{'fraction_non_alphanumeric': 0.036413689545141716, 'fraction_numerical': 0.010969988946589085, 'mean_word_length': 5.10828025477707, 'pattern_counts': {'":': 0, '<': 8, '<?xml version=': 0, '>': 5, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Optimal design of redundant structural systems: fundamentals

In spite of extended recent interest in System Reliability-Based Design Optimization (System RBDO) and life-cycle cost or Risk Optimization (RO), there is a lack of published studies on optimal design of redundant hyperstatic systems with objective consideration of (a) progressive collapse and (b) the impact of epistemic uncertainties. This paper investigates the fundamental aspects of the problem, by addressing the optimal design of simple two-bar active and passive redundant systems. Progressive collapse is objectively addressed, differentiating consequences of direct collapse of statically determinate structures, and progressive collapse of redundant, statically indeterminate structures. It is well known that reliability of a structural system also depends on nonstructural factors, or factors beyond structural design, such as unanticipated loading, manufacturing quality, quality of workmanship and human errors. These factors can be taken into account in an encompassing risk analysis, which accounts for physical and epistemic uncertainties, and which contributes a fixed latent failure probability to the structural optimization problem. Results presented herein show that the latent failure probability is the single most important parameter in determining optimal solutions, in System RBDO and in RO solutions. When the latent failure probability is smaller than target (System RBDO) or optimal (RO) failure probabilities, there is an equivalence between redundant and non-redundant (hyperstatic and isostatic) designs. However, when the latent reliability is smaller than target or optimal reliabilities, optimal designs become necessarily redundant (hyperstatic); as the only way to make system reliability larger than the latent reliability is by making structural systems redundant.


INTRODUCTION
Until today, basic structural design is made on a member-by-member basis. This includes design of redundant, statically indeterminate structures, which are known to be more reliable than non-redundant or statically determinate structures. Reliability-based calibration of partial safety factors of modern design codes is made at member level. To the best of our knowledge, there are no practical procedures or equivalent partial factors that can be used to design redundant systems, objectively accounting for their greater reliability.
Optimal design of structural systems considering uncertainties has been object of extensive research in recent years [1][2][3][4][5][6][7][8]. Some of the early seminal papers on structural reliability theory already advocated for the use of reliability measures to drive optimal structural design [9][10][11][12][13][14][15][16][17]. Reliability-Based Design Optimization (RBDO) addresses minimization of an objective function involving material and/or construction costs, subject to a reliability constraint for each failure mode [5][6][7]18]. RBDO is a straightforward extension from deterministic optimization, where deterministic design constraints are replaced by probabilistic constraints. System RBDO uses a single system reliability design constraint, allowing competition between failure modes [7,[19][20][21][22][23][24][25][26][27]. System RBDO has no deterministic equivalent, since the profession never managed to develop equivalent system safety factors. Life-cycle cost or Risk Optimization (RO) also allows competition between failure modes, but by accounting for expected consequences of failure; objectively addressing the compromise between safety and economy in structural design [7-8, 28-43, 74]. In a recent and extensive literature review , the author did not find a single reference on optimal design of redundant (hyperstatic) systems, with objective consideration of progressive collapse (see also over ninety references in Chapter 11 of Ref. [45]). Hence, optimal design of redundant systems accounting for progressive collapse is a widely open field of research.
This paper explores the fundamentals of optimal design of redundant structural systems, objectively considering progressive collapse and the effects of epistemic uncertainties. The study object is the simplest possible redundant structural system of two bars under tensile loading. Albeit simple, it reveals the influence of the most relevant variables: type of redundancy (active or passive), type of material post-failure behavior (fragile or ductile), dynamic amplification in load redistribution, and correlation between material strengths. Two unique features of the study are: differentiating consequences of collapse of redundant systems, occurring in a progressive manner (with warning), and collapses of statically determinate systems, which occur directly; and acknowledging the fundamental influence of epistemic uncertainties in optimal structural design. This paper does not address practical aspects of design for progressive collapse, such as binding techniques, compartmentalization, structural fuses, catenary actions, etc.; it does, however, provide a framework for the probabilistic investigation of the effectiveness of such measures.

Risk analysis
Engineering models are approximate representations of reality. Classical models in structural engineering are derived from solid mechanics principles, and assume perfectly known material properties, loads and boundary conditions. When dealing with model representations and modelling assumptions, different types of uncertainties need to be taken into account [44][45][46][47][48][49][50]. This includes: a) objective, aleatory uncertainties in structural loads, strengths of materials and member dimensions; b) subjective, epistemic uncertainties related to the amount of knowledge or information about the structural system being modelled; and c) human errors, arguably classified as aleatory or epistemic [46,[75][76][77][78]. Objective aleatory uncertainties can be quantified in terms of probabilities, with uncertain parameters modelled as random variables, random processes or random fields. Classic structural reliability analysis addresses objective uncertainties, quantified using probabilities.
Sub-modelling is employed to decompose complex engineering problems into smaller tractable units. For instance, risk analysis of a structural system considers several elements of subjective nature, and yields, among other things, potential loading scenarios ( Figure 1). Risk analysis includes many nonstructural factors, like: the threats to a given structure, considering its intended use, intended public and surroundings; the quality of workmanship, especially in case of large engineering projects; human errors in construction, controls during design and execution stages, operational abuse; subjective judgement and expert opinions [71,72], etc. The above factors include both aleatory and epistemic types of uncertainties. The threats, for instance, can be natural loading events like wind, snow, earthquakes, which can be described using probabilities; or exceptional loading arising from explosions, traffic accidents or terrorist attacks, whose quantification is more subjective. Risk analysis usually combines the above elements using failure and event trees, as illustrated in Figure 1, and results in potential loading scenarios, and in the probabilities of occurrence of each loading scenario. Figure 1: Relationship between risk analysis and structural analysis (with elements from [79]).
As an example, consider the case of progressive collapse due to abnormal loading. In a risk analysis, the probability of occurrence of an abnormal loading event is evaluated as . The probability of column loss ( ), given the abnormal loading event, is [ | ]. The unconditional probability of column loss becomes For a blast loading event, for instance, Shi and Stewart [80] show that collapse of a reinforced concrete column varies with size and distance of the charge; two variables that are very subjective to quantify. Similarly, the impact load resulting from a traffic accident depends strongly on mass and speed of the impacting vehicle. Due to the above epistemic uncertainties, among other reasons, design guidelines for sensitive buildings [51][52][53][54][55] prescribe requirements for alternate load paths, following discretionary element removal, and making designs robust w.r.t. column loss scenarios. In view of the above discussion, these design guidelines are equivalent to assuming = 1.
In a broad risk analysis addressing terrorist attacks, Stewart [81] reaches the conclusion that it may not be cost-effective to protect all US public buildings using the conservative column loss scenario.
A similar study [82] addressing performance, protection and control measures for iconic bridges shows that it may not be cost-effective to require effective performance and protection against terrorist attacks by improvised explosive devices, when the threat probability is below around ALE ≅ 10 -4 . In the illustrative example addressed herein, not considering the column loss scenario is equivalent to assuming = 0.
In between the two extreme scenarios of assuming = 1 and = 0 for the column loss example, in this paper we assume that one result of a risk analysis may be the failure probability for each element of the structure (0 ≤ ≤ 1). This failure probability is evaluated from physical and epistemic uncertainties not directly related to the structural analysis. From the point of view of the structural analysis or the optimization problem, this probability is given, and it is fixed. In order to maintain generality, this is called the latent failure probability ( ). Consideration of such a latent failure probability is a way of acknowledging that the reliability of structural systems does not depend only on structural factors, like the number of elements or their strength: it also depends on non-structural factors like workmanship, human errors in design and operation, operational abuse, failure due to unanticipated loads, accidental loads, terrorist attacks, etc. The latent failure probability is a constant, independent of usual design loadings, the structural redundancy or the actual strength of structural elements. Depending on nature and following the risk analysis, this could be a constant member failure probability, or a constant (sub)system failure probability. Here, constant refers to the structural design problem, not to the source or the actual member. Clearly, system reliability is a function of such latent failure probability.
The impact of latent failure probabilities on the structural system also depends on the enveloping risk analysis (Figure 1). Building on the column loss example above, the column loss probability due to terrorist attack with improvised explosive devices will be greater for columns at the public entrance of a building, than for other internal columns. The probability of column loss due to traffic accident is greater for a corner column exposed to two lanes of traffic, than for other internal columns of a building. The probability of column loss is smaller for a bridge column containing a physical barrier for protection.
Unanticipated loads (of phenomenological origin, for instance) could affect the reliability at system level, or affect a group of members. Examples are the failures of Tacoma Narrows bridge and the World Trade Center, where unanticipated loads affected a large group of members. Structural compartmentalization could be used to assign different and independent to different parts of the structure.
The latent failure probability is evaluated from physical and epistemic uncertainties not directly related to the structural analysis. In contrast, conventional structural reliability analysis only addresses objective probabilities, using well defined probabilistic models. Because of this difference, we refer to as a general way of addressing epistemic uncertainties in structural reliability analysis and, more specifically, in reliability-based optimization. The latent failure probability concept explored herein can be seen as complementary to more objective approaches to address modelling uncertainties in structural design, such as those described in [83][84][85][86].
The concept of latent failure probability proposed herein has strong similarities with the epistemic reliability index proposed by Ito et al. [64], in a context of design optimization. The analysis in [64], however, specifically addresses sampling uncertainties, whereas the latent failure probability proposed herein is given a much broader meaning. For the particular case of sampling uncertainties, the authors [64] are able to show that a conservative reliability index is obtained as the sum of the epistemic and aleatory reliability indexes; and that the epistemic reliability index is independent of the design variables. By similarity, the latent failure probability described herein is also independent of the (structural) design variables. Instead of adding the latent failure probability to the failure probability evaluated from aleatory variables, as in [64], we propose it to be included in the structural system modeling.
Risk analysis considering epistemic uncertainties often involves possibilistic representations of uncertainties, using intervals, fuzzy numbers, fuzzy probabilities or imprecise probabilities [56][57][58]. This is the case when subjective judgement and expert opinion [71,72] need to be accounted for. This may result in interval or fuzzy load cases, or in interval or fuzzy latent failure probabilities. These cases are out of scope for this paper.

Epistemic uncertainties in structural reliability and optimization
Epistemic uncertainties are also often included in structural reliability analysis. When epistemic uncertainties are quantified probabilistically, failure probabilities are interpreted as point-estimates [48].
Usually, however, epistemic uncertainties are modelled using intervals, fuzzy numbers, fuzzy probabilities or imprecise probabilities [56][57][58]. This leads to interval or fuzzy failure probabilities. The simultaneous consideration of interval or fuzzy variables, and random variables, leads to nested uncertainty representations, requiring failure probabilities to be evaluated repeatedly [60].
Epistemic uncertainties have also been considered in the context of reliability-based design optimization [60][61][62][63][64][65][66][67] and risk optimization [68][69][70]. Approaches specifically addressing insufficient information [61][62][63][64] lead to compromise solutions between reducing the objective function and increasing confidence on constraint feasibility. Approaches addressing more general types of epistemic uncertainties either consider conservative failure probability estimates [60,64,65], or lead to nested loops for handling interval/fuzzy and random variables. In the later case, the two nested uncertainty modelling loops become nested with the optimization problem, leading to three nested computational loops. Most of the papers in this subject are directed towards decoupling the analysis loops, making the computations tractable [59,60,67]. The interested reader is referred to Jiang et al. [60] for a comprehensive review on the subject.
In this paper, we propose an alternative and/or complementary way of considering the effect of epistemic uncertainties in structural reliability analysis or in reliability-based optimization. We propose epistemic uncertainties to be handled in the encompassing risk analysis, and that their effect on (the optimal design of) structural systems be reduced to a given, fixed latent failure probability. We acknowledge that this may not be possible for all problems; herein, we address those cases in which this is possible. In this sense, we are not trying to compete with alternative ways of handling epistemic uncertainties [56-60, 66-70, 83-86]. We do observe, however, that in those cases where the proposed alternative is feasible, the proposed latent failure probability approach has some advantages: a) it avoids the nested loops for handling epistemic and aleatory uncertainties; b) effects of the two sources of uncertainty are separated and easier to understand; and c) the latent failure probability is evaluated (estimated) only once, and remains constant during the design process. Notice the similarities with the properties of the epistemic reliability index in [64].
As observed above, in this manuscript we do not propose to compete with alternative ways of addressing epistemic uncertainties in structural reliability and reliability-based optimization problems [56][57][58][59][60][66][67][68][69][70]. We include this sub-section only because we foresee a generalization, beyond the scope of this manuscript, to handling of epistemic uncertainties in reliability-based optimization.
The main objective of this manuscript, in this regard, is to evaluate the impact of such latent failure probabilities (due to epistemic uncertainty) in optimal design of redundant structural systems. In spite of the tremendous impact (to be shown), there is no evidence of the latent failure probability concept in the published structural reliability or optimization literature. An extensive literature review on the subject [1-43, 59-70] revealed a single paper with an equivalent idea [64], yet focused on sampling uncertainties. In a similar way, the actual risk analysis is out of scope of this manuscript, which addresses the impact on optimal system reliability of a given latent failure probability .

Study object
This paper addresses optimal design of simple redundant systems, such as those illustrated in Figure 2.
The systems are formed by two bars of different materials, identified with numerals 1 and 2, which share the tensile load P.
The study object is simple and academic; but it serves the purpose of evaluating the impact of epistemic uncertainties in optimal design of redundant structural systems. Extensions to multi-bay multi-story RC buildings, with more explicit modelling of progressive failure, will be the object of future studies. The cross-section areas of the two bars are the design variables of the optimization problem.
These are determined independently. We start with a statically indeterminate two bar system, and let the optimizer decide whether a second bar is necessary or not. When the second bar is kept, we don´t know a priory if its cross-section area is sufficient to sustain load P. Hence, it is up to the optimizer to decide whether redundancy will mean just a statically indeterminate system, or if redundancy means that the secondary element has sufficient capacity to absorb the load in case of failure of the primary element.
When the structure is statically indeterminate and the two bars share the loading, we have a system with active redundancy (Figure 2, left). If the secondary member has sufficient capacity to absorb the whole load P, in case of failure of the primary member, then the reserve strength of the secondary member is mobilized in a passive manner. In this case, the redundant system illustrated in Figure 2 (left) actually exhibits active and passive redundancies. Therefore, from this point on, this is called active-passive redundancy in this paper.
The two systems illustrated in Figure 2 right exhibit passive redundancy, because the second element is disconnected, and does not take any loading, unless element 1 fails. The strength of element 2 is only mobilized in case of failure of element 1. Formulation and results for passive systems are presented in the appendix.

Material model
Progressive failure, and reserve strength of "failed" members depends on material behavior. In this study, a simple fragile-ductile material model is considered, as shown in Figure 3. The rupture or yielding stress is , and the post-failure strength is given by . For = 0 we have elastic-fragile material; for = 1 the material is elastic-perfectly plastic (ductile). Intermediate behavior is obtained for 0 < < 1.
In order to make developments as analytical and linear as possible, material strengths (and loading, for this matter) are modelled as Gaussian random variables. Rupture or yielding stresses are given by: where the subindex () indicates bar number. Coefficient of variation (COV) of material strength is given by = / . Moreover, correlation between material strengths is given by ∈ [0,1).

Load model
In order to investigate progressive failure of a two-bar parallel system, a sequence of two load applications needs to be considered. In this paper, loading is modelled as an independent sequence of two Gaussian load pulses ( = = ), with identical intensity: Each load pulse represents the maximum load that would be sustained during two periods of operation.
In case of failure of a primary member, dynamic load amplification may occur. To account for dynamic load amplification, an impact factor is considered: where is the load in the secondary member immediately after redistribution. The second load application ( ) is assumed to occur under static conditions. In the following, dynamic load amplification factors = {1,1.3} are considered. Load amplification is particularly relevant in failure of brittle members; nevertheless, the above values are employed for brittle and ductile members in the sequence.

Problem formulation
Let and be vectors of structural system parameters. Vector contains random variables, such as member dimensions and geometry, strength of materials, loads and model error variables. Vector represent the objective uncertainties, which can be modelled using probabilities (random variables).
Vector contains design variables whose values are to be determined, in order to maximize performance of the system, or in order to minimize weight, cost, etc. Typical variables in vector are nominal member dimensions, partial safety factors, reinforcement ratio, design life, parameters of inspection and maintenance programs, etc.
To keep the development as simple as possible, in this paper vector contains only the rupture or yielding stress and the loads, such that: = { , , , }. Vector contains the partial load factors to be used in design of the redundant systems: = { , }, which are introduced shortly.
The existence of uncertainty implies the possibility of structural failure. The boundary between safe and failure domains is given by limit state functions (d, ) = 0, written for each failure mode, and/or for each member of the structure, such that: Probabilities of primary and conditional member failures are given generically by: where P[ ] is the probability operator and ( ) is the joint density function of the random variable vector. In this manuscript, limit state functions are linear, and random variables have Gaussian distribution, hence Eq. (5) has analytical closed form solution [44,45]: where is the reliability index, [ ] is the expected value operator, and [ ] is the variance operator.
For the progressive collapse of redundant, statically indeterminate structural systems, the limit state function is written generically as: where ( ) represents the compound system failure domain, is the index set listing components of the k th cut-set, such that series, parallel and combined cut-set systems can be represented. Let represents the system failure probability, such that:

Latent failure probability of the parallel system
As discussed in Section 2, the reliability of structural systems does not depend only on structural factors.
Human errors in design, workmanship and operation, unanticipated loading and phenomenological uncertainties may lead to failures which are usually not considered in limit state functions (like Eqs. 4 and 7), but which can be evaluated from an encompassing risk analysis (Figure 1).
This paper addresses optimal design of the cross-section of the structural elements in Figure 2, for the normal load case described in Section 3.3. However, it is assumed that an encompassing risk analysis identified some abnormal loading conditions of very large intensity but very low probability of occurrence; it was further found that it is not economical to design individual elements to withstand such abnormal loading [80,81]. The single element failure probability given in risk analysis is . The same is valid for both elements.
To maintain generality, an alternative justification for the same comes from reliability of the connections, as illustrated in Figure 2. Technically, strength of the connections could be part of the structural design problem; but connections also fail due to non-structural causes like poor workmanship, manufacturing defects or assembly mistakes, which also vary according to connection type (welded, bolted, glued, etc.) and to experience of the construction crew. The probability of failure resulting from risk analysis could also be due to connection reliability ( ) and unanticipated loading ( ), such that = + .
As the structural system considered herein is very simple, the interpretation of as resulting from abnormal loading (and producing a "column loss" scenario) is not straightforward; therefore, from this point on, it is considered that results from connection failure due to non-structural causes. The main results presented in the sequence; however, are also valid for a situation of "column loss due to abnormal loading".
Let be the event "failure of connection to element one", and be the event "failure of connection to element two", with probabilities: where stands for latent failure probability. In order to avoid excessive growth of the failure tree, it is assumed that connection failure can only occur at the first time the connection is loaded (the first load serves as proof load).
Following Eq. (6), the latent failure probability can also be written as a latent reliability index This allows straightforward comparison with the target reliability index in reliability-based optimization (RBDO), and with the optimal reliability index * of risk-based optimization (both to be described).

Load sharing
Consider the two-bar statically indeterminate parallel system illustrated in Figure 2. In this type of (conventional) redundant system, the two bars share the workload, until one or both of them fail. If there is passive or standby redundancy, the remaining bar will absorb the total load, as commented in Section 3.1. If the displacement of both bars is the same, then the fraction of load P carried by the i th bar is: where is the stiffness of the i th bar, given by: = / , with the elasticity modulus, the cross-section area, and the length of each bar. If elasticity modulus and length are the same, the load fraction reduces to:

Usual design
Usual design of redundant statically indeterminate systems is made on a member-by-member basis, without differentiating for number of parallel elements. Moreover, load sharing is decided beforehand, i.e., on a basis of analyzing influence areas for loads. For the simple redundant system illustrated in Figure 2, for instance, one has: where is a conventional load (safety) factor. For proportional load sharing, one has = , which inserted in Eq. (12) leads to:

Design with independent dimensioning of each member
In order to address the optimal design of active-passive redundant systems, independent proportioning of each element is considered herein: and where ≥ 0, = {1, 2}, is the partial load factor for element i. The two-bar active-passive system is symmetrical; hence, any of the two bars could fail first, the other bar becoming the redundant element.
Each load factor is allowed to be equal to zero (but not both); hence, the result of system optimization may be that a redundant element is not necessary.

System reliability
The failure pattern of active-passive systems has both elements sharing the load from the beginning. Figure   4 illustrates the event tree for two load applications, where denotes the event "failure of bar i", and denotes the event "failure of connection to bar i". Overhead bars represent the complementary event.
Failure consequences are discussed later. Due to independent dimensioning (Eqs. 14 and 15), any bar can fail first. The limit state function for primary failure of the i th bar ( ) is given by: Figure 4: Event tree for active-passive system submitted to two load applications.
The reliability index for primary member failure is: The limit state function for conditional failure of a second element, given failure of the primary element (event | ), is: The reliability index for conditional failure is given by: Progressive failure of a second element may occur in the first load application, following failure of the connection to the primary element; or in the second load application, following failure of the primary element or its connection, in the first load application. For the second load application, there is no dynamic amplification, and = 1 in Eqs. (19) and (20).
As they are actively engaged (active redundancy), both elements may fail simultaneously. The limit state function for joint failure of the two bars (event ∩ ), is: The reliability index for the joint failure event is: The event in dashed lines, in Figure 4, corresponds to failure of bars 1 and/or 2: ∪ . The complementary event to ∪ is ∩ , as stated in Figure 4. The union probability is written as: By adding and substracting the term [ ∩ ] : we obtain, in the first line of Eq. (24), the probability that only bar 1 fails : In the same way, the second line in Eq. (24) is the probability that only bar 2 fails.
If the connections do not fail, there are tree mutually exclusive ways in which system failure can occur: progressive failure of bars in order 1-2, progressive failure in order 2-1, or simultaneous failure of both bars. Hence, following the event three in Figure 4, the system failure probability is obtained as: where the term | is evaluated from Eq. (20), with a proper change of indexes. In Eq. (26), the letters identify each line, according to the failure tree in Figure 4. Following Eq. (6), the system reliability index can be evaluated from system failure probability as = −Φ . Eq. (26) also assumes independence between the connection failure events and . More details about system reliability modelling can be found in [74].
The present academic problem was built so as to admit exact solution by the FOSM method (linear limit state functions of Gaussian random variables). In general, more elaborate reliability techniques may be required [see 44-46, for instance].

DESIGN OPTIMIZATION
From Eqs. (17) and (26) where unit material cost per volume is simply assumed proportional to mean strength ( , = 1,2). Two different approaches can be used to formulate the design problem: reliability-constrained design optimization, or optimization considering failure consequences, as follows.
(6), the target system reliability can also be written in terms of a target reliability index: Results of RBDO are clearly dependent on the target system reliability used as design constraint. The target reliability is specified a priori by the designer, and should be based on a costbenefit analysis.
The cost of ultimate failures accounts for damage to equipment, damage to third parties, payment of compensation for injury, death, and environmental damage, and for bad reputation. These costs are assumed constant, or independent of the design vector.
One relevant feature of risk or failure consequence-driven design optimization is the possibility to differentiate for the consequences of collapse that occurs directly, or without warning, and collapse that occurs in a progressive manner [42]. Failure of a primary element, which is not immediately  for active-passive redundant systems is given by: where the letters identifying each line correspond to the letters of the failure paths in Figure 4. The union term in Equation (31)  The failure consequence-driven design optimization problem is stated as: with = {0 ≤ , 0 ≤ } being side constraints.
In the above equations, failure cost multipliers , and can be interpreted as the actual cost of failures, or simply as parameters to balance the relative consequences of failure, w.r.t. the cost of materials for the reference structure. Typical values of these cost multipliers for conventional civil engineering structures are given in [73], which recommends a cost-benefit analysis for > 20. Our structural system is simple; hence, failure consequences could be several times larger than costs of materials. In this study, the following values are used: = 2, = 20 and = 100. Specific results to be presented depend directly on these cost multipliers. However, the overall conclusions are valid for similar relative magnitudes of cost multipliers.

Parametric analysis
The key parameters that characterize design of redundant systems considering progressive failure are the latent failure probability ( ), dynamic load re-distribution factor ( ), the correlation between material strengths ( ), material behavior (fragile-ductile) and the type of redundancy (active or passive). Latent failure probabilities are considered same for both connections: = = .
In the following, two levels of each parameter are considered:  Table 1. Two reciprocal cases are also investigated, following Table 1. Results are not presented or discussed herein, as they are reciprocal to the results presented in Sections 6.2 and 6.3 (the problem is symmetric w.r.t. bars 1 and 2). Results for System RBDO By using system reliability as a design constraint (System RBDO), the results illustrated in Figure  First, we note that the latent probability has the greatest impact in results, which superseeds any effects of material behavior (ductile/fragile), strength correlation or dynamic load re-distribution. When the latent failure probability is neglected, RBDO solutions are linear in partial factors and . This also occurs when the target reliability index is smaller than the latent reliability ( < 3.09 in Figure 5, right). When RBDO solutions are linear in partial factors and , there is a linear trade-off between these parameters. Hence, designs with same reliability are obtained with a single bar of either material, with two bars of same cross-section area, or with two bars of inversely proportional cross-section areas.
However, when the target reliability is larger than the latent reliability ( > 3.09), single-bar solutions are no longer optimal. Two bars become necessary, as the reliability of the system can only be larger than the latent reliability if the system becomes redundant. This is an obvious result, in retrospect, which had not been demonstrated before.
When the system becomes necessarily redundant, RBDO solutions become dependent on impact factor. Further, we notice that the solutions for ductile material are more dependent on strength correlation for large , when latent reliability is neglected or when it is much smaller than .
Results obtained for RBDO serve as a hint to results for risk optimization. Specifically, the nonlinear behavior related to the latent probability can be expected to affect risk optimization. Since the optimal reliability index * is a by-product of risk optimization, it is expected that the risk-optimal structure will be a two-bar redundant system when * > .

Results for Risk Optimization (RO)
Results for risk optimization of the active-passive system are presented in Table 2, and in When the optimal system reliability is larger than the latent reliability (right in Figures 6 and 7, for = 10 ), the local minimum along diagonal line = is dislocated towards the upper right corner, and optimal load factors are increased. For = 1, the optimal structure has two bars with same cross-section area ( = ≈ 1.46). For = 1.3, three local minima can be clearly seen (bottom right in Figures 6 and 7); the global minimum solution, however, has two bars with same cross-section area, with = ≈ 1.8. Again, we notice little influence of material post-failure behavior in the optimal solutions.
Usually, structural design is made on a member-by-member basis, and global (system) checks are made considering redundancy, robustness, etc. The problem herein was formulated in such a way that the optimizer decides if a second (redundant) member is required. System checks are warranted by collapse probabilities, and member checks are considered by failure of hyperstatic bars (service failure in Eq. 31). Therefore, some unexpected configurations are obtained, such as for = 10 and = 1.3 in Table 2. The optimal solution contains a bar which cannot sustain the total load ( = 0.512 for = 0), but which will share the load with bar 2 until it (eventually) fails. This optimal configuration is independent of material model, as for = 1 a similar solution is obtained. This feature is clearly a consequence of dynamic amplification in load redistribution ( = 1.3).      In comparison to the same strength case, we notice a lack of symmetry (as expected), and a greater influence of material post-failure behavior and load amplification factor. The impact factor has a greater role when is small and is large. System reliability is closer to linear with and for the ductile material with < = 3.09, and is non-linear with and for the fragile material. Linear or non-linear, there is an equivalence between two-bar and single bar solutions, when < = 3.09. For > , only redundant two-bar solutions are optimal. Also for this case, the reliability of the system can only be larger than the latent reliability if the system becomes redundant.
Impact of strength correlation is only relevant for the ductile material and for large , when latent probability is neglected or when it is much smaller than .

Results for Risk Optimization (RO)
Results for risk optimization of the active-passive system, with different mean strengths, are presented in Table 3 and Figures 9 ( = 0) and 10 ( = 1). In comparison to Figures 6 and 7, it is noted that symmetry with respect to diagonal line = is gone, as expected. The general trend, however, is still there: for = 10 (left in Figures 9 and 10 Two of the results in Table 3 26) and (31) are correct for very small , we conclude that the solutions are correct also for = 0.   Results for risk optimization of the active-passive system, with different mean strengths and different COVs, are presented in Table 4. Results are quite similar to those obtained for different means but same COV (Section 5.2): for = 10 , all optimal solutions are redundant two-bar systems; for = 10 , all optimal solutions are single-bar statically determinate systems. The most significant difference is observed for = 10 and for = 1.3, where the optimal solution changed from a twobar solution with a thin wire as bar two, to a single bar solution made of material 2 only. In all cases for which bar one has zero area, the joint failure reliabilities converge to that of bar two: ∩ = .   Among all parameters studied, it was shown that non-structural factors, or factors beyond structural design, play the largest role in optimal configurations. These factors include epistemic uncertainties affecting abnormal loadings; human errors in design, construction, and operation; operational abuse; etc. The influence of such factors in the optimum structural design problem was considered by imposing a latent failure probability, resulting from the encompassing risk analysis. It was shown that the only way to make system failure probability smaller than the latent failure probability is by making the structural system redundant. Hence, as a general practical conclusion, structural systems need to be redundant not (only) because of known, aleatory uncertainties, but also because of epistemic uncertainty arising from non-structural factors. Drawing a parallel to the discussion in Chapter 13 of ref. [46], it may not be worth increasing safety factors to account for gross errors, but it is worth making structures redundant because of them, as shown herein. Results in this paper where obtained for very simple two-bar parallel systems, with epistemic uncertainty affecting the reliability of connections. However, the results motivate intuitive generalization to the optimal design of more complex redundant systems.
It is well known that, in order to increase system reliability using shelf components, one has to create redundancy using parallel components. However, in structural engineering, each component is designed individually. Hence, one can in principle design individual members to be as reliable as desired. But when non-structural factors are taken into account, it becomes evident that redundancy is required. This is the main conclusion of this study. Somehow, this has been overlooked in past research addressing structural optimization via system RBDO or risk optimization . Specifically w.r.t these two formulations, it was shown herein that when the latent reliability is larger than target system reliability in RBDO, or larger than optimal risk-based reliabilities, there is an equivalence between redundant and non-redundant designs, and results become dependent on impact factors. However, when target (System RBDO) or optimal reliabilities are larger than the latent reliability, optimal designs become necessarily redundant. Optimal designs were found largely independent of material post-failure behavior (ductile-fragile), but only because same failure cost multipliers were considered.
Brittle failures are known to have worst consequences, because of the absence of warning prior to failure. Strength correlation was shown to play an insignificant role in optimal design. Bars with same mean strength and COV resulted in symmetrical optimal designs, whereas for different mean and COV ratios, symmetry is lost.
Ongoing research is addressing the impacts of latent failure probabilities in the optimal design of steel trusses and RC frames. Topology optimization concepts are being employed to handle the multimember problem. Understanding the fundamentals of reliability of structural systems in progressive collapse is very important, before more practical design situations can be considered.

APPENDIX: RESULTS FOR SYSTEM WITH PASSIVE (STANDBY) REDUNDANCY
This paper addresses design of redundant systems considering progressive collapse. Several problem parameters are considered, such as of material post-failure behavior, strength correlation, dynamic load amplification and ratios of mean and variance of material strengths. Surely, the type of redundancy is also relevant. In the body of the manuscript we addressed conventional systems, where redundancy is active, but may become passive in case of failure of a primary element. In this Appendix, we address passive (standby) redundancy, as illustrated in Figure 2 (right). All symbols have the same meaning as in the manuscript body, with exception of the design variables, which are renamed from to (active member), and from to (passive member). Notice that the problem is no longer symmetric.
Formulation Figure 11 illustrates the event three for a passive two-bar system submitted to two load applications. When the structure is first loaded, only bar 1 is active. If the connection to bar 1 fails, bar 2 and its connection are automatically mobilized. If connection to bar two also fails, we have direct collapse (DC). If the connection to bar 2 does not fail, the strength of the second bar is mobilized. If the connection to bar 1 does not fail, uppon first load appplication, then the chain of events ilustrated in the upper branch in Figure   11 becomes possible. The standby element may be engaged before failure of element 1; for instance, due to excessive deformation of element 1. If this is the case, then both elements can also fail simultaneously ( ∩ , path "i" in Figure 11). Dynamic load amplification may or may not occur, in this case. If dynamic load amplification is considered, then must be included in Eqs. (21) and (22). However, if goes to zero in the optimization problem ( → 0), with > 1 ; then it is possible that Φ[− ∩ ] becomes greater than Φ[− ], following Eqs. (18) and (22). In this case, the probability of the event 'only bar one fails' should go to zero (as bar two would fail also); for this reason, the operator max [0, … ] is included in Eq. (25): Figure 11: Event tree for passive two-bar system submitted to two load applications.
If the standby element does not engage before failure of element 1, then [ ∩ ] = 0, and path "i" in Figure 11 and line (i) in equation (34) should be disregarded.
Following the reasoning in Section 4.4 and Figure 11, the system failure probability is obtained as: Results of System RBDO are illustrated in Figure 12, for the passive assembly with same mean material strengths. Results for fragile material ( = 0) are shown at the top, and for the ductile material ( = 1) at the bottom. Results neglecting latent failure probability ( = 0) are shown left in Figure 12, and results for = 10 are shown right. Note the relevant impact of the latent failure probability, as observed for the active-passive system in Figure 5. Figure 12: System RBDO results for passive system with two bars of same material strength.
Comparing the results in Figure 12 with those in Figure 5, for an active-passive system with similar characteristics, one finds out that material post-failure behavior has a greater influence in optimal design of passive systems. Results for fragile material ( = 0, top in Figure 5) are non-linear with design factors and , and insensitive to dynamic load amplification factor and strength correlation , regardless of latent failure probability. Results for ductile material ( = 1, bottom in Figure 12) show greater influence of and , when < . For the ductile material, System RBDO results are almost linear with design factors and for < , similar to the active-passive system.
Results for RO, two bars of same mean strength ( = ) Results for risk optimization of the passive system are presented in Table 6, and in Figures (Figures 6 and 7), objective functions are more non-linear with parameters and , and material post-failure behavior has a greater impact. Both behaviors were also identified for the System RBDO formulation (see Figures 5 and 12). For = 10 or smaller (left in Figures 13 and 14), two local minima can be observed; one for large and very small (or even zero ), one for = 0 and large . There is an economical trade-off between these alternative designs, as objective functions are similar. The global minimum, in all cases, is the design with a large primary element (large ) and very small secondary element (very small ).
For brittle material, the second bar is not strong enough to sustain mean loads, and conditional reliabilities are very low ( | < 0). Because the ductile material continues to take load after failure, conditional reliabilities are large, in spite of small area for the second bar.
When = 10 (right in Figures 13 and 14), a third minimum point appears, and becomes the global minimum: in all cases, this corresponds to a more robust redundant systems, having two bars with similar cross-section areas. Interestingly, the optimal solutions are the same for both materials, showing that redundancy is mostly required to overcome the large connection failure probability. Since connection failure is controlling optimal design, material post-failure behavior becomes irrelevant. Also for = 10 we note that optimal solutions are the same, regardless of dynamic load amplification factor. This may be a consequence that the redundant element is designed already considering the amplification factor (in contrast to Eq. 15). Connection reliability has a strong impact in direct collapse costs, as observed in Table 5. Table 5: RO results for passive system with two bars of same mean material strength ( = ).