At four o’clock in the morning of 30 April 1988 a railway embankment
near the coastal town of Coledale in New South Wales collapsed, sending
tonnes of mud and water down a hill. The debris crushed a house, killing
a woman and child who were inside. The area was prone to subsidence and
evidence given at the inquest suggested that the designers of the embankment
had not taken proper account of this. Four people, two of them engineers,
were subsequently charged with endangering passengers on a railway. One,
a principal geotechnical engineer with the State Rail Authority of New South
Wales, was also charged with two counts of manslaughter.
Though none of them was convicted, the engineering profession was horrified
that engineers should be charged in this way, and rallied to their support.
Peter Miller, chairman of the standing committee on legal liability of the
Institution of Engineers, Australia, argued that criminal prosecutions against
engineers set a precedent that could change the way engineering was practised.
He said it was likely to result in engineers becoming more conservative
in their assessments and decisions. Although this was not in itself a bad
thing, it would mean higher costs for engineering work, he claimed.
The institution was also concerned about individual blame being apportioned
to engineers who work as part of a team in organisations operating under
financial constraints. Bill Rourke, who retired last month as the institution’s
chief executive, pointed out in its magazine, Engineers Australia, that
safety margins are closely related to the availability of funds. He argued
that the provider of those funds, in this case the community, should carry
a significant responsibility for safety levels.
Advertisement
The issue of who should take responsibility when things go wrong is
becoming a central concern for the engineering profession worldwide. At
the end of last year the Australian institution sent all its members a discussion
paper entitled Are you at risk? Managing Expectations. More than 3000 engineers
replied, the largest response the institution has ever had on any issue.
In the preface to the paper, the institution’s president, Mike Sargent,
said that the trend towards criminal prosecutions for negligence and the
escalation of civil law claims against engineers ‘constitute a significant
threat to the ability of our profession to serve the community and might
even threaten its continued existence’.
Miller, too, believes that the profession is at risk. ‘Engineers are
being put in untenable positions,’ he says. ‘They are being asked to make
decisions over matters they cannot control and being forced to take responsibility
for these decisions.’ What Miller and his colleagues at the Institution
of Engineers are proposing is nothing short of a radical change in the relationship
between engineer and society. The engineering profession seems to be approaching
a turning point.
Miller and his colleagues believe that if people were more aware of
the uncertainties surrounding engineering work and the limitations of mathematical
models, then they would not so readily blame engineers for failures. The
institution’s discussion paper pointed out that engineers had presented
a falsely optimistic and idealistic view of their work. They are now paying
the price for having raised unjustifiably high the public’s expectations
of what they can deliver. ‘We know (or should know) that our models are
limited in their ability to represent real systems, and we use (or should
use) them accordingly. The trouble is that we are so inordinately proud
of them that we do not present their limitations to the community, and leave
the community with the impression that the models are precise and comprehensive.’
The discussion paper quotes the 1946 chairman of the Scottish branch
of Britain’s Institution of Structural Engineers as saying: ‘Structural
engineering is the art of modelling materials we do not wholly understand
into shapes we cannot precisely analyse so as to withstand forces we cannot
properly assess in such a way that the public at large has no reason to
suspect the extent of our ignorance.’
Why have engineers misled the public in this way? Gavan McDonell, an
engineer and supervisor of the graduate programme in science and society
at the University of New South Wales, says: ‘It is the very nature of professions
to fill the role of a sort of priesthood with transcendental access to superior
knowledge. Engineers have assumed this role, too. They have protected their
professional status as possessors of special knowledge and have not been
inclined to discuss the limitations of that knowledge with those outside
the profession.’ McDonell admits that there is a large element of technocratic
arrogance in this stance, but says that modern societies require this division
of knowledge in order to function. There is, however, an important rider:
‘Previously the community trusted in the probity and ethical rightness of
the expert,’ he says. ‘But as experts are increasingly seen to be working
for particular interests in society, that trust is disappearing.’
Miller, too, points to the breakdown of the social contract between
engineers and society. He says that the contract involved a commitment by
engineers always to put the public interest first and a commitment by the
public to allow engineers to regulate themselves. ‘That contract is now
seen to be broken by both parties,’ he says. The institution’s discussion
paper is the first step in a process of re-establishing trust between engineers
and the public. Miller, one of the authors of the paper, was at first hesitant
about sending it out. He was worried that engineers might not be interested
in questions that don’t have clear-cut answers, and concerned that they
would not want to discuss philosophy – even engineering philosophy. He has
been gratified to find an unsuspected hunger for such a discussion.
The philosophy set out in the paper is that engineering is an art rather
than a science, and as such depends heavily on judgment. The widespread
use in engineering of heuristics, or ‘rules of thumb’, requires judgment
to be used properly. Billy Vaughn Koen, professor of mechanical engineering
at the University of Texas at Austin, defines a heuristic device as ‘anything
that provides a plausible aid or direction in the solution of a problem
but is in the final analysis unjustified, incapable of justification and
fallible’. Heuristics is used in the absence of better knowledge or as a
short-cut method of working out something that would be too expensive or
time-consuming to work out more scientifically.
An example of a heuristic device is a ‘factor of safety’, sometimes
referred to as a ‘factor of ignorance’. Engineers have to work with materials
that vary widely in strength and other characteristics, and design for a
range of operating conditions and loads. To cope with these variations and
uncertainties they employ factors of safety. Henry Petroski, an American
engineer who has written extensively on engineering accidents, explains:
‘Factors of safety are intended to allow for the bridge built of the weakest
imaginable batch of steel to stand up under the heaviest imaginable truck
going over the largest imaginable pothole and bouncing across the roadway
in a storm.’
However, the concept of a factor of safety is often misunderstood by
those outside the profession as implying some large safety margin on a predictable
design. Barry McMahon, a Sydney-based geotechnical engineer, has found his
clients believe that a factor of safety implies ‘certainty’ plus a bit more.
He says they are far more concerned with the financial risk of ‘conservative’
design (design that errs on the safe side) than they are with other sources
of risk. Conservative design tends to be more expensive, which means that
there is always pressure to reduce factors of safety.
For a factor of safety to be effective, the means of failure must be
known and the cause of the failure determinable by experiment. For example,
concrete columns may be designed to cope with 10 times the compression stresses
the engineer estimates they will have to bear. In this case the factor of
safety is 10. But this assumes that if the columns are going to fail it
will be as a result of compression. If the columns are subject to unexpected
forces from another direction – so that they are stretched instead of compressed,
for example – then their extra ability to take compression will not be of
much help. The ability of a concrete column to bear a particular stress
is determined by experiments done repeatedly on concrete columns in the
laboratory.
All engineering structures incorporate factors of safety and yet some
still fail, and when this happens the factor of safety for similar structures
built subsequently might be increased. Conversely, when a particular type
of structure has been used often without failure, there is a tendency for
engineers to suspect that these structures are overdesigned and that the
factor of safety can be reduced. Petroski says: ‘The dynamics of raising
the factor of safety in the wake of accidents and lowering it in the absence
of accidents can clearly lead to cyclic occurrences of structural failures.’
He points out that this cyclic behaviour occurred with suspension bridges
following the failure of the Tacoma Narrows Bridge , which collapsed spectacularly
in 1940 in mild winds.
Cutting safety margins to reduce costs in the face of success happens
in all engineering disciplines. William Starbuck and Frances Milliken, researchers
at New York University, have studied the catastrophic failure of the Challenger
space shuttle in January 1986 and concluded in their paper ‘Challenger:
fine-tuning the odds until something breaks’ (Journal of Management Studies,
Vol 25, July 1988) that the same phenomenon was present there. They argue
that, as successful launches accumulated, the engineering managers at NASA
and Thiokol, the firm responsible for designing and building the rocket
boosters for the shuttle, grew more confident of future success. NASA relaxed
its safety procedures, treating the shuttle as an ‘operational’ technology
rather than a risky experiment, and no longer tested or inspected it as
thoroughly as they had the early launches.
Signs of failure
The O-rings sealing the joints in the shuttle’s solid-fuel rocket booster,
which were eventually found to have played a major role in the accident
(‘Why Challenger failed’, New ÐÓ°ÉÔ´´, 11 September 1986), had shown signs
of failure in several earlier flights. Inspectors found heat damage to O-rings
after three of the five flights during 1984 and after eight of nine flights
during 1985. But since this damage had not impeded the shuttle launch, engineering
managers at NASA and Thiokol came to accept this damage as ‘allowable erosion’
and ‘acceptable risk’. Lawrence Mulloy, manager of the solid rocket booster
project, is quoted by Starbuck and Milliken as saying: ‘Since the risk of
O-ring erosion was accepted and indeed expected, it was no longer considered
an anomaly to be resolved before the next flight.’
Brian Wynne, a researcher at the University of Lancaster, has also studied
the Challenger disaster and other accidents. He says that O-ring damage
and leakage had come to be accepted as ‘the new normality’. Wynne argues
that implementing designs and operating technological systems involve ‘the
continual invention and negotiation of new rules and relationships’ and
that if this did not happen most technological systems would come to a halt.
Starbuck and Milliken agree with respect to the space shuttle. They point
out that NASA had identified nearly 300 special ‘hazards’ associated with
the launch of Challenger. ‘But if NASA’s managers had viewed these hazards
so seriously that any one of them could readily block a launch, NASA might
never have launched any shuttles.’
Wynne says there is a tendency to refer to ‘human error’ when accidents
occur, as if there has been some ‘drastic departure from normal rule-bound
operating practices, and as if we were exonerating a supposedly separate
mechanical, nonsocial part of the system’. He suggests that part of the
problem may be that technological systems are designed as if organisations
can operate with perfect communication and that people are not prone to
distraction, illogic or complacency. Jean Cross, professor of safety science
at the University of New South Wales, agrees that engineers have a tendency
to neglect what she calls the ‘human/technology interface’ in their designs.
For example, they do not take account of how long it takes people to process
information and how people behave when they are under stress.
The institution’s paper gives some recognition to this. It says that
the notional probability of failure implicit in engineering codes does not
give sufficient weight to human factors. ‘It deals mainly with those issues
for which we can rationally compute factors of safety.’ Miller is keen for
engineers to give more consideration to the human/technology interface.
This is one of the areas that will be covered in a second discussion paper,
which is being put together at the moment.
For Starbuck, Milliken, Wynne, Petroski and many others, all engineering
design involves experimentation. According to Petroski, ‘each novel structural
concept – be it a sky walk over a hotel lobby, a suspension bridge over
a river, or a jumbo jet capable of flying across the oceans – is an hypothesis
to be tested first on paper and possibly in the laboratory but ultimately
to be justified by its performance of its function without failure.’ Failures
will occasionally occur. They are unavoidable, he argues, unless innovation
is completely abandoned.
Wynne goes further, arguing that the experimental nature of engineering
extends beyond the design stage: ‘If technology involves making up rules
and relationships as its practitioners go along, it is a form of social
experiment on the grand scale.’ Similarly, Starbuck and Milliken say that
‘fine-tuning is real-life experimentation in the face of uncertainty’.
If engineering is based on incomplete models and on judgment and experimentation,
who should be held responsible when engineering projects fail, causing loss
of life and property, and damage to the environment? For many engineers
this is not a useful question. Mark Tweeddale, professor of risk engineering
at the University of Sydney, argues that finding who is to blame for an
accident is a fruitless way of going about things. ‘If someone makes a mistake,
you need to ask what caused them to make that mistake? Was it the stress
they were under? Was it that they were not properly trained? Should they
never have been hired for the job? All these questions lead back to management,
but management is also human and the same questions apply. It’s like peeling
an onion: in the end you are left with nothing.’ This does not mean an accident
shouldn’t be investigated. But Tweeddale feels that legal proceedings to
establish blame are unhelpful in sorting out the lessons to be learnt from
an accident, because the sub judice laws that come into play during a court
case restrict free and open public discussion of what happened.
Engineers feel that the public is increasingly looking for someone to
blame when accidents happen, rather than accepting accidents as an inevitable
part of life. They are frustrated at what seems to be the public’s requirement
for complete safety. Simon Schubach, a consulting engineer who does risk
assessments for the New South Wales planning department, is often asked
at public meetings: ‘Will it be safe?’ But the audience seldom accepts his
answer, which tends to be along the lines of: ‘On the basis of the assumptions
we made, and the limited applicability of the models we used, our assessment
is that the project will meet acceptable risk criteria.’ Schubach finds
the public’s demand for certainty naive, unreasonable and ill-founded: ‘Engineering
is just not like that.’
McDonell is also concerned about the increasing tendency for lawyers
to look for someone to hold liable whenever anything undesirable happens
after engineers have given advice. However, he argues that the law still
has a part to play where there has been gross negligence and dereliction
of duty. ‘This may mean criminal prosecutions of engineers in some instances,’
he says. ‘Engineers simply can’t expect to be immune from this.’
Australia’s Society for Social Responsibility in Engineering believes
that engineers should accept responsibility for the safety of their work
even if this means they will be held criminally liable. Philip Thornton,
president of the society, says: ‘If an engineer makes a structure stronger
because the risk of being charged if that structure collapses is too high,
then the risk of someone being killed or seriously injured is also too high.’
Thornton argues that if engineers are concerned about being personally liable
for accidents and failures then they are less likely to bow to economic
pressure to reduce safety margins. ‘Caution is a good thing.’
The dilemma for engineers today is how to tell the public of the extent
of their ignorance without losing the community’s confidence. Getting public
acceptance of new or controversial technologies is greatly assisted by portraying
them as perfectly predictable and controllable. ‘Concern for public reassurance
produces artificially purified public accounts of scientific and technological
methods and processes,’ says Wynne. ‘When something goes wrong, this background
is an ever more difficult framework against which to explain that even when
people act competently and responsibly, unexpected things can happen and
things go wrong.’
The emerging recognition that this situation cannot go on is leading
Australian engineers to question their role as ‘problem solvers’ who design
projects and advocate them as the ‘right’ solutions to community problems.
The Institution of Engineers is suggesting a shift to a different role for
engineers as ‘technical advisers’ who put forward options for the community
to choose from. This means forgoing some of their autonomy and status as
technological decision makers in favour of sharing the decisions, in order
to share the responsibility if things go wrong. McDonell argues that the
social contract between engineers and the community will not disintegrate
if ways can be developed of consulting the public and allowing the community
to monitor and vet projects.
It will not be easy for people like Miller and his like-minded colleagues
in the Institution of Engineers to bring engineers around to this sharing
of responsibility and decision making, and to open and frank dialogue with
the community. The change will require a lot more discussion within the
profession and changes in engineering education and perhaps public education.
Yet Miller is heartened by the overwhelmingly positive response he has had
from engineers in Australia.
Sharon Beder is a member of the Institution of Engineers, Australia,
and of the Society for Social Responsibility in Engineering. She is currently
environmental education coordinator at the University of Sydney.
Tom Wyatt is reader in structural design in the Department of Civil
Engineering at Imperial College, London.
Further reading: Are You At Risk? Managing Expectations, Institution
of Engineers, Australia, 1990; Henry Petroski, To Engineer is Human: The
Role of Failure in Successful Design, Macmillan 1985; Brian Wynne, ‘Unruly
technology: practical rules, impractical discourses and public understanding’,
Social Studies of Science, Vol 18, 1988; William Starbuck and Frances Milliken,
‘Challenger: fine-tuning the odds until something breaks’, Journal of Management
Studies Vol 25, July 1988.
* * *
TACOMA NARROWS: A BRIDGE TOO FAR
Impressed on the minds of civil engineering students around the world
is the Tacoma Narrows Bridge, a notorious example of ‘getting it wrong’
in the design of a major project. The bridge, which stood in Washington
state, was completed in 1940 and was immediately nicknamed ‘galloping Gertie’
because of its spectacularly dynamic behaviour, which was captured on film.
The failure of the bridge four months later can be seen as the result of
decades of developments in bridge design as much as a failure of the Tacoma
design in particular.
The classical suspension bridge developed rapidly in the first half
of the 19th century. All the early examples used ‘eyebar chains’ – long
wrought-iron links pinned together after the fashion of a bicycle chain.
For instance, Thomas Telford, the great British civil engineer of the period,
took enormous pains to establish the static strength of this structural
form and achieved spectacular successes. But there were also failures because
of the unsuspected dynamic effects of wind. Telford’s own bridge across
the Menai Straits, built to connect Anglesey with the Welsh mainland in
1826, was severely damaged – though it survived and was subsequently strengthened.
Meanwhile, the Brighton Chain Pier, which comprised three modest suspension
spans, was wrecked in 1836, not long after it opened. A sketch by an expert
eyewitness shows the pier buckling in the wind in an accident that clearly
foreshadows the Tacoma failure.
By the turn of the century much longer spans became possible using steel
wire cables, and two successive record-breaking spans were successfully
completed. The first of these was John Roebling’s Brooklyn Bridge across
the East River in New York city, completed in 1883 with a main span of 487
metres. The second, completed in 1931, was the George Washington Bridge
over the Hudson River, connecting New York to New Jersey. It was designed
by Othmar Ammann and its main span surpassed 1000 metres. Chance circumstances
distorted the lessons of this project, and opened the way to misleading
interpretations about the need for stiffening in such bridges. The construction
work was overtaken by the depression and the bridge opened with one deck
and no stiffening girders, but with colossal cables designed for two decks,
one of them for railway tracks. It was the great weight of these cables
that enabled the single-deck structure to survive the effects of wind.
It was inferred, however, that long-span suspension bridges could now
be built with no more than the minimal stiffness required to distribute
the weight of traffic; the lessons from the Menai Straits and Brighton in
the 19th century had been forgotten. Paradoxically, the Tacoma bridge would
never have attracted interest in its day and its collapse would never have
been filmed had it not been for its susceptibility to a form of wind excitation
that did little harm. The bridge frequently developed spectacular vertical
oscillations as the structure caused wind eddies to form alternately above
and below the deck. The frequency of this ‘vortex shedding’ very often matched
one of the structure’s natural frequencies, causing it to resonate and the
oscillations to amplify.
The movement of the bridge became a local attraction, but it could have
survived these relatively modest stresses for a long time. However, before
the eyes of the spectators and the monitoring cameras, a slightly stronger
wind blowing at 18 metres per second (40 miles per hour) produced violent
twisting of the structure. The subsequent collapse of the bridge – which
by this time had been closed to traffic – was filmed for posterity. The
mechanism involved in the collapse has something in common with the airfoil
‘flutter’ that affected high-performance monoplanes in the thirties, and
also the familiar rattle of the slats of Venetian blinds. The 19th-century
troubles encountered by Telford and others shared some of the same origins.
At Tacoma, engineers had taken a leap, compared to available experience,
in reducing mass and stiffness. It wasn’t the only bridge built like this.
Other designers concurrently followed the same path and there were some
narrow escapes. For instance, the Golden Gate Suspension Bridge over the
mouth of San Francisco Bay stood for 14 years without sufficient torsional
stiffness to ensure safety against the form of instability encountered at
Tacoma. Opened in 1937 (before the Tacoma collapse), its span of 1280 metres,
which was the world’s longest until the mid-1960s, had substantial truss
stiffening. Unfortunately, the two side-trusses were not integrated to form
a torsionally stiff box frame. In a severe storm in 1951, truck drivers’
reports of oscillation were dismissed. But next day, it was obvious that
the deck had twisted dangerously. The simple additional bracing that was
needed was then fitted very quickly.
If innovations are introduced in smaller steps, the risk of error at
any one step appears to be reduced. It can also be claimed that a small
step over the bounds of safety will reveal the problem in a gentler form,
catastrophe can be avoided, and the overall risk of innovation reduced.
In other words, small steps forward in design may be more advisable than
big ones. However, if errors amplify, a critical point may still be reached
from a series of small steps that has the same disastrous result as a single
large leap. The same caveat applies to making progressive reductions in
safety margins for design checks.
The result of the Tacoma failure was a return to ugly, heavily-stiffened
designs supplemented by inconvenient aerodynamic slots between various elements
of the deck. These can be seen in many examples, including the Forth Road
Bridge in Britain. But 20 years after the Tacoma Narrows Bridge collapsed,
a new look became possible with the slender deck structure proposed for
the bridge taking Britain’s M4 motorway across the Severn estuary. Most
importantly, from the point of view of cost, a reduction in the structure’s
weight of some 30 per cent was shown to be possible by ‘streamlining’ to
accommodate the effects of wind.
It is a commentary on the problems of innovation in civil engineering
that it was necessary to mobilise this possibility in full – reducing weight
to an absolute minimum – to convince the client (the Department of Transport)
that the gain was worth the risks of building to such a drastically innovative
design.
Unfortunately, the fact that the bridge was light relative to its load
of traffic made it less able to withstand the increases in traffic in the
years after it was built. This problem has required strengthening measures
of great complexity that have only just been completed. It would seem that
the right balance was not struck between the short-term interest of saving
money and the long-term interest of ensuring extra margins of strength.
We are now at a point where innovation again presses. The cable-stayed
structural form is stretching towards spans of 1000 metres, hitherto exclusively
the preserve of the classical suspension bridge (see ‘Bridge design stretched
to the limits’, New ÐÓ°ÉÔ´´, 26 October). Meanwhile, spectacular increases
of span should open up for the classical form using aramid or other high-strength
nonmetallic cables. Both forms present a challenge: how to foresee and avoid
the hazards that no doubt await the designer. The challenge for the designer
and the client is to achieve a balanced assessment of risk, bearing in mind
that the client must buy from the drawing board.