Use of the event tree to assess the risk reduction obtained fromrockfall protection devices

The paper presents and discusses a procedure for the evaluation of the collective risk that can affect a road subjected to rockfalls, with and without protection measures, by means of the event tree analysis. This tool is useful to show designers whether the rockfall protection structures are located in the correct positions, whether they are the correct technological choice and what level of reduction of risk can be obtained. Different design options can therefore be compared on the same bases.


Introduction
The fulfilment of safety requirements for routes in mountainside areas often requires that protection measures are taken to control the incidence of rockfalls.The types of events and accidents that can be caused by rockfalls along railways and roads, range from minor falls that damage tyres and vehicle bodyworks, to larger falls that directly affect vehicles or cause vehicles to swerve off the road.
The effects of these events can be the damage of vehicles, injuries or the death of drivers or passengers and economic loss due to road closure (Duncan and Norman, 1996).Furthermore, the cost of a single car accident can be significant since it can involve the hospitalisation of the driver and passengers, the repair of the vehicle, the legal costs and compensation and, on occasion, the owner of the road or the designer of the existing protection works can be subjected to an official enquiry by the state prosecutor.
The most frequent causes of rockfall are mainly related to water: rain, freeze-thaw, snowmelt, channel runoff, differential erosion, springs or seeps and the growth of tree roots in cracks, which can open fractures and loosen blocks on the Correspondence to: D. Peila (daniele.peila@polito.it)slope.The other main group of factors affecting stability on rock slopes is represented by the geologic and geotechnical conditions of each site, namely, fractured rock, adverse dip of the joints and soil decomposition and earthquakes can trigger collapse (Peckover and Kerr, 1977;Giani, 1992;Duncan and Norman, 1996;Guzzetti et al., 2003;Wieczorek et al., 2008;Casale et al., 2008).If the detached rock block moves downwards towards the infrastructures and interferes with them, it is necessary to design protection works that are able to intercept the blocks and stop them (Peckover and Kerr, 1977;Duncan and Norman, 1996;Peila et al., 1998Peila et al., , 2006Peila et al., , 2007;;Pelizza et al., 2004), such as ground embankments and net fences, which must be placed on the slopes after an evaluation of the possible trajectories of the falling blocks.
The design of rock slope reclamation is based on two fundamental steps: the hazard analysis of the natural area that has to be reclaimed and the design of protection techniques.These analyses are characterized by a high level of variability due to the complexity of a precise quantification of the probability of occurrence of the rockfall.Many procedures can be found in technical literature to classify the risk of an infrastructure located near unstable rock slopes, e.g. the Rockfall Hazard Rating System -RHRS (Pierson et al., 1990, Evans et al., 1993), the Rock Engineering System (RES) (Hudson, 1992;Cancelli and Crosta, 1999;Crosta and Agliardi, 2003), the modified RHRS (Budetta, 2004), the Rockfall Hazard Assessment Procedure (RHAP) developed by Lombardia Region (Italy) (Crosta et al., 2001).These methods are based on the rock mass condition, on the road characteristics, on the climate and on previous rockfall events: each of these variables is associated to an index which, combined together, gives the hazard level of the area, expressed as the probability that a rockfall event will occur in the analysed area but they do not provide any indication on how the technical intervention could reduce the risk condition and do not give a direct numerical evaluation of the obtained improvement level.The Swiss federal services in charge of natural hazards have developed the concepts of danger zones coupling hazards zones and intensity of natural phenomenon (i.e. total kinetic energy for rockfalls).Contrasting with risk analysis, zoning depends on a normative category of hazard defined on potential damage of buildings representing a sort of risk analysis for one hazard type, because danger zones imply degrees of damages.(Lateltin, 1997;Raetzo et al., 2002;Jaboyedoff et al., 2005) Apart from the global risk assessment of rock slopes subjected to rockfall events, another important design step is the definition of a block trajectory (that is, the path length, the height, the velocity and the energy assumed by the block during the fall) and many procedures for the numerical analysis of this phenomenon have been set up above all over the last twelve years (Giani, 1992).Generally speaking, all these numerical or analytical rockfall modelling require the determination of the geometrical and physical characteristics of the falling slope and of the rock block.The principal geometrical features refer to the slope topography, the block size and its shape while the physical characteristics are the initial free falling block velocity, the coefficient of restitution of the slope surface (describing the response of the slope surface to the impact event) and the sliding and rolling friction coefficient.The definition of these parameters is quite difficult and these parameters are therefore usually assumed not as deterministic values but rather by varying them within a predefined range.The computation, therefore, provides a family of collapse trajectories.When the best position (taking into account the slope geometry, the available areas and other geometrical, operational and geotechnical constraints) has been decided on and the best intercepting structure has been chosen, it is rare, in design practice, that these devices can intercept all the computed trajectories, thus the hazard cannot be reduced to zero but only significantly reduced.Furthermore, the possibility of a single unusual and random event occurring, cannot be excluded and a residual risk is always present.
As a consequence of these aspect for a reliability-based design (JCSS, 2001) acceptability limits have to be set and a comparison of the probability of injury or loss of human lives before and after the installation of the protection devices must be computed.The event tree appears to be a good tool for these studies (Bunce et al., 1997;Hoek, 2000;Locatelli, 2005;Oggeri and Tosco, 2005) since it permits the various events that can occur to be taken into account and the various conditions before and after the protection device installation to be compared.A global procedure for the use of the event tree for the evaluation of the risk of a road subjected to rockfall is discussed to show its potentiality.

The event tree
The event tree is a system which is applied to analyse all the combinations (and the associated probability of occurrence) of the parameters that affect the system under analysis.All the analysed events are linked to each other by means of nodes (Fig. 1): all possible states of the system are considered at each node and each state (branch of the event tree) is characterised by a defined value of probability of occurrence.
The fundamental properties of the event tree can be summarized as follows: • events which start from the same node are autoexcluding and the sum of the respective probabilities of occurrence must be equal to one, that is, with reference to Fig. 1: (1) Steps 1 and 2 of the event tree analysis: definition of N tot , N r and N s .
• the probability of occurrence of each path (P (Rn)) is a function of all the branches that are included in it.Again with reference to Fig. 1: It is necessary to identify the consequences (potential value of loss) linked to the specific sequence of events for each path obtained from the event tree.The aim of this analysis is to compute the risk value which affects a road subjected to rockfalls (Guardini et al., 2006).Quantitatively, risk is defined as a function of the probability of occurrence of a hazard process (P ) (UN/ISDR, 1994) and the expected degree of damage, the latter being a product of the damage potential and the corresponding vulnerability (D) (Varnes, 1984).The general risk formula is: Using this approach and evaluating the probability of occurrence that a falling rock directly impacts a car and/or damage the road basement thus causing a car accident, it is therefore possible to compute the collective which express the risk of the road as the number of fatalities per year, taking into account the number of cars travelling on the road per year.If the obtained value is not acceptable, because it is too high with reference to national standards, regulations or guidelines (Wilhelm, 1997(Wilhelm, , 1999;;Borter, 1999;Bell and Glade, 2004;Lateltin et al., 2005;Mölk et al., 2008), it is possible to carry out the analysis again, considering the presence of protection systems, that reduce the probability of a falling rock intercepting the road, thus reducing the probability of occurrence of a fatality and consequently the collective risk of the road.The proposed tool, based on an event tree approach, therefore allows a simple comparison to be made between different protection devices and design choices, according to their ability to reduce the collective risk on the road.The "optimal" solution which gives an acceptable value of the residual risk can therefore be chosen and justified.Using the computed value of the collective risk, it is then possible to simply evaluate the individual fatality risk for the people that use the road (Zischg et al., 2005).Furthermore, the described event tree approach permits the evaluation of the probability of occurrence of non fatal accidents, which values is important for the cost-benefits analysis.The first step of the analysis involves the choice of the number of rocks that can fall from the slope during a predefined time interval (i.e. one year).Unfortunately rock failure probability is often unknown and the exact rock block sizes are often difficult to be evaluated (Wieczoreck et al. 1998;Vengeon et al., 2001;Dussauge et al., 2003).If the site is well known and well monitored, the number of rocks falling from the slope during a predefined time interval (N tot ) can be obtained from an analysis of previous rockfall events (historical catalogue) or the rock failure rating systems can be used (Cancelli and Crosta, 1993;Mazzoccola and Hudson, 1996;Rouller at al., 1998;Mölk et al., 2008).Alternatively, one solution could be to assess several scenarios for different return periods for rock failure and volumes, depending on the knowledge of the mean rock failure probability for a specific instability and the knowledge of the site geomechanical condition (Derron et al., 2005).For example, Jaboyedoff et al. (2005) proposed using the mean of the return period classes of the Swiss codes (Lateltin, 1997) where the probability of occurrence, or return period, is considered high if more than one event occurs in 30 years, medium if the return period is between 30 and 100 year, low if it is between 100 and 300 years and is assumed nil if it is over 300 years.
The second step is the definition of the number of events, among N tot , that actually hit the road (N r ), and that do not interfere with the road (N s ).These values can be obtained from an analysis of the previous events or, alternatively, through the evaluation of the trajectory analysis by calculating the percentage of all simulated trajectories that cross a point (2-D models) or an area (3-D models).The logical scheme of these two steps is shown in Fig. 2 while the complete Fig. 3. General scheme of the event tree proposed for the analysis of the probability of a fatal accident due to a rockfall on a road.sequence of possible events leading to a fatal accident is shown in Fig. 3.The required input data are: the length of the slope under analysis (L p ), the average (or limit) speed of the vehicles (V v ), the average vehicle length (L v ) and the number of vehicles travelling on the road per day (N v ).

Development of the procedure and application example
In order to explain how the proposed approach can be applied, it is necessary to take the scheme shown in Fig. 3 as a reference, where the various probabilities of each branch can be evaluated by means of different approaches: numerical evaluation, predefined assumption and elaboration of statistical data from national databases.For a better comprehension of the proposed approach, it has been found easier to carry out the computation of real data of a stretch of a mountainside local road that crosses a debris fan subjected to rockfall from a 200 m high overhanging rock slope (Table 1), and to give an explanation of the various steps.
Once parameter N r (number of rockfall events per year that hit the road) has been defined, it is possible to compute the probability that a vehicle travelling on a road is hit by a falling rock (P 1), this being a function of two simultaneous events: spatial and temporal correspondence between the rock and the vehicle (to have the accident, the block and the vehicle have to fill the same space at the same moment).It is possible to express the probability that a generic vehicle is hit by a rock (P (A v )) as shown in Eq. (4).
where P (S): the probability of spatial correspondence between the rock and the vehicle; P (T |S): the probability of temporal correspondence between the rock and the vehicle.
In this way P 1 can be calculated as the product of the generic probability P (A) v for one vehicle and the number of vehicles travelling on the road per year (N v/a ), as shown in Eq. ( 5).
It is possible to apply the binomial theorem (Benjamin and Cornell, 1970) to calculate P (S), defining P (S, N a ) as the probability of N a vehicles being hit when N r rocks fall: where P (S|H ): probability that a vehicle occupies the portion of the road affected by a rockfall.If a constant probability of rock detachment along the considered portion of road is considered, P (S|H ) can be simplified as the ratio between the vehicle length and the slope length: It is possible to point out that if N a =0, Eq. ( 6) reduces to the probability that no vehicles are hit: and the probability that one ore more vehicles are hit, which corresponds to the previous definition of spatial correspondence between the block and the vehicle, is therefore given by Eq. ( 9): P (T |S), which has been defined (Eq.4) as the probability of temporal correspondence between the block and the vehicle, can be assumed equal to the part of the year occupied by a single passing of the vehicle through the section (Eq.10), where slope length L p is expressed in kilometres and vehicle speed V v is expressed in kilometres per hour.
Once these two parameters (P (S), P (T |S)) have been calculated, it is possible to obtain P (A) v by applying Eq. ( 4), which substituted in Eq. ( 5), gives P 1 (probability per year that a vehicle is impacted by a block): =3.34•10 −2 (12) The probability that no vehicles is hit by a block (P 1') is given by the ones complement of P 1 (Eq.15).In the following, the calculation of denied probabilities P n ' is not repeated.
P 1 =1−P 1=0.99 826 (15) Continuing with the analysis of the event tree (Fig. 3), given a rockfall event and the collision with a moving vehicle, the probability of a fatal accident (P 2) has been assumed equal to 0.2, according to what has been proposed by Bunce et al. (1997).It was assumed that a rock with sufficient energy to deform the asphalt could penetrate the skin of a car and could seriously injure or kill one or more occupants.In the case of a stationary vehicle, the probability of death due to an impact could be assumed to be 0.125 this is based on the approximation that 0.25 of the length of an average vehicle is occupied by passengers in addition is assumed that no more than one out of two falls that impact a person result in death (these assumption also make some allowance for the average vehicle not occupying the full width of the road).This assumption is clearly linked to the falling rock size: if the rock is larger that 0.5 m, it is more realistic to assume that each impact could kill the impacted passenger.Therefore, in order to apply the proposed procedure, it is necessary to consider the most probable size of the impacting block.A killing probability of 0.5 has been considered in the example.This value is assumed to be higher for a moving vehicle (0.2 instead of 0.125) because, apart from the possibility of direct impact with passengers, it includes the detrimental effect of a rock impact on the performance of the vehicle (e.g. the driver might lose control of the vehicle).Similar probability values were proposed by Zischg et al. (2005), for the probability of death in vehicles caused by an avalanche incident, according to the calculation procedure proposed by Wilhelm (1999).
In the case where the rock does not hit the vehicle, it is necessary to verify whether the road surface has been damaged by the impact in such a way as to represent a possible cause of accident for a vehicle travelling on it.This event, associated to the probability P 3 (Fig. 3), has been considered Table 1.Input data assumed for the analysis.The number of rocks hitting the road was evaluated from the analysis of a real site where it was possible to collect information of rockfall events covering a period of 30 years.The geomorphological situation of the considered example is that of a local mountain side road that crosses a debris fan subjected to rockfall from a 200 m high overhanging rock slope.The event historical catalogue shows that it is possible to have one rockfall event per year, with an average number of blocks per event ranging from 10 to 30.Thus, starting from the number of events per year (N tot ), the number of rocks hitting the road (N r ) was computed through a two-dimensional trajectory analysis, with the simulation of 5000 events, evaluating the percentage of blocks that crosses the position of the road on the fan, in a similar way to the approach proposed by Jaboyedoff at al. (2005) possible only if the rock has a volume of 0.065 m 3 or more.This choice is based on the consideration that a block impacting on a horizontal surface can create a hole comparable to its average size and that only if the hole is larger and deeper than the radius of a car wheel, it can cause a diversion of the wheel itself.For the definition of this probability, it is therefore essential to estimate the size distribution of the falling rock, in order to calculate the probability of damage to the road surface.In the example, given the distribution shown in Fig. 4, obtained from the historical catalogue, which shows that 30% of the falling rocks have a larger volume than the assumed limit, the value of P 3 is 0.3.The probability of falling rock stopping on the road (P 4) should be determined through a trajectory analysis and this value is given by analysing the stop distribution.The value P 4=0.5 has been assumed in the example.
The probability of a travelling vehicle hitting a previously fallen rock (P 5) can be calculated according to the proposal of Bunce et al. (1997) and it is linked to the possibility that the driver can see the block on the road and has the time to avoid the impact by changing trajectory or stopping the car.To evaluate this probability, it is necessary to introduce the decision sight distance (L dsd ): when a driver sees a rock on the road he must take a quick decision to either stop or swerve.The decision sight distance is the distance the vehicle travels in the time necessary to implement this decision.This parameter can be determined, for example, according to the document drawn up by the American Association of State Highway and Transportation Officials (2001) where it is linked to the type of road and to the speed of the car (Table 2), but it obviously also depends on the local geometrical conditions: for example, if the stretch of road subjected to the rockfall is just behind a curve, the probability that the driver does not have sufficient time to take the decision is high and this local condition must be taken into account to evaluate P 5. Since the example concerns a local suburban road with a maximum allowable speed of 80 km/h and no particular geometrical conditions, the value of L dsd is assumed to be equal to 270 m, according to AASHTO (2001).The P5 value can therefore be calculated as the product of the generic probability of an accident P (A) v for one vehicle and the number of vehicles travelling on the road per year (N v/a ), in a similar way as to what was done for the calculation of P 1.The probability of spatial correspondence between the rock and the vehicle P (S)' is now assumed to be a function of half the Decision Sight Distance L dsd .Equations ( 16), ( 17), ( 18) and ( 19) show the complete calculation. where: Substituting the obtained values it is possible to compute the probability of accident for a single vehicle (Eq.20) and the annual probability P 5 (Eq.21).
The probability of a fatal accident due to the impact between a moving vehicle and a fallen rock has been assumed equal to 0.1 according to Bunce et al. (1997).This value is lower that the one calculated for the "moving vehicle-falling rock" case because it takes into account the possibility that the reaction of the driver, while travelling the Decision Sight Distance, has a positive consequence.
In the eventuality that the rock severely damages the asphalt, the probability that a travelling vehicle has an accident due to the damaged road surface (P 7) has been assumed equal to 1.11•10 −2 (percentage of accidents per year) and the probability per year of death due to a damaged road surface P 8 has been assumed from the same source to be 4.9•10 −2 .These values have been obtained from an elaboration of Italian Institute of Statistics concerning the main causes of road accidents over the years 2003-2004 on the whole Italian road network.
Considering the branches of the event tree that exclude severe damage to the road surface, given the rockfall event, the rock could either stop on the road (P 9) or not (P 9'), These values correspond to P 4 and P 4', which have already been calculated (P 4=P 9=0.5;P 4'=P 9'=0.5).Finally, the two lower braches present events that have already been analysed: the probability of a vehicle having an accident due to impact with a fallen rock (P 10=P 5=3.35•10 −2 ) and the probability that this accident has fatal consequences (P 11=P 6=0.1).
The proposed approach provides 12 different paths: the probability of occurrence of each of them can be calculated from the product of each single event that constitutes the path itself.
For example, if the first path, which results in a fatal accident is analysed, it can be observed that the related probability is given by the product of the annual probability that a rock hits the vehicle (P 1) and the probability that this accident is fatal (P 2): It is possible to calculate the probability values associated to the 12 paths with the same procedure, considering not to install any protection measure against rockfall in a first stage of the analysis.The obtained results are summarized in Table 3. Summing the values of identical outcomes it is possible to obtain the annual probability of a fatal accident, non fatal accident and no accident: The advantage offered by the installation of protection measures against rockfall can be evaluated considering that this advantage is a function of the catching capacity (C) of the structure, that is, the percentage of rock that can be stopped by the protection structure with reference to its position on the slope, height and energy capacity.Of all the computed falling trajectories, only a variable percentage can be intercepted by a protection device since some blocks can fly higher than the possible height of the commercial products (usually ranging, for the net fences, between 4 m and 6 m) or the impact energy, due to the block speed, can be higher that the energy capacity of the designed protection device.These values obviously differ according to the various design choices: the position on the slope of the protection device, which is directly linked to the available space between the rock slope and the road, the device types that can be installed, with reference to the local geomorphology and the event to be faced, etc. (Peila et al., 2006).If the proposed event tree is used, it is therefore possible to compare the various choices and evaluate the obtained reduction of collective risk.
The action of the protection device is expressed by the reduction in the number of falling rocks that can involve the road (N r '): In the discussed example, which is characterized by the installation of a net fence, a catching capacity C=98% has been considered.This value is not intrinsic of the device, but depends on the local geometrical and geomechanical conditions and on the statistical evaluation of the falling trajectories.In this example, 98% of the 5000 forecasted trajectories can be intercepted by a specific net fence (which is characterised by an intercepting height and an energy capacity) installed in a specific position on the slope.It is obvious that if the height of the barrier is changed or its position is modified, the catching capacity will change.In the example N r ' becomes: N r =(1−0.98)Nr =0.02•2.5=0.05rockfall events/year (25) If these new input data are assumed to carry out the analysis, it is possible to observe that the probability that a vehicle travelling on the road is hit by a falling rock (P 1) and the probability that a travelling vehicle hits a previously fallen rock (P 5) take on the values shown below (Eq.26): The occurrence probabilities related to each path are shown in Table 4 and the total annual probabilities are: It is possible to immediately see the advantages obtained from the installation of the rockfall protection measures in the chart shown in Fig. 5.
Once the annual probability of death has been calculated (collective risk of the road and individual risk for the people travelling on the road), under natural conditions and with different designs of rockfall protection measures, the last step of the analysis should be a comparison of the computed results with reference values.This was done, for example, by Bell and Glade (2004) with reference to the Iceland regulation for the hazard zoning due to snow and landslides, by  Zischg et al. (2005), who compared the risk induced by snow avalanches with the fatality risk resulting from traffic accidents on the same type of road, by Hoek (2000), who used the death probability due to dam failures proposed by Nielsen at al. (1994) and as proposed in many different national standards and regulations.

Conclusions
The collapse of small rock fragments and of single rock blocks that detach from slopes hanging over roads and railways, is one of the most frequent hazards for public transportation systems which has to be faced and controlled by the owner of the infrastructures.Generally speaking, protection interventions against rockfalls can be considered active if they prevent instability from occurring or passive if they are designed to mitigate the effects of a previous movement, by intercepting and stopping falling rock blocks before they reach an area where they can cause damages.Prestressed wire anchors, rock bolts and grouted bars can therefore be classified as active measures since they prevent the detachment of blocks from their original position, while embankments, ditches, net fences and rock sheds are considered passive since they do not directly interfere in the process of rock detachment, but control the dynamic effects of blocks that have already been detached while moving downhill.Since in many real conditions, it is technologically and/or practically to reduce the risk to nil impossible with passive interventions and the designer can chose between different technological and geometrical options, it is necessary to have a tool that is able to allow an easy comparison of the effectiveness of the various choices, in terms of risk reduction.
The proposed approach has this aim since, by introducing in the event tree the concept of a catching capacity of the passive protection installation, which can be easily calculated with the statistical computation of falling trajectories, it is able to compute a reduction of the collective fatality risk on the studied road.Thus, the best design solution, with reference to recognized acceptable risk levels, can be chosen and a cost-benefit analysis can be carried out on the basis of quantitative values.

Table 3 .
Results of the 12 paths analysed using the event tree approach.Probability values without protection measures against rockfall.

Table 4 .
Results of the 12 path analysed using the event tree approach.Probability values with the installation of protection measures against rockfall.