#89 1978 · William LeMessurier / Citicorp · Structural engineering / construction
The engineer who discovered his own finished skyscraper could collapse in an ordinary storm didn't hide it or panic publicly — he confessed to the client and had it secretly rebuilt around the people living inside it.
the problem
a professional discovers, only after delivery, that their own completed work has a critical, previously undetected flaw
background
Manhattan's newly completed Citicorp Center stood on four massive stilts positioned at the midpoints of its sides rather than the corners, an unusual design engineer William LeMessurier had calculated to withstand winds hitting the building's flat faces straight-on. Under standard 1970s New York building code, engineers were not required to check how a structure like this responded to quartering winds — gusts striking at a diagonal, toward a corner instead of a face — because that scenario was assumed to produce less stress than a direct hit.
Months after the tower opened and was fully occupied, a Princeton engineering student's question about quartering winds prompted LeMessurier to run the numbers out of curiosity, not obligation. He found that diagonal winds increased stress on the building's diagonal support braces by roughly 40 percent — and separately discovered that during construction, cost-saving had quietly changed the connections at those braces from welded joints to bolted ones, a substitution his own office had approved without fully re-checking its strength. Combined, the two facts meant the building's bolted joints could fail in a storm expected to strike New York roughly once every 16 years, with no meaningful warning before a partial collapse.
what everyone would do
The available responses to discovering a hidden, potentially catastrophic flaw in a finished, occupied building were the two extremes: quietly conceal the defect to protect his own reputation and hope the specific storm conditions never occurred, or go public immediately and trigger a panic evacuation of a fully occupied Manhattan skyscraper before any fix existed.
what they saw
LeMessurier saw that neither extreme actually served the people living and working in the building, concealment left them genuinely exposed to a real risk of collapse, while immediate public disclosure with no fix ready would create chaos and panic without making anyone safer any faster. Rather than choosing between silence and alarm, he disclosed the defect immediately but narrowly, directly to Citicorp's leadership and insurers who could actually authorize and fund a fix, and moved fast on a low-visibility correction that addressed the real danger without the disruption a public announcement would have caused before a remedy was ready.
the move
Rather than conceal the flaw to protect his reputation, or go public and risk a panic evacuation of an occupied Manhattan skyscraper with no fix yet in hand, LeMessurier disclosed the defect directly to Citicorp's leadership and insurers within days, then designed and ran a night-shift welding repair — internally code-named Project SERENE — reinforcing all 200 vulnerable joints with steel plates while the tower stayed open and fully occupied during business hours.
why it works
Disclosing to the narrowest chain that could authorize a fix, rather than either the public or no one, meant the people with actual power to act got the information immediately while the building's occupants were spared a premature panic that would have accomplished nothing except disruption before repairs could even begin. Running the repair, code-named Project SERENE, as a quiet night-shift welding operation reinforcing all 200 vulnerable joints let the actual danger get addressed at the same speed a public crisis response would have required, without the chaos, reputational spiral, or potential stampede-related risks a public evacuation announcement could have introduced on its own. Because the fix was completed in months, finishing before the fall hurricane season fully arrived, the approach converted a genuine catastrophic risk into a managed, resolved one before the specific storm conditions that could have triggered collapse ever materialized, which is exactly why the episode is now held up as the model response in engineering ethics rather than a story of either negligence or overreaction.
the payoff
Welders worked through the night from August to October 1978, finishing the repair before the fall hurricane season fully arrived; contingency evacuation plans were quietly prepared but never used, including during a scare when Hurricane Ella threatened New York mid-repair before turning out to sea. The fix held, the building never failed, and the episode stayed almost entirely out of public view until a 1995 New Yorker article revealed it 17 years later — after which LeMessurier's decision to self-report was widely held up in engineering ethics teaching as the model response, rather than a career-ending admission.
where it breaks
The mechanism depends on there genuinely being a narrow, empowered audience capable of authorizing and funding a fast fix, a flaw discovered in a context with no clear responsible party able to act quickly, a public building with fragmented ownership or bureaucratic approval chains, might not permit the same speed, forcing a harder tradeoff between concealment and public alarm. It also depends on the professional actually being capable of designing and executing a genuine fix within the time available before the risk materializes, LeMessurier's narrow disclosure only worked because Project SERENE could plausibly complete before hurricane season, a defect with no available remedy or a much shorter safety margin might leave no responsible option except public disclosure regardless of the disruption it caused. And this approach requires real trust between the discloser and the narrow audience informed, a professional disclosing to a client or authority who might respond by burying the problem rather than funding a genuine fix would have made quiet disclosure indistinguishable from concealment, meaning the model depends on the disclosed party actually being willing and able to act in good faith once informed.
what came after
The Citicorp Center crisis is now a standard case study in engineering ethics and structural failure courses, cited for showing that voluntary, immediate self-disclosure of a professional's own error — followed by a fast, quiet fix — can avert catastrophe better than either silence or public alarm, a template later echoed in software security's coordinated vulnerability disclosure and aviation's just-culture safety reporting.
references
- [1]Citicorp Center engineering crisisWikipedia, 2026en.wikipedia.org
- [2]A Potentially Disastrous Design ErrorDamn Interesting, 2010damninteresting.com
- [3]The Fifty-Nine-Story CrisisThe New Yorker (Joe Morgenstern), hosted by Duke University, 1995people.duke.edu