ANOTHER LOOK AT RISK AND STRUCTURAL RELIABILITY CRITERIA

Transcription

1 ANOTHER LOOK AT RISK AND STRUCTURAL RELIABILITY CRITERIA V.M. Trbojevic, Risk Support Ltd., UK Abstract The paper presents a comparison of societal risk criteria and the several structural reliability criteria for two assumed profiles of consequence severity. Starting from the societal risk (FN) criteria (risk neutral) used in the UK and the Dutch criteria (risk averse), the consistent set of criteria is developed based on the maximum average individual risk and the number of people exposed (in a building) and compared against three major structural reliability codes. The findings indicate that there is incompatibility between the safety risk criteria and structural reliability criteria regarding risk aversion, that safety level provided by load bearing structures may be intolerable in comparison with the societal risk criteria as used informally for assessing risk to the general public in the vicinity of major hazards installation. Introduction Safety regulation in the hazardous industries focuses on control of risk to population or the general public. In this context term risk means risk of fatalities, however there are surrogate measures of risk taking into account severe distress, need for prolonged medical treatment, injury and death. To facilitate regulation of safety, risk criteria have been introduced which translate risk estimates as produced by a risk analysis into value judgments. For example, an estimate of individual risk per annum of 10-7 can be considered as negligible risk ; similarly, an estimate of injuries occurring several times per year, can be considered as unacceptable. In general there are two types of risk criteria: 1. Individual risk criteria which are legally in use, for example in the Netherlands and UK, and 2. Societal risk criteria expressed as intolerable frequency of exceedance of a specified number of fatalities, and which are used in a non-prescriptive mode. The purpose of structural reliability criteria or codes of practice is to ensure that structures and structural element are designed, constructed and maintained in such a way that they are suited for their use during the design working life in an economic way, JCSS Moreover, the structures are required to satisfy requirements such as serviceability limit state (to remain fit fir service), the ultimate limit state (to withstand extreme actions during their use), and be robust (they shall not be damaged by accidental events like fire, explosion, impact, etc.). 1

2 It is obvious that in the hazardous industries all facilities must be designed to similar reliability, structural and process integrity criteria, but that there is also an additional requirement in the form of risk acceptability criteria. The aim of this paper is to explore the level of safety that these different criteria offer expressed in terms of fatalities. Risk Criteria Societal risk (SR) is the term used to describe the chances that major accidents could result in harm to a significant number of people (SR is the relationship between the frequency and the number of people suffering from a specified level of harm in a given population from the realisation of specified hazards, Institution of Chemical Engineers 1992). The most widely used form of the societal risk criteria is based on the annual frequency F of N or more fatalities. A description of the societal risk criteria in the UK and the Netherlands is of interest because these two countries are in the forefront of the application and use of quantitative risk analysis and risk criteria. The interpretation of the risk criteria in the UK is looser than in the Netherlands, i.e. the upper tolerability limit is not used in the UK as the instrument of precise control of risk, but it is relied on ALARP (as low as reasonably practicable) dynamics to bring down the risk, HSWA In other words, the duty holders (company, responsible party, etc) have to ensure that risks to their employees, contractors and general public are as low as reasonably practicable (ALARP). In the Netherlands, the risk has to be below the upper tolerability limit and further risk reduction is not enforced. Consequently, the upper tolerability limit for individual risk to a member of the general public (or people living near by) from a hazardous installation in the UK is set to 10-4 per year but the risks have also to be ALARP, while in the Netherlands it is currently 10-5 per year and from 2010 it will be 10-6 per year, but the ALARP is not strictly enforced. Therefore the two criteria are most likely delivering the similar safety levels, i.e. the individual risk limit of 10-4 per year with the enforcement of ALARP is more likely to push the risk to near 10-5 level. United Kingdom The origins of the societal risk criteria in the UK can be traced back to the late 1970s, HSE In HSE 1989 the FN line was anchored at an accident causing 100 fatalities with the frequency of 1 in 10,000 per year, and the slope of -1. However, it was also noted that a line of this slope would seem to reflect the least that we judge the public might require for larger N; and they might want a steeper curve. In HSE 2001, the similar criterion was confirmed, but with the anchor point defined by the risk of a single accident causing the death of 50 people or more with the frequency of 1 in 5,000 per annum can be considered as intolerable. The broadly acceptable level of risk is suggested as a line three decades lower than the upper tolerable line. The term broadly acceptable is used as denoting that the risk, though definite, assimilates to the background level of risks we accept as part of daily life, HSE

3 The Netherlands A first attempt to define the societal risk criteria in the Netherlands dates back to 1976, Ale The Dutch approach is based on the individual risk criterion of 10-6 per year, which is translated into an anchor point for societal risk of 10-5 per year for 10 or more fatalities. In addition an aversion factor of 2 was applied so that a heavier weight is assigned to the larger consequences. The negligible risk values are defined by a line two decades lower. Linking Societal Criteria to Individual Risk Criteria The development of a societal risk criterion completely consistent with the individual risk was first proposed by Schofield This approach is based on a simple formula for the group risk or the estimated number of fatalities which is as follows: N IR = f ( N) N β max and f ( N) = F( N) F( N + 1) Where: N max is the number of people exposed to particular hazards, IR is the maximum tolerable individual risk, N max x IR is the maximum group risk assuming that all people are exposed to the same IR, f(n) is the frequency of exactly N fatalities, F(N) is the frequency of N or more fatalities, N is the number of fatalities, and β is a risk aversion exponent ( = -1 for no aversion, = - 2 for the Dutch case). Term no aversion means that one accident in 100 years involving 100 fatalities is as unacceptable as one accident in one year involving one fatality; with the risk aversion of -2, one accident in 100 years with 10 fatalities would be as unacceptable as one accident in one year involving one fatality. For the maximum individual risk, the maximum number of exposed people and the risk aversion factor, the term F(1) can be evaluated and the FN curve constructed as F(N) = F(1) / N β. The results for the derived N max for the British (N=50, F=2 x 10-4, β= -1) and Dutch (N=10, F=10-5, β= -2) criteria are given in Table 1. The criteria specified in HSE 2001, correspond to 715 exposed persons with the average IR of 10-4 per annum or 9,763 persons with the average IR of 10-5 per annum. The Dutch criteria correspond to 1,644 persons exposed to an individual risk of 10-6 per year. In addition, the consistent criteria are derived for two individual risk values of 10-5 and 10-6 and for 1,000 and 500 exposed persons. The values in bold in Table 1 represent the derived values. 3

4 Table 1. Relationship between IR, F(1), Nmax and β Criterion IR F(1) Nmax β UK (R2P2) 1.00E E UK (R2P2) 1.00E E-2 9,763 1 The Netherlands 1.00E E-3 1,644 2 Consistent 1.00E E-3 1,000 1 Consistent 1.00E E Consistent 1.00E E-4 1,000 1 Consistent 1.00E E The criteria corresponding to the parameters in Table 1 are also presented in Figure 1. Annual Frequency of N or More Fatalities 1.E-2 1.E-3 1.E-4 1.E-5 1.E-6 1.E-7 1.E-8 UK - R2P2 The Netherlands Consistent (IR=10-5, N=1,000, β=1) Consistent (IR=10-5, N=500, β=1) Consistent (IR=10-6, N=1,000, β=1) Consistent (IR=10-6, N=500, β=1) Number of Fatalities N Structural Reliability Criteria Figure 1. Societal risk criteria There are several structural reliability criteria in use, for example, DNV 1992, CSA 1989, Eurocode 2002, NKB 1978, JCSS 2000, etc. All of these prescribe a target annual failure probability depending on the type of failure and/or the severity of consequences. Therefore of interest is to explore the level of safety these codes offer in terms of failure frequency and the severity of consequences expressed in terms of fatalities. 4

5 Eurocode The Eurocode 2002 uses three reliability classes which are related to types of buildings and consequence categories as shown in Table 2. Table 2. Eurocode Consequence Classes and Annual Probabilities of Failure Conseq. Class Consequence Description Type of Building Min. Value for Reliability Index (annual) Corresponding Annual Probability of Failure CC3 High consequence for loss of human life, or economic, social or environmental consequences very great Grandstands, public buildings, concert halls, etc CC2 Medium consequence for loss of human life, or economic, social or environmental consequences considerable Residential and office buildings CC1 Low consequence for loss of human life, or economic, social or environmental consequences small or negligible Agricultural, storage buildings, greenhouses Nordic Committee for Safety of Structures (NKB) The next comparison is carried out for the Nordic Committee for Safety Code, NKB 1978, Kroon The NKB s target annual failure probabilities for load carrying structures are presented in Table 3. Table 3. NKB s Target Annual Failure Probabilities Consequences of Failure Type of Failure Severity Risk of Injury / Fatalities Societal Conseq. Ductile Failure with Reserve Strength Ductile Failure without Reserve Strength Brittle Failure, Stability Failure, etc. Less serious Small Insignificant Serious Significant Significant Very serious Large Very large It can be seen that for each type of failure there are three pairs of annual frequency and the corresponding consequence severity. The values in bold are taken for comparison (in Table 5). 5

6 Joint Committee on Structural Safety (JCSS) The tentative target reliability indices and associated target failure from JCSS 2001 rates are presented in Table 4. The values corresponding to in bold (5 x 10-4 ) is taken as anchor point for comparison (in Table 5). Table 4. JCSS Target Reliability Indices and Associated Failure Rates Relative cost of safety measure Minor consequences of failure Agricultural structures, silos, masts, etc Moderate consequences of failure Office, apartment, industrial buildings Large consequences of failure Hospitals, theaters, high rise buildings, bridges Large (A) β = 3.1 (p f = 10-3 ) β = 3.3 (p f = 5 x 10-4 ) β = 3.7 (p f = 10-4 ) Moderate (B) β = 3.7 (p f = 10-4 ) β = 4.2 (p f = 10-5 ) β = 4.4 (p f = 5 x 10-6 ) Small (C) β = 4.2 (p f = 10-5 ) β = 4.4 (p f = 5 x 10-6 ) β = 4.7 (p f = 10-6 ) Associating Fatalities to Probabilities of Failure In order to facilitate a comparison of the structural reliability criteria which prescribe the probabilities of failure for different consequence of failure severities, and the safety risk criteria which specify the relationship between the frequency of a hazardous event and the corresponding number of fatalities, one needs to associate severities of structural failure with fatalities. For the purpose of comparison a hypothetical office or residential building is assumed. Furthermore, it has been assumed that three consequence of failure severities correspond to 100, 10 and 1 fatalities for the upper level, and to 10, 1 and 0 fatalities for the lower level. These two levels can be associated for example, with the worst and the best estimates. The numbers of fatalities are kept fixed while the building occupancy (number of people in the building) will vary. The assumed numbers of fatalities and the corresponding failure probabilities for the three codes are presented in Table 5. Probabilities of failure in bold denote numbers given in the codes (other numbers are assumed), for example for Eurocode, the probability of failure of 10-6 for office buildings corresponds to 100 (10) fatalities, and the derived value for 10 (1) fatalities is one decade lower, etc.). In case of JCSS, the probability of 5 x 10-4 for office building has been assumed to correspond to the small fatality level, i.e.1 (0), 5 x 10-5 to 10 (1) fatalities, and 5 x 10-6 to 100 (10) fatalities. 6

7 Table 5. Number of Fatalities vs. Annual Probabilities of Failure Risk of Injury / Fatalities Assumed Number of Fatalities Upper Level Lower Level Eurocode - Residential and office buildings NKB - Ductile failure without reserve strength JCSS - Office, apartment building, etc Large x 10-6 Significant x 10-5 Small x 10-4 Comparison of Risk and Structural Reliability Criteria A graphical comparison corresponding to the values in Table 5 is presented in Figure 2. The consistent criteria are based on the average individual risk of 10-6 per year (same as the Dutch FN criteria), without risk aversion, i.e. β = 1, and with risk aversion factor β = 2. Annual Frequency of N or More Fatalities 1.E-3 1.E-4 1.E-5 1.E-6 1.E-7 1.E-8 The Netherlands Consistent (IR=10-6, N=100, β=1) Consistent (IR=10-6, N=100, β=2) EN / NKB Upper EN / NKB Lower JCSS Upper JCSS Lower Number of Fatalities N Figure 2. Comparison of Three Codes and the Consistent FN Criteria The first comparison is carried out for Nmax = 100 (total number of people in the building). It should be noted that this is highly pessimistic case because it corresponds to the probability of fatality equal to 1 (i.e. no survivals for the catastrophic structural failure). It can be seen that for the upper level of fatalities (1, 10, 100) both the Eurocode (EN) and the NKB are above the 7

8 criterion line, while for the lower level of fatalities (0, 1, 10) the EN/NKB line is below the criterion while the JCSS line is crossing it. It should be noted that the underlying assumption for the criteria and the fatalities was that the maximum number of exposed people was 100 and that the number of fatalities for the worst failure case is equal to that number. Fatality probability for the three failure probabilities was 1%, 10% and 100%. In reality 100% fatalities is practically never the case with catastrophic structural failures. Therefore, the next set of assumptions is made as follows: 1. The maximum number of people is assumed as 200, which with the same assumptions for fatalities means that the probability of fatality now becomes 0.05% (for 1 fatality), 5% (for 10 fatalities) and 50% (for 100 fatalities). The upper tolerable limit of the criterion also moves up (with the increased number of exposed persons). 2. The maximum number of exposed people is raised to 500, and the probability of fatality now becomes 0.2%, 2% and 20%. The criterion line again moves upwards. The new results are presented in Figure 3. Rick aversion has been removed from the criteria. It can be seen that the structural reliability criteria are above the FN lines even for an optimistic scenario of 20% fatalities in a catastrophic structural failure event. The structural reliability criteria are not sensitive to the amount of damage, in this case the number of fatalities, just to the damage severity. Annual Frequency of N or More Fatalities 1.E-3 1.E-4 1.E-5 1.E-6 1.E-7 1.E-8 Consistent (IR=10-6, N=100, β=1) Consistent (IR=10-6, N=200, β=1) Consistent (IR=10-6, N=500, β=1) EN / NKB Upper Level of Fatalities JCSS Upper Level of Fatalities Number of Fatalities N Figure 3. Comparison against Consistent FN Criteria for N max = 100, 200 and 500 8

9 In order to get a clearer view, the results for the occupancy of 500, for the two levels of fatalities (upper: 100, 10 and 1, and lower: 10, 1 and 0) are presented in Figure 4. Annual Frequency of N or More Fatalities 1.E-3 1.E-4 1.E-5 1.E-6 1.E-7 1.E-8 Consistent (IR=10-6, N=500, β=1) EN / NKB Upper Level of Fatalities JCSS Upper Level of Fatalities EN / NKB Lower level of Fatalities JCSS Lower Level of Fatalities Number of Fatalities N Figure 4. Comparison against Consistent FN criteria for N max = 500 It can be seen from Figure 4 that both EN/NKB and JCSS with the upper level of fatalities exceed the upper tolerable criterion, while JCSS with the lower level of fatalities is close to it. In fact as the criterion corresponds to the average individual risk of 10-6 per annum, the upper level of fatalities for EN/NKB correspond to average individual risk of 1.4 x 10-6 per annum and for JCSS to 6.8 x 10-6 per annum. Similarly, with the lower level of fatalities EN/NKB contribute 14% and JCSS 68% to the upper level of individual risk of 10-6 per annum. It should be noted that the structural probabilities of failure represent the maximum allowable values; however there are indications that occupants in a building are exposed to the higher risk than what is allowed for offsite population in the vicinity of major hazards installation. On the other hand there is usually some redundancy in structures which often is not taken into account in structural reliability analysis. Therefore structures are most likely safer than what the numbers in the codes would indicate. 9

10 Conclusions The above three examples indicate the following: 1. Safety level provided by load bearing structures may be intolerable from safety risk point of view (as proposed by the UK and Dutch societal risk criteria). 2. The structural reliability criteria should consider more explicitly the effect of potential consequences on the number of exposed persons. 3. There should be clear differentiation of structures like residential or office blocks in which people are not exposed to additional hazards, and the industrial structures in which the industrial operations risk may be significant and are added to the structural related risks (which may not be negligible). 4. There is a need for improved communication between structural engineers and safety/risk analysts in order to achieve better alignment of the two types of criteria; this can be achieved easily by starting from the same definition of either a broadly acceptable risk or the negligible risk. 5. Risk aversion (in the Dutch criteria) is generally rejected by structural reliability practitioners, however it would be interesting to discuss whether structural reliability criteria with risk aversion in the region of large consequences should be precautionary or whether the treatment of uncertainty in the codes accounts for precaution. For example, if for significant risk of fatalities (assumed 10 and 1 fatality, Table 5) the annual probability of failure is 10-5 (Eurocode, NKB), then for large risk fatalities (assumed 100 and 10 fatalities), the probability of failure should be 10-7 (i.e. two decades smaller, instead of existing 10-6 ). Acknowledgement Most of the work presented was performed within the EU - Project Safety and Reliability of Industrial Products, Systems and Structures (SAFERELNET), which has been funded by the European Commission under the contract number G1RT-CT , References Ale, B.J.M Tolerable or Acceptable: A Comparison of Risk Regulation in the United Kingdom and in the Netherlands, Risk Analysis, Vol. 25, No.2, CSA General Requirements, Design Criteria, the Environment, and Loads, Part 1 of the Code for the Design, Construction, and Installation of Fixed Offshore Structures, Preliminary Standard S471-M1989, Canadian Standards Association, Rexdale (Toronto), Ontario, Canada. DNV Structural Reliability Analysis of Marine Structures, DNV Classification Note No

11 Eurocode European Committee for Standardisation, European Standard EN 1990:2002 (E), Eurocode Basis of structural design, April. HSWA Health and Safety at Work etc Act 1974, SI 1974/1439 HSE, (1998), Ball, D.J. and Floyd, P.J., Societal Risks, HMSO. HSE Quantified Risk Assessment: Its Input to Decision Making, Health & Safety Executive, London, HMSO. HSE Generic Terms and Concepts in the Assessment and Regulation of Industrial Risks, Health & safety Executive, HSE Books. HSE Reducing risk, protecting people, HSE Books, ISBN Institution of Chemical Engineers Nomenclature for Hazard and Risk Assessment in Process Industries, Rugby, IChemE. JCSS Joint Committee on Structural Safety, Probabilistic model code, 12 th draft. Kroon, I Memo COWI, 25 June NKB Nordic Committee for Building Structures, Recommendations for Loading and Safety Regulations for Structural Design, NKB Report No. 36. Schofield, S.L A Framework for Offshore Risk Criteria, The Journal of the Safety and Reliability Society, Volume 13, No. 2, Summer. 11