Introduction

The valley formed by the Fraser River hosts an important transportation corridor between the City of Vancouver and the interior of British Columbia and other provinces in Western Canada. This corridor cuts through the Canadian Cordillera and is used by the Canadian Pacific Railway (CP), the Canadian National Railway Company (CN), and one of Western Canada’s major highways (Highway 1).

Transportation corridors through sections of the Canadian Cordillera required steep rock cuts to accommodate highway and railway alignments. Rock slope instabilities such as rock falls, slides, and topples that originate in these cuts and from natural rock cliffs can travel downslope and potentially reach and block highways and railway tracks. Mountainous regions are known to be highly susceptible to these events, the Canadian Cordillera being no exception (Gardner 1970; Gardner 1977; Whalley 1984; Spang and Rautenstrauch 1988; Hungr and Evans 1989; Evans and Hungr 1993; Dorren 2003). Hence, it is not uncommon for transportation corridors through this type of terrain to contain sections that are highly exposed to these slope instabilities (Peckover and Kerr 1977; Brawner 1978; Pierson 1992; Bunce et al. 1997; Budetta 2004; Lan et al. 2010).

Recognizing the risks associated with slope cuts in the Cordillera, CP engaged in the development and implementation of a rock slope management program in the early 1970s (Brawner and Wyllie 1975). This system has evolved into a qualitative rating system to describe the slope hazard and its likelihood of occurrence (Mackay 1997). Mitigation works (such as protection walls, ditch widening and maintenance, face stabilization and scaling) follow site inspections in the priority indicated by the rating system. This form of risk assessment and management is currently being applied. However, results from this approach are not readily amenable to comparison with other hazard assessments that the railway may employ. Hence, the need for the development of a quantitative risk assessment approach that minimizes the amount of qualitative inputs.

A quantitative risk assessment (QRA) associated with slope instabilities between milepost 2 and 15 of CP’s Cascade subdivision is developed for this study. The assessment focuses on the risk to life of running trade employees working along this section. CP’s extensive records dating back to the 1940s serve as the main input for the hazard analysis and are of significant value in the consequence analysis stage. The risk estimation considers measures of the uncertainty in the input parameters and how these are carried through the analysis to reflect uncertainty in the calculated risk values.

Study area

CP’s Cascade subdivision is located in southwest British Columbia, along the Fraser River valley, in the Canadian Cordillera. Figure 1 shows the section between mile 0 (North of Boston Bar) and mile 40 (at Hope, 150 km East of Vancouver and about 50 km North of the U.S. Border) of CP’s Cascade subdivision. This section has a long history of slope instability (Piteau 1977; Lan et al. 2007; Macciotta et al. 2011). In particular, the section from milepost 2 to 15 (along the west riverbank) accounts for 67 % of all recorded slope instabilities in a length equivalent to 32.5 % of the 64 km (40 miles). Instabilities documented along this section include rock falls, slides, and topples.

Fig. 1
figure 1

CP’s Cascade subdivision study area and geologic context

Full size image

Figure 1 presents the spatial distribution of slope instabilities recorded along the study area. Moreover, the volumes of these slope instabilities cover several orders of magnitude (Fig. 2). Slope instability records in this section date back to the 1940s. These records include date, location, and volume of the events, as well as the probable source height, weather conditions, and any site observations considered relevant by the inspector (Macciotta et al. 2011). Although these records are considered of a high quality, rock falls of small volume that can cross the railway tracks without causing damage or leaving traces of its path are not noticed and are not included in the database.

Fig. 2
figure 2

Distribution of slope instability volumes in the study area based on 340 event records along the study section that included volume information. Along the study section, rock falls are considered to have volumes up to about 30 m3 and rock slides to have volumes of 10 m3 or higher. Slope instabilities with volumes between 10 and 30 m3 have shown to potentially behave as rock falls or rock slides

Full size image

From Boston Bar to Hope (first 40 miles of the subdivision), the Fraser River lies along the junction between the Coast Mountains and the Cascade Mountains. Several orogenic episodes involved folding and faulting, metamorphism, and intrusion (McTaggart and Thompson 1967). This intense deformation resulted in complexly folded rock masses cut by north–south trending faults (Monger 1970). These faults are part of the Fraser River fault zone and are associated with broad zones of weak materials and differential weathering (Piteau 1977). The lithology along milepost 2 through 15 consists in mainly intrusive rocks (Diorites and Granodiorites) and metamorphic rocks (Schist). Shearing and alteration is common to all rock units, being intensified at contacts between units and near faults. The study area is characterized by steep slopes that have been glaciated with the highest peaks staying above the ice (Monger 1970), and significant lateral erosion by the river is evident. Figure 1 shows the geological context of the area. In this figure, the Hope and Yale faults are delineated (both part of the Fraser River fault zone). Also, the general lithology of the area is presented in Fig. 1.

Quantitative risk assessment methodology

The general methodology followed is consistent with current practice for a landslide QRA (Ho et al. 2000; Crozier and Glade 2005; Lee and Jones 2004; Fell et al. 2005; AGS 2007). The process leading to a fatal accident is modelled with the aid of an event tree analysis (ETA) as shown in Fig. 3. The ETA considers two scenarios for a moving train: (1) falling material impacts a moving train and (2) the moving train encounters a blocked track. The scenario where falling material impacts a stationary train is not considered representative of the section analyzed. Moreover, records indicate that fatal accidents have occurred only after the train derails (CP personal communication). It is then decided to simplify the analysis by considering that a fatal accident can only occur if the train derails.

Fig. 3
figure 3

Event tree used to estimate the probability of a fatal accident given a rock slope instability

Full size image

Previous studies have applied QRA methods along transportation corridors (Wyllie et al. 1980; Bunce et al. 1997; Guzzetti et al. 2004; Pine and Roberds 2005; Shamekhi and Tannant 2010). In these analyses, multiple variables influence the location, magnitude, and frequency of the hazards, as well as the likelihood and severity of the consequences. Determination of the values for these variables is associated with different degrees of uncertainty that are carried through the analysis. Even when an extensive database exists, only those events that damage or derail the train are reported. Events that can be classed as “near misses” are not included in the database. Consequently, there is a gap in the statistical record used to stochastically derive the consequence probabilities required for QRA. When such statistics are not available, subjective probabilities are often used to fill the missing gaps.

Subjective probability can be defined as an expression of personal belief about outcomes. It is a quantified measure of the degree of belief or confidence in the outcome, according to the personal state of knowledge at the time of assessment (Vick 2002). Such personal assessments are not unique and change with increasing knowledge about the situation. As a consequence, when subjective probabilities are used as input for QRA, the uncertainty related to these input probabilities can be carried forward in the analysis, without proper quantification (Fig. 4a). Accounting for the uncertainties associated to QRA inputs, and propagating them quantitatively through the analysis, would allow for a measure of uncertainty in the calculated risk (Fig. 4b).

Fig. 4
figure 4

Uncertainty associated with risk analyses input variables and risk estimations. a Input probabilities as a single value with no estimate of the model result uncertainty. b Subjective probabilities defined as a range of values and a probability density function

Full size image

You and Tonon (2012) presented an approach using approximate methods of probabilistic analysis to incorporate measures of uncertainty in risk estimation. They highlighted the uncertainty related to defining a probability density function (PDF) for variables where limited or no information is available, and they proposed the use of imprecise probabilities within event tree analysis. Imprecise probabilities allow constructing a set of PDFs. Random sets, normalized fuzzy sets, and envelopes of cumulative probability distributions are special cases of imprecise probabilities (You and Tonon 2012). This method then renders a lower and upper estimate of risk based on approximation techniques. Wang et al. (2013) presented an example of uncertainty assessment in quantification of risk related to slope instabilities. They also adopted an approximate method, a First Order Second Moment error propagation technique, which provides an estimate of the mean and variance of the calculated risk. One objective of this study is insight into the distribution of the uncertainty embedded in the calculated risks. Monte Carlo random sampling techniques and simulation consist of sampling processes over input PDFs in order to populate a mathematical expression that represents the phenomena being modelled. Values of the input variables are selected on the basis of random number generation and variable mapping according to their cumulative probability distribution. Each iteration of the simulation is statistically treated as an observation within a set of possible outcomes. This approach allows for a PDF to be fitted to the calculated values of the mathematical expression (Ayyub 2003). This approach has been applied to landslide science before. Examples of this are the analyses by El-Ramly et al. (2002) to calculate the probability distribution of the stability levels of a slope and more recently, Macciotta et al. (2014) to calculate the probability distribution of height and kinetic energy of falling rock blocks. In this study, we use Monte Carlo random sampling and simulation techniques to calculate the PDF of risk.

Upper and lower bounds of the subjective probabilities capture their uncertainty. Given the wide range of instability volumes recorded, subjective probabilities are defined as a function of this volume. A PDF is defined between the upper and lower bounds. This implies that a PDF is generated for each volume, depending on the expected subjective probability range. The model then automatically generates the input PDFs as functions of the instability volume analyzed. Then, a Monte Carlo simulation routine solves the ETA a defined number of iterations. The iterations of the simulation randomly pick values of the input parameters following their probability distribution. The solutions of the ETA for all iterations are recorded and presented as a probability distribution of results. Figure 5 shows the iteration steps of the Monte Carlo simulation to estimate the probability of a fatality in this study.

Fig. 5
figure 5

Monte Carlo simulation process to estimate the probability of a fatality and the risk to life of a crew member

Full size image

The annual probability of fatality is calculated following the Binomial Theorem (Bunce et al. 1997) as:

$$ P\left[\mathrm{fatality}\right]=1-{\left(1-P\left[\mathrm{fatality}:\mathrm{S}\mathrm{F}\right]\right)}^N $$

where P[fatality] is the annual probability of fatality, P[fatality:SF] is the probability of a fatal accident given a slope cut instability volume, and N is the number of slope instabilities each year.

The risk to life of a crew member is calculated as:

$$ R=\frac{\left(P\left[\mathrm{fatality}\right]\times DR\times C\right)}{E} $$

where:

R is the risk to life of a crew member, DR is the ratio of crew members killed given a fatal derailment occurs, C is the number of crew members per freight train, and E is the total number of people employed as freight train crew that travel through the section.

For this study, E is estimated at 500 employees, DR is estimated as 0.87 based on records of fatal derailments (Bunce 2008), and C is set at 2 crew members.

Hazard analysis

Slope instability volumes and frequencies

Rock falls, topples, and slides along the slope cuts in the study section are ubiquitous and frequent, and for purposes of the QRA presented in this study, they are treated statistically and differentiated by volume and not by failure type. Differentiation by failure type would have been necessary if precursory factors or triggering mechanisms were to be included in the analysis.

The database of the volume and the temporal and spatial occurrence of the rock instabilities between miles 2 and 15 is used to obtain cumulative probability distributions of the annual number of slope instabilities and their volumes. These distributions are presented in Fig. 6. The records of annual number of slope instabilities are approximated with an inverse Gaussian distribution (Fig. 6a), and their volumes are approximated with a Pearson distribution (Fig. 6c). The relationship between the quantiles of the model results and the fitted probability distribution can aid in assessing the goodness of the distribution fit. A quantile “N%” can be expressed as the value that divides a set or a distribution into two subsets with N% and (1-N%) elements, respectively. The plot of the quantiles of a set of values against the quantiles of a fitted distribution is a Q-Q plot. The Q-Q plot for a perfect distribution fit is a line with a slope of 45°. The more the plot deviates from this line, the more likely the distribution fit is not representative of the data set. Figures 6b and d present the Q-Q plots for the distributions fitted to the annual number of slope instabilities and their volumes, which suggest good fits between records and the distributions adopted.

Fig. 6
figure 6

Cumulative probability distribution of the annual number of slope instabilities

Full size image

Probability that the instability reaches/blocks the track

CP’s records include events where the instability volume was encountered blocking the tracks and those caught within a ditch or behind protective structures. Events of limited volume that fall and cross the railway tracks without damage or evidence of their paths are not noticed and, thus, not included in the database. It is important to consider this limitation when evaluating the probability of a train being hit by a falling rock or debris, as the database could be underestimating the potential for such outcome. The fraction of the instabilities blocking the track can be estimated from the database, but the fraction of instabilities with the potential to impact a moving train can only be roughly approximated from the database. The ratio between the number of records where the instability volume was encountered blocking the tracks to the total number of slope instabilities noticed is given for three slope instability volume ranges in order to assess any volume dependency (Table 1). Increasing the number of event volume ranges limits the number of records within each range to a level where ratios calculated become unreliable.

Table 1 Ratio of failure events blocking the track to total failures—CP’s Cascade subdivision milepost 0 to milepost 40
Full size table

The results in Table 1 suggest that the probability of an instability reaching the track increases with increasing instability volume. Hence, the upper and lower bounds of the probability distribution are defined as continuous and volume dependent as illustrated in Fig. 7.

Fig. 7
figure 7

Conditional probability distribution for an event reaching the track given a slope instability occurs

Full size image

There are not enough incident records of volumes less than 0.1 m3 to confidently extrapolate the linear assumptions shown in Fig. 7. Consequently, the probability distribution is truncated at a minimum of 0.3 for these smaller volumes. Also, the few instability volumes larger than 1000 m3 all resulted in blocked tracks. It is therefore assumed that for volumes over 1000 m3, the probability of the track being blocked is 100 %. As it was previously discussed, the track blocked ratios in Table 1 are considered approximations of the probability that the instability volume blocks the track. This uncertainty is reflected in the choice of upper and lower bounds shown in Fig. 7. This information is also used as a rough approximation of the potential for a falling block or debris to impact a moving train.

Consequence analysis

Two outcomes are considered after the instability volume reaches the track: the material impacts a train or the material blocks the track. These then become mutually exclusive events, and the sum of their probability, given the material reaches the track, is equal to one.

Probability that the slope instability impacts a moving train

Given a slope instability occurs, each iteration of the simulation approximates the probability that the instability impacts a freight train by estimating the probability that the instability and the train coincide in space. This spatial probability is estimated as:

$$ P\left[S\right]=\frac{\left(L\times T\right)}{\left(V\times 24\right)} $$

where P[S] is the spatial probability of the falling material coinciding with the moving train, L is the average train length in km, T is the number of trains per day, and V is the train speed in km/h. Table 2 presents the input upper and lower bounds used to calculate P[S]. This equation assumes that the length of the train is significantly larger than the dimension of the slope instability and that each event can only affect one train. This is consistent with the length of the trains along the section of study, the fact that there is no double track along this section and that operators of trains in the area will receive warning if an incident occurs.

Table 2 Input parameters used to estimate the spatial probability P[S] of a slope instability coinciding with a moving train
Full size table

A uniform probability distribution is assumed for the values of L and T within the upper and lower bounds presented in Table 2. Note that this calculation considers constant train frequency and an even slope instability frequency throughout the day and throughout the year. While this is not a representative of the site, this simplification is a valid approximation for the evaluation of annual average risks. The posted track speed of 40 km/h assumes no previous slope instabilities reported at the time the train travels through the section and no slow orders are in place.

Probability that a freight train encounters a blocked track

The probability of a freight train encountering a blocked track depends on the instability not impacting a moving train while travelling downslope. This is estimated as (1 - P[S]) for each iteration of the simulation. This neglects those blocks of limited volume crossing the railway tracks that are not noticed and, hence, not included in the instabilities database. Events that leave no trace of their path and cross the tracks are considered not to have enough kinetic energy to derail a train at impact. There could be considerable damage to a train car or locomotive, however, not likely to pose a noticeable risk to crew members (probability of spatial intersection between one of these events and a crew member would be quite small if we follow the equation for P[S] with a length equal to the size of the falling block). Approximating the probability of a freight train encountering a blocked track as (1 - P[S]) is therefore considered adequate for the QRA presented in light of the available information.

There is a possibility that the first train or vehicle reaching the blocked track is not the freight train considered in this study. Because the freight train traffic is much more frequent than other traffic (passenger train, high rail, maintenance equipment), it is assumed that the freight train is the first to impact the slide volume.

Probability that the hazard detection system is present and operational

The Hazard Detection System (HDS) consists of a series of wire fences along the section, between the railway track and the cut slope. A sketch of the HDS is presented in Fig. 8 in the context of two types of slope instability, rock falls (Fig. 8a) and wedge slides (Fig. 8b). The spacing between wires is about 20 to 25 cm, and the fence height varies between less than a meter and up to 2 m in some sections. When a section of track is blocked, it is expected that the material blocking the track would have broken one or more of these wires in its path. This is detected by the system, and the nearest track circuit signal shows that the track is occupied.

Fig. 8
figure 8

Hazard Detection Systems (HDS). Sketch of the HDS for rock fall type of slope instability (a), in the context of sliding type of slope instability (b), and views of the HDS installed at mile post 3.4 (c) and 11.4 (d) of CP’s Cascade subdivision

Full size image

The probability that the HDS would detect the volume depends on the ratio of length of HDS to the total section length and on the total number of days per year, the HDS is active. The HDS is installed along mileposts 2 through 15 of the study section. Considering the time required for maintenance and repairs, the probability that the HDS is present is between 0.9 and 1 for any given year. A uniform PDF was defined in this range.

Probability that the HDS is activated

The probability that the HDS is activated depends on the instability volume, the spacing between wires, and the height of the HDS relative to the slope geometry. An example of the HDS layout on the site is presented in Fig. 8. Figure 8c and d show views of the HDS installed at mile post 3.4 and 11.4, respectively.

Insufficient records include information on HDS activation, whether the material was encountered blocking the track and the instability volume, for a reliable estimate of the HDS activation probability. Based on the characteristics of the HDS and the slopes along the study area, we judged the HDS activation probabilities. These adopted probabilities and their justification are presented in Table 3. Continuous upper and lower boundaries for the probability distributions that the HDS is activated are based on Table 3 and are presented in Fig. 9.

Table 3 Subjective probabilities for the HDS activation conditional probability
Full size table
Fig. 9
figure 9

Boundaries for the HDS activation conditional probability distributions described in Table 3

Full size image

Probability that a warning is issued and train speeds

When a section of the HDS is activated, the nearest track circuit signal shows a track as occupied and activates a slow order. This implies that the first train to encounter the blocked track receives a warning only if there is a track circuit signal between the activated HDS and the train. The section between track circuit signals is known as the signal block. We assume that if the train is outside the signal block where the event occurs, and the HDS is activated, the warning is effective.

The probability that a warning is issued is approximated by the complement of the probability that the train is inside the signal block when the event occurs:

$$ P\left[\mathrm{warning}\right]=1-P\left[\mathrm{SignalBlock}\right]=1-\frac{B\times T}{V\times 24} $$

where P[warning] is the probability a warning is issued given the HDS is activated, P[SignalBlock] is the probability the train is inside the signal block when the event occurs, B is the distance between the activated HDS and the nearest track circuit signal, T is the number of trains per day, and V is the train speed in km/h. B is not known but can be conservatively estimated as the entire length of the signal block or as half this length to account for an average distance. In this study, B is assumed between 0.5 and 1 km.

Table 4 presents the input parameters used to calculate P[warning]. Uniform probability distributions are adopted for the values of B and T within the upper and lower bounds. The input values characteristic of the site render a high warning probability when the HDS is activated and show limited variation.

Table 4 Input parameters used to estimate the probability of a warning (P[warning]) being issued given the HDS is activated
Full size table

The analyses assume that if warned, the train will slow down to a restricted speed. This restricted speed, or slow order, is at a maximum half the track speed (20 km/h). Records show that most slow orders in this section are to keep speeds to about 16 km/h, which is consistent with the above assumption. All other branches of the ETA with unsuccessful warning outcomes consider the train to be travelling at track speed when encountering the blocked track.

Conditional derailment probability—slope instability impacts a moving train

When the slope instability impacts a moving train, the derailment probability is a function of kinetic energy. This energy depends on the instability mass, velocity, and how it disaggregates and reaches the track. A comprehensive analysis of these factors is complex and requires information rarely available. Furthermore, unless the impact caused a derailment or excessive damage, it may not be noticed until the train reaches the next inspection site. Hence, the impact record is incomplete.

In this study, subjective upper and lower bounds probabilities are developed based on the limited available data. According to Bunce (2008), CP records indicated that rock volumes less than 1 m3 have not caused a derailment after impacting a moving train. Hence, for instability volumes less than 1 m3, a residual derailment conditional probability is judged as 0.01. Based on the historical records, this probability increases with increasing volume. For volumes over 40 m3, the derailment probability, should an impact occur, approaches one. The wide range of subjective probabilities adopted for slope instability volumes between 1 and 40 m3 reflects the uncertainty at this level of the ETA. Figure 10 shows the adopted upper and lower bounds for the derailment probabilities given the instability volume impacts a moving train.

Fig. 10
figure 10

Elicited upper and lower bounds for the derailment conditional probability distributions given falling slope debris impact a moving train

Full size image

Conditional derailment probability—train encounters a blocked track

The distance between the train and the farthest visible section of rail is referred to as the sight distance. The sight distance required for a train to stop is the stopping distance. The ratio of sight distance to stopping distance can aid in estimating the probability that the train stops before impacting a blocked track. A ratio of 1 indicates that there is just enough distance between the train and the blocked section for the freight train to come to a stop. Lower ratios indicate that the train is not able to stop but can reduce its speed.

The stopping distance is a complex field and depends on factors such as train length, weight, type, brake force and initial speed, alignment grade and curvature, interaction between the wheels and track, and weather conditions (Barney et al. 2001; Loumiet and Jungbauer 2005; Bunce 2008). Loumiet and Jungbauer (2005) presented an analysis of the stopping distance for a freight train consisting of 100 loaded cars and 4 locomotives, a train of similar characteristics to the average freight train considered in this study. Following Loumiet and Jungbauer calculations, a slightly higher stopping distance of 400 m is adopted for trains travelling at track speed and 250 m for slow order.

In the study area, the average visible track length ahead of the locomotive is about 1 km. This, when compared to the stopping distances, suggests that the crew have enough time to react and stop the train if they observe a blocked track. However, about 10 % of the section contains curves that decrease sight distances to about 200 m, so the sight distance to stopping distance ratio becomes less than one.

Judgment is required to account for the volume of material blocking the track. In this scenario where the train impacts a blocked track, we judge that up to 0.1 m3 of material poses a residual probability of derailment (0.01) if the train is travelling at track speed. As when 100 m3 or more material blocks the track, the chance for a derailment approaches certainty, given the impact is at enough speed. Subjective probabilities between 0.1 and 1 are adopted for material volumes of about 10 m3. These subjective probabilities are estimated to be between 1 and 2 orders of magnitude lower for scenarios where the train is travelling at slow order.

The sight distance to stopping distance ratio analysis and the judgment about the influence of the material volumes blocking the track in the derailment probability are used to elicit upper and lower bounds for the subjective probabilities of derailment given a train encounters a blocked track (Fig. 11). Uniform probability distributions for each volume are adopted between the upper and lower bounds shown in Fig. 11.

Fig. 11
figure 11

Subjective probability that derailment occurs after a train reaches a blocked track a at track speed of 40 km/h and b at a slow order of 20 km/h

Full size image

Probability of fatality should a derailment occur

Bunce (2008) presented an analysis of CP’s records showing that only 3 out of more than 230 mainline derailments resulted in fatal accidents. This suggests that on average, 1.3 % of all derailments result in a fatal accident. Bunce noted that all fatal derailments had occurred when the locomotive derailed and fell into a water body and also suggested that the probability of a fatal accident given a derailment in mountainous terrain would be higher than average. However, due to the history of slope instability in the study area, the track speed is limited to 40 km/h, lower than other sections along the Canadian Cordillera. Table 5 shows the adopted values for the conditional probability of fatality used to populate the ETA. These values are based on the analyses presented by Bunce (2008) and consider the particular conditions along the study section. Following the approach in Bunce (2008), upper and lower bounds corresponding to the train travelling at slow order speed are adopted as one order of magnitude lower than those for track speed.

Table 5 Adopted conditional probability of fatality given a derailment occurs
Full size table

Simulation and results

Defining the number of iterations for the simulation

The outcome of the Monte Carlo simulation applied to the event tree is a normalized histogram of observations that can be approximated using a PDF for the estimated risk values. Estimates of the mean, mode, and standard deviation for the resulting PDF can be compared against selected risk evaluation criteria. The random nature of the approach means that point estimates derived from the resulting PDF vary for different simulations using the same model. Incrementing the number of iterations increases the number of results to a larger statistical sample and reduces this variability. Ten simulations for each of four different numbers of iterations are evaluated for a total of 40 simulations. Results are plotted in Fig. 12 in terms of the mean and variance of the probability of fatality for each simulation. We decided to work with the results obtained for a simulation with 100,000 iterations, given its variability is considered negligible relative to the magnitude of the results (Fig. 12).

Fig. 12
figure 12

Comparison of mean and variance of the calculated probability of fatality from the Monte Carlo simulation for increasing number of model iterations

Full size image

Visualization and interpretation of risk distributions over several orders of magnitude

The estimated risk values in the Monte Carlo simulation covered 5 orders of magnitude. This spread reflects the input uncertainty carried through the analysis. A PDF of such results would show a long tail towards the higher magnitudes (Fig. 13a). Adopting the mode of the PDF could allow assessing the central tendency of the results; however, the shape of the distribution towards the lower values and in the proximity of the mode remains hidden by the scale of the plot.

Fig. 13
figure 13

Diagram of Monte Carlo simulation results covering several orders of magnitude in normal scale (a) and in semi-logarithmic scale assuming a normal distribution (b)

Full size image

In order to analyze the central tendency and variability of the estimated risk, the calculated PDF is plotted using a base-10 semi-logarithmic scale. Given the PDF in the semi-logarithmic scale approximates a normal distribution (Fig. 13b); a mean and standard deviation could then be calculated for the base-10 logarithm of the estimated risk values. This method minimizes shifting of the calculated mean, while the mode suffers no change, and allows for a better assessment of the distribution. In this study, the mean and the standard deviation calculated using the base-10 logarithm of the risk values are denoted as m and s, respectively.

It is important to note that this approach treats the orders of magnitude of risk as risk categories, minimizing the effect of the actual estimated values when calculating the point estimates. However, we believe that the approach is compatible with how probability is perceived at orders of magnitude below 10−1 and compatible with how evaluation criteria are expressed. Further, it allows for a measure of the uncertainty in the estimated risks.

Using partial results for potential model calibration—derailment probability

The model setup presented in Figs. 3 and 5 allows for calculation of the derailment probability as a partial result of the simulation. The calculated annual probability of derailment is shown in Fig. 14. This section compares these partial results to historical derailment records to increase the confidence on the validity of the model. Historical records of the study area indicate one freight train derailment occurred between 1975 and 2009, a frequency of 1 in 35 years (average 0.029 occurrences annually). What is not considered in this simple frequency is the number of trains per year; fewer trains used the corridor in the early years. We judge that train frequencies have been similar to the ones considered for analysis since 1980. The derailment frequency would then represent 1 derailment in 20 to 30 years or an average of 0.033 to 0.05 annually. Figure 14 shows the derailment annual probability distribution and the historical derailment frequencies considering similar train traffic for the periods described above. The derailment annual probability mean value estimated by the model is 0.04 with a mode of 0.02, consistent with the statistical data.

Fig. 14
figure 14

Monte Carlo simulation results for the annual derailment probability

Full size image

Analysis of the estimated derailment probability variation is less straightforward. The probability of derailment occurring within a period of time depends on the annual frequency of derailment and can be expressed through the binomial theorem as:

$$ P\left[\mathrm{derailment}\right]=1-{\left(1-F\right)}^Y $$

where F is the derailment annual frequency and Y is the period of time for which the derailment probability is being estimated. The derailment annual frequency represents the average distribution of freight derailments in time and is estimated as the inverse of the average time between derailment occurrences. Figure 15 presents the probability of derailment for different time intervals (Y). The estimates consider derailment annual frequencies (F) of 1 in 2 years, 1 in 500 years, and the frequency estimated from records of 1 in 20 to 30 years. Figure 15 highlights the time period between 20 and 30 years. As expected from the binomial theorem, the probability of derailment occurring in a period of 20 to 30 years is about 0.64 if the annual frequency is considered as 1 derailment every 20 to 30 years.

Fig. 15
figure 15

Probability of derailment in different time periods considering annual derailment frequencies of 1 in 2 years, 1 in 20 to 30 years, and 1 in 500 years

Full size image

Figure 15 shows how the probability of derailment in a 20 to 30-year period is almost certain when considering an annual derailment frequency of 1 in 2 years, and it is significantly low when considering an annual derailment frequency of 1 in 500 years. This suggests that given a derailment was recorded in a 20 to 30-year period, it is very unlikely that the annual derailment frequency is higher than 1 in 2 years or lower than 1 in 500 years. The Monte Carlo simulation estimation of the derailment annual probability in Fig. 14 shows that the distribution of results between the mean and twice the standard deviation (m − 2 s and m + 2 s) lies within annual frequencies of 1 in 2 and 1 in 500 years.

Following this methodology, the model is assessed to have enough accuracy in light of the available information for the estimation of derailment probabilities. It should be noted that this approach showed the potential for model calibration as data increase with time.

Risk calculation

Risk was calculated in terms of the risk to life for a crew member and following the model setup presented in Figs. 3 and 5. Figure 16 shows the distribution of the risk to life for a crew member. Also shown are the selected risk evaluation criteria and common risks. The mean and mode of the estimated individual risk PDF are 3.6 × 10−6 and 3.4 × 10−6, respectively. The mean annual probability of fatality along the section (probability of at least one fatal accident), or total risk, was estimated at 2 × 10−3.

Fig. 16
figure 16

Monte Carlo simulation estimate of the risk to life of the average crew member. (1) Derived from the 2007 age-standardized mortality rates for the Canadian population (Statistics Canada 2010). (2) Data from Baecher and Christian (2003). (3) Porter et al. (2009) suggestion that the incremental risk is low if it does not exceed 0.2 % of the Canadian age-standardized risk of loss of life. (4) HSE (2001). (5) ANCOLD (2003). (6) ERM (1998)

Full size image

Risk evaluation

Society’s risk perception and tolerance vary between different regions depending on the social, cultural, and economic context (Morgenstern 1995; Finlay and Fell 1997). The risks estimated in this chapter are compared against widely used risk evaluation criteria. Even though these criteria were proposed for other locations and contexts, they are considered applicable for illustrative purposes.

The individual risk evaluation criteria selected for comparison are those developed for people living in landslide prone areas in Hong Kong (ERM 1998), risks associated with dam failures in Australia (ANCOLD 2003), and the criterion proposed for land use planning around industries in the UK (HSE 2001). The criterion proposed by HSE (2001) was included given its wide spread application and because it proposes risk criterion for workers.

The mean (m) of the estimated risk to life for the crew (Fig. 16) is 3.6 × 10−6. This value is lower than the tolerable limit of 10−3 set for workers in the UK (HSE 2001). It is also lower than the tolerable limit of 10−4 set for the public exposed to landslide phenomena in Hong Kong (ERM 1998) and associated with dam failures in Australia (ANCOLD 2003). Figure 16 also shows that the risk value corresponding to the mean plus twice the standard deviation (m + 2 s) is 8 × 10−5. Statistically, 97.7 % of the risk values in the PDF are lower than this value, which was also below the tolerable risk criteria selected.

According to Fell et al. (2005), the International Society of Soil Mechanics and Geotechnical Engineering (ISSMGE) Technical Committee on Risk Assessment and Management defines individual risk to life as the increment of risk to the individual in addition to the everyday risk if the hazard was not present. In this regard, Porter et al. (2009) estimated that an increase in individual risk of 1 × 10−5 would represent an increase of less than 0.2 % over the average Canadian risk to life, which could be considered as low. It is noted that the mean estimated for the individual risks is 3.6 × 10−6 and, hence, plots below this value.

The estimated risks, however, are above the acceptable limits set for workers by the HSE (2001). This evaluation indicates that the risks between milepost 2 and 15 of the Cascade subdivision are within the As Low As Reasonably Practicable (ALARP) zone and measures are required to minimize the risks posed by the slope hazard, should the benefits outweigh the cost of mitigation. This conclusion is not unexpected, for this section is a highly hazardous one, where considerable risk mitigation measures, rock fall detection fences, ditch cleaning, slope scaling, are used, thus complying with the ALARP principle.

Conclusion

The risks from slope instabilities between mileposts 2 to 15 of CP’s Cascade subdivision are estimated using an event tree analysis. The lack of statistical data to populate some branches of the analysis requires elicitation of subjective probabilities. Upper and lower bounds are estimated for these probabilities to account for the uncertainties of these probabilities and a Monte Carlo simulation technique used to propagate the uncertainties through the analysis.

The estimated risk probability distribution shows normality when plotted using a semi-logarithmic scale. Calculation of the mean and standard deviation uses the base-10 logarithm of the estimated risk. This method minimizes the influence of the risk values when calculating the central tendency and its variability and treats each order of magnitude as a risk category. This approach is compatible with how risk is perceived when dealing with several orders of magnitude. It is also compatible with how risk evaluation criteria are expressed, while further allowing for the uncertainty in the estimated risk to be measured.

Unmeasured uncertainties associated with the upper and lower subjective probability limits are still present in the results. It is also noticed that other sources of uncertainty, such as model uncertainty, could still represent the major source of error. In this regard, the validity of the model could be assessed to a certain extent by comparing the model estimations at different levels of the ETA against available data. In this study, the model derailment probability is compared against derailment statistics in the section. This also opens the possibility for model calibration and upgrade in light of new data.

The low estimated individual risks in this analysis correspond to the short period of time each individual spends in the study section. The total risk associated to slope hazards along this section (2 × 10−3) is distributed through a large number of freight trains and their crew. This renders lower individual risks. If reduction of the total risk was to be considered, mitigation measures should focus on lowering the probability of a fatal accident. Site inspections, scaling works, rock fall detection fences, ditch maintenance, and protective walls are all in place at the site. These either reduce the hazard frequency or the consequence probability and, hence, reduce the total risk in the area.

The simple yet comprehensive analysis presented is readily applicable. It demonstrates a QRA methodology applied to a section of track that has a substantial slope instability database. QRA for such conditions can be a valuable tool for decision-making. Reviews of the analyses should be carried out at regular intervals and probabilities updated in light of new information. As more experience is gained with the application of the QRA process, it may prove to be a suitable tool for risk management of many aspects of railway operations.