1 Introduction

Recent earthquake events have highlighted the importance of resilience of structures and infrastructure systems. Society is expected to recover from a major earthquake event as soon as possible thereafter. However, it is impractical and impossible to design buildings and infrastructure to be completely earthquake-proof. Even if building structures were designed in conformance with the best standards and practices in the world, there is still a risk of failure or collapse in an extreme earthquake event, due to the uncertainties in material properties and actual ground motion characteristics (Chandler 1997; Tsang 2008, 2011). Hence, the performance requirements in seismic design codes and safety policy should be defined in terms of the residual risk of structural collapse, level of damage and loss, as well as the expected life-cycle costs (Wiggins 1972; Ang and de Leon 1995; Bommer and Pinho 2005; Weatherill et al. 2010; Liel and Deierlein 2012; Porter 2014; Dolšek 2015).

In the last decade, there have been proposals about incorporating various measures of residual risk of individual building structures in the performance goals of earthquake-resistant design. A comprehensive review can be seen in Douglas and Gkimprixis (2018). The 2012 edition of the International Building Code (IBC) (adopted principally in the United States) and the 2010 edition of the structural design standard ASCE/SEI 7 were the first to set out risk-targeted performance requirements for seismic design of different importance or occupancy categories of building structures (Luco et al. 2007). It is stipulated that the collapse risk (probability) of an ordinary building shall be limited to lower than 1% in 50 years (i.e. the notional lifetime of a building) (or an annual probability of exceedance of 2 × 10−4), when the building is designed in accordance to the risk-targeted maximum considered earthquake (MCER) ground motion (as described in FEMA P-750 report, prepared by BSSC 2009), in contrast to the previous editions that were based entirely on the return period of design ground motion without considering the seismic risk of structures. Meanwhile, the probability of collapse should be limited to 10% under the MCER action. Also, recommendations for the acceptable level of failure probability of an individual building has been put forward by Tanner and Hingorani (2015) and Tsang and Wenzel (2016) which can be used as a performance objective in seismic design.

For guiding the future revision of Eurocode 8, Dolšek (2015) has contemplated a set of risk-based performance objectives for seismic design of buildings and Dolšek et al. (2017) have further proposed a decision model that contains important parameters for risk-based seismic design of buildings. Apart from target collapse risk, target expected economic loss for a given period of time can be used for controlling potential damage due to earthquakes. An iterative risk-based structural design procedure has also been developed (Sinković et al. 2016). Meanwhile, risk-targeted maps have been developed for mainland France (Douglas et al. 2013) and Romania (Vacareanu et al. 2018), and a preliminary study has been conducted towards developing such a map for the whole Europe (Silva et al. 2016).

On the other hand, there are attempts to evaluate structural design requirements or safety policy by employing building-based fatality risk limits using a frequency–number (F–N) curve (Tanner and Hingorani 2015) and a hypothetical scenario-based F–N diagram for a group of identical (non-ductile concrete frame) buildings subjected to a uniform strong shaking (Liel and Deierlein 2012). The F–N curve/diagram is a plot of the annual rate (or frequency), F, of exceeding N fatalities in one earthquake, typically plotted on a double logarithmic scale.

The aforementioned risk-targeted or risk-based design requirements are mainly based on collapse risk or probable loss (economic or fatality) in a single building or a group of identical buildings. These are certainly excellent attempts to provide a more scientific and rational basis for the safety level of a structure and an individual. However, in these studies, there is no indication of the consequences to society. An initial attempt by Crowley et al. (2012) has been made to evaluate societal risk in a probabilistic manner by obtaining a recurrence relationship for economic loss. The outcome can be used for the calibration of codes for performance-based design.

The authors of this paper have recently proposed a semi-probabilistic procedure for developing a societal risk function based on loss modelling of earthquake scenarios that are consistent with a wide range of the probabilistic hazard using the Greater Melbourne Region as a case study (Tsang et al. 2018). The procedure is linked to the current format of hazard information and is transparent, which helps communicate risk to the practicing engineering community and policy makers.

Once the societal risk function is available, it provides an indication about the level of risk or the amount of loss in a probabilistic manner. An important missing link would then be a guiding principle or a practical approach that sets forth safety requirements in a society, such that the actual risk function can be benchmarked against it. This paper aims exactly at this and attempts to put forward a universal and practical scheme for determining regulatory F–N functions with the consideration of a tolerable level of individual fatality risk in earthquakes and the total population of the selected region, which can be suitable for adoption in a public safety regulation or guideline. The proposed approach is then applied to Melbourne, Australia, in a case study. The proposed scheme should also be applicable to other natural hazards and for safety engineering applications generally.

2 Earthquake fatality as a risk measure

Life safety and mortality control is always a major performance objective in the structural design of an individual building or is a public safety requirement for society. It would be especially true if the general public is engaged in the decision-making process. Article 3 of the Universal Declaration of Human Rights drafted by the United Nations Commission on Human Rights guarantees that ‘Everyone has the right to life, liberty and security of person.’ This underlines the fundamental rights to personal safety for all individual human beings. There are indeed both the moral and legal obligation for the governments, property developers, engineers and builders to construct buildings and civil engineering facilities that provide adequate level of protection.

In order to illustrate whether the stipulated requirements in IBC-2012 and ASCE/SEI 7-10 are adequate for mortality control or not, Fig. 1 shows the annual individual fatality risk, in the unit of micromorts (i.e. mortality rate of 10−6), in buildings designed in conformance with IBC-2012 and ASCE/SEI 7-10. These were estimated based on the conditional probability of death given collapse of structure through an analysis of casualty data in the HAZUS Technical Manual (FEMA 2012). It is seen that the risk of death varies from 0.5 micromorts in timber and steel light frame to 4 micromorts in low-rise concrete structure with unreinforced masonry (URM) infill walls. Detailed calculations can be found in Tsang and Wenzel (2016).

Fig. 1
figure 1

Estimated annual individual fatality risk (in micromorts) in HAZUS categories of buildings that are designed in conformance with the collapse risk requirement in IBC-2012 and ASCE/SEI 7-10

Full size image

A benchmark level of annual individual fatality risk of 10−6 (one micromort) is superimposed onto Fig. 1. Such a value has been commonly recommended as the tolerable risk limit by various organisations and documents, such as, ISO 2394:1998 (ISO 1998), Eurocode EN1990:2002 (CEN 2002), The Ministry of Housing, Spatial Planning and the Environment (VROM) of the Netherlands (Ale and Piers 2000), U.S. National Academy of Engineering as proposed for The Long Beach City Council, California (Wiggins 1972). This tolerable risk limit has been well supported by historical mortality data caused by natural hazards in the U.S. (Starr 1969, 1972). A brief review of the relevant documents has been given in Tsang and Wenzel (2016).

Collapse risk assessment for buildings has been conducted by Haselton and Deierlein (2007) and Liel and Deierlein (2008). These studies have provided an insight about the expected level of safety and the residual risk of both ductile (code-conforming) and non-ductile (pre-code) concrete frame buildings in California, U.S. The number of fatalities has also been estimated (Liel and Deierlein 2008). As shown in Fig. 2, the annual individual fatality risk in ductile structures is estimated to be around 2–18 micromorts, whereas the risk in non-ductile structures is around 30–420 micromorts, which is significantly higher than the tolerable level of one micromort.

Fig. 2
figure 2

Estimated annual individual fatality risk (in micromorts) in broad HAZUS categories of buildings that are designed in conformance with the collapse risk requirement in IBC-2012, in comparison with the estimates from the seismic performance assessment studies for California, U.S. (Haselton and Deierlein 2007; Liel and Deierlein 2008), and Melbourne, Australia (Tsang et al. 2016; Hashemi et al. 2017)

Full size image

Similar collapse risk studies have also been conducted for typical soft-storey buildings with precast or in situ reinforced concrete columns under a low axial load ratio located in the low-to-moderate seismicity Melbourne, Australia (Tsang et al. 2016; Hashemi et al. 2017). The annual individual fatality risk is estimated to be around 0.1–3 micromorts for a wide range of site conditions, as shown in Fig. 2, which is generally below or close to the tolerable level. All these results indicate that the actual individual fatality risk with the existing building stocks would likely exceed the tolerable risk limit of one micromort, particularly in regions of high seismicity.

Apart from assessing the fatality risk to an individual person in a building, the evaluation can also be assessed on a national and global scale. Using the CATDAT Damaging Earthquakes Database (Daniell et al. 2011) and the population at the time of each event from the national censuses, the ratio of deaths to the census population in each year can be calculated. The annual mortality rates of each country since 1900 are then averaged and presented in the unit of micromorts in Fig. 3. It can be seen that such a tolerable limit of one micromort was indeed exceeded in many seismically active countries historically. The historical implications of this limit and the uncertainties in death tolls were discussed in Daniell et al. (2017, 2018). There is an urge to enhance the overall earthquake safety level on the global scale.

Fig. 3
figure 3

Global view of average annual earthquake mortality rate (in micromorts) based on CATDAT Damaging Earthquakes Database (Daniell et al. 2011). Black outline indicates a value above one micromort

Full size image

In order to control the fatality risk in all categories of buildings to the same tolerable level (one micromort), a set of target collapse risk limits for the structural design of (ordinary) buildings has been put forward in Tsang and Wenzel (2016). For example, the proposed annual risk limit for concrete buildings ranges from 0.5 × 10−4 to 1.5 × 10−4. As the definition of “collapse” in IBC-2012 and Tsang and Wenzel (2016) is consistent with that of the “Complete Structural Damage” state in HAZUS, or the “Collapse Prevention” level in FEMA Publication 273 (ATC 1997), or the “Near Collapse” level in Eurocode—Part 3 (CEN 2005) and the Vision 2000 document (SEAOC 1995), the corresponding limiting risk of real collapse would be in the range of 7 × 10−6–8 × 10−6 (Tsang and Wenzel 2016). When it is compared with the annual collapse rates of concrete buildings, 2 × 10−6–10 × 10−6 in Italy (1980–2009) and 1 × 10−6–2 × 10−6 in Greece (1978–2003) (Douglas and Gkimprixis 2018), estimated based on the Cambridge Earthquake Impact Database (CEQID), the collapse risk of concrete buildings in Italy might be considered too high.

Annual collapse risk limits could be applicable to the design of new buildings; however, not all countries have seismic codes, whilst different countries are at different stages of earthquake protection, whether the codes are part of law, enforced or ignored. As of 2018, 166 out of 238 nations or regions have some form of seismic code or zonation (see Fig. 4), but they are usually not implemented for all types of buildings (see Fig. 5), given the large number of non-engineered building types worldwide and over 530 versions of codes and updates that have occurred formally worldwide since 1900 (Daniell 2015). It is also acknowledged that there is a strong correlation between public sector corruption and the number of deaths in major earthquakes (Escaleras et al. 2007; Ambraseys and Bilham 2011) and other natural hazard events (Alexander 2017; Escaleras and Register 2016).

Fig. 4
figure 4

Number of nations with a seismic design code or zonation (1900–2018)

Full size image
Fig. 5
figure 5

Percentage of buildings in each country that should have been built under a seismic code (reproduced from Daniell 2015)

Full size image

From the public safety perspective, it would be desirable to achieve a tolerable level of structural safety by imposing more stringent safety requirements on the design of new buildings as soon as possible. However, given the low building replacement rates especially in well developed countries, the pace of improvement could be slow, unless strengthening and retrofitting strategies are enforced and implemented widely on existing structures. Hence, the societal risk level should be evaluated in order to inform policy making regarding the required structural safety level and the need for seismic retrofitting. This paper addresses exactly this issue.

3 Proposed societal risk criteria

Recent studies have focused on setting target collapse risk limits for seismic design of individual buildings. Such a low level of collapse risk for a single building is probably considered acceptable; however, as there are numerous buildings in the affected region of a major earthquake event, the potential consequence and impact to society has to be taken into account in the evaluation of the safety level of our engineered structures. In this section, a methodology is put forward for evaluating the safety level of building stocks in a region, which can be used for justification of a seismic retrofitting policy or a required change of the design code level. Section 3.1 introduces and reviews the benchmark format of F–N functions in existing regulations for examining industrial risk. The huge discrepancies between existing regulations and the problems of using them are revealed and discussed. Section 3.2 presents the key formulations and the rationale behind the proposed universal method for setting regulatory F–N functions by scaling the benchmark function based on the amount of population in the selected region and the tolerable individual risk limit. It would then provide a consistent framework for regulating individual and societal fatality risk. An illustration is then presented in Sect. 4 using the Greater Melbourne Region as a case study.

3.1 Benchmark ALARP F–N functions

In the field of safety engineering, industrial risk is being quantified at a system level. For example, the potential loss in the surrounding area is taken into account in the safety evaluation of a petrol station. The risk is the combination of the frequency of recurrence and the consequence of an event. This is presented by an F–N curve, typically in the form of a power function as shown in Eq. (1), which was firstly proposed by Farmer (1967) and Beattie (1967) for limiting the number of deaths due to radiation release.

$$F \times N^{b} = k$$
(1)

in which k is a constant and b is the slope of the F–N function plotted on a log–log scale that indicates the level of risk aversion. A society is typically more concerned about rare major catastrophes with a large number of casualties rather than a series of frequent minor events that lead to similar total number of casualties. This concern can be reflected by the choice of b-value of a regulatory F–N function. A b-value of 1.0 is regarded as risk-neutral that all events would lead to the same average number of fatality per year, whilst a b-value greater than 1.0 indicates risk-averse consideration typically for low-probability large-consequence events.

F–N diagrams are typically used in the regulation and management of systems that involve a significant amount of risk. They can be used as parts of a policy for land-use planning or risk assessment of new installations. As shown in Fig. 6, an unacceptable (intolerable) region and an acceptable (negligible) region are usually defined, whilst a region called ALARP is usually specified in between the two. ALARP stands for “as low as (is) reasonably practicable/possible”, which is also known as ALARA (as low as is reasonably attainable/achievable) or SFAIRP (so far as is reasonably practicable). The residual risk is considered tolerable if the actual F–N function (e.g. based on real data) falls into the ALARP region, provided that the sacrifice (in terms of money, time, trouble or efforts) required in making the safety improvement must be grossly disproportionate to the further risk reduction that is achieved. Whilst acknowledging that safety has a cost, there is a general moral and legal obligation for the parties involved to consider all investments and expenditures in the attempt to achieve the aforementioned human rights (Faber and Stewart 2003). The residual tolerable risk must however be properly assessed, for example, through a cost–benefit analysis, and must be kept under review and must be further reduced if future circumstances allow (DSC-NSW 2010).

Fig. 6
figure 6

Example of F–N diagram typically used in safety regulations and guidelines

Full size image

The benchmark F–N functions for the upper and lower bounds of ALARP region (solid and dashed lines, respectively, in Fig. 6) that are commonly defined in regulations and guidelines can respectively be generalised in a parametric form as:

$$\log \left( {F_{BU} } \right) = a - b \times { \log }\left( N \right)$$
(2)
$$\log \left( {F_{BL} } \right) = \left( {a - 2} \right) - b \times { \log }\left( N \right)$$
(3)

\(F_{BU}\) and \(F_{BL}\) are the upper and lower bounds of the recurrence frequency of the benchmark ALARP region, whereas the coefficient \(a = { \log }\left( k \right)\). The upper bound function (Eq. 2) can be regarded as a societal tolerable risk limit (or limit of tolerability), beyond that, risks are considered unacceptable. There is no international consensus regarding the choice of values for the benchmark functions. It depends on the perception of risk, the decision-making process and the regulatory purpose and safety goals (Faber and Stewart 2003).

The benchmark F–N functions for ALARP are sometimes truncated by a maximum value, \(N_{B,max}\), that limits the number of fatalities in an event. A greater number of fatalities may be unacceptable or tolerable, depending on the evaluation by the decision maker, but thorough examination and sufficient preventive measures are necessary to reduce the risk to ALARP. It is noteworthy that this truncation is not needed for a risk-averse ALARP function with b = 2, as the corresponding limiting annual frequency of 100 or more fatalities is very low.

There are various standards and guidelines internationally that have been used to express risk tolerance and limit the number of fatalities that might be caused by accidents resulted from hazardous activities. Figure 7 shows the upper bound of ALARP region of the benchmark F–N function in those documents. Table 1 summarises the key parameters of these functions. For cases when the F–N functions are specified separately for existing and new facilities, e.g., the Netherlands and New South Wales, Australia, the parameters stipulated for new facilities are included in this comparison. It is seen that a-value varies from -2 to -4, whilst b-value is either 1 or 2. It is however noted that a b-value other than 1 or 2 is also adopted in other criteria for the U.K. (e.g. 1.4, 1.5), as reported in Trbojevic (2005). \(N_{B,max} = 1000\) is adopted by the Planning Department of the Hong Kong Government and the Dams Safety Committee of the New South Wales Government. Loss of over 1000 lives is seen by society as catastrophic at the international scale (DSC-NSW 2006).

Fig. 7
figure 7

The benchmark F–N function of the upper bound of ALARP region stipulated in various standards and guidelines

Full size image
Table 1 Key parameters for the benchmark F–N function of the upper bound of ALARP region stipulated in various standards and guidelines
Full size table

The Average Annual Loss (AAL) of life, or Potential Loss of Life (PLL) in a year, implied by the benchmark upper bound ALARP function, \(PLL_{BU}\), can be calculated by:

$$PLL_{BU} = \mathop \sum \limits_{N = 1}^{{N_{B,max} }} F_{BU} \left( N \right)$$
(4)

This is the long-term expectation value of the number of fatalities per year, averaged over many years. The calculated values of PLLBU implied by the upper bound ALARP functions in various standards and guidelines are included in Table 1. If \(N_{B,max}\) is not specified, a value of 100,000 is assumed for calculating PLLBU, whilst the choice of this value affects the result of the U.K. function only (as the tolerable frequency limit is still high for large number of fatalities). It is clear that the value of PLLBU varies significantly amongst those regulatory ALARP functions. The huge discrepancies can probably be attributed to the purpose and historical development of the regulation, as well as the location of application of the ALARP functions. For example, the number of fatalities can differ significantly if the same facility is installed in a densely populated area or at a remote site, let alone the difference between the consequence of failure of different types of facility. The size of the affected population has not been explicitly defined or associated to those ALARP F–N functions (Trbojevic 2005).

Furthermore, there is currently no direct link between the existing societal risk criteria in terms of the F–N functions and the regulatory individual risk criteria. If the tolerable fatality risk for an individual is 10−6, the implicit number of affected population for the upper bound ALARP F–N function recommended by the Hong Kong Planning Department (2008) would be 7600. This is consistent with the number of occupants at a particular time in a single asset like an exhibition center, a stadium or an airport, which can be in the order of thousands to tens of thousands. However, the number of affected population is in the order of tens of people for a petrol station in a remote area. Clearly, the benchmark F–N functions in existing standards and guidelines cannot be directly used for evaluating public safety level at a regional scale.

3.2 Proposed regulatory ALARP F–N functions

The existing ALARP F–N function for safety evaluation is typically used for a single asset, e.g. a building that houses a large number of occupants or a critical infrastructure like a power plant. The extent of the affected area is fairly limited, say, in the order of tens or hundreds of metre radius, except that the effects can be diffused like radioactive substances from a damaged nuclear power plant. However, a damaging earthquake can lead to widespread destruction and casualties. The affected region that could lead to structural failure and loss of life is much larger, in the order of tens or even hundreds of kilometres distant from the fault break. When probabilistic risk assessment is conducted, the scale of study region can vary from a neighbourhood level to a national level, or even up to a continental or global level.

As pointed out by Jonkman et al. (2003), the direct use of those F–N functions on a local or installation level can lead to “an undesired situation” on a national or regional level. Hence, the benchmark ALARP F–N function in existing regulations as described in Sect. 3.1 cannot be directly used for evaluating the earthquake safety level of a society. An appropriate and universal way of setting the ALARP F–N function is needed.

It is proposed herein that the tolerable number of the average annual PLL due to structural failures in the selected region can be calculated based on the tolerable annual individual fatality rate, \(\lambda_{D,tolerable}\), and the total population in the selected region, \({\mathcal{P}}\). The benchmark upper bound ALARP F–N function can then be scaled based on the ratio between the region-specific PLL and the value of PLLBU. This can provide a direct link and compatibility between the regulatory individual risk criteria and the societal risk criteria. A value of 10−6 for \(\lambda_{D,tolerable}\) is recommended, which is in accordance with the stipulations in various international documents, as discussed in an earlier section or in detail in Tsang and Wenzel (2016). With a total population of 4.2 million (as of the 2011 census) in the Greater Melbourne Region according to the Australian Bureau of Statistics, 4.2 fatalities each year or 42 every decade might be considered tolerable.

For this purpose, a population-scaled factor, \(\theta_{P}\), is introduced for adapting the benchmark ALARP F–N functions to a specific study area, such that it becomes suitable for the assessment of natural hazard risk at a regional scale:

$$\theta_{P} = \frac{{{\mathcal{P}} \times \lambda_{D,tolerable} }}{{PLL_{BU} }}$$
(5)

Example calculations of \(\theta_{P}\) factor for different scale of study area are shown in Table 2. It is clear that the values of \(\theta_{P}\) factor differ by orders of magnitude for different amount of population. It is also found that the limiting fatality number, \(N_{R,max}\), and the level of risk aversion have some significant influence on the values of the scaling factor.

Table 2 Example calculations of population-scaled factor, \(\theta_{P}\), for different scale of selected region in Australia
Full size table

The rate of exceedance of the F–N functions for the upper and lower bounds of ALARP region can then be modified by the population-scaled factor:

$$\log \left( {F_{PU} } \right) = a - b \times { \log }\left( N \right) + { \log }\left( {\theta_{P} } \right)$$
(6)
$$\log \left( {F_{PL} } \right) = \left( {a - 2} \right) - b \times { \log }\left( N \right) + { \log }\left( {\theta_{P} } \right)$$
(7)

Essentially, the coefficient \(a\) in the original functions becomes \(a + { \log }\left( {\theta_{P} } \right)\) in the scaled functions, whilst b-value remains unchanged. It is also noteworthy that the resulted value of \(\theta_{P}\) is indeed highly dependent on the a-value of the benchmark function. Hence, the choice of benchmark F–N function becomes not critical, as long as the level of risk aversion as indicated by the b-value is properly specified by the relevant authority.

As for the benchmark functions, the scaled regulatory F–N functions for ALARP can be truncated by a maximum value, \(N_{R,max}\), that limits the number of fatalities in an event of earthquake. Depending on the rescue and emergency services capability of the region of interest, the limiting fatality number, \(N_{R,max}\), can be predefined by relevant government authority, preferably with adequate consultation with the affected community. For example, it can be set as a percentage of the total population in the study area. It is reminded that \(PLL_{BU}\) in Eq. (5) should be computed based on this case-specific \(N_{R,max}\), such that the average annual PLL implied by the scaled upper bound ALARP function, \(PLL_{PU}\), becomes:

$$PLL_{PU} = \mathop \sum \limits_{N = 1}^{{N_{R,max} }} F_{PU} \left( N \right) = PLL_{BU} \times \theta_{P} = {\mathcal{P}} \times \lambda_{D,tolerable} .$$
(8)

4 Case study

Once a regulatory societal risk limit is determined, the actual F–N function of the study region has to be either obtained from historical data or based on computational estimates or a combination of both. Whilst historical data is usually incomplete especially at the long return period ends, F–N data would be obtained through regional earthquake loss modelling, which is occasionally conducted by government agencies, re-insurance sector or asset managers of spatially distributed infrastructure for assessing the resiliency of a city, evaluating probable financial impact, or deriving disaster management plan (Erdik 2017; Silva 2017). It is usually done for selected scenario earthquakes, each of which may be associated with a return period, such that the outcomes carry some measure of the probability of exceedance.

For the safety evaluation scheme proposed in this paper, there is no limitation on the approach for obtaining the actual F–N function. A probabilistic risk assessment can be conveniently conducted for each individual geo-unit or grid. Alternatively, a fully stochastic approach that requires simulations of thousands of earthquake scenarios through rigorous loss estimation can provide a full picture of the characteristics of a societal loss recurrence function. Also, a semi-probabilistic procedure can be used to obtain the F–N function based on a smaller set of scenario earthquakes. This has been adopted in this case study.

4.1 The Greater Melbourne Region

4.1.1 Exposure information

Melbourne (Coordinates: 37°48′49″S, 144°57′47″E) is the most populous city in the state of Victoria in Australia, which has a total population of 4,205,584 (as of the 2011 census) according to the Australian Bureau of Statistics. In this case study, the whole region is divided into 9658 geo-units, as defined by the Australian Statistical Geography Standard (ASGS) based on the census data of 2011, and can be found in the National Exposure Information System (NEXIS) developed by Geoscience Australia.

The population density (in the unit of the number of people per square kilometre) of each geo-unit is shown in Fig. 8. It is observed that the population is mainly concentrated within the City Centre and inner suburbs of Melbourne, with up to 98,470 people per square kilometre, whilst it is no more than 1230 people per square kilometre on the outskirt of Melbourne. The ground condition of each geo-unit has been broadly categorised according to NEHRP soil classification scheme. Building exposure data was collected from NEXIS and then adapted to the HAZUS classification scheme. Over half of the population in the region is residing in timber light frame (W1) buildings. The distribution of the ratio (in per cent) of floor area of W1 buildings to the land area of each of the 9658 geo-units in the Greater Melbourne Region is shown in Fig. 9.

Fig. 8
figure 8

Population density in each of the 9658 geo-units in the Greater Melbourne Region (in the unit of the number of people per square kilometre)

Full size image
Fig. 9
figure 9

Distribution of the ratio (in per cent) of floor area of timber light frame (W1) buildings to the land area of each of the 9658 geo-units in the Greater Melbourne Region

Full size image

4.1.2 Hazard-consistent scenario earthquakes

As a key component of the semi-probabilistic loss assessment, the selection of scenario earthquakes is based on the predicted demand on the uniform hazard spectrum at the predominant natural period (T) of the potentially more vulnerable groups of buildings in the Greater Melbourne Region, which are one-to-two-storey timber light frame (W1), low-rise unreinforced masonry (URML) and low-rise concrete moment frame (C1L). As the predominant period of these three types of vulnerable constructions is in the order of 0.3 s, the spectral acceleration response at this single natural period (i.e. SA0.3) was adopted for selecting hazard-consistent scenario earthquakes. The uniform hazard spectra for a wide range of return periods, \(T_{RP}\), presented in Somerville et al. (2013) were adopted.

A correction was made to remove the consideration of ground motion uncertainties from the uniform hazard spectra. The probabilistic hazard rates were multiplied by a correction factor of 0.313 (more details can be found in Werner 2016), such that the reduced rates would be corresponding to the median spectral response values, which were then used for identifying scenario earthquake events. The two major ground motion prediction equations (GMPEs) employed in the probabilistic seismic hazard assessment (PSHA) study by Somerville et al. (2013), i.e. Somerville et al. (2009) and Allen (2012), were used for back-calculating the magnitudes of the scenarios for each fault along with its distance from the population centroid. Information about the locations and geometry of faults are available from the website of Geoscience Australia (2017). 68 scenario earthquakes have been identified, which are summarised in detail in Tsang et al. (2018).

4.2 Societal fatality risk function

4.2.1 Scenario-based fatality estimation

The computer software SELENA (Molina et al. 2010) has been adopted for earthquake loss modelling in this case study. Only fatalities directly due to structural damage are considered, which include both indoor and outdoor fatalities. The estimates exclude those caused by co-existing events or secondary effects like fires, tsunami and landslides, or indirect causes including heart attacks, power failure and the release of hazardous materials. The number of fatalities was estimated based on the methodology recommended in Coburn and Spence (2002), given the lack of existing Australian fatality information. This remains a major source of uncertainty in the case study, whilst other fatality estimation models can also be employed (So 2016). Both instantaneous deaths and immediate life threatening injuries are combined in the fatality estimates in this study.

As the structural response behaviours of Australian buildings are not completely known, the recommendations of capacity curves and fragility functions in HAZUS Technical Manual were adopted in this illustration. In HAZUS, the vulnerability of buildings has to be classified based on design code levels, namely, high, moderate and low, according to the Design Seismic Zones specified in the Uniform Building Code (UBC) (preceding the IBC). Meanwhile, a fourth level, pre-code, is recommended for buildings which were not designed and built according to a modern seismic code. In this study, Australian buildings were conservatively classified at pre-code level by this definition. This assumption has been discussed, explored and validated in previous studies (Ryu et al. 2013; Daniell et al. 2015). For the evaluation of code levels (in Sect. 4.3.1), the capacity curves and fragility functions in HAZUS have been adopted for all cases, as a complete set of information is not available for the study region.

Figure 10 shows the differences in the number and the distribution of fatalities in two scenario earthquakes, namely, a magnitude 7.8 event occurring on the Muckleford fault and a magnitude 5.6 event occurring at a random location very close to the City Centre. A finite rupture model with an appropriate rupture surface geometry has been defined for loss modelling of each earthquake scenario, whilst only the locations of epicentre are annotated in Fig. 10.

Fig. 10
figure 10

Number of fatalities as a percentage of the population in each geo-unit in the Greater Melbourne Region due to a a magnitude 7.8 earthquake occurring on the Muckleford fault; and b a magnitude 5.6 earthquake (annotated as “rand7”) occurring at a random location very close to the City Centre

Full size image

4.2.2 Parametric F–N function

A societal risk recurrence function, in terms of number of fatalities (i.e. an F–N curve), can be constructed based on a dataset of the simulated number of fatalities in the Greater Melbourne Region due to the suite of 68 selected earthquake scenarios, versus the corrected return periods, \(T_{RP}\) (or rates of exceedance, F) of the hazard. Equation (9) is the idealised F–N function in the form of an upper-truncated Pareto distribution function proposed in Tsang et al. (2018). For the Greater Melbourne Region, the reference point of the function, i.e. \(N_{ref}\) and \(T_{RP,ref}\), is anchored at 2475 years with 2700 fatalities, whilst the b-value is 1.0. Based on the trend of the dataset at the long return period end, the estimated largest (i.e. truncated) number of fatalities, \(N_{max}\), is in the order of 210,000, which is approximately 5% of the total population of the region. This F–N function is plotted as “pre-code” in Fig. 11.

Fig. 11
figure 11

Societal earthquake fatality risk function, F–N curve, for the building stocks and the population in the Greater Melbourne Region, based on HAZUS characterisation for various code levels, in comparison with the population-scaled regulatory ALARP F–N functions as proposed in this study

Full size image
$$\frac{1}{F\left( N \right)} = T_{RP} \left( N \right) = T_{RP,ref} \left( {\frac{{N_{ref}^{ - b} - N_{max}^{ - b} }}{{N^{ - b} - N_{max}^{ - b} }}} \right)$$
(9)

The corresponding PLL is around 13 per year on average, based on Eq. (10), in which \(N_{min}\) can be assumed equal to 0.5 (Tsang et al. 2018). With respect to the population of the study area, this is translated to an average annual mortality rate of 3 micromorts, which triples the tolerable individual risk limit of 1 micromort (ISO 1998; Tsang and Wenzel 2016).

$$PLL \cong \left\{ {\begin{array}{*{20}l} {\frac{{N_{ref}^{b} }}{{T_{RP,ref} }}\left( {\frac{{bN_{max}^{1 - b} - N_{min}^{1 - b} }}{1 - b}} \right) \quad {\text{for }}b \ne 1 } \\ {\frac{{N_{ref} }}{{T_{RP,ref} }}\left[ {ln\left( {\frac{{N_{max} }}{{N_{min} }}} \right) - 1} \right] \quad {\text{for }}b = 1} \\ \end{array} } \right.$$
(10)

Amongst the eight major known faults considered (Tsang et al. 2018), earthquake scenarios with magnitude 7.3–7.7 occurring along the 97-km Selwyn fault lead to the highest number of fatalities in the range of 45,000–150,000, which is corresponding to approximately 1–3.5% of the total population. This is partly because of the higher population density closer to the Selwyn fault, as shown in Fig. 8. It is noted that the estimated frequency of recurrence of such events is in the range of 2 × 10−6–2 × 10−5, which may be viewed as exceptionally low. A sensitivity study shows that the average annual PLL is reduced by 6.5% if the fatalities of events with frequency of recurrence lower than 2 × 10−5 are ignored, i.e. the fatality risk function is truncated at N = 45,000.

4.3 Evaluation of seismic design requirements

4.3.1 Design code level

As discussed in Sect. 3.2, the choice of benchmark F–N function (especially the a-value) actually does not govern the outcome, hence, the benchmark functions adopted by the Planning Department of the Hong Kong Government were selected in this case study. The a-value of the upper bound ALARP function is − 3, whilst the b-value is 1, indicating risk-neutral (i.e. the dashed line in Fig. 11). A parametric study about the choice of b-value will be conducted in Sect. 4.3.2.

The total population, \({\mathcal{P}}\), of the Greater Melbourne Region is 4,205,584. Given the tolerable annual fatality rate, \(\lambda_{D,tolerable}\), of 10−6, the tolerable number of the average annual PLL due to structural failures is then equal to 4.2. If the regulatory limiting fatality number, \(N_{R,max}\), is assumed as 0.5% of the total population, i.e. 21,028, then \(PLL_{BU} = 0.01065\) and \(\theta_{P} = 395\) based on Eqs. (4) and (5). The regulatory F–N functions for the upper and lower bounds of the ALARP region for the study area can then be obtained by using Eqs. (6) and (7), which are plotted as solid lines in Fig. 11. The regulatory F–N functions, after being modified by the population-scaled factor, \(\theta_{P}\), become consistent with the tolerable limit of individual fatality risk, which would be appropriate for assessing societal earthquake fatality risk at a regional scale. It can be seen that the “pre-code” F–N function completely falls into the “unacceptable” region.

Detailed analysis has revealed that the highest fatality rates occur in two model building types, namely, URML and C1L (Tsang et al. 2018). In order to bring down the F–N curve to ALARP, it would be more effective if new constructions of these two building types are built to a higher safety standard or certain proportion of existing buildings is retrofitted to a higher level of earthquake resistance. Hence, low-code and moderate-code designs of these two building types were adopted in a hypothetical study for an evaluation of the potential risk mitigation effects of designing structures to higher code levels. It is noted that moderate-code masonry structures are reinforced, which is named as RM1L in HAZUS. Either one of the two building types was changed at one time, or both types were changed at the same time, which result in a combination of eight scenarios, in addition to the “both pre-code” scenario. The corresponding values of \(N_{ref}\) for all nine scenarios are summarised as a matrix in Table 3, whilst the values of \(T_{RP,ref}\), b and \(N_{max}\) are the same for all cases.

Table 3 A matrix of the number of fatalities, \(N_{ref}\), at the reference return period, \(T_{RP,ref} = 2475\) years, for all nine hypothetical scenarios of building stocks
Full size table

The societal risk functions based on pre-code building stocks, the building stocks with low-code URML and C1L, as well as the building stocks with moderate-code RM1L and C1L are shown on the F–N plot of Fig. 11. It is shown that the entire F–N curve for “both low-code” scenario still falls into the “unacceptable” region, whilst the F–N curve for “both moderate-code” scenario falls into the ALARP region, except the low-frequency tail. This shows that designing low-rise masonry and concrete frame building structures in Melbourne to satisfy HAZUS low-code requirements is still inadequate from the societal risk perspective. Parts of the building stocks need to be replaced or retrofitted in order to bring the residual risk level in society down to an ALARP level. It is also noted that the remaining fatalities in the “both moderate-code” scenario are mainly resulted from the collapse of timber light frame (W1) buildings.

The procedure presented above is rather robust except that the value of \(N_{R,max}\) is an unknown. Hence, a sensitivity study was conducted to check if different values of \(N_{R,max}\) would lead to different conclusions or not. It is found that, when b-value is 1.0, the population-scaled factor, \(\theta_{P}\), would vary from 553 for \(N_{R,max} = 1000\) to 264 for the largest value of \(N_{R,max} = {\mathcal{P}}\), as summarised in Table 4. Although the factor seems to vary significantly, the observed trend and the conclusion drawn in the previous paragraph are still valid for any value of \(N_{R,max} \ge 1000\). In reality, the relevant government authority should be able to predefine a reasonable value (or range) of \(N_{R,max}\) based on the rescue and emergency services capability, as well as the risk tolerability in the society.

Table 4 Values of population-scaled factor, \(\theta_{P}\), for different values of \(N_{R,max}\) and different level of risk aversion (as indicated by the b-value)
Full size table

4.3.2 Level of risk aversion

The tolerable level of risk has been found to decrease with an increasing number of exposed persons (Starr 1969). This can probably be explained by the risk-averse nature of human beings, especially when it is about a large-scale catastrophe with a huge number of deaths, which is certainly unbearable to any society nowadays. Hence, it is sensible for policy makers to consider risk aversion in setting the regulatory ALARP F–N functions, as in some European countries, e.g. the Netherlands, as shown in Table 1.

A parametric study was conducted to examine the effects of the level of aversion on the results (whilst a-value is kept as − 3). As b-value is typically between 1.0 and 2.0, apart from the start and end values of the range, the mid-range of 1.5 was chosen in this study. A b-value of 1.5 can be considered as moderately risk-averse, whilst a value of 2.0 can be seen as highly risk-averse. It was found that the value of \(N_{R,max}\) does not change the value of \(\theta_{P}\) significantly, as shown in Table 4.

The regulatory ALARP F–N functions for the three levels of risk aversion are shown in Fig. 12, along with the societal fatality risk functions for the Greater Melbourne Region based on hypothetical building stocks of different code levels. It is clear that the societal risk levels are considered unacceptable, when risk aversion is considered, even if the two most vulnerable building types were designed and built in conformance with HAZUS moderate-code level, which was intended to represent the structural performance of building stocks in seismic zones with 10% chance of exceeding an effective peak ground acceleration of 0.2 g in 50 years (SEAOC 1999).

Fig. 12
figure 12

Population-scaled regulatory ALARP F–N functions with different levels of risk aversion (as indicated by the b-value), in comparison with the societal earthquake fatality risk function, F–N curve, based on hypothetical building stocks of different code levels

Full size image

Nevertheless, the introduction of risk aversion may be viewed as inconsistent and “somewhat illogical” (Faber and Stewart 2003), as “the events involving high consequences often are associated with ‘follow-on’ events which themselves may contribute significantly to the risk (Faber and Stewart 2003).” Put into the context of this study, a catastrophic earthquake event does not only lead to huge number of fatalities, but destroys the whole community, hampers economic development, and possibly ruins the life of the survivors in the longer term. Risk-averse consideration may not be needed (i.e. a b-value of 1.0 is used) if “all such ‘follow-on’ consequences are taken into account in the risk analysis (Faber and Stewart 2003).”

5 Conclusions and closing remarks

Decision-making in a knowledge-based society should be scientific and evidence-based especially when different opinions and interest groups exist. An ideal building code should indicate the target levels of collapse and fatality risk since it is a legal document that sets forth structural design requirements for protecting life and property. It is becoming the reality as the required tools and knowledge are available nowadays. This paper begins with a review of the state-of-the-art and state-of-the-practice of risk-based seismic design. It was shown in Sect. 2 that the annual individual fatality risk in buildings designed in conformance with IBC-2012 and ASCE/SEI 7-10 generally exceeds the tolerable annual risk limit of 10−6 (i.e. one micromort). Hence, a lower annual collapse risk limit is deemed required. On the other hand, there is limited indication whether the impact on society is tolerable or not.

The main objective of this paper is to put forward a rational and universal approach for evaluating the structural safety level of building stocks in a region, which can be used for justification of a seismic retrofitting policy or a required change of the design code level. Section 3 discusses the problems with existing safety regulations, and then presents the key formulations for deriving the population-scaled regulatory functions, that define the upper and lower bounds of the “as low as reasonably practicable (ALARP)” region on the F–N plot. The regulatory ALARP F–N functions can then be compared with the societal risk functions based on probabilistic loss assessment, which is illustrated in Sect. 4 using the Greater Melbourne Region as a case study based on the characterisations of structural performance for the various code levels defined in HAZUS.

The proposed scheme for deriving regulatory ALARP F–N functions is generally applicable, regardless of the approach for loss assessment. If a probabilistic loss assessment is conducted for each individual geo-unit or grid, the number of fatalities or other loss quantities can be summed up to produce a societal risk function for a neighbourhood, a city or a whole country. It is noteworthy that, within the same grid, multiple events with different magnitudes and source-site distances can contribute to the same level of an intensity measure, the fatality estimates can thus be very different. On the other hand, if a scenario-based approach through rigorous loss modelling is used, an appropriate scale of the study region has to be defined in the first place. The distinct fatality distributions resulted from different earthquake scenarios can be captured if a fully stochastic approach is adopted.

In practice, depending on the chosen level of administrative unit, e.g. council, municipality, city, state or nation, there may be differences in the tolerable level of fatality risk. The proposed scaling approach can accommodate the discrepancies within the same framework. Participatory modelling and co-engineering approaches (Daniell 2012) have been used previously for water management decisions across varying spatio-political scales and provide a tool for such an approach as proposed in this paper to be implemented practically. The proposed scheme is also applicable to other natural hazards and for safety engineering applications generally.

One micromort is adopted as the tolerable fatality risk limit in this study. However, in a densely populated region, the number of people being affected at the same time is huge, whilst the emergency response capacity in the community might not be sufficient for coping with the potential disaster. This situation is defined by UNISDR (2009) as “intensive risk”, for which a more stringent risk limit might be justified. This remains an important matter for further investigation. As the consequences of structural failure concern life safety and economic loss, this is a cross-disciplinary issue, and the responsibility of decision-making should be shared amongst relevant authorities and all the stakeholders, in order to minimise the residual societal risk to a tolerable level.