Probabilistic Models for Risk Assessment

Share Embed


Descrição do Produto

Risk Analysis, Vol. 2, No. I , 1982

Probabilistic Models for Risk Assessment Joseph Fiksel' and Donald B. Rosenfield' Received September 16. i 981

Recent concern with the potential for stray carbon fibers to damage electronic equipment and cause economic losses has led to the development of advanced risk-assessment methods. Risk assessment often requires the synthesis of risk profiles which represent the probability distribution of total annual losses due to a certain set of events or activities. A number of alternative probabilistic models are presented which the authors have used to develop such profiles. Examples are given of applications of these methods to assessment of risk due to conductive fibers released from aircraft or automobile fires. These assessments usually involve a two-stage approach: estimation of losses for several subclassifications of the overall process, and synthesis of the results into an aggregate risk profile. The methodology presented is capable of treating a wide variety of situations involving sequences of random physical events. KEY W O R D S probability; assessment;' accidents; risk; profiles.

collect and interpret the resulting information and to provide a quantitative risk assessment of the impact of carbon fiber composite use upon the civilian economy. The complexity of this problem required development of special techniques for risk assessment. This paper describes a series of models and a framework for the use of probabilistic risk assessment procedures. Examples are cited in which these models were used in developing risk profiles for potential economic losses due to the electrical effects of carbon fibers released from aircraft or automobile fires. 'lie important contribution of the authors' approach is the development of a two-fold breakdown of problem areas and of the subsequent methodological treatment in each type of problem that can lead to the successful development of risk profiles. Although it is difficult to determine the precise universe of problem areas amenable to one of the two approaches, some general guidelines can be developed so that the analyst can successfully apply one of the two frameworks presented. Example applications are presented in refs. 1-5.

1. INTRODUCTION

During the late 1970s, there was significant interest in the use of carbon fiber composite materials on advanced aircraft, and demand for these materials over the next few decades was projected to be strong. At the same time, a potential problem was recognized by the US. Government-carbon fiber composites that were involved in a fire might release tiny conductive fibers that could be transported in the air for miles, penetrate through windows or cracks, and cause damaging short-circuits in electronic equipment. This raised the spectre of possible widespread economic disruptions in the event of a serious aircraft crash. To investigate this phenomenon, a multimillion dollar research program was established under the guidance of the National Aeronautics and Space Administration (NASA). Arthur D. Little, Inc., was engaged to

'Arthur I). Little, Inc., Acorn Park, Cambridge, MA 02140.

1 0272-4332/82/0300-0001$03 00/1 E 1982 Society for Rlsk Analycls

Fiksel and Rosenfield

2

2. ALTERNATE RISK ASSESSMENT APPROACHES The term risk has been defined as the potential for unwanted negative consequences of an event or activity. ( 6 ) Risk is usually characterized by the frequency, or likelihood, of adverse consequences and by the magnitude, or severity, of such consequences. A system of defining risk in terms of “triplets” encompassing probabilities of scenarios and their impacts is described in ref. 7. Risk assessment is a practical discipline concerned with measuring and predicting the frequency and severity of adverse or undesirable events, and it has been applied to problems of risk management in many fields, including environmental pollution, occupational safety, transportation, and energy production. The techniques used in risk assessment are still evolving, since this is a relatively recent branch of management science. A common approach used to represent risk is the “risk profile,” whch is the complement of the probability distribution of the annual losses. In particular R ( x ) = Pr{ total annual losses exceed x )

and deals with losses for all events occurring in a given year. Closely associated is the “conditional loss profile” for a specific event E :

R ( x 1 E ) = Pr { Losses exceed x given that event E occurred} This paper presents a series of generalizable probabilistic models that the authors have used in risk assessment studies. The models developed here permit the synthesis of risk profiles whch quantify the losses resulting from random accidents in complex real-world situations. The major modelling problem addressed by the authors may be stated as follows: Assume that risk is due to the consequences of point process events, such as aircraft or automobile accidents. Each of these events can be subclassified into one of numerous types. (For example, in the case of aircraft accidents the location could be at any one of a large number of airports.) For each of the subclassifications a loss distribution conditional on the occurrence of an event may be developed. Under these conditions, the problem addressed is how to compute the risk profile for total annual losses.

The approach described here for solving t h s problem includes synthesis of loss distributions for the several subclassifications and conversion of conditional loss distributions into annual loss distributions. When the expected losses per incident are high, the conditional loss distributions for the several subclassifications can be mixed to determine an overall loss distribution. Convolutions of this distribution together with the probabilities arising from the point processes may then be used to develop the risk profiles for total annual losses. The convolution procedure is typically performed computationally, but the procedure of first developing a conditional loss distribution aggregated over all subclassifications minimizes the computational effort involved. Section 3 describes both the convolution procedure and the development of conditional loss distributions. For two risk assessments dealing with carbon fiber releases in general aviation and automobile accidents, a completely different type of probabilistic model was developed. For these cases, the numbers of subclassifications were very large and the number of failures per event of the point process was substantially less than one. Because of this, nearly all the probabilistic variation in the loss within each subclassification was due to the random nature of the failure process rather than physical conditions controlling the average number of failures. An analytic model was subsequently employed based on a Poisson distribution of the number of losses for each subclassification. The details of this analytic procedure are presented in Sec. 4.

3. DERIVATION OF RISK PROFILES FOR HIGH LOSS EVENTS For high loss cases, the risk profile was based primarily on conditional loss distributions, whch quantified the probabilities that a loss arising from any single incident subclassified by type of incident would exceed a given amount. The procedure was a probabilistic mixture and convolution. The equations used were as follows:

m

R ( x )=

2 PiG(’)(x) i=l

Probabilistic Models for Risk Assessment where I " ; ( x ) = probability that loss is greater than or

equal to x given an incident in subclassification i

Q, = conditional probability that an incident is of subclassification i N = number of subclassifications

3 for the 26 individual distributions resulted in significant errors in the tail of the overall distribution. Thus, the procedure to implement the system of equations was computationally based. On the other hand, the number of incidents per year was not extremely large. (The expected number of fire accidents involvingjets using carbon fiber composites per year was projected to be 2.7 in 1993.) We assumed a Poisson probability distribution:

G( x ) = probability that loss is greater than or equal to x given a single incident G(')(x ) = i-fold convolution of G

G(')(x) = G(x)

P,= probability of i incidents per year R ( x ) = Prob(tota1 annual losses equal or exceed x} The definition of subclassifications for conditional loss distributions should be guided by ease of model development. For example, in the analysis of potential risks due to carbon fiber releases from commercial aircraft, the subclassifications corresponded to the 26 airports designated as major hubs. Since each city's distribution of economic facilities and weather variables were unique, separate analyses were required for each city. These airports account for 68%of passenger enplanements and about 59%of air carrier departures in the United States, and we made the conservative assumption that all relevant accidents will take place on or near one of these 26 hub airports. As other airports and other potential accident locations are generally in lower density areas, this procedure might slightly overestimate the risk. The numbers Q, represented the conditional probability that an aircraft accident would occur at any one of the 26 hub cities given that an accident occurred. These numbers were developed from forecast accident rates for jet aircraft in 1993 taking into account operations forecasts and weather mixes at each airport. Some of the issues involved in implementing this system of equations should be noted. The 26 conditional loss distributions were all extremely skewed distributions whose standard deviations greatly exceeded their means. Attempts to use analytic forms

where p = expected number of incidents per year. A Poisson distribution can generally be assumed in any analysis of this type since actual incidents can be characterized by independent time increments. In the case of the carbon fiber analysis, since the P, values become negligible at i = 21, a computer program was written to compute the 21 convolutions of the function G. Thus, the development of the national risk profile was a simple computational procedure. For this type of problem, the procedure in Eq. (1) was judged to be superior to alternative approaches. Development of an annual loss distribution, for example, for each of the 26 subclassifications would have involved 26 separate convolution procedures and the synthesis of the 26 distributions would have involved an additional convolution. Direct simulation estimates of G( x ) or R( x ) would have been more computationally complex but subject to greater statistical uncertainty. In particular, direct estimation of R ( x ) would not have likely accounted for annual losses resulting from several high-loss accidents. The annual risk profile for economic losses due to air carrier fires involving carbon fibers is shown in Fig. 1. The horizontal axis shows total economic losses in 1977 dollars as a result of carbon fiber accidents in a given year. The vertical axis shows the annual probability of exceeding each dollar loss value. For example, an annual loss of $10,000 would be exceeded about once every 300 years. The expected annual losses in 1993 are about $470. These losses are substantially less than economic losses due to other risks either from natural or man-caused disasters. As a result of this risk assessment and other studies (9, which were completed before NASA reported on its findings, NASA concluded that the potential for economic losses from carbon fiber releases is very low,

Fiksel and Rosenfield

4

NearIy all of the input probability distributions were based on historical data, although forecasts of carbon fiber usage in 1993 required some judgment.

Error Analysis

10-4

10 1

I

I

102

lo3

lo4

lo6

Total Losses D IDollarsl

Fig. 1. National annual risk profile for carbon fiber releases from commercial air carriers in 1993 (vertical lines indicate error bounds).

and does not constitute a significant risk to the civilian sector. (NASA, of course, was not empowered to approve or disapprove the use of carbon fiber composites, but only to report on the potential risks.)

Development of Conditional Loss Profiles The issue of determining the conditional loss distributions for each subclassification in a risk analysis procedure is very much problem-dependent. For the analysis of risks due to carbon fiber releases from air carrier accidents a probabilistic simulation model was developed that was applied to each of the 26 hub airports. The model was a complex one involving the mechanics of cloud dispersion, the geometries of facility and accident location, and facility demographics. Further details can be found in ref. 1. The output of each simulation run was a statistical estimate of the conditional loss distribution for one of the 26 subclassifications. In each simulation iteration, it was assumed that an accident had occurred and the risks due to that accident were computed on the basis of numerous random input variables. These included weather factors (stability class, temperature, wind speed, wind direction), accident factors (location relative to airport, phase of operation, fire damage, burn time, explosion incidence, fuel burned), operations factors (runway orientation, aircraft size distribution) and the forecasted usage of carbon fiber composites.

Because of the nature of simulation models, one of the most important aspects of the carbon fiber study was an error analysis. This analysis consisted of two parts. The first part was an analysis of statistical errors due to the sampling nature of simulation models. The second part was an analysis of the effects due to modelling assumptions. Statistical errors arise since high-loss cases may not appear frequently as simulation samples. Indeed, the loss distributions were highly skewed, and thus there were a great many observations at low losses and very few at hgh losses. A substantial number of simulation trials were executed (nearly 10,000) using a stratified design with more iterations for high likelhood cites, and binomial confidence bounds were developed for each of the conditional loss distributions and for the national conditional loss distribution denoted by G(x) in Eq. (1). These bounds are presented in ref. 1. As an example, the 95% upper confidence bound on the conditional probability that an accident would result in a loss exceeding $74,000 (the highest observed value) was 3 X 10 '. At $10,000 the upper confidence bound was 2.5 times larger than the estimated value. The second source of possible errors analyzed was modelling assumptions. To assess these possible errors, an extensive series of sensitivity simulations were run for the city of highest mean loss, and critical input parameters were varied. These parameters included, for example, the estimated vulnerability of equipment. With the results of these analyses, confidence bounds for the national risk profile were developed to incorporate the two sources of error above (as well as the statistical error in the estimated 2.7 accidents per year in 1993). These bounds are incorporated withm Fig. 1. The bounds were judgmental in that they represented a qualitative synthesis of the two sources of error, but they did attempt to quantify the underlying errors in a Monte Carlo approach.

4.

DERIVATION OF RISK PROFILES FOR LOW-LOSS EVENTS

As part of the study of risk due to carbon fiber releases the authors also examined potential risk due

Probabilistic Models for Risk Assessment to accidents involving general aviation aircraft and automobiles. There were characteristics of these problems that caused difficulties in the application of the methodology described in Sec. 2. First, the number of events per year was much larger than for air carrier accidents. The number of general aviation fire accidents was estimated to be 88 in 1993, while the number of automobile fire accidents is estimated to be about 94,000 annually. As a result the convolution procedure was difficult to apply. Second, the number of subclassifications was extremely large. Because these types of accidents are likely to occur anywhere in the country it was necessary to subclassify each of the 3,000 counties in the United States. There were other subclassification criteria as well. The most important difference, however, involving aircraft and automobile accidents, was that the expected number of equipment failures per accident was substantially less than one. This was due to the relatively modest amounts of carbon fiber composites projected for these vehicles. For all of the subclassifications, the maximum values for expected number of failures per accident were 0.22 and 0.028 for general aviation and automobiles, respectively, while the respectively. averages were 0.022 and 5 X With a low expectation for the equipment failures for a given scenario (type and location of release, equipment type, and county location combination) the number of equipment failures is Poisson. (This can be validated by the assumptions of the failure model. Each exposed piece of equipment has an independent and small chance of failing.) Thus, the standard deviation, which is the square root of the mean, is significantly larger than the mean. It follows that the variance of the number of equipment failures may be due nearly entirely to the Poisson variation of number of failures given average number of failures, rather than to variation in the Poisson parameter. For example, if the expected number of failures is 0.01, any variation in failures is due nearly completely to the random variation in the number of failures (whether you observe 0,1,2, etc.), whch has a standard deviation of 0.1, rather than to the chance that the actual Poisson parameter may be 0.009 or 0.011 instead of 0.0 1. By defining numerous subclassifications, we were able to reduce this latter type of variation to a negligble effect (see ref. 3). This entire approach can indeed be predicated upon defining a large enough number of subclassifications. For these reasons an analytic methodology based on the Poisson distribution was developed to synthesize the overall risk profile for these two studies.

5

Although there were certain aspects of this methodology that were problem-specific, the general riskassessment procedure is applicable to problems characterized by a large number of subclassifications, a small number of expected failures per event, and minor variations within subclassifications due to sources other than the random nature of failures. An additional important feature of these problems was the high frequency of events per year. For this part of the process, historical data could be used to develop a probabilistic model. Furthermore, the relative frequency of accidents in each subclassification was also based on historical data. However, the model for actual losses due to carbon fiber releases given an accident was not historically based, and t h s was where the Poisson model was applied. It is noteworthy that due to the low number of expected equipment failures per accident, the expected number of equipment failures per year was only 1.9 and 46 for general aviation and automobiles respectively. Some of the problem-specific features of the methodology were as follows: for a given release scenario, equipment type, and county location of the accident, the number of equipment failures was a Poisson distribution with some expected value p. As a result of this, a matrix of Poisson expectations could be developed corresponding to: (i) equipment type as determined by SIC category; (ii) the particular county; and (iii) the amounts of CF released, which depend upon the type and severity of the accident. The use of CF amounts increased the number of subclassifications but significantly reduced the variation of p within subclassifications. The other two subclassification criteria were the essential means of differentiating economic impacts. Models were developed for each of the two risk analyses to determine the fraction of annual accidents taking place within each county. The probability distribution for number of losses was Pr(number of losses or failures per accident = x )

where pi = Poisson parameter for number of failures per accident for classification i (summed over all equipment types), and Q j = expected portion of accidents of classification i. A computer program was utilized to tabulate these probabilities.

Fiksel and Rosenfield

6 1

10 '

10

10' 10'

10'

lo6

10'

108

I

10

100

1000

10.000

100.000

1 Million

10 Milliori

Dollar Value D

Fig. 2. Approximate upper bound on national risk profile for general aviation accidents (1993).

1,000

10,000

100,000 Total Dollar Losses D

Fig. 3. Upper bound national risk profile for motor vehicles (1993).

1 .ooo.ooo

7

ProbabilisticModels for Risk Assessment In order to develop an annual dollar loss distribution, since the risk was very low, it was necessary to compute only the first two moments of the distribution. Chebyshev inequalities could then be used to determine an upper bound. (For problems where estimates rather than upper bounds are required one could use computerized convolution and tabulation procedures based on the annual mean failures, e.g., 46 for automobiles, or, in certain situations, a central limit approximation). The resulting annual loss distributions for the general aviation case and for the automobile case are presented in Figs. 2 and 3. The moments were computed from the conditional expectation formulae E ( x ) = E(E(xl4)

+

Var( x ) = E(Var( x 1 n ) Var E ( x 1 n )) applied to the distributions of the number of failures per incident, the number of incidents per year, and

the dollar loss per failure. The latter distribution was based on the assumption of independent multinomial random variables for equipment type (approximately true if the number of failures per event is substantially less than one).

5. CONCLUSIONS A modelling approach has been presented which permits risk assessments for complex processes involving multiple subclassifications of risky events or activities. The overall objective of the approach is to develop a risk profile for total annual losses. In the specific case studies cited, these losses were due to the release of carbon fibers from aviation or motor vehicle fires. However, the approach is generalizable to any process in which discrete independent occurrences present a finite chance of some measurable loss. The framework for the application of the various models is summarized in Fig. 4.

Development of Total Annual Risk Profile Case 1: High Expected Losses Per Incident and a Limited Numbcr of Subclassifications

Case 2:

/

Low Expected Losses Per Incident and Numerous Subclassifications

Analytic Methods Based On Poisson Distribution e.g., Carbon Fibers in General Aviation and Automobiles

Synthesis

Development Of Conditional Loss Profiles By Subclassification

e.g., Carbon Fibers in Commercial Aviation

Simulation Models

Analytic Models

Fig. 4. Alternative risk assessment methods.

8 To determine the universe of cases that can be analyzed by one of the two frameworks presented, the following guidelines can be applied. For the first type of approach, the following is required: (i) Appropriate models for conditional loss distributions for subclassifications. (ii) Ability to synthesize distributions through mixture and convolution techniques (which generally requires a moderate number of events per year.) For the second type of approach the following assumptions are required: (i) The dominance of the variation of number of losses per event for a given subclassification by the random nature of losses. (ii) A Poisson distribution of the number of losses in the subclassification given the average number of losses for the given event. This would follow, for example, from independent and low probabilities of each exposed entity resulting in a loss. For the first type of approach, simulation or analytic models can be used to develop conditional profiles, which assume that an initiating event such as an aircraft accident has occurred. Where simulation models are used,-of course, it is also necessary to develop an error analysis. For the second type of approach, one needs to define subclassifications so that the dominance of random variation occurs. This was our major design goal in determining subclassifications. This requirement generally implies a large number of subclassifications and a low number of losses per event. These characteristics are not mandatory, but at least for the applications considered, these resulted in the necessary condition above. In addition to the requirements above the two frameworks also implicitly assume: (i) A Poisson or other readily definable distribution for the number of events per year whose impacts are independent. (ii) An independent multinomial distribution of subclassifications and a mutually exclusive impact of subclassifications. (In other words, one event should not overlap two subclassifications.)

Fiksel and Rosenfield Given the validity of the two above assumptions, one can generally define the subclassifications to successfully apply one of the two frameworks. The important criteria for definition of subclassifications include loss classification and ease of model application, (e.g., city or county), and for the analytic model, reduction of loss variation within subclassifications.

ACKNOWLEDGMENTS The work described in this paper was supported under NASA contract NAS1-15380. The authors would like to thank Ashok S. Kalelkar of Arthur D. Little, Inc. who supervised the overall studies; Paul M. Brenner, Mark E. Pendrock, and Brian W. Smith of Arthur D. Little, Inc. who aided in the computer implementation of the models cited in this paper; Wolf Elber and Robert Huston of NASA, Langley, Virginia, and Karl Hergenrother of the Transportation Systems Center, Cambridge, Massachusetts who sponsored the studies cited and provided valuable technical guidance.

REFERENCES 1 . Arthur D. Little, Inc., “An Assessment of the Risks Arising From Electrical Effects Associated with the Release of Carbon Fibers from Commercial Aviation Aircraft Fires,” NASA Contract NASI-15380 (February 1980). 2. Arthur D. Little, Inc., “Event Probabilities and Impact Zones for Hazardous Materials Accidents on Railroads,” DOT Contract DOT-TSC-1607 (April 1980). 3. Arthur D. Little, Inc., “An Assessment of the Risks Arising from Electrical Effects Associated with the Release of Carbon Fibers from Motor Vehicle Fires,” NASA Contract NAS1-15380 (December 1979). 4. Arthur D. Little, Inc., “An Assessment of the Risks Associated with the Release of Carbon Fibers from General Aviation Aircraft Fires,” NASA Contract NAS1-15380 (February 1980). 5. National Aeronautics and Space Administration, “Assessment of Carbon Fiber Electrical Effects,” NASA Industry/Government Briefing, Hampton, Virginia, December 4-5, 1979, NASA Conference Publication 21 19. 6. W. D. Rowe, An Anatomy of Risk (Wiley, New York, 1977). 7. S. Kaplan and B. J. Garrick, On the Quantitative Definition of Risk, Risk Analysis 1, 11-27 (1981).

Lihat lebih banyak...

Comentários

Copyright © 2017 DADOSPDF Inc.