Engineering Structures 22 (2000) 106–115

www.elsevier.com/locate/engstruct

LRFD: implementing structural reliability in professional practice

*
Bruce R. Ellingwood
Department of Civil Engineering, The Johns Hopkins University, Baltimore, MD 21218, USA

Received 1 August 1997; accepted 9 January 1998

Abstract

Structural reliability methods provide the framework for addressing building safety and serviceability issues in a rational manner.
Load and resistance factor design (LRFD) represents the first attempt in the United States to implement a rational probabilistic
approach to managing uncertainties in the building process in a structural code. The development of LRFD during the period 1969–
85, under the leadership of Professor Theodore V. Galambos, is a paradigm of collaboration between structural engineers, reliability
analysts, and the building industry. Not surprisingly, LRFD has opened the door to new research opportunities and challenges. 
1999 Elsevier Science Ltd. All rights reserved.

Keywords: Buildings (codes); Design (buildings); Reliability; Steel; Structural engineering

1. Introduction ment. The evolution of the flying buttress in gothic

Structural codes provide a set of minimum technical
requirements for safe and acceptable design, a legal basis
for the practice of structural engineering, and a vehicle
for the transfer of technology from research to practice.
The framers of our design codes and standards, on which
the structural engineer relies, must address the question:
“How safe is safe enough?” on behalf of society as a
whole. Code development is an enormous undertaking,
and for the most part has been done well; structural fail-
ures are rare. When failures occur, however, the conse-
quences for the building occupant or user often are
tragic, public scrutiny is intense, and economic and legal
consequences to the architect, engineer and owner are
severe.
With such high stakes, it perhaps is surprising that
until recently there was no systematic way of determin-
ing whether a structure was “safe enough”. Structural
engineering as a profession has evolved gradually over
the centuries, from a trade into a profession. During
much of that time, builders took mainly a trial-and-error
approach to safety. This learning process occurred
slowly and no doubt was accompanied by a great deal
of human misery, building loss, and personal embarrass-
* Tel.: 001-410-516-8443; Fax: 001-410-516-7473;
bre@jhu.edu
cathedrals in the 12th and 13th centuries illustrates the
adaptive nature of structural engineering in construction.
Recognizable structural engineering calculations date
from the time of Coulomb and Navier in the late 18th
century. In the late 20th century, with significant
advances in structural engineering and with the wide-
spread availability of the computer as an analysis tool,
the behavior of complex systems can be determined
quite accurately for design purposes. Unfortunately,
despite these advances, structural loads and material
strengths remain unpredictable, and this uncertainty is
at the root of the structural safety problem in building
construction. Uncertainty gives rise to “risk”, rep-
resenting the likelihood of an unfavorable event and its
consequences in human and economic terms. Risk is
present in all human endeavors. The primary purpose of
structural codes and standards is to manage and control
risk to socially acceptable levels.
2. Structural safety
Uncertainties arise from both the demands placed on
a system and from the capacity of the system to respond
to and withstand those demands. In many engineering
fields, particularly those involving mass-produced manu-
E-mail: factured products, the demands and capacities are rela-
tively predictable; the technology is easily controlled;

0141-0296/00/$ - see front matter  1999 Elsevier Science Ltd. All rights reserved.
PII: S 0 1 4 1 - 0 2 9 6 ( 9 8 ) 0 0 0 9 9 - 6
 B.R. Ellingwood / Engineering Structures 22 (2000) 106–115
and ample supporting data on product performance are
available from component testing. Product design, devel-
opment and improvement can involve a heavy dose of
trial and error, and acceptable performance can be
ensured by the rapid feedback that occurs in the design
process. The consequences of failure are mainly incon-
venience or economic loss. In civil/structural engineer-
ing, and in other engineering fields that are professional
service-oriented rather than product-oriented, the situ-
ation is vastly different. Most structures are not mass-
produced, so performance data are not easily developed
under repeatable circumstances. Demands on the system
from occupants and from natural phenomena hazards
such as wind and earthquake are highly variable. Events
of concern (design-basis events) are rare. Moreover, fail-
ures are highly visible and their consequences are severe.
Structural engineers traditionally have approached the
problems posed by uncertainty and risk by applying a
judgmental “factor of safety” to structural calculations.
One might, for example, estimate a wind load conserva-
tively and then design the structure for a wind load that
is twice as great; or (as in the now-archaic allowable
stress design method) limit the elastic stress to some
fraction of the “failure” stress. Such factors of safety on
yield strength of steel tension members have decreased
from about 2.5 in the 1880s to about 1.7 100 years later,
a decrease that presumably is associated with our
increasing confidence in the design and construction pro-
cess [1]. Until recently, little thought was given to what
the likelihood of failure of such designs might be; they
were simply judged to be “acceptably low”. It is easier
to design a safe structure than to compute its likelihood
of failure.
As might be inferred from the previous discussion,
judgmental approaches to managing building risk work
reasonably well as long as building technology is stable,
there is ample opportunity to learn from experience, and
societal expectations do not change. When structural
design is based on rare events or when new technology
is involved, however, judgement and intuition may not
be sufficient. Such an approach may be uneconomical in
some instances; designing a structure with stronger
beams and columns usually (but not always) makes it
safer, but also increases its cost. Perhaps more seriously,
it may fail to account for different (perhaps higher) per-
formance categories required for certain facilities. For
example, the U.S. Nuclear Regulatory Commission
strives to limit the probability of radionuclide release
from a nuclear power plant accident to less than one in
a million per year [2]. The fact that we now have several
thousand years of accumulated plant operating experi-
ence furnishes only anecdotal evidence of whether cur-
rent requirements for design, construction, operation and
maintenance are sufficient to meet this goal. The after-
math of recent natural and man-made disasters, the rapid
evolution of design and construction methods, height-
107
ened expectations on the part of the public and its scru-
tiny of the process by which we set our standards for
public health and safety, and the litigious nature of mod-
ern society all have made it clear that this judgmental
approach to assuring building safety is becoming
increasingly unacceptable [3]. It is getting harder and
more costly to take corrective action following the
consequences of an error in engineering judgement.
Many factors that determine the performance of engi-
neered systems, while unpredictable, exhibit statistical
regularity. This suggests that probability and statistics
can provide tools to treat these sources of uncertainty
rationally in structural design. The field of structural
reliability has developed over the past 40 years to pro-
vide a theoretical framework for addressing safety and
for analyzing uncertainty.
3. Role of probability in setting design-basis events
Probabilistic modeling and statistical analysis have
been used extensively to determine extreme environmen-
tal events due to wind, snow, earthquakes or floods for
design purposes for several decades. The alternatives of
choosing events that are based on a maximum historical
occurrence or on a postulated maximum possible occur-
rence have clear disadvantages. Maximum historical
events are likely to be exceeded in the future, parti-
cularly if the historical record is relatively short.
Maximum possible events are based on a concurrence of
conservative deterministic assumptions, and often lead to
excessive and uneconomical design requirements. The
use of probability and statistics allows some of the arbi-
trariness in event specification to be reduced, if not elim-
inated entirely.
The use of statistics to analyze extreme windspeeds
dates back to at least the 1930s [4]. An early ASCE
report on wind forces on structures [5] suggested that
the use of 50-year and 100-year mean recurrence interval
(MRI) windspeeds (windspeeds having probabilities of
0.02 and 0.01, respectively, of being exceeded in a given
year) gives the designer a tool for “conservative” and
“more conservative” design, based on hazard to life or
property from a structural failure. Probability in earth-
quake engineering found a place in the specification of
the seismic hazard [6], expressed in terms of an effective
peak ground acceleration, spectral acceleration at speci-
fied periods, or similar parameters. In the mid-1970s, a
probabilistic seismic hazard study was undertaken [7],
ultimately leading to a seismic hazard map with contours
of ground acceleration with 10% probability of being
exceeded in 50 years (equivalently, a 475-year MRI). As
with wind, no technical justification was provided for
these numbers; the 50-year interval was selected for con-
venience, while the 10% probability was judged to be
“reasonable and conservative”.
108 B.R. Ellingwood / Engineering Structures 22 (2000) 106–115
A review of other contemporary literature indicates
little justification for the quantitative probability levels
selected to specify design-basis events in modern struc-
tural codes. A 50- to 100-year MRI event is not incon-
sistent with the largest (or near-largest) event that an
engineer might expect to experience during his or her
professional career. On the other hand, probabilistic
models of load events and statistical methods for treating
data do provide a rational framework for processing
observed data consistently and for extrapolating beyond
the range of observation. Thus, as a result of studies such
as those above, probabilistic methods have come to be
accepted in structural codes during the past two decades
in setting design levels for natural phenomena hazards.
The ASCE 7 Standard [8] has required that ordinary
building structures be designed for windspeeds or
ground snow loads with MRIs of 50 years since 1972;
buildings have been required to withstand earthquake
ground shaking corresponding to a MRI of 475 years
since 1982 (reportedly, this may increase to 2500 years
in the next edition for certain structures); dams are
designed to withstand 100-year flood levels, and so on.
These criteria address the uncertainty in the design event
with a frequency distribution that describes it explicitly
with a probabilistic model. By setting the design level
at some small probability of being exceeded, some meas-
ure of risk consistency is introduced that is not possible
with a purely judgemental safety factor or a “maximum
event” specification.
The above approach, of course, deals only with the
demand portion of the structural design problem. Inte-
grating demand and capacity into a reliability-based
structural design code or specification requires a higher
level of sophistication, and advances in this arena have
been more recent. The remainder of this paper presents
a personal view of how structural reliability has evolved
in meeting the needs of the standard development com-
munity, and will identify some of the challenges facing
us, now that first-generation reliability-based structural
design codes are in place.
4. Probability-based limit states design
The use of structural reliability theory as a tool in
structural code development in the United States can be
traced back to the late 1960s. In classical reliability
theory, the structural action(s) due to the applied load(s),
Q, and the resistance, R, are modeled by random vari-
ables. In the simplest representation, failure occurs if R
is less than Q. The probability of this event is,
冕
⬁
P[Fail] ⫽ Pf ⫽ FR(x)fQ(x)dx (1)
0 especially noteworthy. Professor Winter observed that a
in which FR(x) ⫽ cumulative distribution function of R
and fQ(x) ⫽ density function of Q. This equation is
impractical for design purposes, as anyone who ever has
worked with it can appreciate. For one thing, it requires
a knowledge of the probability laws for R and Q, which
may vary for different structural actions and limit states.
Also, there is the problem of how to handle the numeri-
cal integration in the typical iterative design context.
Thus, prior to the late 1960s, most of the problems
addressed in the reliability literature were primarily
theoretical and relatively simple in nature [9].
Within the period 1968–72, however, the scope of
structural reliability expanded rapidly beyond a rela-
tively narrow research community to a broader group of
engineers concerned with improving the standard devel-
opment process. Within this period, we have the First
International Conference on Structural Safety and
Reliability [10] (held, appropriately enough, at the
Smithsonian Institution in Washington, DC); a collection
of papers on practical aspects of structural safety pub-
lished in the ACI Journal in the Sept–Dec 1969 issues,
followed by a technical session organized by ACI on
probabilistic design of concrete buildings in 1971; and
an ASCE specialty conference on reliability of metal
buildings [11]. Also in that period, efforts were initiated
to transform Eq. (1) into something more practical for
design [12–14]. It was a remarkably quick transition
from academic to applied research, and did not occur
by happenstance.
The first moves toward what we now call limit states
design (plastic design for steel or strength design for
concrete) had preceded the expansion to practical appli-
cations in the reliability area by only about a decade.
Limit states design, in contrast to allowable stress design
(ASD), requires careful thought about how best to cope
with possible modes of structural behavior (elastic ver-
sus nonlinear response), analysis techniques (first-order
versus second-order), and performance limits
(serviceability, onset of structural nonlinearity, incipient
system instability). ASD does not deal with these issues
in an entirely rational manner when it deals with them
at all. More often, the complexities raised by these issues
simply are shrouded in the overall factor of safety that
is used to reduce the critical failure stress (yielding,
buckling, fracture) down into the elastic range, where it
can be accommodated in a first-order elastic structural
analysis. Leaders in the structural engineering profession
who wrestled with these issues during this period real-
ized early on that limit states design would require a
more rational way of dealing with uncertainties [1].
Although many people contributed to the debate, the
contributions of George Winter of Cornell University,
who was one of the eminent individuals who served on
both the AISC Specification Advisory Committee and
the ACI Committee 318 during those years, are
 B.R. Ellingwood / Engineering Structures 22 (2000) 106–115
more rational treatment of the uncertainties in loads and
strengths was essential and, in addition, argued strongly
for the development of common load requirements for
different construction materials. Comments from this
segment of the standards community found fruit in the
reliability community, and is the main reason why the
papers in these conferences and publications during
1968–72 had, for the first time, a strong practical current
running though them.
One notable example of this move toward practical
implementation can be found in the notion of the
reliability index, ␤, as an alternative (to Pf) measure of
reliability. The reliability index was introduced in an
attempt to avoid conceptual and practical difficulties
(problems of computation, lack of data, modeling errors)
with the use of Eq. (1). In its initial implementation, ␤
was evaluated simply as a function of the means and
standard deviations (or coefficient of variations) of
resistance and structural actions. (Later, techniques for
incorporating information on probability distributions
were developed, leading ultimately to what we now call
first-order reliability methods.) Following the simple
form of Eq. (1), if the margin of safety, M, is defined
as M ⫽ R ⫺ Q, with mean E[M] and standard deviation
SD[M], then ␤ ⫽ E[M]/SD[M]. For common structural
engineering practice, this number usually is on the order
of 2 to 6; many engineers at the time were more comfort-
able with such numbers than with probabilities of 10−5
or less (in the case where R and Q are normal, ␤ ⫽
⌽−1(1 ⫺ Pf). Moreover, ␤ could be computed with only
a knowledge of “most likely value” (reflected, approxi-
mately, in E[M]) and “uncertainty” (reflected in SD[M]),
quantities with some familiarity, rather than the entire
distribution, which was an unfamiliar concept. Since ␤
incorporated uncertainty explicitly, it seemed to offer an
improvement over the traditional factor of safety, where
there was abundant evidence that uncertainty was not
treated rationally.
Load and Resistance Factor Design (LRFD) rep-
resents the first attempt in the United States to implement
rational probabilistic thinking in the context of a modern
limit states structural code. The American Iron and Steel
Institute (AISI) and the American Institute of Steel Con-
struction (AISC) initiated a research project in 1969 to
develop a practical steel design specification using
reliability principles to treat uncertainties in loads and
in structural strength. The project was under the direc-
tion of Professor Theodore V. Galambos, who was
assisted by Dr M.K. Ravindra, and was guided by an
advisory committee of experts in steel structures, struc-
tural design, and reliability theory. The major portion of
the technical work was performed during the period
1969–76. The technical basis for LRFD is explained in
a collection of eight papers published in September 1978
[15,16]. A period of trial design and refinement fol-
lowed. The draft LRFD specification was debated by the
109
AISC Specification Committee, first at a week-long
meeting in August 1981, and subsequently at yearly
meetings over a period of several years. The first LRFD
specification was published in 1986 and the second in
1994 [17]. By the end of the decade all steel design
improvements and specification revisions will be tailored
primarily for LRFD.
The plea for common load requirements for different
construction materials was answered only after the first
draft of the LRFD specification was completed. The
1970s saw a number of advances in first-order reliability
analysis, stochastic load modeling, and supporting data
acquisition. These advances made it possible to develop
a set of common load requirements, including load fac-
tors and load combinations, for inclusion in ANSI Stan-
dard A58 (now ASCE Standard 7) in a relatively short
period in 1979. The procedure by which this was done—
collection and analysis of statistical data on loads and
strengths, reliability assessment of structural members
for which it was believed that current design was accept-
able, selection of reliability targets, and finally setting
load criteria to meet those targets—is documented in two
articles appearing in May 1982 [18,19]. These load cri-
teria were adopted by ballot for ANSI Standard A58.1-
1982; they have been reaffirmed and thus have remained
essentially unchanged (with the exception of the earth-
quake load factor) since then [8].
LRFD successfully transformed the classical structural
reliability equation into a form that was practical for
design, even by engineers not familiar with the reliability
concepts. From the performance requirement that the
member reliability should exceed the target reliability
index, ␤, Eq. (1) was replaced by the familiar LRFD for-
mat,
␾Rn ⫽ Σ␥iQni (2)
in which Rn and Qni are the nominal strengths and loads,
respectively, traditionally provided in familiar codes and
standards, and ␾ and ␥i are resistance and load factors
that reflect (a) uncertainty in strength and load, and (b)
consequences of failure, measured by the associated
value of ␤. The left hand side of Eq. (2) is the purview
of AISC (or other material specification); the right hand
side is defined by ASCE Standard 7. The specific load
factors—1.2 on dead load, 1.6 on live load, 0.9 on yield-
ing in tension, and so forth—are familiar to most readers.
A similar approach is followed by our colleagues in Can-
ada, Mexico, Europe and Japan. It may seem like a small
step, but it was not; the move toward LRFD required a
thorough re-examination of the philosophical under-
pinnings of ASD (or lack thereof) and led to changes in
the procedures by which Rn is calculated for different
limit states as well.
The development of the first LRFD specification for
steel structures from 1969 to 1985 provides the paradigm
110 B.R. Ellingwood / Engineering Structures 22 (2000) 106–115
for a collaboration of those in reliability research, a parti-
cular construction technology, and professional practice
to work together to improve the process by which build-
ing structures are engineered. In retrospect, the process
leading to the LRFD Specification may seem inordi-
nately long. However, it was a learning process that
involved a broad group of professionals with diverse
backgrounds and expertise. A more recent effort to
develop ASCE Standard 16-95 on LRFD for engineered
wood construction was essentially completed during the
period 1988–94, or 6 years. The NCHRP project to
develop an AASHTO LRFD Code for highway bridge
design was accomplished in a similar time frame.
These probability-based code development efforts
were successful, in my view, because they were man-
aged by engineering researchers who were familiar, first
of all, with the structural engineering issues involved,
and who were willing to adopt the reliability tools neces-
sary for analyzing uncertainty. It is problematic whether
these code development efforts would have been suc-
cessful had their leadership come from the reliability
research community. On the other hand, the reliability
analysts played an absolutely essential role in providing
the means for dealing with the multitude of uncertainties
attendant to a structural code. Such opportunities for
synergism are replete in modern structural engineering.
5. The future of reliability in structural
engineering
The next decade presents exciting opportunities for
structural engineers, standard writers, and reliability ana-
lysts to continue to work together to rationalize the
building design process. The following is a collection,
in no particular order and certainly not all-inclusive, of
some of the challenges facing us. Readers no doubt will
add to the list.
5.1. Advances in computation and systems analysis
Advances in computation will play a key role in meet-
ing many of the challenges below. Such advances have
been occurred exponentially during the last 28 years
since the work on reliability-based design standards such
as LRFD was initiated. Numerous structural analysis
programs are now available for performing first-order
analysis, second-order nonlinear analysis, and so forth.
They are efficient in terms of resources required, and
often are accompanied by elegant user-oriented inter-
faces and design aids. They offer the prospect of introd-
ucing reliability-based design directly in the design
office. Of course, they do require a human capital invest-
ment to be fully useful as productivity tools. One objec-
tion to LRFD, often voiced in professional and trade
association venues, centers on the cost of transitioning
from ASD to LRFD. In my view, the competitive press-
ures of the international marketplace will ensure that
advances in computerized structural analysis and design
will continue unabated. Those who fail to adapt to this
reality will find themselves out of business early in the
21st century.
Structural system effects are reflected in the current
reliability-based codes, but only indirectly. Examples of
this include the K-factor used in column design and the
R and Cd factors used to account for nonlinear behavior
in the context of an elastic analysis in earthquake-resist-
ant design [20]. Improved structural modeling (both lin-
ear and nonlinear) made possible by computational
advances will enable us to address the issue of designing
the structural system as a system rather than as a collec-
tion of members. The need for such an approach is evi-
dent in several areas, including stability analysis of tall
buildings, but perhaps most immediately in earthquake
engineering, where most recent advances (including
Chapter 9 of ASCE Standard 7-95 and AISC’s Seismic
Provisions for Structural Steel Buildings) have been
aimed at ensuring that the system can tolerate or with-
stand strong ground motions without life-threatening
damage. The performance of special moment-resisting
steel frames during the Northridge Earthquake is evi-
dence of not only the benefits of steel construction (no
building collapses occurred) but the need for more accur-
ate models of connection behavior.
Redundancy and load redistribution subsequent to
initial yielding were not taken into account explicitly in
the structural reliability assessment underlying LRFD.
This can lead to a false impression of the reliability of
even an indeterminate beam, let alone a more complex
structural system. To illustrate this point, consider the
two-span continuous beam in Fig. 1, designed for the
nominal loads shown. Assume that a floor slab provides
full lateral support, and that the beam is compact; thus,
LTB or local instability need not be considered. We will
consider two design situations: (1) ASD (elastic) design;
(2) LRFD Section F1.1 (first plastic hinge). Using LRFD
Section F1.2d (plastic design) leads to the same required
section as (2) because the positive moment within the
left span controls design. Table 1 summarizes the steel
beam sections obtained by these design procedures. We
note that LRFD permits approximately an 11% reduction
in beam weight from ASD.
Next, two possible beam limit states are considered
for purposes of reliability assessment: first yield and
plastic collapse (other intermediate limit states may be
of interest in some applications). The fact that dead and
live loads, wD and wL, both are random variables means
that the location of the maximum positive moment in
the left span is random. This source of uncertainty has
a relatively small impact on the object of this particular
example or the results, and will be neglected for sim-
plicity. These two limit states then are (the divisor 12
 B.R. Ellingwood / Engineering Structures 22 (2000) 106–115
Fig. 1. Continuous beam design by ASD and LRFD.
Table 1
Design of two-span continuous beam
Criterion Section Reliability index, ␤
First yield Collapse
ASD W21 ⫻ 62 2.43 3.03
LRFD F1.1 W24 ⫻ 55 2.02 2.76
enables wD and wL to be expressed in units of kips/ft
while Fy, Sx and Zx are in customary units):
Yield: BFySx/12 ⫺ (62.5 wD ⫹ 85.9375wL) ⫽ 0
Plastic: BFyZx/12 ⫺ 77.2068(wD ⫹ wL) ⫽ 0
in which Fy ⫽ yield strength; Sx and Zx ⫽ elastic and
plastic section moduli, respectively. The probabilistic
models for these terms are available elsewhere [18,19].
Using customary first-order reliability analyis, the
reliability indices, ␤, (based on the maximum structural
action in a 50-year service period) are computed for first
yield and plastic collapse and are presented in the final
two columns of Table 1.
Several points are worthy of note. For one, the differ-
ence between the “yield” and “collapse” columns, in
terms of limit state probability, is about a factor of 7.
This increase in reliability against collapse above first
yield reflects redundancy in the beam; the difference
would have been only minor had the beam (structure)
been statically determinate. For another, the use of stan-
dard hot-rolled shapes leads to sections greater than or
equal to the required section; in the examples in Table
1 this oversizing ranged from 3 to 8%. As a result, the
␤’s in the final column of Table 1 fall above the mini-
mum of approximately 2.5 (with respect to a 50-year
service period), on which the LRFD Specification [17]
is based. Moreover, in most structural framing systems,
columns are extended over several stories or the same
beam section is used for several bays for ease in fabri-
cation, even if the full section capacity is not required.
This additional token design conservatism increases the
actual reliability further over that indicated by code cali-
brations (on which the minimums provided by the code
are based), and make it possible to tolerate some local
damage in the structure without fear of structural col-
111
lapse. On the other hand, when design is completely
computer-automated and every beam and column is
designed at or close to the limit state or when the struc-
ture has little capability for redistributing force following
first yield or failure, there may be little additional margin
for error. The reliability of such structural systems can
be substantially less. How much less has not yet been
thoroughly investigated, and requires additional con-
sideration in the next generation of LRFD specifications.
Closely coupled to the issue of system behavior is that
of performance-based design. It has been somewhat sur-
prising and amusing to me to see performance-based
design recently introduced in several quarters as a new
(3a) concept. The performance concept was introduced in
1970 in the Operation Breakthrough Project, sponsored
(3b) by HUD at the National Bureau of Standards, and a set
of (primitive) reliability-based criteria for strength and
serviceability limit states were published in 1977 [21].
At that time, unfortunately, computational resources
were insufficient to cope with some of the problems of
system design-by-analysis, and the alternative of validat-
ing designs by structural testing was viewed as too
expensive. Twenty years later, resources now are avail-
able to take full advantage of the performance concept.
There is a strong move in this direction in the SAC Steel
Project being funded by FEMA, and the Department of
Energy Standard [22] on design and evaluation for natu-
ral phenomena hazards has already adopted it.
Encapsulated in the performance concept are the
notions of identifying different performance limits
explicitly (e.g., impaired service function; loss of occu-
pancy; life-threatening damage), relating structural
response (perhaps nonlinear) to a level commensurate
with the performance limit identified (nonstructural dam-
age, first yielding or hinge, incipient instability), and
associating with each a specific numerical risk goal,
expressed in terms of probability. One might depict this
sort of behavior by a family of “fragility” curves,
describing the (conditional) probability of failure of the
system, for a particular demand. This is illustrated in
Fig. 2, where a family of such curves are presented for
a frame; the vertical axis plots conditional limit state
probability, P[LS|W ⫽ w], while demand (measured here
in terms of lateral force, w) is measured on the horizontal
axis. The slope of each fragility is a measure of the
uncertainty in the structural behavior for that limit con-
dition. The separation or clustering of these fragilities at
112 B.R. Ellingwood / Engineering Structures 22 (2000) 106–115
Fig. 2. Fragility models for performance limits.
a given fractile, say 0.05, conveys an idea of the robust-
ness of the system; curves that are tightly clustered are
indicative of a system that has little capacity beyond the
first sign of damage. As a specific example for earth-
quake-resistant design, one might use fragilities to differ-
entiate between the design requirements for different cat-
egories of building occupancy based on seismic risk
[23]. Since the variability in the seismic hazard might
be strongly site-dependent, such an approach may also
require designing for different levels of the earthquake
hazard (expressed, e.g., in terms of spectral
accelerations) to meet all stated building performance
goals. Moreover, the load criteria may very well be site-
dependent. Some evidence of the need for this differen-
tiation can also be found in the wind area, where recent
research [24] suggests that wind risk is substantially
higher in hurricane-prone areas than in regions affected
mainly by strong extratropical winds.
System reliability analysis techniques must be
developed to provide the numerical risks to support such
design and decision-making. Such techniques can range
from the complex to the simple, but many are now
within reach. A performance-based approach to struc-
tural design seems complex when compared to the for-
mat and content of current structural standards. Nonethe-
less, it is an idea worth considering for the next
generation of reliability-based standards and for LRFD.
In the light of building performance during recent natural
disasters, it seems likely that more informative measures
of building risk may be required by the insurance indus-
try as a condition for underwriting policies for new or
existing building construction. It would be well for the
structural engineering profession to get a handle on this
before subsequent events move the decision process out-
side our technical realm where we can influence it and
into the political arena.
5.2. Target reliability measures
Probability-based analysis and design concepts are
founded on the notion of a “target” reliability or risk as
a quantitative measure of acceptable performance. Sel-
ecting reliability targets for structural engineering pur-
poses is difficult because of the unique nature of the
facility in question, limited data, and small limit state
probabilities of relevance. The reliability index, ␤ as a
measure of reliability in LRFD was adopted, in part, to
avoid the problem of specifying a numerical value of
risk. Calculated risks or failure probabilities that are not
consistent with what has been observed in practice create
a credibility problem for those using reliability tools in
structural analysis and design. Those of us who are
working toward advancing reliability-based design must
develop a fuller appreciation of this fact and be willing
to communicate the risk concepts to our colleagues and
others in terms that are easily understood.
One might attempt to establish reliability targets by
considering risks that arise from other exposures and
human activities. For example, the risk of death from
disease provides a psychological yardstick, of sorts,
against which the acceptability of other risks might be
measured. It is well to have some sense of what these
risks, expressed here in terms of annual frequencies, are
in the United States [1,25,26]. Overall mortality risk
(uncorrected for exposure) is about 8.6 ⫻ 10−3/year; due
to cancer and heart disease, 5.7 ⫻ 10−3/year. Individual
risk of death due to motor vehicle accidents is about 2
⫻ 10−4/year; due to home accidents, 1 ⫻ 10−4; due to
 B.R. Ellingwood / Engineering Structures 22 (2000) 106–115
fire, 1.5 ⫻ 10−5. Homicide risk is about 1.5 ⫻ 10−4/year,
taken over the whole population; in our inner cities, it
is higher by an order of magnitude. Commercial aviation
risk to a well-traveled professor of structural reliability
is about 5 ⫻ 10−5/year. Risks that are incurred volun-
tarily can be about 100 times those incurred involuntarily
and still be acceptable [27,28].
In the civil engineering field, the observation that, on
average, 1% of our dams suffer a failure of some kind
within 20 years of construction implies a dam failure rate
of about 5 ⫻ 10−4/year. Bridge collapse probabilities are
on the order of 10−4/year. Most estimates of building
structural collapse probability are in the range 10−6/year
to 10−5/year.
What, then, are we to make of the “risk” associated
with LRFD, and its target reliability indices of about
2.5–3.0 [29], obtained by calibrating to traditional design
practice for members in which the limit state is yield in
tension or first plastic hinge in flexure? The correspond-
ing limit state probability (for general localized yielding)
would be on the order of 0.0025 in 50 years or, approxi-
mately, 5 ⫻ 10−5/year, assuming that the variability in
the strength is small in comparison with that in the struc-
tural action due to the loads. The structural collapse
probability would be less, depending on the extent to
which the structural system permits load redistribution
following first yield. In a truss of 100 members, in which
each member is sized exactly at the LRFD limit, we
would expect to see one or two of the members at incipi-
ent yield sometime during a service life of 50 years.
These probabilities are not inconsistent with some of the
societal risks enumerated above. Perhaps they can be
explained and justified more easily than we have been
led to believe.
Determining acceptable risk hinges on socio-political
as well as technical issues and concerns. While risks are
real, the attitudes of the average person toward them are
not grounded in reality. People are more willing to
accept risks if they understand them. Public reaction to
nuclear power is a good example of what happens when
people are not well-informed about a particular tech-
nology and its associated risk, and a few highly vocal
special interests move into the void and steer the national
debate. Finding solutions to the problem of setting
acceptable risks in structural engineering will always be
difficult given the rarity of design-basis events. Engin-
eers must communicate risk information and voice their
views to their peers in profession and in the social arena.
We cannot back away from the acceptable risk issue by
talking about notional failure probabilities, reliability
indices, and such. More precise ways of expressing
reliability targets will have to be used to take full advan-
tage in LRFD of concurrent advances in structural analy-
sis and reliability analysis.
113
5.3. Designing for balanced risks
It seems self-evident that engineering design should
strive to achieve some balance among competing risks
by focusing efforts on reducing the worst of them. Costly
efforts can be misdirected toward reducing one source
of risk to vanishingly small levels, leaving other sources
unaddressed. We have one example of this in the build-
ing code community, manifested by the perennial argu-
ment concerning research funding in the wind versus
earthquake engineering areas. In the nuclear power area,
significant resources were directed for a number of years
toward large LOCA mitigation until PRAs demonstrated
that this was only a minor source of offsite risk in com-
parison to other sources, such as loss of offsite power.
Reliability methods can show where current code devel-
opment activities are not in tune with the risks. The first
generation of reliability-based codes does not take full
advantage of this capability.
As a simple example, suppose that structural failures
can result from any one of M mutually exclusive and
collectively exhaustive hazards, Hi, each of which occurs
(annually) with probability P[Hi]. Suppose, further, that
the consequences of failure due to each Hi are compara-
ble (this assumption is not necessary in decision analysis,
but allows the basic concept to be presented in a math-
ematically simple form). The risk of failure (measured
in this simple example by the probability, Pf) of a build-
ing would then be,
冘
M
Pf ⫽ P[Fail|Hi]P[Hi] (4)
i⫽1
in which P[Fail|Hi] ⫽ (conditional) probability of fail-
ure, given the occurrence of Hi. If each of the terms
P[Fail|Hi] P[Hi] is of comparable magnitude, then the
risk is “balanced.” Conversely, if one of these product
terms is orders of magnitude higher than the others, then
socio-technical efforts to address the other sources of
hazard will have only a marginal impact on overall risk
and might be criticized as a waste of public resources.
A general strategy for mitigating risk from diverse
sources should examine each of the terms in Eq. (4), in
turn, and would wring out as much benefit as possible
from each. It might be possible to reduce risk by con-
trolling or eliminating the hazard, which would reduce
P[Hi]. This might not be socially acceptable in some
instances (e.g., natural gas cannot be proscribed to con-
trol the possibility of explosions in apartments because
gas is necessary for heating and cooking). In others, it
might not be possible (e.g., we cannot control the occur-
rence of hurricanes or tornadoes). The structural stan-
dards community at present focuses its attention entirely
on the terms P[Fail|Hi], striving to reduce the effect of
the hazard by making the conditional probability
114 B.R. Ellingwood / Engineering Structures 22 (2000) 106–115
acceptably low. However, we only pay attention to a few
of the terms in this summation. It is little wonder that
our calculated probabilities do not agree well with obser-
vations.
There is a need to address the performance of struc-
tures against hazards other than those for which the
building was explicitly designed. These so-called abnor-
mal load events would include structurally significant
fires, explosions of natural gas, detonation of high
explosives, or vehicular collisions, events with inci-
dences typically on the order of 10−6 to 10−4 dwelling
unit/year [1]. Tragically, it is becoming more necessary
to take such a view, in order to mitigate the occurrences
of events such as those at the World Trade Center in
New York and the Murrah Federal Building in Oklah-
oma City. Probability-based LRFD criteria for fire-resist-
ant structural design are within reach [30], and special
load requirements can be found in the Commentary C2.5
to ASCE Standard 7-95.
5.4. Safety of buildings under construction
The LRFD Specification and ASCE Standard 7-95 do
not address buildings under construction. Reliability
analysis for buildings during construction is a difficult
problem, made more so by the nearly infinite number of
ways that building constuction can proceed. Contractors
maintain their competitive edge by ingenious construc-
tion sequencing and likely would view any standard with
suspicion, as possibly inhibiting their flexibility. An
ASCE Standard Committee is developing a construction
load standard. Incorporation of reliability concepts has
proved difficult.
5.5. Condition assessment of existing structures
Like any other man-made product, buildings wear out
over a period of many years from the accumulated
effects of use and the environment. Even a casual glance
at the decaying infrastructure in our largest cities high-
lights the importance of structural aging as a national
problem. Most structures are not designed for a finite
service life. Criteria are needed to evaluate existing
structures—to perform condition assessments of their
fitness for future service. It may be surprising to some
to learn that the LRFD Specification has no provisions
for load testing existing buildings; those engineers who
are asked to specify a load test often must consult Sec-
tion 20 of ACI Standard 318 for reinforced concrete
buildings, where some rudimentary provisions are found.
The time-variant aspect of the reliability analysis is
particularly significant for condition assessment of exist-
ing structures, since their strength and stiffness change
over time as a result of aging effects that are uncertain
and difficult to model analytically. On the other hand,
the fact that the structure has survived an extended per-
iod of previous service provides evidence of minimum
integrity. The proposed rehabilitation or retrofit may
arise from a change of building occupancy or usage, and
the reliability goals for the structure may have changed.
Nondestructive evaluation plays a key role in periodic
condition assessment; there is uncertainty in all common
NDE technologies, both in locating flaws and in measur-
ing their potential impact on structural behavior. More-
over, there is uncertainty associated with various mainte-
nance and repair actions. These uncertainties must be
taken into account in reliability-based condition assess-
ments of existing buildings. The current load and resist-
ance criteria in LRFD, which were intended for design-
ing new buildings and were developed from time-
invariant probabilistic models of strength in which the
above sources of uncertainty were not represented, may
not apply for evaluating an existing building [31]. While
quantitative risk or margins assessments have been pro-
posed for some critical facilities [22], such assessments
may be difficult if implemented for routine civil con-
struction. Developing LRFD tools for evaluating existing
steel structures presents a challenge.
5.6. Human error
After the structural reliability analyses are completed,
we are left with the fact that most spectacular and cata-
strophic structural failures have occurred as the result
of human error, not stochastic variation in the material
strengths or loads that are reflected in the load and resist-
ance criteria in LRFD. Errors are distributed throughout
the building process: in design, construction, and service
life. Human error caused the collapse of the Skyline
Tower in Fairfax, VA in 1973; the Hartford, CT Civic
Arena Roof in 1978; the Willow Island Cooling Tower
in WVA in 1978; the elevated walkway at the Hyatt
Regency Hotel in Kansas City, MO in 1981; the L’Am-
biance Plaza apartments in Bridgeport, CT in 1987. Con-
trary to intuition, design errors cause a significant frac-
tion of such failures. Steel structures are not immune to
such failures. Previous research has indicated that the
contribution of the human error term(s) in the summation
in Eq. (4) may be on the order of 5 to 10 times the
magnitude of the term(s) associated with stochastic
variability in loads and strengths. Research is needed to
identify error sources and to develop strategies for their
control in design, construction and operation. Ignoring
the possibility of such failures in risk assessment is
likely to lead to an overly optimistic view of facility
safety.
6. A few parting thoughts
Structural reliability methods furnish code developers
with quantitative bases for engineering decision-making
 B.R. Ellingwood / Engineering Structures 22 (2000) 106–115
and a clear audit trail for the treatment of uncertainties
in the building process. They do not remove the burden
of making the decisions, however. This frustrates some
engineers who, when first exposed to these methods, had
hoped to more or less automate the decision process.
Structural reliability provides a forum for a dialog
between the research and practice ends of structural
engineering on how best to manage uncertainty and risk
in structural design. This dialog must establish the link
between performance goals embodied in LRFD and
society’s willingness to accept risk. Thus, we may expect
to see structural reliability have an increasing role in the
code development process, enabling structural engineers
to reduce or otherwise manage risk, to address newly
defined hazards, and to identify and respond to new chal-
lenges in building design.
Acknowledgements
This paper was presented in a shortened form at a
Symposium on Innovations in Structural Design:
Strength, Stability, Reliability, which was held in Min-
neapolis, MN, June 1997, to honor Theodore V. Gal-
ambos. Its preparation was supported, in part, by
Lockheed-Martin Energy Corporation under Award
19X-SP638V and by the US Army Corps of Engineers
under Award DACW39-95-0018. This support is grate-
fully acknowledged. However, all views herein are those
of the author, and do not necessarily reflect the views
of the above organizations.
References
[1] Ellingwood B. Probability-based codified design: past
accomplishments and future challenges. Struct Safety
1994;13(3):159–76.
[2] Okrent D. The safety goals of the U.S. Nuclear Regulatory Com-
mission. Science 1987;236:296–300.
[3] Committee on Risk Appraisal in the Development of Facilities
Design Criteria. Uses of risk analysis to achieve balanced safety
in building design and operations. Building Research Board,
Washington, DC: National Academy Press, 1991.
[4] Davenport AG. A rationale for the determination of design wind
velocities. J Struct Div ASCE 1960;86(5):39–68.
[5] Wind forces on structures. Transactions, ASCE
1961;126(PartII):1124–98.
[6] Cornell CA. Engineering seismic risk analysis. Bul Seismological
Soc Am 1968;58(5):1583–606.
[7] Algermissen ST, Perkins DM. A probabilistic estimate of
115
maximum acceleration in rock in the contiguous United States.
Open File Report 76-416, US Geological Survey, Golden, CO,
1976.
[8] Minimum design loads for buildings and other structures (ASCE
7-95). American Society of Civil Engineers, New York, 1996.
[9] Freudenthal A, Garrelts J, Shinozuka M. The analysis of struc-
tural safety. J Struct Div ASCE 1966;92(1):267–325.
[10] Freudenthal AM, editor. Proceedings, International Conference
on Structural Safety and Reliability. Oxford: Pergamon Press,
1972.
[11] Safety and reliability of metal structures. Committee on Metals,
American Society of Civil Engineers, New York, 1972.
[12] Cornell CA. A probability-based structural code. ACI Journal
1969;66(12):974–85.
[13] Rosenblueth E, Esteva L. Reliability basis for some Mexican
codes. In: Probabilistic design of reinforced concrete buildings.
ACI SP-31, American Concrete Institute, Detroit, MI, 1972.
[14] Ang AH-S, Cornell CA. Reliability bases of structural safety and
design. J Struct Div ASCE 1974;100(9):1755–69.
[15] Ravindra MK, Galambos TV. Load and resistance factor design
for steel. J Struct Div ASCE 1978;104(9):1337–54.
[16] Galambos TV, Ravindra MK. Properties for steel for use in
LRFD. J Struct Div ASCE 1978;104(9):1459–68.
[17] Load and resistance factor design specification for structural steel
buildings. American Institute of Steel Contruction, Chicago, IL,
1993.
[18] Galambos TV. Probability-based load criteria: assessment of cur-
rent design practice. J Struct Div ASCE 1982;108(5):959–77.
[19] Ellingwood B. Probability-based load criteria: load factors and
load combinations. J Struct Div ASCE 1982;108(5):978–97.
[20] Uang C-M. Establishing R (or Rw) and Cd factors in for building
seismic provisions. J Struct Engrg ASCE 1991;117(1):19–28.
[21] Performance criteria resource document for innovative construc-
tion. NBSIR 77-1316, National Bureau of Standards, Wash-
ington, DC, 1977.
[22] Natural phenomena hazards design and evaluation criteria for
department of energy facilities (DOE-STD-1020-94). US Depart-
ment of Energy, Washington, DC, 1994.
[23] Cornell CA. Reliability-based earthquake-resistant design: the
future. Presented at Emilio Rosenblueth Symposium, 11th World
Conf on Earthquake Engrg, Acapulco, Mexico, June 1996.
[24] Simiu E, Heckert NA, Whalen T. Estimates of hurricane wind
speeds by the “peaks over threshold” method. NIST Technical
Note 1416, National Institute of Standards and Technology, Gai-
thersburg, MD, 1996.
[25] Statistical abstract of the United States. US Department of Com-
merce, Washington, DC, 1995.
[26] Wilson R, Crouch EAC. Risk assessment and comparisons: an
introduction. Science 1987;236:267–70.
[27] Starr C. Social benefits versus technological risk. Science
1969;168:1232–8.
[28] Pate-Cornell E. Quantitative safety goals for risk management of
industrial facilities. Struct Safety 1994;13(3):145–57.
[29] Ellingwood B, Galambos TV. Probability-based criteria for struc-
tural design. Struct Safety 1982;1(1):15–26.
[30] Ellingwood B, Corotis RB. Load combinations for buildings
exposed to fires. Engineering Journal, AISC 1991;28(1):37–44.
[31] Ellingwood B. Reliability-based condition assessment and LRFD
for existing structures. Struct Safety 1996;18(2):67–80.