Event 

At 21.15 h on March 13, 2012, a Belgian coach crashed in the Sierre tunnel in Switzerland. The coach was on its way to bring school children and their attendants back to Belgium. The school children had had a holiday of 9 days, in which they also had practiced skiing. There were 52 people on board the bus, of which 22 children, 4 attendants, and 2 drivers died in the crash. The bus had got off the road and had collided head‐on with a wall of a lay‐by, and that wall was perpendicular to the road direction (see Figure 6.1).

Additional Facts 

The Sierre tunnel is near Sierre in the Swiss canton of Valais. The tunnel was opened in 1999 and consists of two tubes of 2460 m in length. Thus, it is a unidirectional tunnel. There is a European Directive on the minimum safety requirements for tunnels in the trans‐European road network [1]. Switzerland is not a member of the European Union; however, it has committed itself to follow this Directive. The Directive contains instructions for lay‐bys in tunnels, however, only for bidirectional tunnels. Furthermore, the Directive does not contain instructions concerning the angle between the end walls of lay‐bys and the road direction.

Concluding Remarks 

End walls of lay‐bys of roads in tunnels should have an angle with the road direction of, e.g. 30°. Vehicles can get off the road and on the lay‐by for various reasons, e.g. simply by mistake. If that is the case, they should be treated as gently as possible by deflection. The Swiss authorities have installed a crash barrier in the lay‐by in question after the accident. That crash barrier has an angle of less than 30° with the road. This provides a good safety margin to mitigate the effects of collision.

Event 

On December 12, 2003, a bus driver was caught between the front doors of his bus at Almelo in The Netherlands when he left the bus in the bus house [2]. He was killed by the force of the closing doors.

Additional Facts 

The bus driver had switched off the bus operational system and wanted to leave the bus through the front doors. The interlocking of the bus system saw to the violent closing of the front doors 4 s after the bus operational system had been switched off. It had been taken into consideration that 4 s should be the ample time for the bus driver to leave the bus after he had switched off the bus system.

Concluding Remarks 

Immediately after the accident, Connexxion, the responsible bus company, ordered bus drivers to leave their buses through the exits in the middle part of the bus or at the rear of the bus. Those doors were safeguarded; that is, they closed slowly and opened automatically when experiencing a resistance. Subsequently, the company had changed the interlocking of the front doors of their buses within weeks. The front doors closed slowly after this modification and opened automatically when experiencing a resistance. The original margin of 4 s to leave the bus by the front door was too small and the violent closing of that door was unsafe.

Event 

At approximately 09.00 h on November 11, 2000, a carriage of a cable railway took fire in a tunnel at Kaprun in Austria. The carriage was moving to the mountain station. A total of 150 people from the carriage died in the accident. The driver and a passenger in a train near the mountain station and three people in the mountain station died as well. Their death was caused by smoke.

Additional Facts 

The cable railway transported skiers through a tunnel having a length of approximately 3.3 km. The carriage took fire after it had advanced approximately 600 m in the tunnel. Twelve passengers escaped from the fire by leaving the carriage and walking downward. Other passengers left the carriage and walked upward. They lost their lives because the flames and the smoke also moved upward.

The fire started by the ignition of a hydraulic oil. The hydraulic oil was in use for the braking system. The fire started in the driver's cabin at the rear of the train. The train had driver's cabins both at its front and its rear. The driver's cabins were integral parts of the train. At the time of the accident, the driver's cabin at the front was manned, whereas the one at the rear was not manned. Electric air heaters had been installed by the operator of the cable railway in the driver's cabins to warm the air in the cabin. A line containing hydraulic oil for the braking system was close to the air heater in the driver's cabin at the rear of the train and leaked or started to leak. The oil's trade name was Mobil Aero HFA. The hydraulic oil was inflammable.

Concluding Remarks 

Placing an electric heater and a line containing an inflammable liquid close to each other should have been avoided. Reference is made to the contents of Section 4.2.3. Having an inflammable car refrigerant is not recommended. A remark made in Section 4.2.5 is also applicable in this case. Knowledge acquired by companies manufacturing cars would have been useful in this case.

Event 

On February 12, 2010, Georgian luger Nodar David Kumaritashvili suffered a fatal crash during a training run for the 2010 Winter Olympics competition at Whistler in Canada [4].

Additional Facts 

The luger was fatally injured at the Whistler Sliding Centre when he lost control in the final turn of the course and was thrown off his luge and over the sidewall of the track, hitting an unprotected steel support pole. His speed was nearly 90 miles per hour. The speeds of the lugers on the course are maximum before the final turn.

Concluding Remarks 

Lugers can get off the track for various reasons. If that is the case, he or she should be treated as gently as possible by means of deflection. It is standard practice in ski resorts to shield steel support poles. After the accident, a high wooden wall was built at the location of the accident. Other measures to prevent further accidents at the 2010 Winter Olympics were taken as well.

Event 

In the afternoon of July 25, 2000, a Concorde airplane crashed at Paris. It fell on a hotel at Gonesse after having taken off from Roissy‐Charles de Gaulle Airport. A severe fire broke out under the left wing when the aircraft was still on the runway. The fire caused a loss of thrust of both engines attached to the left wing (Numbers 1 and 2). All 109 people on board the airplane and 4 people in the hotel lost their lives. The airplane had been in the air for approximately three quarters of a minute. Both the aircraft and the hotel were destroyed.

Probable Cause of the Accident 

The front right tire of the left landing gear having four tires (Tire 2) ran over a strip of metal, which had fallen from a different airplane, and was damaged [5]. Debris was thrown against the left wing and it caused the rupture of a fuel tank in the wing (Tank 5). The flow rate of leaking fuel has been estimated as several dozens of kg s⁻¹. The leaking fuel ignited by an electric arc in the landing gear or through contact with hot parts of an engine. The speed of the aircraft at that point in time was 280 km h⁻¹. That means that the aircraft was committed to take‐off. The fire caused a loss of thrust on Engine 2. The crew shut down Engine 2 following an engine fire alarm. The landing gear would not retract. Next, Engine 1 lost thrust, and, subsequently, the aircraft's angle of attack and bank increased sharply. Finally, Engines 3 and 4 on the right wing lost thrust by a combination of deliberate selection of idle by the crew and by a surge due to excessive air flow distortion. This allowed aircraft bank to be reduced. The Concorde then crashed practically flat, destroying the hotel. It was then immediately consumed by a violent fire.

Concorde Features 

The Concorde was an airplane designed to fly with a speed in the range of 2000–2200 km h⁻¹ at an altitude of approximately 17 km. The aircraft is depicted in Figure 6.2. This forced designers to attach two engines to each wing. The two engines attached to a wing were installed side by side. This design implies that a problem with an engine may affect the engine next to it. Furthermore, the engines are close to fuel tanks in the wings. Compare this design to that of, e.g. the Airbus 340 or the Boeing 747. Both the distance between the engines and the distance between the engines and the fuel tanks in the wings are relatively large for those airplanes.

The wings of a Concorde were more vulnerable to the impacts of foreign objects than the wings of, e.g. a Boeing 747 or an Airbus A340. For example, the skin thickness of Tanks 2, 5, and 6 was only 1.2 mm [6]. These tanks were damaged in an incident at Washington in 1979.

The speed with which a Concorde took off and landed was approximately 400 km h⁻¹ [7]. Compare this to the speed with which a Boeing 747 takes off and lands, that is, approximately 325 km h⁻¹. The high speed with which a Concorde took off and landed implied a heavy load for the tires.

Concorde History 

The Concorde resulted from a collaboration between France and Great Britain. A total of 20 Concordes have been built. British Airways and Air France together operated 14 airplanes. The commercial exploitation started in 1976. The number of flying hours before the accident at Paris in 2000 was 300 000. Both the English and the French Concordes were grounded within a month after July 25, 2000, the date of the accident. Approximately 1 year later, after the implementation of improvements, both operators were allowed to fly again with the aircraft. However, Air France stopped flying with the Concorde in March 2003 and British Airways in October 2003. Both companies mentioned the decrease in the number of passengers as the reason.

Previous Events Concerning Tires 

BEA (Bureau d'Enquêtes et d'Analyses pour la Sécurité de l'Aviation Civile) mentions 57 cases of tire bursts/deflations for the Concordes prior to the date of the accident at Paris on July 25, 2000 [8]. The number 57 has been assessed as the number of events for which information from at least two different sources had been found or for which reports or detailed information exist. Twenty‐one further events were notified by a single source, but no reports or detailed information exist for them. Mention of damage to the structure of the tanks was not made in any of these 21 events. Out of the 57 events, Air France experienced 30 and British Airways 27. Twelve out of these 57 events had structural consequences on the wings and/or the tanks, of which six led to penetration of the tanks. The latter six incidents occurred between 1979 and 1994. Only one out of these six incidents at which tanks were penetrated resulted in a fuel leak. This occurred at the aforementioned incident at Washington in 1979. The fuel leak from all of the penetrations at Washington in 1979 was 4 kg s⁻¹.

None of the 57 events identified showed rupture of a tank, a fire, or a significant simultaneous loss of power on two engines.

Only one case of tank penetration by a piece of tire was noted. Metal parts originating from, e.g. wheel rims punctured the tanks in the remaining five cases in which tanks were penetrated.

Several measures were taken in the course of the years, e.g. both Air France and British Airways stopped using retread tires. However, there were still three tire bursts in 2000 before July 25, 2000.

Concluding Remarks 

The deflating/bursting of tires of the Concorde during take‐off and landing was not considered a safety risk between 1976 and July 25, 2000. That point of view was held when serious consequences did not result from the incidents. After the accident at Paris on July 25, 2000, it was considered a safety risk. An important measure to prevent tire bursts/deflations was the introduction of the NZG‐tire (near zero growth) made by Michelin. A further important measure was the reinforcement of several fuel tanks by means of a Kevlar lining. Kevlar is a material used for, e.g. the manufacture of bulletproof vests. Further measures were implemented after July 25, 2000.

Event 

The Space Shuttle Challenger accident occurred on January 28, 1986, when it broke apart 73 s into its flight. Its Mission Number was STS‐51‐L (STS stands for Space Transport System). The spacecraft disintegrated over the Atlantic Ocean, off the coast of Central Florida. The disintegration led to the death of all seven crew members.

Space Shuttle 

Space Shuttles were launched from Kennedy Space Center at Cape Canaveral in Florida as from 1981 [9]. The program was stopped in 2011. A Space Shuttle consisted of four parts (see Figure 6.3). First was an Orbiter looking like an airplane having two short wings. Second and third were two Boosters containing solid fuel. They provided the major part of the thrust during the first part of the launch. They were empty after approximately 2 min, were pushed off, and were parachuted down into the Atlantic Ocean. The Boosters were reused. Fourth was an External Tank (ET) containing liquid oxygen at −183 °C and liquid hydrogen at −235 °C. The three main engines of the Space Shuttle were activated 7 s before the launch. They received both liquid hydrogen (fuel) and liquid oxygen from the ET. The ET was empty after approximately 8 min and was subsequently jettisoned from the Orbiter. It then burnt up in the earth's atmosphere. The main engines stopped functioning when the ET was empty and were not used anymore during the particular flight. Launching still lasted approximately 2 min after the ET had been jettisoned from the Orbiter. Engines smaller than the main engines then provided the further required thrust.

The ET was insulated with foam to prevent ice formation on the ET.

O‐rings 

Each of the two Boosters consisted of a number of separate segments joined together and sealed by O‐rings. The segments were shipped from their manufacturer and assembled at the Kennedy Space Center. The Challenger accident occurred when hot gases burned through an O‐ring and seal in the aft joint on the left Booster. The Presidential Commission on the Space Shuttle Challenger Accident published a report. The title of Chapter 6 is “An Accident Rooted in History”. In the Findings of this chapter, the following text can be read:

The Commission has concluded that neither Thiokol nor NASA responded adequately to internal warnings about the faulty seal design. Furthermore, Thiokol and NASA did not make a timely attempt to develop and verify a new seal design after the initial design was shown to be deficient. Neither organization developed a solution to the unexpected occurrences of O‐ring erosion and blow‐by even though this problem was experienced frequently during the Shuttle flight history. Instead, Thiokol and NASA management came to accept erosion and blow‐by as unavoidable and an accepted flight risk.

The title of Chapter 4 of the aforementioned report is “The Cause of the Accident”. The Conclusion of this chapter reads as follows:

In view of the findings, the Commission concluded that the cause of the Challenger accident was the failure of the pressure seal in the aft field joint of the right solid rocket motor. The failure was due to a faulty design unacceptably sensitive to a number of factors. These factors were the effects of temperature, physical dimensions, the character of materials, the effects of reusability, processing, and the reaction of the joint to dynamic loading.

Concluding Remarks 

The margins of the Space Shuttle with respect to O‐ring erosion and blow‐by were too small. The joints were redesigned after the accident.

Event 

The Space Shuttle Columbia tried to return from a mission on February 1, 2003. Its Mission Number was STS‐107. It disintegrated over Texas during re‐entry into the earth's atmosphere. This resulted in the death of all seven crew members.

Space Shuttle 

See Section 6.2.7 and Figure 6.3.

High Temperatures on Re‐entering the Earth's Atmosphere 

The orbital speed of Columbia was approximately 28 000 km h⁻¹. The Commander and the Pilot of Columbia used the two Orbital Maneuvering System engines to slow down Columbia, to leave the orbit, and to reenter the earth’s atmosphere. This occurred over the Pacific Ocean at a height of 122 km. Air consists of nitrogen and oxygen mainly. Columbia collided with these two types of molecules and that produced friction heat. During such a descent, wing leading‐edge temperatures rise to values probably exceeding 2760 °C [10]. The Space Shuttle was protected against high temperatures by a thermal protection system (TPS). To this end, reinforced carbon–carbon (RCC) panels were installed on the leading edges of the wings. However, shortly after the launch, a suitcase‐size piece of thermal insulation foam had broken off from the ET and struck the leading edge of Columbia's left wing, damaging an RCC panel. The piece of foam came off an area where the Orbiter attaches to the ET. Part of the hit RCC panel left the Columbia when it was in orbit. Thus, Columbia was, at this position, no longer protected against the high temperatures caused by the compression of the gas on re‐entry of the earth's atmosphere and that caused the destruction of the internal wing structure and ultimately of the vehicle.

Foam Shedding 

The shedding of ET‐foam had a long history [11]. Damage caused by debris has occurred on every Space Shuttle flight, and most missions have had insulating foam shed during ascent. One debris strike in particular foreshadows the STS‐107 event. On December 2, 1988, Space Shuttle Atlantis was launched on STS‐27R. During the ascent, shed insulating foam had knocked off a tile of the TPS, exposing the Orbiter's skin to the heat of re‐entry. The structural damage was confined to the exposed cavity left by the missing tile, which happened to be at the location of a thick aluminum plate covering an L‐band navigation antenna. Probably, the thick aluminum plate prevented the occurrence of further serious damage. Atlantis suffered further damage during the ascent on December 2, 1988.

Changes to Space Shuttle operations were implemented after the Columbia accident in 2003. On‐orbit inspections of the TPS were organized to detect damage. In case of irreparable damage, a rescue mission could be sent. A further decision was that, in principle, missions would be flown to the International Space Station (ISS) only.

Space Shuttle Discovery was launched on July 26, 2005, on the “Return to Flight” mission STS‐114. The mission was successful. However, a piece of foam was shed from the ET. The debris did not hit the Orbiter. The size of this piece of foam was comparable to the size of the piece of foam that hit the Columbia. The foam did not come from the same location as that in the case of the Columbia [12]. Due to this foam shedding, the next shuttle flight did not take place until July 2006. The second “Return to Flight” mission, STS‐121, was launched on July 4, 2006, and was successful. However, more foam was shed than expected [12].

The foam shedding at the two “Return to Flight” missions demonstrated that foam shedding remained a problem. It had not been possible to make the Orbiter more resistant to debris strikes either.

Concluding Remarks 

The margins of the launching of Space Shuttles with respect to foam shedding were too small.

The thought may come up why foam was used in the first place. Providing the ET with a double hull and creating vacuum in the concentric space would also have provided insulation and would not have caused shedding problems. However, such a design would have added mass to the ET, and at complicated spots foam would still be needed.

Event 

An airplane type Airbus A330 operated by Air France took off from Rio de Janeiro in Brazil on May 31, 2009. The aircraft was bound for Paris in France. It experienced problems over the Atlantic Ocean in the early morning of June 1. The problems could not be controlled by the pilots and the airplane hit the surface of the ocean. The impact resulted in the death of all 216 passengers and the crew of 12 people. The airplane was destroyed.

Cause of the Accident 

The speed indications became incorrect at 2 h 10 min 5 s, likely due to the obstruction of the Pitot probes by ice crystals [13]. The Pitot probes are at the outside of the airplane in contact with the atmosphere. Some automatic systems were subsequently disconnected. The flight crew could not control the flight path. It plunged into the sea at 2 h 14 min 28 s.

History of the Obstruction of the Pitot Probes 

Airbus was informed by 10 operators of A330 and A340 aircraft of 16 relevant incidents that occurred in cruise between February 2005 and March 2009 [14]. The manufacturer associated these 16 incidents with the failure condition manifested by a sudden reduction in several indicated speeds. Based on the data available, these incidents could be attributed to a possible obstruction of at least two Pitot probes by water or ice. Nine of them occurred in 2008 and three at the start of 2009.

An Airworthiness Review Meeting (ARM) took place in December 2008. The “Pitot icing” theme was on the agenda. Airbus presented 17 cases of temporary Pitot probe blocking that had occurred on the long‐range fleet between 2003 and 2008, including nine in 2008. Airbus could not explain the sudden increase in the number of incidents.

A further ARM meeting was held on March 11 and 12, 2009. The situation concerning the Pitot probes was reviewed. It was recommended to replace the Pitot probes by improved ones. However, the replacement was not made mandatory.

The European Aviation Safety Agency (EASA) wrote a letter dated March 30, 2009, to the Direction Générale de l'Aviation Civile (DGAC). DGAC is the French Civil Aviation Authority (CAA). In this letter, the EASA organization concluded that at that stage the situation did not mean that a change of Pitot probes on the A330/A340 fleet had to be made mandatory. EASA is a European Union Agency.

Changes Made by Air France Following the Accident 

The replacement of the Pitot probes by the aforementioned improved type was accelerated [15]. The replacement was completed on June 11, 2009. Subsequently, following an Airworthiness Directive issued by EASA, the Pitot probes in Positions 1 and 3 were replaced in early August 2009 by Pitot probes made by a different manufacturer. Final remark: prior to the AF 447 accident, Air France took the initiative to have the Pitot tubes in Position 2 replaced in January and February 2009 by Pitot probes made by the different manufacturer. Unfortunately, the replacement of one probe is not enough. Both the Airbus A330 and the Airbus A340 aircraft have Pitot probes in three positions.

Concluding Remarks 

The design of the Pitot probes was not a design with ample margins for the application in airplanes. Moreover, in case of failure of the probes, the flight crew had relatively little time, in the AF 447 accident less than 4 min, to make the required adjustments.

Event 

An airplane type Boeing 737‐800 operated by Turkish Airlines took off from Istanbul in Turkey on February 25, 2009 [16]. The aircraft was bound for Amsterdam in The Netherlands. It experienced problems shortly before it could have reached its destination. The problems could not be controlled by the pilots. When the airplane approached a runway, it lost height and fell, 1.5 km before the runway, on a field (see Figure 6.4). A total of 128 passengers were on board and 7 persons of the flight crew. The impact resulted in the death of five passengers and four of the flight crew, and 117 passengers and 3 persons of the flight crew were wounded.

Cause of the Accident 

There were two instruments to measure the aircraft's altitude [17]. The output of the left instrument controlled the fuel supply to the engines (autothrottle). The left instrument gave a value of −8 ft when the aircraft approached Amsterdam Schiphol Airport. This value was wrong. Wrong values had been measured at earlier occasions. The measurement led to a reduction of the fuel supply to the engines to a minimum value. The consequence was that the airplane lost too much speed. This fact was, in first instance, not noticed by the pilots. The pilots could have seen visual indications and warnings that the airplane lost too much speed and that the nose position was not right. A warning (by shaking of the stick) that the aircraft could stall was given when the altitude was 460 ft. The flight crew noticed the latter warning but did not react adequately and the airplane hit the ground shortly after this warning.

A second aspect is that the pilots of Turkish Airlines got landing instructions from the Air Traffic Control of Amsterdam Schiphol Airport that were not completely in line with the internal directions of the Air Traffic Control of Amsterdam Schiphol Airport. This fact caused a masking of the reduction of the fuel supply to the engines to a minimum value by the wrong value of the left instrument for measuring the altitude.

Finally, the approach of the landing strip had not been stabilized by the pilots. A stabilization of the approach comprises that the obligatory activities of the pilots prior to the landing have been completed when the airplane reaches a certain altitude. One of these obligatory activities is the preparation of a checklist for the landing of the aircraft. The pilots were still busy with the obligatory activities when the stick shaker signal came.

Functioning of the Instruments for Measuring the Altitude 

The instruments are located in the bottom of the aircraft [18]. Parts of the instrument are in contact with the atmosphere. An antenna sends radio waves to the ground. The radio waves are reflected by the ground and received by a second antenna. The instrument calculates the altitude from the time elapsed between emission and receipt of the radio waves.

History of the Problems with the Instruments for Measuring the Altitude Experienced by Turkish Airlines 

Turkish Airlines experienced problems with the instruments for measuring the altitude before the accident occurred at Amsterdam on February 25, 2009 [19]. The problems experienced most frequently were fluctuating and negative altitudes, the activation of the warning system of the landing gear, the cut out of the autopilots, and warnings from the ground proximity system. A total of 235 faults of the instruments for measuring the altitude of 52 Boeing 737‐800 airplanes of Turkish Airlines in the period from January 2008 to February 2009 were reported in the maintenance files of Turkish Airlines. Sixteen of these 235 faults came from the airplane involved in the accident at Amsterdam on February 25, 2009. Actions to remedy the faults were taken.

Appreciation of the Problems Experienced with the Instruments for Measuring the Altitude 

Turkish Airlines considered the problems as a technical problem. The operator did not see the problems as a safety risk [20]. Boeing also concluded that the problems were not a safety problem. As far as the Dutch Safety Board could ascertain, the latter conclusion was based on the reasoning that the probability of an incident under 500 ft is very small. Boeing considered the system to be more accurate at low altitudes than at high altitudes, making the probability of the occurrence of problems at low altitudes smaller than at high altitudes. Moreover, Boeing had the opinion that the pilots get a sufficient number of warnings and instructions to take timely action, to restore the situation, and to land safely [21].

Concluding Remarks 

The Number 1 Recommendation of the Dutch Safety Board in its report is:

Boeing has to increase the reliability of the system to measure the altitude by means of radio waves [22].

Turkish Airlines and Boeing hold the point of view that the problems with the instruments for measuring the altitude are a safety risk since the accident at Amsterdam on February 25, 2009.

Accidents with Flights AF 447 and TK1951 indicate that people are safetywise not 100% reliable to take proper action in case of emergencies.

Event 

The accident occurred in the iron ore mine Lengede‐Broistedt on October 24, 1963. Approximately 700 000 m³ of water ran from a pond, which was part of the facilities and adjacent to the mine, into the mine and filled it from 100 m below ground level up to 60 m below ground level. The maximum depth of the mine was 100 m. A total of 129 men were trapped in the mine, of which 79 managed to get out in the first couple of hours. Seven men were rescued on October 25. By means of a drilling action, three men were rescued on November 1. A final spectacular drilling action saved the lives of 11 miners on November 7. The total number of miners who lost their lives was 29.

Additional Facts 

The pond was used for clarification purposes. That means, the pond was used to accomplish a solid/liquid separation. Water that had been used in the facility, and still contained small solid particles, was transferred to the pond. The small solid particles settled in the pond. The supernatant liquid, i.e. clear water, could then be disposed of. The pond had been installed in a pit in which open‐cast mining had been practiced. There were connections between the pit and the mine before it was changed into a pond. These connections had been filled before the pit had been turned into a pond.

Concluding Remarks 

A separation between the pond and the mine collapsed on October 24, 1963. It has not been possible to assess whether the accident started with a collapse of a former connection between the pond and the mine or of the separation between the pond and the mine. If the distance between the pond and the mine would have been larger and if there would never have been connections between the pit, which became a pond, and the mine, a collapse would have been impossible.

Event 

Terminal 2E of Roissy Airport at Paris had been taken into service in June 2003 [23]. It had a length of 650 m, and the upper part, the departure hall, had an oval Cross‐section. The lower part was the arrival hall. It had facilities for nine aircrafts (see Figures 6.5 and 6.6). Terminal 2E had a daring design with wide open spaces. Arches stood from one side of the departure hall to the other side of that hall, and the distance between the supports of an arch was 26.20 m. That is, the width of the departure hall was 26.20 m, whereas the length was 650 m. The width of the arches was 4 m. Reinforced concrete, steel, and glass were used as materials of construction.

A piece of concrete fell from an arch at 05.30 h on Sunday, May 23, 2004. An evacuation was organized subsequently. A part of the terminal, containing the aforementioned arch, and having a length of 30 m, collapsed at 06.57 h on May 23, 2004. The ambient temperature at the time of the collapse was 4.10 °C. There were six arches in the part that collapsed. There were passenger passages through three of these arches, i.e. one passage through each arch. The accident took the lives of four people, and three people were injured.

Information 

Standing in front of the terminal, in the area where the aircrafts park, the zone that collapsed was at the right‐hand side of the center of the terminal. A zone symmetrical with the collapsed zone was at the left‐hand side of the center. The latter zone had the same construction as the collapsed zone. Both zones have been investigated by the French Berthier Commission (in French: La Commission Berthier). According to the Berthier Commission, the causes of the accident are as follows:

• Insufficient concrete reinforcement or improperly positioned concrete reinforcement
• A lack of mechanical redundancy, which means a lack of possibilities to transfer the load to other zones in case of local defectiveness
• A weak carrying capacity of the supporting beam
• The positioning of the steel support struts within the concrete.

Additional Information 

It is the Commission's opinion that the process of the collapse of a structure having a small margin as to the carrying capacity can be explained by

• a small movement of the structure as a result of its delayed deformations related to concrete creep that, although it is normal for a concrete structure, have added to the stresses in certain susceptible points;
• the effect of cyclic temperature changes that have progressively enlarged the initial crack in the structure.

The width of the margin as to the carrying capacity of the structure was thus reduced and subsequently annulled. Thus, a minor phenomenon was sufficient to set the fatal set of events in motion. Note that the accident happened almost 1 year after Terminal 2E had been taken into service. The first event was a crack in the concrete of the inner face of an arch containing passenger passages on the line connecting the steel support struts. It probably occurred between two steel support struts. This caused the fall of a large concrete slab. The disturbance that set the fatal series of events in motion may have been the very low temperature in the morning of May 23, 2004, or the weakness of a clamp of a post.

The fall of that concrete slab has, approximately one and a half hour later, caused two interacting phenomena, which occurred almost simultaneously. These two phenomena have caused, because of the lack of redundancy of the structure, its sudden collapse. The first phenomenon was the breaking of the northern part of an arch. The second phenomenon was the breaking and the fall of the southern supporting beam.

The conclusion is that the collapse of the structure, of which the original safety margins were too narrow, has been caused by several factors instead of by one factor.

The decision to tear down and rebuild the whole part of Terminal 2E, of which a section had collapsed, was taken in 2005. A more traditional steel and glass structure was chosen. It was taken into service in 2008.

Concluding Remark 

The margins of the original construction of Terminal 2E at Roissy Airport at Paris were too small.

Event 

On May 18, 2007, the gorilla Bokito escaped from his residence at the zoological garden Blijdorp at Rotterdam in The Netherlands [24]. He jumped across the moat separating him and the other gorillas from the public and subsequently attacked a woman and wounded her severely. A second woman fled, fell, and broke her pelvis bone.

Characteristics of the Gorilla Residence Concerned 

The width of the moat was 4 m. The Gorilla EEP Husbandry Guideline 2006 of The European Association of Zoos and Aquaria prescribes a moat width of 6 m. New gorilla residences had to adhere to this Guideline as from 2006. The gorilla residence at Blijdorp was built in 1999. The Guideline stipulated that zoological gardens were not, if applicable, obliged to increase the moat width of existing gorilla residences as long as they did not modify their gorilla residence.

Measures Taken by Zoological Garden Blijdorp After the Accident 

The zoological garden had a high wooden fence built at the public side of the moat. The erection of such a wooden fence is not considered a modification. It is considered a safety measure. With the construction of a wooden fence, Blijdorp complied with the requirements of the aforementioned Guideline.

Concluding Remark 

Blijdorp could have decided to build the fence when the aforementioned Guideline appeared as the specialists of the European Association of Zoos and Aquaria in 2006 considered a moat width of 4 m inadequate.