Why Engineers Don't Build Things to Barely Survive

How much stronger than necessary does a structure actually need to be, and who decides? It sounds like an engineering footnote, but it's really a question about how a profession converts catastrophic, hard-to-predict failures into numbers that show up in a spreadsheet before a single beam is poured or bolted.

Chicago's own building stock offers a useful, less dramatic illustration than a Hollywood disaster. The city's building code, one of the oldest municipal codes in the country dating to reforms after the 1871 fire, has historically required conservative live-load allowances for older loft and warehouse buildings that now get repurposed as residential lofts — part of why so many Fulton Market and West Loop conversions involve engineers re-verifying floor capacity rather than assuming original industrial specs translate directly to modern occupancy loads. The redundancy built into heavy timber and cast-iron-column construction from that era, over-specified by today's standards largely because the science of load calculation was less precise, has in some cases made adaptive reuse safer and cheaper than it would be with a razor-thin original design.

The Hyatt Regency walkway collapse in Kansas City in 1981 is the textbook case of what happens when redundancy is engineered away rather than never built in. Two suspended walkways crossed the hotel atrium, hung from the ceiling by long steel rods. The original design ran a single rod from the ceiling through both walkways, splitting the tension load between two connection points. A late change during construction, for fabrication convenience, switched to two separate rod sets — which sounds nearly identical, but doubled the load carried by the fourth-floor walkway's connection to its rods instead of dividing it. The National Bureau of Standards investigation that followed found the modified connection had barely half the strength needed to meet the Kansas City building code even before the crowd load on the day of the collapse. It wasn't an act of God or an unmodeled hurricane; it was a documented, checkable engineering change that nobody re-verified, and 114 people died when the walkways gave way onto a dance being held below.

Contrast that with Citicorp Center (now 601 Lexington Avenue) in Manhattan, completed in 1977, where the failure mode was different: not a shortcut, but a genuine gap in what had been modeled. Structural engineer William LeMessurier discovered in 1978, after the building was already occupied, that the tower's distinctive stilted design — raised on four columns positioned at the middle of each side rather than the corners — made its bolted (rather than welded) diagonal bracing joints vulnerable to quartering winds, meaning wind hitting the building at a corner angle rather than straight-on. Standard code calculations at the time typically emphasized perpendicular wind loads, and the quartering-wind case had not been fully modeled with the building's actual connection details. LeMessurier calculated that a strong enough storm — one with roughly a 1-in-16-year recurrence for that wind direction, according to his own later accounts — could conceivably fail the joints. The building's owners quietly reinforced every one of those joints in secret, overnight welding, while the 1978 hurricane season played out, a case now taught widely in engineering ethics courses as an example of both a real gap in original analysis and a rare instance of a firm fully correcting it once found.

Safety factors are not a single universal truth handed down from physics; they're policy choices made under uncertainty, and different disciplines land on very different numbers for reasons that don't always translate cleanly across fields. Aerospace engineers work with 1.5 because every extra pound of margin costs fuel and payload for the life of the aircraft; civil engineers building a highway overpass have far less pressure to shave material and correspondingly larger margins, often effectively several times higher when you account for combined load and material factors together. Comparing "the" safety factor for a bridge to "the" safety factor for a plane wing is comparing different risk economies, not different levels of caution.

There's also real professional disagreement about how much of the historical safety margin in codes reflects genuine physical uncertainty versus institutional conservatism that persists mostly because nobody wants to be the engineer who advocated cutting it. Some engineers and code-writing committees have pushed toward performance-based design — modeling exactly how a specific building responds to a specific earthquake or fire scenario rather than applying blanket safety factors — partly because uniform margins can be wasteful in some cases and insufficiently protective in genuinely novel situations in others. That shift is still underway and not resolved by consensus.

And a plain fact worth sitting with: no safety factor protects against every failure mode. Codes and margins are built from known failure patterns — the kinds of loads and forces engineers have already seen go wrong often enough to quantify. Genuinely novel conditions, like a resonant frequency nobody had reason to model, or a material degradation pathway that takes forty years to show up, can still find the gap. Safety factors reduce the odds of failure; they don't manufacture certainty out of an uncertain world.