil particles are completely
filled with porewater.
scram: In the operation of a nuclear reactor, an emergency control measure

in which all control rods are simultaneously inserted into the reactor core to
stop the fission reaction.
scupper: An opening in a building parapet wall, designed to prevent the

accumulation of excessive rainwater on a flat roof surface.
sediment-induced amplification: A phenomenon in which soil

composed of soft sediment greatly amplifies the ground motions caused by
seismic waves.
seepage: The movement of water through soil.
seismic wave: An elastic wave that propagates outward from the epicenter
of an earthquake.
self-sustaining fission: A process that occurs when neutrons emitted by

the fission of atomic nuclei encounter adjacent nuclei and cause them to split
and emit more neutrons.
settlement: The downward displacement of a structure due to the

compression of the soil beneath its foundation.
shear: An internal force or stress that causes angular distortion in a

structural element.
shearhead: A steel fixture that provides points of attachment between a

concrete slab and the lifting rods that are used in lift-slab construction.
294
Glossary
shear key: A type of joint that incorporates a mechanical interlocking

connection to prevent shearing across the joint.
shear strength: The largest internal shear force a member can carry before
failing.
shear wall: A concrete wall that provides lateral stability and later load-
carrying capacity to a structural frame.
sheet piling: A wall formed by driving a row of steel elements (sheet piles)
into the ground edge to edge; used for retaining walls, floodwalls, and similar
structures.
shock absorber: A device that damps out vibrations.
shoe track: In well-drilling, a length of casing that extends below the float
collar and is filled with cement during the cementing process.
shop drawings: Detailed plans that show precisely how each piece of steel
will be cut, shaped, and drilled for a project.
silt: A non-cohesive sedimentary soil consisting of individual particles that

are smaller than sand particles but larger than clay particles.
simple support: A type of structural support system in which a beam or

truss is supported only at its two ends.
skew: The parallelogram-shaped geometric configuration of a bridge plan,

typically used to accommodate a road or railroad that crosses a river at an
oblique angle.
slab: A horizontal floor or roof panel, typically made of reinforced concrete.
solid rocket booster (SRB): A rocket motor, fueled by solid propellant

and used to provide a rocket with additional thrust during its liftoff and
initial ascent.
space truss: A truss with its structural geometry defined in three-

dimensional space (rather than in a single plane).
295
Glossary
spillway: A dam component that facilitates the controlled discharge of

surplus water from a reservoir, to prevent the dam from being overtopped in
a flood.
spiral reinforcement: An earthquake-resistant alternative to ties for lateral

reinforcement of concrete columns, consisting of a single reinforcing bar
formed into a helix that encircles the flexural reinforcement along the full
length of the column.
spread footing: A foundation element that distributes load from a

structural column or wall to the soil below.
stall: In aerodynamics, the rapid loss of lift that occurs when an excessive
angle of attack causes the separation of airflow on the top of a wing.
stay: A diagonally oriented cable, used to support the deck of a cable-stayed

bridge.
steam separator: A drum that separates high-pressure steam from hot

water in a power plant cooling system.
steel: An alloy of iron, carbon, and other elements, used extensively as a

structural material because of its strength, ductility, and capacity to be joined
by welding.
stiffening truss: A truss that resists the bending and twisting of a

suspension bridge deck.
stiffness: Resistance to deformation. Stiffness is the opposite of flexibility.
stirrup: A U-shaped reinforcing bar, used in a reinforced-concrete beam to

ensure adequate shear strength.
storm drainage system: An engineered system that captures surface

runoff and transmits it into a natural waterway.
storm surge: A rise in sea level resulting from the wind and low
atmospheric pressure associated with a storm.
296
Glossary
stormwater detention pond: An earthen enclosure designed to store the

runoff from an intense storm temporarily and then release it into the storm
drainage system at a controlled rate to prevent flooding.
strain: A nondimensional measure of deformation, typically expressed as a

percentage of the measured elongation.
stratum: A layer of soil or rock.
strength: The maximum internal force or stress a structural member can

resist before failure. Strength can be defined in terms of tension, compression,
and shear.
stress: A measure of the intensity of internal force in a structural element,

expressed in units of force per area (e.g., pounds per square inch).
stress concentration: A discontinuity that causes the local stress in an

element to be measurably higher than the average stress.
stress corrosion: A phenomenon in which the gradual accumulation of

corrosion product (rust) within the grain boundaries of a metal causes tiny
cracks to form. Stress corrosion occurs when the metal is subjected to tension
stress in a corrosive environment.
stress intensity factor: For an element with an existing crack or defect, a

quantitative measure of the propensity to experience brittle fracture.
stringer: A longitudinal beam that supports the deck of a bridge or walkway.
structural analysis: The systematic application of engineering mechanics

principles to calculate the internal forces and deformations of a structure in
response to applied loads.
structural engineer of record: The engineer legally responsible for the

design of a structural system.
structural response: The internal forces and deformations experienced by

a structural element or structural system in response to applied loads.
superstructure: The portion of a structure above the foundations.
297
Glossary
suspender: A vertical cable or rod, used to suspend the deck structure of a

suspension bridge from one of the main cables.
suspension bridge: A bridge supported by one or more main cables, which

are mounted at anchorages and draped across one or more towers.
sway: The lateral displacement of a structure due to wind or

earthquake loads.
sway brace: A structural element that connects the top chords of two
parallel main trusses in a truss bridge.
synchronous lateral excitation: Pedestrian-induced vibration of a

bridge.
tang and clevis: A type of mechanical connection in which a single element

on one component (the tang) is inserted between two parallel elements on the
other component (the clevis) and secured with one or more pins.
technology: A product of engineering.
tectonic plate: A discrete component of the earth’s outer shell, which floats
on the earth’s mantle.
tendon: A high-strength steel reinforcing cable, used in post-tensioned

concrete.
tensile strength (or tension strength): The largest internal tension

force a member can carry before failing.
tension: An internal force or stress that causes elongation of a structural

element.
thermal deformation: The tendency of a material to expand when heated

and contract when cooled.
through truss: A truss bridge on which the deck and roadway are located at
the bottom chord of the truss.
thrust: The propulsive force generated by a propeller, jet engine, or rocket

engine.
298
Glossary
tie: A reinforcing bar formed into a loop, used to strengthen a reinforced-

concrete column.
top drive: A powerful electric motor used to rotate the drill pipe on an oil
drilling rig.
torsion: The twisting of a structural element in response to loads.
transept: One of two side arms of the cross-shaped plan of a church or

cathedral.
transfer girder: A girder that supports one or more columns.
triforium: The second story of a Gothic cathedral interior.
trimming: The process of adjusting the flight characteristics of an aircraft.

On most aircraft, pitch trim is achieved by controlling the angle of the
horizontal stabilizer.
truss: A structural system composed of slender elements arranged in

interconnected triangles. Truss elements carry load primarily in tension or
compression.
tuned mass damper: A device that reduces the load-induced motion of a

structure by counteracting its motion while dissipating its kinetic energy.
turbine: An engine that produces continuous power by means of a fast-

moving flow of water, steam, gas, or air driving a rotor fitted with vanes or
blades.
turbofan: A jet engine that combines a turbine with a ducted fan.
turbogenerator: A machine composed of a turbine and a generator

spinning on a common shaft, used to convert the kinetic energy of a moving
fluid into electrical energy.
under-excavation: The controlled extraction of soil beneath a structural

foundation to reduce a tilt caused by leaning instability or differential
settlement.
299
Glossary
underbalanced: In well-drilling, an unsafe condition that occurs when the

formation pressure (the pressure within a subsurface hydrocarbon reservoir)
exceeds the pressure of the drilling mud in the wellbore.
uniaxial tension test: A laboratory test used to determine the mechanical

properties of a material by loading a test specimen in tension until it fails.
unstable isotope: An isotope that must emit particles to attain a more

stable form.
uranium-235: The most commonly used fissile material for nuclear power
generation.
vault: An arch extruded into the third dimension to create a curved surface
that encloses space.
viscosity: The resistance of a fluid to flow.
voltage: A difference in electrical potential between two points, measured

in volts.
vortex: A region of turbulent low-pressure air, swirling in a more-or-less

circular path.
vortex shedding: An aerodynamic phenomenon in which air flowing

around a blunt object forms vortices on alternating sides of the object.
voussoir: A wedge-shaped stone used to construct an arch.
web: The vertical element of an I-shaped cross section.
welding: A process by which two pieces of metal are fused rigidly together
by melting the metal or by depositing melted metal along the interface
between the pieces.
wellbore: A hole drilled through rock to create an oil or natural gas well.
well control: In well-drilling, the process of preventing the unwanted flow

of hydrocarbons into a wellbore by controlling the density of the drilling mud.
wellhead: A steel fixture mounted at the top of an oil or natural gas well.
300
Glossary
wetland: A region characterized by a water table that stands at or near the

land surface for a sufficiently long portion of each year to support aquatic
plants. Wetlands often form within and around a delta.
winch: A machine that uses a rotating drum to apply tension to a cable.
wind load: Horizontal pressure applied to a structure by wind.
winglet: A small fin mounted at the tip of an aircraft wing to reduce drag.
wrought iron: A type of iron that is shaped by forging or rolling. Because of

its relatively low carbon content, wrought iron is tougher, more ductile, and
stronger in tension than cast iron.
yielding: The large deformation of a ductile material at the onset of failure.
301
Bibliography
Relevant Engineering Topics
Barsom, John M., and Stanley T. Rolfe. Fracture & Fatigue Control in
Structures: Applications of Fracture Mechanics. Englewood Cliffs, NJ: Prentice
Hall, 1987.
Dally, James W., and William F. Riley. Experimental Stress Analysis. New
York: McGraw-Hill, 1978.
Derucher, Kenneth N., George P. Korfiatis, and A. Samer Ezeldin. Materials

for Civil & Highway Engineers. Upper Saddle River, NJ: Prentice Hall, 1998.
Fisher, John W. Fatigue and Fracture in Steel Bridges. New York: John
Wiley, 1984.
Gordon, J. E. Structures: Or Why Things Don’t Fall Down. New York: Da

Capo, 1978.
Hibbeler, R. C. Mechanics of Materials. New York: Macmillan, 1994.
———. Statics & Dynamics. Upper Saddle River, NJ: Pearson Prentice
Hall, 2007.
———. Structural Analysis. Upper Saddle River, NJ: Prentice Hall, 1997.
Mindess, Sidney, J. Francis Young, and David Darwin. Concrete. Upper

Saddle River, NJ: Pearson, 2003.
Paz, Mario. Structural Dynamics: Theory & Computation. New York: Van
Nostrand, 1985.
Salvadori, Mario. Why Buildings Stand Up: The Strength of Architecture. New
York: Norton, 1980.
Shackelford, James F. Introduction to Materials Science for Engineers. Upper

Saddle River, NJ: Prentice Hall, 2000.
302
Bibliography
Terzaghi, Karl, and Ralph B. Peck. Soil Mechanics in Engineering Practice.

New York: John Wiley, 1967.
Construction Management and Project Delivery Systems
American Society of Civil Engineers. Quality in the Constructed Project: A

Guide for Owners, Designers, and Constructors. Reston, VA: ASCE, 2000.
Gould, Fred, and Nancy Joyce. Construction Project Management. Upper

Saddle River, NJ: Pearson, 2009.
Engineering Ethics
Fleddermann, Charles B. Engineering Ethics. Upper Saddle River, NJ:

Pearson, 2012.
Florman, Samuel C. The Civilized Engineer. New York: St. Martin’s

Press, 1987.
General Engineering Failures (Lesson 1)
Akesson, Bjorn. Understanding Bridge Collapses. New York: Taylor &

Francis, 2008.
Delatte, Norbert J. Beyond Failure: Forensic Case Studies for Civil Engineers.
Reston, VA: ASCE Press, 2009.
Levy, Matthys, and Mario Salvadori. Why Buildings Fall Down. New York:
Norton, 1992.
Petroski, Henry. Design Paradigms: Case Histories of Error and Judgment in

Engineering. New York: Cambridge University Press, 1994.
———. To Engineer Is Human: The Role of Failure in Successful Design. New

York: Vintage, 1992.
———. To Forgive Design: Understanding Failure. Cambridge, MA:

Belknap, 2012.
303
Bibliography
Wearne, Phillip. Collapse: When Buildings Fall Down. New York: TV

Books, 2000.
The Dee Bridge Failure (Lesson 2)
Gagg, Colin R., and Peter R. Lewis. “The Rise and Fall of Cast Iron in
Victorian Structures: A Case Study Review.” Engineering Failure Analysis 18,
no. 8 (2011): 1963–1980.
Lewis, Peter R., and C. R. Gagg. “Aesthetics versus Function: The Fall of the
Dee Bridge, 1847.” Interdisciplinary Science Reviews 29, no. 2 (2004): 177–191.
Simmons, J. L. A., and James Walker. “Report to the Commissioners of

Railways, by Mr. Walker Captain Simmons, R.E., on the Fatal Accident on
the 24th Day of May 1847, by the Falling of the Bridge over the River Dee,
on the Chester and Holyhead Railway; Together with Any Minutes of the
Commissioners Thereupon.” Railways Archive. December 1, 2008. https://
www.railwaysarchive.co.uk/docsummary.php?docID=1806.
Taylor, William M. “Iron, Engineering and Architectural History in Crisis:

Following the Case of the River Dee Bridge Disaster, 1847.” Architectural
Histories 1, no. 1 (2013): 1–13.
The Firth of Tay Bridge Failure (Lesson 3)
Board of Trade. “Report of the Court of Inquiry, and Report of Mr. Rothery,
upon the Circumstances Attending the Fall of a Portion of the Tay Bridge on
the 28th December 1879.” Railways Archive, https://www.railwaysarchive.
co.uk/docsummary.php?docID=107.
Lewis, Peter R., and Ken Reynolds. “Forensic Engineering: A Reappraisal

of the Tay Bridge Disaster.” Interdisciplinary Science Reviews 27, no. 4
(2002): 1–12.
Martin, T., and I. A. MacLeod. “The Tay Rail Bridge Disaster Revisited.”
Bridge Engineering 157, no. 4 (2004): 187–192.
Petroski, Henry. Engineers of Dreams: Great Bridge Builders and the Spanning
of America. New York: Knopf, 1995.
304
Bibliography
The Kemper Arena Roof Collapse (Lesson 4)
Goldberger, Paul. “Kansas City Arena Loses Roof in Storm.” The New York
Times, June 6, 1979.
The Cypress Street Viaduct Collapse (Lesson 5)
Hough, S. E., et al. “Sediment-Induced Amplification and the Collapse of the

Nimitz Freeway.” Nature 344 (1990): 853–855.
Nims, Douglas, et al. “Collapse of the Cypress Street Viaduct as a Result of

the Loma Prieta Earthquake.” University of California, Berkeley, Earthquake
Engineering Research Center Report UCB/EERC 89/16, November 1989.
The Sunshine Skyway Bridge Failure (Lesson 6)
National Transportation Safety Board. Marine Accident Report: Ramming

of the Sunshine Skyway Bridge by the Liberian Bulk Carrier Summit Venture,
Tampa Bay, Florida, May 9, 1980. Report NTSB-MAR-81-3. Washington
DC: NTSB, April 1981.
The Skagit River Bridge Failure (Lesson 6)
National Transportation Safety Board. Collapse of the Interstate 5 Skagit River

Bridge following a Strike by an Oversize Combination Vehicle, Mount Vernon,
Washington, May 23, 2013. Report NTSB/HAR-14/01. Washington DC:
NTSB, July 2014.
The Murrah Federal Building Bombing (Lesson 7)
Federal Emergency Management Agency. The Oklahoma City Bombing:

Improving Building Performance through Multi-hazard Mitigation. FEMA
Report 277. Washington DC: FEMA, August 1996.
Mlakar, Paul F., et al. “The Oklahoma City Bombing: Analysis of Blast
Damage to the Murrah Building.” Journal of Performance of Constructed
Facilities 12, no. 3 (1998): 113–119.
305
Bibliography
Sozen, Mete A., et al. “The Oklahoma City Bombing: Structure and
Mechanisms of the Murrah Building.” Journal of Performance of Constructed
Facilities 12, no. 3 (1998): 120–136.
The Kansas City Hyatt Regency Walkways Collapse (Lesson 8)
Bernhardt, Randall P. “Hyatt Regency Skywalk Collapse Remembered.”

Structure, August 2016, https://www.structuremag.org/?p=10274.
Marshall, R. D., et al. Investigation of the Kansas City Hyatt Regency Walkways
Collapse. National Bureau of Standards Building Science Series 143.
Washington DC: NBS, May 1982.
The Tacoma Narrows Bridge Failure (Lesson 9)
Billah, K. Yusuf, and Robert H. Scanlan. “Resonance, Tacoma Narrows

Bridge Failure, and Undergraduate Physic Textbooks.” American Journal of
Physics 59, no. 2 (1991): 118–124.
Buobopane, Stephen G., and David P. Billington. “Theory and History

of Suspension Bridge Design from 1823 to 1940.” Journal of Structural
Engineering 119, no. 3 (1993): 954–977.
Griggs, Frank. “Tacoma Narrows Bridge Failure 1940.” Structure (February

2022): 42–45.
Kawada, Tadaki. History of the Modern Suspension Bridge. Reston, VA: ASCE
Press, 2010.
Morgenthal, Guido. “Fluid-Structure Interaction in Bluff-Body Aerodynamics

and Long-Span Bridge Design: Phenomena and Methods.” University of
Cambridge Department of Engineering Technical Report No. CUED/D-
Struct/TR.187, August 2000.
Myerscough, Matthew. “Suspension Bridges: Past and Present.” The Structural

Engineer 91, no. 7 (2013): 12–21.
306
Bibliography
Washington State Department of Transportation. “People of the 1940

Narrows Bridge.” Tacoma Narrows Bridge History, https://www.wsdot.
wa.gov/TNBhistory/stories-1940-bridge.htm.
The Millennium Bridge (Lesson 10)
Dallard, P., et al. “The London Millennium Footbridge.” The Structural

Engineer 79, no. 22 (2001): 17–33.
Newland, David. “Vibration of the London Millennium Bridge: Cause

and Cure.” The International Journal of Acoustics and Vibration 8, no. 1
(2003). 3–8.
The John Hancock Center Failures (Lesson 11)
Campbell, Robert. “Builder Faced Bigger Crisis Than Falling Windows.” The
Boston Globe, March 3, 1995.
Connor, Jerome J. Introduction to Structural Motion Control. Upper Saddle

River, NJ: Pearson Prentice Hall, 2003.
Dupre, Judith. Skyscrapers. New York: Black Dog & Leventhal, 1996.
Lago, Alberto, Dario Trabucco, and Antony Wood. Damping Technologies for
Tall Buildings. Amsterdam: Elsevier, 2019.
Schwartz, Thomas A. “When Bad Things Happen to Good Buildings.”

Architecture Week. April 25, 2001. http://architectureweek.com/2001/0425/
building_3-1.html.
The Beauvais Cathedral Collapse (Lesson 12)
Courtenay, Lynn T. The Engineering of Medieval Cathedrals. London:

Routledge, 2016.
Eakin, Emily. “Cybersleuths Take On the Mystery of the Collapsing

Colossus.” The New York Times, October 27, 2001.
307
Bibliography
Mark, Robert. Experiments in Gothic Structure. Cambridge, MA: MIT

Press, 1984.
Mark, Robert, and William W. Clark. “Gothic Structural Experimentation.”

Scientific American 251, no. 5 (1984): 176–185.
Murray, Stephen. “The Choir of the Church of St.-Pierre, Cathedral of

Beauvais: A Study of Gothic Architectural Planning and Constructional
Chronology in Its Historical Context.” The Art Bulletin 62, no. 4 (2014):
533–551.
Wolfe, Maury I., and Robert Mark. “The Collapse of the Vaults of Beauvais
Cathedral in 1284.” Speculum 51, no. 3 (1976): 462–476.
The Ashtabula Bridge Collapse (Lesson 13)
Gasparini, D. A., and Melissa Fields. “Collapse of Ashtabula Bridge on

December 29, 1876.” Journal on the Performance of Constructed Facilities 7, no.
2 (1993): 109–125.
Griggs, Frank E. “Charles Macdonald.” Journal of Bridge Engineering 15, no. 5

(2010): 565–580.
Macdonald, Charles. “The Failure of the Ashtabula Bridge.” Transactions of

the American Society of Civil Engineers 6, no. 1 (1877).
The FIU Pedestrian Bridge Collapse (Lesson 14)
National Transportation Safety Board. Pedestrian Bridge Collapse over SW 8th

Street, Miami, Florida, March 15, 2018. Highway Accident Report NTSB/
HAR-19/02. Washington DC: NTSB, October 2019.
US Department of Labor, Occupational Safety and Health Administration,

Directorate of Construction. Investigation of March 15, 2018 Pedestrian Bridge
Collapse at Florida International University, Miami, FL. Report prepared by
Mohammad Ayub. Washington DC: OSHA, July 2019.
308
Bibliography
The Ronan Point Collapse (Lesson 15)
Griffiths, Hugh, Alfred Pugsley, and Owen Saunders. Report of the Inquiry
into the Collapse of Flats at Ronan Point, Canning Town. London: Her
Majesty’s Stationery Office, 1968.
The Great Boston Molasses Flood (Lesson 16)
Brown, Burtis. “Details of the Failure of a 90-Foot Molasses Tank.”

Engineering News-Record 20, no. 20 (1919): 974–976.
Mayville, Ronald A. “The Great Boston Molasses Tank Failure of 1919.” Civil
+ Structural Engineer Media. September 1, 2014. https://csengineermag.com/
the-great-boston-molasses-tank-failure-of-1919/.
Puleo, Stephen. Dark Tide: The Great Boston Molasses Flood of 1919. Boston:
Beacon Press, 2019.
Schworm, Peter. “Nearly a Century Later, Structural Flaw in Molasses Tank

Revealed.” The Boston Globe, January 14, 2015.
The Silver Bridge Collapse (Lesson 17)
National Transportation Safety Board. Collapse of U.S. 35 Highway Bridge,

Point Pleasant, West Virginia, December 15, 1967. NTSB/HAR-71/01.
Washington DC: NTSB, 1971.
Passaglia, Elio. A Unique Institution: The National Bureau of Standards,

1950–1969. NIST Special Publication 925. Washington DC: US Department
of Commerce, 1999.
Fatigue Cracking in the Yellow Mill Pond Bridge (Lesson 17)
Fisher, John W., and Sougata Roy. “Fatigue Damage in Steel Bridges and
Extending Their Life.” Advanced Steel Construction 11, no. 3 (2015): 250–268.
309
Bibliography
Kwon, Kihyon, and Dan M. Frangopol. “Bridge Fatigue Assessment and

Management Using Reliability-Based Crack Growth and Probability of
Detection Models.” Probabilistic Engineering Mechanics 26, no. 3 (2011):
471–480.
The Tower of Pisa (Lesson 18)
Burland, J. B., et al. “The Leaning Tower of Pisa.” In Geotechnics and

Heritage, edited by Bilotta, Flora, Lirer, and Viggiani, 207–227. London:
Taylor & Francis, 2013.
Burland, J. B., M. Jamiolkowski, and C. Viggiani. “The Stabilisation of the

Leaning Tower of Pisa.” Soils and Foundations 43, no. 5 (2003): 63–80.
The Teton Dam Failure (Lesson 19)
King, Hobart M. “Tuff.” Geology.com, https://geology.com/rocks/tuff.shtml.
Seed, H. B., and J. M. Duncan. “The Teton Dam Failure: A Retrospective

Review.” In Soil Mechanics and Foundation Engineering: Proceedings of the
10th International Conference on Soil Mechanics and Foundation Engineering.
Rotterdam: A.A. Balkema, 1981.
US Department of the Interior, Teton Dam Failure Review Group. Failure

of Teton Dam: Final Report. Washington DC: US Department of the
Interior, 1980.
The Senior Road Tower Collapse (Lesson 20)
US District Court for the Southern District of Texas. “Channel 20, Inc.
v. World Wide Towers Services, Inc., 607 F. Supp. 551 (S.D. Tex. 1985).”
Justia. May 6, 1985. https://law.justia.com/cases/federal/district-courts/
FSupp/607/551/2371003/.
310
Bibliography
The L’Ambiance Plaza Collapse (Lesson 20)
Culver, Charles G., et al. Investigation of L’Ambiance Plaza Building Collapse

in Bridgeport, Connecticut. National Bureau of Standards Report NBSIR 87-
3640. Washington DC: US Department of Commerce, September 1987.
The Mianus River Bridge Collapse (Lesson 21)
Balakrishna, Chandana C., and Daniel G. Linzell. “Examination of Steel Pin

and Hanger Options: Retrofit to Replacement.” In Structures Congress 2017.
Reston, VA: ASCE, 2017.
National Transportation Safety Board. Highway Accident Report: Collapse

of a Suspended Span of Interstate Route 95 Highway Bridge over the Mianus
River, Greenwich, Connecticut, June 28, 1983. Report NTSB/HAR-84/03.
Washington DC: NTSB, 1984.
The Space Shuttle Challenger Disaster (Lesson 22)
McDonald, Allan J. Truth, Lies, and O-Rings: Inside the Space Shuttle
Challenger Disaster. Gainesville, FL: University Press of Florida, 2018.
Rogers, William P., et al. Report to the President by the Presidential Commission
on the Space Shuttle Challenger Accident. Washington DC: Presidential
Commission on the Space Shuttle Challenger Accident, 1986.
The Chernobyl Nuclear Power Plant Explosion (Lesson 23)
International Nuclear Safety Advisory Group. INSAG-7: The Chernobyl

Accident—Updating of INSAG-1. Vienna: INSAG, 1992.
Mahaffey, James. Atomic Accidents: A History of Nuclear Meltdowns and

Disasters from the Ozark Mountains to Fukushima. New York: Pegasus, 2014.
Plokhy, Serhii. Chernobyl: The History of a Nuclear Catastrophe. New York:

Hachette Audio, 2018.
311
Bibliography
The Macondo Blowout (Lesson 24)
Boebert, Earl, and James M. Blossom. Deepwater Horizon: A Systems Analysis

of the Macondo Disaster. Cambridge, MA: Harvard University Press, 2016.
Shroder, Tom, and John Konrad. Fire on the Horizon: The Untold Story of the
Explosion aboard the Deepwater Horizon. New York: Harper Audio, 2011.
Turley, J. A. From the Podium: The Cause of BP’s Macondo Blowout. Littleton,
CO: The Brier Patch, 2012.
The Boeing 737 Crashes (Lesson 25)
Langewiesche, William. “What Really Brought Down the Boeing 737 Max?”
The New York Times Magazine, September 18, 2019.
Robinson, Peter. Flying Blind: The 737 MAX Tragedy and the Fall of Boeing.
New York: Random House Audio, 2021.
Simons, Graham M. Boeing 737: The World’s Most Controversial Commercial

Jetliner. Philadelphia: Air World, 2020.
The Failure of the New Orleans Hurricane Protection System

(Lesson 26)
Andersen, Christine F., et al. The New Orleans Hurricane Protection System:
What Went Wrong and Why. Reston, VA: ASCE, 2007.
Brinkley, Douglas. The Great Deluge: Hurricane Katrina, New Orleans, and
the Mississippi Gulf Coast. New York: Harper Audio, 2006.
Freudenburg, William R. Catastrophe in the Making: The Engineering of

Katrina and the Disasters of Tomorrow. Houston: Audible Studios, 2013.
Link, Lewis E., et al. Performance Evaluation of the New Orleans and Southeast
Louisiana Hurricane Protection System: Draft Final Report of the Interagency
Performance Evaluation Task Force. Washington DC: US Army Corps of
Engineers, 2006. https://www.loc.gov/item/2006618548/.
312
Bibliography
Mlakar, Paul F. “The Behavior of Hurricane Protection Infrastructure in

New Orleans.” The Bridge: Linking Engineering and Society 36, no. 1. (2006):
14–20.
Rogers, J. David. “History of the New Orleans Flood Protection System.” In

Investigation of the Performance of the New Orleans Flood Protection Systems
in Hurricane Katrina on August 29, 2005. Independent Levee Investigation
Team. July 31, 2006.
Image Credits
iv: Library of Congress, Prints and Photographs Division, Xurzon/iStock/Getty Images
Plus; 4: Federal Emergency Management Agency/Wikimedia Commons/Public Domain;
12: The Illustrated London News (1847)/Wikimedia Commons/Public Domain, Robert
Stephenson. Engraving by D. J. Pound, 1860, after J. Mayall/Wellcome Library, London/
CC BY 4.0; 22: Peterrhyslewis/Wikimedia Commons/Public Domain; 23: National
Library of Scotland/Wikimedia Commons/Public Domain; 26: Illustrated London News
(1877)/Wikimedia Commons/Public Domain; 33: Garrett Fuller/Wikimedia Commons/
CC BY-SA 4.0; 34: Maps Data: Google@2022 Landsat/Copernicus; 41: H.G. Wilshire/
United States Department of the Interior United States Geological Survey; 52: Gary
Leavens/flickr/CC BY-SA 2.0; 56: Martha T/Wikimedia Commons/CC BY 2.0; 61:
FEMA News Photo/Wikimedia Commons/Public Domain; 72: Archaeodontosaurus/
Wikimedia Commons/Public Domain; 80: Danforth, Bald & Co./Wikimedia Commons/
Public Domain; 82: Brooklyn Museum/Public Domain; 92: Tristan Surtel/Wikimedia
Commons/CC BY-SA 4.0; 102: Werner Kunz/Wikimedia Commons/CC BY-SA 2.0;
113: Nadar/Wikimedia Commons/Public Domain; 114: GoodLifeStudio/iStock/Getty
Images Plus; 123: University of Toronto/Internet Archive; 124: Carter, Charles Frederick./
Wikimedia Commons/Public Domain, National Archives and Records Administration;
125: Library of Congress, Prints and Photographs Division; 144: Derek Voller geograph.org.uk/
Wikimedia Commons/CC BY-SA 2.0; 153: Boston Public Library/Wikimedia Commons/
Public Domain; 168: nimis69/E+/Getty Images Plus; 172: Saffron Blaze/Wikimedia
Commons/CC BY-SA 3.0; 174: Deryck Chan/Wikimedia Commons/CC BY-SA 4.0;
179: WaterArchives.org/Wikimedia Commons/CC BY-SA 2.0; 190: Nikonlike/iStock/
Getty Images Plus; 196: Library of Congress, Prints and Photographs Division; 206:
National Aeronautics and Space Administration/KSC; 212: NASA/Wikimedia Commons/
Public Domain; 217: IAEA Imagebank/Wikimedia Commons/CC BY-SA 2.0; 225:
AFS 86/Wikimedia Commons/CC BY-SA 4.0; 229: National Archives and Records
Administration; 230: user/Wikimedia Commons/CC BY; 241: PK-REN/Wikimedia
Commons/CC BY; 253: NASA/Wikimedia Commons/Public Domain
313
Copyright © The Teaching Company, 2022
Printed in the United States of America
This book is in copyright. All rights reserved.
Without limiting the rights under copyright reserved above,

no part of this publication may be reproduced, stored in or
introduced into a retrieval system, or transmitted, in any
form, or by any means (electronic, mechanical, photocopying,
recording, or otherwise), without the prior written permission of
The Teaching Company.
4840 Westfields Boulevard, Suite 400

Chantilly, VA 20151‑2299
USA
1-800-832-2412
www.thegreatcourses.com

DG10130 9X2H4N

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

DG10130 9X2H4N

Uploaded by

Copyright:

Available Formats

Topic Subtopic

Science Engineering & Technology

Epic Engineering Failures

EDITORIAL & DESIGN SERVICES

About Stephen Ressler . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . i

1 Learning from Failure: Three Vignettes . . . . . . . . . . . . . . . . . . . 3

2 Flawed Design Concept: The Dee Bridge . . . . . . . . . . . . . . . . . . 11

3 Wind Loading: The Tay Bridge . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

4 Rainwater Loading: Kemper Arena . . . . . . . . . . . . . . . . . . . . . . . 32

5 Earthquake Loading: The Cypress Structure . . . . . . . . . . . . . . 40

6 Vehicle Collisions: Land and Sea . . . . . . . . . . . . . . . . . . . . . . . . 51

7 Blast Loading: The Murrah Federal Building . . . . . . . . . . . . . . 60

8 Structural Response: The Hyatt Regency Walkways . . . . . . . 69

9 Bridge Aerodynamics: Galloping Gertie . . . . . . . . . . . . . . . . . . 79

10 Dynamic Response: London’s Wobbly Bridge . . . . . . . . . . . . . 91

17 Stress Corrosion: The Silver Bridge . . . . . . . . . . . . . . . . . . . . . 161

Engineering is the application of math, science, technology, and experience

In this course, you will explore 33 examples of engineering failures ranging

1 All these failures occurred because one or more aspects of the

2 These failures demonstrate that engineering is a fundamentally human

3 These case studies demonstrate that engineering failures often result

enable further technological advances. In this sense, failure is integral to

Because every engineering failure results from one or more breakdowns in

` a fundamentally flawed design concept;

` failure to properly account for particular types of loading;

` unanticipated structural responses;

` inadequate resistance of structural members, connections, and foundations;

` flawed construction technologies; or

The Hyatt Regency

This disaster was caused primarily by organization and communication

The Dee Bridge Collapse

The Engineering Process

` Every engineering challenge begins with a need. In the Hyatt Regency

` PHASE 1: In response to this need, the engineer develops a design

` PHASE 2: The designer estimates the loads—the maximum forces the

` PHASE 3: When loads are applied to a structure, they cause a response,

The design engineer analyzes the structural response to calculate the

` PHASE 5: The design consists of a set of plans and specifications

Our understanding of an engineering failure can be enhanced by considering

shortcoming in phase 4. However, there were also significant contributing

` The Hyatt Regency disaster resulted from organizational dysfunction

Failure Stimulates Development

Nonetheless, such failures invariably stimulate the development of new

` After the Dee Bridge disaster, British engineers instituted substantially

` After the Hyatt Regency walkway collapse, the US engineering profession

` After Hurricane Katrina, the US Army Corps of Engineers improved their

The Dee Bridge Disaster

The steam locomotive was invented in 1802, but

The Dee Bridge Girders

A girder is a main load-carrying beam in a structural system. A beam is a

due to the repetitive, dynamic nature of railroad loading. Today, we recognize

Recognizing this vulnerability, Stephenson added the wrought-iron eyebar

railway was temporarily closed as Stephenson supervised the placement of a

Focusing on load estimation, Stephenson designed the Dee Bridge to carry

The wheels of a steam locomotive are driven by a pair of pistons, enclosed

Estimated Vehicular Load

First, Stephenson’s estimated vehicular load didn’t account for hammer

The Fatal Flaw

Note that the general concept of using tension reinforcement to strengthen

In summary, Stephenson’s Dee Bridge design was fatally compromised by

Two months later, Her Majesty’s Government established the Royal

Second, this case is typical of most engineering failures in that it resulted

The Tay Bridge Collapse