Summary

Definitions for the terms collapse resistance and robustness are proposed. Based on an analysis of the shortcomings of current design methods, a pragmatic ap-proach for designing against progressive collapse is suggested and a set of design criteria is presented. Design strategies based on preventing or presuming local failure are compared. Furthermore, the alternate-load-paths approach is com-pared with the compartmentalization approach concerning their applicability to different types of structures and design objectives.

definition of robustness—as it is given, for instance, in the draft of Eurocode 1 [5]—which does include possible causes of initial failure. Such a broader definition is close to the term collapse resistance as defined in the next section. It is believed that clarity is served by distinguishing these two properties (which could be named differently if no consensus on a re-definition of the term robustness can be reached).

Collapse Resistance

It is suggested to define the term col-lapse resistance as insensitivity to ac-cidental circumstances, which are low prob ability events and unforeseeable incidents. Again, the accidental circum-stances are to be quantified by the de-sign objectives. Collapse resistance is a property that is influenced by numer-ous con ditions including both struc-tural features and possible causes of initial failure. The structural system is of particular importance. It would in tol-erably limit the range of design possi-bilities, however, if only those structural systems were per mitted that are clearly robust. Nor is such a limitation neces-sary be cause a structure whose system tends to promote collapse progression can be made suffi ciently collapse resis-tant by other measures such as a par-ticularly safe design of key elements. Fur thermore, collapse re sistance may not be required for every structure.

The Inadequacy of Current Design Methods

Modern design codes and procedures of design and verification are based

on reliability theory. Actions and re-sistances are statistically determined on the basis of empirical data. After choosing an allowable probability of failure, the design values for actions and resis tances can be computed using probabilistic methods. Such an ap-proach is based on a mathematically sophisticated and, as it seems, sound foundation. It is reflected in the design codes by partial safety factors and a se-ries of load combination schemes. If the application of the ensuing code rules is often cumbersome, the design engineer might take comfort in the idea that, by working on a rational mathematical basis, a uniform safety level is reached. Still, it turns out that such an approach fails with regard to the identification and proper treatment of a potential for progressive collapse. There are three reasons for this failure [6, 7].

The first reason lies in the fact that current design codes are based on the consideration of local and not global failure. Correspondingly, design equa-tions are usually defined and applied on a local level only (check of cross-sectional forces or element stability). Structural safety, therefore, is likewise accounted for on the local level only. The global safety, that is, the safety against the collapse of the entire sys-tem or a major part thereof, is a func-tion of the safety of all the elements against local failure but also of the system response to local failure. The latter influence is neglected. Differ-ent systems will respond differently to local failure. The underlying assump-tion that a consistent safety level of a structural system is reached by an ad-equate safety of its elements, therefore, is not generally valid. Such methods when applied to non-robust structures will produce unsafe designs. It must be noted that there is currently no deter-ministic design code either that avoids this problem. A point that neverthe-less can be raised is that probability-based design does not deliver on the task it set out to accomplish, namely to provide uniform reliability. Even if a well-known fact to reliability theorists,

Structural Engineering International 2/2006 Reports 113

Progressive Collapse of Structures: Nomenclature and Procedures Uwe Starossek, Prof., Hamburg University of Technology, Hamburg, Germany

Introduction

Research on progressive collapse has intensified since the events of Septem-ber 11, 2001 as documented by a num-ber of recent conferences [1, 2, 3, 4]. This research has not yet led, though, to a consolidated set of nomenclature and procedures, and there is still little guidance for the practicing design en-gineer. This paper attempts to address these shortcomings and needs.

The term robustness is regularly used in publications and discussions on pro-gressive collapse. Still, it is used differ-ently and there is no common agree-ment to date on its exact meaning [4]. Two definitions are given in the next two sections. They prove useful for the discussion of design procedures fol-lowing thereafter.

Robustness

It is suggested to define the term robustness as insensitivity to local failure, where “insensitivity” and “local failure” are to be quantified by the design objec-tives, which are part of the design criteria (explained later). Defined in this way, robustness is a property of the structure alone and is independent of possible causes of initial local failure. This definition is in contrast to a broader

Peer-reviewed by international ex-perts and accepted for publication by SEI Editorial Board

Paper received: February 11, 2006Paper accepted: March 15, 2006

Report X-162.indd 113Report X-162.indd 113 4/21/06 5:11:14 PM4/21/06 5:11:14 PM

this seems to have remained unknown to many practicing engineers.

The second shortcoming of current design methods is that low prob ability events and unforeseeable incidents are not taken into account. Within the scope of a probabilistic design con-cept, such a simplification is necessary because the supporting statistical data, derived from experience and observa-tion, are unavailable. In the case of a non-robust structure, however, this simplification becomes inadmissible. This follows from the first reason dis-cussed above. A structure with primar-ily serial load transfer, say, a high-rise building, is considered. For the sake of argument, the initial local failure probabilities shall be statistically in-dependent. The prob ability of collapse is then in the order of the sum of the failure probabilities of all the constitu-tive elements, that is, of the building’s individual storeys, when it is assumed that, due to impact forces, collapse is induced by the failure of any one sto-rey. If the number of elements is suf-ficiently large (sim ply, if the area of attack is large), even very low prob-abilities of local failure can result in a probability of global failure which is high enough to be taken seriously. The latter statement also holds when the initial local failure probabilities are correlated (which is often the case).

The third problem with current design methods is that the underlying proba-bilistic concept requires specification of an admissible probability of fail-ure. The target failure probabilities of probabilistic design codes are usually derived from calibration with previous deterministic design codes. Hence, no new societal consensus seems neces-sary when probabilistic design is ad-opted. Considering the extreme losses that can result from progressive col-lapse, however, it might be difficult to reach an informed and true societal consensus on the numerical value of the admissible probability of such an outcome: a problem which risks of the type “low probability/high conse-quence” are typically up against [8].

Possible Improvements of Current Design Methods

The first problem outlined in the pre-vious section is not inherent to reliabil-ity theory but results from practical limitations which appear when reli-ability theory is applied to actual structural systems. The determination

of a system’s global safety has to take into account the system response to local failure. Within the framework of current design methods, one could attempt to consider this influence by an additional partial safety factor on the resistance side of the design equa-tions. This factor would take a value of one for robust structures and a value smaller than one for non-robust struc-tures. Provisions in some codes are in-deed equivalent to such an approach. In that case, however, the reduction of the design value of resistance of non-robust structures is based rather on judgment than on thorough analysis. Such reduction factor would actually have to be stipulated based on para-metric analytical studies for all the dif-ferent structural systems covered by the respective design codes. Another possibility would be to pursue a fully probabilistic analysis in a given design situation.

In either case, the system response to local failure needs to be considered. That response involves large deformations and displacements, separation of struc-tural elements, falling elements striking other elements below, and other kinds of interaction which all require a fully non-linear dynamic analysis in the time domain. These difficulties are com-pounded by the need to consider many initial failure scenarios and by the fact that, due to the nonlinear dependencies appearing here, small errors in the modelling assumptions can produce large deviations in the computational outcome. Even a deterministic analysis of the system response to local failure poses tremendous difficulties. A sto-chastic analysis of that response and the analysis of global safety would add further dimensions of difficulty, and, therefore, seems out of reach of today’s analysis resources—at least when an exact computation of general reduction factors or an exact analysis of a specific structural system in a design situation is expected. On the other hand, an analysis of the system response to local failure, be it deterministic or stochastic, could give some qualitative indication on the degree of robustness of certain types of structural systems or of a specific structure.

The second and third problems outlined in the preceding section are fundamen-tal challenges to a purely probabilistic design approach. If a low probability of local failure can add up to a large probability of global failure, then that quantity needs to be known. Also, if societal consensus on the admissible

probability of a catastrophic event cannot be reached, another basic in-gredient to a numerical stochastic com-putation is missing.

Suggested Design Approach

It follows from the discussion above that the shortcomings of current de-sign methods can at best only partly be overcome within the framework of reliability theory. The possibilities of improvement which do exist are not yet explored today and might prove in-sufficient in the future. Still, guidance is needed on how to design a collapse-resistant structure that is insensitive to accidental circumstances. It is therefore suggested to use, for the time being, the following pragmatic approach.

On the one hand, the design methods as described in the current codes are applied. They are based on reliability theory which is reflected in the codes by partial safety factors and load com-bination schemes. In view of the incon-sistencies outlined above, one could argue that the number of load combi-nations prescribed by some codes can be reduced because it is exaggerated when compared to the accuracy actu-ally achieved.

On the other hand, additional mea-sures with particular regard to collapse resistance are taken. The procedure is further described in the subsequent section. It is not necessarily based on reliability theory but rather on judg-ment and a decision-making process. Structural analyses are carried out deterministically.

Design Criteria

In the assessment and the design of a structure with regard to its collapse resistance, the following additional de-sign criteria are of importance:

– Requirements – Design objectives– Design strategies– Verifi cation procedures

First, the requirements, particularly the question of whether collapse resist-ance is necessary, should be clarified. The necessity depends on the structure’s significance with respect to the conse-quences of a collapse, including the immediate material and immaterial losses but also indirect effects such as the possible impairment of the infrastructure and of civil and national

114 Reports Structural Engineering International 2/2006

Report X-162.indd 114Report X-162.indd 114 4/21/06 5:11:16 PM4/21/06 5:11:16 PM

defense. An other criterion for the determination of requirements is thestructure’s degree of exposure to haz-ards of war, malicious action, and nat-ural disasters. The exposure can be considered par ticularly high for public buildings, major bridges, and other lifeline structures. If collapse resistance is deemed necessary, the following design objectives must be specified:

a) Assumable extent of accidental cir-cumstances

b) Assumable extent of initial local failure

c) Acceptable extent of collapse pro-gression

d) Acceptable extent of damage to the remaining structure

e) Applicable safety factors and load combinations

Design objectives b, c, and d can be used when testing for robustness, design objectives a, c, and d can be used when testing for collapse resistance accord-ing to the respective definitions given above. The following design strategies to prevent progressive collapse are men-tioned in the lit erature and have at least partially made their way into the de-sign codes:

a) High safety against local failure – Specifi c local resistance of key

elements (direct design) – Non-structural protective mea-

sures (event control) b) Design for load case “local failure”

(direct design) – Alternate load paths – Isolation by compartmentaliza-

tion c) Prescriptive design rules (indirect

design)

These design strategies are described in more detail in [7, 9, 10]. It is of inter-est to note that the assumable extent of accidental circumstances (design objective a) must be specified only if the design strategy “high safety against local failure” is used. The prediction of the structural response to local failure requires suitable verifi cation proce-dures. It is suggested to use determin-istic structural analyses, which should be as accurate as possible and consider all relevant scenarios [7, 9, 10]. The proper choice of triggering events and, if necessary, simplified analysis meth-ods highly depends on the structure at hand and requires genuine engineer-ing work [6, 11]. It is difficult to codify. Still, the de velopment, validation, and codification of general and simplified

but ad missible verification methods would be a worthwhile undertaking.

The design criteria listed above are to date only partially addressed in codes and guidelines. As far as applicable design crite ria cannot be made avail-able in codified form or be developed from first principles and reliability theory, they should be agreed upon by the contracting and other affected parties or established by the building authorities.

It is anticipated that the design crite-ria can only partly be developed from first principles and reliability theory. Quantifying the assumable extent of accidental circumstances related to low-probability and unforeseeable events like hazards of war, malicious action, and human error will be partic-ularly difficult. Stipulating the accept-able extent of collapse progression can be facilitated by cost/benefit consid-erations which become controversial, however, when human life is to be in-cluded. There will thus remain necessi-ty for judgment and a decision-making process. On the other hand, the choic-es to be made here tend to be rather transparent. The design criteria for the Confederation Bridge, Canada, for in-stance, stipulate the acceptable extent of collapse progression to be the equiv-alent of about 700 m bridge length out of a total length of 12'910 m [6, 11]. The only alternatives would have been not to address the risk of progressive col-lapse at all or to abandon the project. These three choices are clear even to a layperson. A societal consensus or an administrative or political decision is therefore easier when compared to the choice of an abstract quantity like a safety index β—even when that consensus or decision is that certain structures remain unbuilt.

Local Failure: Prevent or Presume?

The design strategy can be either try-ing to prevent an initial local failure or designing for such a case. From each of these two strategies, two design meth-ods are derived as listed in the preced-ing section. If collapse resistance shall be achieved by preventing local fail-ure, the design methods “specific local resistance” and “non-structural pro-tective measures” come into question. These methods do not aim at enhanc-ing structural robustness.

On the other hand, if local failure is presumed, the design methods “al-ternate load paths” and “isolation by compartmentalization” can be pur-sued to make the structure robust and to limit an incipient collapse to an acceptable extent. Again, the safe performance of certain key elements is crucial and must be verified. In contrast to the design strategy “high safety against local failure,” these key elements are under the control of the engineer: they are selected by choosing the alternate load paths or the loca-tions of compartment borders, a design freedom whose magnitude depends on the design objectives. Thus, the num ber of key ele ments can be comparatively small, particularly when the compart-mentalization approach is utilized (see [7, 9, 10] for further discussion and substantiation).

For these reasons, design methods based on the presumption of local failure seem preferable for structures of high significance or exposure. They allow high safety against progressive collapse at relatively low additional cost, as long as such a de sign is pos-sible. Moreover, they are more sat-isfying from a reliabil ity standpoint because their efficiency is less depen-dent on the failure probabilities of key ele ments; uncertainties related to ac-cidental circumstances are altogether ir relevant.

Redundancy versus Compartmentalization

The existence of alternate load paths is referred to as structural redundancy, which means re dundancy of the struc-ture with regard to its ability to carry loads. Isolating an incipient collapse by compartmentalization requires either a strengthening or a reduction of conti-nuity at the compartment borders. In other words, the compartment borders must be able to sustain either large forces or large displacements [9, 10]. The compartmentalization approach, including the consequence of reducing continuity, has been applied to the design of the Confedera tion Bridge, Canada [6, 11]. Its application in that case was substantiated by the infeasi-bility of alternate load paths. It may still be preferable, though, even when alternate load paths could be provided. Furthermore, the continuity required for the formation of alternate load paths may, in certain circumstances,

Structural Engineering International 2/2006 Reports 115

Report X-162.indd 115Report X-162.indd 115 4/21/06 5:11:17 PM4/21/06 5:11:17 PM

not prevent but rather promote collapse progres sion. This view is supported by eye-witness accounts of controlled demolition experts and fire fighters who have observed the collapse of buildings [1, page 21]. Such observations seem plausible when consid ering that collapse progression requires interac-tion, which in turn could mean a certain degree of connectivity, between structural elements.

In light of these considerations, the failure of Ronan Point, an often cited example of progressive collapse, can be interpreted differently. Triggered by an explosion in one of the upper storeys, one building corner collapsed over nearly the entire height of the building. The larger part of the build-ing, however, remained undamaged. This progressive collapse of floor slabs has been ascribed to a lack of continu-ity in slab reinforcement. On the ten-tative premise that an overall collapse of the building must be prevented, and contemplating the compartmentaliza-tion approach, such a lack of continu-ity does not seem so bad after all.

Stimulated by the Ronan point fail-ure, requirements for continuity have been included in building codes in the form of prescriptive design rules. These provi sions were intended to in-crease the robustness of a structure. If, however, the result ing alternate load paths become overloaded, the design objective cannot be achieved. In this context, an observation made in [12] concerning the collapse of the Murrah Federal Building is of interest. If only one main column was immediately de-stroyed by the bomb blast (one of the possibilities discussed in that report), it is argued that the two adjacent main columns could have been pulled down by the connections to the fall-ing structural com ponents in-between

(in case the reinforcement were con-tinuous). This assessment is supported by the fact that the collapse stopped at a main column shortly after a dis-continuity in the transfer girder’s top reinforcement.

Two examples where compartmental-ization accomplished by discontinu-ity has possibly prevented widespread collapse are the Pentagon Building and the Charles de Gaulle Air port Ter-minal in Paris. The Pentagon Building consists of three building rings each divided in five compartments separat-ed by expansion joints. The airplane impact near an expansion joint caused several columns on both sides of the joint to fail. The more affected sec-tion, the outer ring on the right of the joint, collapsed while the less affected section, the outer ring on the left of the joint, did not (Fig. 1). A connec-tion might have promoted a collapse progression, since the left section was heavily damaged as well and might not have been able to carry additional loads. The isolation of collapse on the other side of the collapsed section was achieved by strong structural elements which resisted the collapse loads and thus likewise formed a col lapse bound-ary and compartment border.

The partial collapse of the Charles de Gaulle Airport Terminal was initi-ated by the failure of a portion of the roof due to poor work manship and deficiencies in design. The collapse came to a halt at the two joints which separated the collapsing section from the adjacent structures on both sides (Fig. 2). It seems unlikely that the forces which occurred during collapse could have been sustained, in case of conti nuity, by the adjacent sections since these sections suf fered from con-struction deficiencies as well.

The potential value of continuity shall not be called into question. It should be kept in mind, however, that continu-ity can be harmful when the resulting alternate load paths are not pro vided with the strength required to withstand the forces transmitted by continuity. If it is im possible, or overly expensive, to provide alternate load paths with suffi-cient strength, the design method “iso-lation by compartmentalization”—if necessary, by selectively elimi nating continuity—has the advantage. This is also the case if alternate load paths (or collapse-isolating elements) are strong enough, but the corresponding verifi-cation proves difficult or unconvincing [6, 11].

The design method “alternate load paths,” on the other hand, is indicated if the fall of components or debris must be prevented by any means. This applies particularly to cases in which falling parts could strike key elements of the remaining structure because the impact loading produced by such an event is difficult to design for. Such conditions are found in structures with primarily vertical alignment, such as high-rise buildings; they are less typi-cal for horizontally aligned structures, such as bridges. The suitability of the two design methods compared here thus depends on the type of structure and its alignment in space.

The alternate-load-paths approach requires an increase of either or both continuity and strength. Compart-mentalization, on the other hand, can be accomplished by less continuity or more strength. Other differences be-tween these two methods concern the spatial distribution of design measures, the dependency of their efficiency on the size of initial failure, and the mini-mum extent of collapse. The alternate-load-paths approach leads to changes

116 Reports Structural Engineering International 2/2006

Fig. 2: Partial collapse of the Charles de Gaulle Airport Terminal, ParisFig. 1: Partial collapse of the Pentagon Building

Report X-162.indd 116Report X-162.indd 116 4/21/06 5:11:18 PM4/21/06 5:11:18 PM

that are distributed throughout the struc ture; its efficiency decreases with an increase in initial failure size; it is therefore preferable for small initial failure size; the minimum extent of col-lapse decreases with initial failure size. The com part mentalization approach re quires changes at discrete locations; its efficiency tends to be insensitive to initial failure size; it is preferable for large initial failure size; the minimum extent of collapse is fixed and com-paratively large. Both methods can be combined. When the alternate-load-paths approach is used within individu-al com part ments, structural robustness is increased for both small and large initial failure sizes.

Conclusion

It was found that clearer and more prac-tical definitions are arrived at when the term robustness is distinguished from the term collapse resistance, the former being a property of the structure alone, the latter including possible causes of initial failure. In regard to progres-sive collapse, non-robust structures are of particular concern and require specific consideration. The necessity of such consideration follows from an inspection of current design methods which are based on reliability theory. Because of fundamental difficulties and due to the number and complex-ity of influencing factors which appear after failure initiation, a purely prob-ability-based design of real structures seems impracticable. A framework for a pragmatic design approach was therefore proposed in which the usual probability-based design procedures, as described in the codes, are comple-mented by additional assessment and particular design measures with re-gard to progressive collapse in which structural analyses are carried out deterministically.

This approach is contrary to the rec-ommendation made in [5] to perform nothing but a risk assessment for struc-tures of the highest consequence class. It follows from the preceding discus-sion that such a study can at best sup-plement, not replace, a design approach as it is presented in this paper. On the

other hand, reliability theory can play a role in a more detailed comparison of the design methods discussed here and in deter mining some design cri-teria like exposure, assumable extent of accidental circumstances and initiallocal failure, or applicable safety fac-tors. Nevertheless, these and other design criteria might be difficult to quantify and in the end be left to judg-ment. The dependency of the accuracy of such judgment, and the importance of reliability theory, is relatively high when using the design strategy “high safety against local failure,” less so for the design method “alternate load paths,” and minimum for the design method “isolation by compartmental-ization.” Still other design criteria need to be stipulated in a decision-making process. The choices to be made in that process, for instance, concerning the acceptable extent of collapse progres-sion, are relatively transparent so that an informed societal consensus should be possible.

The alternate-load-paths approach and the prescrip tive design rules based on that idea should be applied with dis-cretion. Forces should be determined based on the overstrength of elements introduced for continuity and the force transfer should be checked down to thefoundation. Compartmentalization can be accomplished either by a strength-ening or by a reduction of continuity atthe compartment borders. For certain structures, compartmentalization is the more suitable approach to prevent pro-gressive collapse — a fact that has gone nearly unnoticed in the structural engi-neering community. If this option has been overlooked, one reason might be that the terms continuity, redundancy, and robustness are intuitively equated, a tacit assumption which is justified at best for particular types of structures.

The adequacy of a particular design method depends on the design objec-tives, and on the type of structure and its alignment in space. Bridge struc-tures are primarily horizontally aligned whereas buildings can be horizontally or vertically aligned. Impact loading produced by falling structural compo-nents is more of a concern for high-rise buildings, not so much for bridges. The need to provide continuity to prevent

such impact loading is therefore differ-ent in these two kinds of structures.

Acknowledgement

This paper was prepared during the author’s stay at the Korea Bridge Design and Engi-neering Research Center at Seoul National University. The generous support received from the Research Center is gratefully ac-knowledged.

References

[1] Multihazard Mitigation Council of the National Inst. of Building Science. Work shop on Prevention of Progressive Collapse. Chicago, July 10–12, 2002, MMC Report, Washington, D.C.

[2] American Institute of Steel Construction. Steel Building Symposium: Blast and Progressive Collapse Resistance. New York, Dec. 4–5, 2003, Proc., AISC, Chicago.

[3] Precast/Prestressed Concrete Institute. Blast and Progressive Collapse Resistance of Precast and Prestressed Concrete Structures. Workshop, Chicago, April 21, 2004, Proc., PCI, Chicago.

[4] JCSS and IABSE. Robustness of Structures. Workshop, Building Research Establishment, Watford, UK, November, 28–29, 2005.

[5] Project Team Draft prEN 1991-1-7. General Actions – Accidental Actions. July 2004.

[6] STAROSSEK, U. Zum progressiven Kollaps mehrfeldriger Brückentragwerke. Bautechnik, Vol. 74, No. 7, 1997, pp. 443–453.

[7] STAROSSEK, U. Progressiver Kollaps von Bauwerken. Beton- und Stahlbetonbau, Vol. 100, No. 4, 2005, pp. 305–317.

[8] BREUGEL, K. VAN. Storage system criteria for hazardous products. Structural Engineering International, Vol. 7, No. 1, 1997, pp. 53–55.

[9] STAROSSEK, U.; WOLFF, M. Progressive collapse: Design strategies. IABSE Symposium Structures and Extreme Events, Lisbon, Sep. 14–17, 2005, http://server.sh.tu-harburg.de/sta-rossek/Index.htm.

[10] STAROSSEK, U.; WOLFF, M. Design of collapse-resistant structures. JCSS and IABSE Workshop on Robustness of Structures, 2005, see [4], http://server.sh.tu-harburg.de/starossek/Index.htm.

[11] STAROSSEK, U. Progressive collapse study of a multi-span bridge. Structural Engineering International, Vol. 9, No. 2, 1999, pp. 121–125, http://server.sh.tu-harburg.de/starossek/Index.htm.

[12] CORLEY, W. G.; SOZEN, M. A.; THORN-TON, C. H.; and MLAKAR, P. F. The Oklahoma City Bombing: Improving Building Performance through Multi-Hazard Mitigation. Federal Emer-gency Management Agency Mitigation Director-ate, FEMA Report 277, 1996.

Structural Engineering International 2/2006 Reports 117

Report X-162.indd 117Report X-162.indd 117 4/21/06 5:11:21 PM4/21/06 5:11:21 PM