Structural Safety 31 (2009) 245–250

Contents lists available at ScienceDirect

Structural Safety
journal homepage: www.elsevier.com/locate/strusafe

Another look at risk and structural reliability criteria

V.M. Trbojevic
Risk Support Ltd., London, UK

a r t i c l e i n f o a b s t r a c t

Available online 20 November 2008 The paper presents a comparison of societal risk criteria and the several structural reliability criteria for
two assumed profiles of consequence severity. Starting from the societal risk (FN) criteria (risk neutral)
Keywords: used in the UK and the Dutch criteria (risk averse), the consistent set of criteria is developed based on the
Risk criteria maximum average individual risk and the number of people exposed (in a building) and compared
Structural reliability criteria against three major structural reliability codes. The findings indicate that there is incompatibility
Major hazards between the safety risk criteria and structural reliability criteria regarding risk aversion, that safety level
Safety
provided by load bearing structures may be intolerable in comparison with the societal risk criteria as
Societal risk
F-N criteria
used informally for assessing risk to the general public in the vicinity of major hazards installation.
Ó 2008 Published by Elsevier Ltd.

1. Introduction It is obvious that in the hazardous industries all facilities must

Safety regulation in the hazardous industries focuses on control
of risk to population or the general public. In this context term
‘‘risk” means risk of fatalities, however there are surrogate mea-
sures of risk taking into account severe distress, need for prolonged
medical treatment, injury and death. To facilitate regulation of
safety, risk criteria have been introduced which translate risk
estimates as produced by a risk analysis into value judgments.
For example, an estimate of individual risk per annum of 107
can be considered as ‘‘negligible risk”; similarly, an estimate of
injuries occurring several times per year, can be considered as
‘‘unacceptable”.
In general there are two types of risk criteria:
1. Individual risk criteria which are legally in use, for example in
the Netherlands and UK, and
2. Societal risk criteria expressed as intolerable frequency of
exceedance of a specified number of fatalities, and which are
used in a non-prescriptive mode.
The purpose of structural reliability criteria or codes of practice
is to ensure that structures and structural elements are designed,
constructed and maintained in such a way that they are suited
for their use during the design working life in an economic way
[11]. Moreover, the structures are required to satisfy requirements
such as serviceability limit state (to remain fit for service), the ulti-
mate limit state (to withstand extreme actions during their use),
and be robust (they shall not be damaged by accidental events like
fire, explosion, and impact).
E-mail address: vmt@risk-support.co.uk
be designed to similar reliability, structural and process integrity
criteria, but that there is also an additional requirement in the form
of risk acceptability criteria.
The aim of this paper is to explore the level of safety that these
different criteria offer expressed in terms of fatalities.
2. Risk criteria
Societal risk (SR) is the term used to describe the chances that
major accidents could result in harm to a significant number of
people (SR is the relationship between the frequency and the num-
ber of people suffering from a specified level of harm in a given
population from the realisation of specified hazards [10]). The most
widely used form of the societal risk criteria is based on the annual
frequency F of N or more fatalities. A description of the societal risk
criteria in the UK and the Netherlands is of interest because these
two countries are in the forefront of the application and use of
quantitative risk analysis and risk criteria.
The interpretation of the risk criteria in the UK is looser than in
the Netherlands, i.e. the upper tolerability limit is not used in the
UK as the instrument of precise control of risk, but it is relied on
ALARP (as low as reasonably practicable) dynamics to bring down
the risk [5]. In other words, the duty holders (company, responsible
party, etc.) have to ensure that risks to their employees, contractors
and general public are as low as reasonably practicable (ALARP).
In the Netherlands, the risk has to be below the upper tolerabil-
ity limit and further risk reduction is not enforced. Consequently,
the upper tolerability limit for individual risk to a member of the
general public (or people living near by) from a hazardous installa-
tion in the UK is set to 104 per year but the risks have also to be
ALARP, while in the Netherlands it is currently 105 per year and
from 2010 it will be 106 per year, but the ALARP is not strictly

0167-4730/$ - see front matter Ó 2008 Published by Elsevier Ltd.

doi:10.1016/j.strusafe.2008.06.019
246 V.M. Trbojevic / Structural Safety 31 (2009) 245–250

enforced. Therefore the two criteria are most likely delivering the 2.3. Linking societal criteria to individual risk criteria
similar safety levels, i.e. the individual risk limit of 104 per year
with the enforcement of ALARP is more likely to push the risk to The development of a societal risk criterion completely consis-
near 105 level. tent with the individual risk was first proposed by [14]. This ap-
proach is based on a simple formula for the group risk or the
2.1. United Kingdom estimated number of fatalities which is as follows:
X
Nmax  IR ¼ f ðNÞ  N b and
The origins of the societal risk criteria in the UK can be traced
back to the late 1970s [6]. In [7] the FN line was anchored at an f ðNÞ ¼ FðNÞ  FðN þ 1Þ
accident causing 100 fatalities with the frequency of 1 in 10,000
where Nmax is the number of people exposed to particular hazards,
per year, and the slope of 1. However, it was also noted that ‘‘a
IR is the maximum tolerable individual risk, Nmax  IR is the maxi-
line of this slope would seem to reflect the least that we judge
mum group risk assuming that all people are exposed to the same
the public might require for larger N; and they might want a stee-
IR, f(N) is the frequency of exactly N fatalities, F(N) is the frequency
per curve”. In [9], the similar criterion was confirmed, but with the
of N or more fatalities, N is the number of fatalities, and b is a risk
anchor point defined by the risk of a single accident causing the
aversion exponent (=1 for no aversion, =2 for the Dutch case).
death of 50 people or more with the frequency of 1 in 5000 per an-
Term ‘‘no aversion” means that one accident in 100 years involving
num can be considered as intolerable. The broadly acceptable level
100 fatalities is as unacceptable as one accident in one year involv-
of risk is suggested as a line three decades lower than the upper
ing one fatality; with the risk aversion of 2, one accident in 100
tolerable line. The term ‘‘broadly acceptable” is used as denoting
years with 10 fatalities would be as unacceptable as one accident
that the risk, though definite, assimilates to the ‘‘background level”
in one year involving one fatality.
of risks we accept as part of daily life [8].
For the maximum individual risk, the maximum number of ex-
posed people and the risk aversion factor, the term F(1) can be
2.2. The Netherlands
evaluated and the FN curve constructed as F(N) = F(1)/Nb. The re-
sults for the derived Nmax for the British (N = 50, F = 2  104,
A first attempt to define the societal risk criteria in the Nether-
b = 1) and Dutch (N = 10, F = 105, b = 2) criteria are given in Ta-
lands dates back to 1976 [1]. The Dutch approach is based on the
ble 1. The criteria specified in [9], correspond to 715 exposed per-
individual risk criterion of 106 per year, which is translated into
sons with the average IR of 104 per annum or 9763 persons with
an anchor point for societal risk of 105 per year for 10 or more
the average IR of 105 per annum. The Dutch criteria correspond to
fatalities. In addition an aversion factor of 2 was applied so that
1644 persons exposed to an individual risk of 106 per year.
a heavier weight is assigned to the larger consequences. The negli-
In addition, the consistent criteria are derived for two individual
gible risk values are defined by a line two decades lower.
risk values of 105 and 106 and for 1000 and 500 exposed persons.
The values in bold in Table 1 represent the derived values.
The criteria corresponding to the parameters in Table 1 are also
Table 1 presented in Fig. 1.
Relationship between IR, F(l), Nmax and b

Criterion IR F(l) Nmax b 3. Structural reliability criteria

UK (R2P2) 1.00E–4 1.00E–2 715 1
UK (R2P2) 1.00E–5 1.00E–2 9763 1
There are several structural reliability criteria in use, for exam-
The Netherlands 1.00E–6 1.00E–3 1644 2 ple, [3,2,4,11,13]. All of these prescribe a target annual failure prob-
Consistent 1.00E–5 1.34E–3 1000 1 ability depending on the type of failure and/or the severity of
Consistent 1.00E–5 7.36E–4 500 1 consequences. Therefore of interest is to explore the level of safety
Consistent 1.00E–6 1.34E–4 1000 1
these codes offer in terms of failure frequency and the severity of
Consistent 1.00E–6 7.36E–5 500 1
consequences expressed in terms of fatalities.

1.E-2
Annual Frequency of N or More Fatalities

1.E-3

1.E-4

1.E-5

UK - R2P2
1.E-6 The Netherlands
Consistent (IR=10-5, N=1,000, β =1)
1.E-7
Consistent (IR=10-5, N=500, β=1)
Consistent (IR=10-6, N=1,000, β=1)
Consistent (IR=10-6, N=500, β=1)
1.E-8
1 10 100
Number of Fatalities N
Fig. 1. Societal risk criteria.
 V.M. Trbojevic / Structural Safety 31 (2009) 245–250 247

3.1. Eurocode 3.4. Associating fatalities to probabilities of failure

The Ref. [4] uses three reliability classes which are related to
types of buildings and consequence categories as shown in Table 2.
3.2. Nordic committee for safety of structures (NKB)
The next comparison is carried out for the Nordic Committee for
Safety Code [12,13]. The NKB’s target annual failure probabilities
for load carrying structures are presented in Table 3.
It can be seen that for each type of failure there are three pairs
of annual frequency and the corresponding consequence severity.
The values in bold are taken for comparison (in Table 5).
3.3. Joint committee on structural safety (JCSS)
The tentative target reliability indices and associated target fail-
ure from [11] rates are presented in Table 4. The values corre-
sponding to in bold (5  104) is taken as anchor point for
comparison (in Table 5).
In order to facilitate a comparison of the structural reliability
criteria which prescribe the probabilities of failure for different
consequence of failure severities, and the safety risk criteria which
specify the relationship between the frequency of a hazardous
event and the corresponding number of fatalities, one needs to
associate severities of structural failure with fatalities. For the pur-
pose of comparison a hypothetical office or residential building is
assumed. Furthermore, it has been assumed that three conse-
quence of failure severities correspond to 100, 10 and 1 fatalities
for the upper level, and to 10, 1 and 0 fatalities for the lower level.
These two levels can be associated for example, with the ‘‘worst”
and the ‘‘best” estimates. The numbers of fatalities are kept fixed
while the building occupancy (number of people in the building)
will vary. The assumed numbers of fatalities and the corresponding
failure probabilities for the three codes are presented in Table 5.
Probabilities of failure in bold denote numbers given in the codes
(other numbers are assumed), for example for Eurocode, the prob-
ability of failure of 106 for office buildings corresponds to 100 (10)

Table 2
Eurocode consequence classes and annual probabilities of failure

Consequence Consequence description Type of building Minimum value for Corresponding annual
class reliability index (annual) probability of failure
CC3 High consequence for loss of human life, or economic, social or Grandstands, public 5.20 107
environmental consequences very great buildings, and concert halls
CC2 Medium consequence for loss of human life, or economic, Residential and office 4.70 106
social or environmental consequences considerable buildings
CC1 Low consequence for loss of human life, or economic, social or Agricultural, storage 4.20 105
environmental consequences small or negligible buildings, and greenhouses

Table 3
NKB’s target annual failure probabilities

Consequences of failure Type of failure

Severity Risk of injury/ Societal Ductile failure with reserve Ductile failure without reserve Brittle failure and stability
fatalities conseqence strength strength failure
Less serious Small Insignificant 103 104 105
Serious Significant Significant 104 105 106
Very serious Large Very large 105 106 107

Table 4
JCSS target reliability indices and associated failure rates

Relative cost of safety measure Minor consequences of failure Moderate consequences of failure Large consequences of failure
Agricultural structures, silos, and Office, apartment, and industrial Hospitals, theaters, high rise buildings, and
masts buildings bridges
Large (A) b = 3.1 (pf = 103) b = 3.3 (pf = 5  104) b = 3.7 (pf = 104)
Moderate (B) b = 3.7 (pf = 104) b = 4.2 (pf = 105) b = 4.4 (pf = 5  106)
Small (C) b = 4.2 (pf = 105) b = 4.4 (pf = 5  106) b = 4.7 (pf = 106)

Table 5
Number of fatalities vs. annual probabilities of failure

Risk of injury/ Assumed number of Eurocode – residential and office NKB – ductile failure without reserve JCSS – office and apartment
fatalities fatalities buildings strength building
Upper level Lower level
Large 100 10 106 106 5  106
Significant 10 1 105 105 5  105
Small 1 0 104 104 5  104
248
1.E-3
Annual Frequency of N or More Fatalities
1.E-4
1.E-5
1.E-6
1.E-7
1.E-8
1 10
fatalities, and the derived value for 10 (1) fatalities is one decade
lower, etc. In case of JCSS, the probability of 5  104 for office
building has been assumed to correspond to the small fatality level,
i.e. 1 (0), 5  105 to 10 (1) fatalities, and 5  106 to 100 (10)
fatalities.
4. Comparison of risk and structural reliability criteria
A graphical comparison corresponding to the values in Table 5
is presented in Fig. 2. The ‘‘consistent” criteria are based on the
average individual risk of 106 per year (same as the Dutch FN cri-
teria), without risk aversion, i.e. b = 1, and with risk aversion factor
b = 2.
The first comparison is carried out for Nmax = 100 (total number
of people in the building). It should be noted that this is highly pes-
simistic case because it corresponds to the probability of fatality
equal to 1 (i.e. no survivals for the catastrophic structural failure).
It can be seen that for the upper level of fatalities (1, 10, 100) both
the Eurocode (EN) and the NKB are above the criterion line, while
for the lower level of fatalities (0, 1, 10) the EN/NKB line is below
the criterion while the JCSS line is crossing it. It should be noted
1.E-3
Annual Frequency of N or More Fatalities
1.E-4
1.E-5
1.E-6
1.E-7
1.E-8
1 10
Fig. 3. Comparison against consistent FN criteria for Nmax = 100, 200 and 500.
V.M. Trbojevic / Structural Safety 31 (2009) 245–250
The Netherlands
Consistent (IR=10-6, N=100, β=1)
Consistent (IR=10-6, N=100, β=2)
EN / NKB Upper
EN / NKB Lower
JCSS Upper
JCSS Lower
100
Number of Fatalities N
Fig. 2. Comparison of three codes and the consistent FN criteria.
that the underlying assumption for the criteria and the fatalities
was that the maximum number of exposed people was 100 and
that the number of fatalities for the worst failure case is equal to
that number. Fatality probability for the three failure probabilities
was 1%, 10% and 100%. In reality 100% fatalities is practically never
the case with catastrophic structural failures.
Therefore, the next set of assumptions is made as follows:
1. The maximum number of people is assumed as 200, which with
the same assumptions for fatalities means that the probability
of fatality now becomes 0.05% (for 1 fatality), 5% (for 10 fatali-
ties) and 50% (for 100 fatalities). The upper tolerable limit of the
criterion also moves up (with the increased number of exposed
persons).
2. The maximum number of exposed people is raised to 500, and
the probability of fatality now becomes 0.2%, 2% and 20%. The
criterion line again moves upwards.
The new results are presented in Fig. 3. Rick aversion has been
removed from the criteria. It can be seen that the structural
reliability criteria are above the FN lines even for an optimistic
Consistent (IR=10-6, N=100, β=1)
Consistent (IR=10-6, N=200, β=1)
Consistent (IR=10-6, N=500, β=1)
EN / NKB Upper Level of Fatalities
JCSS Upper Level of Fatalities
100
Number of Fatalities N

1.E-3
Annual Frequency of N or More Fatalities
1.E-4
1.E-5
1.E-6
1.E-7
1.E-8
1 10
Fig. 4. Comparison against consistent FN criteria for Nmax = 500.
scenario of 20% fatalities in a catastrophic structural failure event.
The structural reliability criteria are not sensitive to the ‘‘amount”
of damage, in this case the number of fatalities, just to the damage
severity.
In order to get a clearer view, the results for the occupancy of
500, for the two levels of fatalities (upper: 100, 10 and 1, and low-
er: 10, 1 and 0) are presented in Fig. 4.
It can be seen from Fig. 4 that both EN/NKB and JCSS with the
upper level of fatalities exceed the upper tolerable criterion, while
JCSS with the lower level of fatalities is close to it. In fact as the cri-
terion corresponds to the average individual risk of 106 per an-
num, the upper level of fatalities for EN/NKB correspond to
average individual risk of 1.4  106 per annum and for JCSS to
6.8  106 per annum. Similarly, with the lower level of fatalities
EN/NKB contribute 14% and JCSS 68% to the upper level of individ-
ual risk of 106 per annum.
It should be noted that the structural probabilities of failure
represent the maximum allowable values; however there are indi-
cations that occupants in a building are exposed to the higher risk
than what is allowed for offsite population in the vicinity of major
hazards installation.
On the other hand there is usually some redundancy in struc-
tures which often is not taken into account in structural reliability
analysis. Therefore structures are most likely safer than what the
numbers in the codes would indicate.
5. Conclusions
The above three examples indicate the following:
1. Safety level provided by load bearing structures may be intoler-
able from safety risk point of view (as proposed by the UK and
Dutch societal risk criteria).
2. The structural reliability criteria should consider more explic-
itly the effect of potential consequences on the number of
exposed persons.
3. There should be clear differentiation of structures like residen-
tial or office blocks in which people are not exposed to addi-
tional hazards, and the industrial structures in which the
industrial operations’ risk may be significant and are added to
the structural related risks (which may not be negligible).
V.M. Trbojevic / Structural Safety 31 (2009) 245–250 249
Consistent (IR=10-6, N=500, β =1)
EN / NKB Upper Level of Fatalities
JCSS Upper Level of Fatalities
EN / NKB Lower level of Fatalities
JCSS Lower Level of Fatalities
100
Number of Fatalities N
4. There is a need for improved communication between struc-
tural engineers and safety/risk analysts in order to achieve bet-
ter alignment of the two types of criteria; this can be achieved
easily by starting from the same definition of either a broadly
acceptable risk or the negligible risk.
5. Risk aversion (in the Dutch criteria) is generally rejected by
structural reliability practitioners, however it would be inter-
esting to discuss whether structural reliability criteria with risk
aversion in the region of large consequences should be precau-
tionary or whether the treatment of uncertainty in the codes
accounts for precaution. For example, if for significant risk of
fatalities (assumed 10 and 1 fatality, Table 5) the annual prob-
ability of failure is 105 (Eurocode, NKB), then for large risk
fatalities (assumed 100 and 10 fatalities), the probability of fail-
ure should be 107 (i.e. two decades smaller, instead of existing
106).
Acknowledgements
Most of the work presented was performed within the EU – Pro-
ject ‘‘Safety and Reliability of Industrial Products, Systems and
Structures” (SAFERELNET), which has been funded by the European
Commission under the Contract Number G1RT-CT2001-05051,
http://www.mar.ist.utl.pt/saferelnet.
References
[1] Ale BJM. Tolerable or acceptable: a comparison of risk regulation in the United
Kingdom and in the Netherlands. Risk Anal 2005;25(2):2005.
[2] CSA. General requirements, design criteria, the environment, and loads. Part 1
of the code for the design, construction, and installation of fixed offshore
structures. Preliminary standard S471-M1989. Canadian Standards
Association, Rexdale (Toronto), Ontario, Canada; 1989.
[3] DNV. Structural reliability analysis of marine structures. DNV classification
note no. 30.6; 1992.
[4] Eurocode, European Committee for Standardisation. European standard EN
1990:2002 (E). Eurocode – basis of structural design; April 2002.
[5] HSWA. Health and safety at work etc Act 1974. SI 1974/1439; 1974.
[6] HSE, Ball DJ, Floyd PJ. Societal risks. HMSO; 1998.
[7] HSE. Quantified risk assessment: its input to decision making, health and
safety executive, London. HMSO; 1989.
[8] HSE. Generic terms and concepts in the assessment and regulation of industrial
risks, health and safety executive. HSE Books; 1995.
[9] HSE. Reducing risk, protecting people. HSE Books; 2001. ISBN: 0 7176 2151 0.
250 V.M. Trbojevic / Structural Safety 31 (2009) 245–250

[10] Institution of Chemical Engineers. Nomenclature for hazard and risk
assessment in process industries, Rugby, IChemE; 1992.
[11] JCSS, Joint Committee on Structural Safety. Probabilistic model code, 12th
draft; 2000.
[12] Kroon I. Memo – COWI; 25 June 2004.
[13] NKB, Nordic Committee for Building Structures. Recommendations for
loading and safety regulations for structural design. NKB report no. 36;
1978.
[14] Schofield SL. A Framework for Offshore Risk Criteria. J Safety Reliab Soc
1993;13(2). Summer.