Acta Polytechnica Vol. 43 No. g/2009 Risk Assessment in Advanced Engineerirg Design M. Holickf r'(t'i2drylodsfm designi'ng of eivitenginee_ring struclures and, other^enginee-rin-g s2steyu arefrequently based, onthe concept oftargetprobability offailure' Howeaer, tnx.Tnlaimtat qrmntity il tlsyatl2 Eecifieion tnt-iiyit of compirail,ae sii^d,ies and past expericnce only.Illoreoaer, probabilistit dzsign metllo( suffer from seaeial deficieiciis, inctuding tack of ansidcration ji accidental and oth.er ha,zard ::y*:.:_y !!::rytlyy-ces. Both of these extrene conditions are tnore ana"*ore frery.entty becoming causes of serious failures and, other adaerse eaents. Aaail'able.experienu clearly indicates that probabilistlc dulgn piocAures;na! be efwiently tippt *itii tyi *n analysis an'd assessmcnt, which can tahe into account aa:o.us iansequmces of imiaaourable eadts. ti| tnityoi'ont;c;paia'tnal n add'ition to trad'itional probabilistir concepts the methods of ad,uanced ingineeriig d,;sign will also **ron$ na,h" ,mrn yi iirpntt" rir,hs. KEwords: lnznrd,, risk, assessrnent, advanced d,esign, structure, engineering system. I Notation Ai States of nodel Bj States of node I Dh States of node D Ci Consequences of events .E7 (utilitl, cost, damage, injuries) C,o, Total expected cost Ei Events Hi Hazard situation i Hr Hazard situation under normal conditions H2 Hazard situation due to fire H3 Hazard situation due to fire without flashover H4 Hazard situation due to fire with flashover P(FlHi) Probability of failure F given situation.F{ g(r) Performance (limit state) function Fr Probabiliry of failure F Pa Target probability of failure Pr Probability P(FlI12) ofstructural failure during fire Prr," Probability of fire start P(I12) r Generic point of the vector of basic variables X Vector ofbasic variables F Reliability index qlr) Probability density function of the vector of basic variables X O-rritpi"l Inverse distribution function of standardized normal variable 2 Introduction Present standards for design of civil structures [], 2, 3] are mostly based on the concept ofthe target probability of failure 10. Howeve4 it is well recognised that the reliability of srmc- tures and other engineering systems suffers from a number of uncertainties, thar can hardly be analysed 14, b,6l and well described [7] by probabilistic methods. Moreove4, traditional probabilistic concepts consider the significance of failure and other adverse evenrs only very vaguely [], 2]. That is why probabilistic methods are often supplemented by recently l0 developing methods of risk assessment [5, 6, 8, g]. In some countries, risk assessment even becomes compulsory by law in the case of complex technical systems (powei stations, tunnel routes) by law. With regard to probabilistic concepts, it should be noted that civil engineering structures and other engineering sys- tems suffer fiom a number of uncertainties, which can hardly be entirely described by available theoretical tools. These uncertainties include [8]: r natural randomness of basic variables, o statistical uncertainties caused by a limited amount of avail- able data. o model uncertainties caused by deficiencies of computa- tional models, r uncertainties caused by inaccuracy in definitions of limit states, . gross errors caused by human faults, o lack of understanding of the actual behaviour of materials and structures. The above uncertainties are listed in an order correspond- ing to their increasing effect on the ffequency of failures and the decreasing possibility of describing them theoretical- ly. taditional probability methods usually deal with the first three types of uncertainties only. The fourth uncertainty could be partly described using the theory offuzzy sets [10]. Theoretical tools for the description ofgross errors are insut ficient [5], while no tools are available to describe lack of understanding of the actual behaviour of new materials and stnrctures. The theoretical tools obviously have a limited ca- pability to describe all rypes of uncerrainries [7,8]. This fact may partly explain the observed proportions of failure causes indicated in [8]. In general, structural failures and other adverse events occus primarily under hazard (accidental) situations (due to impact, explosion, fire and extreme climatic actions) and partially under normal (persistent) design situations due to common load effects. Obviously, further developments in advanced engineering design should be focussed on the most important causes, including the e{Iects ofvarious hazard situ- ations due to human activity and extreme environmental Acta Polytechnica Vol. 43 No. 3/2003 effects. Probabilistic concepts constitute the most important theoretical tool. 3 Probabilistic design methods Probabilistic methods are commonly based on the as- sumption that an event (failure) F given a certain condition (hazard situation) H, is unequivocally described by inequality g(r) < 0, where g(r) = 0 is the so called limit state function and x is a realisation of the vector of basic variables X' If the joint probability density qx(xlH) of basic variables X given the situation H is known, then the conditional probability pF =P(F!H) can be determined,as pF =P(F!H) = lq*<*lula* . (l) 91J;.o Instead of the probability po rhe reliability index F =-oil(Pr) is often used. It is well recognised [4] that the described concept has several deficiencies. Important defi- ciencies originate from uncertainties in the defrnition of the limit state function g(r) and in probabilistic models of basic variables X given the conditions 11. Howevet the most signifi- cant and essential deficiency of probabilistic design methods based solely on equation (l) is the lack of consideration for all hazard situations H, and the relevant consequences of unfavourable events. To reduce this drawback, methods of risk analysis and assessment have recently been developed [5, 6l and applied (e.g., [6]). 4 Basic concepts of risk assessment The risk assessment of a system attempts to cover all possible hazard situations that might lead to unfavourable events related to the considered system. The hazard situations include gross errors in human activity and accidental actions such as impact, explosion, fire and extreme climatic loads. Identified hazard situations (including accidental and common design situations), designated generally as H,, are assumed to occurwith a certain probability P(H,). If the failure F of a structure due to a particular situation Hr occurs with the conditional probability P(FlHr), then the total probability of falhne p, is given as I l]: po = FpirlHi)P(Hi). e)/-/ x The conditional probabilities P(FIH;) must usually be found by a separate analysis of the respective situations H,' Equation (2) can be used for harmonisation of the partial probabilities of failure P(flH,) P(H;) corresponding to the situations H,, and for the follorving risk consideration. In general, the hazard situations H,may lead to a number of events E, (e.g., collapse, excessive deformations, full devel- opment of-the fire, impact). The consequences of the events Eu are expressed by one-dimensional utility comp_onents C,' (.i.g., by the costs expressed in a certain currency)' Ifthe con- sequences C,, are uniquely related to the events E, then the to- tal utility (ridk) C related to the hazard situations H' is given as [8], c=fcre1n,,lrtop1no7. (3) ,1-/ ii It is sometimes necessary to describe the consequences of an unfavourable event E,, by a quantity having several compo- nents, denoted as Ci;, l (describing for example costs, injuries or casualties). The components Cu of the resultant risk are then given as \_rcn=) cij,kP(EijlHi)P(Hr). e)'' /-,t U If it is possible to specify the acceptable limit Cu,, for the components Co, then the structure can be designed on the ba- sis of the condition for acceptable risks Cp < Cp,;, which sup- plements the probability condition Pr < Fa. Several methods have been developed to analyse risk (fault tree, event tree, causal networks). A promising method seems to be provided by Bayesian decision analysis using decision trees or Bayesian (believe) causal networks. 5 Decision tree In general a decision tree has three basic nodes, as indi- cated in Fig. l: a decision node representing alternative ac- tions or options, a chance node representing the random out- come of the decision, and a utility node representing utility or risk outcornes of the decision [9]. llandorrr outtotne t.lritit].- Altematives I Fig. l: Decision tree for prior and posterior analysis The simplest form of decision analysis is so-called prior- -analysis of the risk (utility) when the basic statistical and probabilistic information is available prior to any decision or lctivitv. Prior analysis is an assessment of the risk associated with different decisions; it is commonly used for compar- ing the risks corresponding to different decisions. Posterior decision analysis differs from prior analysis by considering possible changes in the branching probabilities and/or the iottr.qu..t.et due to risk reducing measures' risk mitigating lLrndom tlutc{}luo System performance Litilit] llecision Risk reducine and Results of mitigation miasures mveslgauon Planned investigation Fig. 2: Decision tree for pre-posterior decision analysis ll Acta Polytechnica Vol. 43 No. gl100g measures and collection of additional information. Fosterior decision analysis may be used to evaluate different aclditional activities affecting the total risk. a1ottrc1 important modification of the described ap_ P,P".h.t,, Foy" T pr€-posterior decision analysis, -"y b. illustrated by the decision tree shown in Iig. 2. The aim of pre-posterior decision analysis is to identifi the optimal deci- sions with regard to activities that may be performed in the !qr., e.9., planning of risk reducing activities and/or col- lection of nen' information. An imporunt pre_requisite for pre-posterior decision analysis is consideration ofhrture ac- tions that may be applied taking into accounr the results of the planned activities. 6 Bayesian network Bayesian networks or influence diagrams (Bayesian net_ works supplemented by utility nodes)ltZ, ta1 provide an important generalization ofvarious decision trees. The main features of this method are illustrated by the following nvo examples. trig. 3 shows a simplified network extracted from influence_diagrams developed for risk analysis of buildings under a fire design situation [14, lb, 16]. Tfre nenuork coi_ sists ofseven chance nodes numbered l, 2, g,4,5, 12 and 14, four decision nodes 6, 7, 15 and 16, and six utility nodes g, 9, 10, ll, 13 and 17. The utility nodes represent the costs of yT."jr fire safety measures (nodes S, l0; lZ), damage to the building (nodes 9, I l), and injuries (node l3). Nodes are interconnected by directional arrows indicating causal links between par€nt and children nodes. AII the causa] links must, horvevel be described by appropriare input dara (conditional probabilities or utility unit$ tinrca to assumed states of the nodes. For example the utility nodes (except utility node l3) are directly dependent on the size of a build- ing (node l5). Utility node 13, describing the cost of injury is affected b7 the size of the building through the number of endangercd persons represenred Uy ctranie node 14. This data is sometimes difficult to specify, and expertjudgement often has to be used. Chance nodes l, 2,2,4,5,12 and 14 represent alternative random variables having two or more states. The node I _Sit_ uation describes the probability of fire start pfi,s = p(II2) and the complementary probabitii t -p6.uof iro^iinaf situation 1{,..Chance node 2-Sprinklers descriEes the functioning of sprinklers provided that the decision (node 6) is positiveithe probability of the active state of the sprinklers gin.r, uj n.. start is assumed to be very high, for eiample 0.gg9. Chance node 3-Flashover has two states: the design situation ilu (fire design situation without flashover) and H. 1fire design siiua- tion wirh flashover when the fire is fully developed). If sprinklers are installed the flashover in a compart- ment of 250 m2 has the positive state with the conditional probability 0.002; if sprinklers are nor installed then P{H4lH2} =0.066 [14, 15, l6]. It is assumed that with proba_ bilities equal to squanes of the above values the fire wiil flash over the whole building thus the values 0.000004 and 0.0044 are considered for chance node 3. Chance node 4_protection (introduced for formal computational reasons) has identical states as decision node 7-protection. Chance node 5_Col_ lapse represents structural failure that is described bv the probability distribution linked to three children nodes il, 3, 4). This situation can hardly be modelled using a decision tree. Nore that the probability of collapse in the case of fire brrt not flashover may be smaller than in a persistent situa- tion, due to the lower imposed load. In order to describe the basic principle of probability cal- culation used when analysing Bayesian networks, consider the fundamental task indicated in Fig. 4. The simple ocample in Fig. 4 is taken out of the diagram shown in fig. b. One child node D (Node I - Iire flashover) is dependent on rwo parenr Fig' 3: Bayesian nenryork describing a structure under normal and fire design situations t2 Acta Polytechnica Vol. 43 No. 312003 Fig. 4: A fundamental case of a Bayesian network nodes: I (Node I Design situation) and I (Node 2 Sprin- klers), each of them having a number of discrete statesli and 8,. If the children nodes I and I have a discrete statel, and B, then the probability of event Q (a particular state of node D) is given by the formula srp(Dk)= ) ,v1ople,n,)P(Ai)P(B j). (4) L,l In addition to the general relationships (2) and (3), equa- tion (4) represent the fundamental theoretical tool for analyz- ing Bayesian network or influence diagrams. The input data consists of the conditional probabilitiesP(Dpl'\87), which are sometimes diffrcult to specif. Another example of an influence diagram recently used for risk analysis of tunnel routes in Prague is indicated in Frg. 5 (unpublished study of the author). It shows the most important nodes describing safety in tunnels. It contains six decision nodes representing imPortant factors (l to 6), seven chance nodes (7 to l3) and six utility nodes (14 to l9). Arrows indicating causal links connect relevant nodes. All the causal links must again be characterized by appropriate input data' It is interesting to note that in this case the nenvork includes six decision nodes describing important factors af- fecting the safety of a tunnel, which might be adjusted at the design stage. The utility node$ repr€sent the economic factors and adverse consequences (nodes 14 to l9)' A more detailed description of the nodes is provided by the following list, which also indicates difticulties in input data specification. Decision nodes (l to 6) 1. Structure. The decision node describes the structural arrangement of the tumrel (length, slope, number of lanes, etc.), which might be adjusted at the design stage. 2. Traffic. Describes the raffrc arangements in the tunnel (curves, ingoing and outgoing lanes) that are alternatively considered in the design. 3. E-routes. Describes the distance of the escape routes and their capaciry that are considered in the design. 4. F-safety. Describes extent of fire safety measures applied in the tunnel, which may be adjusted in the design' 5. Ventilation. Describes the probability that the ventilation system applied in the tunnel will actually be functioning. 6. T-equipm. Describes the extent of the technological equipment that is activated in case of an accident. Chance nodes (7 to 13) ?. N*accid. This chance node describes the ntrmber of acci- dents per year. 8. N-pers. f)escribes the number of persons endangered during traffrc accidents in the tunnel. 9. F-starts. Describes the probability that a fire will start. l0.Function" Describes the efficiency of the fire safety equipment. 11. Fire. Describes the probability of a fully developed fire. l2.Function. Describes the efiiciency of the ventilation system. Fig. 5: Bayesian network for risk analysis in tunnels l3 Acta Polytechnica Vol. 43 No. gl200g I 3 . Smoke. Describes the intensity of smoke developed in the tunnel. Utility nodes (f4 to f9) 14.C3. Cost of the decision described in node 3. 15.C4. Cost of the decision described in node 4. 16. C5. Cost of the decision described in node 5. 17. C6. Cost of the decision described in node 6. 18. Injuries. Cost due to injuries. 19. Cll. Cost of a frrlly developed fire. hobabilistic and risk analysis is very similar ro that de_ scribed in detail above for the case of a fire situation. Wthout going into technical details trig. 5 shows the effect of the vCntilation system and technological equipment on the ex_ pected risk ofone tunnel in the city routi circle in prague, taking into accounr fatal injuries only. R t.2 1.0 0.8 0.6 0.4 0.2 0.0 2 Technological equipment only Fig. 6: Effect of ventilation level and technological equipment on expected risk in a tunnel 7 Tle implied cost of averting a fatality The utiliry nodes may generally describe economic as well as social and environmenhl costs [lZ, lg, lg]. In order compare all possible damages it is necessary to express all consequences in terms of a single unit. This seems io be an extremely difficult task. Thble I indicates that the cost of one life is estimated to about I to 3 million of USD (data pre_ sented in [9]). The so-called Implied Cost of Averting; Fa_ tality ICAF can be expressed as ( .'-r) rcAF(L,e)=gl r-[t*{l' lor, (5) [.' e) ) where symbols g, e andw are defined in Table l. However, the data indicated in Table I remains a subject for further investi- gation and should be considered as indicative values only. 8 Criteria for social risks An important question concerning risk assessment is what happens when we compare obtained results with acceptable limits. The criteria for social limits shown in Fig. Z are-taken from [8]. I l0 nr 100 1000 0.1 P 0.01 0.001 0.0001 0.00001 \ *N *=l ' 1 1=0.1, t=2 .lYesterschelde Fig. 7: Acceptable level ofsocial risks Table l: The Implied Cost of Averting a Fatality - ICAF(&), financial data in ppp USg (1999) obtained from UN-HDR 2001, World Bank Country g - annual income a - life time 2 zr.r - working part of e ICAF(Ae) tx lOt US 34000 ,7,7 0.15 2.6 J"pa. 26000 8t 0.15 2.1 Germany 25000 0.125 1.9 UK 22000 tt 0.125 t.7 Czech Republic 8000 ID 0.15 0.6 Mexico 8800 72 0.15 0.6 South Africa 9100 CD 0.15 0.5 Colombia 5900 70 0.15 0.4 China 3900 70 0. l5 0.3 India 2400 63 0. l5 0.1 Nigeria 800 47 0.18 0.04 t4 Acta Polytechnica Vol. 43 No. 3/2003 International standard ISO 2394 (1998) provides a limit for an individual risk of fatal injury per year by the value 10'6. If there are more endangered persons in one accident, the acceptable risk is usually expressed [8] as P(R>N)