I was playing tennis. That's the part that stays with me from what Daniel wrote. He was on a tennis court, thirty-seven years old now, and the thing he remembers is a room full of people suddenly silent in front of a small CRT.
And the question underneath all of it, which is the one everybody watching that morning asked and then felt a little foolish for asking. Would the towers hold.
Right. He watched it live without understanding the magnitude, and he wants the physics. What actually happened to those buildings when the aircraft hit, whether the engineers of the nineteen sixties ever considered a scenario like it, whether it is even possible in theory to build something that survives a deliberate airliner attack, and whether we should try. He has a view on that last part. The chance of an accidental event like this is vanishingly small, and preventing an intentional one, in his framing, belongs at the security layer rather than the structural one. Making a building invincible against a completely unnatural attack is not a target he thinks is worth pursuing.
He's not wrong, and we'll get to why the engineers themselves say the same thing. But there's a question he's circling that I find more interesting than it looks at first. He assumes this wasn't something the designers considered. It was actually considered. In detail.
That's the thing nobody expects. Before we can ask whether a building could survive that, we have to be honest about what the people who built it thought they were designing for.
The pre-2001 world is important here, because it's too easy to assume the buildings were designed in a vacuum. Building codes did not require aircraft impact to be considered at all. Not then, not now, in any ordinary code. The Twin Towers were the first structures outside the military and nuclear industries ever designed to resist jet impact, and that design was a voluntary act by the Port Authority. Somebody chose to do it.
So it wasn't an oversight. It was an extra.
And the record of that extra is a three-page white paper, dated February third, 1964. The conclusion, roughly: a Boeing 707 or a DC-8 travelling at six hundred miles per hour would cause only local damage which could not cause collapse or substantial damage to the building.
Three pages.
And it was a real analysis. Not marketing, not a sales claim. Somebody did the arithmetic on an aircraft impact and concluded the structure would take it.
And then twenty-five years of argument about what that document actually promised. The popular version is that the towers were built to survive a plane, so the collapse looks like a betrayal of that promise. The honest version is narrower and, frankly, more interesting.
The hole in the white paper is fire. The National Institute of Standards and Technology went looking for any evidence that the original analysis considered the fire that would follow the impact, the extent of the structural damage the impact itself would cause, or the size of a fire created by thousands of gallons of jet fuel. They found none. The design assumption was real but it stopped at the moment of impact.
So the paper said the building would be standing after the plane hit it. It didn't say anything about what happens for the next hour while it burns.
Which is the axis the whole episode turns on. So let's open the 1964 white paper and see exactly what it did and did not consider.
The number I want to sit with is six hundred miles per hour. That's the assumed speed in the paper. And the aircraft they actually got were flown faster and were heavier.
Almost twenty percent heavier than a 707. And the speed matters more than the mass, because kinetic energy scales with the square of velocity. Double the speed and you quadruple the energy. So a modest increase in speed is not a modest increase in the problem you're handing the building.
Leslie Robertson, the chief engineer, is very plain about this. He said, in a BBC interview, that they designed for the impact of the largest airplane of its time, the Boeing 707, and then that with the 707, to the best of his knowledge, the fuel load was not considered in the design. And then the line that stays with you: and indeed I don't know how it could have been considered.
That's not a man making an excuse. That's a man saying the analysis ran out of road.
Why could it not have been considered? What's the technical reason he'd say that?
Two reasons. One, there was no established method for predicting how a structure behaves under a multi-hour, multi-floor uncontrolled fire in 1964. The fire engineering of the era didn't have the tools. And two, the fuel load is enormously variable. A plane on a short domestic hop carries almost nothing. A plane crossing the country carries a lot. A plane on a transcontinental flight carries a great deal. So even if you wanted to model it, you have to pick a fuel load, and whatever you pick is arbitrary.
Arbitrary is the honest answer. It always is.
And there's a context here that made the builders less cautious than they might otherwise have been. The Port Authority adopted the proposed 1968 New York City Building Code three years before it took effect, and that code was less restrictive than the 1938 code it replaced.
In what way less restrictive?
Three big ones. Required stairwells were cut from six to three. Fire towers were eliminated. The fire rating on the core shaft walls dropped from three hours to two. And there was a permitted one-hour reduction in fire rating for structural components. The towers were built to a code that was more permissive than the code it was replacing.
Which is worth stating plainly. The buildings that everyone assumed were over-engineered were built to a slightly looser spec than the ones that came before.
It's the kind of detail that makes the whole story harder to tell as a morality play. The towers weren't unusually fragile and they weren't unusually robust. They were designed to a set of assumptions that, in hindsight, were narrower than what the building would face.
Then 1993 happens. Bomb in the basement.
And Robertson said afterwards that the bombing created a lot of confidence in everyone's mind that the Trade Center was pretty sturdy.
That's the wrong lesson learned.
It's the exact opposite of what the 1993 hearings recommended. The post-bombing commission said harden the target, and specifically, train for a plane strike. The building had survived a bomb, so the assumption became that it would survive more. That confidence is what made the next eight years more relaxed than they should have been.
And it's the confidence that made the 1964 white paper feel like a settled matter. Three pages from 1964, plus a bombing survived in 1993, and you have a building that everybody believes is safe.
So now we get to the morning itself, and the thing to keep straight is that this is not a story about impact. This is a story about impact plus fire plus the loss of the fireproofing.
Sequence. Take me through it.
Aircraft impact damages perimeter columns. Loads redistribute to adjacent columns and to the core, via the floor systems and the hat truss at the top. The building is still standing at this point. The fires are fed mainly by building contents, not by the jet fuel, which is mostly consumed in the first few minutes. Over the next hour, those fires heat the core columns, which soften and buckle, which shortens them. As the core shortens, the floors above pull the perimeter columns inward, which is the inward bowing people saw in the photographs in the minutes before collapse. The perimeter sections buckle. And then the change in potential energy due to the downward movement of the building mass above the buckled columns exceeds the strain energy that could be absorbed by the structure. Global collapse.
That last sentence is the whole physics in one line. The building had a finite capacity to absorb energy, and the falling mass exceeded it.
And the crucial finding that gets lost in the retelling: the towers withstood the impacts. Demand-to-capacity ratios, which is the ratio of the load a column is being asked to carry against what it can take, showed the majority of core and perimeter columns continued to carry loads after impact. They would have remained standing were it not for the dislodged fireproofing and the subsequent multi-floor fires.
Not the impact. The fireproofing.
Not the impact.
I want to stop on the fireproofing, because the number in the record here is absurd. It was specified at half an inch at construction. Upgraded to one and a half inches on some floors later. And a model-code evaluation, for a similar floor system, recommended two inches. That's a three-to-four-fold discrepancy on a component whose entire job is to keep the steel from heating.
And NIST's language is unusually blunt. They said it confirms the lack of technical basis in selecting a thickness. That's a regulator saying the number on the drawing had no derivation behind it.
Half an inch. That's a coating. Two inches is a system.
That distinction matters, because the fireproofing is not decoration. Spray-applied fire-resistive material works by insulating the steel. It buys time. Every additional half inch buys more time. If the wrong thickness is on the steel, the failure clock runs faster, and the fire has more of a chance.
The two towers stood for very different amounts of time. What are the numbers?
One hundred and three minutes for the north tower. Fifty-six for the south. Nearly identical aircraft.
Forty-seven minutes of difference.
The difference comes from asymmetrical impact damage, from how much fireproofing was dislodged on each floor, and from how the loads redistributed after the impact. The south tower was hit lower and off-center, and the fireproofing came off differently on the way in.
So the outcome was contingent. There wasn't one deterministic collapse mode. There were a dozen variables, and small differences in them produced a forty-seven minute gap in survival time.
Which is the detail that makes the "design flaw" story impossible to hold. Same drawings, same steel, same code, and a forty-seven-minute difference in how long the building stood. That's not a unique structural weakness. That's the physics of a very particular morning.
What was the actual overload once the upper section started moving? I've seen an order-of-magnitude estimate from Kausel at M.I.T.
At least a factor of ten. Dynamic forces exceeding the design loads the lower columns were ever specified for. His phrasing is, there was no way in the world that the columns below could have taken this large overload.
Ten times. Which is the pivot point. Once the upper section is falling, the question changes character. It is no longer about resisting an impact, it is about absorbing the gravitational energy of a collapsing mass. Resisting an impact is a peak-load problem. Absorbing a collapse is an energy-budget problem. Those are different questions, and they demand different answers.
And that's the shift the whole second half of this conversation turns on. Because the first question, could a building survive the impact of a fully fuelled airliner, is the one everybody asks. The second one, could a building survive the collapse that follows, is the one that answers it.
So take the theoretical question seriously first. Could a building be built to survive this?
Buyukozturk and Ulm at M.I.T. gave the cleanest answer. The towers were indeed designed to withstand the impact of a large commercial aircraft. They were not, however, designed to withstand the prolonged effect of fire resulting from a bomb in the guise of a fully fuelled aircraft. So: impact, maybe. Impact plus hours of contents fire plus a falling upper section, no.
Which is to say the question is not really about the impact. It's about everything that happens next. The building wasn't killed by the plane. It was killed by what the plane did.
And the honest framing of the original question is that the 1964 analysis was correct on its own terms. You put a 707 through that building at six hundred miles per hour and the building stands. The analysis just didn't take the next step.
Is there a version of the design that does take the next step? Because this is the part I want you to be careful about. There's a temptation to say "well, you could just make the columns thicker", and I don't think that's right.
It's not right, and the reason is the position Jerome Connor at M.I.T. took. Making existing buildings jet-crash proof makes no sense whatsoever. The chance that any individual building out of the thousands in the nation might suffer a similar attack is so small that retrofitting them would not make economic sense.
And then the follow-up that closes the argument.
A terrorist could simply increase the load.
Yeah. That's the end of it.
That's the end of it because it turns the question into an unbounded problem. Every defensive measure you take is a specific response to a specific attack profile. And the attacker chooses the attack profile. You don't. So any target you set is a moving target, and it will move faster than you can build.
Kausel makes the point from a different direction. He says buildings that could withstand massive blast forces and jet-fuel fires would be unbearably ugly. Nobody would wish to live or work in such fortresses.
And that's not just an aesthetic objection. It's a design objection. The room you work in is shaped by the structure you need. If you need twelve-foot concrete walls at the base and a fully shielded interior core, you don't get a building with windows. You get a bunker with an address.
So we're now at the point where Daniel's own take is well supported. Not by intuition, by the engineers who worked on it. He says the chance of an accidental event like this is vanishingly small, and preventing intentional attacks belongs at the security layer rather than the structural layer. He thinks making buildings invincible against deliberate aircraft attacks is the wrong target.
And the institution that actually writes the codes says the same thing. Beth Tubbs at the International Code Council put it flatly. Such risks cannot be addressed in a building code. And then the real question, which is not a technical one: how much should society invest in protecting against a dread risk?
That's a political question dressed as an engineering question.
It's a distributional question, and the code council is very careful to say so. NIST uses the same language. These load conditions fall outside the norm of design loads considered in building codes. So the answer was never going to be "make buildings invincible". It was going to be "make them better at failing slowly".
Which is where the profession actually went.
And that's the part Daniel's prompt is really asking about, and it's the piece that I find most interesting. Because when you look at what actually changed after 2001, it isn't a fortress architecture. It's a set of humdrum procedural reforms, and they pay off in fires and earthquakes and high winds, not in aircraft attacks.
Give me the shape of it.
NIST issued thirty recommendations across eight categories. Twenty-three major code changes were adopted into the International Code Council's 2009 I-Codes. The conceptual shift is what matters more than the specific items. The central concept is the alternate load path method, which is exactly what it sounds like: design the structure so that if you lose a critical element, the loads can redistribute through alternate routes rather than triggering a disproportionate collapse.
So if a column is destroyed, the building has a plan B.
It has a plan B. Underneath that you have structural integrity, key element analysis, continuity, structural ties, local resistance. The unifying idea is that the structure isn't just a set of parts that each work on their own. It's a system that has to keep working when one part doesn't.
And the nuance that keeps this from being a triumph narrative.
New York City practice evolved toward what's called a balanced framework rather than requiring alternate load paths universally. Because those measures, in the language of the code commentary, can be costly, complex, and limiting. The International Building Code now splits the requirement at four hundred and twenty feet, which is about a hundred and twenty-eight metres. Typical high-rise below, super high-rise at or above, with different requirements at each level.
The code isn't a single standard. It's a sliding scale, and the question at each step is whether the added robustness is worth the cost.
That's actually the correct way to make the decision. It's a profession deciding how much robustness to buy, not a profession declaring victory.
The framing that stays with me from the ASCE piece is that 9/11 was not simply a collapse event, it was a systems event.
Because everything the code changes address, the alternate load paths, the structural integrity, the evacuation improvements, the elevator systems, the peer review, they are all consequences of treating the building as a whole system rather than a stack of elements that each pass their own check.
What's the concrete downstream list? Because I want the specifics here, not the abstraction.
Fire service access elevators, which are now required in buildings with floors more than a hundred and twenty feet above fire department access. Occupant evacuation elevators, which are recognized as a design option rather than an emergency evacuation tool only, and the first installation in the United States was at 181 Fremont in San Francisco. New York City's 2008 Construction Codes, which were the first major modernization of the city's code in nearly forty years, mandatory for new construction from July first, 2009. And since 2008, structural peer review for buildings over six hundred feet, over one million square feet, or with high aspect ratios. That's Section 1618.
Peer review. So an independent engineer looks at the design before it's built.
That's a mundane procedural change, but it's the kind of thing that catches errors which wouldn't otherwise be caught.
The blast standard is the honest limit of the response, isn't it?
Yes. ASCE and SEI's fifty-nine dash twenty-two Blast Protection of Buildings emerged partly from the post-2001 rethinking, because it was recognised that government buildings might not be the only targets. But it addresses mitigating disproportionate collapse. It does not address surviving a direct jet-fuel attack. That's the boundary of what engineering has actually signed up to do.
The Pentagon is the counter-case worth mentioning, because it's the building that did better than expected.
Better than expected for reasons the designers didn't anticipate. The 1941 design proved more resistant to progressive collapse than analysis predicted, because of structural continuity and column reinforcement. Paul Mlakar at the Army Corps of Engineers described the outcome as a relatively small area of the building collapsing twenty minutes after impact.
Continuity and redundancy. Not invincibility.
Continuity and redundancy. That's what bought time. It didn't stop the attack. It changed what happened after.
What's the honest statement of where this all lands, then?
No building has ever been designed and built to survive a deliberate, fully fuelled airliner attack. The engineering consensus, from M.I.T., from ASCE, from the code council, is that it isn't a practical target. And the real legacy is a profession that got better at disproportionate-collapse resistance and at evacuation, which pays off in fires, earthquakes, and high winds. Not in fortress architecture.
Robertson's own line is worth putting up against that. He said, near the end of his account, I just hoped that the buildings would stand. I had no way of knowing that they would or would not.
Which is the truth of any large structural design. You build against a set of assumptions, and then you find out.
The thickness was measured with a comb gauge.
Spray-applied fireproofing. The thickness is measured with a comb gauge. It's a little toothed tool, you press it into the wet material and the teeth tell you how deep the coating goes. I've watched a crew do it. You can't use a tape measure because the material is going onto a flanged column, so the geometry isn't flat, and you need to know the thickness on the web and the flanges separately. The comb gauge tells you both.
The crew chief walks the floors with a toothed gauge and reads the thickness off it.
The crew chief walks the floors and reads the thickness off it. And the difference between half an inch and two inches is not a rounding error. It's the difference between a coating and a system.
Half an inch versus two inches was the number that stood out to us too. It's a three-to-four-fold gap.
It's the number that should have been the story. The white paper was an honest analysis with a known omission. You can argue about whether the engineers should have modelled the fire and the answer is that they couldn't, because there wasn't a method. So you file that under "limits of the era". The fireproofing is different. The fireproofing was a specification. Somebody put the number on the drawing. If the number on the drawing has no derivation behind it, that's not an era problem. That's a decision problem.
NIST's words were that the thickness selection confirms the lack of technical basis.
Which is a regulator's way of saying nobody wrote down why.
That argument is pretty strong, actually. You're saying the fireproofing is more damning than the white paper because the white paper is excusable and the fireproofing isn't.
That's what I'm saying. I'm not disagreeing with your conclusion. I think you two are letting the fireproofing off easily.
That's a fair reading, and I think you're right that it sitting in the same clause as the 1964 paper is doing it a disservice.
I was on a job once as a consultant on the fireproofing on a building that never got built. They brought me in to review the spec against the model code, which is a small job, one afternoon's work. They paid me in full. And I still send them an invoice for zero dollars every year, as a professional courtesy, and they have never once replied.
The building never got built and you still invoice them.
I still invoice them. It's a courtesy. They'd have to tell me to stop if they wanted me to stop.
Do you still have the comb gauge?
I have the comb gauge.
Right.
Anyway. The fireproofing is the number I'd put in the headline, not the white paper. That's all I've got.
I'd like to come back to the comb gauge for a second, actually, because I think it's a good way to look at the whole episode. The comb gauge is a measurement tool. Somebody built it because the thickness of the material matters, and somebody had to be able to check that it was on the steel the way the drawing said. Everything we've been talking about is a version of that question. The 1964 white paper measured the impact and skipped the fire. The code measured the fire rating and skipped the aircraft. The fireproofing spec measured a number and skipped the derivation. Each of these is a moment where the measurement was narrower than the thing it was meant to describe.
The code changes after 2001 are all attempts to widen the measurement. The alternate load path method is a way of measuring what the structure does when a critical element is gone. The peer review is a way of measuring the design against a second set of eyes. The evacuation requirements measure the time to get people out rather than the time for the steel to fail.
OK, so where do I land on this. Daniel's thesis is right. The engineers he quotes say it, the code council says it, and the historical record says it. Making skyscrapers invincible against deliberate airliner attacks is not a target worth pursuing. The chance of an accident like this is vanishingly small and the prevention of an intentional one belongs at the security layer.
The interesting part of what he asked is what came after. Not "is invincibility possible" but "did the response to the failure do any good for the buildings that are going up today".
The answer is yes, and it's a boring kind of yes. Fire service access elevators, occupant evacuation elevators, alternate load paths, peer review, continuity, redundancy. Nothing about those measures stops an aircraft. All of those measures help in an earthquake, in a fire, in high wind, in a floor that has lost a column because a truck hit the base of it.
Which is the ASCE framing of the whole thing. 9/11 as a systems event. The building wasn't a stack of elements. It was a system. And every meaningful reform since reflects that.
The one thing I'd take from this is the fireproofing. If you take one thing from this, it's that the failure didn't come from the thing everybody argues about. It came from a number on a drawing that nobody could defend. Half an inch. And the fix afterwards wasn't to make the buildings unbreakable. It was to make the profession check the numbers on the drawings more carefully.
To add a peer reviewer whose whole job is to ask why the number is what it is.
The next dread risk that the code will be asked to regulate is probably not an aircraft. It's probably something none of us have thought about yet. And the buildings going up are being built right now, against today's set of assumptions, which is what every generation has done. The 1964 white paper was an honest analysis that skipped the fire. The fireproofing was a specification nobody could defend. I'm not sure which one worries me more about the buildings in construction this year. Probably the second one. The first is honest about its limits. The second doesn't even know what the limits are.
The systems framing suggests the next wave of design review will judge a building less on whether each of its parts passes its own check and more on how the entire business behaves when something happens that nobody planned for.
That's where I'd leave it. Thanks to our producer, Hilbert Flumingtop. If this was your kind of episode, go back for episode twenty, Architectural AI; episode ten, How ASR Went From Frustration To ... Whisper Magic; and episode eight, Building Your Own Whisper. This has been My Weird Prompts.
If you want to send us a prompt, the place to do it is Telegram, at t dot me slash MWP listener bot. And if you want to find the back catalogue or read the show notes, it's all at my weird prompts dot com.
Send us your own prompt. We'll be back soon.
