Important

notice
As the registered person who downloaded this file from
www.istructe.org, a non-transferable, non-exclusive licence
to access its content has been granted to you.

A record of your download has been retained by the Institution.

Reproduction or transmission (electronically or otherwise) of all

or part of the content is prohibited.

Unless the licensee is a registered member of the IStructE’s Academic

Community, storing all or part of the content (electronically or
otherwise) in any form of multi-user repository is prohibited.

Registered members of the IStructE’s Academic Community

may store the content in their institution’s repository. The content
may also be used by these registered members for teaching purposes
only (e.g. course/lecture materials).

Any infringement of the terms of this licence may result in legal action.

Licence agreement - NWM - free V1

Essential Knowledge Series
Essential Knowledge Text No. 5

Lessons from
failures

Allan Mann

Production supported by:

Lessons from failures

Acknowledgements
Author
Allan Mann FREng PhD BSc(Eng) FIStructE

Reviewers
David Brohn PhD CEng FIStructE (E-Training Systems Ltd)
Bill Harvey BSc PhD CEng FIStructE FICE (Bill Harvey Associates Ltd)
Bob Lark BSc(Eng) ACGI PhD CEng FICE (Cardiff University)

Series Editor
Graham Owens FREng FIStructE CEng MSc PhD DIC FRSA

Permissions
Photographs and other digital imagery are supplied/reused courtesy of the following:

Figure 1.1 United States Coast Guard (public domain)

Figure 3.1 © PA
Figure 3.2 © PA
Figure 4.1 © PA
Figure 5.1 © PA

Published by:
The Institution of Structural Engineers
47–58 Bastwick Street
London EC1V 3PS
United Kingdom
T: +44(0)20 7235 4535
E: [email protected]
W: www.istructe.org

First published: April 2016

This version (1.0) published: April 2016

© 2016 Allan Mann (pre-publication version) and published under a non-exclusive licence by
The Institution of Structural Engineers

The Institution of Structural Engineers and those individuals who contributed to this Essential Knowledge Text have
endeavored to ensure the accuracy of its contents. However, the information presented should always be reviewed by those
using the Text in the light of the facts of their particular case and specialist advice obtained as necessary. No liability for
negligence or otherwise in relation to this Text and its contents is accepted by the Institution, the author, the reviewers, their
servants or agents.

No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means
without prior permission of The Institution of Structural Engineers, who may be contacted at 47–58 Bastwick Street,
London EC1V 3PS, United Kingdom.
 Lessons from failures

Contents
Synopsis2
Terminology and definitions 3
1. Introduction 4
2. Safety 6
3. History 9
4. Design and construction failures 11
4.1 Introduction 12
4.2 Concept/feasibility/safety concept 12
4.3 Structural design 12
4.4 Detailing 13
4.5 Construction 14
4.6 Structure in use 14
4.7 Conclusion 15
5. Materials 16
5.1 Introduction  17
5.2 Causes 17
5.3 Steel corrosion 17
5.4 Concrete degradation 17
5.5 Conclusion 19
6. Fire 20
7. Human error 23
7.1 Introduction 24
7.2 Human error in civil engineering  25
8. Natural disasters 26
9. Man-made disasters 29
10. Overall lessons and how to avoid failures 32
10.1 Introduction 33
10.2 Overall lessons 33
10.3 Avoiding failures 33

The Institution of Structural Engineers Essential Knowledge Text No. 5   1

Lessons from failures

Synopsis
Failures happen and their causes are many. Some are avoidable. Others, consequent on natural
disaster, may be unavoidable. However, as a group, failures are not just ‘accidents’. There are
common themes and, by studying them, we can learn to minimise the risk of repeats, which is our
duty in the cause of ‘safety’.

2   The Institution of Structural Engineers Essential Knowledge Text No. 5

 Lessons from failures

Terminology and
definitions
Safety A very wide ranging term. Intuitively we all Consequence In judging what is acceptable,
know what ‘being safe’ means, but academically consequences have to be considered. For example,
it can have a number of interpretations. It often those of an agricultural shed falling down may be
means a structure must not fail badly under defined relatively insignificant, but the consequences of
loading/operating conditions. a dam failing are frightful. Hence a higher safety
Limit states A general term to define various margin (and more cost) is appropriate.
modes of failure that have to be considered: Robustness A descriptive term which means
strength, deformation, fatigue, corrosion etc. structures should not fail catastrophically if a minor
Common limit states are: part fails.
• Ultimate limit state The maximum strength Safety factor A term related to the numerical
of the structure assessment of strength. Historically, permissible
• Serviceability limit state A limit normally set stresses were defined as yield stress/safety factor.
This is not the same as the current terminology
by a tolerable deformation
of ‘load factor’, because ultimate strength can be
Acceptance criterion A term to describe what computed taking account of a structure’s plastic
might be acceptable at the limit state. In normal capacity.
circumstances, a structure must not show signs of
failure but, in extreme circumstances, significant Load factor A numerical margin applied to defined
deformation short of collapse might be acceptable. loads. It is used to check structural ultimate capacity.
The performance of a car park crash barrier is The factor varies according to how uncertain the
one example. Another is that, under earthquake loads (or their combinations) might be.
loading, we would accept significant controlled Instability A gross change in state, consequent on
deformation. a minor event.

The Institution of Structural Engineers Essential Knowledge Text No. 5   3

Introduction
By the end of this section, the reader will appreciate the scale of what can go wrong.

4   The Institution of Structural Engineers Essential Knowledge Text No. 5

 Lessons from failures

‘Failure’ might imply that a structure has collapsed, perhaps causing death and almost certainly costing
a great deal of money. Other failures might be due to serviceability issues or involve asset loss over time
due to degradation.

Structural engineers have always considered it their duty to make structures ‘safe’, certainly avoiding
collapse. But wider concepts of safety exist and might be summarised as making structures ‘safe to
build’,‘safe in service’ and ‘safe to operate’. Mere code compliance is insufficient to meet such objectives.
In reality, there are all sorts of uncertainties to deal with and achieving safety is about managing risk.

No profession particularly likes to think about its failures. But many failures do occur — both large and
small — and some are absolutely catastrophic. The failure of the Deepwater Horizon oil platform in 2010
(Figure 1.1) is an example.

Figure 1.1: Deepwater Horizon platform, Gulf of Mexico

BP estimated its total costs for the disaster at $54.6 billion; the environmental impacts were huge,
the damage to the company’s image humiliating and the fines levied colossal1.1.

Failures do not necessarily come about from folly; nor do they come about through minor infringement
of code rules. Reasons are often much more complex and often several negative factors combine.
However, failures are not just ‘accidents’. If we do not learn from them we may well end up making
the same mistakes. Equally, we need not be overly pessimistic. The vast majority of structures perform
perfectly well, and that feedback should give us confidence that common design rules do work.

References
1.1 CNN Money (2015) BP settles final Gulf oil spill claims for $20 billion [online] Available at:
money.cnn.com/2015/10/06/news/companies/deepwater-horizon-bp-settlement
(Accessed: 31 March 2016)

The Institution of Structural Engineers Essential Knowledge Text No. 5   5

Safety
By the end of this section, the reader will have some understanding of what makes
structures safe.

6   The Institution of Structural Engineers Essential Knowledge Text No. 5

 Lessons from failures

Structural engineers are responsible for the design of all manner of complex structures, from long span
bridges to nuclear power stations. Failure of the former would cost vast sums of money, while failure of
the latter could be devastating on a human/environmental level (in addition to the financial cost) so we
need such structures to be ‘safe’. As a society, we have inherited a vast amount of infrastructure — much
of it degraded — yet we are not at liberty just to scrap and rebuild. Hence we often have the task of
deciding if a structure is ‘safe enough’.

Historically, the concept of ‘stress’ was a major breakthrough in our ability to describe structural behaviour.
Recognising uncertainty, it allowed engineers to introduce a margin between what they thought a
structure’s capacity was and what they thought its likely stress states were in service. That margin was
first formalised as a safety factor. Very early on it was realised that the approach was unsatisfactory since
certain materials, such as cast iron, failed unpredictably, while other more ductile materials (with equal
safety factors) simply deformed in a controlled manner when overloaded and were thus ‘safer’. It was also
realised that actual stresses varied considerably from theory, and what really mattered was a structure’s
ultimate strength rather than its perceived maximum stress at any point in time.

A review of failures confirms that linking safety to safety factors alone, or even to ultimate strength will
still not be good enough. The sinking of the Titanic remains one of world’s largest maritime disasters.
But it was not the hull’s safety factor that was inadequate. Sinking came about by a combination of
events: partly through human error, technically because the mode of failure had not been anticipated,
and because the structural response was not what the designers expected (more than one watertight
compartment punctured). The failure also highlights the need to consider ‘consequences’ and that the
safety we build in has somehow to be linked to what might happen if the structure fails. There is no
absolute value of safety; only an appropriate level — linked to the probability of the hazards that might
apply, to confidence in the design and to consequences of failure.

In 1968, the Ronan Point block of flats in London failed spectacularly. A gas explosion blew out a wall
panel initiating a ‘pack of cards’ type failure; it was a classic case of instability defined as a gross change
in state consequent on some minor event. Stability is a separate attribute to strength and, to be safe,
a structure has to be both strong enough and stable enough. Ronan Point also highlighted the need
for another desirable safety attribute, ‘robustness’, which is a quality hard to define but conceptually it
means that no structure should fail grossly, consequent on minor damage.

The modern approach is to consider that any structure is subject to a range of hazards (subdivided
perhaps into different levels of probability), and for each there are various ‘limit states’ to achieve and for
each of those states an acceptance criterion that has to be defined. Such criteria are not absolute; they
can vary according to the probability of the hazard and the significance of the consequences. Thus, for
example, under normal loading, deflection might be restricted, while under earthquake loading it might
not. Under normal loading, the structure might be required to achieve a prescribed load factor, while
under extreme loading it might only be required not to collapse.

Key structural safety attributes might be defined as:

• Understanding the hazards and associated uncertainties that might apply, and defining what
constitutes ‘failure’ against the various hazards

• Defining the various modes of failure that might exist

• Being able to sustain applied loads with a margin that reflects the uncertainty of the applied
loading

• Being stable enough in all stages of construction and throughout life

• Being stiff enough to fulfil operational requirements

The Institution of Structural Engineers Essential Knowledge Text No. 5   7

Lessons from failures

• Assuring structures are robust enough

• Assuring structures are ductile enough

• Design and detailing such that structures can achieve an adequate ‘ultimate strength’ and display
the essential deformation characteristics to achieve that strength

• Being confident that what was intended to be built was actually built

• Assuring that materials used will not degrade throughout life to an extent prejudicing safety or
requiring exceptional maintenance

• Guarding against the role of human error in design, construction and service

Collectively, these attributes ought to assure that a structure will perform satisfactorily in service and, in
the event of something unforeseen, will display adequate warnings of danger in advance of complete
failure.

8   The Institution of Structural Engineers Essential Knowledge Text No. 5

History
Here, the reader will gain some understanding of major historical disasters.

The Institution of Structural Engineers Essential Knowledge Text No. 5   9

Lessons from failures

An obvious question, is how high profile structures could possibly fail when their design and
construction teams must have been highly competent? We might presume that with sophisticated skills
in analysis and a detailed understanding of materials and structures, the risks of failure ought nowadays
to be minimal. But that hope is not borne out by evidence. One reason is that we are currently much
more innovative and adventurous, and doing anything new brings with it the possibility of error. The
answer also lies in human behaviour; lessons are not learned from the past, people and teams remain
fallible and far too often there are commercial pressures which dominate at the expense of a careful, safe
approach. Such pressures were contributory to the failure at Heathrow in 1994 (described later) and the
failures illustrated in Figures 3.1 and 3.2.

Figure 3.2: Fukushima nuclear disaster (2011)

Figure 3.1: Piper Alpha tragedy (1988)

Fig. 3.1 depicts the catastrophic failure of a North Sea drilling platform following an explosion and fire.
167 workers died. The subsequent Cullen Enquiry made in excess of 100 recommendations to improve
safety procedures.

Fig. 3.2 shows a small part of the aftermath of the massive earthquake and tsunami that struck the
east coast of Japan in 2011, causing three meltdowns at the Fukushima Daiichi Nuclear Power Plant.
The reactors were damaged and critical cooling systems disabled. The concrete ponds containing
water‑covered spent fuel cracked, allowing the fuel to become uncovered and overheated.

By any definition, all three events: Heathrow, Piper Alpha and Fukushima, are catastrophes. There have
been many more.

10   The Institution of Structural Engineers Essential Knowledge Text No. 5

Design and
construction
failures
Here, the reader is introduced to a set of failures directly related to design and
construction activities.

The Institution of Structural Engineers Essential Knowledge Text No. 5   11

Lessons from failures

4.1 Introduction
The length of time between project conception and completion can be significant, often involving large
teams and specialists from several disciplines, all interacting with each other. Even the smallest project
can involve architects, civil and structural engineers, services engineers and contractors. Opportunities
for confusion are many and, in any conference on failures, an underlying theme of ‘miscommunication’
invariably recurs. It is the norm for design changes to be made, and every time that happens, the
possibility of some unfortunate consequence is potentially overlooked.

We can make progress by observing what has gone wrong elsewhere. It is instructive to examine each of
the major stages of projects and look at failure examples within each. These might be:

• Concept/feasibility/safety concept

• Structural design

• Detailing

• Construction

• Structure in use

4.2 Concept/feasibility/safety concept

A large number of disputes arise in construction. Their existence is proof enough of misconception
between the aspirations of those who conceive projects and those entrusted with carrying them out.

A fundamental error exists when proper attention is not given to stiffness because a lack of stiffness
is hard to rectify. Errors might manifest themselves as problems on architectural finishes, via floor
displacement or, in extreme cases, via excess dynamic response. When the Empire State Building was
erected, its sway was such that occupants complained of motion sickness. The Tacoma Narrows bridge
shook violently4.1. The prize‑winning John Hancock Tower, Boston, (1976) swayed so much that its
windows cracked. In recent times, the Millennium Bridge had to be closed on opening day when crowd
use caused too much motion.

It is never too early to have project clarity and a definition of key functional safety demands or the
principal hazards that might apply. A prime example would be that of the Tasman Bridge (1975), when
a large carrier collided with parts of the high level bridge, precipitating collapse of the central deck. A
number of people were killed. The hazard of impact by shipping should have been given more attention.

4.3 Structural design

Structural design includes the tasks of concept, analysis, member design and assuring buildability. Errors
can occur at any stage. In some cases, the designers just ‘got it wrong’ e.g. the Ramsgate Walkway4.2. The
walkway was part of an articulated structure from the dockside edge. It collapsed killing six people and
seriously injuring more. Part of the cause was faulty design of a base extension pivot which was short and
stubby. Designers assumed it to be in pure shear whereas, in reality, the arms were short cantilevers with
connection interfaces in both shear and bending. That difference resulted in a huge additional elastic
stress and therefore a dramatically reduced fatigue life. There was a concept error: it was just a mistake.

Dramatic cooling tower failures occurred at Ferry Bridge Power Station, UK in 1965. The cause is often
attributed to wind funnelling through the tower group. However, cooling towers are theoretically pure
shell structures subject to plane membrane stress and these towers were analysed and reinforced as

12   The Institution of Structural Engineers Essential Knowledge Text No. 5

 Lessons from failures

such. Unfortunately towers cannot be constructed perfectly and any unevenness in the shell wall creates
local bending. If the shell has only a single layer of reinforcement (commensurate with plane membrane
assumptions), it has no resistance against bending — and that lack of bending capability was a crucial
weakness in this case. Modern shell walls have two layers of rebar.

Even more dramatic was the failure of the Sliepner offshore platform in 1991. It occurred because a
mistake was made in the Finite Element Analysis resulting in underwater cell walls being severely
overstressed and failing in shear. The massive structure sank during installation, with losses of up to
$700 million. There are dangers in being overly reliant on computers and not deploying the skills of
cross‑verification by simple statics.

It is also essential to give due consideration to overall stability, as a failure of the school at Rock Ferry
near Liverpool proved in 19764.3. The structural form included standard trussed rafters supported on
masonry side walls. The roof collapsed, primarily because it contained no adequate bracing. Looking
at the structure as a whole, there were no clear load paths for transfer of lateral wind load to ground. It
is unknown if the wall designers assumed their walls were propped via the roof, or the roof designers
assumed their roof was propped via the walls. A lesson from this and similar failures is that there should
be one party in overall charge of stability and robustness.

4.4 Detailing
Steel structure performance is largely governed by connection capacity, and all concrete components
depend on successful detailing. In most structures, connections are the weak link (the previously
mentioned Ramsgate failure took place at connections). The crucial importance of detailing within the
structural engineering package can be observed from the failure at Charles de Gaulle Airport (Figure 4.1).

Figure 4.1: Shell roof at Charles de Gaulle Airport, Paris, France (2004)

The Institution of Structural Engineers Essential Knowledge Text No. 5   13

Lessons from failures

This was the showcase airport for Paris. One morning, part of Terminal 2E collapsed completely, killing
four people4.4. The airport’s terminal building had a very novel form; the inner 300mm precast concrete
shell supported thrusts from metal posts installed to support outer glazing. Failure was caused by these
posts punching through the inner concrete, perhaps because they were embedded too deeply, perhaps
because of construction misalignments. Signs of trouble had been evident before the final failure, with
some concrete spalling off.

4.5 Construction
In many ways, the construction phase of any project is the riskiest — a view borne out by the sheer
number of reported cases. There are reasons for this. Firstly, main designers tend to assess stresses
and stability in structures as finally completed. While understandable as a starting point, this approach
neglects that structures must be assembled piece by piece and, during that stage, will necessarily be
in varying states of incomplete stability and carrying loading not matched by final load. Finally, there is
always a need to verify that what has been built matches what the designer thought was being built:
obvious, but numerous failures show this is not always achieved.

An illustration of construction loading and stability can be seen from the failure of the West Gate Bridge
in Melbourne, Australia (1970)4.5,4.6. This was a long box girder bridge. To erect the boxes they were split
down their middle, with the intent of rejoining on site at their longitudinal seam. Thus during erection,
the strength and stability of the half sub-units differed substantially from their fully assembled state.
During construction, the two sides of the boxes did not marry due to some plate buckling. Collapse
was initiated by erectors removing bolts from the upper flange splice to try and correct the buckle and
achieve fit. This was the technical failure cause. Nevertheless, the inquiry afterwards heavily criticised
the designers for having failed to give proper consideration to erection proposals, which highlights the
importance of communication between parties.

Box girder bridges represented a significant improvement in bridge design. Yet when first introduced,
there were some spectacular collapses in Germany and the UK, as well as Australia. All failures occurred
during erection, partly because temporary stress and stability conditions were not appreciated, but also
because the complex theory of plate buckling was imperfectly understood.

4.6 Structure in use

Charles de Gaulle airport failed after about one year. One of the worst building disasters of modern times
occurred in 2013 in Dhaka, Bangladesh, when an entire multi-storey factory failed in use, killing more
than 1,000 workers. Reports suggest that structural cracks had previously developed but been ignored,
the owners had reassured the workers over safety so the workers remained inside. Failure seems to have
been linked to gross overloading by the building of illegal storeys, with damage perhaps exacerbated
by machinery vibration. Despite these clear contraventions, by any standards the structure was not
‘robust’, and its mode of failure was of a type that could have been avoided if the lessons from the UK’s
Ronan Point collapse had been implemented. Bangladesh might seem a ‘one off’, attributable to criminal
negligence, but it bears similarities to the failure of the Sampoong Department Store in Korea (1995)
where almost instantly, 1,500 people became trapped and 502 were killed. This failure was initiated by
flat slab shear perimeter puncturing, made all the more inevitable by misplaced rebar and foolish site
modifications. Collectively, the structure was overloaded, weakened and had a faulty design.

These failures illustrate the absolutely crucial role of detailing. A structure is only as strong as its weakest
link and no amount of sophisticated analysis will compensate for joint weaknesses or poorly arranged
reinforcement. These defects represent a mismatch between theory and reality.

14   The Institution of Structural Engineers Essential Knowledge Text No. 5

 Lessons from failures

4.7 Conclusion
Particular attention should be paid to the following:

• A need to identify all the hazards that might apply, the possible modes of failure and potential
unserviceability conditions

• A need to clearly identify load paths and stability systems and provide robustness

• Interim construction loading and stability cases might be critical

• The role of imperfections and practicalities of construction

• The key role of detailing

• To be sure that what was intended to be built is actually built

• To control ‘change’

• Never ignore warning signs of distress

• The need for a person/persons having overall responsibility for the whole structure, especially if
component design is delegated

References
4.1 YouTube (2006) Tacoma Narrows Bridge Collapse “Gallopin’ Gertie” [online] Available at:
www.youtube.com/watch?v=j-zczJXSxnw (Accessed 4 April 2016)
4.2 Chapman, J.C. (1998) ‘Collapse of the Ramsgate Walkway’, The Structural Engineer, 76(1), pp. 1–10
4.3 Menzies, J.B. and Grainger, G.D. BRE Current Paper CP 69/76: Report on the collapse of the Sports Hall
at Rock Ferry Comprehensive School, Birkenhead, Garston: BRE, 1976
4.4 Wood, J.G.M. (2005) ‘Paris Airport terminal collapse: lessons for the future’, The Structural Engineer,
83(5), pp. 13–14
4.5 YouTube (2014) West Gate Bridge Collapse – 15 October 1970 [online] Available at:
www.youtube.com/watch?v=HpouRX5SjVA (Accessed 4 April 2016)
4.6 The WestGate Bridge Memorial (2016) Report of Royal Commission into the failure of West Gate Bridge
[online] Available at: www.westgatebridge.org/sites/default/files/downloads/report-of-royal-
commission.pdf (Accessed 6 April 2016)

The Institution of Structural Engineers Essential Knowledge Text No. 5   15

Materials
By the end of this chapter, the reader will understand the influence of material
degradation on major failures.

16   The Institution of Structural Engineers Essential Knowledge Text No. 5

 Lessons from failures

5.1 Introduction
With care and proper detailing, building materials last. There are wooden structures hundreds of years
old and brick structures thousands of years old. Safety requires an understanding of what may happen
to materials, allied with an ability to understand degradation processes and linked rates of change in key
properties.

There are many estimates of the corrosion costs to national budgets, and suggestions that total costs are
a noticeable percentage of the world’s GDP. There are reports of huge annual sums to replace structurally
defective bridges; a key cause being decay from use of winter de-icing salts.

5.2 Causes
The most basic causes of decay are the natural processes of rain, ice and wind. Wetness creates decay
in timber (and increases the appetite of wood boring beetles) and corrosion in steel. Freeze-thaw cycles
affect even tough materials. Sunlight causes degradation through UV attack, and repeated cycling
through hot and cold temperatures is a source of gradual weakening. Even the atmosphere is a hazard.
Carbon dioxide gradually reduces the protection concrete offers to buried rebar. In the 1960s UK, before
the Clean Air Acts, acid rain was a national concern to buildings and forests. In coastal regions, salt laden
spray and salty air significantly accelerate metal corrosion rates.

5.3 Steel corrosion

There are several reports of bridges collapsing due to corrosion. One example is that of the Mianus
River Bridge, USA (1983). A 30m suspended section fell out when the bridge was about 30 years old.
The structure had one section supported by hangers on each of its four corners. Each hanger consisted of
a strap with single pins top and bottom with the pin retained in place by a cap plate and nut. The bridge
spanned a salty tidal estuary and was subjected to winter de-icing salts. Failure began by corrosion,
apparently forcing off a cap plate on one lower pin, so allowing that pin to come out and cause all
support to be lost. The hanger support on the opposite side then had to carry twice its nominal load.
Stresses were high and eventually the second pin failed in fatigue, and in so doing allowed the span to
fail catastrophically.

5.4 Concrete degradation

Modern reinforced concrete was ‘invented’ around the beginning of the 20th century and thought to be
a wonder material capable of lasting forever. Even until the 1960s, issues of concrete durability were not
widely appreciated by the design and construct community, resulting in a legacy of badly deteriorated
building stock and a huge workload of repair and replacement.

The key is to prevent embedded rebar from corroding — since corroding metal expands, bursting off
cover and permitting more access to moisture and thus an accelerated cycle of decay. Embedded rebar
is kept passivated by the surrounding alkalinity of the concrete, which in turn is linked to the cement
content and other factors. Over time, concrete reacts with carbon dioxide in the atmosphere and this
gradually reduces the alkalinity of the cover material. Modern codes ought to minimise the risk by
assuring minimum cement content and adequate cover, and enforcing certain construction practices
such as adequate compaction. But reality is obviously affected by site quality.

Certain chemicals, especially chlorides, are known to cause degradation. Groundwater with excessive
sulphates and aggressive chemicals within soils can attack foundations. Good concrete can only be
made with proper aggregate. Some aggregates cause problems. Frost damage can occur. In certain
industrial processes (e.g. chimneys), acid attack from fumes may erode and degrade. Salt generally is a

The Institution of Structural Engineers Essential Knowledge Text No. 5   17

Lessons from failures

problem, and the use of de-icing salts on roadways is a major cause of highway structure deterioration. In
vulnerable areas such as parapets, the problem can be so bad that stainless steel rebar has to be used in
lieu of normal steel.

Over the years several degradation mechanisms have come to light. Principal amongst these are:

• High Alumina Cement (HAC) conversion

• Alkali Aggregate Reaction (AAR)/Alkali Silica Reaction (ASR)

• Sulphate attack and Thuamasite

• Chloride attack

Many degradation failures are progressive but some have led to instant collapse. In 1973, the roofs over
the swimming pool and gymnasium at the Sir John Cass School, UK caved in5.1. Two other equally serious
failures happened at about the same time. In all three cases, beams made from HAC were a common
factor. It was found that, under certain conditions, the original concrete lost strength dramatically.
These failures created a nationwide scare and HAC was banned from use in the UK in 1976.

Post-tensioned bridges, UK (1970–1990)

Concerns about the durability of ducted tendons in bridges surfaced as early as 1979.
Ynys-y-Gwas road bridge in Wales collapsed without warning in 1985 due to tendon
corrosion. This led to generalised concern over the adverse effects of chlorides and the
need to improve methods of detecting corrosion and of providing effective methods
of corrosion prevention.

The collapse of the Kongresshalle shell roof in Berlin (1980) had previously shown what
could happen. The whole structure suddenly collapsed without warning. The cause
was poor waterproofing and lack of corrosion protection around the tendons.

A major concern with all these failures was the lack of warning of reduced safety, with
the potential for sudden failure.

18   The Institution of Structural Engineers Essential Knowledge Text No. 5

 Lessons from failures

The failure of the De la Concorde overpass near Montreal, Canada created headlines worldwide.
A complete 20m span of the bridge suddenly dropped out crushing vehicles below. Five people were
killed. Consequential costs on traffic disruption were substantial (Figure 5.1).

Figure 5.1: De la Concorde overpass collapse (2006)

The span dropped because its abutment support fell off. This was precipitated by a horizontal crack
which had been slowly growing. Causes were misplaced rebar, low quality concrete deteriorating in
freeze-thaw conditions and lack of shear rebar in thick slabs (permitting brittle failure)5.2.

5.5 Conclusion
The key lesson is that degradation is an unavoidable reality. The extent over the life of the structure
can be controlled by proper design and by proper specification aimed at avoiding known degradation
mechanisms. Careful detailing is very important. To detect gradual weakening in service, the structure
needs to be arranged so that it can be inspected. Critical areas should not be hidden from view.

References
5.1 Bate, S.C.C. BRE Current Paper 58/74: Report on the failure of roof beams at Sir John Cass’s Foundation
and Red Coat Church of England Secondary School, Stepney, Garston: BRE, 1974
5.2 Wood, J.G.M. (2008) ‘Implications of the collapse of the De la Concorde overpass’, The Structural
Engineer, 86(1), pp. 16–18

The Institution of Structural Engineers Essential Knowledge Text No. 5   19

Fire
By the end of this chapter, readers will appreciate the significance of fire as a major
cause of structural failure.

20   The Institution of Structural Engineers Essential Knowledge Text No. 5

 Lessons from failures

Fire is a generic hazard applicable to all structures. Over the centuries fire has devastated communities
causing injury, death and commercial loss. Many lessons have been drawn from studying incidents.

Fire can be a regional or local hazard. In parts of the world, excessive summer heats and drought have
created huge regional conflagrations. Fire has also exacerbated many well-known disasters, an obvious
example being the events of September 11, 2001 at the World Trade Center in New York. Although
initiation was by terrorist attack, the twin towers were only finally brought down by the intense
heat of burning jet fuel. Thus, although fire is a hazard on its own, its effects may often couple with
others; ground motion caused considerable destruction in the San Francisco earthquake of 1906, but
the ensuing fire worsened the devastation. Similarly, fire has been a subsequent hazard following many
Japanese earthquakes.

In buildings, protecting life is the prime objective, and death can occur from either smoke inhalation or
heat. Protection of commercial assets or heritage buildings will also be important; the destruction of any
data processing centre could be hugely catastrophic.

Topics within ‘fire engineering’ are: ignition, spread of flame, fire resistance, detection, suppression and
consequences.

Clearly, part of protection policy must be minimising the risks of ignition. In the natural world, ignition
can be from lightning strike, illustrated by the destruction of York Minster’s roof in 1984. Within buildings,
ignition often comes from faulty electrical apparatus: the severe fire in Moscow’s Ostankino TV tower
(2000) was thought to have been linked to cabling short circuits. Alas, approx. 50% of fires in the UK are
started by arson, and that can not be prevented, so any protection policy has to include minimising the
risk of fire spread, assuming some ignition source will arise. A 2013 fire in a Birmingham plastics factory
started and become out of control just minutes after a Chinese lantern floated down on it — a cause
perhaps not thought about previously?

An obvious basis for risk reduction is good management, making sure that the accumulation of
ignitable materials and rubbish is controlled. The Bradford City Stadium fire of 1985, the worst fire
disaster in the history of English football, occurred during a match, killing 56 and injuring at least 265.
The stand was timber and its roof was set alight. Rapid spread occurred because the roof was covered
with tarpaulin sealed with asphalt and bitumen. That incident was not unique. The London Underground
Kings Cross fire (1987) started below a wooden escalator, again ignited by a cigarette dropped into
grease impregnated with fibres. Many deaths were caused by smoke.

All materials used in buildings require testing to see whether they have sufficient resistance against
spread of flame. The spread rate at Bradford was no doubt promoted by the roof’s construction.
Another classic incident of material promoting flame spread can be seen in the 1971 fire of the
Summerland leisure centre on the Isle of Man. After the fire took hold, the worst effects were on highly
flammable acrylic sheeting which clad the building. Occupants panicked and many were killed6.1.

Materials need to be considered for their ability to generate smoke. Manchester’s Woolworth’s
department store burnt down in 1979 and showed what can happen. Burning furniture containing
polyurethane foam rapidly produced large amounts of dense smoke. This obscured exit signs, caused
confusion, and the smoke’s density and irritants hindered escape. Fires can occur anywhere. Many
serious ones have occurred in tunnels. There have been five in the Channel Tunnel. The worst was in
2008, lasting 16 hours with temperatures reaching 1,000oC. The heat was so intense that the tunnel’s
concrete lining was badly affected and repair costs amounted to c. €60 million.

The Institution of Structural Engineers Essential Knowledge Text No. 5   21

Lessons from failures

Many fires take place on construction sites; a key one occurring at the Broadgate site, London, in 1990.
The fire lasted for hours, with temperatures exceeding 1,000oC. During and after the fire, the steel
structure behaved well; there was no collapse although deflections were large. This incident offered a
first opportunity to examine the influence of fire on the structural behaviour of a modern and complete
steel framed building with composite construction. In its aftermath, much research was conducted, and it
is now possible to simulate the effects of excess heat on structures and determine their modes of failure
as fires progress. This has lead to economy and better safety.

References
6.1 Silcock, A. and Hinkley, P.L. BRE Current Paper CP 74/74: Report on the spread of fire at Summerland in
Douglas on the Isle of Man, Garston: BRE, 1974

22   The Institution of Structural Engineers Essential Knowledge Text No. 5

Human error
Here, the fact that human error is a common factor in most failures, is discussed.

The Institution of Structural Engineers Essential Knowledge Text No. 5   23

Lessons from failures

7.1 Introduction
The world’s financial markets went into turmoil after 2007 and, in the frightful aftermath, the Queen
asked why nobody had noticed it coming. A professor is reported to have answered: “At every stage,
someone was relying on somebody else, and everyone thought they were doing the right thing”.
A parallel with our own profession is that after the investigation of any civil or structural failure, the
same observations are frequently made — that other parties assumed those responsible knew what
they were doing or were too cowed to ask ‘experts’ the obvious. It frequently transpires that elementary
mistakes have been made with undue risks being taken, and frequently without adequate monitoring or
supervision by the companies involved.

It is simply unfortunate that human beings make mistakes. This may be at an individual level or it may be
via corporate failure. Sometimes the cause has been duplicity or dishonesty, but is more often fallibility.
Mix-ups can be bizarre; a severe problem arose on the Mars Orbiter project when imperial and metric
units were confused. As a consequence, the Orbiter arrived at Mars at the wrong orientation and there
disintegrated. In one construction case, a European firm designed a steel structure to be fabricated in the
UK. The designers specified the welds as fillets, assuming a size definition based on weld throat, whereas
the UK firm assumed the size meant leg length: there is 30% difference in shear capacity and 100%
difference in weld quantity between the two definitions.

The consequences of human error are exemplified by the events at Fukushima, Japan. In 2011, one of
the world’s most frightening failures occurred at the Fukushima Daiichi nuclear plant. At the time it
seemed as if the nuclear nightmare might really happen. Severe core overheating and reactor meltdown
occurred. The disaster was precipitated by a natural occurrence, a large earthquake followed by an
enormous tsunami. These twin events caused plant failures that initiated the subsequent catastrophe,
and the consequences were not controlled by the structure (concrete cooling ponds cracked). Yet the
official parliamentary report was unequivocal that this was not a natural disaster but a man-made one.
The reported concluded that the crisis was ‘a profoundly man-made disaster’ and the disaster ‘could
and should have been foreseen and prevented’. The report catalogued serious deficiencies by both the
government and plant operator, claiming wilful negligence had left the plant unprepared. Additionally,
the report blamed cultural conventions for a reluctance to question authority, and criticised the role of
the government regulator. The deficiencies in the plant’s safety had been known about, and instructions
issued for rectification, but not acted on. Neither had the regulator made any attempt to enforce them.
There was no preparation or proper planning for response in the event of failure. Admittedly the tsunami
was much larger than thought possible and the plant’s defences had been overwhelmed, but the
consequence of that could have been foreseen and the weakness rectified fairly simply. The report also
blamed plant staff and regulators for not learning from previous accidents and not taking benefit from
worldwide experience; all factors that should be promoted in any commitment to safety.

A classic failure, consequent at least partly on failure to respond to instrument readings, is that of the
tunnel collapse under Heathrow airport in 1994. The tunnel collapsed catastrophically bringing chaos.
So much so, that the UK’s Health and Safety Executive (HSE) described it as ‘one of the worst civil
engineering disasters in the UK in the last quarter century’. One feature of the inquiry singled out that:
‘Warnings of the approaching collapse were present from an early stage in construction but these were
not recognised’.

The Heathrow incident provides another major safety lesson. No one should assume that in any large
project the worst cannot happen. There is an added danger in large projects that overall safety objectives
and risks get overlooked since parties assume someone else must know what they are doing. In the
aftermath of the Heathrow crisis, the contractor stated: ‘We will never try to change our plea of guilty but
it is clear that the collapse was the result of organisational blindness’.

24   The Institution of Structural Engineers Essential Knowledge Text No. 5

 Lessons from failures

7.2 Human error in civil engineering

Failures attributed to design error in civil engineering certainly occur. One example of this might be:

Hyatt Regency hotel walkway collapse, USA (1981)

This was a key collapse in failure history. The walkway was high level, suspended from
hangers, but there were difficulties in erection so the support detail was changed at
walkway level. The manner of change inadvertently doubled the load on the support
point and it failed completely allowing total collapse — killing 114 people and injuring
216 others. At the time it was considered the worst structural collapse in US history7.1.

Investigators concluded that one cause was lack of proper communication between
the designers and the fabricators.

This failure highlights several themes:

• Confusion in communication

• Vulnerability to key details

• Lack of robustness

• Inadequate change control

• Interaction between design and construction

References
7.1 YouTube (2015) The Hyatt Regency hotel walkway disaster (Kansas City, Missouri) [online] Available at:
www.youtube.com/watch?v=MeCpmQUi4hU (Accessed 4 April 2016)

The Institution of Structural Engineers Essential Knowledge Text No. 5   25

Natural disasters
The challenges of coping with structural failure consequent on natural disaster are
explained here.

26   The Institution of Structural Engineers Essential Knowledge Text No. 5

 Lessons from failures

One objective for civil and structural engineers is to protect society from natural disaster. It is during such
events that infrastructure is really put to the test, and when structures fail, the costs (both financial and to
human life) can be awful. So it is a real challenge to understand how structures perform under extreme
conditions. There are immense difficulties; the loadings are often uncertain and the costs of protection
often barely affordable.

We have always had to cope with natural disaster. Vast flooding occurs every year. Millions have died in
earthquakes worldwide. The 2004 Indian Ocean earthquake and tsunami killed over a quarter of a million
people and affected more than one million in some way. In Haiti, around a quarter of a million people
died in the 2010 earthquake.

There are said to be approx. 400 natural disasters per annum. 2012 might have been one of the costliest
years ever — with 11 extreme events across the Americas alone, generating billion dollar losses. Some
events were spectacular, none more so than during the Newcastle (UK) evening rush hour storm of June,
which sent cascades of water down the city streets and a dramatic lightning strike onto the Tyne Bridge.
Later in the year, another Newcastle storm produced such a torrent that the ground surrounding the
piled foundations of a block of flats was swept away. In the winter following, a number of buildings in
Scotland collapsed under excessive snow load.

Natural disasters of concern are:

• Earthquakes

• Extreme wind/flood/rain/heat/cold/snow/ice/rain

• Hailstorm/lightning

• Fire

• Pollution

• Mudslide/landslide

Any of these events can cause failure and severe consequence. Examples are:

UK floods (1953)
In 1953, 300 people died in East Anglia and Holland after sea walls were breached
and floods progressed inland over many miles. About 40,000 people were made
homeless. The cause was a combination of events: a full moon to cause high tide, a
deep depression to raise water even higher and a north–south storm to push waters
higher still. That combination of circumstances might not be predictable at any one
instant, except to note that it will happen at some time (and it did happen again in
2013 but with much less damage). The risk can be anticipated if forecasters see those
combinations of phenomena developing. Long term, that understanding drives the
need for such sea defences as the Thames Barrier.

The Institution of Structural Engineers Essential Knowledge Text No. 5   27

Lessons from failures

Aberfan, Wales, UK (1966)

Aberfan was a coal mining village and for many years waste had been dumped in tips
beside the town. The waste had been stacked up over porous rock containing many
springs. Just before the tragedy, there had been several days of heavy rain. The tip
was unstable and, on 21 October, about 150,000m3 of slurrified material flowed down
at speed straight into the village. En route it destroyed a terrace of houses, but worse
was the burying of Pantglas Junior School. The children inside were killed by impact or
suffocated. 116 children and 28 adults died.

Emley Moor TV transmitter, Yorkshire, UK (1969)

This was a guyed mast 385m high and one of the world’s tallest structures at the time.
The mast tubes and guys were frequently coated in ice and, during thaws, ice dropping
onto adjoining roads was a hazard. In March 1969, the entire mast fell. Collapse is
thought to have come about through a combination of cable ice weight and the
added ice changing the shape of the cables, causing them to oscillate in steady wind
flow. Little was known about cable dynamics at that time.

28   The Institution of Structural Engineers Essential Knowledge Text No. 5

Man-made
disasters
The challenge of coping with structural failure consequent on man-made disaster is
explained through several examples.

The Institution of Structural Engineers Essential Knowledge Text No. 5   29

Lessons from failures

The catastrophe consequent on the failure of the Deep Water Horizon platform was man-made; there
have been plenty of others. When designing any structure, a key lesson for engineers is to bear in mind
the consequences to society at large if it fails. Obvious examples are nuclear plant, but any infrastructure
poses a risk, and failures remind us of the need to be imaginative when it comes to considering what
might go wrong. Some examples illustrate this:

Alexander Kielland, Norway (1980)

The Alexander Kielland was a semi-submersible drilling rig that capsized. The
accident’s direct cause was fracture in one of the bottom braces. But the fracture was
merely the last phase of crack extension spreading rapidly under cyclical loading
from an initiation point on a small weld. This failure offers many lessons. Firstly, it was
clearly a disaster losing an entire rig and killing a large number of workers. Secondly,
is the scale of catastrophic failure that can occur, consequent on even a small defect.
It is a prime example highlighting the need for engineers to build robustness into
their structures. The direct causes suggest that there was no design appreciation of
the possibility of fatigue loading or of cracks propagating from non load-bearing
elements. Any weld, load-bearing or not, is a potential crack initiation site. The features
of initial defect, poor weld profile and plate tearing all suggest use of an inadequate
material, an inadequate Quality Assurance (QA) regime at the time of fabrication
and an inadequate Quality Control (QC) regime in failing to pick up the defect
post‑fabrication.

Erskine Bridge, Glasgow, UK (1996)

‘Bridge bashing’ is the result of tall vehicles trying (and failing) to pass under decks.
It occurs on roads and in bridges over water. A particular example was that of an oil
platform being towed under the girders of the Erskine Bridge in Glasgow with the
platform mast too high. The result was a catastrophic rip in the bridge deck bottom
flanges, with repair costs estimated at £4.25 million. A busy traffic route was affected
for four months.

(In 2013, in Genoa, Italy, a container ship smashed into the port’s 50m high control
tower, bringing it all crashing down9.1).

Stockline factory explosion, Glasgow, UK (2004)

Stockline was a plastics factory in Glasgow. In 2004, there was a terrible explosion, the
worst in Scotland since Piper Alpha. The factory was destroyed, nine workers were
killed and 40 injured. The cause was later established as a gas leak from a corroded
pipe laid under the factory.

30   The Institution of Structural Engineers Essential Knowledge Text No. 5

 Lessons from failures

There is no shortage of examples of man-made disasters. No country, structure or material is immune and
the events are normally characterised by a dramatic failure, usually with severe consequences. Seminal
events such as Piper Alpha, Deep Water Horizon or the Twin Tower collapses punctuate the news year
after year. The examples included here are not unique, they merely illustrate the breadth of cause:
fatigue failure, unauthorised change and technical ignorance, impact, corrosion. Some also illustrate the
folly of ignoring warning signs.

References
9.1 BBC News (2013) Italy deaths as Genoa ship hits control tower [online] Available at:
www.bbc.co.uk/news/world-europe-22444421 (Accessed 5 April 2016)

The Institution of Structural Engineers Essential Knowledge Text No. 5   31

Overall lessons
and how to
avoid failures
Here, the reader will gain an appreciation of the procedures adopted to minimise the
risk of failures.

32   The Institution of Structural Engineers Essential Knowledge Text No. 5

 Lessons from failures

10.1 Introduction
Evidently, failures happen — and usually the consequences are extremely serious for those involved.
But there have been too many incidents to dismiss them all as freak events. There is cause and potential
for prevention, so it would be foolish and arrogant not to study the events. Much human endeavour
advances at a personal and societal level by trial, by making mistakes, learning from them and moving
on. So we have a professional duty to collate information on failures and share the lessons. In structural
engineering, we are at a stage where technical knowledge is extensive; so extensive in fact that the
profession is sub-divided into many specialisms. That breadth of skill creates its own challenges. It is
very hard for engineers to acquire a full appreciation of all the technical knowledge available, certainly
at an early career stage, and we have the inevitable danger of misunderstandings across the interfaces
of knowledge. Thus we depend on teamwork and supervision to minimise the risk of error. It is neither
wise, nor sound management, to assume errors will not be made. Rather, the presumption should be the
other way around — errors will be made and we have to manage the risks according to likelihood and
severity10.1.

10.2 Overall lessons

A glance at the case histories included in this Text reveal that none resulted from a minor transgression
of code allowables or some marginal ‘over stress’. Modern codes are sufficient to assure structural safety
if used correctly. However, ‘compliance with the code’ is not good enough. Too often, that will promote
over‑attention to structural element design with a degree of unjustified precision. The attributes of
safety governed by properties such as robustness, ductility and stability are ones of concept more than
numerical strength. Failures come about because modes of failure have not been anticipated; via human
error, poor detailing, poor communication etc. The construction phase is historically a risky one. Another
lesson is that the degree of care in design and the reliability of the structure need to be tailored to the
consequences of failure. A constant theme is time: structures and systems ought to be designed and
detailed to give warning of impending distress. When catastrophe threatens from the environment or
from structural failure, there needs whenever possible to be a plan, a warning system and time to react or
escape. It should be borne in mind that all structures go into service in one condition and, from then on,
their material constituents may well degrade. Proper design has to account for degradation to minimise
it, to assure it can be detected in service, and therefore to assure structures maintain a minimum capacity
throughout life.

10.3 Avoiding failures

A first step in any project is to identify the hazards that might apply and understand the uncertainties
associated with them:

• All loading and all member capacities are estimates, and neither strength nor stability should
be sensitive to minor variations, nor to assumptions of construction quality. If there are any
assumptions at all (e.g. for existing structural capacity or quality), they should be challenged
and justified

• The consequences of failure ought to be identified, and then a strategy for achieving appropriate
reliability, stability and robustness defined — both in construction and through life. There should
be clarity in load paths both vertical and in the two horizontal directions

• The structural form adopted has to be ‘buildable’

• Before starting the numerical design proper, a basis of design should be defined and verified
by the team, to make sure no mode of failure or desirable attribute is overlooked. It is very easy
to make a mistake. All analysis should be checked before the output is used further, and that

The Institution of Structural Engineers Essential Knowledge Text No. 5   33

Lessons from failures

check ought to include an assessment of whether any computer predictions match with a simple
expectation of order of magnitude. Thereafter, all calculations and drawings need to be checked
before construction. Particular attention should be paid to connections and interfaces. It is wise
to verify that what the designer thought was being built, was actually built. Changes need to be
handled with great care to see that implications are fully thought through. Any key construction
item should be subject to integrity testing. In service, any signs of failure or degradation need to be
acted upon promptly

• Be quite clear on lines of responsibility and authority for decision-making. Never be afraid to
question

• Remember that dangers thrive at interfaces. There should be one party in overall charge of stability
and robustness

• For all but the simplest of structures, it is prudent to have an independent check/peer review.
That check should start with an overview of the acceptability of the structural form, followed by an
assessment of the likely hazards and risks to make sure no mode of failure or mode of instability
has been overlooked. The check should include order of magnitude, as well as independent checks
of stresses and behaviour to validate any computer output relied upon. The checking process
should be documented

References
10.1 Carpenter, J.N. (2008) ‘Safety, risk and failure: the management of uncertainty’, The Structural
Engineer, 86(14), pp. 100–105

34   The Institution of Structural Engineers Essential Knowledge Text No. 5

The Institution of Structural Engineers
International HQ
47–58 Bastwick Street
London EC1V 3PS
United Kingdom
T: +44 (0)20 7235 4535
E: [email protected]
W: www.istructe.org

Founded 1908 and incorporated by Royal Charter 1934

Registered with the Charity Commission for England and Wales No. 233392
and in Scotland No. SC038263