The check that cannot see the error

Every structural analysis prints a line saying that the sum of the reactions equals the sum of the applied loads, to within some very small residual. It is the first thing anybody looks at, it is often the only verification performed, and it is worth having.

It is also incapable of detecting a large class of errors, and the class it cannot detect is not the obscure one.

Which free body produced the number #

The whole structure, cut at its supports.

That is the free body a global equilibrium check is a statement about, and it has exactly six equations in three dimensions: three force sums and three moment sums. Six equations, for a model that may have fifty thousand degrees of freedom.

The check is that those six are satisfied. It is a real check and it is a strong one against a specific set of failures — but six equations cannot say much about fifty thousand unknowns, and what they can say is precisely delimited.

What it catches #

Anything that changes what the structure is carrying shows up immediately, because the applied side of the six equations and the reacting side stop matching.

A lost restraint. A support released in the model and not replaced means one reaction is missing, and the residual is the whole of it. This is the commonest modelling error there is and the check finds it instantly.

A load in the wrong unit. A member load entered as newtons per millimetre where kilonewtons per metre was meant is a thousandfold error, and it appears as a residual that nobody can miss.

A load applied to nothing. A pressure on a surface that was not meshed, or a point load at a node that does not exist, vanishes from the model — and the residual is its size.

A duplicated load. The same load entered twice.

Those four cover a great deal of ordinary error, and it is why the check has the standing it has. Every one of them is caught by a comparison that takes no effort at all, and every one of them is a failure of the input rather than of the analysis.

What it cannot catch, and why #

Now change one member’s second moment of area by a factor of ten and run it again.

The frame redistributes completely: the stiff member attracts moment, its neighbours shed it, the deflected shape is different, and every internal force in the model has changed. And the global residual is exactly zero.

The reason is not subtle once it is stated. The reactions are computed from the same equilibrium equations that the check tests, so they satisfy them by construction. A different distribution of internal forces is a different set of reactions that also sums to the load — because equilibrium of the whole is a statement about the boundary, and the error lives entirely in the interior.

The error is self-equilibrating. Its effect on the structure is a set of internal forces that sum to nothing across every external cut, and no check made on an external free body can see it.

That is a general fact rather than a property of stiffness errors. Anything that changes only the sharing of a load between paths is invisible: a wrong stiffness, a wrong release, a member connected to the wrong node in a redundant frame, a support spring an order of magnitude out, a wrong modulus, a wrong section orientation.

The stiffest path takes the load is the essay about the sharing itself. Read here, it is a statement about what equilibrium is blind to: the total is fixed by statics and the split is fixed by stiffness, so a check made on the total cannot see a mistake in the split.

Which is a restatement of the lower bound theorem #

There is a piece of theory that makes the same point and makes it sharper.

Two ways of being wrong sets out the lower bound theorem: any distribution of internal forces in equilibrium with the applied load, which nowhere exceeds the material’s strength, gives a safe estimate of the collapse load. Not the correct distribution — any of them.

That theorem is exactly the reason a strut-and-tie model works, why plastic design is legitimate, and why moment redistribution is allowed. It is also, read backwards, a formal statement that equilibrium does not identify the answer. There is a whole space of statically admissible distributions and the elastic one is a single point in it, chosen by compatibility.

So a check that tests equilibrium is testing membership of that space. It rejects anything outside it, which is useful, and it says nothing about which point inside it the analysis has landed on.

That gives a useful boundary on the whole argument. On a determinate structure the equilibrium check is nearly sufficient, because there is only one admissible distribution and finding it is all there is to do. On a redundant one it is a projection onto six numbers, and everything one support too many bought is in the part that was projected away.

What the second check has to be #

If equilibrium cannot see the sharing, something has to, and there are three things that can.

A compatibility check. Deflections have to be continuous and have to satisfy the supports. A member connected to the wrong node shows up as a discontinuity in the deflected shape, and looking at the deflected shape — really looking, at a plot with the deformations exaggerated — is the single most effective verification there is. It is also the one that has no numerical output, which is why it is skipped.

An independent approximate calculation. A hand calculation of one member, by a different route, catches a sharing error because it computes the share rather than the total. This is the reason the hand methods survive: the matrix that replaced the hand methods replaced them for production and not for verification.

A sensitivity run. Change something the answer should not depend on and check that it does not. Refine the mesh, swap the numbering, halve a stiffness that should not matter — and if the answer moves, the model is telling something.

None of the three is automatic, and that is the practical difficulty. The check that runs by itself is the one that cannot see the interesting errors, and the checks that can see them require somebody to look.

The three errors ranked by how they are found #

It is worth putting the classes side by side, because the ordering is not the one intuition gives.

Errors in what is applied — loads, units, positions, missing pressures — are caught by a check that runs automatically, in a second, on every analysis ever done. They are also the errors most likely to be made, because loading a model is the most tedious part of building it.

Errors in what is connected — a member at the wrong node, a release that should not be there, a support in the wrong place — are usually caught by a deflected shape, and only if somebody looks at one. They are less common than load errors and considerably harder to find.

Errors in what is stiff — a section property, a modulus, an orientation, a spring constant — are caught by nothing that runs by itself. They change every internal force in a redundant structure, they preserve equilibrium exactly, and they frequently preserve the deflected shape’s appearance as well, because a shape that is wrong by twenty per cent in one member still looks like a deflected frame.

The last class is the one worth being frightened of, and its remedy is neither a check nor a plot: it is a second calculation of one number by a different route. One deflection without solving everything exists for production reasons and survives for this one — a virtual work calculation of a single deflection, done by hand, tests the stiffnesses along one path in a way nothing in the analysis does.

An error that is not an error #

There is a case worth separating, because it looks like the same thing and is not.

A self-stress state — a set of internal forces in equilibrium with no applied load at all — is invisible to a global equilibrium check for exactly the reason above, and it is entirely real. The forces that are there with nothing applied is the essay about it: a lack-of-fit, a prestress, a settlement, a temperature change, a welding residual. Each produces internal forces summing to nothing externally.

So the invisibility is not a defect. It is the same property that lets a structure carry a prestress without its supports knowing, and a check that could see self-equilibrating internal forces would also be a check that flagged every legitimate one.

Why a converged answer is not a right one #

There is a second family of reassurance that deserves the same treatment, because it is trusted for the same reason and is wrong in the same way.

Refine the mesh and watch the answer settle. That is convergence, and it is a genuine and necessary thing: it says the discretisation is fine enough that the numerical solution is close to the exact solution of the model that was built. It says nothing whatever about whether that model is the structure.

Every error in this essay survives refinement exactly. A wrong second moment is still wrong at a million elements. A support in the wrong place is still in the wrong place. A load in the wrong unit is still in the wrong unit, and the answer converges beautifully to a very precise account of a structure carrying a thousand times too much.

The distinction has names — verification for “is the equation being solved correctly”, validation for “is it the right equation” — and the practical content of them is that every automatic check available belongs to the first. All of them. The second has no automatic form and never will, because it is a comparison between a model and an intention, and the intention is not in the file.

Where the model stops #

The residual is never exactly zero in a real solver. It is a round-off, and its size depends on the conditioning of the stiffness matrix rather than on the correctness of the model — so a badly conditioned model with a stiff spring in it can have a residual a thousand times larger than a well-conditioned wrong one.

Moment equilibrium is often not checked. Many programs report force sums and not moment sums, which is a pity: a load applied at the wrong position preserves the force sums exactly and shows up only in the moments.

Nothing here is about the loads being right. Everything above assumes the load schedule is what the structure will actually receive, and the check tests only that the model has received what the schedule says. The largest errors in structural engineering are not in the analysis at all; they are in deciding what the structure has to carry, and no residual has an opinion about that.

And equilibrium of a part is stronger than equilibrium of the whole. Cutting the structure somewhere in the middle and checking that the internal forces on the cut balance everything on one side of it is a genuinely different check, and it catches many of the errors the global one cannot — because it makes the interior into a boundary.

That last point is the practical remedy and it deserves to be better known. The global check is the weakest member of a family, and every other member of it is available for the price of one cut.

The one check that would catch everything #

There is an obvious candidate for a verification that would catch all three classes, and it is worth saying why it is not used.

Build the model twice, independently, and compare. Two engineers, two packages, two idealisations — and any difference between the answers is an error in one of them. That is exactly what is done for the software itself, where benchmark problems with known answers are the standard qualification, and it is done for the models of a very small number of structures: nuclear containments, offshore platforms, a handful of long-span bridges.

It costs twice as much, and that is the whole objection. On a structure where a failure is unthinkable it is bought; everywhere else the profession relies on a single model, a global residual that cannot see the interesting errors, a deflected shape that somebody may look at, and the experience of the person who built it.

The middle ground that is worth more than it costs is a partial independent model: one member, one frame, one load path, computed by a different method. It is cheap, it is the thing the hand methods survive for, and it tests exactly the class of error nothing else does — because it computes a share rather than a total, and a share is where the invisible errors live.

The residual is reported as a fraction, and it should be read as a force #

One more thing about the check is worth fixing, and it is about how the number is presented rather than about what it can detect.

Solvers report the out-of-balance as a proportion of the applied load, and a proportion is the wrong unit for the question being asked. On a building weighing 141,000 kN, a residual of 0.5 per cent — a figure most engineers would read as noise — is 705 kN, which is more than the whole axial load in an internal column at the base of a twelve-storey frame. A load case that has lost an entire column’s worth of load reports as half a per cent, and half a per cent looks like round-off.

The fix is to read the residual against the smallest thing the check ought to detect rather than against the largest thing in the model. That number is available on any project: the load on one column, or one bay of floor, or one storey’s wind. A residual below round-off is a few units in the last place of the arithmetic — on double precision, parts in $10^{12}$ of the largest term, not parts in $10^3$ — so anything between those two figures is not noise, it is a small error being described in a unit that flatters it.

Which is the same discipline as the section above, applied to the check that does work. A verification is worth what it would fail on, and a global equilibrium check reported as a percentage of a very large number has been quietly weakened until it would fail on almost nothing.

The generalisation #

The habit worth taking away is to ask, of any verification, what it would have to be for it to fail.

A check that passes tells nothing until it is known what would have made it fail. A global equilibrium check fails on a change to the applied loads or the reactions, and on nothing else — so a model that passes it is a model whose loads and supports are consistent, which is a real and limited statement.

This is the same discipline this site applies to its own machinery: an assertion that has never rejected anything proves nothing. The way to find out what a check is worth is to break the model deliberately, in each of the ways it might be broken, and see which breakages the check reports. That takes an afternoon on any analysis package and it is done by almost nobody.

The reverse habit is worth having too, and it is cheerful: a check that would fail on the thing being worried about is worth running even if it is crude. A hand calculation accurate to twenty per cent detects a factor-of-ten stiffness error perfectly well, and a factor of ten is what those errors usually are. Precision is not what a verification needs; independence is, and a rough calculation by a different route beats a precise one by the same route every time. That is why three forces must meet at a point is still a useful thing to know: a graphical check on a joint takes a minute and shares no arithmetic with anything the computer did.

The count that does not see it is the same lesson about a different check: counting members and restraints is necessary for a structure to be stable and never sufficient, and a count that passes on a mechanism is a count whose failure mode was never established. Equilibrium is that check’s larger cousin — necessary always, sufficient only on the structures simple enough not to need it.