massive transfer of risk-reliability book

book/prob-design/01-one-random-variable.md

@@ -0,0 +1,78 @@
+(prob_design_1_rv)=
+# One Random Variable
+
+Consider a river that is protected by dikes, earthen embankments with the purpose of keeping water in the river channel and preventing flooding of the hinterland. The dikes should be designed and build such that the height allows the river to safely pass the maximum discharge every year, measured in m$^3$/s. A rating curve ({numref}`rating_curve`) gives us the relationship between discharge and water depth, $h_w$, so if we know what the maximum discharge is, we can build our dikes to the critical height, $h_{dike}\geq h_w$. But there is a problem---what is the maximum discharge in the river each year? How would we even go about determining this value? One way is to make observations and find the highest recorded data point. For example, in 1995 the Rhine River reached a discharge of around 12,000 m$^3$/s, the highest recorded level to date. But even with over 100 years of measurements, the record is not complete: there could always be a bigger discharge. Another approach could be to come up with a number that is, beyond a reasonable doubt, impossible to exceed.  Many experts believe that 16,000 m$^3$/s is getting close to an upper limit, and 20,000 m$^3$/s may be physically impossible. Which of these two values should we choose for the design of our dike, and why?[^expensive-option] 
+
+```{figure} ../figures/rating_curve.svg
+---
+height: 400px
+name: rating_curve
+---
+Rating curve for hypothetical river. Relationship is $q=C \cdot h_w^\beta$ where $\beta$=2.0 and $C$=4.0.
+```
+
+This is a difficult question because the actual discharge observed in a given year is random. In addition to other variables, it is largely dependent on rainfall in the drainage basin, which is impossible to predict far in advance---certainly not for the entire year. Furthermore, we don't have a way to accurately extrapolate our past observations to identify a logical maximum discharge. For this reason, we will use a continuous probability distribution to quantify the probability associated with a specific maximum discharge, $q$, that might be observed in a given year, defined by the PDF $f_{Q}(q)$ and CDF $F_{Q}(q)$. The only other piece of information needed is a design standard---a probability that defines the discharge to use for our design. Other chapters in this book cover the derivation of a design standard, so for this discussion we will assume that a flooding probability of 1/100 has already been determined as the acceptable level. Because there is only one random variable, we can use the PDF to determine the design discharge ({numref}`design_1_rv`).
+
+```{figure} ../figures/design_1_rv.svg
+---
+height: 400px
+name: design_1_rv
+---
+PDF and design value for river discharge with 0.01 probability of exceedance: $q_{design}=155 \: \text{m}^3\text{/s}$.
+```
+
+In particular, we note that failure occurs for high discharge, so we must use the complementary CDF to find the design value, in this case probability of exceeding $q_{\mathrm{design}}$:
+
+$$
+1-F_{Q}(q_{\mathrm{design}})=0.01
+$$
+
+$$
+q_{\mathrm{design}}=F_{Q}^{-1}(1-0.01)=155\:\text{m}^3\text{/s}
+$$
+
+after which the water depth and minimum dike height can easily be determined from the rating curve:
+
+$$
+h_{dike}=h_{w,design}=\left(\frac{q_{design}}{C}\right)^{1/\beta}=6.23 \text{m}
+$$
+
+Recalling the *safety margin* limit state from the previous section, $M=R-S$, we can see that randomness plays a role through the load variable, $S$, such that
+
+$$
+M=R-S=h_{dike}-h_{w,design}
+$$
+
+If the condition $M<0$ defines flooding (i.e., failure) and if $q$ is the only random variable, we have successfully ensured a situation where the flooding probability is 0.01. 
+
+**Reflection on the Simple Example**
+
+Is this an oversimplification of reality? Perhaps, but it gets pretty close. Many flood protection systems in the world use an exceedance proabability approach to probabilistic design: choosing a specific and making sure the component or system can handle the load. This works well when the primary source of uncertainty is the load: the river discharge in this case. 
+
+We also took for granted that a simple relationship between river discharge and water depth is available. However, this is never the case, as such a relationship depends on the cross-sectional shape and roughness of the floodplain, which not only varies along the river trajectory, but also changes due to natural phenomenon and human interventions. This introduces additional uncertainty into our assessment of whether the dikes are high enough.
+
+Fortunately there is also extra conservatism built into this approach. For example, duration of high water plays a role: if discharge exceeds the capacity of the dike system, but only lasts for a short time (minutes or a couple hours), perhaps the dikes can withstand the overflow without eroding and causing flooding. This can be conceptualized by considering the joint probability of a high discharge *and* degradation of the dike leading to flooding:
+
+$$
+P(\text{flooding},h_w>h_{dike})=P(\text{flooding}|h_w>h_{dike})\cdot P(h_w>h_{dike})
+$$
+
+where the conditional term represents the probability that the dike erodes (fails) given that the water depth exceeds the height. Assuming failure when the critical water depth is exceeded is conservative because it implies $P(\text{flooding}|h_w>h_{dike})=1.0$, whereas in reality this is not the case, and the 'true' flooding probability is less than that computed in the equation above.
+
+Later chapters of this book will introduce methods for taking these realities into account in the design and decision-making process. For now, we will see how our probabilistic design changes when more than one random variable must be considered.
+
+<!-- ## Old stuff
+
+Let's consider that the load is random.
+
+Discrete.
+
+Continuous.
+
+Illustration of exceedance probability approach. Compare 1/10,000 with:  
+$$
+\int_{-\infty}^{+\infty}f(\text{levee failure}|h)\cdot f(h)\: \text{d}h
+$$ -->
+
+
+[^expensive-option]: Although the 20,000 m$^3$/s value is tempting because it is the most safe option, it is probably prohibitively expensive to build!

book/prob-design/02-two-random-variables.md

@@ -0,0 +1,191 @@
+(prob_design_2_rv)=
+# Two Random Variables
+
+The previous section illustrated how a decision for dike height, $h_{dike}$, can take into account uncertainty in river discharge. We used a maximum allowable probability of flooding to derive the specific value of discharge, $q_{design}$, that should be used to choose $h_{dike}$. This was necessary because there was otherwise no way of establishing what the maximum discharge should be. The only variable considered to be random was the maximum river discharge that occurs each year. This section considers how the design process becomes more complicated when *two* random variables are considered (two load variables).
+
+````{admonition} Distribution for $q_1$ and $q_2$
+:class: dropdown
+On this page all calculations assume the same lognormal distribution for random variables $q_1$ and $q_1$, where the first and second moments of the distribution are:
+
+$$
+\begin{align*}
+E[X] &= \exp\left(\mu + \frac{\sigma^2}{2}\right) = 100\\
+VAR[X] &= \left( \exp(\sigma^2)-1 \right)\exp(2\mu + \sigma^2)= 400
+\end{align*}
+$$
+<!-- RRRRRR See the table in [Summary of parametric distribibutions](summary_dist) -->
+
+For the `lognorm` method in `scipy.stats` we need to provide the parameters shape `s` = $\sigma$, `loc` = 0 and `scale` = $\exp(\mu)$ (see explanation [here](https://mude.citg.tudelft.nl/book/probability/Loc-scale.html)), in this case:
+```python
+import scipy.stats as stats
+s = 0.198
+loc = 0.000
+scale = 98.058
+q_1 = stats.lognorm(s=s, loc=loc, scale=scale)
+q_2 = stats.lognorm(s=s, loc=loc, scale=scale)
+```
+````
+
+## Discharge from Two Rivers
+
+In this scenario our objective for choosing $h_{dike}$ is still the same, except now we recognize that our location on the river is downstream of a confluence of two smaller rivers. The discharge at the location of our dike is thus the sum of the dicharge from Rivers 1 and 2:
+
+$$
+q=q_1+q_2
+$$
+
+where the same rating curve applies, giving $h_w$ as a function of $q$. As before, acknowledging that the maximum discharge per year in each river is a random variable, we can approach the design problem in the same way: choose $h_{dike}$ such that it retains water when $q$ takes a value with probability of exceedance 0.01. For now, we can assume the distribution for River 1 and River 2 are the same as in the previous Section, and that they are independent.
+
+*Compared to the previous example, now there are two distributions---how do we find the design discharge and dike height?*
+
+Before presenting the correct approach, three common mistakes are illustrated.
+
+### Incorrect Approach 1
+
+Find the discharge in each river, $q_1$ and $q_2$, such that the probability of exceeding each discharge is 0.01. As in the previous section,
+
+$$
+q_{1,\mathrm{design}}=q_{2,\mathrm{design}}=F_{Q}^{-1}(1-0.01)=155\:\text{m}^3\text{/s} \;\rightarrow\; q_{design}=310\:\text{m}^3\text{/s} 
+$$
+
+*Why is this approach incorrect?*
+
+It considers the simultaneous occurrence of *both* rivers exceeding a design discharge with probability 0.01. This is a joint probability of occurrence, $P(Q_1>q_{1,design},Q_2>q_{2,design})$, which can be evaluated with a multivariate probability distribution (or the marginal distributions in the independent case). The scenario is equivalent to observing two sixes after tossing two dice simultaneously: if the dice are fair, the probability is $1/36$. Thus, for this incorrect case the probability $P(Q_1>q_{1,design},Q_2>q_{2,design})$ is not 0.01, it's actualy 0.01$^2$=0.0001, illustrated in the figure below.
+
+```{figure} ../figures/design_2_rv_error_1.svg
+---
+height: 400px
+name: design_2_rv_error_1
+---
+'And' probability for Incorrect Approach 1.
+```
+
+### Incorrect Approach 2
+
+Find the discharge in each river, $q_1$ and $q_2$, such that the joint probability of exceeding these values is 0.01. Since the two rivers are independent, we can solve for our design probability, $p_{design}$:
+
+$$
+\left(p_{design}\right)^2=0.01\: \rightarrow \: p_{design}=\sqrt{0.01}=0.1
+$$
+
+$$
+q_{1,\mathrm{design}}=q_{2,\mathrm{design}}=F_{Q}^{-1}(1-0.1)=126\:\text{m}^3\text{/s} \;\rightarrow\; q_{design}=252\:\text{m}^3\text{/s} 
+$$
+
+```{figure} ../figures/design_2_rv_error_2a.svg
+---
+height: 400px
+name: design_2_rv_error_2a
+---
+'And' probability for Incorrect Approach 2.
+```
+
+*Why is this approach incorrect?*
+
+It only considers one scenario! 
+
+There are infinite alternative scenarios that also result in a joint probability of exceedance of 0.01, for example, $0.2\cdot 0.05 = 0.01$:
+
+$$
+q_1=F_Q^{-1}(1-0.20)=116\:\text{m}^3\text{/s}\;\; \text{and}\;\; q_2=F_Q^{-1}(1-0.05)=136\:\text{m}^3\text{/s}
+$$
+
+which results in a totally different dike height.
+
+```{figure} ../figures/design_2_rv_error_2b.svg
+---
+height: 400px
+name: design_2_rv_error_2b
+---
+Comparison of two 'and' probabilities for Incorrect Approach 2.
+```
+
+### Incorrect Approach 3
+
+Since the 'and' case didn't work we can use the 'or' probability, or union! In other words: find the discharge in each river, $q_1$ and $q_2$, such that the probability of either of them being exceeded is 0.01.
+
+The union probability can be found as follows:
+
+$$
+P(Q_1>q_1 \cup Q_2>q_2)=1-P(Q_1<q_1,Q_2<q_2)
+$$
+
+given the assumtion of independence, the union probability is:
+
+$$
+P(Q_1>q_1 \cup Q_2>q_2)=1-P(Q_1<q_1)\cdot P(Q_2<q_2)
+$$
+
+Solving for the case where $P(Q_1>q_1 \cup Q_2>q_2)=0.01$ implies the exceedance probability for each river discharge is $\sqrt{1-0.01}=\sqrt{0.99}=0.995$, thus:
+
+$$
+q_{1,\mathrm{design}}=q_{2,\mathrm{design}}=F_{Q}^{-1}(0.995)=163\:\text{m}^3\text{/s} \;\rightarrow\; q_{design}=326\:\text{m}^3\text{/s} 
+$$
+
+```{figure} ../figures/design_2_rv_error_3.svg
+---
+height: 400px
+name: design_2_rv_error_3
+---
+'Or' probability for Incorrect Approach 3.
+```
+
+*Why is this approach incorrect?*
+
+As with the first two incorrect approaches, it also only considers one specific scenario! There are infinite combinations of $Q_1$ and $Q_2$ such that the union is 0.01.
+
+### Correct Approach
+
+The discharge in the main river is the sum of the discharge of its tributaries, thus it is a function of random variables which has a distribution $f_Q(q)$. Thus we can use the distribution of $Q$ to find the design value $q_{design}$ directly. Unfortunately, although $q$ is a linear combination of $q_1$ and $q_2$, because they are lognormally distributed we cannot find a simple analytic expression for the distribution of $q$. However, using Monte Carlo sampling from the distributions of $q_1$ and $q_2$ gives:
+
+$$
+q_{design}=F_Q^{-1}(1-0.01)=275\:\text{m}^3\text{/s}
+$$
+
+This is equivalent to integrating the joint probability distribution of $q_1$ and $q_2$ over the region $\Omega$ where $q>275\:\text{m}^3\text{/s}$, illustrated in the figure below, along with the contours of joint probability density.
+
+```{figure} ../figures/design_2_rv_correct.svg
+---
+height: 400px
+name: design_2_rv_correct
+---
+Correct approach: $P(Q>275\:\text{m}^3\text{/s})=0.01$. Also illustrated is the region $\Omega$ where $q>275\:\text{m}^3\text{/s}$ and contours of joint probability density.
+```
+### Comparison of Approaches
+
+All four design values of $Q$ are collected in the table below, along with the required dike height. Clearly the method of incorporating uncertainty makes a difference, as the height varies over 1 m across all options, which is a significant increase in cost for a structure that is many kilometers long.
+
+```{list-table} Comparison of design values for all four approaches.
+:header-rows: 1
+:name: design_2_rv_comparison
+
+* - Approach
+  - Design Value, $q_{design}$ [m$^3$/s]
+  - Design Value, $h_{dike}$ [m]
+* - Incorrect 1
+  - 310
+  - 8.80
+* - Incorrect 2
+  - 252
+  - 7.94
+* - Incorrect 3
+  - 326
+  - 9.03
+* - **Correct**
+  - **275**
+  - 8.29
+```
+
+## Reflections on the Simple Example
+
+% Dependence considered in componenet reliability part (and system!)
+% Design point consideration NOT included here, and probably not in this book!!!
+
+We need to be explicit in what we are trying to evaluate. In this case, it is the distribution of a function of random variables, $Q$.
+
+For non-Gaussian distributions and for non-linear functions of random variables it is often not possible to get the distribution of the function of random variables analytically. Fortunately it is easy to find it numerically through sampling techniques. This will be discussed elsewhere.
+
+The 'and' and 'or' approaches (intersection and union) are simple, but really only limited to discrete cases. As illustrated above, they cannot be used in the case of continuous random variables, or with functions of random variables because one must integrate across all possible scenarios leading to failure. Nonetheless, these approaches are extremely useful for many situations, and are the basis of *system reliability* problems.
+
+The situation illustrated here is often referred to as a *component reliability* problem, where the 'component' is defined by a function of random variables.
+ Although nothing more than a function of random variables,is nothing more than an integration over a specific region of a multivariate probability density function. Often this region describes failure of a component, which we will try to keep below an acceptable level.

book/prob-design/example-river-system.md

@@ -0,0 +1,24 @@
+# Flood Management Case Study
+
+```{note}
+The flood management example is covered in the plenary lecture on Jan 9, 2023 (see Brightspace), and has not yet been added to this book.
+```
+
+As mentioned on Introduction page:
+> Throughout this book we will repeatedly draw on the field of flood management to illustrate risk and reliability concepts as this field requires expertise from all perspectives in civil and environmental engineering and geosciences, from climate and hydrologic processes to evacuation and recovery. 
+
+<!-- After introducing key elements of the system, topics may include:
+- hazard
+- levee failure, conditional on the hazard
+- consequences
+- integration (sum) to get risk
+- assume we can establish a max value, then we can derive the required safety level for our levee
+- fragility curve -->
+
+```{figure} ../figures/simple-city.png
+---
+width: 600px
+name: simple-city
+---
+A simple city that we would like to protect against flooding by the river.
+```

book/prob-design/exercise.md

@@ -0,0 +1,13 @@
+# Exercises
+
+Elsewhere in this book we have covered methods that will allow you to solve the discharge problem on the previous page, for example, propagation of uncertainty, functions of random variables, etc. Try the following exercises to evaluate the distribution of $q$. In each case, you should be able to define both the distribution of $q$ as well as the value of $q_{design}$:
+
+1. Define the distribution of $q_1$ and $q_2$ as LogNormal using Scipy, then evaluate the distribution of $q$ using Monte Carlo Simulation
+2. Approximate the distributions of $q_1$ and $q_2$ using only their moments and use error propagation to approximate the distribution of $q$
+3. Use the moments to define Normal distributions for $q_1$ and $q_2$, then find the distribution of $q$ (hint: it should also be Normal, and you can solve for it analytically)
+4. Use the moments to define Normal distributions for $q_1$ and $q_2$, then use the multivariate normal distribution in Scipy to define a correlation coefficient and explore what the effect of dependence between $q_1$ and $q_2$ has on the result.
+
+```{note}
+Solutions to these exercises are on the next page.
+```
+

book/prob-design/overview.md

@@ -0,0 +1,41 @@
+(prob_design)=
+# Probabilistic Design
+
+Stated as simply as possible, the term *probabilistic design* implies the use of probability to design something. Although this may sound complex, it is actually not much different than a deterministic approach, where values used to design something are not assumed to be random. For example, the load on a beam, or the maximum discharge expected in a river. In a typical design process, the problem and functional requirements are first defined, the system or component is evaluated and then refined {cite:p}`voorendt2017`. It is ideally an iterative process, where tradeoffs between competing requirements must be considered in order to arrive at an optimal configuration. During much of your university education you have probably learned a variety of techniques to evaluate interesting problems in your field of study; however, only towards the end of a bachelor or master program do you begin to *design* things and take into count information beyond what is written in a simple exam problem to make decisions. The design process is often challenging because there is no single right answer, and it turns out that incorporating probability in the design process can help.
+
+Consider some arbitrary object--let's call it a thingamajig--which we must design and eventually build. We would like to apply the *factor of safety* approach, which compares load[^solicitation], $S$, to resistance, $R$, such that $FS=R/S$. As long as we make sure that $S$ is less than $R$, or $FS>1$, our thingamajig will never fail. We could also use the *safety margin* approach, where $M=R-S$, which also quantifies the point between safe and unsafe, although here we make sure $M>0$. These so-called *limit states* make the design process quite simple and is a great engineering approach for many situations, for example, if:
+1. the values of $R$ and $S$ are precisely known, or the range of values is negligibly small
+2. $R$ and $S$ never change (at least not over short time or length scales)
+3. $R$ and $S$ are easy to measure in all locations of interest
+4. the model used to design the thingamajig is nearly perfect
+5. the consequence of a failure is negligible
+
+In situations like this you can make your design decision and rest assured that there won't be any lawyers knocking on your door in the near future because the thingamajig broke.
+
+For many situations, however, a deterministic analysis is not wise because we cannot guarantee that our thingamajig will always survive. When $R$ and/or $S$ can take on a range of possible values, all of a sudden there is a chance that our thingamajig is *not* reliable: there is a distinct probability it may *fail.* Part of this book is concerned with the quantification of what is often called the *failure probability,* $p_f$, for which there are many different techniques. These techniques all rely on  probability theory because it allows us to quantitatively account for the following in our engineering process:  
+
+1. imprecise measurements
+2. model error
+3. randomness in some of our important design variables
+4. risk-based design criteria and safety standards
+
+These are just a few examples, where items 3 and 4 are the focus of the following chapters, and items 1 and 2 have already been considered elsewhere in MUDE.
+
+%Sometimes we have criteria, sometimes we do not.
+
+## Chapter Overview
+
+%Terms and definitions first??
+%Aleatoric and epistemic.
+%Sometimes we don't have a structure. Then we can consider just the *hazard*.
+
+A probabilistic design is illustrated in the following sections, first with the simple cases of one random variable. Then an example with two random variables is used, which can be referred to as a *bivariate* case. This is more insightful than the univariate case because it allows us to consider the quantitative and qualitative influence of dependence, as well as the functional relationship between two variables and their joint probability density (e.g., union, intersection or limit-states).
+
+The evaluation and design of a river flood protection system is used to introduce key aspects of risk and reliability, as well as the design process. A distinction is made between using probability to assess engineering components and systems (reliability analysis) and to derive design criteria (risk evaluation), which are introduced formally in later chapters after the general risk analysis framework is discussed.
+
+---
+
+_The primary author for this chapter is Robert Lanzafame._
+
+[^solicitation]: $S$ stands for solicitation. While this letter and word are much more pedantic-sounding than simply using load, or $L$, it is widely used in the structural engineering field, where component reliability methods were pioneered. Here we take a broader approach on the subject. Classical texts are {cite:t}`adk2022`, {cite:t}`moss2020` and {cite:t}`ditlevsen1996`.
+%[^pattern]: The word *paradigm* is not used because it suggests completeness. The examples here, are meant to be used as illustrations for key concepts, and extended to other situations and higher dimensions, so *pattern* seems more appropriate.