Manual for the systematic risk

assessment of high-risk
structures against
disproportionate collapse
September 2013
Technical author
D Cormie MEng(Hons) CEng CEnv FIStructE FICE M.ASCE (Arup)
Membership of the steering group
O Brooker BEng CEng MIStructE MICE MCS (Modulus) Chairman
J Carpenter BSc(Eng) CEng FIStructE FICE CFIOSH (Consultant)
G Harding OBE DIC CEng FIStructE MICE (Consultant)
J Lane MSc CEng FICE (Rail Safety and Standards Board)
Dr A Mann PhD FREng CEng FIStructE MICE (Consultant)
Dr S Matthews PhD CEng FIStructE FICE CSci CWEM MCIWEM (BRE)
S McKechnie BSc(Hons) CEng MIStructE (Arup)
A T Moolan BSc(Hons) CEng MICE FRICS (LABC)
C O’Regan BEng(Hons) CEng MIStructE (The Institution of Structural Engineers)
P Watt BSc(Eng) (Department for Communities and Local Government)
Consultees
Dr J Agarwal PhD (University of Bristol)
W Baker MSc SE PE FIStructE F.ASCE NAE (Skidmore, Owings & Merrill LLP)
M Banfi MA CEng FIStructE FICE (Arup)
J Burridge MA(Cantab) CEng MIStructE MICE (MPA The Concrete Centre)
Dr M Byfield PhD CEng MIStructE MICE (University of Southampton)
Professor M Chryssanthopoulos PhD DIC CEng FIStructE FICE (University of Surrey)
K Claber MSc CEng MICE
Dr S Dogruel PhD (Arup)
D Dusenberry PE F.SEI F.ASCE (Simpson Gumpertz & Heger Inc.)
S Inglis MA (Arup)
Professor B A Izzuddin PhD CEng FIStructE M.ASCE (Imperial College London)
R Johnson MArch SE SECB ASCE (Skidmore, Owings & Merrill LLP)
Dr H S Lew PhD PE Hon M.ACI F.SEI F.ASCE (National Institute of Standards and Technology)
Dr S Marjanishvili PhD SE PE M.ASCE (Hinman Consulting Engineers Inc.)
K Moazami PE F.ASCE (WSP)
Dr M O’Connor PhD MBA (WSP)
L Robertson SE PE CEng FIStructE FIEI Dist.M.ASCE M.NAE (Leslie E. Robertson Associates RLLP)
Dr R Smilowitz PhD PE M.ASCE (Weidlinger Associates)
Dr D Stevens PhD PE F.ACI M.ASCE (Protection Engineering Consultants LLC)
Professor A Vrouwenvelder MSc (TNO/Delft University)
M Waggoner SE PE PEng (Walter P Moore and Associates Inc.)
A Way MEng CEng MICE (The Steel Construction Institute)
Building Standards Division, Scottish Government
Director: Engineering and Technical Services
S Fray BSc(Hons) CEng MIStructE M.SEI MICE (The Institution of Structural Engineers)
Secretary to the steering group
L Allen MEng(Hons) (The Institution of Structural Engineers) (until July 2012)
L Kirk MEng(Hons) (The Institution of Structural Engineers) (from September 2012)
Acknowledgements
This publication was supported through grant funding from the Department for
Communities and Local Government and received funding from Arup’s Design and
Technology Fund.
Image copyright:
Figure 2.1: Contains public sector information published by the Health and Safety
Executive and licensed under the Open Government Licence v1.0
Box 3.1: Huddersfield Examiner
Box 3.3: AP/Press Association Images
Box 3.9: Institution of Civil Engineers (Professor John Burland)
Box 3.10: Jonathan G M Wood Structural Studies & Design
Box 4.1: Dr Man-Seop Lee and Prof. Uwe Starossek
Figures 4.3, 4.5 and 4.6: Arup
Figure 4.7: Cox Rayner Architects
Box 4.2: Victoria Police
Box 4.3: AP/Press Association Images
Box 4.5: AP/Press Association Images
Box 5.1: Colin G Bailey
Published by The Institution of Structural Engineers
International HQ, 11 Upper Belgrave Street, London SW1X 8BH
Telephone: +44 (0)20 7235 4535 Fax: +44 (0)20 7235 4294
Email: mail@istructe.org Website: www.istructe.org
First published 2013
ISBN 978-1-906335-24-3
# 2013 The Institution of Structural Engineers
The Institution of Structural Engineers and those individuals who contributed to this Manual have
endeavored to ensure the accuracy of its contents. However, the guidance and recommendations
given in the Manual should always be reviewed by those using the Manual in the light of the facts of
their particular case and specialist advice obtained as necessary. No liability for negligence or
otherwise in relation to this Manual and its contents is accepted by the Institution, the technical
author, the members of the steering group, the consultees, their servants or agents. Any person
using this Manual should pay particular attention to the provisions of this Condition.

No part of this publication may be reproduced, stored in a retrieval system or transmitted in any
form or by any means without prior permission of the Institution of Structural Engineers, who may
be contacted at 11 Upper Belgrave Street, London SW1X 8BH.
Tables Boxes

Table 2.1 BS EN 1991-1-7 building risk classification 8 Box 2.1

Eliminating risks – example 6
Table 3.1 Example likelihood scale 14 Box 2.2
Reducing and informing risks – example 6
Table 3.2 Example consequence scale 15 Box 2.3
Controlling risks – example 7
Table 3.3 Examples of hazards 18 Box 2.4
ALARP and gross disproportion – example 7
Table 5.1 Cost-benefit assessment 55 Box 3.1
Emley Moor, 19 March 1969 20
Box 3.2
Camden School for Girls assembly hall, 1973 and
Sir John Cass Secondary School swimming pool,
1974 20
Box 3.3 Cliff edge effects – Paris Charles de Gaulle
Terminal 2E collapse, 2004 22
Box 3.4 Low likelihood/high consequence hazards – Eschede
train disaster, 1998 23
Box 3.5 World Trade Center, 11 September 2001 24
Box 3.6 Mersey Valley Footbridge, 4 January 2007 24
Box 3.7 Light aircraft crash, New York City,
11 October 2006 25
Box 3.8 Great Heck rail crash, 2001 25
Box 3.9 Hambly’s paradox 27
Box 3.10 Pipers Row car park, 1997 31
Box 3.11 Shear failure of a reinforced concrete transfer
slab 31
Box 3.12 Brittle failure of a steel-framed structure 32
Box 4.1 Haeng-Ju Grand Bridge collapse, Seoul, 1992 and
Tasman Bridge, Hobart, Australia, 1975 38
Box 4.2 Failures in quality control of design and construction,
West Gate Bridge, Melbourne, October 1970 45
Box 4.3 Gross design error and lack of single point of
responsibility, Hartford Civic Center, Connecticut,
January 1978 46
Box 4.4 Sleipner A offshore platform, 1991 47
Box 4.5 Bad Reichenhall Ice Rink roof collapse,
2 January 2006 47
Box 5.1 Torre Windsor, Madrid, 2005 52
Box 6.1 Example: refurbishment of a Victorian
warehouse 59
Box 6.2 Example: redevelopment of a Grade I listed
building 59

iv The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse
Foreword
Robustness is an indisputably desirable quality of a
structural design. Designing a structure to be less
sensitive to damage renders it safer and reduces
risks. A small perturbation which produces a gross
structural response is not automatically unsafe, but
usually has the potential to be. Designing for
robustness aims to eliminate such characteristics
such that the structure is less sensitive to
perturbations which have the potential to cause
harm. In design there is much that we do not know:
robust design is much more than following a set of
rules and designing for a certain set of scenarios, it is
about ensuring our design is less sensitive to these
unknowns. It is famously stated in The Structural
Engineer, May 1978:
‘‘Structural engineering is the art of moulding
materials we do not wholly understand into shapes
that we cannot precisely analyse, so as to withstand
forces we cannot really assess, in such a way that
the community at large has no reason to suspect the
extent of our ignorance.’’
– Dr A. Robert Dykes,
Institution of Structural Engineers
Scottish Branch, 1978
Robustness is part of our protection against this
uncertainty and in the UK has been recognised since
the collapse of Ronan Point in 1968 as an essential
aspect of good structural design practice.
Since 2004 there has been a particular requirement
to specifically consider the risk associated with a
high-risk, or ‘Class 3’ structure through the use of a
systematic risk assessment. In high-risk structures
the potential to cause harm is heightened compared
with other structures due either to the number of
occupants, a characteristic of those occupants, or
some feature of the structure’s function, form and
construction, location or purpose. Consequently there
is a need to take greater care to assess the
robustness of the structure and to take greater steps
to reduce the risks to which it is subjected.
The profession must be cognisant of the need for
safety and risk reduction on the one hand and the
costs of the construction on the other. Good risk
management does not minimise all risks at gross
cost: it ensures that the costs of risk reduction
measures remain proportionate to the magnitude of
The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse
the risk, so that resources can be judiciously targeted
to give the most effective reduction in risk.
Risks may be derived not only from accidental or
malicious actions on the structure but also from
so-called ‘soft’, or procedural, hazards such as
design errors, the failure to adequately
communicate design information leading to errors
in its construction, a lack of requirements for the
inspection and maintenance of the structure, or
the failure to adhere to them. Rarely is there a
single cause leading to an accident and usually
human error are a significant contributing factor,
the risk of which the designer would do well to
reduce. Indeed, ‘soft’ hazards may be so
significant that they will be the governing factor in
the overall level of risk associated with the design.
This Manual was commissioned by the Institution
with financial support from the Department for
Communities and Local Government, and is written
primarily for the design of those structures classified
as Class 3 in EN 1991-1-7. The principles can also
be readily applied to all types of structures
irrespective of the design standards being used, and
it is recommended that they are adopted wherever a
structure might be considered high-risk. The Manual
provides guidance to the practising structural
engineer on the design of such structures against
disproportionate collapse by systematic risk
assessment, as well as providing useful guidance for
client bodies and building control authorities on the
use of such design approaches.
David Cormie,
Technical Author
Owen Brooker,
Steering Group Chair
vii
Contents

Tables iv 4.9 Alternative load path analysis 39

4.9.1 Introduction 39
Boxes iv 4.9.2 Linear static procedures 40
4.9.3 Nonlinear static analysis based on dynamic
Glossary and abbreviations v energy balance 40
4.9.4 Nonlinear dynamic time history analysis 42
Foreword vii 4.10 Tying 42
4.11 Local protection of critical structural elements 43
1 Introduction 1 4.12 Compartmentalisation 43
1.1 General 1 4.13 Procedural measures 44
1.2 Purpose 1 4.14 References 48
1.3 Legal background 2
1.4 References 2 5 Example systematic risk assessment 50
5.1 Worked example 50
2 Background and design objectives 4 5.2 References 57
2.1 Use of a risk-based approach for design against
disproportionate collapse 3 6 Application of systematic risk assessment to existing
2.2 Risk 4 buildings 58
2.3 Risk-based design 4 6.1 Introduction 58
2.4 Reduction of risk 5 6.2 Design of modifications to existing buildings 58
2.5 Building risk classification 7 6.3 Use of systematic risk assessment for existing
2.6 Requirements for design of high-risk buildings against buildings 58
disproportionate collapse 9 6.4 Cost-benefit assessment for existing buildings 58
2.6.1 Eurocodes 9 6.5 References 60
2.6.2 Other jurisdictions 9
2.7 References 9 Appendix A Further reading 61

3 Development of a systematic risk assessment 11

3.1 Framework for a systematic risk assessment 11
3.2 Step 1: Identify the hazards 17
3.2.1 Identification of hazards 17
3.2.2 Foreseeable and unforeseeable hazards 19
3.2.3 Cliff edge effects 21
3.2.4 Low likelihood/high consequence hazards 22
3.2.5 Combined hazards 23
3.2.6 Human error 24
3.2.7 Malicious hazards 24
3.2.8 What to include 24
3.2.9 What to exclude 25
3.3 Step 2: Eliminate the hazards 25
3.4 Step 3: Determine the tolerable risk threshold 26
3.5 Step 4: Evaluate the risk 26
3.6 Step 5: Identify risk reduction measures 28
3.7 Step 6: Cost-benefit assessment 29
3.8 Step 7: Implement the risk reduction measures 30
3.9 Step 8: Review the residual risk 31
3.10 Step 9: Check the sensitivity of the risk assessment 31
3.10.1 Common areas of sensitivity 31
3.10.2 Cliff edge effects 31
3.10.3 Low likelihood/high consequence hazards 32
3.10.4 Combined hazards 32
3.11 Step 10: Review the overall level of risk 32
3.12 Step 11: Provide adequate information about any risks
that remain 32
3.13 References 33

4 Approaches to design against disproportionate

collapse 36
4.1 Introduction 36
4.2 Minimum requirements 36
4.3 General design recommendations 36
4.4 General procedural recommendations 36
4.5 Design loadcases and performance criteria 37
4.6 Design approaches 37
4.7 Scenario-independent design 38
4.8 Mechanisms of resistance 39

The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse iii
1 Introduction
1.1 Scope of this Manual
This Manual proposes a systematic risk assessment
framework for the design of high-risk structures
against disproportionate collapse. Risk assessment is
a requirement for all structures, but for Class 1 and 2
buildings (BS EN 1991-1-7 Annex A1.1) is usually
addressed through good quality management and
through adherence to recognised codes of practice.
This Manual is concerned with systematic risk
assessment as defined in BS EN 1991-1-7
Annex A1.1, principally with regard to the design of
Class 3 buildings. It complements the Institution of
Structural Engineers’ publication Practical guide to
structural robustness and disproportionate collapse in
buildings1.2, which provides a useful primer on the
concepts of robustness and the (largely) qualitative
methods used in the design of lower-risk buildings
against disproportionate collapse. The Practical guide
does not, however, give guidance on the design of
high-risk (Class 3) buildings, which is the primary
focus of this Manual.
The approach set out for systematic risk assessment
in this Manual is designed to be equally applicable to
any high-risk structure. This may include structures
and buildings that do not fit into the building risk
classification system in BS EN 1991-1-71.1,
structures where there are particular risks associated
with the design itself – perhaps by virtue of it being
novel or unusual – or where there are particular risks
to which the structure may be exposed, such as
malicious risks including terrorism.
It may also include structures where there is
exposure or vulnerability in a temporary state, and the
design of the extension, alteration or change of use of
existing structures where design constraints may limit
the level of robustness than can practically be
achieved. In addition to consideration of risks to life
safety, the same methodology may equally well be
applied for the consideration of risk unrelated to
safety, such as where a higher level of performance is
necessary in the structure to support some critical
function, purpose or use.
Boxed examples are given throughout the text to
highlight either lessons from past failures, examples
that would constitute a poor design, or examples of
good design practice. This chapter includes the legal
background, while in Chapter 2 some of the key
concepts are introduced together with a discussion
the Eurocode requirements. Chapter 3 presents the
proposed framework for a systematic risk
assessment and is the core of the document, and is
followed by discussion of each part of the risk
assessment process and the factors that should be
considered in its development. Chapter 4 presents a
commentary on the spectrum of risk reduction
measures that could be employed, both ‘hard’
measures (changes to the design) and ‘soft’
measures (quality assurance, use of peer review and
so on). Chapter 5 gives a worked example for a
typical Class 3 building.
The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse
The reader is referred to three related Institution
publications:
– Safety in tall buildings and other buildings of large
occupancy1.3 provides many recommendations for
designing tall buildings to be intrinsically safe and is
a direct complement to this Manual.
– Risk in structural engineering1.4 provides a
foundation in the principles of risk management and
how to manage risk in design.
– Appraisal of existing structures1.5 has an equally
important relationship to this Manual, which in
Chapter 6 outlines how systematic risk assessment
can be applied to designing for robustness in the
retrofit of existing structures, where the existing
nature of the building is likely to place constraints
on the design feasibility.
1.2 Purpose
The risk-based approach outlined in this Manual may
be used to consider the full spectrum of natural,
accidental and malicious hazards. It is intended to
provide an approach through which the Eurocode
requirement (BS EN 1991-1-7 Annex A1.1) to
undertake a systematic risk assessment for Class 3
buildings can be met, together with the
recommendations of the Building Regulations
Approved Document A1.6 and the equivalent
documents in the devolved administrations of the
United Kingdom1.7-1.9 for Class 3 buildings.
The Manual is written for the professionally qualified
structural engineer who has a certain level of
experience in safety engineering and the principles of
risk assessment. It is intended to aid the practising
structural engineer in the design of robustness in a
high-risk building, though the structural engineer
tasked with preparing the robustness design has a
responsibility to ensure that they are suitably qualified
and experienced (SQEP) to do so. No formal register
exists designating individuals with suitable
qualification and experience for the systematic risk
assessment of high-risk buildings, but it will normally
be expected that the systematic risk assessment will
be authored by a senior structural engineer with a
track record of designing similar buildings, while past
experience of designing against extreme hazards will
be advantageous.
While intended to aid the structural engineer in the
process, the Manual is not intended to be the sole
means by which the engineer will gain the skills and
knowledge required and hence become competent in
the preparation of a systematic risk assessment.
In addition to providing guidance to the practising
structural engineer, the Manual highlights the duty of
care owed by the structural engineer to deliver a
robust design, and the responsibilities held by the
client in the decisions made on the basis of the
assessment findings. It is also written to provide
guidance to the building control body in evaluating a
building control submission for a Class 3 building.
1
1.3 Introduction

1.3 Legal background not suffer collapse to an extent disproportionate to the

cause’’. Eurocode 0 (BS EN 1990)1.17 has the same
basic requirement, though does not restrict the cause
This section outlines a brief summary of the main of the event solely to accidental actions.
legal principles applicable to this Manual, which is
written in the context of health and safety legislation The Approved Documents set out guidance which, in
in England and Wales. the Secretary of State’s view, will be appropriate to
meet the Regulations: similar guidance exists for the
For most construction projects, the main sources of Regulations applicable in the devolved
legislation include: administrations of the United Kingdom1.7–1.9. For
– the Health and Safety at Work etc. Act 19741.10 high-risk buildings, Approved Document A1.6
– the Construction (Design and Management) (CDM) recommends that a systematic risk assessment be
Regulations1.11 undertaken. This recommendation is consistent with
– the Building Regulations1.12. the requirement of BS EN 1991-1-71.1, and it is this
systematic risk assessment which is the subject of this
In certain industries such as the rail, nuclear and Manual.
petrochemical industries, other specific pieces of
legislation will also apply.

Clients are responsible for appointing competent and 1.4 References

adequately resourced designers to carry out the work.

The designer has a statutory duty to, so far as is 1.1 British Standards Institution. BS EN 1991-1-7:2006.
reasonably practicable: Eurocode 1: Actions on structures. Part 1-7: General
– eliminate hazards which may give rise to risks, and actions: Accidental actions. London: BSI, September
– reduce the risks associated with any remaining 2006.
hazards (Regulation 11(4)).
1.2 Institution of Structural Engineers. Practical guide to
If any significant risks remain, the designer must take structural robustness and disproportionate collapse in
all reasonable steps to provide adequate information buildings. London: IStructE, October 2010.
to those who are likely to need to identify and
manage the remaining risks (Regulation 11(6)). 1.3 Institution of Structural Engineers. Safety in tall
buildings and other buildings of large occupancy.
Legislation requires duty holders to consider all London: IStructE, October 2010.
reasonably foreseeable hazards which will, depending
on the structure, include natural hazards such as 1.4 Institution of Structural Engineers. Risk in structural
windstorm and flood, accidental hazards such as fire engineering. [due for publication 2013]
and vehicle impact, and malicious hazards such as
malevolent vandalism and terrorism. A hazard must 1.5 Institution of Structural Engineers. Appraisal of existing
be eliminated or the risk arising reduced unless, structures. 3rd ed. London: IStructE, November 2010.
compared to the risk, it can be demonstrated that it
is grossly disproportionate in terms of time, cost and 1.6 Office of the Deputy Prime Minister. The Building
effort to do so. Regulations 2000 — Approved Document A:
Structure. A3 — Disproportionate Collapse. 2004
Some guidance on determining whether something is edition with 2004 amendments. NBS, 2004.
in gross disproportion to the risk and what
constitutes ‘so far as reasonably practicable’ is given 1.7 Scottish Building Standards Agency. Technical
by the Health and Safety Executive1.13 and the handbook – non-domestic. Section 1 – Structure.
Institution of Civil Engineers1.14. Further information Scottish Building Standards Agency, 1 October 2010.
about the duties of a designer is found in the CDM
Regulations Approved Code of Practice1.15 and 1.8 Scottish Building Standards Agency. Technical
Industry Guidance for Designers1.16. handbook – domestic. Section 1 – Structure. Scottish
Building Standards Agency, 1 October 2010.
The structural engineer will hold a duty of care to
develop a safe structural design. However, duties will 1.9 Building Control Northern Ireland. Technical Document
not fall solely upon the structural engineer: any D – Structure. Department of Finance and Personnel
individual or organization who makes a project- Northern Ireland (DFPNI), 2009.
related decision that might significantly impact the
safety of others may be deemed a designer under the 1.10 The Health and Safety at Work etc. Act 1974 (as
Regulations. amended). 1974.

In designing against disproportionate collapse, risk 1.11 The Construction (Design and Management)
reduction may impact upon the aesthetics of the Regulations 2007. 2007 (SI 2007/320).
design or may increase the cost of the structural
package or the project as a whole. Other parties 1.12 The Building Regulations 2010. 2010 (SI 2010/2214).
such as clients and contractors may be implicated as
designers by virtue of making decisions about 1.13 Health and Safety Executive. ALARP at a glance: How
particular risk reduction measures in the context of to tell if a risk is ALARP: Deciding by good practice.
aesthetics, amenity, function, cost, programme and http://www.hse.gov.uk/risk/theory/alarpglance.htm.
so on that have a bearing on the safety of the design. [Accessed 2012-11-28].

The Building Regulations1.12 require the building to be 1.14 Institution of Civil Engineers. A review of, and
constructed so that ‘‘in the event of an accident [it] will commentary on, the legal requirement to exercise a

2 The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse
 Introduction 1.4

duty ‘so far as is reasonably practicable’ with specific

regard to designers in the construction industry.
London: ICE, January 2010.

1.15 Health and Safety Executive. Managing health and

safety in construction – Construction (Design and
Management) Regulations 2007 Approved Code of
Practice. HSE Books, 2007.

1.16 Health and Safety Executive/Construction Skills. The

Construction (Design and Management) Regulations
2007 – Industry Guidance for Designers. CDM07/4.
ConstructionSkills, 2007.

1.17 British Standards Institution. BS EN

1990:2002 þ A1:2005 incorporating corrigenda
December 2008 and April 2010. Eurocode: Basis of
structural design. London: BSI, 27 July 2002 and
2010.

The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse 3
2 Background and design objectives

2.1 Use of a risk-based approach for risk-based approach it is necessary to make a

distinction between a hazard and the risk arising from
design against disproportionate collapse that hazard. A hazard is something which has the
potential to cause harm, and may be either an action
No systematic risk assessment is a substitute for the on the structure (accidental or malicious), or a so-
lack of a robust structural form. The structural called ‘soft’ hazard such as the failure to adequately
engineer should start from the position of a robust, communicate design information or to carry out
safe structural form and good, ductile detailing, and inspection and maintenance in accordance with a
should then use a systematic risk assessment to specified regime such that a fatigue, corrosion or
determine whether it is sufficiently robust. The safety some other failure results. The risk associated with a
of the structure rests on these two pillars: the first particular hazard is commonly defined as some
and most important, the basic structural form and combination of the likelihood that the hazard will
detailing of the structure; and the second the risk materialise, and the consequences should it do so.
assessment, which seeks merely to test the design
against hazards to which it might be subjected and The distinction in the terminology is necessary to
determine whether there are circumstances in which distinguish the requirements of a risk management
there are risks which are too great to bear. approach, which are to identify all hazards to which
the building might reasonably be subjected and
Since a risk-based approach, by its definition, has no eliminate them where possible to do so, and for the
prescriptively codified requirements, this places hazards that remain to evaluate and reduce the risks
reliance on responsible judgement of the designer that arise so far as is reasonably practicable2.1.
and any regulatory or approving body. In the majority
of cases, risk-based decisions can be successfully Traditionally, risk is expressed in the form of
navigated using sound engineering judgement and by Equation 2.1.
reference to contemporary good practice.
Equation 2.1
The objectives of the approach to design against
Risk ¼ Likelihood
Consequence
disproportionate collapse based on systematic risk
assessment as described by this Manual are then:
(1) To identify the hazards to which the structure The evaluation of the risk arising from each hazard to
might reasonably be subjected. which a building might feasibly be subjected forms
(2) So far as reasonably practicable, to eliminate the the basis of a risk assessment for the design.
hazards which give rise to the risks.
(3) For the hazards that remain, to develop risk
reduction measures that reduce the risks arising
from each hazard so far as it is reasonably 2.3 Risk-based design
practicable to do so and, in so doing, to develop
a structural design which exhibits a level of
structural robustness commensurate with the Section 2.2 considers risk and how to evaluate it. But
level of risk to which the building is subjected. why consider risk at all, and not just design for a
given load? Almost all design is inherently risk-based.
It should be noted that while ‘risk assessment’ is used Buildings are typically designed for a 1 in 50 year
as the commonly accepted term, the approach is about wind load. In seismic design, the designer typically
more than merely the assessment of the risk: reduction considers two separate design basis events: an
of the identified risks is integral to the process. For the earthquake which has a 10% probability of
purposes of this Manual, risk assessment is a exceedence in 50 years, and a larger earthquake
structured tool to help suitably qualified and which has a 2% probability of exceedence in 50
experienced professionals identify, evaluate and years. Even the imposed load used in design is
manage the risk of disproportionate collapse. calculated on a probabilistic basis, and the
characteristic material strength typically corresponds
Rarely will recourse be required in a Class 3 design to a to a 95% confidence interval. Partial factors are then
fully quantitative risk assessment (QRA), and this Manual used to reduce the risk that the design load will
does not advocate a fully quantitative approach. exceed the design resistance to a level which is
Nevertheless, the framework proposed in this Manual considered tolerable.
lends itself to any level of detail in the assessment of risk,
whether qualitative, semi-quantitative or fully quantitative, The difference is that in most aspects of design the
and the structural engineer should determine the level consideration of risk is inherent in the code of
of detail warranted for a particular design. practice, and usually the designer merely needs to
adopt the magnitude of load and the associated
partial factors corresponding to the design life and
other characteristics of the structure.
2.2 Risk
In the design of a structure to withstand accidental
and malicious actions, the hazards to which the
‘Hazard’ and ‘risk’ are often used interchangeably in structure might be subjected and the loads which
everyday vocabulary; however, when adopting a could result from each hazard vary significantly from

4 The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse

structure to structure. Quite clearly, designing a
building for all possible accidental and malicious
actions to which any structure might be subjected is
simply neither practical nor proportionate, nor good
engineering design.
The purpose of a risk-based approach to design
against disproportionate collapse is to allow a proper
examination of the risks to which the structure is
subjected; and in so doing to produce a
proportionate, economic design. Good risk
management does not seek to minimise all risks, but
ensures that the costs of risk reduction measures
implemented in the design remain proportionate to
the magnitude of the risk.
A risk management approach also has an important
secondary benefit in that the remaining risks have
been identified and assessed, enabling those affected
to take action to control the risks to which they are
exposed. If, for example, a building houses a data
centre, actions may be taken to ensure appropriate
fail-over and back-up facilities are designed for the
appropriate actions, such that the tenant’s business
is able continue uninterrupted and their consequential
losses (and hence the building owner’s potential
liability) are reduced.
2.4 Reduction of risk
Two basic approaches exist with regard to reduction
of risk. The first is to define a threshold above which
a risk is considered intolerable, and to reduce the
risks to this threshold. The second is to reduce all
risks so far as is reasonably practicable, irrespective
of whether they already fall below the tolerable
threshold. Any risk which remains above the tolerable
threshold is unacceptable in all circumstances. This
second approach is the one required by England and
Wales statute for safety-related risks.
The first approach ensures that intolerable risks are
addressed, but fails to consider whether a significant
further benefit could be gained beyond this threshold
for a small additional investment. It also fails to
consider the risks which initially lie below the tolerable
threshold.
The second approach goes much further: it defines a
threshold beyond which risks must be mitigated, but
also requires the designer to consider all risks which
fall within a range beneath this threshold and mitigate
these so far as is reasonably practicable (SFARP).
This forces the designer to consider the potential to
eliminate hazards or reduce risks for a small,
sometimes negligible, design change. Such changes
can have a potentially significant impact on the level
of risk and will often be missed by the first approach,
and it is for this reason that England and Wales
statute adopts this approach focussed on driving
down all risks.
The second approach is characterised by the ALARP
risk management framework (Figure 2.1),
recommended by the UK Health and Safety
Executive in the report Reducing risks, protecting
people2.1, which describes HSE’s decision-making
process and originated in an earlier report on The
tolerability of risk2.2. Risks falling in the unacceptable
region must be mitigated, while those below this
The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse
Background and design objectives 2.4
threshold generally fall into the ALARP region and
must be driven down to a level which is as low as
reasonably practicable (ALARP). Below this level,
available resources could be used more effectively on
other risks. ALARP can, for practical purposes, be
taken as being synonymous with the statutory duty to
reduce risks so far as is reasonably practicable
(SFARP)2.3, 2.4 and forms the basis of the approach
used in this Manual.
As highlighted by the statutory duties of a designer
outlined in Section 1.3, it is better to eliminate a
hazard in the first place than to protect against the
risk which arises from it. Similarly, it is better to
implement measures to reduce the risk than to simply
communicate the risk such that it has to be
controlled through operational measures.
One model for expressing this which is suited to
structural engineering design is the ERIC risk
reduction model2.5 (Figure 2.2). This states that
hazards should be eliminated unless the cost of
doing so is disproportionate when weighed in relation
to the risk. The designer has an almost unique
opportunity to eliminate hazards from a design, and
every opportunity should be taken to do so in order
to avoid the need to mitigate the associated risks
later on. If, for example, a building can be designed
such that an errant vehicle cannot impact the building
columns, it will always be preferable to do so than to
reduce the risks associated with the hazard. By the
same logic, it will always be preferable to design a
building so that it is able to withstand the loss of a
column than to protect against its loss, because the
inherent vulnerability associated with the column is
removed and the risks derived from the hazards to
which the column may be subjected become less
significant (Box 2.1).
If the hazard cannot reasonably be eliminated, the
risk arising should be reduced to a level which is
ALARP (Box 2.2). Deciding whether a risk is ALARP
can be challenging because it requires exercise of
judgement. The designer must reach decisions about
whether a risk reduction measure is proportionate or
disproportionate, and therefore whether a risk has
been reduced so far as reasonably practicable. In the
majority of cases the decision can be reached
through engineering judgement and with reference to
contemporary good practice, examples of which are
given throughout this Manual. Guidance on deciding
whether a risk is ALARP is given by the Institution of
Civil Engineers2.3 and the Health and Safety
Executive2.4.
Unacceptable
region
ALARP region
Broadly
acceptable
region
Figure 2.1 The ALARP framework for the tolerability of risk
5
2.4 Background and design objectives

E liminate Example: grade separation

If a hazard can be eliminated by amending the design, the designer must do so eliminates the hazard of an
errant vehicle impacting
(1) if it is a mandatory requirement or a specific obligation; but otherwise
perimeter building columns.
(2) so far as is reasonably practicable.
If the identified hazard cannot be eliminated:

Example: the structure is designed to

R educe be able to redistribute the load from a
The designer must reduce the remaining risks associated with the perimeter column through the adjacent
hazard, so far as is reasonably practicable. perimeter and internal columns such
The weight given to a particular risk will be proportional to its that collapse is prevented.
assessed likelihood and consequence. This will be a professional
judgement but guided by relevant good practice. If this is not possible, then an external
vehicle barrier (such as an upstand wall)
If significant risks remain: is designed to prevent vehicle impact.

I nform Example: the designer informs the client

about the procedures needed to control
Provide information on the risks that remain to the access, e.g. for maintenance vehicles, and
contractor, or those using or maintaining the structure. about the requirements to ensure the
barrier is appropriately maintained.

C ontrol Example: the client implements procedures to

Control the risks during the construction,
operation and maintenance of the building
according to the information communicated
by the designer. Review the risks if the
design or actions change.
restrict access only to authorised maintenance
vehicles and secure access against unauthorised
vehicles, and to ensure appropriate maintenance
of the barrier for its safe and secure operation.

Figure 2.2 The ERIC risk reduction model

Box 2.1 Eliminating risks – example

The UK Highways Agency advocates portal gantries that span both carriageways of a motorway without support in the central
reservation2.12. Such a design wholly eliminates the hazard of impact from an errant vehicle in the central reservation. The need for
impact protection of a support in the central reservation is entirely redundant, and the risks both of damage to the gantry and to
vehicle occupants are both reduced. While the legs on each side of the carriageway are consequently made more critical, these are
generally raised on large concrete plinths located on the embankment to minimise the risk of impact. The gantry design has further
advantages of minimising disruption during construction due to the lack of need for construction access to the central reservation.
Refer also to Box 3.4 for a similar example.

Box 2.2 Reducing and informing risks – example

A designer undertakes a systematic risk assessment of a tall building on an urban site with a small footprint, and concludes that vehicle
security bollards are necessary to enforce the stand-off from the building in order to adequately reduce the risk due to terrorism. The
findings of the designer’s risk assessment, prepared as part of the CDM requirements, identify construction health and safety hazards
only. The health and safety file for the building is produced but is misplaced some time after the completion of the project.
Several years later, the building is sold and the new owner commissions a landscape architect to redevelop the public realm around
the building in a scheme which includes traffic calming. Structural and services engineers are appointed to carry out foundation and
utilities design respectively, but have no scope beyond this. There is a lack of collective knowledge in the client/design team about
the purpose served by the bollards and, presuming their purpose is for pedestrian safety, they elect to remove them as part of the
new public design. The protection afforded by the bollards is lost and the structural design is rendered vulnerable to
disproportionate collapse.

6 The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse
 Background and design objectives 2.5

Some risks will remain in the design: these will relate
to hazards for which a reduction in the risk has not
been possible for some reason or where the risk has
been reduced as far as possible but is still
significant. These risks should be communicated
to those affected (‘inform’) such that they may
take steps to control the risk through working
practices or other measures (Boxes 2.2 and 2.3).
It is often here that things are most likely to go
wrong – from the study of past failures it is readily
apparent that poor communication is often a
significant causal factor2.6-2.11. Safeguarding the
reduction in risk achieved through good quality
management and reducing any significant remaining
risks are therefore both fundamental to a successful
design.
If the cost of a proposed measure is shown to be
disproportionate when weighed in relation to the
magnitude of the risk, it is unnecessary to implement
the risk reduction measure in the design (Box 2.4).
Consequently the assessment of risks using Equation
2.1 forms one input to a cost-benefit assessment,
upon the basis of which decisions will be taken about
the reduction of these risks.
If, after going through these stages, it has not been
possible to reduce the risk to a tolerably low level, the
designer should consider whether the proposed
design is worth the risk. In some cases this will mean
going back to the conceptual stage of design and
approaching the robustness of the structure and
perhaps the structural design as a whole in a different
way.
2.5 Building risk classification
A structure designed to the Eurocodes is required by
BS EN 1990 to ‘‘be designed, and executed in such
a way that it will, during its intended life, with
appropriate degrees of reliability and in an economical
way sustain all actions and influences likely to occur
during execution and use, and meet the specified
serviceability requirements for a structure or a
structural element’’2.17. This overarching requirement
describing the philosophy of the structural design is
supplemented by more specific requirements
contained in Annex A of BS EN 1991-1-72.18 (refer
also to the background document by
Vrouwenvelder2.19). These vary according to the risk
classification ascribed to the building, see Table 2.1.
The building risk classification system and the
associated design requirements given in Annex A of
BS EN 1991-1-72.18 represent contemporary good
practice which the engineer would be expected to
follow. Annex A has been accepted in the UK
National Annex2.20. Where the status of the Annex is
informative, as a minimum the building risk

Box 2.3 Controlling risks – example

Following the inquiry into the Ronan Point collapse2.13, advice was issued to local authorities by the Ministry of Housing and Local
Government (MHLG) for the disconnection of piped gas supplies from other existing large panel system (LPS) blocks, and to
appraise and if necessary to implement strengthening of the block in order to reduce the risk associated with an internal gas
explosion following a release from the piped gas supply. Owners were required to consider whether strengthening was necessary by
MHLG Circulars 62/682.14 and 71/682.15, appraising the strength of the structure using an equivalent static pressure of 34kPa
(5psi) where a piped gas supply was present; or halving this pressure to 17kPa (2.5psi) where the building was without a piped gas
supply. In spite of this, over the intervening years a number of LPS blocks have been identified where the piped gas supply has not
been removed, even though the blocks had not been shown to have sufficient strength to resist the specified overpressure load of
34kPa2.16.
The failure to implement the removal of the piped gas supply is perhaps because of greater weight being given to living conditions
than to the significance of the reasons for the removal of piped gas and the appraisal of the existing structure, either consciously or
because the corporate memory is short. Irrespective of the reason, the failure to put adequate controls in place to manage the risk
means that the hazard associated with internal gas explosion in such structures has either persisted or subsequently re-emerged,
and continues to exist.

Box 2.4 ALARP and gross disproportion – example

Consider the risk associated with a loading bay beneath a building in a city centre. A credible hazard is the impact of a vehicle into
exposed columns. The hazard cannot be eliminated except through omission of the loading bay or its relocation outside the footprint
of the building. The building footprint must be maximised within the site for the project to be viable. Servicing of the building is
necessary but offloading off the street would not be permitted due to associated traffic congestion. It is therefore determined that
measures by which the hazard would be eliminated are in gross disproportion to the magnitude of the hazard.
Consequently it is legitimate to progress to the ‘R’ of ERIC: reduction of the risk arising. It would not be disproportionate to
undertake a vehicle dynamics assessment to determine the maximum impact velocity for different types of vehicle. Nor would it be
disproportionate to put protective bumpers on the columns such that the reinforcement cover is not lost due to successive minor
impacts, or to implement an inspection regime such that impacts are identified and repairs undertaken. It may even be appropriate
to consider the effect of an ensuing vehicle fire on the structure, given the importance of the columns and the likelihood of the
hazard. Even with these risk reduction measures, there remains a degree of risk, however small.
If the risk of terrorism is significant, a blast resilience study can be undertaken which considers any strengthening to reduce the
risk of collapse under blast load and then determines the critical charge weight for collapse. This can be used to inform the
development of security procedures governing the operation of the loading bay such that the client can control the risk through
enforcement of security measures regarding vehicle access.
Proportionate steps can therefore be taken to reduce the level of risk and an acceptable solution developed, with the background
philosophy and any procedural measures necessary to control the residual risk communicated to the client.

The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse 7
2.5 Background and design objectives

Table 2.1 BS EN 1991-1-7 building risk classification

Consequence class Example of categorisation of building type and occupancy
1 – Single occupancy houses not exceeding four storeys.
– Agricultural buildings.
– Buildings into which people rarely go, provided no part of the building is closer to another building, or
area where people do go, than a distance of 1.5 times the building height.
2A – Five-storey single occupancy houses.
Lower risk group – Hotels not exceeding four storeys.
– Flats, apartments and other residential buildings not exceeding four storeys.
– Offices not exceeding four storeys.
– Industrial buildings not exceeding three storeys.
– Retailing premises not exceeding three storeys of less than 1000m2 floor area in each storey.
– Single-storey educational buildings.
– All buildings not exceeding two storeys to which the public are admitted and which contain floor areas not
exceeding 2000m2 at each storey.
2B – Hotels, flats, apartments and other residential buildings greater than four storeys but not exceeding 15
Upper risk group storeys.
– Educational buildings greater than single-storey but not exceeding 15 storeys.
– Retailing premises greater than three storeys but not exceeding 15 storeys.
– Hospitals not exceeding three storeys.
– Offices greater than four storeys but not exceeding 15 storeys.
– All buildings to which the public are admitted and which contain floor areas exceeding 2000m2 but not
exceeding 5000m2 at each storey.
– Car parking not exceeding six storeys.
3 – All buildings defined above as Class 2 Lower and Upper Consequences Class that exceed the limits on
area and number of storeys.
– All buildings to which members of the public are admitted in significant numbers.
– Stadia accommodating more than 5000 spectators.
– Buildings containing hazardous substances and/or processes.

classification system and the performance of a circumstances surrounding the design that warrant
systematic risk assessment as outlined in this Manual the categorisation of a building nominally designated
should still be adopted in the design of high-risk as a lower risk class as a Class 3 building. Such
buildings. The engineer may also decide to adopt the situations in which the designation of a building as
Annex in the design of lower risk buildings. Class 3 might be appropriate include:
– Buildings that do not fall into the building risk
Class 3 framed structures designed and detailed in classification system given in Table 2.1.
accordance with the Eurocodes with the UK National – Buildings housing hazardous operations such as
Annexes and accompanying non-contradictory laboratories, or hazardous plant or materials such as
complementary information (NCCI) will normally oil-filled electrical transformers and bottled gases.
incorporate the requirements of the risk classes up to – Structures featuring innovative, complex or unusual
and including Class 2B. Nevertheless, as part of their structural framing, stability arrangements, materials
design duties the structural engineer has a or construction techniques2.21.
responsibility to review the codes of practice – Structures with a high degree of modularisation and
proposed for design and to ensure they are repetition where there is the potential for a systemic
appropriate and contain all necessary design error.
provisions. This includes the robustness – Structures designed at the margins of the codes of
requirements. practice and the underlying assumptions upon
which they are based.
The building risk classification system in Table 2.1 is – Structures designed ‘down to the bone’ or
merely given as guidance, and the structural engineer optimised ‘to within an inch of their lives’, and
should determine the most appropriate risk therefore very highly stressed and with very little
classification based on the risks associated with the redundancy.
design. Rarely will it be detrimental to classify a lower – Buildings exposed to abnormal, significant or
risk class building as Class 3 and undertake a extreme risks, including those to which there is a
systematic risk assessment. At the very least it results credible risk from terrorist attack.
in a better understanding of the risks associated with – Structures having exposure or vulnerability in a
the structural design, and will often be beneficial in temporary state.
terms of reducing the level of risk in the design or – Existing buildings undergoing extension, alteration
identifying that an alternative design approach is or change of use, particularly where there are
more suitable. unknown structural characteristics and/or the
potential for hidden defects.
The structural engineer should therefore consider – Structures required to exhibit a high level of
whether there are unusual features, actions or other reliability or a greater level of performance than

8 The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse

required solely for life safety, owing to some critical
function, purpose or use they are required to
support.
There will also often be components of Class 3
buildings in a building which would otherwise be
designated as Class 2A or Class 2B, in which case
the entire building should be considered as a Class 3
building.
2.6 Requirements for design of high-risk
buildings against disproportionate
collapse
2.6.1 Eurocodes
BS EN 1991-1-72.18 requires that for all buildings
designated as Class 3, ‘‘a systematic risk assessment
of the building should be undertaken taking into
account both foreseeable and unforeseeable
hazards’’; however no information is given about the
form that this assessment is expected to take. The
recommended approach for meeting the requirement
in a way which is compatible with the mandatory
requirement in UK health and safety legislation of
hazard elimination and risk reduction is described in
Chapter 3.
The Eurocode does not expressly require that Class 3
structures should meet the rules for Class 2B
structures as a minimum; however it would be
paradoxical if a higher-risk Class 3 structure with a
lower level of robustness than that achieved in a
Class 2B design were considered an acceptable
design. The Department for Communities and Local
Government guidance to BS EN 1991-1-72.22 states
that ‘‘logically, design for Class 3 structures should
consider the design rules for [Class 2B] as a
minimum’’.
Class 2B buildings may follow a prescriptive route to
meeting the Eurocode through the incorporation of
horizontal and vertical ties and/or design of ‘key
elements’. This reveals nothing, however, about how
robust the resulting structural design is; merely that it
complies with the requirements of the Eurocode. This
is true of all such prescriptive methods: to understand
the degree of robustness imparted to the structure, a
quantitative assessment is necessary in which the
structure is evaluated under the effects of each
hazard being considered through structural analysis.
In high-risk structures the potential to cause harm is
heightened compared with other structures due either
to the number of occupants, a characteristic of those
occupants or some feature of the building’s function,
location or purpose. The design of such structures
therefore warrants both a greater degree of certainty
being gained regarding the level of robustness
inherent in the structure, and greater measures being
taken to reduce the risks to which the structure is
subjected.
Consequently the structural engineer must, in
commencing the systematic risk assessment,
consider whether greater care should be taken to
evaluate the robustness of the structural design by
using quantitative rather than using prescriptive
approaches. Not all Class 3 structures are created
The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse
Background and design objectives 2.6
equal: there may be nothing inherent in the design of
a four-storey hospital that justifies a different
approach being used from a building with one fewer
storey. However, for a more significant structure,
some level of structural analysis of the performance
of the structure under some of the hazards identified
would be expected, rather than merely relying on the
notional level of robustness imparted by prescriptive
methods.
2.6.2 Other jurisdictions
The requirement to consider disproportionate
collapse is included in most commonly-used building
codes across the world. As a minimum the
requirement is generally stated: ‘‘structures shall be
designed to sustain local damage with the structural
system as a whole remaining stable and not being
damaged to an extent disproportionate to the original
local damage’’2.23. ASCE 7-102.24 contains
requirements for minimum structural integrity for all
structures except those designed in accordance with
detailing requirements for seismic design. The
minimum structural integrity requirements are
expected to provide structural integrity ‘‘. . .for normal
service and minor unanticipated events that may
reasonably be expected to occur throughout their
lifetimes’’, but highlights that more rigorous protection
than is provided by the code should be incorporated
in the design of structures housing large numbers of
people, housing functions necessary to protect public
safety or for structures that may be the subject of
intentional sabotage or attack. The International
Building Code (IBC)2.25 has also implemented some
rules for minimum structural integrity which are
broadly similar.
The US Department of Defense Unified Facilities
Criteria2.26 for the design of defence buildings to
resist progressive collapse are closely correlated with
and are an extension of the UK requirements.
Typically they would not be considered directly
suitable for application to civilian buildings, but they
incorporate a rigorous treatment of robustness and
provide a good source of reference.
When designing to codes of practice other than the
Eurocodes, the structural engineer may choose to
supplement the requirements of the governing
building codes with both the building risk
classification system in BS EN 1991-1-72.18 (or a
version thereof adapted for the project/jurisdiction in
question) and the subsequent preparation of a
systematic risk assessment as described in this
Manual. There are few circumstances where doing so
would not improve the robustness of the structure,
irrespective of the underlying code of practice to
which the building is being designed.
2.7 References
2.1 Health and Safety Executive. Reducing risks, protecting
people: HSE’s decision-making process. HSE Books,
2001.
2.2 Health and Safety Executive. The tolerability of risk
from nuclear power stations. HMSO, 1992.
2.3 Institution of Civil Engineers. A review of, and
commentary on, the legal requirement to exercise a
9
2.7 Background and design objectives

duty ‘so far as is reasonably practicable’ with specific structures – Part 1-7: Accidental actions. London: BSI,
regard to designers in the construction industry. December 2008.
London: ICE, January 2010.
2.21 Pugsley AG. The safety of structures. London: Edward
2.4 Health and Safety Executive. ALARP at a glance: How Arnold (Publishers) Ltd, 1966.
to tell if a risk is ALARP: Deciding by good practice.
http://www.hse.gov.uk/risk/theory/alarpglance.htm. 2.22 Department for Communities and Local Government.
[Accessed 2012-11-28]. Guide to the use of EN 1991-1-7 – Accidental
Actions. DCLG Publications, September 2006.
2.5 Health and Safety Executive/Construction Skills. The
Construction (Design and Management) Regulations 2.23 American Society of Civil Engineers. ASCE/SEI 7-05:
2007 – Industry Guidance for Designers. CDM07/4. Minimum design loads of buildings and other
ConstructionSkills, 2007. structures. ASCE, 2005.

2.6 Agarwal J, Haberland M, Holickẏ M et al. Robustness 2.24 American Society of Civil Engineers. ASCE/SEI 7-10:
of structures: lessons from failures.. Structural Minimum design loads of buildings and other
Engineering International 2012;1/2012:105-111. structures. ASCE, 2010.

2.7 Rihani S. Structural failures – a case study: Hartford 2.25 International Code Council. International Building Code.
Coliseum. ASCE Structural Engineering Institute (SEI), ICC, 2012.
September 2005.
2.26 United States Department of Defense. Unified Facilities
2.8 Delatte NJ. Forensic case studies for civil engineers. Criteria UFC 4-023-03: Design of Buildings to Resist
ASCE Press, 2009. Progressive Collapse. Washington, D.C., 14 July 2009
(including Change 1 – 27 January 2010).
2.9 Levy M, Salvadori M. Why buildings fall down: how
structures fail. New York, NY: W.W. Norton, 1992.

2.10 Feld J, Carper K. Construction failure. 2nd ed.

New York, NY: John Wiley & Sons, 1997.

2.11 Kaminetzky D. Design and construction failures:

lessons from forensic investigations. New York, NY:
McGraw-Hill, 1991.

2.12 Highways Agency. Interim Advice Note 86/07:

Amendments to design requirements for portal and
cantilever sign/signal gantries. IAN 86/07. Department
for Transport, 2007.

2.13 Ministry of Housing and Local Government. Report of

the inquiry into the collapse of flats at Ronan Point,
Canning Town. HMSO, 1968.

2.14 Ministry of Housing and Local Government. Circular

62/68: Flats constructed with precast concrete panels.
Appraisal and strengthening of existing blocks: design
of new blocks. HMSO, 15 November 1968.

2.15 Ministry of Housing and Local Government. Circular

71/68: Flats constructed with precast concrete panels.
Appraisal and strengthening of existing blocks: design
of new blocks. HMSO, 20 December 1968.

2.16 Building Research Establishment. Handbook for the

structural assessment of large panel system (LPS)
dwelling blocks for accidental loading. Watford: BRE
Press, 2012.

2.17 British Standards Institution. BS EN 1990:2002 þ

A1:2005 incorporating corrigenda December 2008 and
April 2010. Eurocode: Basis of structural design.
London: BSI, 27 July 2002 and 2010.

2.18 British Standards Institution. BS EN 1991-1-7:2006.

Eurocode 1: Actions on structures. Part 1-7: General
actions: Accidental actions. London: BSI, September
2006.

2.19 Vrouwenvelder A, Stiefel U, Harding G. Eurocode 1, Part 1.7

– Accidental actions: background document. 2008.

2.20 British Standards Institution. NA to BS EN 1991-1-

7:2006. UK National Annex to Eurocode 1: Actions on

10 The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse
3 Development of a systematic risk assessment

3.1 Framework for a systematic risk
assessment
This chapter forms the core of this Manual: it outlines
the systematic risk assessment process which is
proposed, together with some commentary on each
step of the process. This process is supplemented by
the discussion in Chapter 4 on the design of ‘hard’
measures (i.e. changes to the design) and ‘soft’
measures (i.e. procedural measures) that may be
adopted as risk reduction measures, and an example
systematic risk assessment built on this methodology
is given in Chapter 5.
element rather than being hardened against a given
load, it no longer matters whether this load is slightly
larger than expected or the strength slightly lower.
The cliff edge defined by the ultimate capacity of the
column has been eliminated; consequently the global
structural response has been rendered insensitive to
the ultimate capacity of the column and therefore to
the risks derived from the hazards to which it could
be subjected.

The systematic risk assessment should have a single

author who takes overall responsibility for the
robustness of the design, but to ensure sufficient
expertise is available will require contribution from
several members of the design team and other
stakeholders. The structural engineer tasked with the
authorship of the systematic risk assessment should
possess suitable qualification and experience (SQEP)
to do so, and is responsible for identifying the
additional input necessary to ensure that all
reasonably foreseeable hazards with the potential to
cause harm are identified. It is recommended that the
identification of hazards is undertaken in part through
a risk assessment workshop, facilitated either by the
author of the systematic risk assessment or by an
independent third-party chair with expertise in
facilitating the thorough identification of risks. A
HAZard and OPerability study (HAZOP) is a
systematic approach to the identification of risks
developed by Kletz3.1-3.3, and a HAZOP chairman or
a CDM coordinator can be a suitable facilitator of the
hazard identification workshop.

The proposed framework for systematic risk

assessment is given in Figure 3.1. The approach is
based on two distinct design concepts:
– Scenario-independent design: design to withstand
the sudden loss of any given individual structural
member comprising part of the vertical load path or
stability system, irrespective of the cause.
– Scenario-dependent design: consideration through
a systematic risk assessment of hazard scenarios
which might occur during the design life of the
building (including erection and demolition) that
have the potential to cause harm, and the
implementation of risk reduction measures to
reduce these risks to a level which is considered
tolerable.

Scenario-independent design is a risk reduction

measure which it is recommended should usually be
implemented as a primary risk reduction measure,
prioritised over scenario-dependent measures. This is
because it is effective over several hazards rather
than just one particular hazard, and because it
decreases the sensitivity of the design to the
underlying assumptions made in the risk assessment.

The decreased sensitivity comes through minimising

the presence of cliff edges in the structural response:
if the building is designed to withstand the loss of an

The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse 11
3.1 Development of a systematic risk assessment

Step 1:
Identify the hazards

Step 2: Eliminate the Step 3: Determine

hazards where the level of
feasible to do so tolerable risk

Step 4: Evaluate the risks that remain

(a) Determine (b) Determine the (c) Quantify the risk using a risk matrix
the likelihood consequence (likelihood × consequence)

Step 5: Identify risk

reduction measures

Step 6: Perform a cost–benefit

assessment for each of the
risk reduction measures

Step 7: Implement risk

reduction measures
Review

Step 8: Review the residual risk

Step 9: Check the sensitivity of the risk assessment

(a) Check cliff (b) Review low likelihood/high (c) Review combined
edge effects consequence hazards hazards

Step 10: Review the

overall level of risk

Step 11: Effectively communicate

information about any risks that
remain in the design

Figure 3.1 Framework for a systematic risk assessment for design against disproportionate collapse

12 The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse

– Step 1: Identify the hazards (Section 3.2).
Identify the foreseeable and unforeseeable
hazards to which the building might reasonably
be subjected.
– Step 2: Eliminate hazards where feasible to do
so (Section 3.3). Consider whether it is possible
to eliminate some of these hazards through an
amendment to the design. For example, the
design of a grade change between an adjacent
roadway and a building may eliminate the risk of
vehicle impact, or simple anti-vandal measures
may eliminate the risk of malevolent vandalism to
critical structural elements.
– Step 3: Determine the level of tolerable risk
(Section 3.4). Define scales of likelihood and
consequence appropriate for the evaluation of
risk for the particular project being undertaken,
and determine the extent of damage that would
be considered intolerable. Plot this threshold on
the risk matrix.
– Step 4: Evaluate the risks (Section 3.5). For
each hazard that remains:
4(a) Determine the likelihood of the hazard
materialising.
4(b) Determine the consequences of the hazard
should it materialise, taking into account
the existing design provisions.
4(c) Quantify the risk associated with each
hazard according to the likelihood and
consequence evaluated in 4(a) and 4(b).
Consider the sensitivity of the design to the
underlying assumptions and, where
necessary, perform sensitivity studies using
engineering analysis to identify how the
evaluated risk might vary with minor changes
in the input parameters.
– Step 5: Identify risk reduction measures (Section
3.6). For each risk in turn, irrespective of
whether the risks lie below the tolerable risk
threshold, identify scenario-independent and
scenario-dependent measures that could be
implemented to reduce the risk.
– Step 6: Perform a cost-benefit assessment for
each potential risk reduction measure (Section
3.7). Weigh the reduction in risk in relation to the
cost of the measure. Usually, one mitigation
measure will give a reduction in the risks across
several hazards. The total risk reduction across
all impacted hazards must be used as the basis
for the cost-benefit assessment.
– Step 7: Implement risk reduction measures
(Section 3.8). Identify risk reduction measures to
be implemented, and incorporate them in the
design. Risk reduction measures which are
cheap but have a significant impact on the risk
(a high cost-benefit ratio), or that represent
contemporary good practice, should always be
implemented regardless of whether the risk is
already below the tolerable threshold.
– Step 8: Review the residual risk (Section 3.9).
Review the residual risks that remain in the
design following the application of the risk
reduction measures with the client and any other
risk stakeholders who will become the risk
owners for the residual risks in the design. As
the eventual risk owners who will be responsible
The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse
Development of a systematic risk assessment 3.1
for the controlling the residual risks, both the
client and other risk stakeholders must agree
with and accept the level of residual risk inherent
in the design.
– Step 9: Check the sensitivity of the risk
assessment (Section 3.10). Check the sensitivity
of the findings of the risk assessment in the
following three respects:
9(a) Check cliff edge effects. For each hazard,
check whether small changes in the
assumptions will lead to a gross change in
the consequences of the hazard. If so,
consider the beyond-design basis event in
which the action is slightly worse than
assumed in the risk assessment and either
eliminate the cliff edge or move it to be
sufficiently distant from the design basis so
as to reduce the sensitivity in the design.
9(b) Review low likelihood/high consequence
hazards. Due to the sensitivity of such
hazards to small changes in the underlying
assumptions, use a sensitivity study to
determine whether the risk to occupants
will be significantly worse if the hazard is
slightly larger than is assumed, or the
structural response slightly worse than
calculated.
9(c) Review combined hazards. Combined
hazards may not have been considered
directly in the preceding risk assessment.
Consider combined hazards in their own
right on the basis of the previous decision.
Consider the hazard from two angles when
determining whether the level of damage is
intolerable:
– the likelihood of each event separately and
the level of damage that is considered
intolerable
– given that the first hazard may occur, how
much damage is considered proportionate
to the risk of the second hazard?
– Step 10: Review the overall level of risk (Section
3.11). Review the overall level of both the
unmitigated and the mitigated risk. Unmitigated
risks may be high but highly-effective mitigation
may have been identified and incorporated.
Equally, the overall level of risk may be high but
it may not have been possible to make much
impact through the mitigation measures.
In either case, the design of the building against
disproportionate collapse has been found to
have particular importance, and an independent
peer review of the systematic risk assessment
by a suitably qualified and experienced person is
warranted.
– Step 11: Effectively communicate information
about any risks that remain (Section 3.12). For
those risks that remain in the design, provide
adequate information to those who might be
affected by the risks such as clients, other
designers, contractors and sub-contractors. The
duty is incumbent on the designer to take all
reasonable steps to ensure the information is
communicated effectively: it is not sufficient to
merely prove that information has been issued.
13
3.1 Development of a systematic risk assessment

Likelihood is being prepared. Where the design life varies, for

example in bridge design where 120 years is
The likelihood is expressed of a given hazard which typical or in the design of temporary structures,
has a specified magnitude or severity. This is most the scale of likelihood will need to be adapted
commonly expressed using a return period, or the accordingly. The return period can be calculated
annual probability of exceedence. However, this for a different probability of exceedence using
quickly leads to unmanageably small numbers, and it Equation 3.1.
is often better to think about how likely an event is to
occur during the life of the building. It should also be possible to evaluate the likelihood
of ‘soft’ hazards by considering the procedures in
Table 3.1 gives an example likelihood scale for a place to assure the quality of the design and
building with a typical 50 year design life. The construction, and the potential that exists for
scale should be reviewed to ensure it is uncontrolled events such as the failure to
appropriate for the particular circumstances of the undertake inspection and maintenance during the
building for which the systematic risk assessment operation of the building.

Table 3.1 Example likelihood scale

Likelihood Frequency Approximate return period (based on 50 year
design life)
Frequent/common 10 times in design life Less than 1 in 10 years
Likely 50% probability of occurrence during design life 1 in 10 years to 1 in 100 years
Unlikely 10% probability of occurrence during design life 1 in 100 years to 1 in 1000 years
Rare 2% probability of occurrence during design life 1 in 1000 years to 1 in 10000 years
Improbable 0.1% probability of occurrence during design life 1 in 10000 years to 1 in 100000 years
Negligible Less than 0.1% probability of occurrence during design life Greater than 1 in 100000 years

Equation 3.1
Annual probability of exceedance
¼ 1  ½1  required probability of exceedance in N years]1=N
This is equal to the inverse of the return period.
Example: for an event with a 10% probability of exceedence in 50 years, the annual probability of exceedence is
1  ½1  0:11=50 ¼ 0:2% per annum, and the corresponding return period is 1=0:2% ¼ 475 years, or a 1 in 475 year event.

Consequence reviewed to ensure it is appropriate for the

particular circumstances of the structure for which
Consequence can be evaluated using a variety of the systematic risk assessment is being prepared.
measures: numbers of fatalities, numbers of injuries, For example, it may be varied due to the nature of
economic cost of repair, economic impact of the occupancy of the building, e.g. high levels of
downtime/temporary loss of asset and so on. These occupancy, high-risk groups or a high proportion
variables are difficult to combine (the ‘apples and of occupants having impaired mobility (whether
pears’ problem), and are often difficult to quantify in wheelchair users or ambulant disabled) where a
the first place. For example, the number of fatalities given level of damage may be more serious.
depends on the occupancy of the structure at the Foundation failure may be an additional aspect.
time of the collapse, which in turn depends on such For special structures or for structures with
things as whether it is the first Saturday of the school unconventional framing arrangements, the scale of
holidays. Consideration of fatalities, economic loss consequences in Table 3.2 is unlikely to be directly
and downtime is necessary but in the absence of suitable, and development of an appropriate scale
probabilistic models that are generally too complex to describe the scale of consequences in that
for application in mainstream design, a more easily specific structure will be necessary.
quantified approach is required; for this reason area
of collapse is conventionally used as a proxy for In evaluating the response to a particular hazard, the
these variables. area of collapse may be calculated, and the
underlying variables measured indirectly from this. For
In the context of the magnitude or severity of the example, an area of 100m2 might result in fewer than
specified hazard, the consequence is expressed 10 people at risk of injury or fatality in a typical
by considering the vulnerability of the structure to building, but in a grandstand might correlate to 100
that hazard. Table 3.2 gives an example or more injuries or fatalities. It should also be possible
consequence scale for typical conventionally- to evaluate the consequences of ‘soft’ hazards in the
framed multi-storey buildings. This should also be same manner.

14 The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse
 Development of a systematic risk assessment 3.1

Table 3.2 Example consequence scale

Consequence Description of collapse/damage
Minimal Visible damage to structural element necessitating only cosmetic repair.
For example: cracking of concrete, elastic deformation of steel causing flaking of paint.
Minor Local permanent structural damage but structural members continue carry self-weight. Minor repair will
be needed.
Example: minor deformation of beam flanges necessitating retrofit of gusset plates in order to restore
the full structural capacity.
Significant Loss of structural member local to the event but no collapse of the floor slab.
Serious Collapse of up to 15% of the area of the storey or 100m, whichever is the lesser, and not extending
further than the immediately adjacent storeys.
Substantial Collapse meets one or more of the following criteria:
Collapse exceeds the limits above OR Collapse of up to 20% of the total gross internal
but collapse of a complete storey area of the building (summed over all storeys) but
does not occur. not extending further than five immediately
adjacent storeys (i.e. collapse occurs over fewer
than five storeys in total).
Severe Collapse meets one or more of the following criteria:
Collapse of a complete storey. OR Collapse of up to 20% of the total gross internal
area of the building (summed over all storeys)
and extending over more than five immediately
adjacent storeys (or the full height of the building
if less).
Catastrophic Collapse exceeds one or more of the limits given above.

Risk determining this threshold are discussed in

Likelihood and consequence are usually combined
using a risk matrix (Figure 3.2) to assess the level of
risk. The risk matrix shows a typical tolerable risk
threshold as an example; factors considered in
Section 3.4. The BS EN 1991-1-73.4 threshold of
disproportion for damage due to an accidental event
(which on the above likelihood scale is an event with
a 2% probability of occurrence during the design life
of the building) is highlighted.

Consequence
Catastrophic
Substantial
Significant
Minimal

Serious

Severe
Minor
Likelihood

Frequent/common

Likely

Unlikely

Rare

Improbable

Negligible

Legend Tolerable risk Intolerable risk

Note
A typical tolerable risk threshold is indicated by the thick black line.

Figure 3.2 Example risk matrix

The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse 15
3.1 Development of a systematic risk assessment

The systematic risk assessment process proposed in – Involve other members of the design team or
this Manual assumes the involvement of several specialists e.g. geotechnical engineers, fire
parties, the suggested roles of whom are described engineers, blast engineers, transport engineers and
below. external stakeholders such as emergency
responders, whose input is needed to properly
Client/building owner inform the systematic risk assessment. Consider
– Ensure that the designer is competent and is involving an independent chair with particular
adequately resourced to carry out the work. expertise in risk management to facilitate a hazard
– Define the brief for the structural design, including identification and risk assessment workshop: the
any specific design requirements which may CDM coordinator or another risk specialist such as
indicate an enhanced level of performance is a HAZOP chairman, who is experienced in risk
necessary than that required solely for life safety. assessment but not directly involved in the design,
– Where the level of residual risk affects the client’s will often be a useful chair for a risk assessment
interests (e.g. because of an enhanced level of workshop.
performance, or because of the maintenance and – Develop the systematic risk assessment outlined in
inspection requirements associated with a this Manual, fulfilling the statutory duty to, so far as
particular design solution), agree this with the reasonably practicable, eliminate hazards from the
design team. In all cases the structural engineer, as design and reduce the risks associated with any
a designer, will have a duty to provide a minimum hazards that cannot be eliminated.
level of safety in the design, regardless of any – Develop the design of any risk reduction measures
client opinion. and coordinate the design with other members of
– Take due regard of safety such that the safety of the design team.
the design is not adversely impacted by any client – Provide the client, other designers (e.g. temporary
decisions. Design decisions reconciling cost, works designers, contractor’s designers),
programme and conflicting design requirements will contractors and sub-contractors with adequate
often lead to the client being defined as a designer information about any significant residual risks that
under health and safety legislation, then having the remain in the design.
same duty of care as the design team regarding the
elimination of hazards and reduction of risks Other designers (e.g. temporary works designers,
(see Section 1.3). contractors’ designers)
– Put in place risk management procedures – Provide input to the systematic risk assessment on
recommended by the structural engineer (e.g. any risks within each individual’s area of expertise,
fatigue/corrosion inspection and maintenance in particular on any risks associated with each
regimes, systems to limit the imposed loads applied design that could have an adverse impact on the
to weak floors, etc.) to control any risks that remain robustness of the main structure.
in the design. – Provide advice on any measures that may be used
– Communicate the residual risks to others (e.g. to reduce any risks found to be intolerable and the
building occupants) who may be affected by the implications of any proposed risk reduction
risks that remain in the design, so that they may measures upon each design.
identify and implement procedures to control their
risks which are appropriate to their operations. Other design team members/external stakeholders
– Provide input to the systematic risk assessment on
Structural engineer (designer) any risks within each individual’s area of expertise,
– Ensure the author of the systematic risk and on any measures that may be used to reduce
assessment possesses suitable qualification and any risks found to be intolerable.
experience (SQEP). Where this is not the case,
engage individuals who do have suitable Building control authority
qualification and experience. A single structural – Provide input to the structural engineer on the level
engineer should take overall responsibility for the of risk that the building control authority would
systematic risk assessment and will be the consider tolerable in the design, and any specific
named author of it, but the risk assessment will hazards about which the building control authority
have contributions from several individuals to has particular concern or specific expectations.
provide a wide range of expertise. SQEPness – Once prepared by the structural engineer, evaluate
should normally be demonstrated through the systematic risk assessment and its findings in
substantial previous experience in the design of terms of compliance of the design with the relevant
similar high-risk buildings, with experience in building regulations.
design against extreme hazards being
advantageous. CDM coordinator/risk management specialist
– Develop the structural design philosophy and the – May act as the chair for the hazard identification
approach to design against disproportionate and risk assessment workshop.
collapse to be adopted in the design of the – As an external and independent specialist
structure, and agree this with the client. experienced in risk assessment and not directly
– Review the normal design criteria and ensure their involved in the design, provide input into the
appropriateness for developing a safe structural identification of hazards and assessment of risks as
design. required by the structural engineer.
– Evaluate the tolerable risk threshold, based on the – Review coordination and information flow between
minimum level of risk reduction necessary to designers and ensure that no gaps exist between
achieve a safe design and any client requirement different designers’ responsibilities. This can be
for additional risk reduction to achieve an enhanced particularly relevant when some designers (e.g.
level of performance. temporary works designers or contractors’
– Seek advice from the relevant building control designers) are not appointed at the early stages of
authority on their expectations for the systematic a project when the risk assessment is first
risk assessment. prepared.

16 The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse

– CDM coordinator: as the duty holder responsible
for the preparation of the health and safety file,
ensure information is adequately provided by all
designers on residual risks in the design, including
properly developed proposals that allow the risk
owner to control the residual risks, for example
through inspection and maintenance regimes.
3.2 Step 1: Identify the hazards
3.2.1 Identification of hazards
At the outset of the design, it is recommended that
the structural engineer should document the
proposed structural design philosophy and the
approach to design against disproportionate collapse
and agree this with the client. This will be a live
document that will be updated throughout the
project. The purpose of preparing this prior to starting
the systematic risk assessment is to establish some
principles and consensus about items such as:
– the basis of design
– the assumptions that will be made in the analysis
and design, particularly any simplifying
assumptions
– the basic approach envisaged for design against
disproportionate collapse.
The identification of the hazards is often best done
through a hazard identification and risk assessment
workshop. A workshop, which might usefully be
chaired by a person with specialist expertise in risk
identification such as a CDM coordinator or a HAZOP
chairman, will often lead to a greater flow of ideas
than a desktop exercise. In some cases, particularly
in buildings where hazards are less readily identified,
a formal HAZOP will be prudent (refer to guidance
from the Chemical Industries Association3.1, the
Health and Safety Laboratory3.2 and Kletz3.3).
The structural engineer should give careful
consideration to who should be involved in the
hazard identification and risk assessment workshop.
As well as considering whether to have a CDM
coordinator or HAZOP chairman leading the
workshop, ensure that different designers (e.g.
temporary works designers, contractors’ designers)
are represented. The client should be involved. The
architect, geotechnical engineers, fire engineers, blast
engineers, transport engineers and external
stakeholders (such as emergency responders and
counter-terrorist security advisers) should be involved
where relevant.
Temporary works designers and contractors’
designers may not be appointed, so provision needs
to be made to ensure they are able to prepare a safe
design which does not compromise the robustness
of the main structure, and to ensure that the limits on
their subsequent design are properly communicated
through their appointment. If a contractor is not
appointed to provide pre-construction advice through
a pre-construction services agreement, consideration
should be given to an appointment which permits
contractor participation in the hazard identification
and risk reduction workshop and support of the
subsequent risk assessment process. Facilities
management should also be represented at some
point in the process to consider proposed inspection
and maintenance regimes.
The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse
Development of a systematic risk assessment 3.2
Some of the hazards that a systematic risk
assessment might typically need to consider in the
design of a building against disproportionate collapse
are listed in Table 3.3. This is best used as a list of
prompts to think about the hazards to which a
building might reasonably be subjected. It is
intentionally incomplete: the structural engineer is
responsible for ensuring that all reasonably
foreseeable hazards with the potential to cause harm
are identified, and must ensure suitable qualification
and experience is available to do so. The
identification of hazards will be a team effort,
coordinated by the structural engineer. In some cases
it may involve specialists being brought into the
design team to provide advice in specialist design
fields such as fire engineering and blast engineering
or pre-construction advice.
Hazards are best identified by approaching the
design from several different angles (Figure 3.3):
– by the nature of the design (e.g. whether innovative,
complex or unusual) and by reference to what has
gone before (including past failures and the lessons
learned)
– by the type of action (e.g. environmental, imposed)
– by the nature of the action (whether normal or
abnormal; or whether natural, accidental or
malicious)
– by the origin of the hazard (from the structure itself,
external to/independent of the structure, deriving
from the use/maintenance of the structure or owing
to procedures surrounding the design, construction
or use of the building)
– by the state of construction: during construction
(including specific states at the different stages of
construction e.g. due to lack of stability,
overloading, lack of fit, the occurrence of specific
significant hazards or governing loads, or
unforeseen loading conditions), during the building’s
operation and maintenance, due to deterioration or
lack of maintenance, or during demolition
– by part or section of the structure (substructure,
braced frames, sway frames, stability system;
original construction, extension, alteration; transfer
structures, long spans, connection details)
– by what has the potential to go wrong, be ignored,
overlooked or misinterpreted (e.g. due to lack of
knowledge, failings in communication, the cutting of
corners).
Nature of Type of
the design action
What has the Nature of
potential the action
to go wrong Identification
of hazards
Part/section of Origin of
the structure the hazard
State of
construction
Figure 3.3 Approaches to the successful identification of
hazards
17
3.2 Development of a systematic risk assessment

Table 3.3 Examples of hazards

Design and construction
– Analysis or calculation error
– Uncertainty in the applied loads, and unrecognised effects of variation in the applied load
– Unrecognised action (e.g. sensitivity to vibration or to a single dominant action)
– Unrecognised structural behaviour/structural response
– Factors customarily ignored in design of smaller buildings (e.g. wind-induced dynamic oscillation, verticality tolerances, elastic
shortening, P-
effects, soil-structure interaction)
– Unrecognised material behaviour (e.g. lack of knowledge about new materials)
– Unrecognised sensitivity to design assumptions
– Unrecognised uncertainty in analysis
– Unrecognised load paths, i.e. stress distribution not as predicted in analysis (e.g. due to indeterminate nature of structure,
failure to consider changes in stress distribution due to second-order (P-
) effects or movement/structural deformation
elsewhere in the structure)
– Lack of stability
– Detailing error or the failure to appreciate the detailing requirements for the structure
– Failure to communicate the design intent
– Material defects
– Gross construction error (e.g. omission of reinforcement, dimensional error, installation of precast slabs upside-down)
– Unauthorised design change
– Susceptibility of design to inadequate temporary works
Robustness during construction (or demolition/alteration)a
– Construction method statement inconsistent with design intent or not competently developed
– Effect of dropped object (e.g. wet concrete load)
– Loading in partially-constructed condition or condition of partial strength
– Incomplete stability system
– Lack of stability during demolition
Permanent, imposed and environmental actions
– Wind, snow, ice accretion, rainwater ponding, flooding
– Excessive loading (whether floor loading due to material stacking or imposed loading due to the malfunction or misuse of plant,
e.g. overhead craneage)
– Earthquake
– Fire
– Structural deformation/movement
– Subsidence/ground movement
– Groundwater level change (sensitivity to groundwater, upward pressure, buoyancy)
– Influence of groundwater change on foundation/ground loadbearing capacity
– Scour, undermining of foundations
– Dynamic effects (e.g. vibration)
– Fatigue
– Material degradation, (lack of) durability, corrosion, rot
– Component failure due to fatigue/durability/corrosion/rot, particularly the hidden failure of uninspectable components
Accidental actions
– Vehicle impact
– Fire
– Gas explosion
– Aircraft impact
– Events consequent on plant malfunction
– Dropped objects (in plant)
Malicious actions
– Malevolent vandalism/arson/theft
– Terrorist attack

18 The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse
 Development of a systematic risk assessment 3.2

Table 3.3 Continued

From use/maintenance
– Overloading
– Fatigue
– Corrosion
– Failure to design for inspection and maintenance
– Failure to implement maintenance and inspection regimes
– Unauthorised alteration
– Deterioration
From procedural failings
– Competence to carry out the risk assessment
– Poor definition of design brief
– Failures in coordination and project interfaces
– Failings associated with division of contractual responsibility
– Lack of design supervision during construction
– Lack of good change management
– Lack of competence in design or construction
– Failings in procurement (e.g. insufficient time/resources)
– Poor design or construction supervision
– Sub-standard specifications or quality of construction
– Poor communication of information (e.g. poor quality management procedures)
– Lack of quality assurance and quality control procedures
– Sub-standard components (e.g. due to counterfeiting of quality control markings/certification)

Note
a Risks during construction, alteration or demolition must be considered under the CDM Regulations but do not fall under the
Building Regulations. Determining the need for robustness in a temporary condition would normally fall under the duties of the
relevant contractor except if some sort of accidental damage would have a disproportionate effect, such as on an urban site or
an air rights building where the consequences might spread beyond the site itself.

Approaching the design from different angles is
advantageous on the basis that several attempts to
identify the hazards affecting the design are better
than one. It will lead to repetition, but will also help
identify some hazards that had been missed through
the earlier approaches. Designers tend to think first of
the technical things that could go wrong – a car
crashing into a column, a sustained fire, a fatigue-
induced failure. However, this is often at the expense
of the procedural failings which are often much more
important factors in the actual level of risk to which
the design is exposed.
It must be recognised that hazards are not merely
technical but also procedural. An error in design is rarely
the sole cause of the collapse. Almost without
exception it will be accompanied by errors in the
communication of the design, errors in the construction,
failures in the quality assurance and quality control
procedures for the design and construction, failure to
stay within the limits of the defined usage for which the
building has been designed, malfunction of mechanical
plant or machinery, unauthorised alteration of the
building, and so on.
Human error is persistent and invidious. People
make mistakes, take short-cuts, are put in a role
they are not qualified to undertake, fail to carry out
effective checks, fail to ensure they are understood,
fail to understand what others have done, and fail to
ensure design interfaces are defined and controlled
(‘I thought someone else was doing that’). Checking
procedures break down, audits fail to detect errors,
safeguards fail to operate, quality management
systems and procedures are circumvented.
Complacency, lack of knowledge, programme and
commercial pressures all play their part in
generating hazards.
Advanced structural analysis tends to persuade us
that we understand the structural behaviour of a
system: a BRE/CIRIA survey of 120 structural failures
found that by far the biggest single reason for failure
is a grossly inadequate understanding of real loadings
and behaviour of the structure3.5.
Study of past failures is simultaneously illuminating and
sobering, and is an essential but under-utilised tool in
the structural engineer’s armoury. Agarwal3.6, Delatte3.7
Levy3.8, Feld3.9, Kaminetzky3.10, Campbell3.11, Kletz3.12
and Mann3.13 contain extensive discussions on lessons
learned from failures.
The importance of identifying and considering all such
procedural (‘soft’) hazards alongside the technical
hazards in a systematic risk assessment cannot be
emphasised too strongly. In some cases procedural
hazards will be considered individually, and in other
cases they will be considered in relation to the effect
they may have upon other hazards that could occur.
3.2.2 Foreseeable and unforeseeable hazards
It is a well-established principle of our codes of
practice that in the design of a structure the designer
must consider all reasonably foreseeable actions
(hazards). However, a detailed consideration of a
particular load action is often deliberately neglected in
conventional design because it is deemed ‘outside
the normal design envelope’.

The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse 19
3.2 Development of a systematic risk assessment

It is, however, foreseeable that loads could be answer lies in Vrouwenvelder3.16, who comments that
higher than designed, or that actions for which the hazards may be unforeseeable due to a lack of
structure is not specifically designed could professional knowledge. Mistakes will always be
materialise, or that the assumptions upon which the made, but the risk of mistakes will be significantly
structure is designed could be invalidated. It is also higher when the body of past experience available to
foreseeable that the structure may not be designers is smaller (Box 3.1). These are the known
constructed according to the design intent, or may unknowns made famous by Plato and latterly by
not be used as designed. It is not only foreseeable Rumsfeld3.18, and discussed in the Blackett review of
that mistakes could be made in the construction high impact low probability risks for UK
but is also foreseeable that the structural engineer Government3.19.
could themselves have made an error which goes
undetected3.14, 3.15. Could the problems have been foreseen, for example,
with high-alumina cement (HAC) that led to the
In addition to foreseeable hazards, BS EN 1991-1-73.4 collapses at Camden School for Girls and the Sir
explicitly requires the consideration of unforeseeable John Cass Secondary School in the 1970s (Box 3.2)?
hazards. At first this appears paradoxical – if a hazard Probably – certainly what was widely known was that
is unforeseeable, how can it be considered? The the body of knowledge related to high-alumina

Box 3.1 Emley Moor, 19 March 1969

In 1969, the 385m guyed tubular steel mast collapsed due to wind-induced dynamic oscillation caused by vortex shedding and the
asymmetric loading of ice on the mast and the stays3.17. The TV transmission mast had been constructed three years earlier, and
at the time was one of the tallest structures in the world. It was constructed from curved steel segments to form a 2.75m diameter
tubular mast 275m high, topped by a 107m high lattice section. The cylindrical steel mast regularly became coated in ice during
the winter months and ice also formed in large icicles on the guy cables, which passed over several roads. Thawing ice caused a
falling icicle hazard, and warning lights were placed on the tower which were used in thawing conditions, with notices on the roads
near the guy cable crossings. Roads were closed when hazards were severe. The designers had assumed that excessive deposits
of ice would crack and fall away in the wind and would limit the load on the guy cables and the mast, but at the time of the
collapse this did not happen. The collapse initiated in the fracture of a flange under the low but steady-state wind speed which
induced vortex shedding and a cyclic load on the flange. As the mast collapsed, one of the guy cables sliced through the roof and
walls of a chapel at the base of the tower.
In the court case following the collapse, the designers argued that the deficiencies in the design were unforeseeable, because the
hazard was beyond the bounds of professional knowledge. The principle in UK law regarding innovation and technological advancement
is that if the results of the innovation are unsuccessful and cause loss or damage, then as the risk of such an event occurring is high
it is only just that it should be borne by those benefitting, provided they were given the opportunity to decide for themselves whether or
not the innovation should be pursued. Yet the House of Lords found against the designers and contractors, ruling that the owner had
not been informed of the risks associated with the features of the design. Modifications were made to similar masts at Belmont and
Winter Hill, including the hanging of 150 tons of steel chains within each structure to give additional damping.

Box 3.2 Camden School for Girls assembly hall, 1973 and Sir John Cass Secondary School swimming pool, 1974
Roofs constructed and designed with prestressed concrete beams using high-alumina cement (HAC) collapsed at Camden School
for Girls and the Sir John Cass Secondary School in Stepney in 1973 and 1974 respectively. High-alumina cement had enjoyed a
rapid rise in popularity due to its rapid hydration and early strength compared with Portland cement, giving faster and more
economic construction. Unfortunately it was not widely recognised that the calcium aluminates in the cement were unstable and
undergo a spontaneous chemical conversion, which is accompanied by a decrease in strength, an increase in porosity and therefore
an increase in susceptibility to sulphate and alkali attack. The chemical conversion is accelerated by increased temperature and
humidity, and is highly sensitive to the water/cement ratio of the concrete. Both roof structures failed spontaneously, in-service – in
Camden the roof was 18 years old at the time of the collapse which happened to occur after school hours, while at the Sir John
Cass school the roof was eight years old and a swimming class was using the pool until moments before the collapse.

20 The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse

cement was considerably smaller than that for
Portland cement. Earlier failures had occurred: one in
1962 at Sheephouses reservoir3.20, 3.21, while several
collapses had occurred abroad – several agricultural
sheds, each less than eight years old, suddenly
collapsed in Bavaria in 1961 in similar climatic
conditions to those in the UK. The chemical
conversion and associated progressive loss of
strength was discussed as early as 19493.22-3.24 and
the occurrence of failures was predicted, while a
substantial increase in porosity of HAC was reported
by the Institution of Structural Engineers in 19643.25.
Greater caution could have and arguably should have
been applied noting the relatively unknown nature of
the material.
Greater caution should be taken through the
reduction in the tolerable risk threshold or judicious
increase in partial factors when working with new
materials, manufacturing processes, unique or
unusual structural schemes. This reflects the
increased risk of unwittingly overstepping some
bound in the design approach or the manifestation of
previously unrecognised phenomena3.26.
The Royal Commission into the collapse of the West
Gate Bridge3.27 found that ‘‘. . . when leading
designers are working as pioneers, and only just
within the bounds of the engineer’s knowledge, some
slight misjudgement, or failure to appreciate every
aspect of a new problem may prove disastrous and
bring tragic and fatal results. Under these conditions,
it is more than ever essential to employ really
adequate margins of safety and to ensure that they
are not eroded by various unexpected and accidental
factors, including of course, imponderables and
human fallibility.’’
A key plank in protection against unforeseeable
events is a scenario-independent design approach
(Section 3.6), in which the building is designed to
withstand the loss of any given loadbearing
element. If the building can sustain a degree of
damage irrespective of the cause, it is immaterial
that a particular hazard is unforeseeable because
the structure is less sensitive to damage. It is
primarily for this reason that the scenario-
independent design approach is so important in
designing for robustness, because it ensures focus
is placed on designing for a safe mode of failure,
rather than merely considering the behaviour under
a given set of loads.
The continuous advancement of the state of
knowledge is one pitfall for the unwary structural
engineer working on the design of a high-risk
building; a second is working outside one’s area of
competence. In preparing the systematic risk
assessment, it is to be expected that competence
does not reside wholly within one person. In
particular, in identifying the hazards and
understanding the state of practice in response to
particular hazards, recourse will often need to be
made to other specialists within the design team for
geotechnical engineering, fire engineering, evacuation
modelling, traffic modelling and blast engineering
advice. Recourse may also be needed to external
advisers for advice on the likelihood and nature of
malicious threats and the performance criteria for
which a particular asset should be designed.
Unforeseeable hazards are not the same as
unforeseen hazards, which implies the failure to
The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse
Development of a systematic risk assessment 3.2
properly identify them. In law this is no defence: the
structural engineer holds a responsibility to ensure
that they are suitably equipped to advise the client on
the hazards which are reasonably foreseeable.
Evaluation of potential actions is not merely based on
the systematic modelling of a defined set of actions:
the structural engineer is expected to remain abreast
of the state of practice and must ensure that
modelling, analysis and design is consistent with
contemporary good practice. This may be through
being conversant with the causes of recent near-
misses and structural failures from which much can
be learned. These are reported by bodies such as
Structural-Safety3.28 (incorporating the Standing
Committee on Structural Safety (SCOSS) and the
system of Confidential Reporting on Structural Safety
(CROSS)), but there is much that can be learned from
failures beyond the immediately applicable3.13.
Learning can also come through being conversant
with research literature on advances in the
understanding of structural phenomena, material
behaviour and mechanisms of failure. It is expected
that the structural engineer designing a high-risk
building will be conversant with mechanisms and
behaviours that might not have previously been
considered in an otherwise similar design.
3.2.3 Cliff edge effects
In the Gloucestershire floods in 2007, river flows on
the Teme and Avon were the highest ever recorded;
river levels in the city reaching 4.92m. This was only
1cm lower than the highest recorded level in the
1947 floods due to flood protection works that had
been carried out on the Gloucester floodplain.
The probability of occurrence of the flood was
calculated as 0.5% per year, i.e. a 1 in 200 year
event. Overtopping of the perimeter wall of the main
electrical switching station was only prevented due
to the installation of temporary flood barriers by the
armed forces and emergency pumping, and the
floodwaters came within 5cm of overtopping the
wall. So while the consequences were already
extremely serious, had the flood event been just
slightly rarer or the flood waters slightly higher, the
consequences would have been much worse had
electrical power been lost that the event dominates
the overall risk profile, and all because of the simple
choice about the height of construction of a
reinforced concrete wall.
The underlying flaw in the design of the substation is
that it might have been designed for a 1 in ‘n’ year
event, but that at a 1 in ‘n þ 1’ year event the
likelihood was correspondingly marginally lower but
the consequences substantially greater, meaning the
overall level of risk was also substantially greater. This
is symptomatic of low likelihood/high consequence
risks – because the consequences can exhibit this
cliff edge, such risks can dominate the overall risk
profile.
The parallels in structural design are clear: in the
design of a structural element which is critical to the
stability of the structure lacking redundancy through
alternate load paths, any cliff edges in the structural
behaviour must not be sufficiently close to the
expected structural response to compromise the
basis of the robustness design (Box 3.3).
Further examples of cliff edges are given in
Section 3.10.2.
21
3.2 Development of a systematic risk assessment

Box 3.3 Cliff edge effects – Paris Charles de Gaulle Terminal 2E collapse, 2004
On 23 May 2004, a 30m section of the 650m long elliptical vaulted roof in Terminal 2E at the Charles de Gaulle Airport collapsed,
killing four people. The collapse occurred less than two and a half years since construction was completed, and less than a year
since the terminal opened. The roof structure consisted of external elliptical steel trusses acting compositely with a 300mm precast
concrete shell on the interior.
The official investigation3.29 found that the steel dowels supporting the concrete shells were too deeply embedded into the shells,
which caused cracking in the concrete that in turn led to a weakening of the roof, decreasing the stability of the structure. This also
increased the spreading forces at the springing points of the arch. The concrete blocks were also found to have been poorly
reinforced, meaning that the stresses flowed to the weakest points of the elliptical structure. The arches were supported on parallel
reinforced concrete longitudinal edge beams, supported by slim rectangular columns. The tendency for the superstructure to spread
under load was contained by steel stirrups tied around the column head and bolted to the longitudinal beam, though it is thought
that these were added after the construction had started on site. During construction, repairs were made to the supporting columns
after cracks appeared – a forewarning of the collapse.
The cause of the collapse was found to be long-term concrete creep, exacerbated by the rapid thermal expansion/contraction of the
structure. The temperature dropped from 258C a week before the collapse to 48C, on the morning of the collapse. The differential
thermal movement between the steel truss and the concrete panel acted to exacerbate the cracking due to concrete creep, critically
weakening the highly-stressed concrete.
The report concluded that the edge beam supporting the arches fractured, causing the loss of the springing point of the arch and
the collapse of the roof. In this the design was literally a cliff edge: the lack of redundancy in the arch meant that collapse across
the full width of the terminal was inevitable, and this led to the collapse of the entire length of the structure between expansion
joints. If the structure had been continuous across the expansion joints, it seems unlikely that the forces that occurred during
collapse could have been supported by the adjacent sections and a progressive collapse through the length of the structure could
have been possible.
The cliff edge, a shear-critical design, violates the safe design theorem (see Hambly’s paradox in Box 3.9). It fails to consider whether
the structural component has the strength to transmit its calculated force, the ductility to retain its strength while deforming, and
sufficient stiffness to keep deflections small and to avoid the onset of a local instability before design loads are reached.
The report of the investigation also questions the existence of proper design and construction processes and technical controls on a
project where owner, project manager and architect were essentially the same. The state-owned airport company not only designed
the building but managed the construction, virtually eliminating the distinction between design team and client. This again
emphasises the need for independent peer review, robust analysis and greater redundancy, particularly in unique structures: Leslie
Robertson, the structural engineer responsible for the design of the World Trade Center, commented in an interview to the New York
Times that ‘‘when problems occur, it is usually in the interface’’ between architects, engineers and contractors – ‘‘seldom can one
say with any certainty, ‘That’s it, that right there is where the trouble happened.’’’3.30

3.2.4 Low likelihood/high consequence hazards disproportionately greater extents of damage

(Box 3.4). It may also be for some other reason
Low likelihood/high consequence hazards can associated with the structure’s function, for
dominate the risk spectrum because, despite the example a building which serves a safety-critical
small likelihood of the hazard materialising, the function, the failure of which in a seismic event
consequences should it do so are so severe that could lead to a significant radiological release. This
the magnitude of the risk is much larger than is a prime example of a low likelihood/high
anything for which the structure has been consequence event: though seismic activity in the
designed (Figure 3.4). This may be because the United Kingdom is rare, design against a 1 in
magnitude of the hazard is such that a cliff edge is 10000 year earthquake is commonplace in the
encountered, which is beyond the normal design nuclear industry because of the significance of the
basis but when exceeded results in a consequences should the hazard materialise.

22 The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse
 Development of a systematic risk assessment 3.2

× =

Likelihood Consequence Risk Abnormal action but within the design basis

× =

Likelihood Consequence Risk Accidential action outside the design basis

× =

Likelihood Consequence Risk Low likelihood/high consequence event

Figure 3.4 Risk arising from low likelihood/high consequence events

Box 3.4 Low likelihood/high consequence hazards – Eschede train disaster, 1998
On 3 June 1998, the growth of a fatigue crack in the steel tyre of an intercity express train from Munich to Hamburg caused the
sudden failure of the tyre, which embedded in the floor of the train car3.31. As the train travelled over two sets of points outside
Eschede, the embedded tyre caught in the guide rail of the points, switching them and causing the derailment of the rear ten
coaches of the train. The derailed coaches impacted the central support of a reinforced concrete overbridge, causing the
catastrophic collapse of the bridge onto the train and 101 fatalities.
Shortcomings were found in the design of the wheel, which was a dual bloc design to minimise noise and vibration, comprising a
wheel body surrounded by a rubber damper and a relatively thin steel tyre. Specifically, the following were not considered in the
design:
– the flexure of the tyres on the soft rubber damper with each revolution of the wheel and the corresponding fatigue effects due to
the oscillating load
– the potential for crack growth to initiate on the inside of the tyre
– as the tyre wears and the thickness reduces, the increase in dynamic forces and their exacerbation of crack growth
– the exacerbation of dynamic forces and consequential acceleration of wear due to low or high spots on the tyre.
Despite these failings and the failure of the train operator to take heed of warning signs prior to the accident, the likelihood of the
impact of the train onto the bridge would have been calculated as exceptionally low, because of the condition for the failure of the
tyre and the derailment to occur precisely when they did. Nevertheless the consequences, given that the hazard materialised, were
catastrophic, and the intrinsic risk therefore substantial.

Because of the tendency for low likelihood/high 3.2.5 Combined hazards

consequence events to dominate the risk spectrum,
it is necessary to be cognisant of their possibility
when identifying the hazards and ensure they are
incorporated in the risk assessment. If the
consequences are so severe as to be intolerable
should the hazard materialise, a deterministic design
approach will be required whereby the structure is
designed against the worst-case event. A
deterministic approach is employed in the nuclear
industry for events which could give rise to a major
radiological release.
The Blackett review prepared for UK Government,
while focussed at a national level, provides useful
background on this topic3.19.
There is no need to consider multiple hazards where
they are statistically independent. If the building is
properly designed to withstand the sudden loss of a
column due to vehicle impact such that the building
can then be safely evacuated, there is normally no
need to design it to then withstand the loads
associated with a further abnormal load in its
damaged condition. In the damaged condition the
building need only be designed to remain stable and
to support the minimum dead and imposed loads
required by the relevant code of practice (unless
more onerous client requirements exist such as
requiring the building to retain some greater
function).

The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse 23
3.2 Development of a systematic risk assessment

There are, however, a number of adverse events
which have a high likelihood of causing a secondary
event that is not statistically independent, and should
therefore be considered in combination
(consequential hazards). Many of these consequential
hazards involve fire (Box 3.5), for example an
incendiary fire following an earthquake or explosion
due to the fracture of a gas main, leak of fuel or the
ignition of combustible materials. It is necessary to
assess the potential consequences of an adverse
event and properly consider where combined
hazards need to be considered. Again, a HAZOP is
often the best vehicle for properly considering
consequential hazards.
Box 3.5 World Trade Center, 11 September 2001
The Twin Towers were designed in the mid-1960s, and were
designed to withstand the accidental impact of a Boeing 707
aircraft. In 1945, a B-25 bomber had crashed into the
79th floor of the Empire State Building after becoming lost in
fog while trying to land. The design of One and Two World
Trade Center assumed an impact would be during the aircraft
descent to land, and therefore at relatively low speed and
relatively low on fuel. It did not consider a higher-velocity or
more massive impact, or the effect of a subsequent fuel
fire3.32, 3.33.
Nevertheless, the substantial structural robustness in the
design of the Twin Towers meant that when deliberately
impacted by a much larger aircraft, a Boeing 767 (flying at
similar speed to that considered in design but a heavier
aircraft, in addition to the mass of a full fuel load comprising
nearly an additional one-third of the aircraft’s weight), the
design of the towers exhibited a remarkable degree of
robustness. They were able to sustain the loss of a significant
number of perimeter columns over several floors of the
building, yet redistribute these loads and remain standing
under the ensuing fire for nearly 60 minutes after the attack.
While the consideration of fire following impact was not
common practice in the 1960s or for several decades
thereafter, the combined hazard of a sustained fuel fire
following impact is now only too foreseeable in the design of
such buildings.
3.2.6 Human error
Human error is perhaps the most difficult type of
hazard to spot. Kletz has written extensively on the
subject of human error3.12 and outlines five types of
human error which are a useful aid in identifying the
types of errors that can arise in each phase – design,
construction, operation and maintenance:
– errors due to a slip or momentary lapse of attention
– errors due to poor training or instructions, i.e.
through ignorance or for wont of knowing any
better
– errors due to a lack of physical or mental ability
– errors due to a lack of motivation, or to a
deliberate decision not to follow instructions or
expectations
– errors made by managers, often due to a lack of
appreciation of the part they should or could play.
Kletz developed the technique known as HAZard and
OPerability studies (HAZOP) aimed at identifying
hazards associated with both technical and human
fallibility. While developed for the process industry3.3,
it is equally applicable across the engineering
profession. It is recommended in this Manual for the
design of those structures for which hazards are less
easily identified, including where human error has the
potential to be a significant factor in the generation of
hazards or the control of risks through procedural
measures.
3.2.7 Malicious hazards
Malicious hazards should be considered in the design
of a building when the hazard is reasonably
foreseeable. The judgement about what to consider
is necessarily subjective, but when the consequences
of an attack could be disproportionate – for example
the theft of copper cables or lead roof cladding, the
malevolent vandalism of a railway bridge or the
cutting of the stay cables on a cable-stayed bridge –
it is clear that they should be considered (Box 3.6).
Box 3.6 Mersey Valley Footbridge, 4 January
2007
The Mersey Valley and Sale Water Park footbridges are two
cable-stayed footbridges over the M60 in Manchester, each
with a solid abutment and A-frame supported by a 28m back
span on one side of the motorway, with stay cables
supporting the 74m main span. Each bridge has 20 stay
cables, of which half anchor the A-frame to the back span
and the remaining ten (five on each side) support the main
span. On 4 January 2007, a member of the public alerted
police to damage of the stay cables supporting the
Manchester Valley footbridge. Four stay cables had been
found to have been severely damaged with high tensile wire
strands being severed, and broken hacksaw blades were
found nearby. Subsequently protective sleeves were fitted
over the cables on both bridges to prevent direct access to
the cables.
Similarly, when the likelihood of a terrorist attack is
non-negligible, consideration should be given to
terrorist threats. At a high level, the judgement about
what to design for is most readily determined by
considering the criticality and vulnerability of the
asset. The asset may be critical either to the asset
owner or to a third party. Criticality may be
considered in terms of consequences such as the
economic cost of downtime or asset reinstatement,
the loss of human life in the event of failure, or the
iconic importance of an asset. Vulnerability expresses
the fragility of the asset, i.e. how close it is to failing. If
an asset is both critical and vulnerable, this is a
strong indicator that the designer should consider
terrorism in the risk assessment. A specialist threat,
risk and vulnerability assessment (TRVA) is usually
necessary to evaluate the risk due to terrorism.
Guidance on malicious hazards and vulnerability of
structures to such hazards should be sought from
the UK Centre for the Protection of National
Infrastructure3.34 or from a member of the Register of
Security Engineers and Specialists3.35, or the
equivalent resources in the project’s local jurisdiction.
3.2.8 What to include
A systematic risk assessment should include all
reasonably foreseeable hazards (notwithstanding that
Eurocodes refer to unforeseeable hazards). The
emphasis is on reasonably foreseeable, i.e. hazards
for which the risk is not so vanishingly small that there
would be no design impact.
Consequently the systematic risk assessment should
include natural ‘perils’ such as earthquake,

24 The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse
 Development of a systematic risk assessment 3.3

windstorm, fire, flood, rainwater ponding, adverse
snow loading, and ice accretion, where relevant. Risk
assessments have been prepared which include
‘volcano eruption’ amongst the structural hazards, for
buildings in no proximity even to a dormant volcano.
Similarly, tsunami would only be relevant in the
coastal region of a tsunami-prone area such as the
Pacific Rim or the Indian Ocean. However, sea level
rise due to climate change, in combination with the
storm surge due to the coincidence of a deep
meteorological depression, spring tides and adverse
winds, should be considered where the overtopping
of flood protection would have structural
consequences. Similarly, it might be valuable to have
determined that the extreme wind load is not that
much larger than the 1 in 50 year load, and that the
structure is insensitive to this change. Hazards from
adjacent or nearby sites (e.g. industrial hazards) are
more difficult to evaluate but should be included.
Information should be available from the site owner or
operator.
The systematic risk assessment should also include
man-made accidental and malicious hazards. This will
include hazards such as accidental impact and
malicious hazards such malevolent vandalism and
terrorism.
by equally high-rise or higher-rise buildings. However,
for buildings on the margins of a high-rise area or for
buildings which exceed the height of the surrounding
buildings, past events show that aircraft impact is a
credible risk, particularly of light aircraft due to pilot
error (Box 3.7). Most observers would accept that
collapse resulting from the impact of a heavy
passenger or cargo aircraft would not be
disproportionate, but collapse would not be expected
to result from the impact of a light aircraft (including
post-impact fire).
Box 3.7 Light aircraft crash, New York City,
11 October 2006
On 11 October 2006, a two-seater fixed-wing single-engine
aircraft crashed into the 30th floor of an apartment block on
the Upper East Side of Manhattan while attempting to
execute a 180 degree banked turn above the East River.
The National Transportation Safety Board determined that
pilot error was the cause of the crash, the bank angle being
insufficient to execute a 180 degree turn within the
available width; this being further reduced due to 13 knot
crosswinds. The crash killed both occupants of the aircraft
and caused a post-impact fire and 21 injuries,
predominantly burns.

Design issues customarily ignored in design of

smaller buildings such as wind-induced dynamic
oscillation, verticality tolerances, elastic shortening,
P-
effects and soil-structure interaction should also
be considered. In a low seismic zone, the engineer
should assess whether there is any need to consider
the seismic response. It is standard practice in the
UK to consider seismic loading in the design of the
following: safety-critical systems; buildings performing
a safety-critical function in nuclear power stations and
other facilities handling nuclear materials; and
offshore platforms.
3.2.9 What to exclude
The systematic risk assessment need not consider
hazards that are so unlikely that they have no design
relevance. Accidental aircraft impact, for example,
would not be considered for low or medium-rise
buildings except for the most critical installations such
as nuclear containment structures or military
installations. Even for high-rise buildings, accidental
aircraft impact would not normally be considered if
the building is part of a wider cityscape surrounded
3.3 Step 2: Eliminate the hazards
While it is often stated that it is not possible to
eliminate risk, it is possible to eliminate some hazards
through design, and of course the designer has a
statutory duty to do so. The opportunity to eliminate
hazards is highest at the earliest stages of design
when the structural form has not been defined and
can be developed taking into account the hazards
that exist and the magnitude of the risks. Box 3.8
illustrates an example of where relatively cost-effective
measures would almost entirely eliminate a risk from
a design.
If done correctly, the elimination of hazards might
produce other benefits: the careful design of a
structure, for example, such that the penetration of
water or ponding of rainwater in crevices cannot
occur might eliminate, or at least mitigate, the risks
associated with hidden corrosion. Hence, designing

Box 3.8 Great Heck rail crash, 2001

In the Great Heck rail crash near Selby, North Yorkshire, a passenger train crashed into a stationary vehicle on the East Coast
Main Line that had left the carriageway of the M62 motorway above and run down the embankment onto the railway track. The
train remained upright but continued into the path of an oncoming freight train, killing 10 people including the drivers of both
trains.
The number of bridges where roads pass over railways make it almost inevitable that, at some point, an errant vehicle would leave
the carriageway at just the wrong point to clear the crash barrier and end up on the railway track. Given that trains pass every
few minutes on most major rail lines, it would be almost inevitable that, if this occurred, insufficient time would exist to raise the
alarm, assuming the driver survives the accident (which at Great Heck, he did, and had managed to raise the alarm by calling
the emergency services but not in sufficient time for action to be taken to avert the crash). A crash barrier was in place
alongside the road carriageway, though the vehicle left the motorway some 24 metres before the barrier started.
Through the design of the alignment of the road carriageway and the crash barriers, it is feasible to almost entirely eliminate the
risk, through lengthening of the crash barrier and its design to withstand an errant vehicle impact; landscaping of the embankment;
or the construction of a robust wall that prevents a road vehicle penetrating the containment or evading the end of it3.36. Highways
Agency standards were revised following the disaster to improve the effectiveness of crash barriers, although accidents in similar
circumstances continue to occur3.37.

The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse 25
3.4 Development of a systematic risk assessment

out the hazard – eliminating the hazard from the further than the immediately adjacent storeys3.4.
design – results in a both a safer and a more Taking into account the accidental nature of the
cost-effective solution than having to reduce the risk events to which this relates implies that this might be
arising from it through design measures or through deemed tolerable for events with up to, say, a 2%
operational maintenance and inspection. probability of occurring once during the lifetime of the
building. This guidance is given in the context of
typical forms of construction and accidental
loadcases, and BS EN 1991-1-7 Annex A notes that
the extents of damage considered to be
3.4 Step 3: Determine the tolerable risk disproportionate may vary between different types of
threshold building.

The tolerable risk threshold describes a line drawn

The determination of the threshold of tolerable risk across the matrix which gives an extent of collapse
cannot be abstracted from the hazards being for any given likelihood, as indicated in Figure 3.2.
considered in the risk assessment, since the type of The consequences that would be considered to be
damage will differ according to each hazard. disproportionate in the case of an action categorised
However, the structural engineer should determine as ‘accidental’ can be a useful starting point in
what would be considered intolerable in different constructing the tolerable risk threshold. For more
circumstances prior to, and therefore independent frequent accidental actions or malevolent vandalism,
from, calculation of the risks associated with each minor or no damage would be tolerable; while a
hazard. Guidance on the determination of the level of greater extent of collapse and a correspondingly
tolerable risk is available, inter alia, from higher number of fatalities or injuries may be deemed
Ellingwood3.38 and Hambly3.39. tolerable for terrorism or very rare accidental events.
The tolerable threshold for a particular risk may
It is for the structural engineer, as the author of the sometimes differ because it is considered either more
systematic risk assessment, to determine the risk or less tolerable than the norm: see Chapter 5 for an
reduction measures necessary to satisfy life safety example.
requirements, and then to assist the client
determine whether this level of damage is tolerable Attention should be given to the fact that in the
in relation to the client’s risk appetite or any example risk matrix in Figure 3.2, the tolerability
requirements for an enhanced level of performance. threshold is skewed so that the consequence is given
However, while the engineer can advise the client greater weight as the likelihood reduces, at least up
on this and advice will be sought (and approval to ‘rare’ events. This societal aversion to risk – the
gained) from the building control authority, as the innate avoidance of loss in preference to the
eventual owner of residual risks in the design the achievement of some gain – for accidents with high
client also carries a responsibility in determining the consequence is well recognised3.40-3.42, and only
tolerable risk threshold. The tolerable risk threshold tends to diminish beyond a point where the accident
must therefore be agreed with the client, and an would be accepted as a ‘freak accident’ or
initial review by the building control authority prior to something that ‘could not possibly have been
preparing the systematic risk assessment may often foreseen’, i.e. if it is so unlikely as to be towards the
be worthwhile. negligible end of the likelihood scale.

For the reasons described in relation to Figure 3.2, The inclination to point the finger of blame applies
area of collapse is commonly used as a measure of particularly to man-made hazards, but also holds for
consequence, and therefore of proportion or environmental hazards because perception tends to
disproportion. In determining the tolerable threshold it be that the hazard should have been foreseen.
may be useful to consider fatalities, economic loss Perception is often markedly different with the benefit
and asset disruption, but to facilitate the workings of of hindsight, and it is strongly recommended that
the risk assessment area of collapse is used as a decisions about the amount of tolerable damage
measure of consequence. A collapse may be said to should be made by looking at them through a lens of
be proportionate if the area of collapse is sufficiently how the decisions would be judged if the event were
limited when compared with the likelihood of the to actually occur.
hazard that brings about the collapse. For typical
accidental events, the area of collapse in BS EN
1991-1-73.4 and typical occupancy densities
suggests that fewer than, say, five fatalities might be 3.5 Step 4: Evaluate the risk
deemed tolerable.

Practically, the determination of the tolerable risk is As defined in Equation 2.1 (Section 2.2), risk is
usually best undertaken using likelihood as a frame of evaluated as likelihood
consequence. Both likelihood
reference: for a hazard which is expected to have and consequence, and the resulting evaluation of the
greater than a 2% chance of occurring once during magnitude of risk, are usually best described using
the lifetime of the building, how significant an extent qualitative scales. Quantitative risk analysis can be
of collapse would be considered intolerable? How undertaken in some circumstances and, while the
would this vary for more frequent or more infrequent principles remain the same, the details are beyond the
hazards? scope of this Manual; however, information is available
from Vrouwenvelder3.16, Faber3.43, Sørensen3.44,
In current codes of practice, a collapse is typically Izzuddin3.45 and Janssens3.46.
judged as being proportionate provided the area of
floor at risk of collapse does not exceed 15% or In evaluating the consequences of the hazard,
100m2 (whichever is the lesser) of the area of the consider the sensitivity of the design to the underlying
floor area of the affected storey and does not extend assumptions and undertake sensitivity studies where

26 The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse
 Development of a systematic risk assessment 3.5

necessary to identify how the conclusions might

change in response to minor changes in the input
parameters. Consequence

Catastrophic
Substantial
With reference to the risk matrix shown in Figure 3.2

Significant
Minimal
or a suitable alternative developed for the project, plot

Serious

Severe
Minor
the risks arising from each of the hazards identified
(example in Figure 3.5). These are the ‘raw’ or
unmitigated risks. Some could fall above the tolerable

Likelihood
Frequent/common
risk threshold; typically the majority will fall below it
but as discussed in Section 2.4 will still warrant
Likely
further reduction such that the residual risk is as low
as is reasonably practicable.
Unlikely
Sensitivity studies must be undertaken using well-
Rare
founded engineering analysis to evaluate the
sensitivity of the design to the underlying
Improbable
assumptions and the effect that small changes will
have on the consequences calculated for the given
hazard (Box 3.9). Note: the likelihood of an event also
Negligible
potentially exhibits sensitivity but is generally less Note
likely to do so. Each dot plots the risk arising from a particular hazard.

Figure 3.5 Example risk matrix showing the ‘raw’/unmitigated risks arising from the
hazards considered in the design

Box 3.9 Hambly’s paradox

Hambly’s paradox3.47 succinctly demonstrates the importance of studying the sensitivity of analytical results to the underlying
assumptions. The paradox was posed by Edmund Hambly, past President of the Institution of Civil Engineers, and is expressed as
follows3.48.
‘‘A man weighing 600N sits on a three-legged stool. For what basic force should each leg be
designed?’’
There is no catch to this problem – the stool is supposed to be symmetrical, the man sits in the centre of the seat, and so on. The
answer is, of course, that each leg should be designed to carry a force of 200N.
‘‘The same man now sits on a stool with four legs, one at each corner, and again the stool and the
loading are symmetrical. For what force should each leg of the stool now be designed?’’
The answer of 150N is wrong, and this is the point that Hambly wished to drive home.

60kg 60kg

A three-legged stool, one of the few situations that engineers can analyse with certainty;
and a four-legged stool, one of the innumerable that we cannot (after Burland3.49)

A robust, near-rigid stool, standing on a firm, nearly-rigid floor, will rock: three of the legs will be in contact, supporting the weight
of the man, but the fourth will be clear of the floor. Even if this fourth leg is clear by only a fraction of a millimetre, then it is certain
that the force it is carrying is zero. By simple statics, the force in the leg diagonally opposite will also be zero, even if this leg
appears to be in contact with the floor. The weight of the man is in fact supported symmetrically by the other two legs of the stool,
and each must therefore be designed to carry a force of 300N.
Now the stool may be imagined to be placed arbitrarily on a randomly rough floor and, as there is no way of deciding which leg will
be off the floor, all legs must therefore be designed to carry a force of 300N. There is thus a paradox apparent in the problem –
the addition of a fourth leg to a three-legged stool increases, rather than decreases, the force for which each leg must be
designed. This would be missed entirely assuming perfect geometry and ideal boundary conditions in simple analysis. The boundary
conditions are apparently so simple that no thought is given to their specification.

The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse 27
3.6 Development of a systematic risk assessment

Box 3.9 Continued

If the boundary conditions are thought about, then it is at once clear that they are, in
essence, unknown and unknowable. The surface of the floor could perhaps be
specified, but the man will place his stool at an unknown location. Specification of the
length of the legs will be subject to some tolerance – and, even if initially perfect,
throughout the life of the stool uneven wear will inevitably mean that we tend toward
the same paradoxical conclusion. If this point is realised at all, the common-sense
solution will be found that the legs of the four-legged stool must each be designed for
300N. Unfortunately, the designer may never reach this state: without an awareness
that the solution is sensitive to the boundary conditions, the elastic analysis will
resolutely conclude that the answer is 150N and these forces may be accepted
without question. Of course, all this assumes known loading – the loading may not
resemble what has been assumed, but this does not absolve the structural engineer of
the duty of trying to assess the worst case conditions (see figure).
Hambly’s paradox is essential reading for any engineer who believes we can analyse
with certainty the state of stress in a structure; unfortunately, the higher the level of
redundancy, the lower the level of certainty we have about the real stresses in the
structure. This returns to the quotation in the foreword and is particularly relevant to
designing for robustness. By definition engineers are providing redundancy, and with Computers do not absolve design
it, uncertainty – as illustrated by Hambly’s stool, it is therefore crucial that engineers engineers from considering the
spend time studying the real behaviour by examining how things will change if our most critical loading conditions
underlying assumptions are slightly wrong.

Hambly recognised that current design methods work for ductile structures because of the safe design theorem, which derives from
the lower bound theory of plasticity3.50-3.52 and states that a structure can carry its design loads if, and only if:
– the calculated system of forces is in equilibrium
– each component has the strength to transmit its calculated force and the ductility to retain its strength while deforming
– the structure has sufficient stiffness to keep deflections small and to avoid the onset of a local instability before design loads are
reached.
Thus, even if the real structure deforms under load with a different flow of forces from that calculated, it will still be safe as long
as:
– the failure modes are adequately ductile
– there is no risk of local instability.
Good robustness and design against disproportionate collapse is little more than the application of this principle, albeit with
the significant question for the engineer of confirming that all the failure modes of the structure as designed are adequately
ductile3.53.

3.6 Step 5: Identify risk reduction result from the implementation of each (Figure 3.6).
measures Necessarily, any evaluation of benefit will usually
involve a degree of subjectivity, either because the
measures are ‘soft’ measures for which the benefit
For each risk in turn, irrespective of where the risk lies cannot be quantified with precision, or simply because
in relation to the tolerable risk threshold, consider the benefit is determined through analysis which
measures that could be implemented to reduce the contains inherent uncertainties and approximations.
risk. For any given hazard, several potential risk
reduction options will typically exist, which will vary in Some measures will have a stronger effect upon the
terms of cost, effectiveness and utility/design impact. likelihood than upon the consequence and vice versa.
The structural engineer must, of course, check that Some, as with one of the risk reduction measures
any risk reduction measures do not cause an proposed in Figure 3.6, might decrease the likelihood
increase in the risk owing to another hazard, for but result in an increase in the consequence, though
example by causing a change in stiffness which still be effective in reducing the risk overall. An
affects the seismic demand on the structure. example might be spacing the expansion joints
further apart in the structure, improving the tying in
For all hazards, risk reduction measures must at least the structure such that a horizontally progressive
reduce the risk below the tolerable threshold. The collapse is less likely to occur. If it does occur,
engineer is duty-bound to reduce risks to a level however, it will automatically be greater in its extents.
which is as low as reasonably practicable, and should
therefore consider both measures that reduce the risk In the same way as sensitivity studies were carried
to just below the threshold as well as more powerful out in Step 4 to evaluate the sensitivity of the
risk mitigation measures. Determination as to which unmitigated risk to changes in the underlying
of the potential risk reduction measures is most assumptions, it is essential that as part of this step a
appropriate happens through a cost-benefit sensitivity study is undertaken on the mitigated risk.
assessment in Step 6. This sensitivity study should examine whether, when
each potential risk reduction measure is
To support the subsequent cost-benefit assessment, implemented, the resulting design remains sensitive
the risk reduction measures associated with each or is made insensitive to changes in the initiating
hazard should be plotted on the risk matrix by event. This study can usually be undertaken by
evaluating the residual or mitigated risk that would considering the effect of each potential risk reduction

28 The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse
 Development of a systematic risk assessment 3.7

measure against rarer, or larger, initiating events.

Hardening a column against a given vehicle impact
does not necessarily reduce the risk associated with Consequence
a larger vehicle impact; on the other hand designing

Catastrophic
Substantial
the structure to withstand the sudden loss of the

Significant
Minimal

Serious
column will automatically make the building able to

Severe
Minor
withstand the impact of a larger vehicle (Figure 3.7).
Thus under larger initiating events, measures that
eliminate or reduce the sensitivity will show a greater

Likelihood
Frequent/common
reduction in the consequences of the hazard than
those that do not. Likely
Designing the building using a scenario-independent
Unlikely
approach such that it is capable of withstanding the
sudden loss of a single element forming part of the
Rare
vertical load path or the lateral stability system, will
always be preferable to hardening the structure in a
Improbable
scenario-dependent approach. This is simply
because it renders the structure less sensitive to the
Negligible
magnitude of the hazard and is effective across
multiple hazards. The structural design will be
insensitive to assumptions about, for example, the
Figure 3.6 Residual risks owing to various different risk reduction measures for a given
velocity of a vehicle impacting the column, the
hazard
magnitude of an explosion or the quality of welding
compromising the ductility of the connections under
stress. As a result, the structure is better able to
resist events of any cause, irrespective of whether
they have been explicitly considered, and a better Consequence
level of robustness is achieved in the design.

Catastrophic
Substantial
Significant
Consequently a scenario-independent approach is
Minimal

Serious

Severe
Minor
preferred over those approaches in which sensitivities
remain. It is therefore recommended that a structure
is, wherever possible, designed to withstand the
Likelihood

sudden loss of any given individual structural member Frequent/common

which comprises either part of the vertical load path
or the lateral stability system, irrespective of the Likely
cause of the damage. This will be the first significant
step towards achieving robustness in the design, Unlikely i)
while in the subsequent evaluation of additional
Rare ii)
measures priority should also be given to scenario-
independent approaches.
Improbable
Risk reduction measures will not merely be technical
design modifications but will include ‘soft’, or Negligible
procedural, risk reduction measures. Many measures (a) column hardening
can be implemented which have a significant impact
on the level of risk, particularly when dealing with
something innovative, complex or unusual, for Consequence
example:
Catastrophic

– controls to ensure the effective communication of

Substantial
Significant

design information within the design team and the

Minimal

Serious

Severe
Minor

supply chain
– an external and independent check of the design
(known in the UK as a Category 3 check3.54)
Likelihood

– a higher degree of quality assurance in the design Frequent/common

and construction
– supervision of aspects of the construction by the Likely
designer and
– a peer review of the systematic risk assessment. Unlikely i)

Rare ii)
Such procedural risk reduction measures must be
much more than just an after-thought, and are some
of the most important risk reduction measures that Improbable
can be implemented in a design.
Negligible
(b) scenario-independent design
Note
3.7 Step 6: Cost-benefit assessment The risk reduction associated with option (b) is greater than option (a).

In this step, the benefit resulting from the risk Figure 3.7 Raw and mitigated risks associated with the accidental impact from i) a 3.5T
reduction measure determined in Step 5 is weighed van and ii) a 40T truck

The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse 29
3.8 Development of a systematic risk assessment

against the cost of implementing the measure. ‘Cost’ The statutory duty to reduce risks to a level which is
may be measured in financial cost, programme delay, as low as reasonably practicable was emphasised in
impact on design aspirations such as aesthetics, loss Step 5, and in all cases the mitigated risk must fall
in amenity, utility or function, and so on. Benefit below the tolerable threshold for that risk. A
should not be underestimated: while costs are by responsible structural engineer experienced in risk
comparison easily quantified, benefits are not. The assessment will be familiar with these concepts and
engineer must remember that the real benefit is a will be able to guide the decision-making process
reduction in the fatalities and injuries that will result, such that the overall level of risk is appropriately
should an accidental or malicious hazard develop. It managed. If it is concluded from the systematic risk
is often more illuminating to consider whether the assessment that one or more risk reduction
benefits are ‘worth having’ through a conditional measures are necessary, the cost of which is
assessment: given that the event may occur, is the significant, the basis for these requirements has been
reduction in risk worth the cost? defined in a reasoned, justified manner and the
commercial aspects of the project must be adjusted
The cost-benefit assessment will often be qualitative accordingly. It should be remembered however that in
and based upon good engineering judgement. Often the risk management process, the action taken (and
a relative cost-benefit assessment of whether the cost expended) should at all times remain
Option A has greater potency than Option B is more proportionate to the risk. If this has been shown to be
useful than an absolute assessment, particularly for the case, it indicates a necessary risk reduction
‘soft’ measures where the cost cannot be easily measure and the viability of the project must be
determined. Contemporary good practice will often reviewed: cost alone is not a reason for not
be the ultimate measure against which different risk implementing a particular measure.
reduction measures are evaluated.
Equally and as highlighted in Section 2.4, if after
In the cost-benefit assessment, each of the risk going through the previous steps it has not been
reduction measures is considered in turn, rather possible to reduce the risk to a tolerably low level, it
than each of the hazards in turn as above. The total must be considered whether the proposed design is
benefit of a given risk reduction measure is merely worth the risk. This may mean going back to the
the total risk reduction determined in the previous conceptual stage of design and approaching the
step, aggregated across all of the hazards impacted robustness of the structure and perhaps the
by the particular risk reduction measure being structural design as a whole in a different way.
considered.

The performance of sophisticated cost-benefit

assessment is described elsewhere3.55; however it
need not be complex. For the purposes of design 3.8 Step 7: Implement the risk reduction
against disproportionate collapse, a simplistic measures
approach is often sufficient. As shown in the example
given in Chapter 5, the cost for a particular risk
reduction measure can be expressed in a multitude In this step the risk reduction measures to be
of forms as appropriate to the dominant impact of implemented are identified and incorporated in
each measure being considered (whether cost, design. Risk reduction measures that are ‘cheap’
programme delay and so on). An approximate (either financially or in terms of their design impact)
approach which gives a feel for the benefit of a given but have a significant impact on the risk (a high cost-
risk reduction measure is the sum of the length of the benefit ratio), or measures that represent
lines on the risk matrix which indicate the reduction in contemporary good practice, should always be
the risk of the hazards impacted by the risk reduction implemented regardless of whether the risk already
measure. lies below the tolerable risk threshold.

The cost-benefit assessment permits the total Any risks which fall above the tolerable risk threshold
reduction in risk from each of a range of mitigation must be mitigated, as a minimum such that they are
measures to be evaluated, and importantly, to be brought below the threshold; all raw risks falling
compared in deciding where to target finite resources below the threshold should also be reduced so far as
to derive the maximum value. Some notes are helpful it is reasonably practicable to do so. As highlighted in
in differentiating between different risk reduction Section 1.3, efforts to reduce the risks that remain in
measures where the reduction in risk is similar: the design should continue until the point of gross
– Where one measure is scenario-independent and disproportion is reached. It is through the cost-benefit
the other is scenario-dependent, for the reasons assessment that the location of what represents
described earlier the scenario-independent ALARP and thus the point of gross disproportion is
measure should be prioritised. judged. This is likely to be realised through
– Where the above distinction does not apply, the contemporary good practice and professional
measure impacting the larger raw risks is the more judgement. Guidance on deciding whether a risk is
important of the two. ALARP is given by the Institution of Civil Engineers3.56
– Where one measure mitigates a greater number of and the Health and Safety Executive3.57.
risks than the other but the total level of risk
reduction between the two is broadly similar, the It is by this point that both design changes and ‘soft’
one impacting the larger number of risks is procedural risk mitigation measures will have been
generally the more important. identified. The structural engineer should now be able
to articulate the findings of the systematic risk
The total cost of all risk reduction measures and the assessment in terms of modifications to the structural
aggregated risk reduction can be a useful, though design. They should, however, also be able to
ancillary, measure for demonstrating the value given articulate the necessary precautions to be taken in
by the risk assessment. the procurement process to ensure quality, the effect

30 The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse

upon the construction sequence, controls to ensure
adequate quality management through the supply
chain and during construction, inspection and
maintenance regimes to be implemented during the
operation of the building, and so on. The financial
cost associated with the risk mitigation measures
should also now be available. What follows in the
remaining steps is largely to do with testing the
sensitivity of the risk assessment to the underlying
assumptions, which may modify the findings but is
unlikely to cause wholesale changes, and the review
and acceptance of the residual risks by others.
3.9 Step 8: Review the residual risk
In this step the residual risks that remain in the design
following the application of the risk reduction
measures should be reviewed with the client and any
other risk stakeholders who will become the risk
owners for the residual risks in the design.
Cognisance must be given to any designers who are
not appointed such as temporary works designers,
and limits defined on their subsequent design be
properly documented such that they can be
effectively communicated upon their appointment.
Both the client and other risk stakeholders must
agree with and accept the level of residual risk
inherent in the design as they will be the eventual risk
owners who will be responsible for controlling the
residual risks.
3.10 Step 9: Check the sensitivity of the
risk assessment
3.10.1 Common areas of sensitivity
In this step the findings of the risk assessment are
checked in respect of:
– cliff edge effects
– low likelihood/high consequence hazards
– combined hazards.
3.10.2 Cliff edge effects
For each hazard, check through structural analysis
whether small changes in the assumptions will lead to
a gross change in the consequences of the hazard
(Boxes 3.10-3.12). If so, consider the beyond-design
basis event in which the action is slightly worse than
assumed in the risk assessment, and eliminate the
cliff edge from the response or ensure that it is made
sufficiently distant from the design basis to reduce
the sensitivity of the design to the underlying
assumptions. Consider the potential error in the
assumptions: if the hazard can be accurately
characterised, consider 5% or 10% changes in the
assumptions; but if the hazard is difficult to evaluate,
consider the effect of a 20% or even a 40% change.
It is acceptable for the structure to sustain damage
under such circumstances so lower partial factors
can be used, provided the deformation is controlled
and sudden failure is avoided.
An element which is shown in a scenario-
independent alternative load path analysis to be
critical to the structure could be designed for the
The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse
Development of a systematic risk assessment 3.9
ultimate force to which it might be subjected, and yet
still be governed by a brittle failure mode such as
shear but be designed ‘in accordance with the codes
of practice’. This would completely overlook the
importance of the element to the robustness of the
structure. If an element is shown to be critical to the
design of the structure, a sensitivity study should be
undertaken to ensure that there is only a gradual
change in the response of the structure at a load of
up to, say, 40% above the design (i.e. factored) load.
Box 3.10 Pipers Row car park, 1997
The sudden failure of the car park at Pipers Row,
Wolverhampton was due to loss of punching shear capacity.
Deterioration of the upper surface of the concrete slab due to
frost, water and crystallisation of de-icing salts caused loss of
the cover to the top layer of rebar, fissuring and cracking of
the concrete matrix, carbonation of the concrete and
corrosion of the reinforcing bars. The friable degraded
material extended to a depth of approximately 100mm, well
below the layer of the top reinforcement. The punching shear
capacity rapidly reduced with greater depths of erosion/
disruption of the concrete, leading to a sudden collapse. The
car park was designed using the contemporary code of
practice CP 1143.58, which has since been shown to give an
over-prediction of unconservative shear strengths in
reinforced concrete. The concrete was highly variable: some
with low cement contents, poor mixing and compaction, so
that localised strengths were sometimes substantially less
than the specified 20.5N/mm2. Reinforcement in both faces
of the slab was set too low, leading to premature corrosion of
the bottom flange and a reduction in the shear strength of
the slab. Surfacing was also thinner than the design value
which, combined with the poor concrete compaction, reduced
the dead load from 6.2kN/m2 to 5.4kN/m2. Poor tolerances
in the setting-out of the slab led to an imbalance in the load
distribution and increase in the effective shear stresses
around some columns by some 40%3.59.
The investigation found that, if properly maintained, the
structure should have had a reasonable factor of safety in
relation to the in-service loads. However, deterioration of the
concrete led to the sudden punching shear failure of the
concrete slab and the car park was subsequently demolished.
Box 3.11 Shear failure of a reinforced concrete
transfer slab
Transfer slabs are commonly designed without shear links for
the sake of ease of construction, cost and programme. Shear
transfer relies on the shear strength of the concrete alone,
and a brittle mode of failure is exhibited. Shear links may add
marginal costs to the construction of a transfer slab, but
given the importance of a transfer element in the structural
system the inclusion of links are probably not a
disproportionate risk reduction measure.
31
3.11 Development of a systematic risk assessment

3.10.3 Low likelihood/high consequence hazards

Box 3.12 Brittle failure of a steel-framed structure
A steel-framed structure, though ductile as a material and
usually ductile on an element level using plastic methods of
design, can exhibit brittle failure modes either at a local or a
global level. Brittle failure can occur due to the failure of
connections as well as the more obvious modes of brittle
failure such as fatigue and corrosion. Partial-strength
connections, which will comprise the majority of connections
in a typical structure, can exhibit sudden failure due to
applied forces being larger than designed, or by the
connection being loaded in a manner such as rotation for
which it was not designed. Both actions will often result
under a progressive collapse scenario, and the failure mode
of the structure may be unexpectedly brittle if connections
have insufficient rotational ductility or are unable to develop
the forces and moments necessary to arrest a progressive
collapse. Even moment connections can fail in a brittle
manner if not properly detailed – unexpected brittle fracture
of steel moment connections was a key issue in the
Northridge and Kobe earthquakes3.60-3.62.
Low likelihood/high consequence hazards are
particularly sensitive to small changes in the
underlying assumptions and, as described in
Section 3.2.4, have the potential to significantly affect
the overall risk profile. A specific review of the
assumptions made in the derivation of the risk
associated with such hazards is therefore warranted.
As with cliff edge effects, a sensitivity study should be
conducted to determine whether the risk to
occupants could be made significantly worse if the
hazard is slightly larger than assumed, or the
structural response slightly worse than calculated.
Additionally, if the risk of a low likelihood/high
consequence event is significant, consider whether
additional mitigation is necessary. Consider how the
consequences would be viewed if the hazard did
materialise – would the consequences really be
considered tolerable? As discussed in Section 3.4, this
decision is often put into sharp focus by considering
the conditional probability: given that the event may
occur, what would be the tolerable level of damage?

3.10.4 Combined hazards

The risk associated with combined hazards has a

higher level of sensitivity than single hazards because
it is sensitive to changes in the likelihood in two or
Consequence more underlying events (such as the risk of fire
following a vehicle impact). Consider the hazard from
two angles when determining whether the level of
Catastrophic
Substantial
Significant

damage is tolerable (Box 3.5):

Minimal

Serious

Severe

– the likelihood of each event separately and the level

Minor

of damage considered intolerable, and

– given that the first hazard may occur, how much
Likelihood

Frequent/common damage is considered proportionate to the risk of

the second hazard?
Likely

Unlikely

Rare 3.11 Step 10: Review the overall level of

risk
Improbable

Negligible Review the overall level of risk in the design, by

considering the aggregated totals of both the
Figure 3.8a Risk assessment indicative of a design which is sensitive to the risk unmitigated and the mitigated risks.
reduction measures
Consequence Unmitigated risks may be high, but highly-effective
mitigation measures may have been identified and
incorporated. In this instance a great deal of
Catastrophic
Substantial
Significant

importance is being placed on the mitigation measures,

Minimal

Serious

Severe

which renders them safety-critical (Figure 3.8a). Equally,

Minor

the overall level of risk may be high but not intolerable,

but it may not have been possible to make much
impact through the mitigation measures. In this
Likelihood

Frequent/common
instance the mitigation measures are not particularly
Likely important but there remains a significant risk to
occupants (Figure 3.8b), and the design is sensitive to
Unlikely the assumptions made in the risk assessment.

Rare In either case, the design of the structure against

disproportionate collapse is of particular importance
Improbable and an independent peer review of the systematic
risk assessment by a suitably qualified and
Negligible experienced person is warranted. This may be a peer
review by another team within the same firm or a
Figure 3.8b Risk assessment indicative of a design which is sensitive to the peer review by a third party (known as Category 2
assumptions made in the risk assessment and Category 3 checks respectively3.54), depending
on the level of this sensitivity. The peer review should

32 The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse

not be a mechanistic review of the content of the risk
assessment and the analysis undertaken but an
independent review of the principles adopted, the
sensitivity of the design and the assumptions made.
One potential approach is given by SCOSS3.63.
3.12 Step 11: Provide adequate information
about any risks that remain
The designer has a duty to, after eliminating those
hazards that can be eliminated from the design and
reducing the risks from the hazards that remain so far
as is reasonably practicable, ensure that adequate
information has been communicated to those who
might be affected by any risks that remain in the
design. This normally includes the client as a
minimum, and will often also include other designers
(including information for contractor design),
contractors and sub-contractors.
In practice no design methodology is genuinely
capable of guaranteeing freedom from in-service
damage because the load paths, stress distribution
and magnitude are all too uncertain to do so with any
degree of confidence. Movement joints will seize,
bolts will work loose under vibration and corrosion
and fatigue will change the strength and stiffness
distribution of the structure and therefore the flow of
forces. Safety is therefore assured by a combined
package of design and in-service inspection and
maintenance. Consequently, inspection and
maintenance is central to ensuring the safety of the
structure, and the implementation of the inspection
and maintenance regime is not optional.
Combined with the above limitations of the structural
analysis and design techniques, all the hard work to
eliminate hazards and reduce risks can also be
quickly jeopardised by human factors. Past failures
have shown the significance that mistakes in
communication, lack of understanding or lack of
awareness have had in the causes of failure (see also
Sections 3.2.6 and 4.13). It is not sufficient merely to
issue the information: the designer must take
reasonable steps to ensure that the information is
communicated effectively so that the risks are
understood. This information is likely to include:
– information about the likelihood and consequences
associated with any hazards that have not been
eliminated, taking into account the risk reduction
measures implemented in the design
– information about how the level of risk associated
with these hazards corresponds with the tolerable
risk threshold, which may influence the importance
of control measures put in place by the subsequent
owner of each risk
– recommendations about suitable control
procedures (such as inspection and maintenance
regimes to protect against corrosion and fatigue),
measures to control the usage of certain parts of
the structure (analogous to restrictions requiring the
use of crawling boards for maintenance access to
fragile roofs), and security procedures to control
any malicious hazards.
Further information about procedural measures is
given in Section 4.13.
If, prior to the risk assessment, the design philosophy
and the proposed approach to design against
The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse
Development of a systematic risk assessment 3.12
disproportionate collapse have been documented,
one vehicle for the communication of this information
is through an update of this document. Often it will be
preferable to also provide information to each
affected party that just details the risks and
precaution measures about which they need to be
aware.
3.13 References
3.1 Chemical Industries Association. A guide to hazard and
operability studies. Chemical Industries Association,
1993.
3.2 Health and Safety Laboratory. Review of hazard
identification techniques. HSL/2005/58. Health and
Safety Laboratory, 2000.
3.3 Kletz T. Hazop and Hazan: identifying and assessing
process industry hazards. 4th ed. London: The
Institution of Chemical Engineers, 2006.
3.4 British Standards Institution. BS EN 1991-1-7:2006.
Eurocode 1: Actions on structures. Part 1-7: General
actions: Accidental actions. London: BSI, September
2006.
3.5 Yam LCP, Armitage JS, Walker AC et al. Structural
failures in buildings. Papers presented at a symposium
held at the Café Royal, London: Institution of Structural
Engineers, 30 April 1980.
3.6 Agarwal J, Haberland M, Holickẏ M et al. Robustness
of structures: lessons from failures.. Structural
Engineering International 2012;1/2012:105-111.
3.7 Delatte NJ. Forensic case studies for civil engineers.
ASCE Press, 2009.
3.8 Levy M, Salvadori M. Why buildings fall down: how
structures fail. New York, NY: W.W. Norton, 1992.
3.9 Feld J, Carper K. Construction failure. 2nd ed. New
York, NY: John Wiley & Sons, 1997.
3.10 Kaminetzky D. Design and construction failures:
lessons from forensic investigations. New York, NY:
McGraw-Hill, 1991.
3.11 Campbell P, ed. Learning from construction failures:
applied forensic engineering. Caithness: Whittles
Publishing, 2001.
3.12 Kletz T. An engineer’s view of human error. 2nd ed.
London: Institution of Chemical Engineers, 1991.
3.13 Mann AP. Learning from failures at the interface.
Proceedings of the Institution of Civil Engineers – Civil
Engineering 2008;161(6):8-15.
3.14 Beeby AW. Safety of structures, and a new approach
to robustness. The Structural Engineer
1999;77(4):16-21.
3.15 Beeby AW. Safety of structures, and a new approach
to robustness – discussion. The Structural Engineer
1999;77(18):25-30.
3.16 Vrouwenvelder T, Leira BJ, Sykora M. Modelling of
hazards. Structural Engineering International
2012;1/2012:73-78.
33
3.13 Development of a systematic risk assessment

3.17 Bunni NG. Risk and insurance in construction. 2nd ed. report of the National Construction Safety Team on the
Taylor & Francis, 2005. collapses of the World Trade Center tower. September
2005. Available from: http://wtc.nist.gov.
3.18 Rumsfeld D. US Department of Defense news briefing.
12 February 2002 Available from: www.defenselink.mil/ 3.34 Centre for the Protection of National Infrastructure.
Transcripts/Transcript.aspx?TranscriptID=2636. www.cpni.gov.uk.
[Accessed 2012-11-28].
3.35 Register of Security Engineers and Specialists.
3.19 Government Office for Science. Blackett review of high www.ice.org.uk/rses.
impact low probability risks. Department for Business,
Innovation and Skills, 2011. 3.36 Department for Transport. Managing the accidental
obstruction of the railway by road vehicles. London:
3.20 Neville AJM. History of high-alumina cement. Part 1: Department for Transport, February 2003.
Problems and the Stone report. Proceedings of the
Institution of Civil Engineers – Engineering History and 3.37 Rail Accident Investigation Branch. Rail accident report
Heritage 2009;162(EH2):81-91. – road vehicle incursion and subsequent collision with
a train at Stowmarket Road, 30 November 2011.
3.21 Neville AJM. History of high-alumina cement. Part 2: Report 25/2012. Rail Accident Investigation Branch,
Background to issues. Proceedings of the Institution of November 2012.
Civil Engineers – Engineering History and Heritage
2009;162(EH2):93-102. 3.38 Ellingwood BR. Acceptable risk bases for design of
structures. Progress in Structural Engineering and
3.22 Neville AJM. A study of deterioration of structural Materials 2001;3(170-179).
concrete made with high-alumina cement. Proceedings
of the Institution of Civil Engineers 3.39 Hambly EC, Hambly EA. Risk evaluation and realism.
1963;25(3):287-324. Proceedings of the Institution of Civil Engineers
1994;102(5):64-71.
3.23 Neville AJM. A study of deterioration of structural
concrete made with high-alumina cement – 3.40 Ale BJM. The use of risk information in the
discussion. Proceedings of the Institution of Civil Netherlands. 7th Annual European Summer School on
Engineers 1964;28(1):57-84. Major Hazards. Christ College Cambridge: 6-10 July
1992.
3.24 Lea FM, Davey N. The deterioration of concrete in
structures. Journal of the Institution of Civil Engineers 3.41 Ball DJ, Floyd PJ. Societal risks. Report prepared for
1949;32(7):248-295. the risk assessment policy unit, Health and Safety
Executive. Risk & Policy Analysts Ltd, 1998.
3.25 Institution of Structural Engineers. Report on the use of
high-alumina cement in structural engineering. London: 3.42 Health and Safety Executive. Societal risk technical
IStructE, 1964. seminar progress – Summary Note 04/09. Available
from: http://www.hse.gov.uk/societalrisk/seminar0409/
3.26 Pugsley AG. The safety of structures. London: Edward summary-note.htm. [Accessed 2012-09-25].
Arnold (Publishers) Ltd, 1966.
3.43 Faber MH, Narasimhan H. Robustness of structures:
3.27 Report of the Royal Commission into the failure of the final report of COST Action TU0601. September
West Gate Bridge. 2.-7037/71. Melbourne, Victoria: 2011. Available from: Available from: www.cost-
1971. tu0601.ethz.ch.

3.28 Structural-Safety website. Available at http://www. 3.44 Sørensen JD. Theoretical framework on structural
structural-safety.org [Accessed: 27 February 2013]. robustness. June 2011. Available from: Available from:
www.cost-tu0601.ethz.ch.
3.29 Conseil National des Ingenieurs et Scientifiques de
France. Synthese des travaux de la commission 3.45 Izzuddin BA, Pereira MF, Kuhlmann U et al. Application
administrative sur les causes de l’effondrement d’une of probabilistic robustness framework: risk
partie du terminal 2E de Paris-Charles de Gaulle. assessment of multi-storey buildings under extreme
Paris: Ministry of Transportation, Urban Design, loading Structural Engineering International
Tourism, and Sea, 2005. 2012;22(1):79-85.

3.30 Hawthorne C. Design notebook: the architectural 3.46 Janssens V, Sørensen JD, O’Dwyer DW et al.
blame game. The New York Times, 2004; Assessing the consequences of building failures.
27 May 2004. Structural Engineering International
2012;22(1):99-104.
3.31 Danger ahead – historic railway disasters. Special
feature: Eschede, Germany: ICE high-speed train 3.47 Hambly EC. Oil rigs dance to Newton’s tune.
disaster. http://danger-ahead.railfan.net/features/ Proceedings of the Royal Institution of Great Britain
eschede.htm. [Accessed 2012-11-17]. 1985;57:79-104.

3.32 Leslie E. Robertson Associates. WTC Sept 11, 2001. 3.48 Heyman J, Hambly EC. Hambly’s paradox: why design
http://www.lera.com/sep11.htm. [Accessed calculations do not reflect real behaviour. Proceedings
2012-11-28]. of the Institution of Civil Engineers: Civil Engineering
1996;114(4):161-166.
3.33 National Institute of Science and Technology. NIST
NCSTAR 1: Federal building and fire safety 3.49 Burland J. Interaction between structural and
investigation of the World Trade Center disaster: Final geotechnical engineers. 6th Athenian Geotechnical

34 The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse
 Development of a systematic risk assessment 3.13

Lecture, based on a paper published in The Structural

Engineer 2006;84(8):29-37.

3.50 Baker JF. The steel skeleton. Volume I: elastic

behaviour and design. Cambridge: Cambridge
University Press, 1954.

3.51 Baker JF, Horne MR, Heyman J. The steel skeleton.

Volume II: plastic behaviour and design. Cambridge:
Cambridge University Press, 1960.

3.52 Hillerborg A. Strip Method of Design. Slough, UK:

Viewpoint, 1975.

3.53 Morley C. When plasticity? Symposium on concrete

plasticity and its application. University of Cambridge:
23rd July 2007.

3.54 The Highways Agency, Scottish Executive, Welsh

Assembly Government et al. Design Manual for Roads
and Bridges (DMRB). Volume 1 – Highways structures:
approval procedures and general design. Section 1 –
Approval procedures. Part 1, BD 2/05 – Technical
approval of highway structures. London: Department
for Transport, August 2005.

3.55 Snell M. Cost-benefit analysis for engineers and

planners. 2nd ed. London: ICE Publishing, 2010.

3.56 Institution of Civil Engineers. A review of, and

commentary on, the legal requirement to exercise a
duty ‘so far as is reasonably practicable’ with specific
regard to designers in the construction industry.
London: ICE, January 2010.

3.57 Health and Safety Executive. ALARP at a glance: How

to tell if a risk is ALARP: Deciding by good practice.
http://www.hse.gov.uk/risk/theory/alarpglance.htm.
[Accessed 2012-11-28].

3.58 British Standards Institution. Structural codes of

practice. CP 114: the structural use of reinforced
concrete in buildings. Part 1. London: BSI, 1957.

3.59 Wood JGM. Pipers Row car park, Wolverhampton:

quantitative study of the causes of the partial collapse
on 20th March 1997. Health and Safety Executive,
January 2003.

3.60 Ojdrovic RP, Zarghamee MS. Fracture of steel moment

connections in the Northridge earthquake. Proceedings
of the Institution of Civil Engineers – Structures &
Buildings 1997;122(2):209-217.

3.61 Kato B, Morita K, Maruoka Y et al. Seismic Damage of

Steel Beam-to-Column Rigid Connections in the 1995
Hyogoken-Nanbu Earthquake. Proceedings of the
Second International Conference on the Behaviour of
Steel Structures in Seismic Areas (Stessa’97). Kyoto:
3-8 August 1997.

3.62 Nagao T, Tanaka T, Nanba H. Performance of

beam-column connections in steel structures. 13th
World Conference on Earthquake Engineering.
Vancouver, B.C.: 1-6 August 2004.

3.63 Standing Committee on Structural Safety (SCOSS).

Guidance note: independent review through peer
assist. SCOSS topic paper SC/09/034. January 2009.

The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse 35
4 Approaches to design against disproportionate
collapse

4.1 Introduction In some structural forms this will exacerbate the

collapse because the structure is incapable of
carrying the redistributed loads. In these cases,
This chapter outlines some of the approaches to discontinuities in the form of expansion joints or
designing for robustness, with more detailed structural fuses can be beneficial in limiting the
information available in the references given at the extents of damage4.3.
end of the chapter. Both the structural mechanisms (8) Design for robustness should consider the
of resistance for resisting collapse and some consequences of loss of or damage to elements
procedural measures which can be at least equally as of the stability system, not just elements forming
important in reducing risk are described. the vertical load path.
(9) For particularly severe hazards local to a specific
part of the building such as a screening area or
loading bay, compartmentalisation can be
4.2 Minimum requirements beneficial by providing a secondary sacrificial
structure, or a structural discontinuity such that
the damage does not spread to the adjoining
As a minimum, a Class 3 structure should be at least structure.
as robust as a Class 2B structure. The designer (10) The local absorption of energy is important in
should be able to pursue an alternative approach to containing the damage and is a key role of the
meeting the Class 2B requirements in which explicit structural connections. Brittle connections
demonstration is given that an alternative solution is should not be used.
preferable. In this case the designer should (11) Large spacing between columns or supports
demonstrate that the design exhibits a level of significantly increases the extents of the potential
robustness at least equal to the intent described by damage. Reducing the spans so that
the Class 2B requirements. This is particularly redistribution of load becomes possible should
relevant for special structures such as sculptures, be considered, but if the large spans are
fairground rides, observation wheels, observation necessary the columns or supports become
decks and masts, where the requirements for Class critical. Attention should then move to eliminating
2B structures may have no practical application. the hazards and minimising the risks that could
impair the columns or supports (refer to
Section 4.11).

4.3 General design recommendations

4.4 General procedural recommendations
Robustness is generally enhanced and risks reduced
by application of the following principles:
(1) Ductile design and the ability to dissipate energy Procedural measures employed to reduce risks can
is an overarching principle of a robust be structured around the following principles:
design4.1, 4.2. (1) Single point of responsibility – as with the overall
(2) Systematic procedures should be employed to coordination of the structural design, the lead
identify weaknesses in the structural form. This structural engineer should be directly responsible
will also lead to the identification of the critical for the overall control of the design with respect
elements in a structure. to all issues relating to stability and
(3) The structural design should provide alternative robustness4.4-4.9, and the contracts should be
load paths, with explicit checks undertaken of written to permit this.
their ability to carry loads redistributed from the (2) Design team interfaces should be clearly
loss of a member. identified and controlled such that there is
(4) The horizontal and vertical load paths should be explicit agreement between the parties on either
separated, such that horizontal actions will not side of each interface as to where the
cause failure of the vertical load path. responsibilities lie, and how the design interface
(5) The designer should ensure compatibility is to be managed.
between the strength-based assumptions made (3) Design information (e.g. loads, loadcase
in developing resistance against progressive combinations, connection forces) should be
collapse and the necessary ductility to support clearly and unambiguously communicated and
those assumptions, and ensure the ductility steps taken to ensure each designer has a clear
provided is adequate throughout the design. understanding of them.
(6) Vertical loadbearing elements should be (4) Design change should be clearly managed and
designed such that failure is produced in the controlled.
adjoining slab/beam rather than in the column (5) Good management processes with adequate
(‘strong column/weak beam’) to limit the extents checks to eliminate errors should be in place for
of damage. both the design and the construction.
(7) Continuity through improved connection detailing (6) Risks should be kept under regular review during
generally enhances the robustness of structures. the design process. The initial risk assessment

36 The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse

should be undertaken at the earliest stages of
the design and should keep pace with the design
through periodic review and further development
of the detail as the design progresses to take
account both of the increasing level of detail and
of design changes. The assessment should be
updated as the design is finalised, and updated
again to reflect the as-built design once
construction is completed.
(7) Robust quality management procedures should
be designed and enforced to manage the flow of
information and document control such that the
risk of failures in the communication of
information is minimised.
(8) The structural engineer should develop an
appropriate inspection and maintenance regime
for the structure as a core part of the design
activities, and not merely as an after-thought
shaped to fit the design after it has been
finalised. This should be agreed with the client
during the development of the design and must
be properly communicated by the designer
before the design can be said to be complete.
(9) The required level of competence to construct
the building to the quality required should be
determined, together with identification of the
means by which this will be evaluated and
controlled.
(10) Rigorous measures should be implemented for
quality management in the design process,
which should be commensurate with the level
of risk on the project. Design measures that
are associated with large reductions in risks
or where a high level of residual risk remains
in the design are indicative of where
additional measures are warranted in the
checking and review of the design, up to and
including an independent peer review of the
design4.10. Site testing should be specified for
those aspects of the construction where the
design intent depends upon the quality of
workmanship, in order to ensure the structure
will behave as intended.
(11) Rigorous measures should be implemented for
quality assurance both through the supply
chain and in the construction itself,
proportional to the level of risk in the design.
Examples indicative of where particularly
close supervision and testing of the
construction is warranted include elements:
– known to be particularly important to the
robustness of the structure
– in which there is a high risk of mistakes or
errors being made
– where supervision is known to be difficult
during construction
– where a high degree of reliability is necessary
because subsequent inspection and
maintenance will be difficult.
4.5 Design loadcases and performance
criteria
Eurocode 0 (BS EN 1990:20024.11) defines the
combination of actions for accidental loading. A
typical building with imposed office floor loading and
wind as accompanying variable actions gives the
two loadcases shown in Equations 4.1 and 4.2.
The partial (g-) factors and combination (c-) factors
are taken from the UK National Annex4.12.
The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse
Approaches to design against disproportionate collapse 4.5
Equation 4.1
1.0Gk þ (1.0 or 0.0)
0.5Qk þ 1.0
0.0Wk þ 1.0 Ak
Equation 4.2
1.0Gk þ (1.0 or 0.0)
0.3Qk þ 1.0
0.2Wk þ 1.0 Ak
where:
Gk is the dead load
Qk is the imposed load (partial factor depends on
whether action is adverse or beneficial)
Wk is the wind load
Ak is the accidental load.
In determining the accidental load Ak, the dynamic
effects of the load must be considered. This will
comprise both the sudden redistribution of load
through alternative load paths due to the failure of
a structural element, and dynamic debris impact
e.g. of a structural slab onto the floor
below4.13, 4.14.
Structures with little ductile capacity must be
designed to remain broadly elastic. Structures
designed and detailed to develop significant
ductility post-yield may adopt less onerous
performance criteria. Guidance on appropriate
performance criteria is given in UFC 4-023-034.15.
4.6 Design approaches
Approaches to design against disproportionate
collapse generally fall into one of two types
(Figure 4.1):
– Load Redistribution (LR), in which the ability of the
structure to redistribute the loads resulting from the
loss/damage of the local structural elements is
enhanced.
– Local Protection (LP), in which measures are taken
to guard against the loss of elements occurring in
the first place.
In typical multi-storey buildings LR methods will
generally be preferable to LP methods, because
LR methods will usually have a beneficial effect on
both the extents and the severity of the collapse
against events of unspecified cause and of
increasing magnitude. These methods are
Local protection of
Effective tying
critical structural element
Alternative load path analysis Compartmentalisation
Load redistribution (LR) methods Local protection (LP) methods
Figure 4.1 Categorisation of approaches to design against disproportionate collapse
37
4.7 Approaches to design against disproportionate collapse

described in the following sections, and further

Element failure and detail may be found in the literature including
onset of collapse Faber4.16, Starossek4.3, fib4.13, Ellingwood4.17, 4.18,
Dusenberry4.19, Izzuddin4.20, Vlassis4.21 and
Capacity

Cormie4.14, 4.22.

When a LR approach such as alternative load path

analysis (Section 4.9) is employed, the element is
rendered non-critical by designing the structure to
be capable of redistributing the load as loss of
strength and yielding develops (Figures 4.2a and b).
The cliff edge is eliminated from the structural
Load
Structural
demand

response or the magnitude reduced. When a LP

approach such as the local protection of a critical
structural element (Section 4.11) is used as an
(a) Presence of a cliff edge corresponding to the failure of a critical structural element alternative to LR methods, there will often be no
reduction to the extents or severity of collapse when
Loss of strength and it occurs; however the threshold at which it occurs
load redistribution is raised, moving the cliff edge in the structural
Capacity

response but not eliminating it (Figure 4.2c).

LP methods tend to have greater utility in bridge

structures, where often the only viable approach
to preventing the horizontal progressive
collapse of multiple spans is to
compartmentalise the design so that a collapse is
limited only to the immediately adjacent spans
Load (Box 4.1).
Structural
demand

(b) Effect of load redistribution (LR) approaches on the structural response 4.7 Scenario-independent design
Element failure and
onset of collapse Scenario-independent design, whereby the structure
Capacity

is systematically designed for the removal of one or

more structural elements independent from the
applied load, is one of the most powerful tools in
designing for robustness. As discussed in Section
3.6, it is effective in mitigating multiple hazards and
renders the structure independent of the magnitude
of the hazard.

Load In a scenario-independent design, each loadbearing

Structural
demand

element is assumed to be removed, usually

instantaneously, and the structure designed for the
resulting forces associated with the redistribution of
(c) Effect of local protection (LP) approaches on the structural response the load carried by the element, including the
dynamic effects of this load.
Figure 4.2 Effect of load redistribution (LR) and local protection (LP) on an inherent cliff
edge The extent to which scenario-independent design is
applied will be directed by the risk assessment. For a
typical framed structure it should be considered in the
Box 4.1 Haeng-Ju Grand Bridge collapse, Seoul, 1992 and Tasman Bridge,
removal of each of the following elements in turn,
Hobart, Australia, 1975
listed in decreasing order of importance:
During the construction of the Haeng-Ju Grand Bridge in Seoul, the initial failure of one – All ground floor perimeter columns, together with
span of the continuous pre-stressed concrete girder bridge after the failure of a temporary other significant accessible columns (e.g. those
pier progressed through the 10 adjacent spans, and an 800m section of the bridge was adjacent to loading bays or other vehicular areas
lost4.23. The collapse occurred just after the end of the day’s construction activities and no- such as where the building bridges across a
one was hurt. The progressive collapse was arrested by the expansion joints at each end of vehicular access). Where columns converge into a
the 800m length. The prestressing tendons, which were discontinuous across the common support or are within a spacing of 1.0
expansion joints, played a major role in the collapse by resisting the stresses caused by the times the storey height H, the removal of multiple
failure and transferring the forces, thus enabling the collapse to continue. columns should be considered. 1.0H should
generally be taken as a lower bound spacing for
The failure of the Tasman Bridge in 1975 was due to a ship impact, in which two piers multiple column removal, and the risk assessment
and the three supported spans were destroyed. The other 19 spans remained intact. The used to determine whether multiple column removal
lack of progression of the collapse was related to the discontinuity of prestressing should be considered if spaced at wider centres.
tendons between adjacent spans4.3. – Elements forming part of the stability system.
– All ground floor internal columns, and internal
columns in any other publicly accessible areas.
– Other internal columns.
A similar hierarchy should be developed for other
structures such as cable-stayed systems.

38 The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse
 Approaches to design against disproportionate collapse 4.8

The potential mechanisms of resistance against
progressive collapse and the analytical approaches
for undertaking a scenario-independent design are
discussed in Sections 4.8 and 4.9 respectively.
4.3c). Depending on the type of construction, it may
also be possible to mobilise resistance in shear walls,
internal partitions, and in secondary elements such as
through racking in the façade system, though these
ancillary mechanisms will often be difficult to quantify.

4.8 Mechanisms of resistance

There are three principal mechanisms of resistance in
floor construction which are fundamental to the arrest
of collapse4.22, illustrated in Figure 4.3. For most
structures, redistribution of load solely through the
classical presumed mechanism of catenary action
(illustrated in Figure 4.3a) is not possible due to the
lack of rotational ductility supply available to develop
the required end rotations, and successful
redistribution of load through alternative load paths
also relies on the mobilisation of compressive arching
and/or tensile membrane action (Figures 4.3b and
4.9 Alternative load path analysis
4.9.1 Introduction
Numerous alternative load path procedures are
available, with increasing levels of complexity, and
guidance on their usage is available from several
sources4.13-4.15, 4.17-4.22, 4.24. Each have limits upon
their application and must be used appropriately. A
discussion of some of the pertinent aspects of such
analysis and indication of such limits follows in
Sections 4.9.2 to 4.9.4.

Load from structural

bays above Catenary
force

Additional
reaction
Section forces
(a) Catenary action in structural beam/column frame of an internal column after removal of a
supporting column

Compression ring

Tension
membrane

Plan
(b) Tensile membrane action developed in a flat slab after the removal of the central column

C C

T T

Section
(c) Compressive arching action between composite metal deck slab and steel floor beams

Figure 4.3 Mechanisms of resistance against collapse

The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse 39
4.9 Approaches to design against disproportionate collapse

4.9.2 Linear static procedures response of the system and therefore unknown, must
be assumed as an input variable. Assuming a
Linear static procedures are the simplest analytical dynamic load factor of 2.0 for elastic behaviour will
procedure, but contain significant assumptions and generally lead to a grossly conservative design, so for
are suited only to very limited circumstances. most practical purposes design based on linear static
Dynamic effects are modelled through the use of a analysis is not feasible or economic.
dynamic load factor, for which the maximum value is
usually 2.0 if the building is to remain elastic. 4.9.3 Nonlinear static analysis based on dynamic
energy balance
In a linear static analysis it is assumed that the
system is both geometrically and materially linear, i.e. A nonlinear static analysis which accounts for both
that large displacements do not occur and that the geometric and material nonlinearities in the
material remains elastic. Neither of these are usually structural response can provide a relatively
true in a robustness problem, and these assumptions straightforward analytical solution without the need
are therefore approximations which significantly limit for recourse to more advanced nonlinear dynamic
the extent of the application of this type of analysis. analysis. Pushover analysis is a technique
‘Overstress’ can be used as a predictor of damage originating from the seismic field, whereby the
but only when the levels of plasticity are low such that ultimate static capacity of the structure is derived
load redistribution due to yielding is insignificant. through a statically-applied lateral (‘pushover’) load.
Consequently, linear static analysis should only be Pushover analysis can be undertaken to evaluate
used when the structure remains broadly elastic. For the ultimate capacity of the structure following the
linear static analysis to be valid, none of the following loss of a column/structural element. The element is
should apply: notionally removed from the model and resistance
– irregular geometry mechanisms such as slab flexure, compressive
– irregular distribution of stiffness arching, tensile membrane action and catenary
– non-orthogonal lateral stability system action are modelled. A notional load is applied in the
– asymmetric lateral stability system direction of the removed force (Figure 4.4) and its
– irregular transfer structures. magnitude gradually increased, so that plasticity
successively develops in the structure as load is
In addition, and as a general rule of thumb, ductility redistributed until a collapse mechanism forms. The
ratios (for which ‘overstress’ factors, or force-based ultimate load capacity of the structure is hence
demand/capacity ratios, are often used as a proxy) determined as a function of the resistance
must be less than or equal to approximately 2.0 for a mechanisms modelled and the nonlinear resistance
linear static analytical procedure to be valid4.15 if the function derived. A pushover analysis does depend
failure mode is ductile. If the failure mode is not on correctly identifying the degree of freedom in
known to be ductile, more stringent overstress which failure will occur: in Figure 4.4, it is assumed
factors should be used. that the response of the structure is characterised
by the capacity in the vertical degree of freedom at
The key disadvantage of linear static analysis is that the location of the removed column.
the dynamic load factor, which is based on the
Dynamic energy balance is then undertaken by
comparing the internal strain energy, which is the
integral of this resistance function, with the dynamic
work done when the load carried in the column prior
to its removal is applied suddenly to the rest of the
structure (Figure 4.5). The force applied is of the
same magnitude as the static force; the only
difference is that it is applied suddenly. The
displacement increases until equilibrium is found
between the integrals of both curves, i.e. until the
work done equals the internal strain energy. If the
ultimate load capacity of the structure is reached
before this occurs, the system is not in equilibrium
and collapse results.

In a nonlinear system, the graphical representation is

slightly more complex but the principles are identical
(Figure 4.6).

The main caveat for a nonlinear static analysis of this

type is that the analysis is only as good as the
underlying assumptions. Also, modelling softening in
the response of the structure (as shown in Figure 4.6)
requires a displacement-based solution algorithm,
rather than a force-based solution algorithm which
cannot solve for negative stiffness. Displacement-
based algorithms are readily available in most
mainstream analysis packages.
Removed column
Pushover The ultimate load capacity of the structure will
force usually be governed by the rotational ductility supply
of the supports: if this is over-estimated, the
Figure 4.4 Pushover analysis of a multi-storey steel-framed structure robustness of the structure will also be

40 The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse

Force,
Resistance
F, R
Internal Static
strain ≡ work
energy done
(a) u Displacement
Figure 4.5 Work done vs. internal energy in a linear elastic system when the same magnitude of load is a) applied statically, and
b) suddenly applied dynamic load
Force,
Resistance
Fstat
Figure 4.6 Work done vs. internal energy in a nonlinear system
over-estimated. The ductility supply is highly
dependent upon detailing, and this must therefore
be approached (and specified if undertaken by
others) with care. The assumptions about allowable
ductility should be based on dynamic parameters:
under dynamic loading the basic yield strength of
the material is usually enhanced, but in both steel
and reinforced concrete an element can sometimes
exhibit a more brittle response than when loaded
statically, or sometimes the failure mode can change
altogether4.25-4.29.
Nonlinear static pushover analysis based on dynamic
energy balance has a number of key advantages over
linear static analysis:
– It permits ductility to be accounted for in the
structural response.
– It permits load redistribution to be accurately
modelled.
– Through the energy-based nature of the analysis,
assumptions about the dynamic load factor
associated with the removal of an element are not
required.
The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse
Approaches to design against disproportionate collapse 4.9
Force,
Resistance
R
F
Internal strain
energy
Dynamic work
done
(b) u Displacement
Internal strain energy
Dynamic work done
u Displacement
There are two major advantages of nonlinear
pushover analysis over more complex dynamic time
history analysis:
– The sensitivity of the structure to cliff edge effects
can be observed directly from the plots of strain
energy/dynamic work done.
– The sensitivity of the structural response to small
changes in the variables (material yield strength,
input load and so on) can also be rapidly evaluated.
In some cases these might be obvious from the
results already computed, but because analyses
are computationally inexpensive, sensitivities can be
thoroughly investigated with relative efficiency.
The key limitations of this type of analysis are:
– It implicitly assumes there is a single degree of
freedom which dominates the structural response,
and that this is correctly identified by the analyst.
– The results may be invalid where complex structural
effects during the shedding of load cause behaviour
to change from one degree of freedom to another,
or where contact will occur which significantly
changes the pattern of loading/mode of response.
41
4.10 Approaches to design against disproportionate collapse

Figure 4.7 Kurilpa Bridge, Brisbane

Such structures will typically be unusual, complex materials for typical Class 3 buildings. Timber is
structures and include some cable-supported and advancing rapidly in design technique and usage,
other tensile structures, structures susceptible to and designers should consult with material bodies for
buckling, and structures sensitive to torsional advice on contemporary good practice.
integrity (Figure 4.7).
General
4.9.4 Nonlinear dynamic time history analysis – Provide ties in two approximately orthogonal
horizontal directions and continuously through the
Nonlinear dynamic analysis is the most analytically structure.
rigorous and complex form of analysis described – Other than perimeter columns which should be
here, and has the ability to model the robustness anchored with transverse perimeter ties, ensure
problem with the greatest accuracy. Analysis is that columns have a balanced (symmetric) tying
generally highly complex and requires expertise in arrangement.
computational structural dynamics, and extensive – Design the tying system so that no column is tied in
verification and validation of the findings is only one horizontal direction.
necessary. Unlike nonlinear static pushover analysis – Tie each column continuously from the lowest to
whereby sensitivities can be readily observed, in a the highest level of the structure.
nonlinear dynamic analysis the investigation of – Design each column for a tensile force at least
sensitivities requires re-analysis of multiple equal to the largest total ultimate vertical dead and
scenarios. Computational run times can be very imposed load applied to the column at a single
substantial. floor level (i.e. the sum of the reactions from all the
beams/slabs connected to a column at that floor
As with the nonlinear static approach, the results of level) to which the column may be subjected in
a nonlinear dynamic analysis will only be as good as tension if support is lost from below.
the underlying assumptions and the engineer – Ensure there is a load path to successfully transfer
should be wary of the ‘black box’ phenomenon. these forces through the structure to the
The solution is computed explicitly with few foundation.
simplifying assumptions being necessary: dynamic – Make peripheral ties to perimeter columns
load factors, strain-rate dependency in the material continuous with the internal ties such that peripheral
models, damping and inertial effects can all be ties are capable of reacting the internal tie forces.
modelled explicitly. While this is attractive in terms of – Ensure peripheral ties are continuous around the
reducing the assumptions and therefore perimeter of the building.
uncertainties upon which the analysis is based, the – Wherever practicable, distribute ties evenly
results of a single dynamic time history analysis for throughout each floor and roof level.
a given case should rarely be relied upon in isolation – If beams are to be used as ties, then the floor
and sensitivity studies are essential before the slabs should be effectively anchored in the
results of a nonlinear dynamic analysis should be direction of their span; either to each other
accepted. Because of the fact that the structural continuous over their supports, or directly to
behaviour is computed explicitly, sensitivity studies their supports.
are not necessarily straightforward to undertake, nor – Design ties to be ductile, considering the strains
quick to run. associated with the rotations that connections will
have to undergo to develop resistance against
progressive collapse.
– Provide direct and robust connection between
4.10 Tying horizontal ties and vertical elements.
– At re-entrant corners or at substantial changes in
construction, ensure that ties are adequately
Effective tying is of vital importance to designing anchored or otherwise made effective.
against disproportionate collapse. Listed below are – Where the building is divided by expansion joints
some recommended principles for the design and into structurally independent sections, ensure each
detailing of ties based on steel and reinforced section is designed with an independent tying
concrete design practices as the established system.

42 The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse

Structural steel
– Typical simple connections which are adequate for
normal loads may not have adequate rotational
ductility supply for robustness. Adopt
connections such as web cleats, partial- and
full-depth end plates which have better rotational
ductility4.30. Full-depth end plates have
significantly enhanced tying resistance
compared with partial-depth end plates.
– Design connections to withstand tying forces under
the simultaneous rotation that will occur.
– Make columns continuous through each beam-
column connection.
Further guidance on the design and detailing of
structural steel to deliver robustness is available from
trade organisations4.31.
Reinforced concrete
– Place ties in the bottom flange of concrete slabs/
beams.
– Use ductility class C reinforcement to BS EN 1992-
1-14.32 or equivalent, giving a minimum elongation
at fracture of 7.5%.
– Make ties continuous through the column.
– Positively anchor precast floor slabs into the tying
system through the interlacing of tying
reinforcement into the precast element, not relying
merely on the bond between the precast slab and
the in situ screed.
– In flat slab construction, concentrate the ties in the
column strip and pass the ties between the axial
rebar of the column.
– In precast construction, particular care must be
taken in the detailing of connections to permit
robustness to be developed through the in situ
stitching.
Further guidance on the design and detailing of in situ
and precast reinforced concrete to deliver robustness
is available from trade organisations4.13, 4.33.
Tie forces
A Class 3 structure should meet the minimum tying
requirements given in BS EN 1991-1-74.34 for
Class 2A and 2B structures. However where ties are
used to provide resistance against collapse in a
Class 3 structure, the tying scheme must be
designed from first principles with the magnitude of
the tie forces derived for the hazards concerned,
considering the failure modes and the mechanisms of
resistance that will be used to redistribute forces
through the structure (Section 4.8). As well as the
magnitude of the forces that the tying scheme will be
required to resist, it is necessary to determine the
minimum levels of ductility required to develop these
forces.
As a minimum, the horizontal tie forces should at least
equal the forces specified in BS EN 1991-1-74.34 for
a Class 2A and 2B structure, and the vertical tie
forces should be capable of resisting a tensile force
at least equal to the maximum design ultimate
permanent and variable load applied to the column
at any one storey. It is good practice to include a
25% factor of safety.
4.11 Local protection of critical structural
elements
As discussed in Section 4.6, load redistribution (LR)
The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse
Approaches to design against disproportionate collapse 4.11
approaches are generally preferable to the local
protection (LP) of structural elements, which should
generally be the method of last resort. The
Eurocodes describe elements as ‘key’, for which a
notional design load of 34kPa is recommended.
Because of the terminology of ‘key element’ design
and its association with this load, this Manual avoids
this term and refers to local protection of critical
structural elements. This approach is also known as
the Specific Local Resistance Method (SLRM) in US
practice.
For high-risk buildings, the design of critical structural
elements should be approached with the utmost
caution to ensure that all possible failure modes have
been properly evaluated. The critical structural
element to be protected should be designed for the
maximum loads to which it might be subjected under
the identified hazard scenarios and, taking into
account the critical nature of the element, the
underlying assumptions should be demonstrably
conservative.
Detailed studies will often be required, for example to
model vehicle impact, blast effects and so on. These
analyses will sometimes be complex and will require
input from specialists in the relevant field. It is not
usually necessary for structural elements to be
designed to remain elastic and it will often be grossly
conservative to do so. In general, moderate damage
can be permitted provided it is limited such that the
element continues to be able to carry gravity load.
Second-order analysis will often be required to
identify issues such as P–
effects.
A guiding principle in the design of critical structural
elements is that such elements must be designed to
preclude brittle failure modes, always ensuring that
upper and lower bound assumptions are used in the
calculation of the ductile and brittle modes of
response. For example, in a column design,
conservative assumptions should be used to
calculate the minimum shear capacity, and this
compared with the maximum flexural capacity when
evaluating whether a brittle failure mode could govern
the response (Figure 4.8). A good rule of thumb is to
ensure sufficient shear capacity to resist the flexural
capacity with a 25% margin.
Capacity
Shear
Flexure (upper bound)
Shear (lower bound)
Flexure
Flexure- Shear-
governed governed
(ductile) (brittle)
failure failure
Characteristic Mixed-bound
strength strengths
Figure 4.8 Illustration of how consideration of upper-bound and lower-bound assumptions
in the derivation of flexural and shear capacities can result in a change from a ductile to a
brittle response, while at the same time increasing the calculated capacity of the element
43
4.12 Approaches to design against disproportionate collapse

4.12 Compartmentalisation to become a source of significant risk. In addition,

contractual arrangements often do not provide for
adequate supervision such as the external and
Compartmentalisation is a particular example of a LP independent check of a critical aspect of the
method which acts to reduce the hazard to the design, or the provision of supervision of the
structure as a whole by compartmentalising it in one construction of a critical component by the
part of the structure. Compartmentalisation is of most designer. Where a design contains a critical
relevance to multi-span bridges and long-span element for which a higher degree of quality
structures, where the ability to redistribute loads is management is indicated than provided for by
generally limited owing to their one-dimensional current contracts, the contracts must be revised
nature and higher magnitude of internal forces. Here, accordingly to provide what is necessary on risk
the only viable approach to preventing the horizontal grounds.
progressive collapse of multiple spans is sometimes (5) The lack of a proper inspection and maintenance
to compartmentalise the design so that a collapse strategy. This may not have been developed
affects only the immediately adjacent spans4.3 (perhaps because it was excluded from the
(Boxes 3.3, 4.1 and 4.2). However, the principle of design scope), or it may have been developed
compartmentalisation can conflict with other design and not adhered to, with the consequence that
criteria for which continuity is advantageous, such as degradation in the structure and the associated,
structural efficiency or designing out bearings from preventable, increase in risk is not arrested.
the design to minimise the risk due to lack of
inspection and maintenance. Owing to the lower level
of continuity, compartmentalised structures are often
significantly more susceptible to progressive collapse
during construction when the load path is incomplete
than in their final configuration, and particular care is
therefore needed during erection.

Compartmentalisation does also have some utility in

multi-storey buildings, for example by designing a
gate house, screening area or loading bay to be
structurally separate to the occupied parts of the
building such that an explosion hazard, while causing
gross damage in this area, will not affect the main
part of the structure.

4.13 Procedural measures

The broad principles that should be applied when

considering procedural measures were described in
Section 4.1. The value of procedural measures is
better explained through reference to past collapses
where there have been significant procedural failings,
from which much can be learned. A number are
discussed in Boxes 4.2 to 4.5. The key deficiencies
common to these and to other failures are:
(1) The lack of information flow. This may be the
straightforward failure to communicate
information, or be as a consequence of
contractual issues or design team interfaces
(including the lack of interface with designers not
yet appointed).
(2) The lack of clarity of design responsibility. Gaps or
overlaps in scope, lack of clarity on where the
responsibility for decisions lies, and the lack of
clarity about coordination of different scopes of
work can all be a source of significant risk.
(3) The lack of knowledge. This could materialise in
any area of design or construction, due to lack of
training, lack of awareness of ‘near misses’, past
failures and similar phenomena in other areas of
the industry, lack of supervision of junior staff, lack
of competence to undertake a particular scope of
work with which the individual has been tasked/
the company has been appointed and so on.
(4) The lack of quality management. Lack of quality
management often results from a straightforward
failure to adhere to agreed quality standards,
perhaps due to cost or time pressures, with the
consequence that human error that could have
been prevented remains undetected and goes on

44 The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse
 Approaches to design against disproportionate collapse 4.13

Box 4.2 Failures in quality control of design and construction, West Gate Bridge, Melbourne, October 1970
On 15 October 1970, a 367ft span of western approach of the West Gate Bridge over the River Yarra suddenly collapsed during
construction. The bridge was of a similar trapezoidal box girder design to the Milford Haven Bridge which collapsed a year earlier,
in response to which changes were made to strengthen the design. Each span of the bridge was constructed as two full-length
half-width girders which were bolted together along the longitudinal splice so created. The transverse beams which formed
simply supported beams in their final condition were cantilevered at this time, and the half-girders susceptible to buckling.
The specific action initiating the collapse was the removal of a number of bolts from a longitudinal splice in the upper flange plating
close to mid-span. The bolts were removed in an attempt to straighten out a buckle which had occurred in one of the panels
constituting the upper flange. The buckle had, in turn, been caused by the application of 80T kentledge as a point load at midspan,
in an attempt to overcome difficulties caused by errors in camber. A camber difference of approximately 4.5 inches had existed
between the two half-girders of the span.
The previous span on the eastern approach had suffered a similar but less severe camber difference in the height of the webs,
together with severe buckling of the projecting plate edge forming the upper flange. The camber difference was removed by
jacking up the lower span using four 200T hydraulic jacks and local hydraulic jacks to remove the buckle in the projecting plate
edge.
For the west span the contractor proposed to use kentledge on account of the fact that time might be saved, though no
supporting calculation was undertaken either by the contractor or the designer. During the operation the use of kentledge was
noted to have caused a buckle to develop and the ‘obvious’ overstress due to kentledge noted by the site engineers. The
unfastening of the bolts immediately prior to the collapse in an attempt to correct this buckle had caused it to spread to adjacent
panels.
The Royal Commission into the collapse4.35 attributed the failure of the collapse to two main causes. Primarily, the designers had
‘‘failed to give a proper and careful regard to the process of structural design and to the check of the safety of the erection
proposals put forward by the contractors’’. As a consequence, the factors of safety for the bridge were inadequate during erection
and would also have been inadequate in-service had the bridge been completed. The secondary cause leading to the disaster was
the unusual method proposed by the contractor to use kentledge to correct the camber difference in the erection of the span. The
erection, if to be successful, required more than usual care on the part of the contractor and a consequential responsibility on the
consultants to ensure that such care was indeed exercised, neither of which were met.
A total of 35 people died in the collapse. The Royal Commission found that ‘‘the disaster. . .was utterly unnecessary. The reasons for
the collapse are to be found in the acts and omissions of those entrusted with building a bridge of a new and highly sophisticated
design. [. ..] Among those engaged upon the design and construction of the steel spans there were mistakes, miscalculations,
errors of judgement, failure of communication and sheer inefficiency. [.. .] Error begat error. . .and the events which led to the
disaster moved with the inevitability of a Greek Tragedy’’.

The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse 45
4.13 Approaches to design against disproportionate collapse

Box 4.3 Gross design error and lack of single point of responsibility, Hartford Civic Center, Connecticut,
January 1978
The Hartford Civic Center Coliseum collapsed in the early hours of the morning of 18 January 19784.36, 4.37 under the weight of
snow and ice following a 10 day storm which, while significant, was not out of the ordinary. The construction of the building had
been completed in 1973 and had been used to house ice hockey games for five years, including one game the night immediately
before the collapse. The roof was designed as a pyramidal space frame, innovative at the time and noted for being one of the first
large-span roofs made possible by computer design and analysis.
The roof was designed to span 82
64m over the arena, which seated 10000 spectators. Horizontal chords were spaced 6.4m
apart, diagonally braced with an intermediate layer of horizontal members providing stability to the diagonal bracing members.
Back-to-back angle sections were used to form cruciform built-up sections for the main chord members, with offsets between the
node and the intersection of the bracing members due to the open nature of the chord sections. Computational analysis was used
to verify the design against elastic buckling.
During construction, the inspection agency notified the engineers that it had found excessive deflection in some of the nodes but no
action was taken. Once lifted into its final position, the measured deflection was found to be twice that predicted by the analysis,
but the engineers responded that such discrepancies between the actual and the theoretical should be expected4.38. After
completion of the roof, a member of the public expressed concern about the large downward deflection in the arena roof, but the
engineer and the contractor assured the authorities that the building was safe.
The investigation into the collapse found that three major design errors in the original design contributed to the collapse. The joints
of truss members were modelled as having zero eccentricity, an incorrect assumption which put additional stresses due to bending
moments into the members. Compression members in the top chord were under-designed and braced against buckling only in one
plane. The self-weight of the roof was under-estimated by 20% as 0.9kPa in the analysis, compared with an actual self-weight of
1.1kPa. In a separate investigation, torsional buckling capacity of members near the roof buttresses was also cited as a possible
reason for the collapse. On the night of the collapse the total load acting on the roof was 3.2-3.5kPa (of which the snow load was
0.7-0.9kPa), well below what the design capacity of the roof should have been without the errors, which was at least 6.7kPa.
The Hartford Arena contract was divided into multiple subcontracts, leading to a lack of clarity over who was responsible for the
project as a whole. Although the appointment of a qualified structural engineer to oversee the construction was recommended, the
construction manager opted to take on all the inspection responsibilities himself: as noted by the investigation, ‘‘inspection of his
own work by the construction manager is an awkward arrangement’’4.39. As a result, the system of checks and balances was
eliminated at a stroke and the design engineers were not on site during construction. The construction manager asserted his
responsibility to be only for the correct execution of the design and not for the performance of the project as a whole. Consequently
the design engineer did not have access to full information during the construction, and the significance as a precursor of collapse
of obvious bowing of structural members in the top layer of the space frame which occurred during construction was not
recognised.
The issues in management of the construction in the Hartford Arena collapse illustrates the importance of the responsibility for the
integrity of the design resting with one person. Further, the city of Hartford did not require the peer review of the arena design
usually required for projects of this magnitude, thus making it more likely that errors went undetected. Peer reviews for high-
capacity buildings and structures designed using new techniques are cited as essential by Feld4.40 and SCOSS4.41. The
consideration of the impact of a possible failure in determining suitable partial safety factors and the use of increased partial safety
factors in buildings with high occupancy is recommended by Kaminetzky4.42.

46 The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse
 Approaches to design against disproportionate collapse 4.13

Box 4.4 Sleipner A offshore platform, 1991

In August 1991, the Sleipner A concrete cellular gravity base offshore platform sank in a Norwegian fjord near Stavanger during a
controlled ballast test of the base prior to installation of the topside structure4.43-4.47. The failure occurred in a ballast cell wall
under hydrostatic pressure when the platform reached a depth of 65m. The Norwegian organisation SINTEF investigated and found
that the cause of the failure was an undetected error in the finite element analysis, resulting in under-estimation of stresses by
47%, which led to the shear failure of the cell wall and rapid intake of water. The finite element mesh used for the analysis was too
coarse to accurately resolve peak shear stresses in the base structure, and as a result the reinforcement in shear-critical sections
was detailed with inadequate development lengths. Consequently a simple modelling error, which could have been detected by hand
calculations and prevented through two simple changes to the reinforcement detailing, led to a $700 million economic loss. The
accident demonstrates the importance of verification of computer-generated analysis output by experienced engineers to ensure
proper use of analysis and design techniques.
The base was subsequently redesigned, entirely by hand, and the platform was completed in June 1993. The sinking led to
changes in the design philosophy for concrete gravity base platforms with the introduction of additional extensive risk analysis
criteria, including analysis for impact damage and design for platform stability in the event that one of the buoyancy cells or other
compartments is damaged.

Box 4.5 Bad Reichenhall Ice Rink roof collapse, 2 January 2006
On 2 January 2006, the roof of Bad Reichenhall Ice Rink collapsed due to a 30-40cm snow fall on New Year’s Day, killing 15 and
injuring 304.48. The snow load was well within the calculated design snow load for the structure. The structure was a 75
48m
timber roof construction with 2.87m high glulam box girder beams at 7.5m on centre. The investigation into the collapse found that
design errors and a limited understanding of durability issues were the main causes of the failure. In the structural design, the
weakening of the structure as a result of finger-joints in the timber was disregarded. The design also used urea-formaldehyde glue,
which is moisture-sensitive and is therefore unsuitable for high humidity conditions such as in an unheated, non-air conditioned ice
rink where the relative humidity is high and the thermal air movements lead to condensation on the underside of the roof structure.
Furthermore, there were repeated cases of water penetration as a result of leaks in both the roof membrane and the roof drainage
system, which exacerbated the water damage to the adhesive. The failure was triggered by the snow load in a box girder on the
east side of the building. Cross-beams transferred the load to the adjacent girders, and a horizontal progressive collapse
propagated through the roof structure.

The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse 47
4.14 Approaches to design against disproportionate collapse
4.14 References
4.1 Institution of Structural Engineers. Safety in tall
buildings and other buildings of large occupancy.
London: IStructE, October 2010.
4.2 Beeby AW. Safety of structures, and a new approach
to robustness. The Structural Engineer
1999;77(4):16-21.
4.3 Starossek U. Avoiding disproportionate collapse of
major bridges. Structural Engineering International
2009;3/2009:289-297.
4.4 Bussell MN, Jones AEK. Robustness and the relevance
of Ronan Point today. The Structural Engineer
2010;88(23/24):20-25.
4.5 Bussell MN, Jones AEK. Robustness and the relevance
of Ronan Point today – discussion. The Structural
Engineer 2011;89(4):Online extra 1-2 et seq.
4.6 Standing Committee on Structural Safety (SCOSS).
15th biennial report. London: June 2005.
4.7 Carpenter J. The systematic risk assessment of UK
Building Regulations class 3 structures. Proceedings of
the Institution of Civil Engineers – Structures and
Buildings 2012. DOI: http://dx.doi.org/10.1680/stbu.
12.00004.
4.8 Institution of Structural Engineers. Practical guide to
structural robustness and disproportionate collapse in
buildings. London: IStructE, October 2010.
4.9 Institution of Civil Engineers, Institution of Structural
Engineers. Meeting report: avoiding disproportionate
collapse – the use of ‘systematic risk assessment’.
Joint meeting between the Institution of Civil Engineers
and the Institution of Structural Engineers held at
11 Upper Belgrave Street on 13 February 2012.
London: ICE, February 2012. Available from: http://
www.ice.org.uk/topics/structuresandbuildings/
Avoiding-Disproportionate-Collapse [Accessed
2012-12-28].
4.10 Standing Committee on Structural Safety (SCOSS).
Guidance note: independent review through peer
assist. SCOSS topic paper SC/09/034. January 2009.
4.11 British Standards Institution. BS EN
1990:2002 þ A1:2005 incorporating corrigenda
December 2008 and April 2010. Eurocode: Basis of
structural design. London: BSI, 27 July 2002 and 2010.
4.12 British Standards Institution. NA to BS EN
1990:2002 þ A1:2005 incorporating National
Amendment No. 1. UK National Annex for Eurocode:
Basis of structural design. London: BSI, 15 December
2004 and 2009.
4.13 federation international du béton (fib). fib Bulletin 63:
Design of precast concrete structures against
accidental actions. Guide to good practice. Lausanne:
2012.
4.14 Cormie D. Robustness. In: ICE manual of structural
design: buildings, Bull J, Editor. London: Thomas
Telford, 2012.
4.15 United States Department of Defense. Unified Facilities
Criteria UFC 4-023-03: Design of Buildings to Resist
48 The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse
Progressive Collapse. Washington, D.C., 14 July 2009
(including Change 1 – 27 January 2010).
4.16 Faber MH, Narasimhan H. Robustness of structures:
final report of COST Action TU0601. September
2011. Available from: Available from: www.
cost-tu0601.ethz.ch.
4.17 Ellingwood BR, Dusenberry DO. Building design for
abnormal loads and progressive collapse.
Computer-aided civil and infrastructure engineering
2005;20(3).
4.18 Ellingwood BR, Smilowitz R, Dusenberry DO et al. Best
practices for reducing the potential for progressive
collapse in buildings. NISTIR 7396. National Institute of
Science and Technology, U.S. Department of
Commerce, February 2007.
4.19 Dusenberry DO, Hamburger RO. Practical means for
energy-based analyses of disproportionate collapse
potential. Journal of Performance of Constructed
Facilities 2006;20(4):336-348.
4.20 Izzuddin BA, Vlassis AG, Elghazouli AY et al.
Progressive collapse of multi-storey buildings due to
sudden column loss – Part I: simplified assessment
framework. Engineering Structures
2008;30(5):1308-1318.
4.21 Vlassis AG, Izzuddin BA, Elghazouli AY et al.
Progressive collapse of multi-storey buildings due to
sudden column loss – Part II: application. Engineering
Structures 2008;30(5):1424-1438.
4.22 Cormie D, Mays G, Smith P. Blast effects on buildings.
2nd edition ed. London: Thomas Telford, 2009.
4.23 Kunishima M. Collapse accident under New Haengju
Bridge construction work [Seoul City, Korea. July 31st,
1992]. Failure Knowledge Database/100 Selected
Cases. Available from: www.sozogaku.com/fkd.
4.24 Ruth P, Marchand KA, Williamson EB. Static
equivalency in progressive collapse alternate path
analysis: reducing conservatism while retaining
structural integrity. Journal of Performance of
Constructed Facilities 2006;20(4):349-363.
4.25 Ansell A. The dynamic shear capacity of concrete
structures. Structural Concrete 2007;8(3):147-154.
4.26 Magnusson J, Hallgren M, Ansell A. Air-blast-loaded,
high-strength concrete beams. Part I: Experimental
investigation. Magazine of Concrete Research
2010;62(2):127-136.
4.27 Magnusson J, Hallgren M, Ansell A. Air-blast-loaded,
high-strength concrete beams. Part II: Numerical
investigation. Magazine of Concrete Research
2010;62(4):235-242.
4.28 Tyas A, Warren JA, Stoddart EP et al. A methodology
for combined rotation-extension testing of simple steel
beam to column joints at high rates of loading.
Experimental mechanics 2012;52:1097-1109.
DOI: 10.1007/s11340-011-9562-4.
4.29 Stoddart EP, Byfield MP, Davison JB et al. Strain rate
dependent component based connection modelling for
use in non-linear dynamic progressive collapse
analysis. Engineering Structures 2012. DOI: 10.1016/
j.engstruct.2012.05.042.
 Approaches to design against disproportionate collapse 4.14

4.30 The Steel Construction Institute. Joints in steel span timber structures. Proceedings of the 10th world
construction. Simple joints to Eurocode 3 (P358) (the conference on timber engineering. Miyazaki, Japan:
‘‘Green Book’’). Ascot: The Steel Construction Institute/ June 2-5, 2008.
The British Constructional Steelwork Association, 2011.

4.31 Way AGJ. Guidance on meeting the robustness

requirements in Approved Document A (2004 edition).
SCI Publication P341. Ascot: The Steel Construction
Institute, 2005.

4.32 British Standards Institution. BS EN 1992-1-1:2004

incorporating corrigenda January 2008 and November
2010. Eurocode 2: Design of concrete structures.
General rules and rules for buildings. London: BSI,
31 August 2011.

4.33 Brooker O. How to design concrete buildings to satisfy

disproportionate collapse requirements. TCC/03/45.
October 2008.

4.34 British Standards Institution. BS EN 1991-1-7:2006.

Eurocode 1: Actions on structures. Part 1-7: General
actions: Accidental actions. London: BSI, September
2006.

4.35 Report of the Royal Commission into the failure of the

West Gate Bridge. 2.-7037/71. Melbourne, Victoria:
1971.

4.36 Rihani S. Structural failures – a case study: Hartford

Coliseum. ASCE Structural Engineering Institute (SEI),
September 2005.

4.37 Delatte NJ. Forensic case studies for civil engineers.

ASCE Press, 2009.

4.38 Levy M, Salvadori M. Why buildings fall down: how

structures fail. New York, NY: W.W. Norton, 1992.

4.39 Wearne P. Collapse: when buildings fall down.

New York: TV Books, LLC, 2000.

4.40 Feld J, Carper K. Construction failure. 2nd ed.

New York, NY: John Wiley & Sons, 1997.

4.41 Standing Committee on Structural Safety (SCOSS).

16th biennial report. London: June 2007.

4.42 Kaminetzky D. Design and construction failures:

lessons from forensic investigations. New York, NY:
McGraw-Hill, 1991.

4.43 Jakobsen B, Rosendahl F. The Sleipner platform

accident. Structural Engineering International
1994;4(3):190-193.

4.44 Jakobsen B. The Sleipner accident and its causes.

Engineering Failure Analysis 1994;1(3):193-199.

4.45 Holand I. Structural analysis of offshore concrete

structures. IABSE Congress Report 1996;15:875-880.

4.46 Selby RG, Vecchio FJ, Collins MP. The failure of an

offshore platform. Concrete International
1997;19(8):28-35.

4.47 Tretiakova K. Sleipner A-1 Gravity Base Structure:

Integrated BAE/MS thesis submitted to the Department
of Architectural Engineering, Pennsylvania State
University. 2012.

4.48 Winter S, Kreuzinger H. The Bad Reichenhall ice-arena

collapse and the necessary consequences for wide

The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse 49
5 Example systematic risk assessment

5.1 Worked example building might reasonably be subjected (this is a

partial list and is unordered):
1 Errant truck/bus impact at ground level
This chapter outlines a systematic risk assessment 2 Fire during occupation
for an example building. It is necessarily incomplete
for the sake of brevity, but highlights the main 3 Fire during refurbishment/refit
aspects and decisions made. 4 Vehicle-borne IED at ground level
5 Vehicle-borne IED in loading bay
Design brief 6 Person-borne IED
A new 32-storey steel-framed office building with a 7 Instability of foundation during construction
glazed curtain-wall façade is to be constructed in 8 Failure of temporary works design to provide
the City of London on a site bordered by roads on necessary interim stability during construction
two sides. The building will generally be Class A
9 Lack of coordination between operations of the
office accommodation but will feature a publicly two construction sites, e.g. accidental
accessible exhibition space at the top of the building construction plant movements, excavation
offering views over the City, open for ticketed leading to loss of stability to retaining wall, etc
access by the general public. The building will be
structured on a 9m grid at the perimeter with 18m 10 Numerical or conceptual mistakes in the analysis
internal spans, and at ground level the building line and design
will be cut back to increase the space available to 11 Failure of a critical structural element
pedestrians, such that the perimeter columns are
exposed at ground level. In order to further increase Step 2: Eliminate hazards where feasible to do so
the pedestrian environment, the column spacing will 5 Explosion in loading bay: measures have been
be doubled at ground level. The lateral stability investigated to locate the loading bay such that it
system has not yet been designed. The building will is not situated beneath the footprint of the high-
feature a below-grade loading bay. The basement rise building but is instead situated beneath the
will be constructed within the line of the basement podium building. Due to the topography of the site
of the existing buildings on the site, and the this is not feasible.
foundation will be piled. A podium building, which is 7 Lack of coordination between operations of the
completely structurally separate, is also to be
9 two construction sites: following a review
constructed on the immediately adjacent site by the between the client, the structural engineers and
same client, but is being designed by another the project managers for construction sites, it
design team. has been recommended to the client that
superstructure construction is phased, with the
The UK Centre for the Protection of National high-rise building being built first. Method
Infrastructure (CPNI) has advised the client that the statements for the construction of the podium
building should be designed to withstand a building will be based on the high-rise building
vehicle-borne improvised explosive device (VBIED), already being constructed, which eliminates the
and has highlighted the risk associated with the hazard due to instability of the foundation during
viewing gallery which they advise carries a higher construction and accidental construction plant
likelihood in relation to a person-borne improvised movements from the adjacent site.
explosive device. Recommendations are given for the The substructure will be common to both sites,
design basis for each scenario. eliminating hazards associated with instability
during excavation of the site. In order to minimise
delays to the overall construction programme
Project team associated with the phasing of the
The firm of consulting structural engineers superstructure construction for the two buildings,
undertaking the design has direct, relevant the basement will be constructed using
experience in high-rise building design. The top-down construction.
appointment is from RIBA Stage C (concept design)
to practical completion. No contractor is appointed, Note that other hazards have been considered and
but the engineer requests the appointment of a cannot be eliminated.
competent contractor retained under a pre-
construction services agreement (PCSA) to assist in Step 3: For the hazards that remain, determine
developing the systematic risk assessment and the level of tolerable risk
provide pre-construction advice relevant to design The structural engineer has reviewed the risk matrix in
proposals for risk reduction. Section 3.1 and has determined that it is suited to
the design with the tolerable risk threshold as
indicated.
Step 1: Identify the hazards
A hazard identification workshop is undertaken Step 4: Evaluate the risks
involving the structural engineer, the architect, the For each hazard:
geotechnical, fire and blast engineers and the client. – determine the likelihood of the hazard
The CDM coordinator is part of the client organisation – calculate the consequences should the hazard
and is asked to chair the workshop. The workshop materialise
identifies the following dominant hazards to which the – quantify the risks associated with each hazard.

50 The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse

Likelihoods are ascribed to the hazards by reference
to the scale of likelihood in Table 3.1, based on how
often each hazard might be expected to occur during
the design life of the building. The consequences of
each hazard are evaluated through analysis, the results
of which (with reference to Table 3.2) are as follows:
1 Errant truck/bus impact at ground level:
maximum impact velocities are calculated and
impact analysis shows that column will be
damaged and need repair but will continue to
carry self-weight.
2 Fire during occupation: structural fire analysis
shows that complete collapse of the fire floor will
occur, with consequent impairment of egress
routes from floors above.
3 Fire during refurbishment/refit: structural fire
analysis shows that complete collapse of the fire
floor will occur, with consequent impairment of
egress routes from floors above.
4 Vehicle-borne IED at ground level: advice is
sought from CPNI on suitable charge weights for
design. Blast analysis is undertaken which shows
that the column closest to the blast will be lost,
but that loss of multiple columns will not occur.
Loss of floor slabs will occur local to the device
over two storeys.
5 Vehicle-borne IED in loading bay: advice is
sought from CPNI on suitable charge weights for
design. Blast analysis is undertaken which shows
that the complete structural collapse will not
occur, but that the escape routes will be
impaired due to the internal propagation of blast
pressures.
6 Person-borne IED: internal structural columns are
analysed at the ground floor entrance and in the
exhibition space. Under the charge weight
advised by CPNI, it is shown that structural
columns in the exhibition space can resist the
blast load without loss of their loadbearing
capacity under gravity load, but at ground floor
level collapse occurs.
8 Failure of temporary works to provide necessary
interim stability during construction: top-down
construction will be used for the basement
and temporary works will be required to
provide support to the superstructure frame
during the excavation of the basement. The
ground floor slab acts as a transfer slab and
its failure will cause a significant structural
collapse.
10 Numerical or conceptual mistakes in the analysis
and design: the potential is recognised for
mistakes to be made by the design team.
Mistakes may be a modelling error due to misuse
of the computational analysis software or may be
in the design and detailing of the structure.
Mistakes could occur through inadequate
experience or if there is inadequate supervision
during the design. If in the analysis or design of a
critical structural element such as a transfer beam,
they may result in a severe structural collapse. It is
not feasible to give a statistical probability of the
occurrence of such an error, but considering the
design as a whole and the quality management
systems in place, the likelihood of an error
sufficient to cause a severe structural collapse is
judged as ‘rare’ (2% probability of occurrence).
11 Failure of a critical structural element: the failure
of a critical structural element such as a
transfer element could lead to a severe
The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse
Example systematic risk assessment 5.1
structural collapse. The likelihood of such a
failure occurring somewhere in the design is
again judged as ‘rare’ (2% probability of
occurrence).
Note that hazards 7 and 9 have been eliminated
from the design and are not shown.
The risks so evaluated are shown in Figure 5.1.
Step 5: Identify risk reduction measures
Scenario-independent design is undertaken using the
nonlinear static approach based on dynamic energy
balance outlined in Section 4.9.3. This finds that it is
feasible to sustain the loss of any typical column on a
9m grid, but that the perimeter columns at ground
level on an 18m grid cannot be lost. The loss of a
column in the loading bay can also not be sustained.
Dealing with the hazards in order of their ‘raw’ risk:
2 Fire during occupation or refurbishment/refit: The
3 nonlinear static analysis shows that substitution
of fin plate connections for full-depth end plates
on the secondary beams, together with a slight
increase in the section weight, avoids the need
for fire-proofing of the sections. This provides
robustness by design and also eliminates any
additional through-life hazards associated with
fire following damage to the fire protection during
the life of the building or a fire while the fire
protection is being replaced during maintenance
or refurbishment (see Box 5.1).
Commentary: although shown on the general risk
matrix as being in the intolerable range, through
discussion with the Building Control Officer a
variation is agreed in the level of tolerable risk
and the appropriate performance criterion for this
hazard is agreed as being that collapse of the
complete fire floor will not occur. This is agreed
on the basis that the assumptions in evaluating a
fire during occupation (hazard 2 ) are extreme,
requiring the failure of the fire detection and
suppression systems.
For fire during refurbishment/refit (hazard 3 ),
a supplementary risk assessment will be
prepared at the time of the work, when any
additional necessary measures can be identified.
The requirement is therefore set as being that the
passive fire resistance of the building is sufficient
to contain the collapse to the fire floor. This
performance is achieved, and the magnitude of
this risk is therefore accepted as tolerable for this
hazard.
The risks associated with a fire during the future
retrofit of the building, when the fire detection and/
or sprinkler systems may be inactive, are identified
using structural fire analysis. The risks cannot be
evaluated in detail but a retrofit plan is prepared
which highlights the particular factors that will
need further, more detailed consideration. This
precludes the removal of firestopping and puts
limitations on the storage of combustible materials
to minimise the fire load when the fire detection
and/or sprinkler systems are deactivated, and
includes the results of a structural fire analysis
documenting the structural behaviour in this
scenario.
8 Failure of temporary works to provide necessary
interim stability during construction: the desired
construction sequence requires that the
superstructure is constructed simultaneously with
the excavation of the basement, and therefore
significant propping is required to support
51
5.1 Example systematic risk assessment

Consequence

Catastrophic
Substantial
Significant
Minimal

Serious

Severe
Minor
Likelihood
Frequent/common

Likely 1

2 3
Unlikely 8

6
Rare 10 11

Improbable 4 5

Negligible

Key
Raw risk Mitigated risk

1 Errant truck/bus impact at ground level

2 Fire during occupation
3 Fire during refurbishment/refit
4 Vehicle-borne IED at ground level
5 Vehicle-borne IED in loading bay
6 Person-borne IED
8 Failure of temporary works design to provide necessary interim stability during construction
10 Numerical or conceptual mistakes in the analysis and design
11 Failure of a critical structural element

Figure 5.1 Raw risk matrix

Box 5.1 Torre Windsor, Madrid, 2005

Torre Windsor was a 30-storey office building constructed in the 1970s
which suffered a fire in 2005 during refurbishment5.1. The building
comprised a reinforced concrete frame structure with loadbearing
steel edge columns, with a strong floor at the 17th storey. The
refurbishment included improvement to the fire protection and
escape provision of the building by installing a sprinkler system, fire
protection to the steel edge columns, a new steel escape stair and
new fire doors. During construction a fire broke out on the 21st
floor. The fire spread was exacerbated by the lack of firestopping
and operational fire doors. The sprinkler system had been installed
but was not yet operational. Fire protection had not yet been
installed to the loadbearing edge columns above the 17th floor. The
fire burned for 19 hours, during which time it spread downwards to
the second floor and upwards to the top of the building. The fire
resulted in collapse of the floors above the strong floor on the 17th
floor level because the edge columns, which had not been fire
protected, lost their required load capacity and caused sections of
the building above the 17th floor level to collapse. The collapse
progressed vertically such that the entire part of the building above
the 17th floor level collapsed. It is likely that only the strong floor at
the 17th floor level prevented the total progressive collapse of the
building.

52 The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse

basement slabs prior to the gain of full strength.
The temporary works designer is not appointed,
and therefore the risk cannot be immediately
addressed in the temporary works design;
however the PCSA contractor helps to develop
outline method statements and a propping
scheme, which together provide sufficient plant
access for excavation. The risks associated with
the impact of the temporary works design on the
main structure are articulated and will be
included in the temporary works designer’s brief.
10 Numerical or conceptual mistakes in the analysis
and design: the firm’s normal (QA) procedures
will apply and, as is normal design practice, hand
calculations are used to check the results of
computer output. For this type of building the
firm’s QA procedures include a Category 2
check, which is undertaken by a suitably qualified
and experienced team that may be from the
same organisation but is independent from the
design team and using a different software
package.
In addition to these measures, it is also proposed
to:
– Provide a peer reviewer at commencement of
the design to examine the proposed structural
design philosophy and approach to design
against disproportionate collapse, and to follow
this as it evolves through the design process.
– For critical structural elements as identified in
the nonlinear static analysis, increase the level
of checking by introducing ‘gateway’ checks
where the designers must justify the design to
the peer reviewer before proceeding.
11 Failure of a critical structural element: it is
proposed that enhanced levels of quality
management are implemented for critical
structural elements for all participants in the
supply chain, both off- and on-site. This will be
implemented as follows:
– Specification of reliability class RC3 and
inspection level IL3 (BS EN 1990:2002
Annex B5.2 ) in the construction specification for
these elements for extended and third party
inspection. For other parts of the structure,
RC2 and inspection level IL2 is specified.
– Specification of execution class EXC4
(BS EN 1090-2:2008 Annex B5.3 and
(a) Transfer beam at first floor level
Figure 5.2 Structural framing options (representative section)
The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse
Example systematic risk assessment 5.1
PD 6705-2:20105.4) in the construction
specification of the execution standards for
structural steel, and of execution class EXC3
(BS EN 13670:20095.5) for in situ reinforced
concrete. For other parts of the structure,
EXC3 and EXC2 are specified for structural
steel and reinforced concrete respectively.
Similar execution quality standards are
specified for other materials.
– Design of these elements using off-site
fabrication to permit higher quality control.
– Third-party inspection during off-site fabrication
of these elements.
– Supervision of the construction of these
elements on-site by the designer.
5 Vehicle-borne IED in loading bay: a vehicle barrier
designed in accordance with PAS 685.6 and
PAS 695.7 to withstand a hostile impact can be
installed at the head of the ramp (option 5a). This
provides a technically functional solution but the
structural engineer identifies the risk of human
error or the failure of the vehicle blocker which
would compromise the security. An alternative
scheme is proposed based on vehicle lifts
(option 5b), which has the advantage of reducing
the overall footprint of the basement. The vehicle
lifts prevent inadvertent loss of security to the
basement due to human error or duress in the
operation of the vehicle blocker. In either
scheme, a gatehouse will be incorporated at the
service vehicle entrance such that vehicles can
be checked prior to being admitted to the
basement.
Note that these measures reduce risk so far as is
reasonably practicable, given the loading bay
cannot be relocated from under the building. Of
the two options, option 5b (vehicle lifts) gives the
greater reduction in risk.
4 Vehicle-borne IED at ground floor: two schemes
are considered in the structural design (Figure 5.2).
A transfer beam can be incorporated at first floor
level to transfer from the 9m to the 18m grid. The
transfer beam cannot sustain the loss of the
intermediate column (i.e. a 36m span) and this
column therefore is a critical structural element
and requires local protection. This may be
provided by strengthening the structural section,
or by providing vehicle bollards at the kerbline to
increase stand-off from the column (option 4a).
(b) Vee-columns from ground to third floor level
53
5.1 Example systematic risk assessment

Alternatively (option 4b), vee-columns are internal area. However, loss of a node at ground
proposed from ground to third floor level which level produces an unsupported span of only 18m.
involves the first and second floor levels also being Local protection as a critical structural element is
cut back and the consequential loss of this net therefore not required. While analysis shows that
the transfer beam is unlikely to fail, its critical
nature is noted and it being moved up by one
storey reduces the risk of failure of this element.
(a) 300mm (b) 1 Errant truck/bus at ground level: structural
measures proposed in response to the risk from
an explosion at the ground floor (refer to option
4b) provide the same reduction in consequences
resulting from loss of a column under a vehicle
impact. This therefore reduces the risk by
providing scenario-independence; however, an
analysis undertaken of the impact of the vehicle
onto the structural section shows that the
column will suffer moderate damage but will
continue to be able to carry gravity load.
6 Person-borne IED: a sensitivity study is
undertaken which establishes that 300mm
stand-off achieved through the architectural
cladding dimensions will be sufficient to prevent
loss of the column (Figure 5.3a). Alternatively,
Figure 5.3 Options for protection of columns against a person-borne IED tubular rather than open sections (Figure 5.3b)

Consequence

Catastrophic
Substantial
Significant
Minimal

Serious

Severe
Minor
Likelihood

Frequent/common

Likely 1 1

2,3
2 3 2 3
Unlikely 8
8
6 6
6
Rare 10 11

10 11

Improbable 4 4 4 5
4b 4a
5 5a
Negligible 8
10 11 5 5b

Key
Raw risk Mitigated risk

1 Errant truck/bus impact at ground level

2 Fire during occupation
3 Fire during refurbishment/refit
4 Vehicle-borne IED at ground level
5 Vehicle-borne IED in loading bay
6 Person-borne IED
8 Failure of temporary works design to provide necessary interim stability during construction
10 Numerical or conceptual mistakes in the analysis and design
11 Failure of a critical structural element

Figure 5.4 Risk matrix showing raw and mitigated risks

54 The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse
 Example systematic risk assessment 5.1

are less sensitive to the blast effects and will
avoid collapse, but have a 20% cost premium on
the cost of connections due to the additional
complexity of forming the beam/column
connections.
– independent internal (Category 2) check and
external peer review for critical structural elements
– enhanced quality management of supply chain and
construction for critical structural elements
– vehicle lift.

The risk matrix showing both the raw and the
mitigated risks is shown in Figure 5.4.
Step 6: Perform a cost-benefit assessment
Weigh the reduction in risk in relation to the cost
of the measure. A given mitigation measure will
sometimes reduce the risks associated with
several hazards, and the total risk reduction
across all impacted hazards must be used in the
cost-benefit assessment of each measure. The
cost-benefit assessment is shown in Table 5.1.
‘Benefit’ is derived directly from the risk matrix in
Figure 5.4. ‘Cost’ is all other metrics against which
this is weighed, i.e. financial cost, programme,
amenity and so on. Risk reduction measures are
ranked from top to bottom in terms of the risk
benefit.
Step 7: Identify the risk reduction measures to
be implemented and incorporate them in the
design
Based on the evaluation of the risks and the tolerable
risk threshold, it is agreed with the client that the risk
reduction measures to be implemented are as
follows:
– stand-off around columns at ground floor level
– full-depth end plates to secondary beams
– initial development of temporary works design
– vee-columns/move transfer beam to third floor level
Based on the cost-benefit assessment, the
implementation of these measures is judged to
reduce the risks in the design so far as is reasonably
practicable.
Step 8: Review the residual risk
The residual risks are shown in the risk matrix in
Figure 5.5. These are discussed with the client,
together with the inspection and maintenance plans
for the building which includes the fire retrofit plan
developed in Step 5.
Step 9: Check the risk assessment
Sensitivity studies are performed to investigate the
following:
– Cliff edge effects: modes of failure are generally
found to be ductile. The only cliff edge effect
found is the risk of two vee-columns failing – this
is found to occur significantly above the
maximum loads associated with the hazards
considered.
– Low likelihood/high consequence hazards:
changes in the assumptions made about
likelihood and consequence of the VBIED events
are not found to change the decisions made
about the measures to be implemented to
reduce risks.
– Combined hazards: combined hazards have not
been considered directly in the risk assessment. Fire
may follow an explosion. The lack of reliance on

Table 5.1 Cost-benefit assessment

Risk reduction measure Cost Benefit (from Figure 5.4)
Stand-off around columns at ground floor level Cost: £minimal 6 6
Full-depth end plates to secondary beams Connections: £þ 2 2
Removal of fire protection: £ +
3 3

Initial development of temporary works design Negligible 8 8

Vee-columns/move transfer beam to third floor level Cost of structural frame: £þþ 4 4
Loss of net internal area: £þþþ +
1 1

Change of internal columns from open to tubular Cost: 20% premium on connections package 6 6
sections

Independent internal (Category 2) check and external Cost: £minimal 10 10

peer review for critical structural elements

Enhanced quality management of supply chain and Cost: £þ 11 11

construction for critical structural elements

Vehicle lift Reduced excavation: £ 5 5

Reduced site works programme: £

Hardening of ground floor perimeter columns against Column hardening: £þ 4 4

VBIED

Vehicle ramp/blocker Blocker: £þ 5 5

Notes
a Key: ‘þ’ increases the cost of the building/structure, ‘’ reduces the cost of the building/structure.
b The greater the number of þ/ symbols, the greater the cost impact (positive or negative).

The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse 55
5.1 Example systematic risk assessment

Consequence

Catastrophic
Substantial
Significant
Minimal

Serious

Severe
Minor
Likelihood
Frequent/common

Likely 1 1

2,3
2 3 2 3
Unlikely 8
8
6 6
6
Rare 10 11

10 11
Improbable 4 4 5
4b

Negligible 8
10 11 5 5b

Key
Raw risk Mitigated risk

1 Errant truck/bus impact at ground level

2 Fire during occupation
3 Fire during refurbishment/refit
4 Vehicle-borne IED at ground level
5 Vehicle-borne IED in loading bay
6 Person-borne IED
8 Failure of temporary works design to provide necessary interim stability during construction
10 Numerical or conceptual mistakes in the analysis and design
11 Failure of a critical structural element

Figure 5.5 Risk matrix showing residual risks

passive fire protection renders the building better Consequently the structural engineer recommends
able to withstand ensuing fire because there is no that an independent review of the risk assessment
risk associated with fire protection being dislodged. be undertaken without liability following the
approach given in the SCOSS topic paper
Step 10: Review the overall level of risk SC/09/0345.8, and that reviews of the structural
The overall levels of both the unmitigated and the fire engineering design and nonlinear static
mitigated risk are reviewed to examine sensitivity to pushover analysis are undertaken by suitably
the assumptions made in the risk assessment, or qualified independent reviewers.
sensitivity to the risk reduction measures.
It is further recommended that the design of the vee-
The risk evaluation is generally insensitive to the column connections are included in the scope of the
underlying assumptions, and there is no ‘bunching’ external peer reviewer, and that the fabrication and
of risks around the threshold whereby small changes erection of the vee-columns, connections and
would make a significant difference in the transfer beam are subjected to an enhanced level of
assessment of risk (sensitivity to the assumptions quality management. This will include tighter
made). Some of the measures implemented in the specification, enhanced factory inspection and
design provide a significant degree of risk reduction witness acceptance testing, and the supervision of
(sensitivity to the risk reduction measures), foremost the construction of these elements on site by the
among which are: designer.
– Vee-columns/move transfer beam to third floor
level. Step 11: Provide adequate information about any
– Full-depth end plates to secondary beams. risks that remain
The robustness design is therefore sensitive to these The findings of the risk assessment are
two risk mitigation measures in particular. documented in an update of the structural design

56 The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse
 Example systematic risk assessment 5.2

philosophy and the approach to disproportionate

collapse. The specific treatment given to fire hazards
2 and 3 and the tolerable risks agreed with the
Building Control officer (refer to Step 5) is
documented.

Separate documents are prepared for the

temporary works designer and the steel
subcontractor highlighting the specific residual
risks relevant to their scope of work. The client
asks the structural engineer to document the risk
of structural collapse due to terrorist attack for
incorporation in the tenant handbook, and
appoints a security consultant to develop vehicle
security procedures for control of vehicle access
to the basement (working in conjunction with the
facilities management team).

5.2 References

5.1 Standing Committee on Structural Safety (SCOSS). The

fire at the Torre Windsor office building, Madrid 2005.
SCOSS failure data sheet SC/08/024. June 2008.

5.2 British Standards Institution. BS EN

1990:2002+A1:2005 incorporating corrigenda
December 2008 and April 2010. Eurocode: Basis of
structural design. London: BSI, 27 July 2002 and
2010.

5.3 British Standards Institution. BS EN 1090-

2:2008+A1:2011. Eurocode: Execution of steel
structures and aluminium structures. Part 2: technical
requirements for steel structures. London: BSI,
31 December 2008 and 31 August 2011.

5.4 British Standards Institution. PD 6705-2:2010.

Structural use of steel and aluminium – Part 2:
Recommendations for the execution of steel bridges to
BS EN 1090-2. London: BSI, December 2010.

5.5 British Standards Institution. BS EN 13670:2009

Execution of concrete structures. London: BSI,
28 February 2010.

5.6 British Standards Institution. PAS 68:2010. Impact test

specifications for vehicle security barriers. London: BSI,
January 2010.

5.7 British Standards Institution. PAS 69:2006. Guidelines

for the specification and installation of vehicle security
barriers. London: BSI, December 2006.

5.8 Standing Committee on Structural Safety (SCOSS).

Guidance note: independent review through peer
assist. SCOSS topic paper SC/09/034. January 2009.

The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse 57
6 Application of systematic risk assessment to existing
buildings

6.1 Introduction measures without adversely impacting other design

requirements is similarly reduced. It therefore follows
that the point at which gross disproportion is reached
The principles of systematic risk assessment also will be lower than in new-build construction.
have significant merit in other areas, most notably in
the design of modifications to existing buildings. The structural engineer may use the approach
Systematic risk assessment is not explicitly required outlined in this Manual to support the decision about
for existing buildings, but is one way in which the what measures are proportionate and what
designer can demonstrate compliance with the constitutes gross disproportion, and therefore in
requirements for robustness in design in the retrofit of determining the measures that should be adopted in
existing buildings. the design of existing buildings. Minor modifications
are necessary, principally in the cost-benefit
assessment. These are discussed and illustrated by
example in Section 6.4.
6.2 Design of modifications to existing
buildings
6.4 Cost-benefit assessment for existing
In existing buildings, the ability to effect adequate buildings
robustness provisions is understandably more limited
than in new-build construction. The building may
have been built to previous regulations with lower In the cost-benefit assessment of design measures
robustness provisions, or may be being remodelled for existing buildings, the proposed measure may
to support a change of use in which the robustness have a greater impact on the design than in new-
provisions increase from one use to the other. build construction. For example:
– The design measure may involve significant retrofit
The specific requirements covering the alteration of work such as the drilling of brickwork in order to
existing buildings will be defined in the relevant install vertical ties which carries a high risk of causing
legislation; however in England and Wales, buildings irreversible damage to the existing construction.
undergoing a material alteration or change of use are – There may not be any feasible way of implementing
covered by the Building Regulations and are therefore strengthening measures without adversely affecting
required to comply with the Regulations. Extensions the character of the existing building. This will carry
are also covered by the Regulations but the original increased importance in a building which is listed.
part of the building is not, provided it is made no – The cost of the strengthening measures may be in
worse in relation to its compliance than it was already. substantial disproportion to the benefit gained. It
In Scotland all conversions are required to be altered
should be noted that the cost of strengthening
or strengthened to the standard required by the measures which are sufficient to threaten the viability
current regulations so far as it is reasonably practicable
of the scheme is not a sufficient argument against
to do so, and in no case be worse than before the the implementation of strengthening measures. The
conversion6.1, 6.2. More detailed guidance is given in cost must be shown to be in gross disproportion to
the Institution’s Practical guide to structural robustness the benefit gained: merely being excessive makes
and disproportionate collapse in buildings6.3. no comment about the magnitude of the risks to
occupants, while being so excessive as to threaten
the viability of the scheme similarly so. There are
6.3 Use of systematic risk assessment for some risks that are not worth taking, and some
buildings that are not suitable to support a proposed
existing buildings function. It is the structural engineer’s duty of care to
evaluate this on risk grounds, not merely on the
grounds of the budget for the scheme.
The structural engineer can be faced with significant
challenges in designing against disproportionate As before, the cost-benefit assessment should be
collapse in the retrofit of an existing building, designed such that the benefit gained by
irrespective of their risk classification. For existing implementing certain measures is weighed against
buildings of all risk classes, the systematic risk the design and cost impacts for each proposed
assessment approach may be useful in designing measure. For existing buildings, it is often better to
against disproportionate collapse. The engineer consider the disbenefit of not implementing a
should also refer to the Institution’s report Appraisal proposed measure against the design and cost
of existing structures6.4. impact of doing so, i.e. to measure the cost of doing
nothing (in terms of the increased risk) against the
The overarching duty of care to eliminate hazards cost of doing something.
from the design and to reduce the risks from the
remaining hazards applies equally to the design of Boxes 6.1 and 6.2 give examples of how the
existing buildings. However in existing buildings the systematic risk assessment can be developed for the
risks may already exist, the ability to effect change is redevelopment and refurbishment of existing
reduced, and the ability to implement design buildings.

58 The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse
 Application of systematic risk assessment to existing buildings 6.4

Box 6.1 Example: refurbishment of a Victorian warehouse

A five-storey 19th century warehouse is being converted to office accommodation. The warehouse is constructed of solid,
unreinforced Victorian brickwork masonry and the design details are unknown, although a structural survey has been undertaken to
develop adequate information for design.
The building is classified as a Class 2B structure. From BS EN 1991-1-76.5 either horizontal and vertical ties need to be
implemented, or the loadbearing masonry needs to be designed to withstand the loss of a length of loadbearing wall equal to 2.25
times the storey height. It is not feasible to design the masonry to withstand lateral loads of 34kPa. The feasibility of installing
vertical ties has been investigated and would involve extensive vertical drilling inside the wall to install vertical reinforcing bars, with
significant risk of damage to the masonry brickwork during the drilling operation. Analysis has been undertaken to consider the loss
of an internal wall which would mobilise the vertical ties to withstand the loss of the floor, and is inconclusive but with a marginal
benefit at best.
It has not been possible to show through analysis that the building is capable of withstanding the loss of a loadbearing wall of the
required length, although the masonry blockwork is robust and will be capable of redistributing some load through diagonal
compressive forces through the blockwork. In addition, the building survey did not indicate any significant degradation over time.
The cost-benefit assessment considers the design impact of the vertical drilling to be disproportionate when compared with the
marginal gain in performance if the vertical ties are successfully installed. The ability of the masonry to redistribute the loads due to
the loss of a length of loadbearing wall is considered, coupled with an enhanced perimeter tie. This perimeter tie is cut into the
loadbearing brickwork and constructed in reinforced concrete to improve the ability to redistribute the load horizontally through
catenary action and increase the length over which the wall can remain unsupported. While not able to fully comply with the code
recommendations, the cost-benefit assessment assesses this more modest measure as providing a moderate enhancement in the
performance of the building which is not in disproportion to the design impact, and the measure is implemented.

Box 6.2 Example: redevelopment of a Grade I listed building

A Grade I listed building is undergoing alteration as part of a station redevelopment, which involves the removal of an internal floor
at first floor level. The building comprises loadbearing masonry brick piers between which are two-storey glazed windows. Both the
first floor beams and the roof trusses are supported at each brick pier. Although no calculations are available it is thought that the
first floor beams previously acted to stabilise the brick piers out of plane, although calculations have shown that the piers will be
stable over the two-storey height. The roof is not being modified as part of the alteration.
The heritage body responsible for the listed status of the building has stated that no modifications may be undertaken that affect
the appearance of the outside of the building. The structural engineer has assessed that the removal of the internal floor will have
no effect upon the ability to design the structure for normal loads, but that the loss of one brick pier at ground level would cause a
progressive collapse of the building roof.
The design has considered a number of options, as follows:
(1) Installation of through-anchored transverse ties installed into the masonry wall and onto spreader plates that can be seen on the
external surface of the wall.
(2) Retention of the existing first floor beams in the new design as exposed beams.
(3) Design of a perimeter beam at eaves level to span over a missing pier.
(4) Installation of vehicle barriers designed to resist impact of a vehicle into the pier.

The cost-benefit assessment has evaluated the options as follows:

(1) Externally-fixed transverse ties: can be engineered for the required forces, but has a significant impact on the visual appearance
of the structure.
(2) Retention of existing first floor beams: of limited benefit in providing the required tie forces, but avoids impact on the visual
appearance of the structure.
(3) Perimeter beam at eaves level: can provide the necessary robustness without impacting the visual appearance of the structure,
but adds significant additional cost to the project.
(4) Vehicle barriers: bollards can be designed to prevent a vehicle impact, but requires submission for revised planning consent to
do so, with consequent programme delays in the landscaping works and risks in the structural design if progressed pending
planning consent and bollards are not permitted by the planning authority.
(5) Do nothing: avoids any impact on the appearance of the structure but results in a gross collapse of the roof structure which is
judged to be intolerable.

The structural engineer dismisses option 2 in that, although the cost is limited in terms of the design impact, there is also limited
benefit. The cost-benefit assessment of this option is therefore not proven. Options 1 and 3 have significant benefit in terms of
improving the robustness of the structure, but each have design implications in terms of either an unacceptable impact on listed
status or the need for an increase of the project scope and cost. Option 4 will provide protection against this hazard but will
increase time on site and the consequent cost of construction while planning consent is sought. The risk in option 5 is shown to be
disproportionate.
The structural engineer tables options 1, 3 and 4 with the client, recommending negotiation with the listing authority on the basis of
precedent for externally-fixed ties in historic buildings. This recommendation is made on the basis that options 1 and 3 provide
scenario-independence in the design, noting that there could be other hazards such as explosion which causes the potential loss of
a pier. Implementation of a perimeter beam at eaves level as described in option 3 is recommended if the negotiation with the
listing bodies proves unsuccessful, with appropriate adjustment to the budget for the project for the additional design and
construction works. The design and installation of bollards to prevent the impact of a vehicle into the pier is recommended as the
option of last resort if neither of these options prove viable.

The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse 59
6.5 Application of systematic risk assessment to existing buildings

6.5 References

6.1 Scottish Building Standards Agency. Technical

handbook – non-domestic. Section 1 – Structure.
Scottish Building Standards Agency, 1 October 2010.

6.2 Scottish Building Standards Agency. Technical

handbook – domestic. Section 1 – Structure. Scottish
Building Standards Agency, 1 October 2010.

6.3 Institution of Structural Engineers. Practical guide to

structural robustness and disproportionate collapse in
buildings. London: IStructE, October 2010.

6.4 Institution of Structural Engineers. Appraisal of existing

structures. 3rd ed. London: IStructE, November 2010.

6.5 British Standards Institution. BS EN 1991-1-7:2006.

Eurocode 1: Actions on structures. Part 1-7:
General actions: Accidental actions. London:
BSI, September 2006.

60 The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse
Tables Boxes

Table 2.1 BS EN 1991-1-7 building risk classification 8 Box 2.1

Eliminating risks – example 6
Table 3.1 Example likelihood scale 14 Box 2.2
Reducing and informing risks – example 6
Table 3.2 Example consequence scale 15 Box 2.3
Controlling risks – example 7
Table 3.3 Examples of hazards 18 Box 2.4
ALARP and gross disproportion – example 7
Table 5.1 Cost-benefit assessment 55 Box 3.1
Emley Moor, 19 March 1969 20
Box 3.2
Camden School for Girls assembly hall, 1973 and
Sir John Cass Secondary School swimming pool,
1974 20
Box 3.3 Cliff edge effects – Paris Charles de Gaulle
Terminal 2E collapse, 2004 22
Box 3.4 Low likelihood/high consequence hazards – Eschede
train disaster, 1998 23
Box 3.5 World Trade Center, 11 September 2001 24
Box 3.6 Mersey Valley Footbridge, 4 January 2007 24
Box 3.7 Light aircraft crash, New York City,
11 October 2006 25
Box 3.8 Great Heck rail crash, 2001 25
Box 3.9 Hambly’s paradox 27
Box 3.10 Pipers Row car park, 1997 31
Box 3.11 Shear failure of a reinforced concrete transfer
slab 31
Box 3.12 Brittle failure of a steel-framed structure 32
Box 4.1 Haeng-Ju Grand Bridge collapse, Seoul, 1992 and
Tasman Bridge, Hobart, Australia, 1975 38
Box 4.2 Failures in quality control of design and construction,
West Gate Bridge, Melbourne, October 1970 45
Box 4.3 Gross design error and lack of single point of
responsibility, Hartford Civic Center, Connecticut,
January 1978 46
Box 4.4 Sleipner A offshore platform, 1991 47
Box 4.5 Bad Reichenhall Ice Rink roof collapse,
2 January 2006 47
Box 5.1 Torre Windsor, Madrid, 2005 52
Box 6.1 Example: refurbishment of a Victorian
warehouse 59
Box 6.2 Example: redevelopment of a Grade I listed
building 59

iv The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse
Appendix A Further reading

Cormie D. Robustness. In: ICE manual of structural

design: buildings, Bull J, Editor. London:
Thomas Telford, 2012.

Delatte NJ. Forensic case studies for civil engineers.

ASCE Press, 2009.

Feld J, Carper K. Construction failure. 2nd ed.

New York, NY: John Wiley & Sons, 1997.

federation international du béton (fib). fib Bulletin 63:

Design of precast concrete structures against
accidental actions. Guide to good practice.
Lausanne: 2012.

Government Office for Science. Blackett review of

high impact low probability risks. Department for
Business, Innovation and Skills, 2011.

Kaminetzky D. Design and construction failures:

lessons from forensic investigations. New York,
NY: McGraw-Hill, 1991.

Kletz T. An engineer’s view of human error. 2nd ed.

London: Institution of Chemical Engineers,
1991.

Mann AP. Learning from failures at the interface.

Proceedings of the Institution of Civil Engineers
– Civil Engineering 2008;161(6):8-15.

Levy M, Salvadori M. Why buildings fall down: how

structures fail. New York, NY: W.W. Norton,
1992.

Pugsley AG. The safety of structures. London:

Edward Arnold (Publishers) Ltd, 1966.

Starossek, U. Progressive collapse of structures.

London: Thomas Telford, 2009.

The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse 61
Glossary and abbreviations

Term Definition
Accidental action An accidental action is an unintended action to which the structure might be subjected during its
design life.
Class 1 building A building defined as Consequence Class 1, 2A, 2B and 3 respectively according to Annex A of BS EN
Class 2A building 1991-1-7:2006 Eurocode 1: Actions on structures. Part 1-7: General actions: Accidental actions.
Class 2B building Definitions are generally similar to those given in Approved Document A to the Building Regulations and
Class 3 building in corresponding documents in the devolved administrations of the United Kingdom.
Cliff edge A cliff edge is an informal term which refers to the sudden loss of strength or stiffness in a structural
system. It is usually used on a system level rather than an element level, and is an undesirable
characteristic of a system when the cliff edge lies too close to the expected structural response. A cliff
edge cannot always be eliminated but can be moved further away from the expected structural
response or made less steep.
Consequence Consequence is the harm that will be caused should the specified hazard materialise. In structural
terms, it is an expression of the extents of damage considering the vulnerability of the structure to a
hazard of a given severity. Sometimes referred to in risk terminology as severity or impact, consequence
may be measured in terms of the extents of collapse, numbers of fatalities, injuries, economic loss,
downtime or some other metric.
Disproportionate collapse A disproportionate collapse is one which is greater than should be expected, given the magnitude of the
initiating event. Disproportion is a measure of the extents of the damage given the magnitude of the
initiating event (hazard), against some limit defined for the scenario.
Note: the threshold of disproportion will vary for events of different magnitude – BS EN 1991-1-7
recognises that complete collapse may sometimes be acceptable if the event is sufficiently severe. The
threshold of disproportion is informed by the tolerability of risk associated with a particular accidental or
malicious action. In turn this is informed by regulatory requirement, by client or professional perception,
or by societal expectation.
Ductility, ductility ratio Ductility describes a characteristic of a structural element which exhibits an ability to undergo inelastic
displacements beyond the point of first yield, while exhibiting only a gradual loss of strength as the load
is increased. This is in contrast to a brittle failure mode, which is characterised by a sudden loss of
strength for a small increase in load beyond the point of first yield. A ductility ratio is the displacement
of the system, nondimensionalised with respect to the limiting elastic displacement, and is used as a
measure of the amount of damage sustained by an element.
Hazard A hazard is something which has the potential to cause harm. It may be an accidental or a malicious
action, insufficient strength or resistance, or excessive deviation from intended limits.
Note: the term ‘accidental’ is generally used to encompass both natural and man-made hazards,
although sometimes it is useful to make a distinction between natural hazards and (man-made)
accidental hazards, when the separate terms will be used.
Likelihood Likelihood is an expression of how frequently the hazard of specified magnitude can be expected to
materialise.
Malicious action A malicious action is a deliberate action to which the structure might be subjected during its design life.
Mitigation Mitigation is the reduction in the severity (consequences) of the hazard, given that the hazard
materialises. Often also used to refer to reduction in likelihood. ‘Risk reduction’ is generally the
preferred term for measures that act on either the likelihood and/or the consequences of a hazard.
Progressive collapse A progressive collapse is a particular type of collapse which develops in a progressive manner akin to
the collapse of a row of dominos. A collapse may be progressive horizontally e.g. successively from one
structural bay to those adjacent to it and propagating through the structure in a framed structure, or
successively from one cable to the next in a cable-stayed structure. A collapse may also be progressive
vertically e.g. the collapse of the columns supporting a floor slab due to the dynamic shock load caused
by the collapse onto it of the storey above it, or the successive collapse of the columns supporting a
number of floors due to the dynamic shock load as the block of mass is brought to rest as it impacts
with more rigid structure below.
Note: disproportionate collapse and progressive collapse are often, mistakenly, taken to be synonymous.
A collapse may be disproportionate but not necessarily progressive if, for example, the collapse is
limited in its extents to a single structural bay but the structural bays are large. Vice versa, a collapse
may be progressive in nature but not necessarily disproportionate in its extents, for example if arrested
after it progresses through a number of structural bays and the bays are small such that the overall
extents of damage is limited. Progressive collapse refers to the mechanism of the collapse;
disproportionate collapse refers to its extents.
Reduction of risk Reduction of risk refers to the general concept of making changes that result in a reduction in the level
of risk owing to a particular hazard. Methods used to reduce risks are typically organised according to a
hierarchy of risk reduction which describes the order of preference in which the methods should be
applied, based on their effect on the level of risk.

The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse v
 Term Definition
Residual risk The residual level of risk that exists after risk reduction measures have been put in place. The term
‘residual risk’ is used interchangeably with mitigated risk, though strictly risk reduction may act on both
likelihood and consequence while mitigation acts on consequence alone. This term also introduces the
concept of unmitigated, or ‘raw’, risk.
Risk The risk owing to a particular hazard is the combination of the likelihood that the hazard will be realised
and the consequence should it do so.
Note: in practice, one hazard may give rise to many risks, each of differing likelihood and consequence.
Severity The severity of a hazard defines the magnitude of the action – for example a 1 in 100 year wind load,
a vehicle impact of given mass and velocity and so on.
Structural robustness Structural robustness is a quality in a structural system that describes its ability to accept a certain
amount of damage without that structure failing to any great degree. That is, modest damage (whether
due to accidental or malicious action) causes only a similarly modest change in the structural behaviour:
this implies an insensitivity of the structure to local failure.
Robustness is a quality of the structural system alone, and is independent of the cause of the damage
and/or the local failure. A robust structure specifically is not one which is over-designed: the ability to
resist damage is achieved through consideration of the global structural behaviour and failure modes so
that the effects of a localised structural failure can be mitigated by the ability of the structure to
redistribute the load elsewhere. The effects of the initial failure are gradual in onset and structural
instability is avoided in the response of the structure.
Eurocode 1 (BS EN 1991-1-7) describes robustness as ‘‘the ability of a structure to withstand events
like fire, explosions, impact or the consequences of human error without being damaged to an extent
disproportionate to the original cause’’, thereby linking it explicitly to the concept of disproportionate
collapse while recognising that total collapse is an acceptable outcome from a gross hazard.
Vulnerability The vulnerability of the structure is used in evaluating the consequences of a given hazard, considering
the type of action and the structural response to that action. The vulnerability of a structure will vary
between different hazards – a structure may be sensitive to vehicle impact but not to seismic loading.

Abbreviation Definition
ALARP As Low As Reasonably Practicable.
ERIC Eliminate, Reduce, Inform, Control (see Figure 2.2).
HAZOP HAZard and OPerability review.
QRA Quantitative Risk Assessment.
SFARP So Far As Reasonably Practicable.
SQEP Suitably Qualified and Experienced (Person)/Suitable Qualification and Experience.

vi The Institution of Structural Engineers Manual for the systematic risk assessment of high-risk structures against disproportionate collapse