When a building is hit by a sudden extreme load, from an industrial accident, a gas explosion, a vehicle impact or violent wind, the injuries rarely come from the event alone. They come from how the building responds: windows that turn into fragments, walls that break into debris, and in the worst cases, structural damage that spreads until floors collapse. Understanding these failure modes conceptually is the first step to understanding why protective design looks the way it does. This explainer covers glazing hazards, wall and nonstructural hazards, and progressive collapse, along with the design principles that address each.

Soldiers beside a tall earth-filled protective barrier wall
Soldiers beside a tall earth-filled protective barrier wall

Key takeaways

  • Glass type matters enormously: annealed glass breaks into large, sharp shards, while laminated glass tends to stay bonded to its interlayer.
  • A window is a system. Glass, frame, anchorage and the supporting wall must be balanced, or the weakest link fails first.
  • Progressive collapse is the spread of a local failure into a disproportionately large collapse; robustness, redundancy and continuity prevent it.
  • US references include UFC 4-023-03, GSA's progressive collapse guidelines, ASTM F1642 and ASTM F2912.

Why glass is usually the first concern

Windows are the weakest part of most building envelopes. Glass is strong in compression but brittle, and the large, thin panes in modern facades can fail at loads far below what the surrounding walls resist. When they fail, fragments can travel into occupied rooms. Federal guidance has long identified flying glass as a leading cause of injuries in building explosions, including in buildings well away from the event itself.

How different glass types break

Glass typeRelative strengthHow it breaksProtective notes
Annealed (ordinary float glass)BaselineLarge, sharp, dagger-like shardsMost hazardous; common in older buildings
Heat-strengthenedAbout twice annealedLarger pieces that tend to stay in the frame longer than temperedOften used as a ply in laminated glass
Fully temperedAbout four times annealedSmall, blunt cube-like piecesSafer edges, but pieces can still be projectiles at high velocity
LaminatedDepends on pliesCracks but fragments stay bonded to a plastic interlayerPreferred for protective glazing when properly framed and anchored

Insulating glass units, which combine two or more panes with an air space, are common in modern buildings. Protective guidance generally focuses on the inboard (room-side) pane, often specifying it as laminated so that if the outer pane fails, the inner layer retains fragments.

Balanced design: the window is a system

Making the glass stronger does not help if the frame bends, the glazing bite is too shallow, the anchors pull out or the wall around the window fails. Protective designers aim for a "balanced" system in which each element can carry the load delivered by the element before it. In practice, that means the glass, the frame, the connection of glass to frame, the anchorage of the frame to the wall and the wall itself are evaluated together. That principle explains why window film retrofits often include mechanical or structural silicone attachment to the frame, as described in our retrofit options comparison.

How glazing hazard is rated

In the US, glazing systems are tested under ASTM F1642/F1642M, the standard test method for glazing and glazing systems subject to airblast loadings. Test data are then used to assign a hazard rating under the companion specification, ASTM F2912. Conceptually, ratings range from cases where the glass does not break, through cases where it breaks but stays in the frame or drops close to the window, up to high-hazard outcomes where fragments travel well into the room. GSA's older test protocol uses a similar idea with numbered performance conditions. The key point for owners: a rating applies to the tested system as installed, under the test conditions, so the same product installed differently may not perform the same way.

Impact-rated glass doors installed on a building entrance
Impact-rated glass doors installed on a building entrance

Walls, ceilings and other debris hazards

Glass is not the only hazard. Building elements that are adequate for everyday loads can become debris under extreme ones:

  • Unreinforced masonry walls can crack and break into blocks and fragments that enter the room.
  • Lightweight cladding and infill may detach from the structure if connections are not designed for sudden loads.
  • Suspended ceilings, light fixtures, ductwork and shelving can fall or become dislodged, a hazard that also appears in earthquakes.
  • Doors may be pushed in or off hinges if hardware and frames are weak.

This is why wall retrofits focus on keeping wall material together and attached, for example with fabric or polymer catch systems, and why nonstructural anchorage matters. Our guide to natural hazard resilience shows how the same anchorage principles protect against earthquakes and high winds.

Progressive collapse, conceptually

Progressive collapse is the spread of an initial local failure from element to element, eventually causing the collapse of an entire structure or a part of it that is disproportionately large compared with the original damage. The key word is "disproportionate." A building that loses a column and suffers local damage around it has behaved far better than one in which the same loss brings down a full bay through all the floors above.

Historical lessons

The modern conversation about disproportionate collapse began with Ronan Point, a 22-story apartment tower in London. In 1968, a gas explosion in an 18th-floor flat blew out a load-bearing wall panel, and the corner of the building collapsed from top to bottom, killing four people. The panels had little continuity between them, so there was no alternative path for loads once one panel was lost. The UK changed its building regulations in response.

In the United States, the 1995 bombing of the Alfred P. Murrah Federal Building in Oklahoma City, which killed 168 people, led to new federal security standards, including the creation of the Interagency Security Committee. Post-event investigations found that a large share of the fatalities occurred in the portion of the building that collapsed, which made progressive collapse resistance a central goal of federal protective design.

How engineers prevent disproportionate collapse

The main US references are DoD's UFC 4-023-03, Design of Buildings to Resist Progressive Collapse, and GSA's alternate path guidelines for federal buildings. They use three broad strategies:

  1. Tie forces. Mechanically tying the structure together horizontally and vertically so that elements can hang from or bridge over damaged areas instead of falling.
  2. Alternate load paths. Checking that the structure can redistribute load and remain standing if a specified element is notionally removed, then strengthening where it cannot.
  3. Enhanced local resistance. Making key perimeter elements, especially ground-floor columns and walls, stronger and more ductile so they are less likely to fail in the first place.

Underlying all three are general design qualities that also help in earthquakes: redundancy (more than one way for loads to reach the ground), continuity (reinforcement and connections that run through joints), and ductility (the ability to deform significantly without breaking suddenly). Designers also avoid concentrating large loads on a single element whose loss would be disproportionately damaging. Broader building codes have absorbed some of these ideas; ASCE 7 includes general structural integrity provisions, and the International Building Code has structural integrity requirements for certain high-rise buildings.

Robustness is a design philosophy

Progressive collapse resistance does not assume any particular event. It asks whether the structure is tolerant of losing a part, from any cause. That makes it valuable against accidents, vehicle impacts, fire damage and construction errors as well as intentional acts.

Putting failure modes in context for owners

Most existing buildings were not designed with these failure modes in mind, and few owners can rebuild their structure. Practical priorities, usually identified through a risk assessment, often look like this:

  • Identify high-occupancy rooms adjacent to large windows on exposed faces.
  • Document glass type, frame material and condition, and how frames are anchored.
  • Look for unreinforced masonry or lightweight infill next to occupied areas.
  • Secure overhead nonstructural items in occupied spaces.
  • Ask an engineer whether the structure has obvious single points of failure, and whether a progressive collapse evaluation is warranted for the building's risk profile.

For an overview of the frameworks that set protection levels, read our guide to protective design standards. If you are new to the field, start with what blast mitigation is.

Frequently asked questions

Is tempered glass safe in an explosion?

Tempered glass breaks into small, blunt pieces rather than sharp shards, which is safer for everyday breakage. Under sudden high pressure, though, those pieces can still travel at high speed. Laminated glass, which keeps fragments bonded to an interlayer, is generally preferred for protective glazing.

What does progressive collapse mean?

It is the spread of an initial local failure to other elements, resulting in collapse of the whole structure or a disproportionately large part of it. Designers prevent it with tie forces, alternate load paths and enhanced local resistance.

Do building codes require progressive collapse design?

General codes include structural integrity provisions, and the IBC adds requirements for certain high-rise buildings. Detailed progressive collapse design is required for DoD buildings under UFC 4-023-03 where applicable and is commonly applied to federal facilities through GSA and ISC guidance.

Can windows be rated for hazard?

Yes. Glazing systems are tested under ASTM F1642 and assigned hazard ratings under ASTM F2912. Ratings apply to the system as tested, so installation must match the tested configuration.