The bridge that swayed

When the Millennium Bridge in London opened in June 2000, around ninety thousand people crossed it on the first day. Within hours it was swaying sideways enough to make walkers grab the handrails. It closed after two days and stayed closed for almost two years.

The engineers had checked the obvious things. The bridge was strong enough; nothing was close to breaking. They had also considered the familiar warning about soldiers marching in step, and the design accounted for vertical loads from crowds. What had not been anticipated was a sideways effect, and the mechanism turned out to involve the walkers themselves.

A small sideways movement in a crowded bridge makes walking slightly awkward. People correct their balance, and because everyone is correcting on the same moving surface, the corrections synchronise. Synchronised corrections push the bridge further in the direction it was already going, which makes the next correction larger. The crowd and the structure form a loop in which each amplifies the other, and nobody in the crowd is aware of doing anything unusual.

The fix was unglamorous: dampers fitted beneath the deck, absorbing energy from lateral movement. The bridge has been stable ever since.

What makes the episode instructive is that no component failed and no calculation was wrong. The failure was in the boundary of the model. Everything inside it was handled correctly, and the problem lived in an interaction between the structure and its users that the model did not contain. Those are the failures that are hardest to anticipate, because the question that would have revealed them was never on the list.