Guidelines for stress-test design for non-nuclear critical infrastructures and systems: Methodology

Transcription

1 Guidelines fr stress-test design fr nn-nuclear critical infrastructures and systems: Methdlgy STREST Reference Reprt 4 Editrs: Stjadinvic B, Espsit S Cntributrs:, Cttn F, Giardini D, Iqbal S, Mignan A, Selva J Reviewers: Dlšek M, Babič A Publishing editr: Tsinis G 2016 EUR EN

2 This publicatin is a Technical reprt by the Jint Research Centre (JRC), the Eurpean Cmmissin s science and knwledge service. It aims t prvide evidence-based scientific supprt t the Eurpean plicymaking prcess. The scientific utput expressed des nt imply a plicy psitin f the Eurpean Cmmissin. Neither the Eurpean Cmmissin nr any persn acting n behalf f the Cmmissin is respnsible fr the use that might be made f this publicatin. JRC Science Hub JRC EUR EN PDF ISBN ISSN di: / Print ISBN ISSN di: /607 Luxemburg: Publicatins Office f the Eurpean Unin, 2016 Eurpean Unin, 2016 The reuse f the dcument is authrised, prvided the surce is acknwledged and the riginal meaning r message f the texts are nt distrted. The Eurpean Cmmissin shall nt be held liable fr any cnsequences stemming frm the reuse. Hw t cite this reprt: Stjadinvic B, Espsit S, Babič A, Cttn F, Dlšek M, Giardini D, Iqbal S, Mignan A, Selva J, Tsinis G, Guidelines fr stress-test design fr nn-nuclear critical infrastructures and systems: Methdlgy, EUR EN, di: /659118

3 D DELIVERABLE PROJECT INFORMATION Prject Title: Acrnym: Harmnized apprach t stress tests fr critical infrastructures against natural hazards STREST Prject N : Call N : FP7-ENV-2013-tw-stage Prject start: 01 Octber 2013 Duratin: 36 mnths DELIVERABLE INFORMATION Deliverable Title: Guidelines fr stress-test design fr nn-nuclear critical infrastructures and systems: Methdlgy Date f issue: 31 July 2016 Wrk Package: Editr/Authr: Reviewer: WP7 Disseminatin and stakehlder interactin Bzidar Stjadinvic Simna Espsit (ETH Zürich) Matjaž Dlšek (ETH Zürich) Anže Babič (UL) REVISION: Final Prject Crdinatr: Institutin: fax: telephne: Prf. Dmenic Giardini ETH Zürich mailt: giardini@sed.ethz.ch

4

5 Table f cntents Abstract... iii Acknwledgments... v Deliverable cntributrs... vii 1. Intrductin ST@STREST methdlgy fr stress testing f critical nn-nuclear infrastructures ST@STREST Multiple-expert Integratin: EU@STREST ST@STREST Wrkflw PHASE 1: Pre-Assessment phase PHASE 2: Assessment phase PHASE 3: Decisin phase PHASE 4: Reprt phase ST@STREST Test Levels Cmpnent Level Assessment System Level Assessment ST@STREST Data Structures Applicatin f BNs t natural hazards and CIs Discussins ST@STREST Grading System Risk limits and bundaries between grades Grading system in time dmain Grading f the cmpnents Grading f the system with cnsideratin f epistemic uncertainties Discussin and future develpments ST@STREST Penalty System Prpsed Penalty System Incrprating ST@STREST int the life cycle management f nn-nuclear critical CIs Intrductin LCC including natural hazard risk Unified life cycle management f CI Life cycle analysis including stress test and pst-event data Discussins Using ST@STREST t enhance scietal resilience Mdelling resilience f critical infrastructures against natural hazards Resilience-based stress test fr critical nn-nuclear infrastructures Future research and discussins i

6 5. Cnclusins and recmmendatins References List f abbreviatins and definitins List f figures List f tables ii

7 Abstract Critical infrastructures (CIs) are f essential imprtance fr mdern sciety: these systems prvide the essential functins f public safety and enable, thrugh their services, the higher-level functins f a cmmunity, such as husing, educatin, healthcare and the ecnmy. A harmnized apprach fr stress testing critical nn-nuclear infrastructures, ST@STREST, has been develped. The aims f the ST@STREST methdlgy and framewrk are t quantify the safety and the risk f individual cmpnents as well as f whle CI system with respect t extreme events, and t cmpare the expected behavir f the CI t acceptable values. This reprt summarizes the ST@STREST methdlgy and framewrk, and addresses the extensins f the prpsed methdlgy twards life-cycle management f civil infrastructures and evaluatin f civil infrastructure system pst-disaster resilience. A detailed elabratin f these tpics is presented in the accmpanying Wrk Package 5 reprts. The ST@STREST methdlgy has been applied t six key representative Critical Infrastructures (CIs) in Eurpe, expsed t variant hazards, namely: a petrchemical plant in Milazz, Italy, large dams f the Valais regin in Switzerland, hydrcarbn pipelines in Turkey, the Gasunie natinal gas strage and distributin netwrk in the Netherlands, the prt infrastructure f Thessalniki, Greece and an industrial district in the regin f Tuscany, Italy. The utcmes f these stress tests are presented in the STREST Reference Reprt 5. iii

8

9 Acknwledgments The wrk presented in this reprt was cnducted within the prject STREST: Harmnized apprach t stress tests fr civil infrastructures against natural hazards funded by the Eurpean Cmmunity s Seventh Framewrk Prgramme [FP7/ ] under grant agreement n The authrs gratefully acknwledge this funding. The methds, results, pinins, findings and cnclusins presented in this reprt are thse f the authrs and d nt necessarily reflect the views f the Eurpean Cmmissin. v

10

11 Deliverable cntributrs ETH Zurich Simna Espsit Bzidar Stjadinvic Arnaud Mignan Dmenic Giardini UL Matjaž Dlšek Anže Babič INGV Jacp Selva Sarfraz Iqbal GFZ Fabrice Cttn vii

12

13 Intrductin 1. Intrductin Critical infrastructures (CIs) are f essential imprtance fr mdern sciety: these systems prvide the essential functins f public safety and enable, thrugh their services, the higher-level functins f a cmmunity, such as husing, educatin, healthcare and the ecnmy. Extreme natural events can interrupt services, cause damage, r even destry such CI systems, which cnsequently trigger disruptin f vital sci-ecnmic activities, extensive prperty damage, and/r human injuries r lss f lives. Recent catastrphic events shwed that the CI systems rarely recver their functinality back t the predisaster state, significantly increasing the cncerns f the public. In the cntext f the STREST prject, a harmnized apprach fr stress testing critical nn-nuclear infrastructures, ST@STREST, has been develped. The aims f the ST@STREST methdlgy and framewrk are t quantify the safety and the risk f individual cmpnents as well as f whle CI system with respect t extreme events and t cmpare the expected behavir f the CI t acceptable values. In particular, a multilevel stress test methdlgy has been prpsed. Each level is characterized by a different scpe (cmpnent r system) and by a different level f risk analysis cmplexity (starting frm design cdes and ending with state-f-the-art prbabilistic risk analyses, such as cascade mdelling). This allws flexibility and applicatin t a brad range f infrastructures. The framewrk is cmpsed f fur main phases and nine steps. First the gals, the methd, the time frame, and the ttal csts f the stress test are defined. Then, the stress test is perfrmed at cmpnent and system level; additinally, the utcmes are checked and analyzed. Finally, the results are reprted and cmmunicated t stakehlders and authrities. The ST@STREST data framewrk, used t stre and manage the data abut the CI under test, is als flexible, in that it allws the use f data structures that supprt frequentist (event and fault trees, bw ties) and belief-based ntins f prbability. The stress test apprach prpsed in this prject addresses the vulnerabilities f CIs t catastrphic but rare (high-cnsequence lw-prbability) natural hazard events. An extensin f the prpsed ST@STREST methdlgy and framewrk t integrate the results f stress tests and the data retrieved after disastrus events with the data cllected during every-day peratin f the system and its degradatin (lw-cnsequence persistent events) int a unified life-cycle management strategy fr CIs has been prpsed. In particular, the results f the risk analysis cnducted in the scpe f a stress test in terms f system perfrmance and expected csts f natural events, may be incrprated in a life-cycle cst analysis f the CI system and ptimizatin f its peratins and maintenance. Further, the evaluatin f risk reductin strategies resulting frm a lss disaggregatin may make it pssible t imprve the full management and maintenance plan f the CI itself. Mrever, the evaluatin f the state f civil infrastructures after the ccurrence f a natural event, and the cllectin and prcessing f pst-event data, such as typlgy, lcatin, cmpnent s features and the assessed physical damages, can be useful t update the state cnditin histry f the inspected cmpnents f the CI and t estimate and/r update perfrmance predictin mdels used in a future risk analysis. The CIs supprt the vital functins f public safety, and prvide energy, water, cmmunicatin and transprtatin services. By ding s, the CIs are an essential layer f frnt-line systems that supprt the ecnmic functins f a cmmunity, such as emplyment pprtunities, adequate wages and affrdable husing ptins, as well as scial functins like cmmunity wnership and participatin, educatin and training pprtunities, and a sense f cmmunity and place. Therefre, the CIs play a crucial rle in enabling a cmmunity t successfully functin by prviding the physical fundatins fr much f the ecnmic and scial activities that characterize a mdern sciety. An extensin f the ST@STREST methdlgy and framewrk t evaluate nt nly the vulnerability but als the resilience f CIs, i.e. the ability t prepare and plan fr, absrb, recver frm and mre successfully adapt t adverse events (TNA, The Natinal Academy 2012) has als been prpsed. This extensin builds n the ST@STREST methdlgy by 1

14 Intrductin mdelling the pst-disaster recvery prcess f a CI system and by quantifying the lack f resilience and the attributes f a resilient system using a nvel cmpsitinal supply/demand CI resilience quantificatin framewrk. This extensin enables a new rle f a stress test, that f examining the ability f a cmmunity and its CIs t bunce back after a natural disaster. This reprt is structured in the fllwing way: in Chapter 2, the main aspects f the prpsed engineering risk-based methdlgy fr stress tests f nn-nuclear CIs, ST@STREST, are presented. First, the wrkflw and the interactin amng the main actrs f the prcess are discussed. Then the multi-level apprach and the different levels f analysis are presented. Finally, a pssible grading system fr quantifying the utcmes f a CI stress test is intrduced. This system enables unifrm grading f stress test utcmes acrss a brad spectrum f CIs as well as indicating hw much the risk f the CI shuld be reduced in the next peridical verificatin f the CI. in Chapter 3 a methd t integrate the results f stress tests and the data cllected after disastrus events int a unified life-cycle management strategy fr CIs is intrduced. This methd enables management f bth lng-term degradatin and instantaneus natural hazard-induced stressrs during the lifetime f a CI system. in Chapter 4 the link between scietal resilience and the CIs f the cmmunity affected by a disaster is established first. Then, a time-varying metrics f resilience f a system is adpted in rder t represent the pre-event state f the cmmunity, the phases f disaster-induced lss accumulatin and absrptin, fllwed by the recvery phase and finishing with the pst-event adapted state f the cmmunity. A nvel cmpsitinal supply/demand resilience quantificatin framewrk is presented. The prpsed ST@STREST methdlgy has been applied t six key representative Critical Infrastructures (CIs) in Eurpe, expsed t variant hazards, namely: a petrchemical plant in Milazz, Italy, large dams f the Valais regin in Switzerland, hydrcarbn pipelines in Turkey, the Gasunie natinal gas strage and distributin netwrk in the Netherlands, the prt infrastructure f Thessalniki, Greece and an industrial district in the regin f Tuscany, Italy. The utcmes f these stress tests are presented in the STREST ERR5 (Pitilakis et al, 2016). 2

15 methdlgy fr stress testing f critical nn-nuclear infrastructures 2. ST@STREST methdlgy fr stress testing f critical nn-nuclear infrastructures The aims f the prpsed methdlgy are t assess the perfrmance f individual cmpnents as well as f whle CI systems with respect t extreme events, and t cmpare this respnse t acceptable values (perfrmance bjectives) that are specified at the beginning f the stress test. ST@STREST is based n prbabilistic and quantitative methds fr best-pssible characterizatin f extreme scenaris and cnsequences (Crnell and Krawinkler, 2000; Mignan et al, 2014; 2016a). Further, it is imprtant t nte that CIs cannt be tested using nly ne apprach: they differ in the ptential cnsequence f failure, the types f hazards, and the available resurces fr cnducting the stress tests. Therefre, multiple stress test levels are prpsed (Sectin 2.3). Each Stress Test Level (ST-L) is characterized by different fcus (cmpnent r system) and by different levels f risk analysis cmplexity (starting frm design cdes and ending with state-f-the-art prbabilistic risk analyses, such as cascade mdelling, Mignan et al, 2016a). The selectin f the apprpriate Stress Test Level depends n regulatry requirements, based n the different imprtance f the CI, and the available human/financial resurces t perfrm the stress test. In rder t allw transparency f the ST@STREST prcess, a descriptin f the assumptins made t identify the hazard and t mdel the risk (cnsequences) and the assciated frequencies is required. The data, mdels and methds adpted fr the risk assessment and the assciated uncertainties are clearly dcumented and managed by different experts invlved in the stress test prcess, fllwing a pre-defined prcess fr managing the multiple-expert integratin (Selva et al, 2015, Selva et al, in prep.). This allws defining hw reliable the results f the stress test are (i.e. level f detail and sphisticatin ) f the stress test (Sectin 2.6). Different experts are invlved in the implementatin f stress test prcess and different rles and respnsibilities are assigned t different actrs, as described in Sectin 2.1 and Sectin 2.2. In particular, several participants may be invlved, with different backgrund knwledge. The size f such grups depends n selected ST-Level (see Sectin 2.3). The wrkflw f ST@STREST cmprises fur phases (Fig. 2.1): Pre-Assessment phase; Assessment phase; Decisin phase; and Reprt phase. In the Pre-Assessment phase the data available n the CI (risk cntext) and n the phenmena f interest (hazard cntext) is cllected. Then, the gal, the time frame, the ttal csts f the stress test, and the mst apprpriate Stress Test Level t apply t test the CI are defined. In the Assessment phase, the stress test is perfrmed at Cmpnent and System Levels. In the Decisin phase, the stress test utcmes are checked, i.e. the results f risk assessment are cmpared t the bjectives defined in Pre-Assessment phase. Then critical events, i.e. events that mst likely cause a given level f lss, are identified and risk mitigatin strategies and guidelines are frmulated based n the identified critical events and presented in the Reprt phase. All the aspects characterizing the ST@STREST methdlgy are described in the fllwing sectins, in particular: The use f multiple experts (Sectin 2.1): t guarantee the rbustness f stress test results, t manage subjective decisins and quantify epistemic uncertainty. The wrkflw f the prcess (Sectin 2.2): descriptin f the sequence f phases and steps which have t be carried ut in a stress test. The multi-level framewrk (Sectin 2.3): the different levels f the risk analysis t test the CI respnse t natural hazards. Data structures (Sectin 2.4): different representatins f cmplex systems fr a prbabilistic risk analysis. The grading system (Sectin 2.5): t cmpare the results f the risk assessment with acceptance criteria and define the utcme f the test. 3

16 methdlgy fr stress testing f critical nn-nuclear infrastructures The penalty system (Sectin 2.6): t acknwledge the limitatin f the methds and mdels used t assess the perfrmance f the CI and eventually penalize the utput f the risk assessment. Fig. 2.1 Wrkflw f ST@STREST methdlgy 2.1 ST@STREST multiple-expert integratin: EU@STREST The invlvement f multiple experts is critical in a risk assessment when ptential cntrversies exist and the regulatry cncerns are relatively high. In rder t prduce rbust and stable results, the integratin f experts plays indeed a fundamental rle in managing subjective decisins and in quantifying the epistemic uncertainty capturing the center, the bdy, and the range f technical interpretatins that the larger technical cmmunity wuld have if they were t cnduct the study (SSHAC, 1997). T this end, the experts diverse range f views and pinins, their active invlvement, and their frmal feedbacks need t be rganized int a structured prcess ensuring transparency, accuntability and independency. EU@STREST, a frmalized multiple expert integratin prcess has been develped within STREST (Selva et al 2015, Selva et al, in prep.) and integrated int the ST@STREST Wrkflw (Sectin 2.2). This prcess guarantees the rbustness f stress test results, cnsidering the differences amng CIs with respect t their criticality, cmplexity and ability t cnduct hazard and risk analyses, manages subjective decisin making, and enables quantificatin f the epistemic uncertainty. With respect t the different levels in the SSHAC prcess develped fr nuclear critical infrastructures (SSHAC, 1997), the prpsed prcess is lcated between SSHAC levels 2 and 3 in terms f expert interactin. EU@STREST als makes an extensive use f classical Expert Elicitatins, and is extended t single risk and multi-risk analyses. 4

17 methdlgy fr stress testing f critical nn-nuclear infrastructures The cre actrs in the multiple expert prcess are the Prject Manager (PM), the Technical Integratr (TI), the Evaluatin Team (ET), the Pl f Experts (PE), and the Internal Reviewers (IR). The interactins amng these actrs are well-defined in the prcess. The descriptins and the rles f these actrs are given belw. Prject Manager (PM): Prject manager is a stakehlder wh wns the prblem and is respnsible and accuntable fr the successful develpment f the prject. It is the respnsibility f the PM that his/her decisins appear ratinal and fair t the authrities and public. The PM specifically defines all the questins that the ST shuld answer. Technical Integratr (TI): The technical integratr is an analyst respnsible and accuntable fr the scientific management f the prject. The TI is respnsible fr capturing the views f the infrmed technical cmmunity in the frm f trackable pinins and cmmunity distributins, t be implemented in the hazard and risk calculatins. Thus, the TI explicitly manages the integratin prcess. The TI shuld have: i) expertise n managing classical Expert Elicitatin (cee), preparing questinnaires and analyzing the results in rder t manage the interviews t extract the infrmatin frm the larger cmmunity feedbacks regarding critical chices/issues that any test invlves (e.g., the selectin f apprpriate scientifically acceptable mdels); ii) experience in hazard and risk calculatins; iii) experience in expert integratin techniques, in rder t manage the quantificatin and the prpagatin f epistemic uncertainty ut f acceptable mdels. Evaluatin Team (ET): The Evaluatin Team is a grup f analysts that actually perfrm the hazard, vulnerability and risk assessments required by the ST, under the guidelines prvided by the TI. The team is selected by cnsensus between the TI and PM, and it may be frmed by internal CI resurces and/r external experts. In this sense, the ET represents als the interface between the prject and the CI authrities, guaranteeing the successful and reciprcal acknwledgement f chices and results. Pl f Experts (PE): This pl is frmed nly if required by the ST-Level. Fr mst ST-Ls, the rle f the PE is cvered by the TI. It has the gal f representing the larger technical cmmunity within the prcess. Tw sub-pls are freseen, which can partially verlap: PE-H (a pl f hazard analysts) and PE-V (a pl f vulnerability and risk analysts). The PE-H shuld have either site-specific knwledge (e.g., hazards in the area) and/r expertise n a particular methdlgy and/r prcedure useful t the TI and the ET team in develping the cmmunity distributin regarding hazard assessments. The PE-V shuld have expertise n the specific CI and/r n the typlgy f CI and/r n a particular methdlgy and/r prcedure useful t the TI and the ET team regarding fragility and vulnerability assessments. Individual experts f the pl may als act as prpnent and advcate a particular hypthesis r technical psitin, in individual cmmunicatins with the TI (referring t SSHAC (1997) dcuments, the PE includes bth resurce and prpnent experts). They participate t the interviewing prcesses (either in remte r thrugh specific meetings) lead by the TI as pl f experts, prviding the TI fr their pinins n critical chices/issues. If requested by the CI authrities r if irrecncilable disagreements amng the experts f the pl emerge during the interviewing prcesses (in bth PHASE 1 and PHASE 2 f the Wrkflw, see Sectin 2.2), the TI and PM may decide t rganize meetings with the PE (r parts f it), in rder t penly discuss abut cntrversial issues. In this case, the pl acts as a panel, and the TI is respnsible fr mderating the discussin. Internal Reviewers (IR): One expert r a grup f experts n subject matter under review that independently peer reviews and evaluates the wrk dne by the TI and the ET. This grup prvides cnstructive cmments and recmmendatins during the implementatin f the prject. In particular, IR reviews the cherence between TI chices and PM requests, the TI selectin f the PE in terms f expertise 5

18 methdlgy fr stress testing f critical nn-nuclear infrastructures cverage and scientific independence, the fairness f TI integratin f PE feedbacks, and the cherence between TI requests and ET implementatins. In particular, IR reviews the prject bth in terms f technical and prcedural aspects f the prject (actr s independency, transparency, cnsistency with the prject plan). The IR makes sure that the TI has captured the center, bdy and range f technically defensible interpretatins when epistemic uncertainty is accunted fr in the ST level. Nte that the IR actively plays an imprtant rle during the prject and thus is part f the prject. If regulatrs r external authrities fresee an external review f the prject results, this further review is perfrmed independently and after the end f the prject. Here, the internal review by the IR is cnsidered essential als in this case, in rder t increase the likelihd f a successful external ex pst review. The CI authrities select the PM. The PM selects the TI and IR and, jintly with the TI, the cmpnents f the ET and f the PE. PM and TI are, in principle, individuals. The ET and IR may invlve several participants, with different backgrund knwledge, but in specific cases may be reduced t individuals. The PE is, by definitin, a grup f experts. In all cases, the size f grups depends n the purpse and the given resurces f the prject. The PM interacts nly with the TI and specifically defines all the questins that the prject shuld answer t, taking care f the technical and scietal aspects (e.g., selectin f the ST level, definitin f acceptable risks, etc.). The TI crdinates the scientific prcess leading t answer t these questins, crdinating the ET in the implementatin f the analysis, rganizing the interactin with the PE (thrugh elicitatins and individual interactins), and integrating PE and IR feedbacks int the analysis. The ET implements the analysis, fllwing the TI chices. The IR reviews the whle prcess, in rder t maximize the reliability f the results and t increase their rbustness. The basic interactins amng the cre actrs are shwn in Fig Fig. 2.2 The basic interactins amng the cre actrs in the prcess f EU@STREST 2.2 ST@STREST wrkflw The wrkflw represents a systematic sequence f steps (prcesses) which have t be carried ut in a stress test. As mentined befre, the ST@STREST wrkflw cmprises fur phases: Pre-Assessment phase; Assessment phase; Decisin phase; and Reprt phase. Each phase is subdivided int a number f specific steps, with a ttal f 9 steps. In the Pre-Assessment phase all the data available n the CI and n the phenmena f interest (hazard cntext) are cllected. Then, the gal (i.e. the risk measures and bjectives), the time frame, the ttal csts f the stress test and the mst apprpriate Stress Test Level t apply are defined. In the Assessment phase, the stress test is perfrmed at Cmpnent and System Levels. The perfrmance f each cmpnent f the CI and f the whle system is checked accrding t the Stress Test Level selected in Phase 6

19 methdlgy fr stress testing f critical nn-nuclear infrastructures 1. In the Decisin Phase, the stress test utcmes are checked i.e. the results f risk assessment are cmpared t the risk bjectives defined in Phase 1. Then critical events, i.e. events that mst likely cause a given level f lss value are identified thrugh a disaggregatin analysis. Finally, risk mitigatin strategies and guidelines are frmulated based n the identified critical events. In the Reprting Phase the results are presented t CI authrities and regulatrs. Fig. 2.3 Interactin amng the main actrs during the multiple-expert prcess EU@STREST. The PE is present nly in ST sub-levels c and d. Fr sub-levels a and b, the rle f the PE is assumed directly by the TI The participatin f the different actrs significantly changes alng the different phases f the Stress Test (Fig. 2.3). The PM and TI are the mst active participants in the ST wrkflw. The PM participates in all the steps f the Stress Test until the end (reprting f the results), while the rle f TI ends at the end f the Decisin phase. The TI is cnstantly assisted by the ET and supprted by the PM, while the level f assistance depends n the ST level. The PE (if present, see Sectin 2.3) participates in the Assessment and Decisin phases. The IR perfrms a participatry review at the end f Phase 1 and 3. The final agreement, at the end f the Decisin phase, is made amng the PM, TI and IR. The wrkflw and the invlvement f main actrs and their phase-wise interactins are shwn in Fig In the fllwing, a detailed descriptin f the fur phases is prvided tgether with a specificatin f the invlvement f the different experts in prcess PHASE 1: Pre-Assessment phase The Pre-Assessment phase cmprises the fllwing three steps: STEP 1 Data cllectin: cllectin f all the data available n the CI (risk cntext) and n the phenmena f interest (hazard cntext). Als data cming frm Stress Tests perfrmed n ther similar CI and/r in the same area are cllected. In this step, the test participants are selected: the PM selects the TI and the IR; the TI and the PM jintly select the ET. Then, the TI, with the technical assistance f the ET, 7

20 methdlgy fr stress testing f critical nn-nuclear infrastructures cllects data and relevant infrmatin abut hazards and CI, and abut previus Stress Tests. The TI pre-selects the ptential target hazards and the relevant CI cmpnents. STEP 2 Risk Measures and Objectives: definitin f ne r mre risk measures (e.g. fatalities, ecnmic lss, etc.) and bjectives (e.g. expected lss, annual prbability etc.). This definitin is perfrmed by the PM, based n the regulatry requirements, the technical and scietal cnsideratins, and previus Stress Tests. STEP 3 Set-up f the Stress Test: selectin f the Stress Test Level, and Timing and Csts f the prject and definitin f the level f detail and sphisticatin used fr the cmputatin f the assessment phase, as presented in Sectin 2.6. The selectin f the ST-Level is made by the PM with the assistance f the TI, based n the regulatry requirements. STEP 3 may be a lng prcess and may differ substantially depending if the PE is in place r nt, accrding t the ST-L selected. The presence f the PE allws fr a rbust set-up f the ST, based n the quantitative feedbacks f multiple experts. In this case, the PM and TI set an initial csts and timeframe fr the assessments t be perfrmed in STEP 3. The TI selects the PE and rganizes a ne-day kick-ff meeting with PE, ET, and PM. With the assistance f PE, thrugh classical Expert Elicitatin, the TI selects the target single and multiple hazards and the relevant CI cmpnents and their interactins. If significant disagreements emerge frm the elicitatin result, the TI may prmte specific tpical discussins amng the members f the PE, enabling a final decisin. Based n this selectin, the TI and PM integrate the ET and the PE t have a cmplete cverage f the required expertise. The TI cllects applicable scientific mdels and data needed fr hazard, vulnerability and risk assessment, with the technical assistance f the ET (and thrugh ptential individual interactin with the PE, if required). At this stage, als ptential lacks in mdelling prcedures are identified by the TI. If technically pssible, such lacks shuld be filled by the TI based n quantificatin thrugh classical Expert Elicitatin f the PE, which is at this pint planned fr PHASE 2. Otherwise, a cmplementary scenari-based assessment shuld be planned (see Sectin 2.3). The specificatin f this scenari-based assessment (e.g., the definitin f scenaris t be cnsidered) is made thrugh a specific classical Expert Elicitatin planned fr PHASE 2. T cmplete the planning f actins in PHASE 2, the TI als plans the classical Expert Elicitatin f the PE fr ranking alternative mdels t be used in the stress test, in rder t enable the quantificatin f epistemic uncertainty. If the selected ST-Level des nt fresee the presence f the PE, this prcess becmes simplified since all critical decisins are taken directly by ne single expert, the TI. The TI selects the target hazards and the relevant CI cmpnents. Based n this selectin, the TI and PM integrate the ET, t have a cmplete cverage f the required expertise. In either case, at the end f these basic chices, the TI cllects applicable scientific mdels and data needed fr hazard, vulnerability and risk assessment, with the technical assistance f the ET. Based n this cllectin, the TI and PM jintly identify the level f detail and sphisticatin used fr the cmputatin f the assessment phase (see Sectin 2.6) based n target csts and mdel availability. As mentined abve, ne f the main gal f this assessment phase is t capture the center and range f technical interpretatins that the larger technical cmmunity wuld have if they were t cnduct the study. A preliminary sensitivity analysis may help t identify the key parameters which cntrls the results in rder t fcus the uncertainty analysis and experts discussins n these key inputs. All decisins/definitins are specifically dcumented by the TI. The IR reviews such dcuments and prvides his/her feedbacks regarding the decisins/definitins made thus far. The PM and TI finalize all dcuments, based n this review. At this pint, the final csts and the exact timing fr PHASE 2 and PHASE 3 are established. Further, based n the IR review, the PM and TI may evaluate ptential changes t the analysis 8

21 methdlgy fr stress testing f critical nn-nuclear infrastructures implementatin alng the assessment phase, in rder t avid ptential penalties suggested by the reviewers. In fact, in the case the level f detail and sphisticatin reached in the final implementatin is lwer than the level required, a Penalty System is applied t the utput f the risk assessment (STEP 6 Risk bjectives Check) PHASE 2: Assessment phase The Assessment phase is characterized by tw steps in which the stress test is perfrmed at Cmpnent and System levels accrding t the Stress Test Level selected in Phase 1. In particular: STEP 4 Cmpnent Level Assessment: the perfrmance f each cmpnent f the CI is checked by the hazard-based assessment, design-based assessment r riskbased assessment apprach (see Sectin 2.3). This check is perfrmed by the TI r by ne expert f the ET selected by the TI. STEP 5 System Level Assessment: the stress test at the system level is perfrmed. At first, the TI finalizes all the required mdels. In particular, if the PE is in place (sub-levels c), the TI rganizes the classical Expert Elicitatins in rder t: i) fill ptential methdlgical gaps, ii) quantify the ptential scenari fr the scenaribased risk assessment (SBRA), and iii) rank the alternative mdels t enable the quantificatin f the epistemic uncertainty. The PE perfrms the elicitatin remtely. Open discussins amng the PE members (mderated by the TI) are freseen nly if significant disagreements emerge in the elicitatin results. If the PE is nt in place but EU assessment is required (sub-level b), the TI directly assigns scres n the selected mdels fr ranking. Then, the ET (crdinated by the TI) actually implements all the required mdels and perfrms the assessment. If specific technical prblems emerge during the implementatin and applicatin, TI may slve them thrugh individual interactins with members f the PE (if freseen at the ST-Level) PHASE 3: Decisin phase The Decisin Phase is characterized by three steps: STEP 6 Risk bjectives Check: cmparisn f results f the Assessment phase t the risk bjectives. This task is perfrmed by the TI, with the technical assistance f the ET. Depending n the type f risk measures and bjectives defined by the PM (F-N curve, expected value, etc.) and n the level f detail and sphisticatin adpted t capture the center and range f technical interpretatins, the cmparisn between results frm prbabilistic risk assessment with these gals may differ (see Sectin 2.6). One pssibility t assess the difference between the btained risk measures and the adpted risk bjectives is presented in Sectin 2.5 where the utcme f the stress test is presented by grades (e.g. AA negligible risk, A as lw as reasnably practicable (ALARP) risk, B pssibly unjustifiable risk, C intlerable risk). STEP 7 Disaggregatin/Sensitivity Analysis: identificatin f critical events. This task is perfrmed by the ET crdinated by the TI. Critical events that mst likely cause the exceedance f the cnsidered lss value are identified thrugh a disaggregatin analysis1 (Espsit et al 2016) and based n them, risk mitigatin strategies and guidelines are then frmulated. If specific technical prblems emerge during the applicatin, the TI may slve them thrugh individual interactins with the PE (if present). This step is nt mandatry. It depends n the results f STEP 1 See Appendix B, Deliverable 5.1 (Espsit et al, 2016). 9

22 methdlgy fr stress testing f critical nn-nuclear infrastructures 6 (Risk bjectives Check). Fr example, if the utcme f STEP 6 is that the critical infrastructure passes the stress tests, perfrming STEP 7 may be infrmative, but is nt required. STEP 8 Guidelines and Critical events: risk mitigatin strategies and guidelines are frmulated based n the identified critical events. This task is perfrmed by the TI, with the technical assistance f the ET. All the results in all the steps f PHASE 2 and PHASE 3 are specifically dcumented by the TI. The IR reviews the activities perfrmed in assessments frm STEP 4 t STEP 8. The TI, with the technical assistance f the ET, update t the final assessments fr such steps accunting fr the review. Final assessments and decisins are dcumented by the TI. Based n such dcuments, the PM, TI and IR reach the final agreement PHASE 4: Reprt phase The Reprt phase cmprises ne step: STEP 9 Results Presentatin: presentatin f the utcme f stress test t CI authrities, regulatrs and cmmunity representatives. This presentatin is rganized and perfrmed by PM and TI. The presentatin includes the utcme f stress test in terms f the grade, the critical events, the guidelines fr risk mitigatin, and the level f detail and sphisticatin f the methds adpted in the stress test. Nte that the time fr this presentatin is set in PHASE 1, and it cannt be changed during PHASE 2 and ST@STREST test levels Due t the diversity f types f CIs and the ptential cnsequence f failure f the CIs, the types f hazards and the available resurces fr cnducting the stress tests, it is nt ptimal t require the mst general frm f the stress test fr all pssible situatins. Therefre, three stress test variants, termed Stress Test Levels (ST-Ls) are prpsed: Level 1 (ST-L1): single-hazard cmpnent check; Level 2 (ST-L2): single-hazard system-wide risk assessment; Level 3 (ST-L3): multi-hazard system-wide risk assessment. Each ST-L is characterized by a different scpe (cmpnent r system) and by a different cmplexity f the risk analysis (e.g. the cnsideratin f multi-hazard and multi-risk events) as shwn in Fig The aim f the ST-L1 (Cmpnent Level Assessment) is t check each cmpnent f a CI independently in rder t shw whether the cmpnent passes r fails the minimum requirements fr its perfrmance, which are defined in current design cdes. The perfrmance f each cmpnent f the CI is checked fr the hazards selected as the mst imprtant (e.g. earthquake r fld). At cmpnent-level there are three methds t perfrm the single-hazard cmpnent check. These methds differ fr the cmplexity and the data needed fr the cmputatin. The pssible appraches are: the hazard-based assessment, design-based assessment, and the risk-based assessment apprach. Since a CI is a system f interacting cmpnents, ST-L1 is inherently nt adequate. Nevertheless, ST-L1 is bligatry because design f (mst) CI cmpnents is regulated by design cdes, and the data and the expertise are available. Further, fr sme CIs, the cmputatin f system-level analysis (single- and multi-risk) culd be verly demanding in terms f available knwledge and resurces. 10

23 methdlgy fr stress testing f critical nn-nuclear infrastructures Fig. 2.4 ST-Levels in the ST@STREST methdlgy The stress test assessment at the system level f the CI is freseen at ST-L2 r ST-L3 where the prbabilistic risk analysis f the entire CI (system) is perfrmed. The system level assessment is highly recmmended, since it is the nly way f revealing the majrity f the mechanisms leading t ptential unwanted cnsequences. Hwever, nte that it requires mre knwledge and resurces (e.g. financial, staff) fr cnducting the stress test, thus it is nt made bligatry (if nt required by regulatins). At these levels, ptentially different implementatins are pssible. The quantificatin f epistemic uncertainty may nt be perfrmed (sub-level a). If perfrmed, it may be based either n the evaluatins f a single expert (sub-level b) r f multiple-experts (sub-level c). Indeed, a mre accurate quantificatin f the technical cmmunity knwledge distributin (describing the epistemic uncertainty) can be reached if mre experts are invlved in the analysis and, in particular, when dealing with all critical chices. Further, in case specific needs have been identified in the Pre-assessment phase (e.g. imprtant methdlgical/mdelling gaps) and such requirements cannt be included int the risk assessment fr whatever reasn, scenari-based analysis shuld be als perfrmed as cmplementary t the system ST-L selected (sub-level d). Levels 2d and 3d are cmplementary t L2c and L3c, respectively. In this case, multiple experts define and evaluate pssible scenaris that, fr whatever reasn, cannt be included int prbabilistic risk analysis. In this case, the chice f perfrming a scenari-based assessment shuld be justified and dcumented by the TI, and reviewed by the IR. If scenari-based assessment is finally selected, the chice f the scenaris shuld be based n ad hc expert elicitatin experiments f the PE (SSHAC 1997). These additinal scenaris are meant t further investigate the epistemic uncertainty by including events therwise neglected nly fr technical reasns. Indeed, L2d and L3d are perfrmed t evaluate the ptential impact f epistemic gaps identified by experts, eventually increasing the capability f explring the effective epistemic uncertainty. Thus, it is freseen nly as cmplementary t a full quantificatin f epistemic uncertainty in a multiple-expert framewrk. The system level analysis is thus perfrmed accrding t: 1) the degree f cmplexity f the analysis (single vs. multi hazards), and 2) the degree f invlvement f the technical cmmunity in taking critical decisins and in the quantificatin f the epistemic uncertainty fr the cmputatin f risk. Accrding t these tw aspects a subdivisin fr ST levels has been intrduced (Fig. 2.4). The selectin f the actual prcedure t be implemented is perfrmed in the Pre-Assessment (Phase 1). These tw chices essentially depend n regulatry requirements, n the different imprtance f the CI, and n the available human/financial resurces t perfrm the stress test. A practical tl t supprt the chice f the apprpriate ST level may be a criticality assessment aimed at identifying and ranking 11

24 methdlgy fr stress testing f critical nn-nuclear infrastructures CIs (fr example at a natinal scale). In Espsit et al 2016 (Appendix A) sme key factrs that may be cnsidered t define the criticality f the CIs and a pssible methdlgy t rank CIs are presented and discussed. In the fllwing, a specific descriptin f all ST-Ls and sub-levels is reprted Cmpnent level assessment At Cmpnent Level Assessment nly ne implementatin is freseen, i.e. the ST-L1a. This level requires less knwledge and resurces (financial, staff, experts) fr cnducting the stress test in cmparisn t the system level assessment, but it is bligatry because design f (mst) CI cmpnents is regulated by design cdes, and usually, bth the data and the experts are available. Further, fr sme CIs, the cmputatin f system-level analysis (single- and multi-risk) culd be verly demanding in terms f available knwledge and resurces. Only the TI is required as expert cntributing t critical scientific decisin, while the whle prcess may require up t five experts t assist the TI in technical decisins. The TI selects the mst imprtant hazard t cnsider in the cmpnent-level analysis but, if mre than ne hazard is cnsidered critical fr the CI under study, mre than ne Level 1 check shuld be perfrmed, ne fr each hazard. Three methds t perfrm the single-hazard cmpnent check are prpsed in ST@STREST, and they differ fr the cmplexity and the data needed fr the cmputatin. The pssible appraches are: the hazard-based assessment, design-based assessment and the risk-based assessment apprach. A detailed descriptin is prvided in the fllwing. The main aspects characterizing the ST-L1a are summarized in Table 2.1. Hazard-based assessment: The perfrmance f the cmpnent is checked by cmparing the design value f intensity f the hazard which was actually used in the design f the cmpnent (building, pipeline, strage tank, etc.), IDesign phase, t the design value f intensity f the hazard prescribed in current regulatry dcuments r t the value f intensity accrding t the best pssible knwledge, IAssessment phase. The cmplexity f such an assessment phase is nt high. As a cnsequence, the level f detail and sphisticatin f this type f assessment is cnsidered mderate, since all ther design factrs (e.g. minimum requirements fr detailing, material safety factrs, design prcedures, type f analysis, safety margin) and their impact n the perfrmance f the cmpnents, which can als change frm different versins f regulatry dcuments, are neglected in the assessment. The utcme f this type f assessment phase is qualitative: In cmpliance with the design level f hazard (IAssessment phase IDesign phase); Nt in cmpliance with the design level f hazard (IAssessment phase IDesign phase); The design level f hazard is unknwn. This utcme is assigned when there is n regulatry dcument which wuld require design f the cmpnent fr cnsidered type f hazard at the time f perfrming the stress test. Hazard-based assessment may be used in cases when the cmpnent has nt been designed using mdern design cdes and when the cmpnent is nt significant fr the system respnse. In such cases, the target level f detail is expected t be set t Mderate (see Sectin 2.6), which wuld allw the methd t be used. Hwever, if the target level is set t High r Advanced, a mre accurate methd shuld be used (i.e. design- r riskbased assessment, respectively) t evaluate the cmpnents and avid impsitin f penalty factrs. Mrever, due t the trend f increasing design levels f hazard ver time, the utcme f the hazard-based assessment is expected, in a vast majrity f cases, t 12

25 methdlgy fr stress testing f critical nn-nuclear infrastructures be Nt in cmpliance with the design level f hazard, which wuld, again, require a mre accurate methd t be utilized. Design-based assessment: The level f detail and sphisticatin f this type f assessment is higher than the previus methd since it is based n the design state-fpractice. The expert cmpares the demand, D, with the capacity, C, (expressed in terms f frces, stresses, defrmatins r displacements). The assessment can be based n factring the results frm the existing design dcumentatin r by perfrming design (assessment) f the cmpnent accrding t the current state-f-practice. The decisinmaking regarding the sufficiency f the investigated cmpnent is smetimes difficult, since the demand in the design is mst ften based n linear-elastic analysis while the perfrmance bjectives f the cmpnent are ften assciated with its nnlinear behavir. Alternatively, the perfrmance assessment can be based n nnlinear methds f analysis. The cmplexity f this type f assessment may differ, depending n the type f analysis (linear, nnlinear) used. The utcme f the design-based assessment is qualitative: In cmpliance with the cde (D C); Nt in cmpliance with the cde (D C); The design bjectives fr this type f hazard are nt defined. This utcme is assigned when there is n regulatry dcument which wuld require design f thecmpnent fr cnsidered type f hazard at the time f perfrming the stress test. Risk-based assessment: The hazard functin at the lcatin f the cmpnent and the fragility functin f the cmpnent are required fr this type f perfrmance assessment. The level f detail and sphisticatin f this type f assessment varies frm Mderate t Advanced, which depends n the level used fr evaluatin f the hazard functin and the fragility functin. These tw functins can then be cnvlved in the risk integral in rder t btain the prbability f exceedance f a designated limit state in a perid f time (PLS). In general, the risk integral can be slved numerically. Under sme cnditins, simple clsed-frm slutins f risk integral als exist. The target prbability f exceedance f a designated limit state fr a perid f time (PLS,t) als has t be defined fr each cmpnent and different limit states (e.g. lss f functin, lw/medium/high damage, cllapse) if they are cnsidered in this assessment (e.g. prbability f exceedance implied by the cde). The cmplexity f risk-based assessment is in general high, but it can be reduced t lw when the hazard and fragility functins are already available. Such situatin ccurs if the ST-L2 r ST-L3 assessments are als freseen in the stress test. In this case the ST-L1 assessment and system level assessment shuld be partly perfrmed in parallel. The utcme f the risk-based assessment is quantitative, since the perfrmance f the cmpnent is measured by the estimated PLS, which is then used as a basis fr the grading (see Sectin 2.5). 13

26 methdlgy fr stress testing f critical nn-nuclear infrastructures Table 2.1 Main aspects characterizing the Cmpnent Level Assessment (STL-1a) Level Events cnsidered Number f experts cntributing t critical scientific decisins Ttal number f experts invlved in the prcess Methd: Cre actrs ST-L1a Single hazard check. Hazard selected as the mst imprtant (e.g. earthquake r fld, etc.). If mre than ne hazard is imprtant, mre than ne Level 1 check shuld be perfrmed. 1 (the TI) < 5 (the TI, alng with the technical assistance f the ET frmed by few individuals internal t the CI, and an IR with 1 expert) The perfrmance f each cmpnent f the CI is checked using the hazard-based assessment, design-based assessment r risk-based assessment apprach. Design-based assessment is recmmended when nly ST-L1 is perfrmed. In the case when ST-L1 is fllwed by ST-L2, in which cmpnent-specific fragility functins are used, it makes sense t perfrm riskbased assessment f the cmpnents since fragility functin are anyway required in ST-L2. PM, TI + ET, IR The three methds described abve fr a single hazard check at cmpnent level assessment is demnstrated by means f an example f a precast reinfrced cncrete industrial building (single-strey precast reinfrced cncrete building with masnry infills n the perimeter, Fig. 2.5) lcated in Ljubljana (Slvenia). Fig. 2.5 Plan view f the case study building frm ST-L1 assessment The structure was designed befre the intrductin f the Eurcde standards and it cnsists f cantilever clumns, which are cnnected by an assembly f rf elements. It has tw bays in the X directin and three bays in the Y directin. The distance between the clumns in the X and Y directins are 17.4 m and 8.7 m, respectively, whereas the height f the clumns amunts t 10.3 m. The critical cmpnents f the building are clumns and beam-t-clumn cnnectins. The ratis f lngitudinal and transverse reinfrcement in all clumns amunt t 1.29 % and 0.10 %, respectively. N cnnectins between beams and clumns are prvided. The ttal mass f the structure amunts t 237 t. The design peak grund acceleratin fr the 475 and 2475 year earthquakes amunt t 0.25 g and 0.35 g, respectively. The grund is classified as B (CEN, 2005a). 14

27 methdlgy fr stress testing f critical nn-nuclear infrastructures Hazard-based assessment N infrmatin n the hazard used in the design f the cmpnent is available. It is therefre cncluded that the cmpnent was nt designed t withstand seismic lading. The utcme f the hazard-based assessment is: The design level f hazard is unknwn. Design-based assessment fr Limit State f Near Cllapse Eurcde 8 Part 3 (CEN, 2005b) is used t cnduct the design-based assessment f the cmpnent. The knwledge level, as required by the cde, is identified as»limited«. Cnsequently, cnfidence factr amunts t The limit state f Near Cllapse, which crrespnds t the return perid f 2475 years, is checked. Lateral frce analysis is selected. Table 2.2 summarizes the results f the assessment in terms f verificatin f beam-tclumn cnnectins. As shwn in the table, cnnectins abve the crner clumns d nt meet requirements, which means that the building des nt cmply with the cde. Further assessment f the clumns is nt perfrmed since it can be cncluded that the utcme f the design-based assessment is: Nt in cmpliance with the cde (D C). The detailed explanatin f the calculatins are reprted in Deliverable 5.1 (Espsit et al, 2016). Clumn Table 2.2 Verificatin f beam-t-clumn cnnectins Capacity f clumns in terms f MRd [knm] (material characteristics are multiplied by the cnfidence factr) Dcnn [kn] Ccnn [kn] (material characteristics are divided by the cnfidence factr) Internal Side X Side Y Crner Risk-based assessment Fragility functin fr the cllapse limit state and hazard functin are required in rder t estimate the risk. In this case fragility functin is determined by cnducting nn-linear dynamic analyses using a set f hazard cnsisting grund mtins. The numerical mdel f the building is defined using the principles described in Babič and Dlšek (2016) and Crwley et al (2015). Based n the results f the numerical simulatins a regressin analysis is carried ut by assuming a lgnrmal distributin and by using the maximum likelihd methd as prpsed in previus studies (e.g. Baker, 2015). The gemetric mean f the spectral acceleratins in bth hrizntal cmpnents at 1.9 s is chsen as an intensity measure. The parameters f the resulting fragility functin (Fig. 2.6a), i.e. the median IM and the standard deviatin in the lg dmain βc, are 0.22 g and 0.40, C respectively. The seismic hazard curve (Fig. 2.6b) is determined based n the prbabilistic seismic hazard analysis (PSHA) used fr the develpment f seismic hazard maps in Slvenia (Lapajne et al 2003). It is idealized by a linear functin n a lg-lg plt, expressed as: H( IM ) k IM k (2.1) 0 Interval frm 0.25 IM and 1.25 IM was chsen fr the idealizatin f the hazard curve, as prpsed by Dlšek and Fajfar (2008). The parameters f the idealized hazard curve k0,c and kc amunt t and 1.75, respectively. The resulting prbability f exceedance f the cllapse limit state is determined as fllws: 15

28 methdlgy fr stress testing f critical nn-nuclear infrastructures H( ) exp(0.5 k ) C C C C P IM (2.2) Fig. 2.6 a) Fragility functin f the building and b) seismic hazard n the lcatin f the building System level assessment The system level assessment requires mre knwledge and resurces fr cnducting the stress test cmpared t the Cmpnent Level Assessment. Thus, it is nt made bligatry. Hwever, the system level assessment represents the nly way f revealing the paths that lead t ptential unwanted cnsequences. Therefre, it is highly recmmended. Different implementatins are pssible, accrding t: The cnsideratin f a single hazard (STL-2) r f multiple-hazard/risks (STL-3). The quantificatin f epistemic uncertainty may nt be perfrmed (sub-level a). The use f a single expert (sub-level b) r f multiple-experts (sub-level c) t quantify the epistemic uncertainty. Single hazard (ST-L2) Fr the single hazard system level check, three sublevels are freseen accrding t the degree f invlvement f the technical cmmunity in taking critical decisins and in the quantificatin f the Epistemic Uncertainty (EU) fr the cmputatin f risk. The quantificatin f EU may nt be perfrmed (ST-L2a). If perfrmed, it may be either based n the evaluatins f a single expert (ST-L2b) r f multiple-experts (ST-L2c). As fr ST-L1a fr the ST-L2a, nly the TI is required as expert cntributing t the critical scientific decisin, while the whle prcess may require up t five experts t assist the TI in technical decisins. ST-L2b, instead, requires the use f up t nine experts (the ET frmed by few individuals internal t the CI and a few external experts, and an IR with mre than ne expert) t assist the TI. The ST-L2c requires even mre knwledge and resurces. In this case mre than six experts are required t cntribute t scientific decisins (the TI and a PE frmed by at least six experts), while the whle prcess may require mre than ten experts. 16

29 methdlgy fr stress testing f critical nn-nuclear infrastructures Regarding the methds t apply fr the risk analysis, fr all the sublevels the aim is t evaluate the perfrmance f the whle CI. In a generic frmat, the prcess is independent f the field f applicatin. The prcess can be divided int the fllwing steps (AS/NZS 4360): definitin f cntext, definitin f system, hazard identificatin, analysis f cnsequences and analysis f prbability (r frequency), risk assessment and risk treatment. Several methds/techniques exist fr each f the main steps. They can be classified as qualitative r quantitative (Faber and Stewart, 2003). A list f sme f the methds usually applied in risk assessment f engineering facilities is prvided in Espsit et al, In ST@STREST, fr all sub-levels f the system-level assessment, prbabilistic (i.e. prbabilistic risk analysis, PRA) methds are freseen. PRA is a systematic and cmprehensive methdlgy t evaluate risks assciated with every life-cycle aspect f a cmplex engineered entity, where the severity f cnsequence(s) and their likelihd f ccurrence are bth expressed qualitatively (Bedfrd and Cke, 2001). It can be als fund in the literature under the names f quantitative risk assessment (QRA) r prbabilistic safety assessment (PSA). The final result f a PRA is a risk curve and the assciated uncertainties (aleatry and epistemic). The risk curve generally represents the frequency f exceeding a cnsequence value as a functin f that cnsequence values. PRA can be perfrmed fr internal initiating events (e.g. system r peratr errrs) as well as fr external initiating events (e.g. natural hazards). Main applicatins f PRA have been perfrmed in different fields such as civil, aernautic, nuclear, and chemical engineering. The specific quantitative methd t use depends upn the cntext in which the risk is placed (the hazard cntext), and upn the system under cnsideratin. In civil engineering, PRA methds were develped fr the analysis f structural reliability, using analytical r numerical integratin, simulatin, mment-based methds, r first- and secnd-rder methds (FORM/SORM). In earthquake engineering, the state f the art f prbabilistic and quantitative appraches fr the estimatin f seismic risk relies n perfrmance-based earthquake engineering (PBEE). PBEE is the framewrk that enables engineers t assess if a new r an existing structure is adequate in the sense that it perfrms as desired at varius levels f seismic excitatin. Different analytical appraches t PBEE have been develped in the last years: the apprach pursued by the Pacific Earthquake Engineering Research (PEER) Center is the mst representative (Crnell and Krawinkler, 2000). This apprach was riginally develped fr buildings (i.e., pint-like structures). Hwever, in the years, a significant bdy f research was develped fcusing n risk assessment f infrastructure systems. PBEE was extended t spatially distributed systems such as gas r electric netwrks (Espsit et al, 2015; Cavalieri et al, 2014), transprtatin netwrks (Argyrudis et al, 2015), and telecmmunicatin netwrks (Espsit et al, in prep.). Fr the three CI classes identified in STREST and fr the specific hazard cnsidered, the detail list and explanatin f pssible methds that may be applied t assess the perfrmance and the risk f the CI, are prvided in STREST Deliverable 4.1 (Salzan et al, 2016), 4.2 (Kakderi et al, 2015) and 4.3 (Crwley et al, 2015). Epistemic uncertainties are treated nly at ST-L2b and ST-L2c. The gal is the assessment f the cmmunity distributin, that is, a distributin describing the center, the bdy, and the range f technical interpretatins that the larger technical cmmunity wuld have if they were t cnduct the study (SSHAC). Here, cmmunity distributin means the prbability distributin representing the epistemic uncertainty within the cmmunity. This assessment gal is achieved by: selecting a number f apprpriate alternative scientifically acceptable mdels, and weighting them accrding t their subjective credibility. The selectin f mdels may be based n the develpment f Alternative Trees (mre details can be fund in Deliverable 3.1, Selva et al 2015), where the analysis is divided int a number f cnsecutive steps, and alternative mdels are defined at each step. The prcedure t be fllwed in these tasks is different fr ST-L2b and ST-L2c. In ST-L2b, the 17

30 methdlgy fr stress testing f critical nn-nuclear infrastructures TI (supprted by the ET) selects the mdels based n a literature review, and assigns the weights t each ne f them. At ST-L2c, a mre rbust prcedure is freseen (see STREST Deliverable 3.1, Selva et al 2015). In ST@STREST PHASE 1 (pre-assessment), a preliminary list f mdels is prepared by the TI (supprted by the ET), which is frmally screened by the PE and reviewed by the IR. Then, at the beginning f ST@STREST PHASE 2 (assessment), an expert elicitatin f the PE is rganized by the TI t assign the weights f the mdels (fr example, fllwing an AHP prcedure, see STREST Deliverable 3.1, Selva et al 2015). Then, the ET implements mdels and weights in rder t prduce the cmmunity distributin, implementing methdlgies like the Lgic Tree (e.g., Bmmer and Scherbaum, 2008) r the Ensemble Mdelling (Marzcchi et al 2015). Nte that the selectin f the mdels depends n the adpted strategy fr their integratin (see STREST Deliverable 3.1, Selva et al, 2015). Fr example, Lgic Trees require that mdels frm a MECE (Mutually Exclusive and Cllectively Exhaustive) set, while Ensemble Mdelling simply requires that mdels frm an unbiased set f alternatives representing the epistemic uncertainty int the cmmunity. The main aspects characterizing each sub level f the ST-L2 are summarized in Tables Table 2.3 Main aspects characterizing the System Level Assessment, STL-2a Level Events cnsidered Number f experts cntributing t critical scientific decisins Ttal number f experts invlved in the prcess Methd: Cre actrs ST-L2a Single hazard, selected as the mst imprtant (e.g. earthquake, fld) 1 (the TI) Up t 5 (the TI, alng with the technical assistance f the ET frmed by few individuals internal t the CI, and an IR with 1 expert) Prbabilistic Risk Analysis (PRA, e.g. PBEE framewrk fr seismic hazard) PM, TI + ET, IR Table 2.4 Main aspects characterizing the System Level Assessment, ST-L2b. Level Events cnsidered Number f experts cntributing t critical scientific decisins Ttal number f experts invlved in the prcess ST-L2b Single hazard, selected as the mst imprtant (e.g. earthquake, fld) 1 (the TI) Up t 10 (the TI, alng with the technical assistance f the ET frmed by few individuals internal t the CI and a few external experts, and an IR with > 1 experts) Methd: Cre actrs Prbabilistic Risk Analysis (PRA, e.g. PBEE framewrk fr seismic hazard) + epistemic uncertainty PM, TI + ET, IR 18

31 methdlgy fr stress testing f critical nn-nuclear infrastructures Table 2.5 Main aspects characterizing the System Level Assessment, ST-L2c. Level Events cnsidered Number f experts cntributing t critical scientific decisins Ttal number f experts invlved in the prcess Methd: Cre actrs ST-L2c Single hazard, selected as the mst imprtant (e.g earthquake, fld) > 6 (the TI and a PE frmed by > 5 experts) > 10 (the TI, alng with the technical assistance f the ET frmed by few individuals internal t the CI and a few external experts, the PE frmed by > 5 experts, and an IR with > 1 experts) Prbabilistic Risk Analysis (PRA, e.g. PBEE framewrk fr seismic hazard) + epistemic uncertainty PM, TI + ET, PE, IR Multiple hazards/risks As fr the ST-L2c, the assessment prcess requires mre than six experts t cntribute t scientific decisins (the TI and a PE frmed by at least six experts), and a ttal f mre than ten experts (the TI, alng with the technical assistance f the ET frmed by few individuals internal t the CI and a few external experts, the PE frmed by mre than five experts, and an IR with mre than ne expert) t cmplete the whle prcess. There is n standard apprach fr multi-risk assessment. Different methds culd be used, taken frm the scientific literature. Fr example, Liu et al (2015) culd be used t identify the multi-risk assessment level required (semi-quantitative vs. quantitative); Marzcchi et al (2012) cmbined with Selva (2013) culd be used when the number f interactins at the hazard and/r risk levels remains limited, and Mignan et al (2014; 2016a) culd be used when the number f interactins becmes significant (rughly mre than 3-4 dmin effects). The Bayesian apprach f Marzcchi et al (2012) has the advantage f cupling t the PEER PBEE methd (Crnell and Krawinkler 2000; Der Kiureghian 2005), which is already well knwn t the seismic engineers and relates t the lwer stress test levels (L1 and L2). Selva (2013) prpsed a methd t test ptential individual interactins at the risk level (in vulnerability and/r expsure), and t eventually include them int the assessment using the PEER PBEE frmula. Mrever, ther PEER PBEE-based methds, such as damage-dependent vulnerability methds (Iervlin et al, 2016) and lss disaggregatin, can easily be added t such a general multi-risk framewrk. The Generic Multi-Risk (GenMR) framewrk develped by Mignan et al (2014), n the ther hand, is purely stchastic (a variant f a Markv Chain Mnte Carl methd) and nt derived frm existing single-risk assessment appraches. It is therefre mre flexible when including a multitude f perils (i.e., it is nt earthquake-fcused) but at the same time, requires sme adaptatin frm the mdeler t develp a multi-risk mdel n GenMR (i.e., all events defined in a stchastic event set, all interactins defined in a hazard crrelatin matrix, prcess memry defined frm time-dependent r event-dependent variables). While GenMR culd be used fr a seismic multi-risk analysis (see Mignan et al, 2015), advantages becme mre bvius in mre cmplex cases, such as interactins between different hazards (e.g., earthquake, flding, ersin) and different infrastructure elements (e.g., hydrpwer, spillway and bttm utlet failures) at a hydrpwer dam (Mats et al, 2015; Mignan et al, 2015). Whatever the methd used, the final utput shuld be a prbabilistic risk result in the frm f prbabilities f exceeding different lss levels, a risk r a lss curve. The multi-risk lss curves shall then be cmpared t the nes generated in stress test levels L1 and L2, and differences identified. The main cause f risk shuld be investigated, by disaggregatin (e.g., Iervlin et al, 2016) r by GenMR time series 19

32 methdlgy fr stress testing f critical nn-nuclear infrastructures ranking and metadata analysis (Mignan et al, 2014; Mats et al, 2015; Mignan et al, 2015; 2016a). The treatment f EUs in ST-L3c is similar t the ne described fr ST-L2c. In additin, in ST@STREST PHASE 1, it is freseen that the selectin f the hazards and hazard interactins t be included is based n the results f an expert elicitatin prcedure f the PE (fr example, based n a qualitative risk analysis made thrugh verbal scale, see the case study f the Harbr facilities f Thessalniki in STREST ERR5, Pitilakis et al, 2016). The main aspects characterizing the ST-L3 are summarized in Table 2.6. Table 2.6 Main aspects characterizing the System Level Assessment, ST-L3c. Level Events cnsidered Number f experts cntributing t critical scientific decisins Ttal number f experts invlved in the prcess ST-L3c Multi-hazards (multi-hazard, i.e. cinciding events and multirisk) > 6 (the TI and a PE frmed by > 5 experts) > 10 (the TI, alng with the technical assistance f the ET frmed by few individuals internal t the CI and a few external experts, the PE frmed by > 5 experts, and an IR with > 1 experts) Methd: Cre actrs Multi-risk analysis (extensin f PRA methdlgy fr multirisk) + epistemic uncertainty PM, TI + ET, PE, IR Scenari-based assessment Scenari-based analysis may be perfrmed as cmplementary t ST-L2c and ST-L3c due t methdlgical gaps identified fr specific events/hazards that cannt be frmally included int the PRA. This means that it shuld be cnsidered nly if, fr technical reasns, ne imprtant phenmenn cannt be included int a frmal prbabilistic framewrk (e.g., PRA fr ST-L2c). In this case, the chice f perfrming a scenari-based assessment shuld be justified and dcumented by the TI, and reviewed by the IR. If scenari-based assessment is finally selected, the chice f the scenaris shuld be based n ad-hc expert elicitatin experiments f the PE (see Selva et al, 2015). Different strategies can be adpted in rganizing the elicitatin experiment and in preparing the dcumentatin fr the PE. Fr example, the hazard crrelatin matrix (HCM), ne f the main inputs t the GenMR framewrk (see abve), can als be used qualitatively t build mre r less cmplex scenaris f cascading hazardus events. The HCM is a square matrix with trigger events defined in rws and target events (the same list f events) in clumns. In ST-L3c, each cell f the HCM is defined as a cnditinal prbability f ccurrence. In a deterministic view, cells can be filled by plus + signs fr psitive interactins (triggering), minus - signs fr negative interactins (inhibiting) and empty Ø signs fr n knwn interactins (suppsedly independent events). The HCM has recently been shwn t be a cgnitive tl that prmtes transfrmative learning n extreme event cascading. In ther wrds, it allws defining mre r less cmplex scenaris frm the assciatin f simple ne-t-ne interacting cuples. Once the mdus perandi is understd, mre knwledge n multi-risk can be generated (Mignan et al, 2016b). The cre actrs culd use the HCM tl t define the list f relevant events as well as t discuss the space f pssible interactins in an intuitive interactive way. ST-L3d scenaris wuld then emerge frm the HCM tl. 20

33 methdlgy fr stress testing f critical nn-nuclear infrastructures The main aspects characterizing the scenari-based assessment are summarized in Table 2.7. Table 2.7 Main aspects characterizing the cmplementary scenari-based assessment Level Events cnsidered Number f experts cntributing t critical scientific decisins Ttal number f experts invlved in the prcess Methd: Cre actrs ST-L2d ST-L3d Black swan, i.e. events nt previusly cnsidered (e.g. multihazard, crrelated events) and fr which a PRA is nt feasible due t lack f prcedures and basic knwledge. This pssibility shuld be cnfirmed by the IR (Internal Reviewers). The PE (Pl f Experts) is asked t define such scenaris. Same f ST-L2c r ST-L3c. Same f ST-L2c r ST-L3c. Scenari-based risk assessment (SBRA) PM, TI + ET, PE, IR 2.4 ST@STREST data structures A CI is a cmplex assembly f cmpnents, structures and systems designed t prvide a service, in terms f generatin and flw f water, electric pwer, natural gas, il, r gds in the scpe f the built envirnment f a cmmunity. The data n the cmpnents, structures and systems f the CI needs t be assembled and held in a framewrk t facilitate the applicatin f the prpsed stress test methdlgy and the executin f a stress test. The data n the CI includes nt nly the infrmatin abut the hazard and the vulnerability f the cmpnents and structures, but als the infrmatin abut the functining f the system that includes the tplgy f the system, the links that describe the interactins between the cmpnents and structures, and the causal relatins between the events in the system. Representatin f cmplex systems fr a prbabilistic risk analysis in general, and accident sequence investigatin in particular, has been dne since the early 1970 s in the nuclear industry. There, the event and fault trees are used t represent the system infrmatin necessary t cnduct a prbabilistic risk analysis. An event tree is a graphical representatin f the varius accident sequences that can ccur as a result f an initiating event (USNRC 2012). It is an essential tl in analyzing whether a cmplex system satisfies its system-level design targets. It prvides a ratinal framewrk fr enumerating and, subsequently, evaluating the myriad f events and sequences that can affect the peratin f the CI system. A fault tree is an analytical mdel that graphically depicts the lgical cmbinatins f faults (i.e., hardware failures and/r human errrs) that can lead t an undesired state (i.e., failure mde) fr a particular subsystem r cmpnent (Vesely et al 1981). This undesired state serves as the tpmst event in the fault tree, and usually crrespnds t a tp event in an event tree. Thus, a fault tree prvides a ratinal framewrk fr identifying the cmbinatins f hardware failures and/r human errrs that can result in a particular failure mde f a subsystem r cmpnent. Once fully develped, a fault tree can be used t quantitatively evaluate the rle f a CI subsystem r cmpnent in the peratin and failure f the CI system. A particular graphical cmbinatin f a fault tree and an event tree, called the bw-tie mdel (De Dianus and Fiévez 2006), has been used in risk management since the 1980 s 21

34 methdlgy fr stress testing f critical nn-nuclear infrastructures t visually represent the pssible causes and cnsequences f an accident. Typically, the causes f an accident are shwn n the left side using a fault tree, while the cnsequences f an accident are shwn n the right side using an event tree. Bayesian netwrks (BNs) are prbabilistic mdels that prvide an efficient framewrk fr prbabilistic assessment f cmpnent/system perfrmance and can be used t mdel multiple hazards and their interdependencies 2. They may als facilitate infrmatin updating fr near-real time and pst-event applicatins. Evidence n ne r mre variables can be entered in a BN mdel t prvide an up-t-date prbabilistic characterizatin f the perfrmance f the system. BN is nwadays used fr infrastructure risk assessment and decisin supprt, particularly in the aftermath f a natural event (Bensi, 2010). Similar t event and fault trees, thus als bwties, the tplgy f a BN is derived frm an analysis f the system and remains static. This means that the cmpnent, structures and subsystems and the causal links and cnditinal dependencies amng them are predetermined and d nt change during the prbabilistic risk analysis prcess. There are, hwever, s-called adaptive (Pascale and Nicli 2011) r recnfigurable (Mirmeini and Krishnamurthy 2005) BNs whse tplgy changes (amng several pre-determined tplgies) t best match an estimate f the varying state f the mdeled system. Finally, there are mdular BNs (Niel et al 2000), built ut f many BN mdules, with each mdule representing a functinally independent cmpnent r subsystem f a system-level BN (Park and Ch, 2012). Mre imprtant, the prbabilistic nature f the tw framewrks is different: the event/fault tree framewrk is based n the ntin f prbability as a frequency, while the BN framewrk represents the state f knwledge r belief. Fundamentally, the BN framewrk naturally allws fr intrductin f new knwledge, fr example, frm bservatins f the CI system behavir during its nrmal peratin, frm inspectins, r frm previus stress tests. This enables a fundamental aspect f the prpsed stress test methdlgy, that f repeating a stress test in certain intervals depending n the utcme f the previus stress test in rder t reduce the risk expsure f the CI thrugh the practice f cntinuus imprvement Applicatin f BNs t natural hazards and CIs The use f BNs fr natural hazard assessment has increased in recent years. Straub (2005) presented a generic framewrk fr the assessment f the risks assciated with natural hazards using BNs and applied it t the rckfall hazard. BNs have als been applied t the mdeling f risks due t typhn (Nishijima and Faber 2007), getechnical and hydrlgical risks psed t a single embankment dam (Smith, 2006), avalanches (Grêt- Regamey and Straub 2006), liquefactin mdeling (Bayraktarli et al 2005, 2006, Tasfamariam and Liu, 2014), tsunami early warning (Blaser et al 2009) and seismic risk (Bayraktarkli et al 2005, 2006, 2011; Bensi, 2010; Brgli, 2011). In particular, regarding seismic risk, Bayraktarkli et al (2005, 2006) prpsed a three cmpnents framewrk (Fig. 2.7) fr earthquake risk management using BNs, cmpsed f an expsure mdel that is an indicatr f hazard ptential, a vulnerability mdel which is an indicatr f direct/immediate cnsequences, and a rbustness mdel t quantify indirect cnsequences. Hwever, the framewrk prpsed by the authrs des nt include many aspects which cmplicate the applicatins f BNs t seismic hazard and risk analysis f infrastructure systems such as the mdeling f grund mtin randm fields, directivity effects, r issues assciated with the mdeling f system perfrmance. Bensi (2010) prpsed a mre cmprehensive BN methdlgy fr perfrming infrastructure seismic risk assessment that includes als a decisin mdel fr pst-event 2 A shrt intrductin t BNs terminlgy and prbabilistic structure is available in Deliverable 5.2 (Espsit and Stjadinvic, 2016a). 22

35 methdlgy fr stress testing f critical nn-nuclear infrastructures decisin making (Fig. 2.8). The methdlgy develped by Bensi (2010) cnsists f fur majr cmpnents: i) a seismic demand mdel where grund mtin intensities are mdelled as Gaussian randm field accunting fr multiple seismic surces and including finite fault rupture and directivity effects; ii) a perfrmance mdel f pint-like and distributed cmpnents; iii) mdels f system perfrmance as a functin f cmpnent states; and iv) the extensin f the BN t include decisin and utility ndes t aid pstearthquake decisin-making. Fig. 2.7 BN framewrk fr seismic risk management (surce: Bayraktarli et al, 2005) In additin t demnstrating the value f using Bayesian netwrks fr seismic infrastructure risk assessment and decisin supprt, the study prpsed mdels necessary t cnstruct efficient Bayesian netwrks with the gal f minimizing cmputatinal demands, which represent ne f the weak pints f BN framewrks. Mre recently Grauvgl and Steentft (2016) and Didier et al (2017) prpsed a BN-based mdel t evaluate the seismic resilience f infrastructure systems. The mdel is based n the cmpsitinal supply/demand resilience quantificatin framewrk presented in the STREST Deliverable 4.5 reprt (Stjadinvic and Espsit, 2016). A schematic verview f this BN-based mdel used t evaluate the resilience f the electric pwer supply system in Nepal after the 2015 Grkha earthquake is shwn in Fig

36 methdlgy fr stress testing f critical nn-nuclear infrastructures Fig. 2.8 Bayesian netwrk methdlgy fr seismic infrastructure risk assessment and decisin supprt prpsed by Bensi (2010) Discussins Bayesian netwrks are useful tls in engineering risk analysis because they facilitate the cmputatin, the understanding and the cmmunicatin f cmplex prblems subject t uncertainty. BNs ffer several imprtant advantages. BNs prvide an efficient framewrk fr prbabilistic assessment f cmpnent/system perfrmance and can be used t mdel multiple hazards and their interdependencies. They are an efficient and intuitive graphical tl that enable representatin f the cmpnents and subsystems and the causal links and cnditinal dependencies amng them and assessment f systems under uncertainty. They prvide a cnsistent and clear treatment f the jint prbability distributins f multiple randm variables, and an efficient framewrk fr prbabilistic real-time updating in light f new evidence. BN can be als be extended t include utility and decisin ndes, thus prviding a decisin tl fr ranking different alternatives. Cmplex BNs can be cnstructed using verified and validated mdules that represent cmpnents and subsystems f the CI system. Fundamentally, the BN framewrk naturally allws fr intrductin f new knwledge, fr example, frm bservatins f the CI system behavir during its nrmal peratin, frm inspectins, r frm previus stress tests. This enables a crucial aspect f the prpsed stress test methdlgy, that f repeating a stress test in certain intervals depending n the utcme f the previus stress test in rder t reduce the risk expsure f the CI thrugh the practice f cntinuus imprvement. Hwever, Bayesian netwrks have limitatins. Calculatins in Bayesian netwrks can be highly demanding and the applicatin t distributed systems characterized by a cmplex tplgy is nt always feasible. An accurate mdeling via BNs requires thrugh understanding f the prblem. The need fr expert knwledge in generating the preliminary BN structure represents ne f the mst salient pints f this tl. Mdeling cmplex systems via BNs may require trade-ffs between accuracy, transparency, cmputatinal cmplexity, and detail f mdeling (Friis-Hansen 2004). 24

37 methdlgy fr stress testing f critical nn-nuclear infrastructures Further, the availability f statistical data t develp rbust mdels t relate randm variables in a BN is ften scarce in civil engineering and infrastructure system analysis (Bensi, 2010). Thus, dependence relatins between parents and children and the marginal distributins f rt ndes shuld be based n theretical mdels and/r expert judgement. Althugh BNs represent an apprpriate framewrk t handle uncertainty fr pre- and pstevent risk assessment and decisin supprt analysis, it is imprtant t acknwledge that challenges remain, particularly with respect t cmputatinal demands fr applicatin t large civil infrastructure systems. Fig. 2.9 BN mdel prpsed by Didier et al (2017) 2.5 ST@STREST grading system The first utcme f the stress test, btained in the STEP 6 (Risk Objectives Check), is described using a grading system (Espsit et al 2016). This grading systems is based n the cmparisn f the results f risk assessment with the risk bjectives (i.e. acceptance criteria) defined at the beginning f the test in STEP 2 (Risk Measures and Objectives). The prpsed grading system (Fig. 2.10) is cmpsed f three different utcmes: Pass, Partly Pass, and Fail. The CI passes the stress test if it attains grade AA r A. The frmer grade crrespnds t negligible risk and is expected t be the attained risk bjective fr new CIs, whereas the latter grade crrespnds t risk being as lw as reasnably practicable (ALARP, Helm, 1996; Jnkman et al, 2003) and is expected t be the attained risk bjective fr existing CIs. Further, the CI partly passes the stress test if it receives grade B, which crrespnds t the existence f pssibly unjustifiable risk. Finally, the CI fails the stress test if it is given grade C, which crrespnds t the existence f intlerable risk. 25

38 methdlgy fr stress testing f critical nn-nuclear infrastructures Fig An example f grading system fr the utcme f stress test. The CI may pass, partly pass, r fail the stress test In the fllwing sectins, the risk limits and the bundaries between grades are first discussed. This is fllwed by the descriptin f hw the grading system is extended cnsidering the time dimensin. The guidelines fr the grading f individual cmpnents are then given. A generalizatin f the grading system is made in rder t apply it t thse ST levels which take int accunt epistemic uncertainties and system analysis. Finally, a brief discussin is given Risk limits and bundaries between grades The prject manager (PM) f the stress test defines the bundaries between grades (i.e. the risk bjectives) by fllwing requirements f the regulatrs. The bundaries (i.e. the acceptance risk levels, see STREST Deliverable 5.1, Espsit et al 2016) can be expressed using scalar (Fig tp) r cntinuus (Fig bttm) risk measures. Examples f the frmer include the annual prbability f the risk measure (e.g. lss f life) and the expected value f the risk measure (e.g. expected number f fatalities per year), whereas the latter is ften represented by an F-N curve, where F represents the cumulative frequency f the risk measure (N) per given perid f time. In several cuntries, an F-N curve is defined as a straight line n a lg-lg plt. Hwever, the parameters f these curves, as well as parameters f scalar risk bjectives (i.e. regulatry bundaries in general) may differ between cuntries and industries (STREST Deliverable 5.1, Espsit et al 2016). Harmnizing the risk bjectives f risk measures acrss a range f interests n the Eurpean level remains t be dne. This is a task fr regulatry bdies and fr industry assciatin: they shuld recncile the scietal and industry interest and develp mutually acceptable risk limits. When acceptance criteria are defined as cntinuus measures, the grade is assigned based n the psitin f the farthest pint f the CI lss curve frm the F-N limits (Fig. 2.11). 26

39 methdlgy fr stress testing f critical nn-nuclear infrastructures Fig Grading system in time dmain using scalar risk bjectives (tp) and limit F-N curves (bttm): a) tw different results f the first evaluatin f stress test (ST1), b) redefinitin f the parameters f the grading system due t Result 1 in ST1, and c) redefinitin f the parameters f the grading system due t Result 2 in ST Grading system in time dmain In general, the CI perfrmance can be understd as time-variant. It may change due t, fr example, ageing thrugh use, lng-term degradatin prcess such as crrsin, effects f previus hazard events, man-made events (e.g. terrristic attacks), and change in expsure (e.g. ppulatin). Such change in perfrmance may lead t an increase f the prbability f failure r lss f functinality, r exacerbate the cnsequences f failure during the CI system s lifetime (Fig. 2.10). In the prpsed grading system, it is freseen that the perfrmance f the CI and/r the perfrmance bjectives can change ver time. Cnsequently, the utcme f the stress test is als time-variant. Fr this reasn, the stress test is peridic, which is als accunted fr by the grading system. If the CI passes a stress test (grade AA r A), the risk bjectives fr the next stress test d nt change until the next stress test. The lngest time between successive stress tests shuld be defined by the regulatr cnsidering the cumulative risk. Hwever, mst f existing CIs will prbably btain grade B r even C, which means that the risk is pssibly unjustifiable r intlerable, respectively. In these cases, the grading system has t stimulate the stakehlders t upgrade the existing CI r t start planning tr a new CI in the fllwing stress test cycle. It is prpsed that stricter risk bjectives are used r that the time between the successive stress tests is reduced in rder t make it pssible that stakehlders adequately mitigate the risks psed by the CI in as few repetitins f the stress test as pssible, which means that the CI will eventually btain grade A r the regulatr will require that the peratin f CI be terminated. The basis fr the redefinitin f risk bjectives in the next stress test is the s-called characteristic pint f risk. In the case when scalar risk measures are used, the characteristic pint f risk is represented directly by the results f the risk assessment (Fig. 2.11, tp). In the case when result f risk assessment is expressed by a lss curve in F-N space, the characteristic pint is defined by ne pint f the F-N curve. In general, each curve f increasing risk (see Fig. 2.11) results in ne pint f the F-N curve. The curve f increasing risk, assciated with the characteristic pint is dented as the characteristic curve f increasing risk. It is recmmended that the pint assciated with the greatest risk abve the ALARP regin be selected as the characteristic pint (see Fig. 2.11a). In this case the characteristic pint is defined as the pint f the F-N curve which 27

40 methdlgy fr stress testing f critical nn-nuclear infrastructures is the farthest frm the limit F-N curve that represents the bundary between grades (fr example, grades A and B, and the A-B bundary are shwn by the blue line in Fig. 2.11a). Once the characteristic pint is determined, the grading system parameters fr the next repetitin f the stress test can be defined. If the CI btains grade B in the first evaluatin f stress test (ST1, blue dt in Fig. 2.11a), the grading system fresees the reductin f the distance between grades B and C (the B-C bundary) in the next stress test (ST2, Fig. 2.11b). This reductin shuld be equal t the amunt f cumulative risk beynd the ALARP regin assessed in ST1. This ensures risk equity ver tw cycles, which may be expressed by the fllwing expressin: RST1 R (A-B) = R(B-C), ST1 R (2.3) (B-C), ST2 where R(A-B) is the A-B bundary, R(B-C),ST1 and R(B-C),ST2 are the B-C bundary in ST1 and ST2, respectively, and RST1 is the value f the risk measure assessed in the ST1. Nte that the left side f the Eq. 2.3 is equal t the amunt f risk beynd the ALARP regin assessed in ST1. Furthermre, if grade C (red dt in Fig. 2.11a) is given in ST1, bth the B-C bundary and the perid until the next stress test ST2 are reduced (Fig. 2.11c). In this case, the B-C bundary is set equal t the A-B bundary, since this is the maximum pssible reductin f the regin f pssibly unjustifiable risk. Mrever, the reduced perid until ST2 (tcycle,redefined) is determined n the basis f equity f risk abve the ALARP regin ver the tw cycles and can be calculated using the fllwing expressin: t = t cycle,redefined cycle,initial R R (B-C), ST1 ST1 R R where tcycle,initial is the initial amunt f time between tw stress tests. (A-B) (A-B) (2.4) Grading f the cmpnents Each cmpnent is assessed by at least ne methd (hazard-based, design-based r riskbased assessment). Objectives f a hazard-based assessment and a design-based assessment are btained directly frm the design cdes, whereas the risk bjectives need t be defined in Step 2 (Risk Measures and Objectives). Similar t the case f system level assessment, three threshlds need t be defined (between grades AA and A, between grades A and B and between grades B and C) in rder t cnsistently evaluate the cmpnents f a CI. If a less detailed and sphisticated methd assessment (see Sectin 2.6) results in the cmpnent nt being in cmpliance with the requirements r the requirements are unknwn, a mre sphisticated methd may be used. Fr the Cmpnent-Level Assessment (STEP 4), three levels f detail and sphisticatin are defined as Mderate, High and Mderate-Advanced fr hazard-based assessment, design-based assessment and risk-based assessment, respectively. Different levels in the case f risk-based assessment exist due t varius levels f cmplexity f hazard and fragility analysis. If the result f a hazard-based assessment r a design-based assessment is that the cmpnent is in cmpliance with the requirements, a grade A is assigned t the cmpnent. If these types f assessment result in the cmpnent nt being in cmpliance with the requirements r the requirements are unknwn, a grade C is assigned t the cmpnent, r a higher Level assessment is required. Nte that, if the risk-based assessment is used, the grading system at the cmpnent level is same as that prpsed fr the system-level assessment. The prpsed prcedure fr the prgressive apprach in the case f the assessment at the level f cmpnent and the crrespnding grading system is illustrated in Fig If a cmpnent is assigned grade C, mitigatin actins need t be taken. The time in which the grade needs t be imprved depends n the type f assessment. If a hazard-based r a design-based assessment is used, the mitigatin has t be made immediately, as the cmpnent is nt in cmpliance with the current regulatry requirements. If a risk-based assessment is used, the time in which the grade has t be imprved is determined n the 28

41 methdlgy fr stress testing f critical nn-nuclear infrastructures basis f the amunt f risk crrespnding t the cmpnent reaching the designated limit state in the time perid cnsidered (see Sectin 2.5.2). Start ST-L1 assessment Hazard-based assessment Cmpnent is in cmpliance with requirements Grade A Cmpnent is nt in cmpliance with requirements / The design level f hazard is unknwn / Hazard-based assessment is nt perfrmed Higher level assessment? N Grade C Yes Design-based assessment Cmpnent is in cmpliance with requirements Grade A Cmpnent is nt in cmpliance with requirements / The design bjectives fr this type f hazard are nt defined / Design-based assessment is nt perfrmed Higher level assessment? N Grade C Yes Risk-based assessment Applicatin f the grading system Grade AA, A, B r C Fig Grading f cmpnents f the system (ST-L1) In this sectin the grading f the cmpnents is applied t the example prvided in Sectin Risk bjectives fr the cmpnent in terms f prbability f cllapse, which needed t be defined in Step 2, are as fllws: 10-6 between grades AA and A, 10-4 between grades A and B, and 10-3 between grades B and C. The mst stringent risk bundary is apprximately equal t the target prbability f cllapse, which is freseen in building cdes fr frequent r permanent lads, e.g. in Eurcde 0 (CEN, 2004). Thse values f acceptable prbability f cllapse are within a magnitude f Such a lw prbability f cllapse cannt be achieved by emplying building cdes fr earthquake-resistant design since the nature f seismic actin is cmpletely different than the nature f frequent r permanent lad. The prbability f cllapse fr buildings designed accrding t Eurcde 8 is arund magnitude f A significantly larger value f target cllapse risk (1% in 50 29

42 methdlgy fr stress testing f critical nn-nuclear infrastructures years ( )) was assumed fr new buildings in USA (Luc et al, 2007). As a cnsequence, the risk bundary between grades A and B was set t 10-4, while the risk bundary between grades B and C was increased 5 fld. The prbability f cllapse 5% in 50 years apprximately crrespnds t buildings, which were designed and cnstructed in the third quarter f 20 th century. The prcedure is initiated by perfrming the hazard-based assessment. Since the design level f hazard is unknwn, there are tw ptins: settle with grade C r mve n t the design-based assessment. We chse the latter. The design-based assessment results in the cmpnent nt being in cmpliance with the cde, then tw ptins are pssible: settle with grade C r mve n t the risk-based assessment. We chse the latter. This results in the prbability f cllapse equal t Thus, the cmpnent receives grade B, which means that n risk mitigatin actins are required, but the threshld between grades B and C will be reduced t in the next stress test Grading f the system with cnsideratin f epistemic uncertainties The grading system presented in Sectins and assumes that n epistemic uncertainties are related t the assessed risk. Since ST-L2c and ST-L3c cnsider the effect f epistemic uncertainties, the grading system needs t be generalized in a way that it accunts fr a distributin f values f the risk measure. The grading criteria based n a distributin f risk measure values can be frmulated in a variety f ways. In this prject, it is recmmended that the mean value f the risk measure distributin be used t assess the CIs. Other ptins, which shuld be examined in future studies, are discussed in Sectin Furthermre, the grading system fr cnsecutive stress tests, described in Sectin 2.5.2, is based n the cumulative prbability f risk measure exceedance in the selected time perid between tw stress tests. Fr this reasn, we determine the left side f Eq. 2.3, i.e. the ttal value f risk abve the ALARP regin, as the sum f all pssible risk values abve the ALARP regin (dashed area in Fig. 2.13), which are weighted by their prbability: R R = p(r)(r R ) dr ST1 (A-B) (A-B) R( A B) (2.5) In the case f risk measure based n an F-N curve, each curve f increasing risk crrespnds t a distributin f pints frm different F-N curves (Fig. 2.13b). The characteristic curve f increasing risk is the curve that crrespnds t the greatest amunt f risk abve the ALARP regin, i.e. where the integral in Eq. (2.4) prduces the highest value. Fig Distributin f a risk measure with bundaries f grades in the case f a) a scalar risk measure and b) an F-N curve 30

43 methdlgy fr stress testing f critical nn-nuclear infrastructures Discussin and future develpments There are sme pints f the grading system that need t be discussed and further develped as a part f the future studies. Firstly, it is yet t be determined hw grades f single cmpnents shuld affect the glbal utcme f stress test. Fr example, if the CI is assigned grade B in the ST-L2 assessment, the utcme is a partly pass. Hwever, ne r several cmpnents may receive grade C in the cmpnent level assessment. It is unclear hw this shuld affect the glbal utcme. One ptin wuld be t change the glbal utcme f stress test t fail, since the stakehlders wuld be required t reduce risk f thse cmpnents. Hwever, such an apprach may be t cnservative. Anther ptin wuld be t intrduce a cmplementary utcme f stress test, which wuld address nly single cmpnents and wuld be independent f the utcme btained based n systemic level assessment. In this case, risk mitigatin strategies and guidelines wuld be defined separately fr individual cmpnents as well. A third ptin wuld be t require a system-level assessment in this r the subsequent stress test that explicitly accunts fr the effects f the ffending cmpnents n the behavir f the system using, fr example, the bw-tie apprach, t identify the causes and the effects f failure f such cmpnents. Secndly, in case epistemic uncertainty analysis is f cncern, it is currently recmmended that the mean value f the designated risk measure is used. Hwever, ther ptins shuld be investigated. The grade culd be based n ther quantiles f the risk measure distributin, which shuld be determined by the PM. Guidelines fr selectin f the apprpriate risk measure distributin quantile shuld be develped based n a cmprehensive parametric study as a part f future develpments. Grades culd als be assigned based n a value f the risk measure crrespnding t a specific number f standard deviatins abve the mean, i.e. the cnfidence level that a specific value f the risk measure will nt be exceeded. Such apprach, the high cnfidence f lw prbability f failure (HCLPF) is used by the nuclear industry. Again, cmprehensive parametric studies wuld be required t select the apprpriate number f standard deviatins fr nnnuclear critical CIs. Furthermre, grades culd depend n the type f adjustments f the grading system parameters and the time between successive stress tests. Fr example, if a redefinitin f the bundary between grades B and C is required (based n the amunt f risk abve the ALARP regin, see Fig and 2.13), grade B wuld be assigned. If the reductin f the time befre the next stress test is als required (again based n the amunt f risk abve the ALARP regin), grade C wuld be assigned. Thirdly, the prpsed grading system requires bundaries (acceptance criteria) t be defined between the regins f negligible, ALARP, pssibly unjustifiable, and intlerable risk. The PM will ften need t rely n his r her wn judgement when defining these bundaries, especially in situatins where regulatry requirements d nt yet exist. It is the matter f future develpments t create recmmendatins fr the bundaries f different types f perfrmance measures that can be used by the PM f the stress test as the guidelines. 2.6 ST@STREST penalty system There is a wide range f methds and mdels fr assessing perfrmance f critical infrastructures against natural hazards. These methds cver different levels f detail and cmplexity fr each hazard, vulnerability, and risk cmputatin. All mdels are necessarily a simplificatin f the reality. Hwever, the level f simplificatin may vary significantly. In fact, different mdels and methds have t be assumed r intrduced t describe hw the hazard and vulnerability interact in time and in space. Furthermre, each cmbinatin crrespnds a different level f detail f the analysis. Fr example, reginal seismic hazard assessments and site-specific hazard assessments may bth represent the input fr the risk assessments, hwever they d differ in the level f details related t the hazard analysis (e.g., the descriptin f the natural variability f 31

44 methdlgy fr stress testing f critical nn-nuclear infrastructures surces, the details in mdelling the prpagatin frm surce t target, etc.). In a similar way, generic fragility functins and element specific fragility functin may be used, but again they largely differ in the level f details cnsidered in their quantificatin. Such differences are expected t significantly influence the reliability f the risk results. In the STREST methdlgy, the level f detail and sphisticatin used fr the risk cmputatin reflects the level f cmplexity f the methds adpted fr the cmpnent and system-level risk assessment. In a general sense, it may be defined as the trueness and precisin, and the repeatability and reprducibility f the results f the risk assessment. The selectin f the level f detail and sphisticatin t be used in a particular stress test, namely, t perfrm the hazard and risk analysis, is imprtant because it allws defining hw reliable are the results f the Assessment phase f the stress test. At the same time, this is a challenge, since it requires experts that need t have a clear idea abut all f the mdels and methds available in the scientific literature t perfrm each step f the analysis, i.e. the center, bdy and range f the methds and mdels. The state-f-the-practice methds and mdels are expected t have the trueness, precisin, repeatability and reprducibility that can be achieved within the established state f knwledge and within a reasnable engineering and analysis effrt. The experts need t characterize the trueness and precisin f the state-f-practice methds using multiplicative factrs (t shift the mean and adjust trueness) and dispersins (t characterize the precisin). Mre advanced methds shuld be prmted and less advanced methds shuld be discuraged by adjusting the factrs used t characterize them. Thus, a penalty system is prpsed as a part f the ST@STREST methdlgy. During the Pre- Assessment Phase (STEP 3: Set-up f the Stress Test) the TI and PM select the mst apprpriate ST-Level fr the given CI. As each ST-Level crrespnds t a different level f cmplexity f the hazard and risk analysis, a different level f detail and sphisticatin shuld be required as a minimum t perfrm the required analysis. In particular, in the prpsed ST@STREST, a Target Level (TL) f detail and sphisticatin, has been assciated with each ST-Level, accrding t the judgement abut the cmplexity f the required hazard and risk analysis. This target value represents the state f knwledge f the cmmunity and characterizes the state-f-practice f assessing the CI at the cmpnent and the system level. Then, data, mdels and methds needed t perfrm each step f the risk analysis are identified by the TI. These mdels and methds are characterized by a level f detail that reflects the grade f cmplexity amng the wide range f available methds in the scientific literature. The level f detail and sphisticatin f the Stress Test depends n the specific mdels selected fr the particular test. This selectin is mainly based n a scientific grund, but als has practical cnsequences, such as the requirement f the necessary duratin and resurces fr the stress test. Therefre, the chice f the mdels shuld be taken (and dcumented) jintly by the TI and the PM. Based n the chices made, the TI evaluates the Effective Level f detail f the analysis (EL). This assessment is reviewed by the Internal Review (IR) team, and cmpared with the TL. The EL shuld be at least as high as the TL. Based n the IR review, PM and TI may evaluate if changes t the hazard and risk analysis cmplexity are needed, principally t avid ptential penalties suggested by the reviewers. In fact, if the EL attained in the cnducted stress test is lwer than the TL required, the ST@STREST Penalty System is applied. In the fllwing, the ST@STREST Penalty System, based n the difference between the EL and the TL, is prpsed Prpsed penalty system The prpsed ST@STREST Penalty System aims t penalize the results f the hazard and risk assessment f the cnducted stress test by evaluating a Penalty Factr (PF). This 32

45 methdlgy fr stress testing f critical nn-nuclear infrastructures factr penalizes simplistic appraches (with respect t the state-f-practice) that cannt guarantee a sufficiently accurate analysis. The PF is defined by the TI in STEP 6 (Risk Objectives Check) f the methdlgy based n the difference between EL and TL. Namely, if the EL is greater r equal t TL the penalty system is nt applied. Levels f detail and sphisticatin and a Penalty Factr scheme are prpsed in the fllwing. This is just ne f the pssible schemes that the PM and TI need t determine, the IR t review and cnfirm, with a pssibility t invlve the PE t arrive at the bradest pssible cnsensus. Hwever, the prpsed Levels and Penalty Factr system is general and can be applied in stress test. Prpsed levels Three categries are defined t describe the trueness, precisin, repeatability and reprducibility f the hazard and risk analysis in a stress test: Advanced: making use f detailed infrmatin and advanced state-f-the-art methds and mdels in mst f the steps f the assessment; High: making use f cmmnly detailed infrmatin and state-f-the-practice methds and mdels in mst f the steps f the assessment; Mderate: making use f carse infrmatin and simplified methds in mst f the steps f the assessment. Starting frm this classificatin, a Target Level has been assciated t each ST-Level (Table 2.8) accrding t the grade f cmplexity f the risk analysis required. In case a F 0,1 ) is set up by the experts and quantitative scale is adpted, a Factr interval ( assciated t each Level. An example is prvided in the fllwing: F 0.7,1 1. Advanced : 2. High : F 0.4, Mderate: F 0.2,0.4 These values assciated t each level are indicative: in a particular stress test, they need t be determined by cnsensus between the PM, TI and IR. In general, these values can be studied in mre detail, fr example, in a study t accunt fr different parameters that affect the results f stress tests. In this case, the resulting Effective Level identified fr the hazard and risk assessment, i.e. the EL, shuld be at least equal t the lwest F (lwer bund f the interval) crrespnding t the Target Level. In this case the TL is characterized by lwer TL and upper TL bunds. lb ub Table 2.8 Target Levels fr each ST-Level ST-Level 1a 2a 2b 2c 2d 3c 3d Target Level (TL) Mderate Mderate High Advanced Advanced Advanced Advanced 33

46 methdlgy fr stress testing f critical nn-nuclear infrastructures Effective level (EL) At cmpnent-level (ST-L1) there are three methds t perfrm the single-hazard cmpnent check. These methds differ in the cmplexity and the data needed fr the cmputatin. Therefre, the assciated level f detail and sphisticatin is set as fllws: Hazard-based assessment: Mderate Design-based assessment: High Risk-based assessment: Mderate t Advanced The Effective Level fr the cmpnent hazard-based and design-based assessments is mderate (lwest f all pssible) and high, respectively. This means that, accrding t Table 2.8, the hazard-based assessment represents the minimum level f analysis required. If a risk-based cmpnent assessment apprach is required, the Effective Level may vary accrding t the level f trueness, precisin, repeatability and reprducibility used fr the evaluatin f hazard and vulnerability. Therefre, the resulting EL is a functin f the trueness, precisin, repeatability and reprducibility f the methd adpted fr hazard and vulnerability analysis and it may vary frm Mderate t Advanced. Fr system level (ST-L2 r ST-L3) stress tests, the evaluatin f EL is a functin f the level f detail selected fr each hazard, the methd adpted fr the epistemic uncertainty quantificatin, and the methd adpted fr the multi-hazard/risk evaluatin. Furthermre, evaluatin f EL fr each hazard is a functin f the level f each step and sub-step needed fr the cmputatin f the perfrmance and risk f the CI. In ther wrds, if the cmputatin f risk cmprises three principal steps i (hazard, vulnerability and risk), and each ne f the steps is characterized by j different layers, the resulting EL is a functin f the level f detail and sphisticatin f each step i and layer j. Thus, if a qualitative scale is adpted, the EL crrespnds t the mst frequent (mde) value f the level f detail adpted in each step and layer. If a quantitative scale is adpted (i.e. a quantitative factr is assciated with the analysis), the EL may be cmputed (fr a single hazard analysis, ST-L2) fllwing Eq. (2.6): n m w EL w EL w EL 1, j 1, j 2, j 2, j 3, j 3, j j 1 j 1 j EL W W W n m p p (2.6) where n, m and p are the number f layers in each step (hazard, vulnerability, risk); W i represent the weight f each step i f the risk analysis and w i, j the weight f each layer j (fr each step i) set up by experts. If all layers (fr each step) are cnsidered equally imprtant, then w 1,1 w 1,2... w 1,n 1 w2,1 w2,2... w2,m 1, w3,1 w3,2... w3,p 1. If all steps are cnsidered equally imprtant, then W1 W2 W3 13. In case f a multi-hazard analysis (ST-L3), ALE may be btained as in Eq. (2.7): where H1 H2 H1s H1EL H2 EL... HsEL EL (2.7) s H represents a weight f each hazard q set up by experts. Thus, a multi-hazard q EL crrespnds t the weighted mean f the level f detail evaluated fr each hazard EL Hq. If all hazards are cnsidered equally imprtant, then the weights H1 H2... H s 1. If the epistemic uncertainty analysis is als f cncern, the methd f accunting fr epistemic uncertainties culd be cnsidered as an additinal layer. 34

47 methdlgy fr stress testing f critical nn-nuclear infrastructures Penalty factr (PF) The penalty factr (PF) is defined as the difference between the EL and the TL f the ST level selected. If a qualitative scale (i.e. Mderate, High, Advanced) is cnsidered, three cases are pssible: a) TL=High, EL =Mderate b) TL =Advanced, EL = High c) TL= Advanced, EL =Mderate The penalty factr may be cmputed using the reference values that may be assciated t the three cases. Fr example, in the cases abve: a) PFH-M=0.2, b) PFA-H=0.2, c) PFA-M=0.4. These values are indicative: the actual values need t be set by experts cnsensus fr each stress test. If the level f detail and sphisticatin is expressed using a quantitative scale, PF is defined as the difference between the EL and the lwer bund f the TL f the ST level selected, TL ST lb 0 therwise PF ST TL EL lb if EL TL ST lb (2.8) Nte that the penalty system culd be als applied t penalize the CIs that reach the minimum target but just barely, i.e. when ST ST TL EL TL evaluated cnsidering the upper bund f the TL, i.e., PF ST TL EL ub lb. In this case, the PF may be (2.9) ub Penalized lss, LP Cnsider that the utcme f the risk assessment at the system level is expressed by the annual exceedance rate f lsses (L),. Fr example, in case seismic hazard is f l cncern, accrding t the PEER perfrmance based earthquake engineering (PBEE) framewrk (Crnel and Krawinkler, 2000), is frmulated as: l l G l d dg d edp dg edp im d im (2.10) d edp im where im is an intensity measure (e.g., peak grund acceleratin, peak grund velcity, spectral acceleratin, etc.), edp is an engineering demand parameter (e.g., interstrey drift), d is a damage measure (e.g., minr, medium extensive, etc.), l is the lss variable (e.g., mnetary lsses, dwn-twn time, etc.), and G y x is a cnditinal cmplementary cumulative distributin functin (CCDF) relating the variables. As mentined befre, the risk analysis can be perfrmed at different levels f detail and sphisticatin. In Eq. 2.9 it is pssible t include an extra uncertainty, here named penalty uncertainty, t penalize simplistic analysis appraches. Therefre, a new metric is intrduced, named penalized lss LP expressed (in the lgarithmic scale) as: lg lg L L (2.11) P P where ε P is the penalty uncertainty. Observe that penalty uncertainty ε P acts exactly as mdel errr. In fact, the bjective is t amplify the uncertainties intrduced by simplistic appraches that cannt guarantee an analysis with desirable level f detail and 35

48 methdlgy fr stress testing f critical nn-nuclear infrastructures sphisticatin. A cnvenient chice fr the prbability distributin f ε P is the Nrmal distributin, i.e. ε P ~N(0, σ(l)), where l is defined as: l PF lg l, l 0 (2.12) where PF is the penalty factr defined previusly. Observe that PF acts as a cefficient f variatin (c..v). Further, in rder t fcus n the tails f the risk curve, n errr is added t the penalty factr fr l 0. Cnsidering that the supprt f L is usually 0, r bunded as 0,l, the distributin f P must be truncated accrding t the supprt f L. It is f interest t bserve that is prprtinal t the lss; cnsequently, the tails are penalized bth by the presence f an extra-uncertainty and by a higher. l Then, the penalized lss LP is a new randm variable, defined cnditinally with respect t the lss value l btained frm the risk assessment. Given this, the cnditinal cumulative cmplementary distributin f LP can be written as: 1 P P P P max l G l l F l l P L l L l (2.13) and the annual exceedance rate f LP can be written as: l G l l d l P (2.14) l P An example is prvided in Fig. 2.14, where the annual exceedance curve f a hypthetical CI has been penalized using different PF values. The blue curve crrespnds t PF=0, i.e. the annual exceedance rate f L (Eq. 2.9), while the ther curves represent the annual exceedance rate f the penalized lss LP expressed in Eq Fig Annual exceedance curves f penalized lss cnsidering different penalty factr values Discussin There are sme pints f the penalty system that need further discussin and investigatins as a part f future studies. Firstly, the prpsed penalty system requires levels f detail and sphisticatin (qualitative and/r quantitative) t be prperly set by experts cnsensus. Experts must have a clear idea abut mdels and methds available in the scientific literature and their applicability t perfrm each step f the risk analysis. This may nt be feasible fr all perils that have t be cnsidered fr the stress test. Further, this evaluatin shuld change in 36

49 methdlgy fr stress testing f critical nn-nuclear infrastructures each stress test, reflecting the prgress f the scientific research. The level f knwledge between tw stress tests may change and the levels f detail and sphisticatin scheme shuld reflect this change. Secndly, the cmputatin f the Effective Level (Eq. 2.5 and 2.6) des nt take int accunt the level f detail and sphisticatin assciated t the apprach adpted fr the multi-risk analysis. This is because the current level f knwledge des nt allw ranking these appraches, even thugh different multi-risk methds have been prpsed recently. Finally, the distributin f the penalized lss has been selected as a Lgnrmal distributin in this prject. Other prbability distributins, fr example, a Gaussian distributin n the nrmal scale can be justified as well. Further studies n the determinatin f the apprpriate distributin f the penalized lss shuld be dne. 37

50

51 Incrprating int the life cycle management f nn-nuclear critical CIs 3. Incrprating ST@STREST int the life cycle management f nn-nuclear critical CIs 3.1 Intrductin Structures and civil infrastructure systems are subjected t time-varying envirnmental stressrs. These stressrs can be lw-cnsequence persistent stressrs such as aging, fatigue r crrsin, as well as high-cnsequence lw-prbability-f-ccurrence stressrs such as natural r man-made disastrus events. Bth types f stressrs may induce huge ecnmic lsses and result in significant envirnmental impacts n the cmmunity these CI systems serve. In rder t increase the lng-term perfrmance f such systems against rare events and lng-term degradatin prcess, it is very imprtant t implement adequate strategies fr maintaining such systems during their lifetimes. These activities may include peridic inspectins, maintenance and retrfit actins, structural health mnitring, and perfrmance and risk analysis (Frangpl and Sliman, 2016). These actins are ratinally scheduled alng the life-cycle f the systems using a life-cycle management (LCM) prcedure. Life cycle cst (LCC) and ptimizatin tls are usually adpted t predict the perfrmance f an infrastructure system subjected t lngterm degradatin prcess during its lifetime and t plan maintenance interventins. In particular, the perfrmance prfile (perfrmance indicatr graphed against time) resulting frm the life cycle analysis allws planning the necessary interventins (maintenance, inspectin and repair) in rder t maintain the structural perfrmance at an acceptable level. Establishing the best schedules requires a rbust ptimizatin prcess. The cmplexity f this prcess depends n the scale f the prblem and n the type f deteriratin phenmena cnsidered (lng-term prcesses and/r extrardinary events). A brief verview f different aspects f LCM (i.e. life cycle analysis and cst ptimizatin, degradatin prcesses and mdelling as well as the rle f structural health mnitring and inspectin techniques in supprting life cycle management decisins) may be fund in STREST Deliverable 5.3 (Espsit and Stjadinvic 2016b). 3.2 LCC including natural hazard risk The main aim f a LCC is t predict the perfrmance f a CI system subjected t all envirnmental stressrs during its lifetime. Hwever, it is nted that the seismic risk analysis, and natural hazard risk analysis in general, has nt devted enugh attentin t the structural maintenance ptimizatin prblem (Furuta et al, 2011), althugh sme examples exist. In regins expsed t frequent catastrphic natural events, LCC ptimizatin analysis shuld accunt fr the effects f these hazards. The mdel prpsed by Chang and Shinzuka (1996) represents ne f the first attempts t include natural hazard (in particular seismic risk) in the LCC framewrk. The framewrk is shwn in Fig It includes tw innvative aspects: i. First, in additin t the initial csts f cnstructin and csts attributed t maintenance actin, the csts due t service interruptin are cnsidered. The latter are called user csts that represent the scietal csts that are impsed when the functinality f a system is reduced mstly during the rutine maintenance wrk r the retrfit actin. Fr example, during a maintenance interventin f a bridge, the serviceability f the rad netwrk (flw f gds and peple) is reduced, impsing an increment f travel time fr each user. The ttal extra travel cst due t the maintenance actin represents the user cst. ii. Secnd, the expected csts assciated t seismic risk f a CI system (i.e. discunt cst fr seismic retrfit and damage/repair csts) during the lifecycle f a structure r a system are cmbined with the initial capital and discunted maintenance cst. 39

52 Incrprating int the life cycle management f nn-nuclear critical CIs Fig. 3.1 Life-Cycle Cst framewrk including natural hazard risks adapted frm Chang and Shinzuka (1996) The life-cycle csts C is divided in fur categries as expressed in the fllwing equatin: C C1 C2 C3 C (3.1) 4 where and the unplanned csts. C 1 and Planned csts t wners ( C 2 represents the planned csts, C 3 C 4 C 1 ) invlves initial cnstructin, subsequent expected discunted maintenance csts and discunted seismic retrfit csts, cnsidering that a seismic retrfit is nly applied nce in the lifetime f a structure. In additin t planned csts paid by the wner f the structure/infrastructure system, maintenance and seismic retrfit actins may als impse user csts ( C 2 ) due t the interruptin f nrmal service (e.g. travel delay in a rad netwrk). This cst impsed t the sciety is functin f the extent and the duratin f the usage disruptin during the maintenance activities and the retrfit actin. In additin t the csts assciated t maintenance and design chices (planned csts), the framewrk includes unplanned life cycle csts related t the structural perfrmance and assciated repair csts due t a seismic event. Unplanned csts t wners ( C 3 ) cnsist f expected discunted repair csts f earthquake damage ver the life span f the structure. These csts are evaluated perfrming a prbabilistic seismic risk/perfrmance analysis f the system, cnditinal t its physical state at time t. The perfrmance evaluatin changes ver time due t natural deteriratin as well as mitigatin actins. The unplanned hazardrelated user csts ( C 4 ) cnstitute the final categry f this life-cycle cst framewrk and they are als based n a prbabilistic cnditin/perfrmance analysis f the system under study. These user csts are related t the service disruptin due t earthquake damage and repairs and depend n the expected duratin f repair/recnstructin activity ver the life span f the structure. 3.3 Unified life cycle management f CI Thrugh the life cycle f the CI, systems peratrs have the bjective t maintain the infrastructure systems and mitigate degradatin f system cmpnents ver time all the while achieving an ecnmically justified peratin f the system. T this aim, LCC and 40

53 Incrprating int the life cycle management f nn-nuclear critical CIs ptimizatin tls are usually adpted t predict the perfrmance f an infrastructure subjected t lng-term degradatin prcess during its lifetime and planning maintenance interventins. Hwever, in regins expsed t natural events, LCC analysis shuld als take int accunt the effects f extreme natural events that may increase the prbability f failure r lss f functinality during their lifetime. The multi-level framewrk ST@STREST has been prpsed with the aim f prviding a multi-level systematic and harmnized apprach fr the evaluatin f the perfrmance f these systems against extreme and disastrus natural events. In rder t increase and ptimize the lng-term perfrmance f CIs, the utcmes and findings f a stress test (e.g. results f risk analysis and identified risk mitigatin strategies) shuld be included in the lng-term maintenance plan f a CI. Results f the risk analysis (i.e. Assessment phase, Phase 2) in terms f system perfrmance and expected csts f natural events may be incrprated in a LCC analysis and ptimizatin prblem. Furthermre, the evaluatin f risk reductin strategies (Decisin Phase) may make it pssible t recnsider the full management and maintenance plan f the CI itself. Therefre, the pssibility t include the data n the current state f a CI in the aftermath f an actual disastrus event is anther imprtant aspect f the prpsed framewrk. The state f civil infrastructures after the ccurrence f a natural event is usually assessed thrugh rapid visual inspectin r autmatic screening tls (e.g. clse-circuit televisin). Thrugh the use f standardized survey frms (e.g. EERI, 1996), data n the typlgy, lcatin, cmpnent s features and the assessed physical damages are then cllected t prvide an estimate f the extent f the service disruptin, csts and repair times and t define the repair/replacement strategy t apply. At the same time, the prcessing f these data can be useful t update the state cnditin histry f the inspected cmpnents f the CI and fr estimating and/r updating f the perfrmance predictin mdels used in the risk analysis. In this sectin, a framewrk t integrate stress test utcmes and findings and data gathered frm pst-event damage survey int a unified life-cycle management strategy is prpsed and discussed. In particular, an extended versin f the mdel prpsed by Chang and Shinzuka (1996) is prpsed. The prpsed framewrk aims t include the stress test utcmes (i.e. lss curves, safety assessment and risk mitigatin strategies) and infrmatin that can be retrieved frm pst-event damage survey int a life cycle cst evaluatin and ptimizatin prcedure Life cycle analysis including stress test and pst-event data In rder t ptimize the life-cycle csts in a CI management strategy, the utputs f a stress test are ging t be cnsidered in the prpsed framewrk. As shwn in Fig. 3.2, the utcmes f a Stress Test have an impact n: Expected damages: unplanned life cycle csts related t the structural perfrmance and assciated repair csts due t extreme natural events. A stress test allws t evaluate the perfrmance f the CI against extreme natural events (accrding t the ST-Level adpted). In this way it is pssible t quantify the expected csts caused by extreme natural events and then evaluate the assciated unplanned wner and user csts ( C 3 and C4 in equatin 3.1) t be included in the LCC analysis and ptimizatin. Mitigatin histry: anther utcme f a stress test is represented by the evaluatin f risk reductin strategies based n a disaggregatin analysis (Decisin Phase, Phase 3). A disaggregatin analysis is aimed at btaining the prbability that a specific value f a variable invlved in the risk assessment is causative fr the exceedance f a lss value f interest. The lss may be disaggregated with respect t system s respnse, which may help identifying the cmpnent the damage f which mst likely causes the exceedance f the lss value f interest. Then, risk 41

54 Incrprating int the life cycle management f nn-nuclear critical CIs mitigatin strategies are frmulated based n the results f the disaggregatin analysis with the aim f increasing the lng-term perfrmance f CIs. Fig. 3.2 Prpsed framewrk fr assimilating stress test and pst-event data in a ttal life cycle cst analysis In rder t demnstrate hw the utputs f a stress test may be incrprated in the life cycle management f a CI, the prpsed framewrk was applied t the case study f L Aquila (Italy) gas netwrk. A Stress Test Level 2a was perfrmed n the L Aquila netwrk as it was befre the 2009 earthquake event t assess the perfrmance f the netwrk due t earthquake hazard. Risk is expressed in terms f annual prbability f exceedance f service disruptin levels, measured by a cnnectivity-based perfrmance indicatr (PI), i.e. the Cnnectivity Lss CL. Risk bundaries fr the case study were defined in terms f F-N limits, accrding t the equatin reprted in STERST Deliverable 5.1 (Espsit et al 2016). Then, a disaggregatin analysis was perfrmed and pssible risk mitigatin strategies were identified. Finally, in rder t evaluate the cnsequences f the risk reductin actins (e.g. seismic retrfit f sme cmpnents f the gas netwrk), the seismic perfrmance f the gas netwrk was assessed again, and results f the risk analysis were cmpared with the risk bjectives identified at the beginning f the stress test. Results in terms f annual exceedance curve f the assessed perfrmance lss cnsidering three mitigatin actins are shwn in Fig Mre details n this applicatin study are presented in STREST Deliverable 5.3 (Espsit and Stjadinvic 2016b). 42

55 Incrprating int the life cycle management f nn-nuclear critical CIs Fig. 3.3 Annual rate f exceedance f CL cnsidering mitigatin strategies applied t the statins (MS1 and MS2) and t buried pipelines (MS3) Anther imprtant aspect f the prpsed framewrk is represented by the use f cllected data n the state f a CI in the aftermath f a disastrus event. As shwn in Fig. 3.2, the infrmatin gathered fr pst-event inspectin and survey has an impact n: Cnditin histry: after a disastrus even, new infrmatin abut the CI is available. Thrugh the cllectin and the prcessing f n-site data the state cnditin f the inspected cmpnents f the CI may be updated. Risk analysis: infrmatin gathered after the ccurrence f a natural disaster can be used t estimate and/r update perfrmance mdel parameters adpted in the risk analysis thrugh the use f statistical regressin methds r the mre advanced Bayesian appraches. Mitigatin histry: the main purpse f pst-event damage surveys is t assess the functinality f system s cmpnents and the repair/replacement strategy t apply. Maintenance csts: the updated state cnditin f the CI may be used t redefine the interventin maintenance schedule, i.e. t determine whether a maintenance actin is needed r nt. Infrmatin gathered after the ccurrence f a natural disaster can be f extrardinary imprtance fr the estimatin and/r updating f perfrmance predictin mdels adpted in the risk analysis. Thrugh the gathering and the prcessing f the pst event damage data, it is pssible t derive empirical estimate f perfrmance mdels (Basz et al, 1999, Shinzuka et al, 2000; O Rurke and S, 2000). Statistical regressin methds r mre advanced Bayesian appraches can be used t estimate mdel parameters. In particular, Bayesian prcedures are adpted t update mdel parameters estimates when new data becmes available, cmbining the likelihd functin with the prir infrmatin n these parameters (Straub and Der Kiureghian, 2008). This apprach has als the ability t handle all types f infrmatin and t include engineering expert pinin thrugh a prir distributin. An example f empirical estimatin and Bayesian updating f a fragility mdel fr buried pipelines is prvided in STREST Deliverable 5.3 (Espsit and Stjadinvic 2016b). Pipeline damage data retrieved after the 2009 L Aquila earthquake were used t estimate a fragility functin fr buried steel pipes caused by seismic grund shaking. In particular, a Bayesian estimatin mdel alng with the use f Imprtance sampling technique fr numerical efficiency has been adpted t estimate the parameters f the fragility functin cnsidering as a-priri distributin f the mdel parameters a nn-infrmative ne. Fig. 3.4 shws the 43

56 Incrprating int the life cycle management f nn-nuclear critical CIs results f the Bayesian estimatin fr all sets f simulatins. The results f the estimatins were cmpared with a pipeline fragility relatin cnsidered suitable (in terms f pipe material and diameter) fr the L Aquila gas netwrk., i.e. the ALA (2001) fr steel arc welded pipes. Fig. 3.4 Cmparisn f existing and updated fragility curves fr L Aquila gas steel pipes This case study shws that valuable data frm the mdel-based stress tests and actual pst-event investigatins can be inserted int a ttal life cycle cst analysis and that the effects f high-cnsequence lw-prbability events can be cmbined with the effects f lw-cnsequence persistent degradatin prcesses in a cmprehensive mdel t better plan the life-cycle management f critical civil infrastructure systems. 3.4 Discussins In regins expsed t natural events, LCC analysis shuld als take int accunt the effects f extreme natural events that may increase the prbability f failure r lss f functinality during their lifetime. Hwever, very few studies have been fcused n the pssibility t include the risk assciated t extreme natural events in a LCCframewrk. Stress tests fr civil infrastructure systems have been prpsed in with the aim f prviding a multi-level systematic and harmnized apprach fr the evaluatin f the perfrmance f these systems against extreme and disastrus natural events. In particular, the ST@STERST multi-level framewrk has been prpsed t verify the risk f CI systems respect t extreme natural events and t supprt decisin makers in the evaluatin f strategies t imprve the perfrmance f CIs alng the life cycle. Each Stress Test Level is characterized by different bjectives (cmpnent r system) and by different levels f risk analysis cmplexity (starting frm design cdes and ending with state-fthe-art risk analyses, such as mdeling cascading failures). This makes the stress test adaptable t different hazard cntexts and applicatin t a brad range f civil infrastructure systems. Further, the level f cmplexity is tuned accrdingly t types f critical infrastructures, the ptential cnsequence f failure f the CIs, the types f hazards, and the available resurces fr cnducting the stress tests. A pssible framewrk t integrate the results f stress tests and the data retrieved after disastrus events int a unified life-cycle management strategy f CIs has been intrduced 44

57 Incrprating int the life cycle management f nn-nuclear critical CIs in rder t manage bth lng degradatin and instantaneus natural hazard-induced stresses during the lifetime f a civil infrastructure system. In particular, results f the risk analysis cnducted in the scpe f a stress test in terms f system perfrmance and expected csts f natural events, may be incrprated in a LCC analysis and ptimizatin prblem. Further, the evaluatin f risk reductin strategies resulting frm a lss disaggregatin may make it pssible t recnsider the full management and maintenance plan f the CI itself. On the ther hand, the evaluatin f the state f civil infrastructures after the ccurrence f a natural event, and the cllectin and prcessing f pst-event data, such as typlgy, lcatin, cmpnent s features and the assessed physical damages, can be useful t update the state cnditin histry f the inspected cmpnents f the CI and t estimate and/r update perfrmance predictin mdels used in the risk analysis. 45

58

59 Using t enhance scietal resilience 4. Using t enhance scietal resilience When CIs are affected by extreme natural events, such as earthquakes, flds, tsunami, etc., they are mre and mre ften unable t quickly recver their functinality, either back t the pre-disaster riginal state, r just t a level sufficient t satisfy the pstdisaster demand. With the increasing density and intercnnectedness f the cmmunities tday, the demand n and the imprtance f the CIs is grwing; thus, the cnsequences f CI failure (t meet the demands) can be devastating bth frm the standpint f human life endangerment and frm the ecnmic standpint. The pst-disaster perfrmance f CIs has a high impact n the crdinatin and the executin f emergency actins, and at the same time it influences bth the lng-lasting pst-disaster recvery prcess f the cmmunity, and the eventual pst-disaster resumptin f cmmunity functins. Tday, after decades f develpment f prbabilistic risk assessment techniques, there are slid prbabilistic engineering risk assessment methds and tls that prvide practical estimates f instantaneus CI perfrmance (service) lss due t direct and indirect disaster-induced damage. Hwever, the instantaneus lss by itself des nt reveal hw a cmmunity served by the CIs respnds t a disaster. The time dimensin represents a key aspect: the time-evlutin f cmmunity needs and the ability f the CIs t fulfill these needs (e.g. water, gas, and electricity) is best represented and mdelled using the cncept f resilience rather than f risk. The term resilience has increasingly been seen in the research literature in many fields, frm psychlgy, bilgy, ecnmy, scial studies, and als engineering. Definitin and mdelling r disaster resilience f engineered systems is the tpic f an increasing amunt f recent research wrk. Nevertheless, there is still a substantial diversity amng the definitins and the mdelling f resilience. In this prject, we will define resilience in general as the ability (f CIs and cmmunities) t prepare and plan fr, absrb, recver frm and mre successfully adapt t adverse events (The Natinal Academy 2012). Cnducting a stress test t assess nly the risk f a civil infrastructure system, i.e. t relate the lsses with the ttal prbability f their ccurrence due t ne r mre hazards, des nt prvide enugh infrmatin n the ability f the CI system t functin and recver after a disaster. The system, and systems f systems that frm the built envirnment f ur sciety, are nn-linear. The ST@STREST framewrk prpsed in Chapter 2 aims at evaluating the CI system risk frm natural hazards. Hwever, this framewrk was designed t als serve as a basis fr the develpment f a new stress test cncept that may supprt decisin makers in the evaluatin f strategies t nt nly decrease the risk expsure, but als t enhance the resilience f CIs against natural hazards. It is clear that a new resilience-riented stress test methdlgy and framewrk fr civil infrastructure systems must include the recvery prcess and, furthermre, include mdels f hw the systems functin and deliver their service t the cmmunity, and hw the cmmunity recvers its needs fr such services. The ST@STREST framewrk was develped while keeping in mind such an extensin, t make it pssible t test the resilience f CIs t extreme events, i.e. t verify the capacity f CIs t anticipate, absrb and adapt t events disruptive t its functin, and recver either back t its riginal state r anther state cnsistent with the needs f the cmmunity during, and at the end f the pst-disaster recvery prcess. The extensin f the prpsed framewrk requires the pursuit f tw main gals: Identificatin f resilience metrics and standardized methdlgies t mdel the resilience f CIs; and Understanding hw stakehlders needs depend n CIs, defining resilience-based acceptance criteria. 47

60 Using t enhance scietal resilience Regarding the identificatin f resilience-based acceptance criteria, understanding hw the different stakehlders needs depend n the functinality f the CIs represents the key issue. Business activities need suitable facilities and their supply chains and delivery netwrks; everyne needs a transprtatin netwrk, electricity, water, gas, and cmmunicatin netwrks but, in the aftermath f a disastrus event, sme f these services (e.g. water) are mre needed than thers. There are als different, and cmpeting pririties fr services t critical facilities (e.g. hspitals). Recnciling these factrs t develp CI resilience acceptance criteria, taking int accunt nt nly the instantaneus lsses but als the time evlutin f the CIs and the cmmunity systems during the recvery prcess, is nt trivial. In this chapter these aspects will be argued in mre details. A detailed verview f a pssible apprach t integrate the evlutin f the CI perfrmance in time in the ST@STREST framewrk is presented in STREST Deliverable 5.4 (Espsit and Stjadinvic 2016c) and STREST Deliverable 4.5 (Stjadinvic and Espsit 2016). 4.1 Mdelling resilience f critical infrastructures against natural hazards The prbabilistic resilience assessment f CIs is gaining increasing imprtance in a research effrt tward assessing the risk and resilience f cmmunities t natural hazards because the CIs are essential t the functining f a cmmunity. Several definitins f resilience have been ffered in varius disciplines. Many f them are similar and they verlap with existing cncepts as rbustness, flexibility, agility, etc. The cncept f resilience has been als apprached acrss applicatin dmains, including psychlgy, eclgy, enterprises, and engineering, amng thers. In the engineering dmain, in particular in the subdmain f infrastructure systems, the Natinal Infrastructure Advisry Cuncil (NIAC, 2009) defined the resilience f infrastructure systems as the ability t predict, absrb, adapt and/r quickly recver frm a disruptive event such as natural disasters. Infrastructure systems are als cnsidered as subdmain f scial science, in which lack f CI resilience can lead t huge cnsequences n cmmunities. In the civil infrastructure dmain, in a field-defining paper, Bruneau et al (2003) cnceptualized the resilience as a metric that can be understd as the ability f the system t reduce the chances f a shck, t absrb a shck if it ccurs, and t recver quickly after a shck. The authrs defined fur dimensins f resilience in the well-knwn resilience triangle mdel: 1) rbustness, the strength f the system, 2) rapidity, i.e. the speed at which the system culd return t its riginal state r at an acceptable level f functinality, 3) resurcefulness, the level f capability in applying material and human resurces t respnd t a disruptive event, and 4) redundancy, the extent t which carries by a system t minimize the likelihd and the impact f disruptin. Bruneau et al (2003) prpsed a deterministic static metric f the resilience lss f a cmmunity with respect t a specific event, as the expected degradatin in quality (prbability f failure), ver time (that is, time t recvery), R, frmulated in the fllwing equatin. t1 t0 R 100 Q t dt (4.1) where Q(T) represents the quality f the system, t0 the time when the specific damaging event ccurs and t1 is the time when the restratin f the system is cmpleted (indicated by a quality f 100%). The ntin f system quality was left pen t interpretatin, but is ften understd as the ability f the system t perfrm, which, in the case f CIs, may mean the quantity f delivered service. 48

61 Using t enhance scietal resilience Fllwing the Bruneau et al (2003) pineering study, cnsiderable attentin has been fcused twards develping framewrks t assess the resilience f civil facilities r infrastructures; amng these, ntable wrks are: Chang and Shinuzuka (2004), Franchin and Cavalieri (2015), Bcchini et al (2014), Francis and Bekera, (2014), Brccard et al (2015), Iervlin and Girgi (2015), Sun et al (2015a,b). Amng them, the mst innvative are Francis and Bekera, (2014) and Brccard et al (2015) Francis and Bekera (2014) prpsed a resilience factr as quantitative metric f an infrastructure system s resilience. This factr depends n a speed recvery factr, the riginal stable system perfrmance level (pre-disaster perfrmance f the system), the perfrmance level immediately pst-disruptin (befre recvery starts), and the perfrmance at a new stable state level (after recvery effrts have been exhausted). The speed recvery factr is defined as a functin f the time that is acceptable t elapse after a disaster befre recvery starts, the time t cmplete initial recvery actins and the time t final recvery. Brccard et al (2015) investigated all the statistical assumptins and limitatins t integrate the quantificatin f seismic resilience f a given civil facility r system in a stchastic Markvian framewrk. In particular, the study revisited the PEER framewrk frmula by impsing the resilience f a facility as a final decisin variable, analyzing then the limitatins and the range f applicability evaluating the prbability f interactin between the recvery time and the inter-arrival time f seismic events. Hwever, despite the increasing imprtance f the rle f system resilience in varius disciplines f system engineering, and the recent effrts by many authrs, there is a substantial diversity amng the definitins and the mdelling f resilience (Hsseini et al, 2016, Henry and Ramirez-Marquez, 2012, Ouyang and Duenas-Osri 2012, Bruneau et al, 2003). As als reprted by Bruneau et al (2003) "there is n explicit set f prcedures that suggests hw t quantify resilience in the cntext f earthquake hazard, hw t cmpare cmmunities with ne anther in terms f resilience, r hw t determine whether individual cmmunities are mving in the directin f becming mre resilient in the face f earthquake hazards." Cmmunities and infrastructure systems are cmplex systems f systems. Mdelling their resilience against natural hazards in a prbabilistic way and with a single metric is nt quite straightfrward. Further, mst f the resilience quantificatin framewrks prpsed in literature impse the pint f view f the infrastructure wner, i.e. t recver the initial functinality f the system as fast as pssible. Hwever, CIs are built t deliver a service t a cmmunity, then the resilience assessment shuld als take int accunt the ability f a CI t supply the time-varying cmmunity demand fr the services prvided by the assessed CI (Mieler et al, 2015). A CI resilience quantificatin framewrk needs t explicitly accunt fr the evlutin f the supply (i.e. the service supply capacity f the system) and fr the evlutin f the demand f the cmmunity and ther CIs fr its services in the aftermath f a disaster. T this end, a cmpsitinal demand/supply resilience quantificatin framewrk t evaluate the pst-disaster resilience f CISs that supply their services t satisfy the demand f a cmmunity was recently prpsed (Dider et al, 2015; Sun et al 2015a, 2015b; Didier et al, in prep). The framewrk accunts explicitly fr the evlutin f the demand f a cmmunity and the demand f ther CIs during the pst-disaster recvery prcess. The framewrk cnsists f three main elements: 1. The evlutin f the ptential demand fr the service f the investigated CI ver time after a disaster. The ptential demand is the amunt f demand f all cnsumers f the service f the assessed CI, if there were n limitatins n the supply side (i.e. assuming an unlimited supply f service). Cnsumers include, fr example, the cmmunity (cmpsed by its residential building stck, industries, 49

62 Using t enhance scietal resilience businesses and critical facilities, used by the ppulatin) and all ther CIs (e.g. electric pwer demand f the water supply system in rder t run water pumps). Ptential demand depends n: the vulnerability f the cmpnents f the set f demand systems (e.g. a cmmunity and/r anther CI) during the lss accumulatin and absrptin phase f a disaster; and, the recvery f the cmpnents f the set f demand systems during the recvery phase after a disaster. ptential extrardinary r high-pririty needs in the aftermath f a disaster (e.g. hspital, telecmmunicatins netwrks) 2. The evlutin f the ptential supply fr the service f the investigated CI ver time after a disaster. The ptential supply is the amunt f service supply available t satisfy the demand f the system. Ptential supply depends n: the vulnerability f the cmpnents f the service supply and distributin systems during the lss accumulatin and absrptin phase f a disaster; and the recvery f the cmpnents f the service supply and distributin systems during the recvery phase after a disaster. 3. A system peratin mdel, regulating the allcatin (r dispatch) f the service supply in rder t satisfy the demand f the cnsumers. It accunts fr the capacity limitatins and interactins f the different elements f the CI: the service prductin system, the distributin system, the technical functining and cntrl f the system, and the system r netwrk effects. These include, fr example, the tplgy f the system, peratr service allcatin plicies, r pssible demand distributin strategies. The cmpsitinal resilience quantificatin framewrk allws fr the assessment f the resilience f a cmbined, interacting set f demand/supply CI systems. CI system resilience is the time-varying ability t cver the demand fr its services, while subjected t disruptive events that may ccur ver the system s lifetime. The framewrk allws, thus, t accunt fr the impact f a disaster n bth the demand and the supply side and t track the pst-disaster evlutin f demand and supply at bth cmpnent and system levels. The evlutin f the demand, supply and cnsumptin after a disaster is sketched in Fig The shaded area represents the integral lack f resilience, i.e. the time during which the demand f the cmmunity is larger than the service prvided by the CI. Als shwn are the measures f time required t satisfy the demand, and times needed t fully recver the demand and the supply t the pre-disaster level, accunting fr sme reserve margin. One advantage f the prpsed cmpsitinal resilience quantificatin framewrk is the cmpnent and system level evaluatin strategy, which fllws the ST@STREST methdlgy. Anther advantage is the explicit accunt f the evlutin f demand, supply and cnsumptin f a CI service. This makes it pssible t treat event sequences, such as aftershcks, cmmunity deppulatin, such as the aftermath f the 72 AD Pmpeii vlcanic eruptin, permanent demand changes, such as the effect f the 1995 Kbe earthquake n the recvery f Kbe prt peratins r the effect f demand surges, such as thse that ccur n the cellular phne netwrk immediately after a disaster. A detailed verview f this framewrk is presented in STREST deliverable 4.5 (Stjadinvic and Espsit, 2016). 50

63 Using t enhance scietal resilience Fig. 4.1 Representatin f the netwrk supply, demand and cnsumptin curves after a natural disaster event (STREST Deliverable 4.5 (Stjadinvic and Espsit 2016)) 4.2 Resilience-based stress test fr critical nn-nuclear infrastructures In this sectin the ST@STREST framewrk prpsed in Chapter 2 is analyzed t define a new cncept f stress test aimed at testing the resilience (and nt nly the risk) f CIs t extreme events and cmparing the prbability f lss f resilience (nt just the prbability f instantaneus lsses) t acceptable levels. A resilience-based stress test cncept may supprt decisin makers in the evaluatin f strategies t imprve the capacity f CIs t anticipate, absrb and adapt and/r quickly recver frm a disruptive event. In rder t define a new cncept f stress test aimed at verifying and mitigating the resilience f CIs, sme aspects f the fur-phase ST@STREST wrkflw have t be reviewed and the scpe f each phase f the methdlgy mdified, in particular: Pre-Assessment phase (Phase 1) The cllectin f all data available n the CI als has t include all the infrmatin required fr the estimatin f the resilience metrics selected fr the assessment, e.g. the infrmatin n the rate f recvery, cnditined n the incurred damage state (the recvery curves, a cunterpart t vulnerability curves), the funds, materials and manpwer availability fr the recvery and restratin prcess, the pre- and pst-event demand patterns fr the service f the investigated CI, the characterizatin f the cmmunity the CI serves, and the peratin mdels f the CI in bth nrmal and emergency cnditins. Further, resilience-based bjectives/acceptance criteria have t be defined fr each resilience metric and accrding t the specific perspective cnsidered, i.e. the netwrk peratr and/r the cmmunity the CI serves. Here, the cmpeting interests f the netwrk peratr (e.g. maximizing prfit) and the cmmunity (e.g. minimizing disruptin t the ppulatin) need t be recnciled in an aggregate acceptance criterin. Assessment phase (Phase 2) In the Assessment phase, the resilience (and nt nly the perfrmance) f each cmpnent f the CI (Cmpnent analysis) and the whle system (System Analysis) shuld be evaluated accrding t the ST-Level selected. One pssible way t 51

64 Using t enhance scietal resilience perfrm this task is t use the cmpsitinal demand/supply resilience quantificatin framewrk (Didier et al, in prep). Mre effrts shuld be devted t develp standardized methdlgies aimed at verifying the resilience f CIs in the natural hazard cntext, bth at cmpnent and system level. Decisin Phase (Phase 3) The results f the resilience assessment are cmpared with the bjectives defined in the pre-assessment phase and resilience mitigatin strategies and guidelines are frmulated. An effrt t disaggregate the resilience f a CI-Cmmunity system t find which elements and systems and which events cause the largest amunt f impact. Reprt phase (Phase 4) Results f the resilience analysis and mitigatin strategies are presented t CI authrities, regulatrs and representatives f the cmmunity. An effrt t cmmunicate resilience (and its prbabilistic nature), building n the nging wrk n cmmunicatin r risk, shuld be undertaken Future research and discussins The extensin f the prpsed framewrk requires the pursuit f tw main gals: Identificatin f resilience metrics and develpment f standardized methdlgies t mdel the resilience f CIs; and Definitin f resilience-based acceptance criteria, understanding hw cmmunity s needs depend n critical infrastructures. Definitin and mdelling f disaster resilience f engineered systems is the tpic f an increasing amunt f recent research. Nevertheless, there is still a substantial diversity amng the definitins and the mdelling f resilience. In particular, there is n standardized apprach that suggests hw t quantify the natural disaster resilience f CIs in the cntext f natural hazard. As future research, we fresee the need f defining a taxnmy f resilience metrics mainly based n the fllwing aspects: The identificatin f quantifiable time-dependent system delivery functins that specify the system functinality f the infrastructure system under study, such as the flw, the cnnectivity, the time delay, etc. The mdelling f interdependencies between netwrks within a cmmunity. Including the scial perspective in the definitin f resilience metrics accunting fr time-varying cmmunity demand fr the services prvided by the assessed CI. The definitin f resilience metrics requires a deep understanding f the CI s functinality and the parameters that are imprtant fr bth the peratr and the sciety the CI serves. An example f pssible resilience metrics fr a gas distributin netwrk (Bellagamba, 2015) is prvided in Fig In this case, the system functinality is expressed in terms f daily gas flw. The resilience metrics are identified cmparing the required system functinality by the cmmunity (demand, red line) t the effective capacity f the netwrk after an earthquake (blue line), in particular: The nn-supplied demand SNnsupplied, defined as the area between the capacity and the demand curves when the demand curve is abve the capacity curve. The recvery time f the gas distributin netwrk TRecvery, defined as the time needed fr the gas distributin netwrk t recver its full functinality. 52

65 Using t enhance scietal resilience The time needed fr the capacity t be equal r greater than the demand, called resilience time, TResilience. Further, accrding t the different pssible metrics, standardized appraches aimed at mdelling the resilience f nn-nuclear CIs shuld be identified and/r develped. This implies, first a review f the existing appraches in the field f quantitative risk analysis and a classificatin based n, fr example, the use f analytic r simulatin-based appraches fr the quantificatin f the aleatry uncertainties, the inclusin f interdependencies with ther infrastructure systems and the interactin with the cmmunity the CI serves, etc. Fig. 4.2 Resilience metrics defined fr a gas netwrk, frm Bellagamba (2015) Anther imprtant aspect fr the develpment f a resilience-based stress test cncept is represented by the definitin f acceptance resilience-based criteria t be identified in the Phase 1 f the wrkflw. The key questin t be answered is: When and hw d the CI systems need t be restred befre adversely affecting the different stakehlders, (e.g. cmmunity, the infrastructure peratr)? Understanding hw cmmunity s needs depend n the functinality f the CIs (nw and in the future) is the key. Business activities need suitable facilities and their supply chains and delivery netwrks; everyne needs a transprtatin netwrk, electricity, water, gas, and cmmunicatin netwrks but, in the aftermath f a disastrus event, sme f these services (e.g. water) are mre needed than thers. A first attempt tward this directin is represented by the reprt published in April 2015 by the Natinal Institute f Standards and Technlgy (NIST, 2015): Cmmunity Resilience Planning Guide fr Buildings and Infrastructure Systems. The Guide prvides a methdlgy fr a lcal gvernment, as the lgical cnvener, t bring tgether the relevant stakehlders and incrprate resilience int the lng-term cmmunity develpment planning prcesses. In particular, it identifies the ways scial rganizatins depend n buildings and infrastructure systems t help supprt cmmunity recvery by establishing recvery sequencing and the degree f functinality needed in the built envirnment at different pints in time after a hazardus event. The guide als prvides examples f resilience gals that cmmunities might set fr their scial institutins. 53

66 Using t enhance scietal resilience Further examinatin f extending the stress test cncept t scietal resilience is presented in STREST Deliverable 4.5 (Stjadinvic and Espsit 2016). Hwever, develping a CI resilience-targeted stress test is, as f tday, beynd the state f the art. Fremst, there is a need t develp a harmnized definitin f scietal resilience applicable t a CI-cmmunity system. Secnd, a set f scietal resilience targets need t be established and transfrmed int acceptance criteria fr the CI systems and their elements. Third, a transparent methd fr mdeling and evaluating the CI resilience needs t be established. Only then culd a stress tests targeting the resilience f a CI system be cnstructed. The ST@STREST methdlgy and framewrk that targets CI vulnerability, develped in this prject, can be used as the prttype fr such CI resiliencetargeted stress test. 54

67 Cnclusins and recmmendatins 5. Cnclusins and recmmendatins In the cntext f the STREST prject, a harmnized apprach fr stress testing critical nn-nuclear infrastructures, ST@STREST, has been develped. The aims f the ST@STREST methdlgy and framewrk are t quantify the safety and the risk f individual cmpnents as well as f whle CI system with respect t extreme events and t cmpare the expected behavir f the CI t acceptable values. In particular, a multi-level stress test methdlgy has been prpsed. Each level is characterized by a different scpe (cmpnent r system) and by a different level f risk analysis cmplexity (starting frm design cdes and ending with state-f-the-art prbabilistic risk analyses, such as cascade mdelling). This allws flexibility and applicatin t a brad range f infrastructures The framewrk is cmpsed f fur main phases and nine steps. The gals, the methd, the time frame, and the ttal csts f the stress test are defined in the Pre-Assessment Phase. In the Assessment Phase, the stress test is perfrmed at cmpnent level and system level. The utcmes f the stress test are checked and analyzed in the Decisin Phase. Finally, the results are reprted and cmmunicated t stakehlders and authrities (Reprt Phase). The ST@STREST data framewrk, used t stre and manage the data abut the CI under test, is als flexible, in that it allws the use f data structures that supprt frequentist (event and fault trees, bw ties) and belief-based ntins f prbability. Further, in rder t allw transparency f the stress test prcess, the data, mdels, methds adpted fr the risk assessment and the assciated uncertainty are clearly dcumented and managed by different experts invlved in the stress test prcess. This allws t define hw reliable the results f the stress test are. In particular, a penalty system has been prpsed t acknwledge the limitatin f the methds and mdels used t assess the perfrmance f the CI and eventually penalize the utput f the risk assessment. In particular, the prpsed system penalizes the results f the hazard and risk assessment f the cnducted stress test by evaluating an extra uncertainty, here named penalty uncertainty, t amplify the uncertainties intrduced by simplistic appraches that cannt guarantee a sufficiently accurate analysis. The utcme f the stress test is defined using a grading system based n the cmparisn f the results f risk assessment with the risk bjectives (i.e. acceptance criteria) defined at the beginning f the test. The prpsed system is cmpsed f three different utcmes: Pass, Partly Pass, and Fail. The CI passes the stress test if it attains grade AA r A. The frmer grade crrespnds t negligible risk whereas the latter grade crrespnds t risk being as lw as reasnably practicable. The CI partly passes the stress test if it receives grade B, which crrespnds t the existence f pssibly unjustifiable risk. Finally, the CI fails the stress test if it is given grade C, which crrespnds t the existence f intlerable risk. Guidelines fr the grading f individual cmpnents are als prpsed tgether with a generalizatin f the grading system t take int accunt epistemic uncertainties and system analysis. The stress test apprach prpsed in this prject addresses the vulnerabilities f CIs t catastrphic by rare (high-cnsequence lw-prbability) natural hazard events. An extensin f the prpsed ST@STREST methdlgy and framewrk t integrate the results f stress tests and the data retrieved after disastrus events with the data cllected during every-day peratin f the system and its degradatin (lw-cnsequence persistent events) int a unified life-cycle management strategy fr CIs has been prpsed. In particular, the results f the risk analysis cnducted in the scpe f a stress test in terms f system perfrmance and expected csts f natural events, may be incrprated in a life-cycle cst analysis f the CI system and ptimizatin f its peratins and maintenance. Further, the evaluatin f risk reductin strategies resulting frm a lss disaggregatin may make it pssible t imprve the full management and maintenance plan f the CI itself. Mrever, the evaluatin f the state f civil infrastructures after the ccurrence f a natural event, and the cllectin and prcessing f pst-event data, such as typlgy, lcatin, cmpnent s features and the assessed physical damages, can be 55

68 Cnclusins and recmmendatins useful t update the state cnditin histry f the inspected cmpnents f the CI and t estimate and/r update perfrmance predictin mdels used in a future risk analysis. An extensin f the ST@STREST methdlgy and framewrk t evaluate nt nly the vulnerability but als the resilience f CIs, i.e. the ability t prepare and plan fr, absrb, recver frm and mre successfully adapt t adverse events (The Natinal Academy 2012) has als been prpsed. This extensin builds n the ST@STREST methdlgy by mdelling the pst-disaster recvery prcess f a CI system and by quantifying the lack f resilience and the attributes f a resilient system using a nvel cmpsitinal supply/demand CI resilience quantificatin framewrk. This extensin enables a new rle f a stress test, that f examining the ability f a cmmunity and its CIs t bunce back after a natural disaster. Hwever, there are sme pints f the prpsed ST@STREST methdlgy and framewrk that need t be discussed and further develped as a part f the future studies. The stress test has been classified in three (macr) cnceptual framewrks fr the safety f nn-nuclear CIs. The selectin f the apprpriate ST-L and sub-levels, made by the PM during the Pre-Assessment phase, depends n regulatry requirements that shuld accunt fr the imprtance/criticality f the type CI. CIs are cmplex and diverse in nature. It is imprtant t rank them, if the number f CIs being cnsidered is greater than ne fr perfrming the stress test. The ranking f CIs is a challenging task due t their diverse nature, the ptential cnsequence f failure, the types f hazards psing threat t them, vulnerability state etc. A criticality assessment f the CIs, aimed at identifying and ranking CIs (fr example at a natinal scale), may represent a practical tl t supprt the chice f the apprpriate ST-level. The prpsed penalty system requires level f detail and sphisticatin t be prperly set by experts cnsensus. Experts must have a clear idea abut mdels and methds available in the scientific literature and their applicability t perfrm each step f the risk analysis. This may nt be feasible fr all perils that have t be cnsidered fr the stress test. Secndly, the cmputatin f the penalty uncertainty des nt take int accunt the cmplexity f the apprach adpted fr the multi-risk analysis. This is because the current level f knwledge des nt allw ranking these appraches, even thugh different multirisk methds have been prpsed recently. T establish a cmmn grading system, the risk bjectives f the risk measures acrss a range f interests shuld be harmnized n the Eurpean level. This is a task fr regulatry bdies and fr industry assciatin: they shuld recncile the scietal and industry interest and develp mutually acceptable risk limits. Further, it is yet t be determined hw grades f single cmpnents shuld affect the glbal utcme f stress test. Mrever, in case epistemic uncertainty analysis is f cncern, it is currently recmmended that the mean value f the designated risk measure is used. Hwever, ther ptins such as a grade based n ther quantiles f the risk measure distributin shuld be investigated. Finally, develping a CI resilience-targeted stress test is, as f tday, beynd the state f the art. The ST@STREST methdlgy and framewrk that targets CI vulnerability, develped in this prject, can be used as the prttype fr such CI resilience-targeted stress test nce CI and scietal resilience is defined in a harmnized way, acceptable levels f resilience agreed n, and ways t transparently and cnsistently evaluate CI resilience develped and accepted in practice. 56

69 References References 1. TNA (2012). Disaster Resilience: A Natinal Imperative, The Natinal Academies, Washingtn D.C. ( DOI / Pitilakis K, Argyrudis S, Ftpulu S, Karafagka S, Espsit S, Stjadinvic B, Giardini D, Dlšek M, Babič A, Selva J, Iqbal S, Vlpe M, Tnini R, Rman F, Brizuela B, Piatanesi A, Basili R, Lrit S, Salzan E, Basc A, Crwley H, Rdrigues D, Mats JP, Schleiss AJ, Curage W, Reinders J, Akkar S, Uckan E, Erdik M (2016). Reference Reprt 5: Guidelines fr stress-test design fr nn-nuclear critical infrastructures and systems: Applicatins. STREST prject: Harmnized apprach t stress tests fr critical infrastructures against natural hazards 3. Crnell C, Krawinkler H (2000). Prgress and challenges in seismic perfrmance assessment. PEER Center News, 3 (2) 4. Mignan A, Wiemer S, Giardini D (2014). The quantificatin f lw-prbability highcnsequences events: part I. A generic multi-risk apprach, Nat. Hazards, 73, , di: /s Mignan A, Kmendantva N, Sclbig A, Fleming K (2016a). Multi-Risk Assessment and Gvernance, Handbk f Disaster Risk Reductin and Management, Wrld Sci. Press & Imperial Cllege Press, Lndn, chapter 16, in press 6. Selva J, Iqbal S, Tarni M, Marzcchi W, Cttn F, Curage W, Abspel-Bukman L, Miraglia S, Mignan A, Pitilakis K, Argyrudis S, Kakderi K, Pitilakis D, Tsinidis G, Smerzini C (2015). Deliverable D3.1: Reprt n the effects f epistemic uncertainties n the definitin f LP-HC events. STREST prject: Harmnized apprach t stress tests fr critical infrastructures against natural hazards 7. Selva J, Iqbal S, Cttn F, Giardini D, Espsit S, Stjadinvic B, Argyrudis S, Pitilakis K, Mignan A. The Epistemic Uncertainty Prcess (EU-P): management f critical chices and uncertainty in single and multi hazard/risk assessments based n multiple experts, in prep. 8. SSHAC (1997). Recmmendatins fr prbabilistic seismic hazard analysis: guidance n uncertainty and use f experts (N. U.S. Nuclear Regulatry Cmmissin Reprt, NUREG/CR-6372), U.S. Nuclear Regulatry Cmmissin Reprt, NUREG/CR Washingtn, D.C. 9. Espsit S, Stjadinvic B, Mignan A, Dlšek M, Babič A, Selva J, Iqbal S, Cttn F, Iervlin I (2016). Deliverable D5.1: Reprt n the prpsed engineering risk assessment methdlgy fr stress tests f nn-nuclear CIs. STREST prject: Harmnized apprach t stress tests fr critical infrastructures against natural hazards 10. CEN (2005a). Eurpean Standard EN : 2005 Eurcde 8: Design f structures fr earthquake resistance. Part 1: General rules, seismic actins and rules fr buildings, Brussels, Belgium. 11. CEN (2005b). Eurpean Standard EN : 2005 Eurcde 8: Design f structures fr earthquake resistance. Part 3: Assessment and retrfitting f buildings, Brussels, Belgium. 12. Babič A, Dlšek M (2016). Seismic fragility functins f industrial precast building classes. Engineering Structures, 118: Baker JW (2015). Efficient analytical fragility functin fitting using dynamic structural analysis. Earthquake Spectra, 31:

70 References 14. Dlšek M, Fajfar P (2008). The effect f masnry infills n the seismic respnse f a fur strey reinfrced cncrete frame-a prbabilistic assessment. Engineering Structures. 30 (11): Faber MH, Stewart MG (2003). Risk assessment fr civil engineering facilities: critical verview and discussin. Reliability Engineering & System Safety. 80: Bedfrd T, Cke R (2001). Prbabilistic Risk Analysis. 1st ed. Cambridge: Cambridge University Press, Cambridge Bks. 17. Espsit S, Iervlin I, d Onfri A, Sant A, Franchin P, Cavalieri F (2015). Simulatin-based seismic risk assessment f a gas distributin netwrk. Cmputer- Aided Civil and Infrastructure Engineering DOI: /mice Cavalieri F, Franchin P, Buritica Crtes JAM, Tesfamariam S (2014). Mdels fr seismic vulnerability analysis f pwer netwrks: cmparative assessment, Cmputer-Aided Civil and Infrastructure Engineering. 29(8): Argyrudis S, Selva J, Gehl P, Pitilakis K (2015). Systemic Seismic Risk Assessment f Rad Netwrks Cnsidering Interactins with the Built Envirnment. Cmputer- Aided Civil and Infrastructure Engineering 30 (7): Espsit S, Btta A, De Falc M, Iervlin I, Pescape A, Sant A. Seismic Risk Analysis f a Reginal Telecmmunicatin Netwrk, in prep. 21. Salzan E, Basc A, Karafagka S, Ftpulu S, Pitilakis K, Anastasiadis A, Mats JP, Schleiss AJ (2015). Deliverable D4.1: Guidelines fr perfrmance and cnsequences assessment f single-site, high-risk, nn-nuclear critical infrastructures expsed t multiple natural hazards. STREST prject: Harmnized apprach t stress tests fr critical infrastructures against natural hazards 22. Kakderi K, Ftpulu S, Argyrudis S, Karafagka S, Pitilakis K, Anastasiadis A, Smerzini C, Selva J, Giannpuls G, Galbusera L, Curage W, Reinders J, Cheng Y, Akkar S, Erdik M, Uckan E (2015). Deliverable D4.2: Guidelines fr perfrmance and cnsequences assessment f gegraphically distributed, nn-nuclear critical infrastructures expsed t multiple natural hazards. STREST prject: Harmnized apprach t stress tests fr critical infrastructures against natural hazards 23. Crwley H, Castt C, Dlšek M, and Babič A (2015). Deliverable D4.3: Guidelines fr perfrmance and cnsequences assessment f multiple-site, lw-risk, highimpact, nnnuclear critical infrastructures (expsed t multiple natural hazards, etc.). STREST prject: Harmnized apprach t stress tests fr critical infrastructures against natural hazards 24. Bmmer JJ, Scherbaum F (2008). The use and misuse f lgic-trees in prbabilistic seismic hazard analysis. Earthquake Spectra 96: Marzcchi W, Tarni M, Selva J (2015). Accunting fr Epistemic Uncertainty in PSHA: Lgic Tree and Ensemble Mdeling. Bulletin f the Seismlgical Sciety f America, 105 (4), di: / Liu Z, Nadim F, Garcia-Aristizabal A, Mignan A, Fleming K, Luna BQ (2015). A threelevel framewrk fr multi-risk assessment, Gerisk: Assessment and Management f Risk fr Engineered Systems and Gehazards, 9, 59-74, di: / Marzcchi W, Garcia-Aristizabal A, Gasparini P, Mastellne ML, Di Rucc A (2012). Basic principles f multi-risk assessment: a case study in Italy, Nat. Haz., 62, , di: /s x 28. Selva J (2013). Lng-term multi-risk assessment: statistical treatment f interactin amng risks, Nat. Hazards, di: /s Iervlin I (2016). Sil-invariant seismic hazard and disaggregatin. Bulletin f the Seismlgical Sciety f America. DOI: / (in press). 58

71 References 30. Mignan A, Danciu L, Mats JP, Schleiss A (2015). Deliverable D3.5: Reprt n cascading events and multi-hazard prbabilistic scenaris. STREST prject: Harmnized apprach t stress tests fr critical infrastructures against natural hazards. 31. Mats JP, Mignan A, Schleiss AJ (2015). Vulnerability f large dams cnsidering hazard interactins: cnceptual applicatin f the Generic Multi-Risk framewrk. In: 13 th ICOLD Internatinal Benchmark Wrkshp n Numerical Analysis f Dams. Lausanne, Switzerland, Mignan A, Sclbig A, Saurn A (2016b). Using reasned imaginatin t learn abut cascading hazards: a pilt study, Disaster Preventin and Management, 25 (3), , di: /DPM USNRC (2012). Prbabilistic Risk Analysis. Retrieved frm Vesely WE, Gldberg FF, Rberts NH, Haasl DF (1981). Fault tree handbk (NUREG- 0492). United States Nuclear Regulatry Cmmissin, Washingtn, DC. 35. De Dianus V, Fiévez C (2006). ARAMIS prject: A mre explicit demnstratin f risk cntrl thrugh the use f bw tie diagrams and the evaluatin f safety barrier perfrmance, Jurnal f Hazardus Materials, Vlume 130, Issue 3, 31 March 2006, Pages Bensi M (2010). A Bayesian Netwrk methdlgy fr infrastructure seismic risk assessment and decisin supprt. PhD Dissertatin, University f Califrnia, Berkeley. 37. Pascale A, Nicli M (2011). Adaptive Bayesian netwrk fr traffic flw predictin IEEE Statistical Signal Prcessing Wrkshp (SSP), Nice, pp Mirmeini F, Krishnamurthy V (2005). Recnfigurable Bayesian Netwrks fr Hierarchical Multi-Stage Situatin Assessment in Battlespace, Cnference Recrd f the Thirty-Ninth Asilmar Cnference n Signals, Systems and Cmputers, Pacific Grve, CA, 2005, pp Espsit S, Stjadinvic B (2016a). Deliverable 5.2 Reprt n the prpsed Bayesian netwrk framewrk fr cnducting stress tests f nn-nuclear critical infrastructures. STREST prject: Harmnized apprach t stress tests fr critical infrastructures against natural hazards. 40. Niel M, Fentn N, Nielsn L (2000). Building large-scale Bayesian netwrks. The Knwledge Engineering Review, 15: Park HS, Ch SB (2012). A mdular design f Bayesian netwrks using expert knwledge: Cntext-aware hme service rbt, Expert Systems with Applicatins, Vlume 39, Issue 3, 15 February, Pages Nishijima K, Faber M (2007). A Bayesian framewrk fr typhn risk management. Prceedings f 12th Internatinal Cnference n Wind Engineering (12ICWE), Cairns, Australia. 43. Smith M (2006). Dam Risk Analysis Using Bayesian Netwrks. Prceedings f 2006 ECI Cnference f GeHazards, Lillehammer, Nrway. 44. Grêt-Regamey A, Straub D (2006). Spatially explicit avalanche risk assessment linking Bayesian netwrks t a GIS. Natural Hazards and Earth System Sciences, 6: Bayraktarli YY, Ulfkjaer J, Yazgan U, Faber M (2005). On the applicatin f Bayesian prbabilistic netwrks fr earthquake risk management. Prceedings f the 9 th Internatinal Cnference n Structural Safety and Reliability, Rme, Italy. 59

72 References 46. Bayraktarli YY, Yazgan U, Dazi A, M Faber (2006). Capabilities f the Bayesian prbabilistic netwrks apprach fr earthquake risk management. Prceedings f First Eurpean Cnference n Earthquake Engineering and Seismlgy, Geneva, Switzerland. 47. Tasfamariam S, Liu Z (2014). Chapter 7: Seismic risk analysis using Bayesian belief netwrks. Handbk f Seismic Risk Analysis and Management f Civil Infrastructure Systems. Wdhead Publishing Series in Civil and Structural Engineering. Pages Blaser L, Ohrnberger M, Riggelsen C, Scherbaum F (2009). Bayesian Belief Netwrk fr Tsunami Warning Decisin Supprt. Lecture Ntes In Artificial Intelligence; Prceedings f the 10th Eurpean Cnference n Symblic and Quantitative Appraches t Reasning with Uncertainty, Springer-Verlag Berlin Heidelberg, Verna, Italy, Bayraktarli YY, Baker J, Faber M (2011). Uncertainty treatment in earthquake mdelling using Bayesian prbabilistic netwrks. Gerisk. 5(1): Brgli S (2011). Bayesian Netwrk framewrk fr macr-scale seismic risk assessment and decisin supprt fr bridges. PhD Dissertatin, ROSE Prgramme, UME Schl, IUSS Pavia. 51. Grauvgl B., and A. Steentft Seismic Resilience f Cmmunities during the 2015 Nepal earthquake events. Master Thesis, IBK, ETH Zurich. 52. Didier M, Grauvgl B, Steentft A, Brccard M, Ghsh S, Stjadinvic B (2017). Assessment f pst-disaster cmmunity infrastructure services demand using Bayesian netwrks. 16th Wrld Cnference n Earthquake Engineering, January 9th t 13th 2017, Chile. 53. Stjadinvic B, Espsit S (2016). Deliverable 4.5 Develpment f a cherent definitin f scietal resilience and its attributes. STREST prject: Harmnized apprach t stress tests fr critical infrastructures against natural hazards. 54. Friis-Hansen P (2004). Structuring f cmplex systems using Bayesian Netwrks. Prceedings f Tw Part Wrkshp at DTU, O. Ditlevsen and P. Friis-Hansen, eds., Technical University f Denmark 55. Helm, P (1996). Integrated Risk Management fr Natural and Technlgical Disasters. Tephra. 15(1): Jnkman SN, Van Gelder PHAJM, Vrijling JK (2003). An verview f quantitative risk measures fr lss f life and ecnmic damage. Jurnal f Hazardus Materials 99(1): CEN (2004). Eurpean Standard EN 1990: 2004 Eurcde: Basis f structural design, Brussels, Belgium. 58. Luc N, Ellingwd BR, Hamburger RO, Hper JD, Kimball JK, Kircher CA (2007). Risk-targeted versus current seismic design maps fr the cnterminus United States. Structural Engineers Assciatin f Califrnia 76th Annual Cnventin, Lake Tahe, Califrnia. 59. Frangpl DM, Sliman M (2016). Life-cycle f structural systems: recent achievements and future directins. Structure and Infrastructure Engineering. 12:1: Espsit S, Stjadinvic B (2016b). Deliverable 5.3 Tls and strategies t incrprate stress tests int the lng-term planning and life cycle management f nn-nuclear CIs. STREST prject: Harmnized apprach t stress tests fr critical infrastructures against natural hazards. 60

73 References 61. Furuta H, Frangpl, DM, Nakatsu K (2011). Life-cycle cst f civil infrastructure with emphasis n balancing structural perfrmance and seismic risk f rad netwrk. Structure and Infrastructure Engineering. 7: Chang SE, Shinzuka M (1996). Life-cycle cst analysis with natural hazard risk. Jurnal f Infrastructure Systems, 23: Basz NI, Kiremidjian AS, King SA, Law KH (1999). Statistical analysis f bridge damage data frm the 1994 Nrthridge, CA, earthquake. Earthquake Spectra 15(1): Shinzuka M, Feng MQ, Lee J, Naganuma T (2000). Statistical analysis f fragility curves. Jurnal f Engineering Mechanics. 126(12): O Rurke MJ, S P (2000). Seismic fragility curves fr n-grade steel tanks. Earthquake Spectra. 16(4): Straub D, Der Kiureghian A (2008). Imprved seismic fragility mdeling frm empirical data. Structural Safety. 30 (4): American Lifelines Alliance (2001). Seismic fragility frmulatins fr water systems. Part 2 Appendices, ASCE-FEMA 68. Espsit S, Stjadinvic B (2016c). Deliverable 5.4. Reprt n strategies fr stress test implementatin at cmmunity level and strategies t enhance scietal resilience using stress tests. STREST prject: Harmnized apprach t stress tests fr critical infrastructures against natural hazards. 69. Natinal Infrastructure Advisry Cuncil (NIAC) (2009). Critical Infrastructure Resilience. Final Reprt and Recmmendatins. U.S. Department f Hmeland Security. 70. Bruneau M, Chang SE, Eguchi RT, Lee GC, O Rurke TD, Reinhrn AM, Shinzuka M, Tierney K, Wallace WA, vn Winterfeldt D (2003). A framewrk t quantitatively assess and enhance the seismic resilience f cmmunities. Earthquake Spectra 19: Chang SE, Shinzuka M (2004). Measuring Imprvements in the Disaster Resilience f Cmmunities. Earthquake Spectra. 20: Franchin P, Cavalieri F ( Prbabilistic assessment f civil infrastructure resilience t earthquakes. Cmputer Aided Civil And Infrastructure Engineering. DOI: /mice Bcchini P, Frangpl DM, Ummenhfer T, Zinke T (2014). Resilience and sustainability f civil infrastructure: Tward a unified apprach. Jurnal f Infrastructure System. 20 (2). 74. Francis R, Bekera B (2014). A metric and framewrks fr resilience analysis f engineered and infrastructure systems. Reliability Engineering and System Safety. 121: Brccard M, Galanis P, Espsit S, Stjadinvić B (2015). Resilience-based risk assessment f civil systems using the PEER framewrk fr seismic hazard. Eurpean Safety and Reliability Cnference ESREL 2015, Zurich, Switzerland September. 76. Iervlin I, Girgi M (2015). Stchastic Mdeling f Recvery frm Seismic Shcks. 12th Internatinal Cnference n Applicatins f Statistics and Prbability in Civil Engineering, ICASP12 Vancuver, Canada, July Sun L, Didier M, Déle E, Stjadinvic B (2015a). Prbabilistic Demand and Supply Resilience Mdel fr Electric Pwer Supply System under Seismic Hazard, ICASP12, Prceedings f the 12th Internatinal Cnference n Applicatins f Statistics and Prbability in Civil Engineering, paper 267, July, Vancuver, Canada. 61

74 References 78. Sun L, Didier M, Delé E, Stjadinvic B (2015b). Prbabilistic Demand and Supply Resilience Mdel fr Electric Pwer Supply System under Seismic Hazard. Eurpean Safety and Reliability Cnference ESREL, Zurich, Switzerland September. 79. Hsseini S, Barker K, Ramirez-Marquez JE (2016). A review f definitins and measures f system resilience. Reliability Engineering and System Safety. 145: Henry D, Ramirez-Marquez JE (2012). Generic metrics and quantitative appraches fr system resilience as a functin f time. Reliability Engineering and System Safety, 99: Ouyang M, Duenas-Osari L (2012). A three stage resilience analysis framewrk fr urban infrastructure systems. Structural Safety. 36: Mieler M, Stjadinvic B, Budnitz R, Cmeri M, Mahin S (2015). A Framewrk fr Linking Cmmunity-Resilience Gals t Specific Perfrmance Targets fr the Built Envirnment, Earthquake Spectra, 31 (3): Didier M, Sun L, Ghsh S, Stjadinvic B (2015). Pst-Earthquake Recvery f a Cmmunity and its Pwer Supply System, CmpDyn 2015, Prceedings f the 5th ECCOMAS Thematic Cnference n Cmputatinal Methds in Structural Dynamics and Earthquake Engineering, M. Papadrakakis, V. Papadpuls and V. Plevris, editrs, Paper #C869, Crete Island, Greece, May Didier M, Brccard M, Espsit S, Stjadinvić B. A cmpsitinal demand/supply framewrk t quantify the resilience f civil infrastructure systems. In prep. 85. Bellagamba X (2015). Seismic Resilience f a Gas Distributin Netwrk. Master Thesis, ETH Zurich Advisr: Prf. B. Stjadinvić. 86. Natinal Institute f Standards and Technlgy (NIST) (2015). Cmmunity Resilience Planning Guide 3 fr Buildings and Infrastructure 4 Systems. NIST Special Publicatin

75 List f abbreviatins and definitins ALARP BN CIs CL cee EL ET EU As Lw As Reasnably Practicable Bayesian netwrk Critical Infrastructures Cnnectivity Lss classical Expert Elicitatin Effective Level Evaluatin Team Epistemic Uncertainty EU@STREST Epistemic Uncertainty at STREST GenMR IM IR PBEE PF LCM LCC PEER PIs PM PE PRA PSHA QRA SBRA SHARE ST ST-L STREST Generic Multi-Risk Intensity Measure Internal Reviewer Perfrmance-Based Earthquake Engineering Penalty Factr Life-Cycle Management Life Cycle Cst Pacific Earthquake Engineering Research Perfrmance Indicatrs Prject Manager Pl f Experts Prbabilistic Risk Analysis Prbabilistic Seismic Hazard Analysis Quantitative Risk Analysis Scenari-Based Risk Analysis Seismic Hazard Harmnizatin in Eurpe Stress Test Stress Test Level harmnized apprach t stress tests fr critical infrastructures against natural hazards ST@STREST Stress Test at STREST TI TL Technical Integratr Target Level 63

76

77 List f figures Fig. 2.1 Wrkflw f ST@STREST methdlgy... 4 Fig. 2.2 The basic interactins amng the cre actrs in the prcess f EU@STREST... 6 Fig. 2.3 Interactin amng the main actrs during the multiple-expert prcess EU@STREST. The PE is present nly in ST sub-levels c and d. Fr sub-levels a and b, the rle f the PE is assumed directly by the TI... 7 Fig. 2.4 ST-Levels in the ST@STREST methdlgy Fig. 2.5 Plan view f the case study building frm ST-L1 assessment Fig. 2.6 a) Fragility functin f the building and b) seismic hazard n the lcatin f the building.. 16 Fig. 2.7 BN framewrk fr seismic risk management (surce: Bayraktarli et al, 2005) 23 Fig. 2.8 Bayesian netwrk methdlgy fr seismic infrastructure risk assessment and decisin supprt prpsed by Bensi (2010) Fig. 2.9 BN mdel prpsed by Didier et al (2017) Fig An example f grading system fr the utcme f stress test. The CI may pass, partly pass, r fail the stress test Fig Grading system in time dmain using scalar risk bjectives (tp) and limit F-N curves (bttm): a) tw different results f the first evaluatin f stress test (ST1), b) redefinitin f the parameters f the grading system due t Result 1 in ST1, and c) redefinitin f the parameters f the grading system due t Result 2 in ST Fig Grading f cmpnents f the system (ST-L1) Fig Distributin f a risk measure with bundaries f grades in the case f a) a scalar risk measure and b) an F-N curve Fig Annual exceedance curves f penalized lss cnsidering different penalty factr values Fig. 3.1 Life-Cycle Cst framewrk including natural hazard risks adapted frm Chang and Shinzuka (1996) Fig. 3.2 Prpsed framewrk fr assimilating stress test and pst-event data in a ttal life cycle cst analysis Fig. 3.3 Annual rate f exceedance f CL cnsidering mitigatin strategies applied t the statins (MS1 and MS2) and t buried pipelines (MS3) Fig. 3.4 Cmparisn f existing and updated fragility curves fr L Aquila gas steel pipes Fig. 4.1 Representatin f the netwrk supply, demand and cnsumptin curves after a natural disaster event (STREST Deliverable 4.5 (Stjadinvic and Espsit 2016)) Fig. 4.2 Resilience metrics defined fr a gas netwrk, frm Bellagamba (2015)

78

79 List f tables Table 2.1 Main aspects characterizing the Cmpnent Level Assessment (STL-1a) Table 2.2 Verificatin f beam-t-clumn cnnectins Table 2.3 Main aspects characterizing the System Level Assessment, STL-2a Table 2.4 Main aspects characterizing the System Level Assessment, ST-L2b Table 2.5 Main aspects characterizing the System Level Assessment, ST-L2c Table 2.6 Main aspects characterizing the System Level Assessment, ST-L3c Table 2.7 Main aspects characterizing the cmplementary scenari-based assessment 21 Table 2.8 Target Levels fr each ST-Level

80

81 Eurpe Direct is a service t help yu find answers t yur questins abut the Eurpean Unin. Freephne number (*): (*) The infrmatin given is free, as are mst calls (thugh sme peratrs, phne bxes r htels may charge yu). Mre infrmatin n the Eurpean Unin is available n the internet ( HOW TO OBTAIN EU PUBLICATIONS Free publicatins: ne cpy: via EU Bkshp ( mre than ne cpy r psters/maps: frm the Eurpean Unin s representatins ( frm the delegatins in nn-eu cuntries ( by cntacting the Eurpe Direct service ( r calling (freephne number frm anywhere in the EU) (*). (*) The infrmatin given is free, as are mst calls (thugh sme peratrs, phne bxes r htels may charge yu). Priced publicatins: via EU Bkshp (

82 LB-NA EN-N di: / ISBN