Validated 3D Spatial Stepwise Quantitative Hazard, Risk and Resilience Analysis and Management of Explosive Events in Urban Areas

Abstract

Urban physical security and resilience with respect to accidental and intentional explosive events are an increasing issue regarding civil safety and security of modern societies and their citizens. Examples include industrial on-site explosions, gas explosions or terrorist attacks. In particular, multiple, simultaneous and maliciously time-coordinated events are an increasing event type such as complex attack events consisting of targeted combinations of improvised explosive devices. The paper presents a comprehensive, tailorable and stepwise process. This includes methodologies for scenario, hazard, damage, exposure, event frequency, risk and resilience analysis that have been developed, refined and praxis-tested over decades. The focus is on a summarizing description of the modern best practice approach, the validation efforts undertaken for each step as well as two detailed case studies for exemplary presentation and overall validation. In a comprehensive table, the present approach is compared with other state-of-the-art approaches. The paper shows a refined process how to systematically improve resilience when using the tool, in particular through barriers at explosive sites and at exposed sites of various geometries. Furthermore, along the presentation a set of quality requirements regarding explosive event risk and resilience analyses are provided as collected over the years from the in-field, user group and engineering science perspective as well as a broad outlook on extension options for the future.

1 Introduction

It is a basic human need to feel safe and secure. However, the perception of risk varies individually and collectively. Moreover, risk perception often differs from scientifically determined values that describe risk on an objective basis (Renn 2015). It is therefore important to assess possible societally relevant threat scenarios and events by using scientific methods of risk analysis including a convincing risk visualization suitable for societal risk communication.

Such analyses should also allow the derivation of effective preventive and protective measures. It is further desirable to assess response and recovery post-damage events. Such inputs are deemed a good basis for participatory evaluating threat scenarios taking account of societal risk acceptance on subjective and group level. Due to their massive effects, explosive event scenarios are a showcase for modern risk and resilience analysis and management.

Managing risks associated with explosive events typically involves the definition of spatial areas where the risk can be quantified as within defined acceptable limits. For this purpose, especially in operational contexts, commonly “quantity distance” methods are applied, which yield different radii for graded human injury levels. They are based on the quantity of the explosives and the distance between explosive and exposed site. Usually, this classification follows the system described in the UN “Orange Book” (United Nations 2015) or other national regulations in the context of explosives protection management (for a German example see the regulation 2. SprengV 2017), in particular in the context of human demining (Technical Note 10.20/01 2013).

While the empirically derived quantity distance methods are a quick tool to define zones with given “levels of protection,” i.e., human injury levels in case of events with or without protection, potentially acceptable by persons exposed and suitably protected, they cannot accurately describe actual explosive scenarios. This results from neglecting blast shielding and venting effects due to the free-field assumption made and the use of only limited classes of explosive sources. Sources are typically only classified in terms of net explosive quantity (NEQ) and assumed to be spheres rather than using the real geometry, the point of initiation and hull or preformed fragment properties. Also local barriers or the orientation of the source is not considered.

This gap is closed by quantitative risk analysis (QRA) methodologies, often also called probabilistic risk analyses (PRA). Their ambition is to calculate the objective engineering risks based on a description of the hazard source, its consequences and damage effects as well as various probability quantities. They provide a much more accurate quantification of risks in addition to considering the hazard source characteristics by the analytical assessment or simulation of the influence of the built environment on the blast wave propagation as well as of shielding effects of structures against fragment and debris effects.

Such risk-based methods lay the ground for detailed insight to the various factors influencing the resulting risks. This includes frequency of event and exposition analysis, detailed hazard analysis to characterize the physical threat potential and damage analysis taking account of the different and simultaneous damage mechanisms in terms of damage models as well as counter-measure consideration. However, the communication and implications of such analysis results to practitioners remain a challenging task.

Furthermore, within quantitative risk analyses scenario assessment quantities are provided that also support how to efficiently reduce the risks in the resilience cycle phases prevention (overall event frequency reductions) and protection (damage or vulnerability reduction), and, to a lesser degree, also in the response, recovery and learning phases, when sorting the approach with respect to the resilience engineering logic or timeline order dimension (Thoma et al. 2016; Häring et al. 2016; Vogelbacher et al. 2016). Response, recovery and improvement are covered mainly since the initial damage of events is understood in much detail when applying quantitative risk analyses approaches allowing for very informed fast actions post-events. Furthermore, due to the detailed 3D scenario-based approach, it is known how to build back forward or better to improve protection and prevention. It remains an ongoing challenge to select and combine such approaches for overall transparent and risk assessment and control of explosive urban scenarios including to improve the resilience post such events.

Parts of the presented QRA methodology for explosions were originally developed for ammunition storage safety analysis in NATO-wide scientific working groups, including for German national demands, starting in 1999 (AASTP-4 2016). They are by now in the public domain, since the respective working groups are driven by a strong interest in discussing publicly the foundations of their approaches. Since then, the methodology was repeatedly refined and its scope was broadened to include relevant features for explosive ordnance disposal (EOD) missions, such as buried explosive items or improvised explosive devices (IEDs). It is obvious that only some of these application fields are of interest for civil security and safety contexts.

Furthermore, the physical models underlying the consequence analysis were refined. The methodology has been implemented into software tools and is now being used for risk analyses related to ammunition storage (Steyerer et al. 2017). Moreover, the methodologies are listed in the relevant NATO guidelines AASTP-4 (2016) for risk-based decisions. Similar standardizations for civil applications are still missing.

Another issue of today’s explosive event assessment process landscape and the methods used comprises different policies of scientific and commercial approaches as well as tool providers to lay open their actual assessment processes and methods. This is a major challenge, when considering the requirements of transparency, reproducibility or even auditability and insurability within decision-making processes regarding the risk and resilience management of explosive hazards with relevancy for the public domain. The issue is prevalent in a wide range of civil security scenarios, including World War II bomb disposal, terror event scenarios, assessment of chemical plant safety, renewable gas storage tanks, biogas generation and even battery storage systems.

In recent years, the quantitative risk analysis approach was transferred to civilian applications (Finger et al. 2017; Siebold et al. 2015; Salhab et al. 2011b) particularly answering to the increasing terror threat (Schäfer et al. 2015; Siebold and Häring 2009) and requirements in the chemical and processing industry (von Ramin and Stolz 2016). In addition, the approach was implemented in the explosive quantitative risk analysis (EQRA) tool, a special software for the quantification, 3D spatial simulation and analysis of scenario-based blast and fragment effects resulting from explosive hazard sources.

This approach was mainly developed in the EU projects ENCOUNTER (Schäfer et al. 2015), D-BOX (Esmiller et al. 2013) and EDEN, in the latter as part of several chemical, biological, radiological, nuclear and explosive (CBRNE) catastrophe management tools contributed to the EDEN toolbox (EDEN 2018; Roß et al. 2016).

However, up to now a concise and comprehensive overview of the approach, the selection of models accepted by the scientific end user community, and the EQRA tool is missing. Hence, the present paper aims at a presentation of the overall approach and models deemed sufficient and reliable for each step for a proven best practice assessment and overall physical risk control of urban explosive scenarios. It will also be shown how this increases the resilience with respect to such events.

The paper is structured in a sequence of sections that follows the analysis steps of the overall assessment process approach as shown in Fig. 1. Section 2 gives an overview of the overall method, introduces the EQRA software tool that implements the approach and compares the method to similar approaches. Sections 3, 4, 5, 6 and 7 discuss the analysis steps scenario modeling, hazard analysis, damage analysis, event frequency and exposure analysis and finally risk and resilience analysis. Each section describes the respective methodology and its corresponding inputs and outputs. Section 8 presents two overall validation examples. Finally, Sect. 9 summarizes and discusses future challenges and further developments.

Fig. 1

Seven-step process scheme of the explosives quantitative risk and resilience analysis. Approaches used within each step

2 Explosive Quantitative Risk and Resilience Analysis Methodology

This section introduces the explosive quantitative risk and resilience analysis methodology. Section 2.1 gives a short overview on the analysis process and the underlying theoretical models. Further details on the analysis steps are discussed in the respective Sects. 3, 4, 5 and 6. A brief introduction of the EQRA tool, which implements the approach, is provided in Sect. 2.2. Based on the description of the method and the implementation, Sect. 2.3 discusses major differences of the present approach when compared to representative similar approaches.

2.1 Quantitative Risk and Resilience Assessment Process and Overview on Physical, Engineering and Probabilistic Models

Figure 1 gives an overview of the present iterative risk and resilience assessment process and the methods used for its implementation in the EQRA tool.

As Fig. 1 illustrates, the quantitative risk and resilience assessment process consists of seven major steps and can be understood as an extension of standardized risk management approaches like the ISO 31000 (2018) 5-step risk management scheme. In the following, each step and the most relevant corresponding physical, engineering and probabilistic models are listed and referenced.

• 1. Scenario modeling This step provides the data basis for all further steps. The relevant input includes the definition of the urban spatial geometry, the geometry of the barriers at the source and (potential) exposition sites, the characterization of the explosive improvised hazard source and people characterizations sufficient for event frequency and exposure analysis (Schäfer et al. 2015; Salhab et al. 2011a).

• 2. Hazard analysis It includes the analysis of blast and fragment hazards. The blast propagation is conducted using free-field approximations based on Swisdak (1994) and complex blast propagation using computational fluid dynamics (CFD) methods as described in Klomfass (2015). Fragment propagation is as described in Häring et al. (2009) and Salhab et al. (2011b), as well as the local fragment densities computation; in addition, it is taken account of barriers.

• 3. Consequence and damage analysis Consequence assessment for persons uses probit functions in terms of scaled distances. See the arrow from step (1) to step (3) for direct consequence estimation as explained in Häring and Gürke (2006) and indirect assessments based on blast loading quantities (Aschmoneit and Häring 2010) using probit functions or free parameterizations. Fragment assessment is with modifications as in Häring et al. (2009).

• 4. Event frequencies and exposition For the calculation of risk, numerical values for the event frequency and exposure of people are derived from information provided in the scenario modeling step. The determination of frequencies is based on historical data, classification tables as in Gürke and Rübarsch (2000) and individual expert estimates. The exposure of people is estimated by their annual fraction of hours exposed at each locally discrete exposure site. Exposure profiles are determined from information of exposures of groups at several locations.

• 5. Risk and resilience analysis In the risk and resilience analysis, individual, local and group risks are calculated. Based on the individual local risk values, f–N and then F–N curves can be created for comparison with international risk acceptance criteria (Salhab et al. 2011a). In addition, local and total average absolute risk numbers are accessible.

• 6. Risk and resilience visualization, comparison and evaluation It includes risk and resilience visualizations as well as the visualization of risk comparison values for risk evaluation.

• 7. Scenario acceptance or scenario improvement Improvement is achieved by the selection of counter measures if not acceptable (7a) as input for (1).This step also includes the regular monitoring if risk and resilience is assessed as acceptable (7b).

Steps (1)–(7) describe the quantitative risk and resilience assessment and improvement process along with main modeling features employed as well as their logic constraints, i.e., which data and computation results need to be available for which steps enforcing a logic and timeline order of the assessment process, see the arrows between the boxes. This also defines the main inputs and outputs of each step. For instance, the more accurate consequence analysis requires the physical hazard analysis results.

As can be observed from Fig. 1, the EQRA process provides a set of quantities for assessing consequences (initial loss or vulnerability and hence robustness), frequency of events (susceptibility and hence prevention) as well as a set of risk quantities for assessing the resulting risks. They provide input for expert assessment of mainly risk acceptance. They can also be used as a major input for the assessment and acceptance of (immediate) response, recovery (rebuilding) and potential improvement options regarding resilience taking into account further scenario information during decision making. However, explicit resilience quantities as, e.g., the resilience loss integral, time to recover or slope of recovery (see, e.g., Häring et al. 2016) are not provided. An approach of a quantitative assessment of the recovery behavior using averaged reconstruction times and efforts as well as averaging over many potential events is provided in Fischer et al. (2018).

2.2 Applications and Features

Section 2.2 focuses on how to present the analysis options to users of the approach as well as for decision-making support.

Major results of numerous interactions with experienced end users in the context of national projects like ExE Cities (Voss et al. 2006; Mayrhofer 2012) and EU projects like D-BOX (2016), ENCOUNTER (2015), EDEN (2018) or VITRUV (2017) included the identification of the following main requests and expectations.

Seamless user interfaces; intuitive color coding; use of few scenario assessment quantities; fast computations; all assessment options should be available after a single reasonable “data input phase,” and one single computational phase of possibly longer duration, e.g., overnight for high resolution; and last but not least support of overall risk and resilience assessment with the provision of relevant risk decision criteria for individual and collective risks. In particular, in the projects ExE Cities, ENCOUNTER and EDEN, conceptual as well as detailed scenario improvement options were asked for.

The described process scheme of Fig. 1 governs in the EQRA software tool. It is a desktop application with an easy-to-use graphical user interface and 3D visualization, where the user can model individual threat scenarios and analyze consequences and risks for buildings and humans, taking account of person distributions and physical barriers at the source and at exposed people and objects.

Based on the analysis process sketched out in Sect. 2.1, the application of the EQRA tool in typical assessment scenarios consists of four steps, which are conducted iteratively for scenario risk control and resilience improvement. For an overview of these steps see again Fig. 1, where the interaction steps of the software with users are indicated at the right-hand side.

The main interaction with end users, stakeholders, decision makers and third parties with the explosive event quantitative risk and resilience analysis is in steps i, iii and iv:

• 1. Context and scenario analysis taking account of the assessment context and expected expositions and threats. This is the first main interaction step with end users, stakeholders as well as third parties, see step 1 of Fig. 1.

• 2. Automated computations include the main computations sufficient for fast hazard, consequence, risk and resilience analysis and evaluation. This step is designed in such a way that afterward the analysis results for steps iii and iv are accessible without any delay in the software tool. It comprises steps 2–5 of Fig. 1.

• 3. Results analysis includes visualization of risk quantities, risk comparison with risk criteria and the provision of additional quantities for scenario resilience assessment, e.g., expected average injured and fatalities in case of an event, assessment of catastrophe character of events, see step 6 of Fig. 1.

• 4. Scenario acceptance or improvement covers the risk acceptance decision or the selection of counter measures if not acceptable as input. It comprises step 7 of Fig. 1 including 7a and 7b.

2.3 Comparison of the EQRA Approach to Existing Approaches with Similar Goals

Similar approaches as described in the previous sections are common in other civil applications, in particular for industrial chemical plant risk assessments. Examples of collections of such best practices include the Netherlands “Green book” (BZK et al. 2005), and related software tools and publications refer to the third line and following rows in Table 1.

Table 1 EQRA compared to examples for other QRA tools and their respective feature sets

There are several quantitative risk analysis (QRA) tools on the market providing various features for risk analyses in the context of explosive safety. Table 1 lists some of the most relevant QRA tools.

Many of the tools have originally been developed for the chemical and petrochemical industry; thus, it is not surprising that the focus of most tools is on vapor cloud dispersion and the corresponding consequences. A further inspection of the features reveals that only a few tools are available that simulate complex blast wave propagation in combination with fragment projection. The combined effects of complex blast and fragment throw as it is covered by EQRA seem to be a less frequently implemented feature.

Hence, some of the available tools fall short in describing the full extent of the explosion hazard, i.e., the potential risk of human injury or structural damage due to fragment throw and blast wave propagation different from free-field conditions. In contrast, the EQRA tool closes parts of this gap, since it specializes in the simulation and evaluation of free-field as well as complex blast scenarios and considers fragment effects, as well as their combined effects. Also, the assessment of barriers at the explosion site and the exposed site seems to be non-standard. A further distinction of the EQRA approach to existing approaches is the different application contexts, whereby only the EQRA approach seems explicitly to include urban terroristic scenarios.

3 Scenario Modeling

The following sections are mainly based on Schäfer et al. (2015) and describe the scenario input data that are sufficient for the simulation and model applications of Sects. 4, 5, 6, 7 and 8, see also Fig. 1. Entire scenarios in terms of the inputs described in Sects. 3.1, 3.2 and 3.3 or scenario components can be saved and reused without the need for time-consuming regeneration.

3.1 Scenario, Explosive Site and Exposed Site 3D Geometry and Material Properties

The section shows which urban geometry, source site and exposed site geometry details including barriers and their material properties are taken into account.

Initially, the respective spatial scenario is modeled: surface geometry and built structures. The graphical user interface and the 3D visualization enable the modeling of large indoor settings, i.e., with large indoor volumes sufficient for neglecting blast confinement effects, and outdoor settings such as rural or urban environments. Furthermore, the EQRA tool allows the import of 3D point clouds or background images like 2D maps or satellite images (as shown in Fig. 2 left, map by Google Earth 2018) to facilitate the modeling process in a vivid and user-friendly manner.

Fig. 2

Scenario modeling in EQRA as described by Schäfer et al. (2015): 3D model of a city (left), primitive shapes (middle) used for complex structure modeling (right)

With primitive shapes, like cuboids, cylinders or spheres (Fig. 2 middle), all kinds of buildings, building components and a vast range of other structures can be designed (Schäfer et al. 2015). To suit all requirements, the shapes can be modified and combined in various ways to design complex buildings (Fig. 2 right). After the creation of the scenario geometry, the user can assign further properties to structures, such as the material transparencies with respect to fragments, which affects for instance the propagation of fragments, in particular for modeling barriers.

3.2 Hazard Source and Event Frequency Characterization

For the hazard source characterization, predefined models of explosive hazard sources are placed in the scenario model. The following information is taken into account: position and orientation of hazard source, its geometry and material properties, in particular hull material or any preformed fragments. It suffices to determine the initial fragment launch conditions and the TNT equivalent net explosive mass taking account of casing effects. In addition, the local geometric coverage and barriers with defined fragment transparency at the source as well as at exposed sites can be modeled. Details on the information that suffices in step 1 to characterize explosive hazard sources in step 3 of Fig. 1 are given by Rottenkolber and Häring (2010), Salhab et al. (2011a, b) and Brombacher et al. (2011a).

For assessing the event frequency of explosions, the following data enter: type of handling of hazard source and type of hazard source, in particular classes of explosives. The user can also directly assign to each potential hazard source an event frequency. More precisely, the frequency is determined by an expert estimate input into the user interface or assessed using a classification of the explosive source based on the probability of event (PE) table provided by the Risk Based Explosives Safety Criteria Team (RBESCT) of the US DoD (Gürke and Rübarsch 2000).

3.3 Person and Object Exposure

The person exposition is modeled by occupation numbers of designated sites with known protection level, e.g., outdoor, in building, in vehicle or by number of persons with protective equipment. Exposition of buildings and other structures is defined by their position and geometry.

As Schäfer et al. (2015) explain, the user can assign to each building or crowded place a number of persons. For each person or person group also exposition profiles using these known sites with defined position can be defined. Steps 4 and 6 of Fig. 1 use this information for the computation of individual or group profile risks.

4 Hazard Analysis

The objective of the hazard analysis is the assessment of main physical loading effects, especially in the far field of an explosion, where air blast and fragments are among the predominant explosion effects. Other effects, such as debris throw (parts of built infrastructure), crater ejecta (ground material), fire ball and ground shock, are not considered. Whereas in the near field typically blast loading, debris throw and fragment throw, respectively, have independent of each other high physical loading and hazard potential, the far-field physical loading is typically dominated by fragment and to a lesser degree debris throw. Therefore, the present approach concentrates on blast and fragment loading. Fragment loading covers impact of material that was before the explosion directly enclosing the explosive material or within the explosive and is hence typically much more accelerated when compared to debris material.

Based on the hazard source characteristic as described in step 1 of Fig. 1, predefined models of explosive hazard sources are placed and oriented inside the 3D scenario model in step 2. They include the TNT equivalent explosive mass (for blast calculations) and initial launch conditions of fragments. The EQRA tool computes spatial distributions of blast and fragment hazards as described in Sects. 4.1 and 4.2.

4.1 Blast Hazard

Two approaches for quantifying the blast hazard are employed: free-field and complex blast propagation. In rural threat scenarios with no or only few buildings and for reference, the free-field approach is used for approximating the propagation of blast waves. In the simplest form, blast is modeled as a hemispherical burst in free field. The characteristic physical blast hazard parameters, such as peak overpressure $p$ and the specific impulse $I$ of the positive overpressure phase, are quantified at different distances from the explosion center using simplified Kingery–Bulmash polynomials modified by Swisdak (1994),

$$\varPhi_{{\bar{Z}_{i} }} \left( Z \right) = \exp \left( {\mathop \sum \limits_{j = 0}^{4} c{}_{{\bar{Z}_{i} }}^{\varPhi ,j} \ln \left( {Z_{\varPhi } } \right)^{j} } \right),\quad i = 1,2, \ldots , N_{\varPhi } ,$$

(1)

where the relevant physical blast quantities $p$ or $I$ are represented by $\varPhi$ in the $N_{\varPhi }$ intervals of validity $\bar{Z}_{i}$, which are expressed as empirically determined functions of an effective scaled distance $Z_{\varPhi } = r/Q_{\varPhi }^{1/3}$, where $r$ is the radial distance from the hazard source and $Q_{\varPhi }$ is the effective net explosive quantity for $p$ or $I$. The parameterization uses five fitting coefficients $c_{{\bar{Z}_{i} }}^{\varPhi ,j}$ for each interval of validity. For further details see, e.g., Aschmoneit and Häring (2010).

However, these empirical–analytical models do not produce realistic results for urban environments, especially with many tall buildings or narrow roads. Situations, which require a precise determination of the physical quantities Φ associated with an explosive event and lack a sufficient number of spatial symmetries, are called complex blast scenarios.

The EQRA tool includes a computational fluid dynamics (CFD) solver, based on the Apollo BlastSimulator tool (Klomfass 2015; Klomfass et al. 2016), which is capable of computing a complex blast propagation taking the arrangement of surrounding objects into account. The Apollo BlastSimulator is based on a finite volume approach and dedicated to the simulation of detonations, blast waves and gas dynamics. In the context of the development also of EQRA, it has been validated in several campaigns of scaled experiments, see, e.g., (Brombacher et al. 2011b).

A common starting point to model these situations is the conservation equations of mass, momentum and energy of a compressible (ideal) fluid, i.e., Euler’s equations, plus constitutional laws, see, e.g., Landau and Lifshitz (1987). They are transformed for FEM (finite element method) computations together with the equations of state of the constituents, e.g., using the ideal gas and Jones-Wilkins-Lee equations (Klomfass 2015; Klomfass et al. 2016). By applying fast solvers that locally refine the grid in a controlled way, the complete pressure–time histories can be determined at discrete locations of the threat scenario. They are the input loading for quantity-based consequence or point-mass model-based assessments, see step 3 of Fig. 1.

4.2 Fragment Hazard

Physical hazards due to fragment projection are determined based on fragment trajectories. The EQRA tool computes representative trajectories taking gravity, air resistance, shadowing effects of structures and mitigation effects of protective barriers into account. Required initial conditions of fragments were determined for predefined hazard sources using empirical data from arena tests or numerical methods based on rotational symmetric and more generic fragment matrices (Häring et al. 2009; Salhab et al. 2011b).

For the calculation of the trajectories, the mass, the (maximum average) launch velocity, the direction and the geometric launching point of all fragments are required. The launching point is approximated by a point source in the center of the explosive hazard source, from which all fragments propagate (Häring and Voss 2006). The initial values of representative fragments are calculated on the basis of experimental, analytical and numerical findings that are usually stored in 2D fragment matrices (Salhab et al. 2011b). The 2D fragment matrices provide information on mass, velocity and angular distributions, since they store the number of fragments per mass interval and angular interval, and the maximum launching speed per angular interval for rotationally symmetric sources.

The 2D information stored in the fragment matrices has to be transformed into 3D space in order to generate representative trajectories. For the calculation of the trajectories, all relevant information from the matrices is projected on a launching grid in the form of a discretized surface of a unit sphere with nearly homogenous launching windows in form and size (see Fig. 3), which is located around the hazard source.

Fig. 3

(Adapted from Radtke et al. 2011)

Scheme of the calculation of fragment trajectories and hazardous areas at ground level

The point source approximation and the launch grid allow the definition of the initial velocity vectors, which are required for the calculation of representative fragment trajectories. The directions of the initial velocity vectors are specified by normalized vectors, which point from the center of the hazard source to the centers of the launch windows. The initial velocity vector magnitudes are given by the average maximum launching speeds stored in the fragment matrix for the angular intervals, which cover the launching windows on the spherical launching grid. For details see Häring et al. (2009).

The EQRA tool considers representative fragments as mass points with three degrees of freedom and takes gravity and air resistance into account. The propagation of fragments is mainly influenced by the gravitational force $\vec{F}_{\text{G,f}}$ and the drag force $\vec{F}_{\text{D,f}}$. While $\vec{F}_{\text{G,f}}$ acts downward to the ground surface, $\vec{F}_{\text{D,f}}$ acts in negative velocity direction and slows the fragments down. A common approach to quantify $F_{\text{D,f}}$ is given by

$$F_{\text{D,f}} = \frac{1}{2}\rho_{\text{a}} v_{\text{f}}^{2} A_{\text{f}} C_{\text{D,f}} \left( v \right).$$

(2)

In (2), $\rho_{\text{a}}$ is the density of air, $v_{\text{f}}$ is the speed of the fragment, $A_{\text{f}}$ is the presented average area of the fragment in the direction of motion, and $C_{\text{D,f}}$ is the velocity-dependent drag coefficient of the fragment.

When determining the presented average area and the drag coefficient, three types of fragment shapes are distinguished in the EQRA software tool: natural fragment, sphere and tumbling cube. Under consideration of $\vec{F}_{\text{G,f}}$ and $\vec{F}_{\text{D,f}}$, Newton’s second law of motion leads to the dynamic equation of fragment motion as given in Eq. (3). Using fundamentals of kinematics, the velocity of a fragment is the time derivative of the fragment position, which leads to the kinematic equation of fragment (4). Both equations form a system of ordinary nonlinear differential equations, which describe the motion of single fragments (see also Häring et al. 2009 and references therein),

$$m_{\text{f}} \frac{{{\text{d}}\vec{v}_{\text{f}} }}{{{\text{d}}t}} = \vec{F}_{\text{G,f}} + \vec{F}_{\text{D,f}} = m_{\text{f}} \vec{g} - F_{\text{D,f}} \left( {v_{\text{f}} } \right)\frac{{\vec{v}_{\text{f}} }}{{v_{\text{f}} }},$$

(3)

$$\vec{v}_{\text{f}} = \frac{{{\text{d}}\vec{x}_{\text{f}} }}{{{\text{d}}t}},$$

(4)

together with the initial conditions $\vec{x}_{\text{f}} \left( {t_{0} } \right) = \vec{x}_{0} , \vec{v}_{\text{f}} \left( {t_{0} } \right) = \vec{v}_{\text{launch}}$ for each representative fragment.

Here, $m_{\text{f}}$ is the mass of the fragment, $\vec{v}_{\text{f}}$ is the velocity of the fragment, $t$ is the time, $\vec{g}$ is the gravitational acceleration, and $\vec{x}_{\text{f}}$ is the position of the fragment. For each launching window, one representative trajectory per mass interval is calculated by numerically solving the above equations.

After each time step, it is checked whether the fragment hits a structure or surface element. If so, empirical–analytical perforation and penetration models according to the material of the structure (see UFC 3-340-01 1997; U.S. Department of Energy 1981) are applied to determine the residual velocity after perforation of the structure. The fragment is further propagated with reduced velocity if it perforates.

Based on all representative fragment trajectories, the spatial density of fragments on ground level is determined using a cylindrical ground grid (see Fig. 3), with one layer of cells in vertical direction.

For each cell of the ground grid, the spatial density of fragments $\rho_{\text{frag}}$ within each cylindrical grid cell is determined by

$$\rho_{\text{frag}} = \mathop \sum \limits_{\text{traj}} B^{\text{traj}} N_{\text{frag}}^{\text{traj}} \frac{{l^{\text{traj}} }}{V},$$

(5)

where $N_{\text{frag}}^{\text{traj}}$ is the fractional number of fragments per representative trajectory, $l^{\text{traj}}$ is the length of the trajectory inside the grid cell, and $V$ is the volume of the cylindrical grid cell. The following index function is used in (9)

$$B^{\text{traj}} = \left\{ {\begin{array}{*{20}l} {1,} \hfill & {\text{if grid cell is hit by trajectory}} \hfill \\ {0,} \hfill & {\text{else}} \hfill \\ \end{array} } \right..$$

(6)

As the volume height is chosen to be approximately 2 m, also fragments are considered in the modified fragment density of (5) that only perforate the assessment volume but do not hit its ground area. This definition is used to take conservatively account of all fragments that are dangerous for humans. Due to this definition, the total fragment number is not conserved when comparing the number of launched representative fragments and the total number of fragments on the ground as computed by (5). An alternative fragment density which preserves the total number is (5) without the last fraction.

It is important to note that the number of representative fragment launching windows and the evaluation grid sizes must be chosen such that sufficient representative fragments are launched and hence captured on ground within the simulation. The main advantage of this approach is that it may take account of more complicated trajectory propagation approaches as well as barriers anywhere during flight of fragments.

5 Consequence and Damage Analysis

Based on the spatial distributions of blast and fragment loadings, the presented approach determines spatial distributions of blast, fragment and combined consequences and damages as described in Sects. 5.1–5.3.

5.1 Blast Consequences

Human injury and building damage due to blast are calculated using historically derived empirical damage models. These damage models take as input one or two physical hazard loading quantities and provide as direct output quantity a probit value $Pr$, which can be transformed into a probability of damage $P$. The EQRA approach has been described in (Aschmoneit and Häring (2010)) along with the graphical, maximum likelihood and momentum and bootstrap approaches to determine the probit functions and corresponding probabilities from few data as conducted during the selection and validation of the probit functions. Probit functions can be understood to use lognormal functions in a way agreed by convention.

Harmful effects on the human body are described by the probabilities of eardrum rupture and lethal lung injury. With reference to Absil et al. (1998), eardrum rupture is not considered to be the most severe ear injury due to blast, but is deemed as a good measure of the threshold for more severe ear damage. According to Merx (1992a), the probit value of eardrum rupture is calculated by

$$Pr_{\text{inj}}^{\text{ear}} = - 12.6 + 1.524\ln \frac{\Delta p}{\text{Pa}},$$

(7)

where $\Delta p$ is the peak overpressure of the blast wave given in Pascal.

Furthermore, the probability for lethal lung injuries is defined as the measure fatality in the EQRA approach. According to Bowen et al. (1968) different positions of the human body influence the severity of blast wave effects and should therefore be taken into consideration. In a free-field blast scenario, for instance, the probability of lung injury is higher for standing people than for people in prone position at the same distance to the explosion, which is due to different areas exposed to blast impact and reflection effects. In a complex blast scenario, the probability of lung injury is higher for people standing or lying in front of a surface, which reflects and compresses the blast wave. For simplicity, the EQRA tool predicts the human injury probability for free-field conditions and for people standing in front of walls.

Referring to Merx (1992a), the probit value of lethal lung injury is calculated for the two cases by

$$Pr_{\text{inj}}^{\text{lung}} = 5 - 5.74\ln \left( {4.2\frac{{p_{0} }}{{\Delta p_{\text{eff}} }} + 1.3\frac{{\left( {p_{0} /{\text{Pa}}} \right)^{1/2} \left( {m_{\text{p}} /{\text{kg}}} \right)^{1/3} }}{{I_{\text{eff}} /\left( {{\text{Pa }}\;{\text{s}}} \right)}}} \right),$$

(8)

$$\Delta p_{\text{eff}} = \left\{ {\begin{array}{ll} {\Delta p + \frac{{5\Delta p^{2} }}{{2\Delta p + 14 \times 10^{5} \; {\text{Pa}}}},} \hfill & \quad {\text{for people standing in free field}} \hfill \\ {\frac{{8\Delta p^{2} + 14\Delta p \times 10^{5} \;{\text{Pa}}}}{{\Delta p + 7 \times 10^{5} \;{\text{Pa}}}},} \hfill & \quad {\text{for people standing in front of walls}} \hfill \\ \end{array} } \right.$$

(9)

and

$$I_{\text{eff}} = \frac{1}{2}\Delta p_{\text{eff}} \Delta t.$$

(10)

Here, $p_{0}$ is the atmospheric pressure, $\Delta p_{\text{eff}}$ is the effective overpressure defined in (9), $\Delta p$ is the peak overpressure, $m_{\text{p}}$ is the mass of a person, $I_{\text{eff}}$ is the effective specific impulse defined in (10), and $\Delta t$ is the duration of the overpressure phase of the blast wave.

Even if (7) and (8) are based on historic data, in several intensive literature research studies for comparison of blast fatality criteria and taking account of similar approaches resorting to open literature, the selected approach was confirmed as current best practice (Rübarsch and Gürke 2001). This also holds true today. The challenge with point mass models for ear and lung response is that they require the determination of even more empirical parameters when compared to probit models. However, due to the fast cubic radial decay of the blast loading quantities, probit models already generate rather precise critical distances. The determination of even few parameters of point mass models is challenging from empirical data (Fischer and Häring 2009), even more in such a sensitive domain when compared to structural damage quantification.

For the assessment of building damages, the EQRA tool calculates the probability of windowpane breakage and the severity of structural damage. The estimation of window damage is based on a model provided by Assael and Kakosimos (2010) and Merx (1992b). According to this model, the probit value of windowpane breakage can be calculated by

$$Pr_{\text{dam}}^{\text{win}} = - 16.58 + 2.53\ln \frac{\Delta p}{\text{Pa}}.$$

(11)

In addition, the estimation of the structural damage is based on another model provided by the Dutch publication series on dangerous substances (BZK et al. 2005) and the NATO standard AASTP-4 (2016). According to this model, the EQRA tool calculates the probit value of structural damage $Pr_{\text{dam}}^{\text{struc}}$ by

$$Pr_{\text{dam}}^{\text{struc}} = \left\{ {\begin{array}{ll} { - 4.375 + 1.006\ln \frac{\Delta p}{\text{Pa}},} \hfill &\quad {{\text{if}}\;\log \frac{I}{{{\text{Pa }}\;{\text{s}}}} \ge - 0.149 + 0.665\log \frac{\Delta p}{\text{Pa}}} \hfill \\ { - 3.863 + 1.513\ln \frac{I}{{{\text{Pa }}\;{\text{s}}}},} \hfill &\quad {\text{else}} \hfill \\ \end{array} } \right.,$$

(12)

where $I$ is the specific impulse of the blast wave and $\Delta p$ the blast overpressure. In the case of structural damage, the resulting probit value is not transformed into a damage probability. It is rather directly linked to a specific level of damage. Table 2 shows lower thresholds of the probit value for different levels (severity categories) of structural damage used in the present approach.

Table 2 Lower thresholds of probit value for different levels (severity categories) of structural damage (based on BZK et al. 2005; AASTP-4 2016)

5.2 Fragment Consequences

Personal injury caused by fragment projection is computed using historically derived empirical damage models taking the hit probability and the number of hits into account. According to Dörr et al. (2007), the probability that a person is hit by a fragment depends on the position and presented area of the human body in relation to the fragment trajectory. To determine the presented area of a person, the EQRA tool uses cuboidal volume elements that represent the body of a standing person.

Like the physical hazards due to fragments at ground level (see Sect. 4.2), the probability of personal injury due to fragments is calculated in each single cell of the cylindrical ground assessment grid. Therefore, the probability $P_{\text{hit}}$ that a fragment hits a standing person is determined for a specific grid cell by the ratio of the presented area of the human body $A_{\text{pers}}$ and, as illustrated in Fig. 4, the presented area of the grid cell $A_{\text{cell}}$ in the direction of motion of the fragment $\theta$. In addition, an averaging of all horizontal orientations $\varphi$ of the person is applied to take account of the unknown orientation of persons:

$$P_{\text{hit}} = \hbox{min} \left( {1, \frac{{A_{\text{pers}} }}{{A_{\text{cell}} }}} \right).$$

(13)

Fig. 4

Determination of hit probability using the presented area of the assessment grid cell and the average area of the human body projected in the direction of motion of the incident fragment (Dörr et al. 2007). Different body volume elements and surfaces are indicated

To determine the damage probability in the event of an impact of a single fragment on a person, the EQRA tool uses two empirical–analytical damage models for skin penetration and lethal injury in terms of critical pressure and critical energy, respectively. Sellier and Kneubuehl (1992) state that a specific kinetic energy per area of about 100,000 J/m² is required to rupture human skin. To be able to use this criterion for skin penetration in the damage analysis of the EQRA tool, the critical value has to be transformed into a probability. As Häring et al. (2009) suggest, this can be done by using the piecewise-defined step function

$$P_{\text{inj1}}^{\text{traj}} = \left\{ {\begin{array}{*{20}l} {1,} \hfill & {{\text{if }}\;E_{\text{kin,f}} /A_{\text{f}} \ge 100 ,000\; {\text{J/m}}^{2} } \hfill \\ {0,} \hfill & {\text{else}} \hfill \\ \end{array} } \right..$$

(14)

Here, $E_{\text{kin,f}}$ is the kinetic energy of the fragment, and $A_{\text{f}}$ is the average presented area of the fragment in the direction of motion. The potential of a fragment to cause skin penetration states nothing about the potential of the fragment to cause lethal injury. If the criterion of skin penetration is fulfilled, the resulting injury could be either lethal or non-lethal.

To cause lethal injuries, it is often assumed by convention that fragments with masses from a few grams to several kilograms require a kinetic energy of about 79 J (Crull and Swisdak 2005; AASTP-1 2015). In the EQRA tool, this criterion for lethal injury is used in the damage analysis where the critical value is transformed into a probability using the step function

$$P_{\text{inj2}}^{\text{traj}} = \left\{ {\begin{array}{ll} {1,} \hfill &\quad {{\text{if }}\;E_{\text{kin,f}} \ge 79 \;{\text{J}}} \hfill \\ {0,} \hfill &\quad {\text{else}} \hfill \\ \end{array} } \right..$$

(15)

Taking the previous components into account, the overall local probability of damage $P_{\text{dam}}^{\text{frag}}$ of persons (injuries or lethal) due to possible multiple hits by fragments is determined for a specific cell of the ground grid by

$$P_{\text{dam}}^{\text{frag}} = 1 - \mathop \prod \limits_{\text{traj, nj}} \left( {1 - B^{\text{traj}} P_{\text{hit}}^{\text{traj}} P_{\text{inj}}^{\text{traj}} } \right)^{{N_{\text{frag}}^{\text{traj}} }} .$$

(16)

Here, $B^{\text{traj}}$ is the Boolean-valued index function of (6), $P_{\text{hit}}^{\text{traj}}$ is the hit probability of (13), $P_{\text{inj}}^{\text{traj}}$ is the injury probability $P_{\text{inj1}}^{\text{traj}}$ of (14) or $P_{\text{inj2}}^{\text{traj}}$ of (15), and $N_{\text{frag}}^{\text{traj}}$ is the number of fragments per trajectory. The product in (16) runs over all possible trajectories and both injury types (${\text{inj1, inj2}}$) and assumes that the individual fragment damage effects are statistically independent, i.e., no shock effects take place. The local damage probability of persons due to fragments is computed for each cylindrical grid cell shown in Figs. 3 and 4.

5.3 Combined Consequences

To assess the human injury that is expected outdoors from combined blast and fragment effects, the approach combines the damage probabilities of the individual effects at the discrete locations represented by the cylindrical assessment grid elements by

$$P_{\text{dam}} = 1 - \left( {1 - P_{\text{dam}}^{\text{blast}} } \right)\left( {1 - P_{\text{dam}}^{\text{frag}} } \right).$$

(17)

Here, $P_{\text{dam}}$ is the damage probability due to the combined effects of blast and fragments, and $P_{\text{dam}}^{\text{blast}}$ and $P_{\text{dam}}^{\text{frag}}$ are the damage probabilities due to the individual effects of blast and fragments derived in (8) and (16), respectively. Again, statistical independence is assumed in (17).

For human injury indoors due to combined effects, the approach applies an empirical–analytical probit damage model according to Gilbert et al. (1994)

$$Pr_{\text{dam}} = \left\{ {\begin{array}{ll} {7.955 - 1.77\ln z,} \hfill &\quad {{\text{for slight}}, {\text{serious and lethal injury}}} \hfill \\ {6.923 - 1.70\ln z,} \hfill & \quad {\text{for lethal injury}} \hfill \\ \end{array} } \right.,$$

(18)

where $z$ is a scaled distance based of the real distance $R$ to the centre of the explosion with the TNT equivalent explosive mass $m_{\text{TNT}}$:

$$z = \frac{{R/{\text{m}}}}{{\left( {m_{\text{TNT}} / {\text{kg}}} \right)^{1/3} }}\left[ {1 + \left( {\frac{3175}{{m_{\text{TNT}} / {\text{kg}}}}} \right)^{2} } \right]^{1/6} .$$

(19)

In threat scenarios, which include more than one explosive hazard source, the effects of individual hazard sources are statistically superposed at discrete locations by

$$P_{{{\text{dam }}\;{\text{com}}}} = 1 - \mathop \prod \limits_{\text{haz}} \left( { 1 - P_{\text{dam}}^{\text{haz}} } \right).$$

(20)

Here, $P_{\text{dam}}$ is the damage probability due to the combined effects of several hazard sources, and $P_{\text{dam}}^{\text{haz}}$ is the damage probability due to the individual effects of a single hazard source as given by (17), which suppressed the information on the hazard source considered in the notation for simplicity. The product in (20) loops over all hazard sources.

6 Event Frequencies and Exposition

While the exposure probability of exposed sites like buildings and infrastructures is assumed as unity, the exposure of persons at exposed sites is estimated as the dimensionless annual average exposure $E$, calculated by the number of hours per year of persons at the exposed site divided by the total hours of the year:

$$E = \frac{{{\text{Exposition }}\;{\text{time }}\;\left[ {\text{h}} \right]}}{{{\text{Total}}\; {\text{hours}}\; {\text{per }}\;{\text{year }}\;\left[ {\text{h}} \right]}} .$$

(21)

An example is given in (22), where the annual exposure $E$ of a full-time professional who works eight hours per day at 300 days per year at a site is determined by

$$E = \frac{{8\;{\text{h/d}} \times 300\;{\text{d}}}}{{24\;{\text{h/d}} \times 365\;{\text{d}}}} = 0.274 .$$

(22)

The event frequency $F$ of explosions is determined under consideration of the information given in the scenario analysis as described in Sect. 3.2, in particular on the hazard source characteristics, class and the type of its handling. Any handling or even manipulation activities and of course any non-professional origin of the source such as homemade explosives increase the probability of an explosion by suitable orders of magnitude.

Exposition profiles of single persons or groups are generated by combining expressions of the form of (22). For each exposition, the corresponding local damage probabilities as described in Sect. 5 need to be taken into account in the consequence, risk and resilience analysis.

7 Risk and Resilience Analysis

Section 7 lists the risk and resilience quantities that are accessible within the present EQRA approach. In this step, risk $R$ is determined by the product of the previously calculated values for consequences $P_{\text{dam}}$ (see Sect. 5), exposition $E$ and event frequency $F$ (see for both Sect. 6).

Resorting to Blaise Pascal’s risk formula, risk is defined to be proportional to both probability and consequence of an event, and the general equation for local risk in the EQRA approach reads

$$R = F E P_{\text{dam}} .$$

(23)

7.1 Local Individual Annual Risks and What-if Risks

In the EQRA tool, risk can be expressed by the individual probabilities of the respective consequence or damage injury or fatality according to blast, fragments or combined effects in case of an event. The tool calculates spatial distributions of individual local risks of the different types of consequences using the output from the damage analysis and the specified event frequency.

The local individual annual risk $R$ of a certain type of consequence in case a person is fully exposed all year long, which is a very conservative approximation, and is determined at discrete locations in the threat scenario by a multiplication of the local individual damage probability $P_{\text{dam}}$ for the respective consequence class and the event frequency $F$ estimated by the user in the scenario modeling step (see Sect. 3):

$$R_{{{\text{ind}}\;{\text{anu}}}} = F P_{\text{dam}} .$$

(24)

The local individual damage probabilities $P_{\text{dam}}$ in (24) cover ear injury (7) due to blast, fatality (lethal lung injury) (8) due to blast, lethality of fragments (16) or combined effects (17) in case of an event (what if consequences). In a similar way Eq. (24) can be evaluated for multiple events according to (20). Equation (24) assumes that the person is exposed 1 year.

Local individual what-if damage effects (risks) of a single or defined multiple events are suitable to assess the effect of potential explosions on persons, buildings and objects assuming. They assume a single or a set of events takes place with certainty. They determine the average local consequences by setting $F = 1$ in (24), i.e.,

$$R_{{{\text{ind }}\;{\text{wi}}}} = P_{\text{dam}} .$$

(25)

7.2 Annual Local Individual and Annual Individual Profile Risks

If persons are exposed on several sites, depending on the expected exposures, annual local individual and annual profile risks of persons and for groups of persons are accessible. Typically, exposure times for third party, professionals, etc., differ by orders of magnitude.

The annual local individual risk reads

$$R_{\text{ind}} = F E P_{\text{dam}} ,$$

(26)

where $P_{\text{dam}}$ is defined as below (24) and E is given in (21). The annual individual profile risk of a person reads

$$R_{{{\text{ind }}\;{\text{pro}}}} = F \mathop \sum \limits_{\text{site}} E_{{{\text{ind}}\; {\text{site}}}} P_{{{\text{dam }}\;{\text{site}}}} ,$$

(27)

where $E_{{{\text{ind }}\;{\text{site}}}}$ are the expositions of the person at the different sites and $P_{{{\text{dam }}\;{\text{site}}}}$ are the damage effects of the explosion event or simultaneous events at each site. Requiring that $R_{{{\text{ind }}\;{\text{pro}}}}$ is below an individual annual critical risk ensures that no single person is exposed to excessively high-risk values.

The tool EQRA provides the same annual individual risk comparison values for all individual risks introduced. Most of them were taken from (Proske 2004) and references therein. Within different user groups the annual risk of accidents in Germany of about $5.0 \times 10^{ - 4} /a$ and the classical de minimis risk of $1.0 \times 10^{ - 6} /a$ proved to be important benchmarks.

7.3 Average Local and Overall Consequence Numbers

The local average absolute consequence numbers for each site for different types of consequences as discussed below (24) read

$$N_{{{\text{tot }}\;{\text{site}}}} = F \mathop \sum \limits_{\text{group}} E_{{{\text{ind}}\; {\text{site}}\; {\text{group}}}} N_{{{\text{site}}\; {\text{group}}}} P_{{{\text{dam }}\;{\text{site}}}} ,$$

(28)

where $E_{{{\text{ind }}\;{\text{site}}\; {\text{group}}}}$ is the exposition of a person belonging to a group at the site considered, $N_{{{\text{site }}\;{\text{group}}}}$ is the number of persons in a group, and $P_{{{\text{dam }}\;{\text{site}}}}$ is the consequence probability of the consequence types selected at the site of interest. The sum loops over all groups in the scenario.

The total average number of persons affected regarding a selected consequences type considered is obtained by looping over all sites

$$N_{\text{tot}} = \mathop \sum \limits_{\text{site}} N_{{{\text{tot }}\;{\text{site}}}} .$$

(29)

7.4 f–N and F–N Curves

By the aid of the individual annual local risks $R_{{{\text{ind }}\;{\text{anu }}\;{\text{site}}}}$ for each site for different consequence types according to (24), f–N and subsequently F–N curves are generated. The F–N curves generated can be compared and evaluated with the help of F–N criteria, thus providing input for steps 6 and 7 of Fig. 1 regarding collective risk assessment. The subsequent derivation follows the approach described by Salhab et al. (2011a), slightly extending it since more consequence computation options are considered.

An f–N curve gives discrete annual frequency values $f_{f - N} \left( {N_{f - N} } \right)$ in dependence of an extent of loss $N_{f - N}$, usually defined as the number of fatalities of injured or financial loss (see, e.g., Proske 2004). From (24) we know for each person the individual local annual risk for a selected consequence class for each of the $N_{\text{ES}}$ exposed sites

$$R_{{{\text{ind }}\;{\text{anu, 0}}}} , R_{{{\text{ind }}\;{\text{anu, 2}}}} , \ldots ,R_{{{\text{ind }}\;{\text{anu}}, N_{\text{ES}} - 1}} ,$$

(30)

where for later notational convenience the counting starts at zero.

Also we can define $N_{\text{ES}}$ integer indices for each exposed site $i_{0} , i_{1} , \ldots , i_{{N_{\text{ES}} - 1}}$ such that the following two conditions hold

$$\begin{aligned} & 0 \le i_{0} \le N_{{{\text{ES}},0}} , \ldots , 0 \le i_{{N_{{{\text{ES}}^{ - 1} }} }} \le N_{{{\text{ES}},N_{\text{ES}} - 1}} , \\ & N_{f - N} = i_{0} + i_{1} + \cdots + i_{{N_{{{\text{ES}}^{ - 1} }} }} . \\ \end{aligned}$$

(31)

The conditions of the first line ensure that not more persons are considered in the computations than are present at an exposed site for each subscenario given the numbers of persons for each site as $N_{{{\text{ES}},0}} , \ldots , N_{{{\text{ES}}, N_{\text{ES}} - 1}}$ considered for a group risk assessment, see also the upper bound of the sums in (33). The second line ensures that the total number for each subscenario considered sums up as requested for the f–N curve, see again its use in (33). Given (31) one has of course

$$1 \le N_{f - N} \le N_{\text{pers}} = \mathop \sum \limits_{k = 0}^{{N_{{{\text{ES}}^{ - 1} }} }} N_{{{\text{ES}},k}} .$$

(32)

The total number of persons is given by the sum of persons at each site, and at least one person should be present in the scenario.

The f–N curve reads for each consequence type as discussed below (24),

$$\begin{aligned} f_{f - N} \left( {N_{f - N} } \right) & = \mathop \sum \limits_{{i_{0} = 0}}^{{N_{{{\text{ES}}, 0}} }} \mathop \sum \limits_{{i_{1} = 0}}^{{N_{{{\text{ES}}, 2}} }} \ldots \mathop \sum \limits_{{i_{{N_{{{\text{ES}}^{ - 1} }} }} = 0}}^{{N_{{{\text{ES}}, N_{\text{ES}} - 1}} }} \left( {i_{0} + \cdots + i_{{N_{{{\text{ES}}^{ - 1} }} }} = N_{f - N} } \right) \\ & \quad \times \mathop \prod \limits_{k = 0}^{{N_{{{\text{ES}}^{ - 1} }} }} \left( {\begin{array}{*{20}c} {N_{{{\text{ES}},k}} } \\ {i_{k} } \\ \end{array} } \right)\left( {R_{{{\text{ind }}\;{\text{anu,}} k}} } \right)^{{i_{k} }} \left( {1 - R_{{{\text{ind }}\;{\text{anu}}, k}} } \right)^{{N_{{{\text{ES}},k}} - i_{k} }} ,\quad 1 \le N_{f - N} \le N_{\text{pers}} , \\ \end{aligned}$$

(33)

where the sums run over all different combinations that fulfill (31) as expressed by the index function, which is one if the statement is true and zero otherwise. As in (16), (17) and (20), in (33) the individual annual local risk of persons with respect to a consequence type is assumed to be statistically independent.

More common, however, is the presentation of the group risk assessment in F–N curves that are easily derived from f–N curves. The annual probability of occurrence $F_{F - N} \left( {N_{F - N} } \right)$ describes the occurrence of events with $N_{F - N}$ or more fatalities or injured. F–N curves are calculated with (33) by

$$F_{F - N} \left( {N_{F - N} } \right) = \mathop \sum \limits_{{n = N_{F - N} }}^{{N_{\text{pers}} }} f_{f - N} \left( n \right) .$$

(34)

F–N curves can be compared with collective F–N risk acceptance criteria as given by several countries. Figure 5 shows an exemplary sample F–N curve generated with the approach described, along with F–N criteria.

Fig. 5

Comparison of an exemplary F–N curve with different collective risk acceptance criteria: F–N curve as computed (pink). The F–N criteria used are referenced and discussed in the main text (color figure online)

The F–N curve is evaluated with the help of five different risk acceptance criteria that enable the user to classify and interpret the results accordingly: ALARP boundary with broadly acceptable in green and intolerable in light blue, Hong Kong truncated in orange, Netherlands (VROM) in yellow and Denmark in dark blue (Bottelberghs 2000, Floyd and Ball 2000, HSE 2001, Stallen et al. 1996).

The listed collective F–N criteria can be used for assessing post-event expected response and recovery behavior. Only if the F–N curves are fast decaying by orders of magnitudes as in Fig. 5, it is likely that catastrophes can be prevented since massive numbers of injuries or fatalities are sufficiently unlikely. For instance, the annual probability of having 10 or more fatalities according to Fig. 5 is less than $1 \times 10^{ - 6} /a$, i.e., below the de minimis risk.

This allows to assess also the expected response and recovery behavior post-events, since high injury and fatality numbers can be excluded along with corresponding requirements regarding responders. Together with the knowledge of the risk evaluation team, this information can be used to decide whether the resilience of the considered scenarios is evaluated as acceptable.

8 Validation Examples

Each modeling and computation step as described in Sects. 3, 4, 5, 6 and 7 has been verified and validated. The overall approach was validated in several scenarios, two of which are exemplarily detailed in Sects. 8.1 and 8.2. The aim is to demonstrate the general applicability of the approach and its implementation, to verify the results and to identify possible limitations or gaps.

8.1 The 2011 Oslo Bombing

For the validation of the EQRA tool, a comparative study on the 2011 Oslo bombing focusing on the window damages due to the blast was conducted. The sample case uses an explosive source net explosive quantity according to the back-calculation of the bombing conducted by Christensen and Hjort (2012) for the subsequent trial against the perpetrator, namely 500 kg TNT equivalent. This explosive source is put in the 3D urban governmental environment, and the observed glass and façade damage assessments of Christensen and Hjort (2012) are compared with the analysis of EQRA.

On July 22, 2011, the right-wing terrorist Anders Behring Breivik carried out a vehicle-borne improvised explosive device (VBIED) attack in the government district of Oslo, Norway. A rental van, loaded with 950 kg ammonium nitrate and fuel oil (ANFO), was parked in front of the main entrance of the building housing several ministries and the Norwegian Prime Minister’s office. Breivik ignited the fuse and fled the scene. The van detonated shortly thereafter, killing eight people and wounding 209. Furthermore, several buildings in the surrounding area were damaged by the blast loading; in particular, window pane breakages were recorded at distances up to 400 ms.

Figure 6 compares the real window damages as recorded immediately after the actual attack by Christensen and Hjort (2012) to a screenshot of the window pane breakage probabilities calculated according to Eq. (11) by the EQRA tool with the complex-blast approach described in Sect. 5.1.

Fig. 6

Comparison of the window damages after the blast as recorded by Christensen and Hjort (2012) on the left and the probability of window pane breakage calculated by the EQRA tool on the right. The hazard source location is marked with a red cross, respectively. A 200 m distance scale is inserted for comparison in both cases

The comparison validates a sufficiently good and conservative prediction of glazing damages with slightly overestimated areas. This also holds for the 400 m distance line. All windows destroyed in reality were destroyed in the simulation. Similar results could also be achieved by Fischer et al. (2016) with the VITRUV software. However, only the complex blast simulation allows to determine the venting and channeling effects. The backside of the building closest to the explosive shows the shielding and venting effect most clearly. The road passing from to southwest to northeast shows the channeling effect, i.e., a rather slow decay of blast loading along a street with high buildings.

8.2 The 2008 Islamabad Marriott Hotel Bombing

The second event simulated for validation with the EQRA tool is the 2008 bomb attack on the Marriott Hotel in Islamabad, Pakistan, one of the most prestigious hotels in the country and located very close to government buildings and diplomatic missions.

This validation case study is largely based on the simulations by Brombacher et al. (2011b) and additional information on the attack according to Schuler (2008). As in Sect. 8.1, the scenario was built taking account of the estimated explosive source characteristics. In addition, the person densities on the street and in buildings were modeled by numerous exposed sites, see Fig. 7.

Fig. 7

Isodamage probability curves for different levels of eardrum rupture (10%, 50%, 90%) assuming free-field blast propagation (top left) and with complex blast propagation (bottom left). Isodamage probability curves for different probabilities of lethal lung injury (10%, 50%, 90%) for free-field blast (top right) and for complex blast (bottom right)

On September 20, 2008, at around 8 p.m., an explosives-laden truck tried to break through the hotel’s entry control point. However, the truck remained stuck in the safety barriers. A few seconds later, the truck driver detonated his explosive vest, killing himself and setting the truck thereby on fire. Security guards and further hotel employees unsuccessfully tried to extinguish the fire, while the hotel guests were instructed to move to the backside of the hotel.

After a few minutes, the main truck load detonated. The truck was reportedly loaded with 500–600 kg of TNT (trinitrotoluol) mixed with RDX (Research Department Explosive), aluminium powder, ammunition and mortars. The explosion caused accordingly a huge crater with diameter 18 m and 4.5 m depth. In total, 54 persons were killed and 266 injured by the explosion and the subsequent fire that also devastated large parts of the building and further objects like cars in the surrounding area.

Figure 7 shows isodamage curves indirectly computed using free-field propagation according to (1) and complex blast as described at the end of Sect. 5.1. In both cases, probit functions are used to determine the probability of ear rupture according to (7) and of lethal lung injury according to (8). Three consequence probability levels are used 10%, 50% and 100%, which are shown by colored lines or in terms of heat maps with isoprobability coding in the case of complex blast. It can be observed how the building closest to the explosive site increases the blast effect, especially in corners but also provides shielding behind.

Figure 8 shows that the fragments of the additive ammunition and mortars travelled through a large volume and covered an area within a radius of over 500 m, see also the discussion along with Fig. 3. The maximum fragment range is reached by heavy and fast fragments launched at a vertical angle significantly below 45°. Figure 9 shows the expected consequences due to high-energy fragments according to the NATO energy criterion on the left side according to (15) and due to general skin penetration on the right side according to (14).

Fig. 8

Fragment “launching hedgehog,” propagation and fragment density at ground level (Brombacher et al. 2011b)

Fig. 9

Probability of lethal injury according to NATO criterion (left) and probability of injury due to skin penetration (right) as described in Brombacher et al. (2011b)

As expected, a large area is affected in both models: according to Eq. (15) for high-energy fragments in the left figure for assessing lethality and when using (14) for high energy per area fragments in the right figure when assessing skin injury. The street, parking lot and arcade building are mainly affected. But also effective fragment shielding effects are visible for the backside of the hotel and especially behind the low buildings in front of the main hotel building. For this reason, the EQRA tool predicts only for the area of the courtyard at the entry of the hotel and the road in front of it a probability of over 90% to be lethally injured by fragments. Skin injuries are expected to even much further distances, see Fig. 9 right.

When comparing Figs. 7 and 9 it is seen that fragment effects are dominating in the far field, for fatal injuries as well as for minor injuries. This explains the importance of barriers close to explosive sites or at exposed sites for countering fragment and also debris effects which were not covered in the modeling.

Numbers of fatalities computed were 50 and of injured 259, which compares well with the real data. Of course they depend strongly on the exposition assumptions made, the positions of the exposed sites and the numbers of persons of each representative site. However, this seems to be a realistic estimate.

When comparing the Oslo bombing and the Islamabad sample case, it becomes obvious how beneficial barriers are. In a sense, the long low building in front of the main hotel building in Islamabad not only ensured more scaled distance but also shielded the main blast and fragment effect from the main building, at least for the most critical ground levels where most people tend to be exposed. This is a typical example how to improve potential explosive scenarios with the help of barriers and by ensuring more scaled distance. Compared with the potential even much greater damage, the scenario showed at least organizational resilience, however, restricted to the paying guests of the hotel.

9 Conclusions and Outlook

The main objectives of the paper to present in a closed and comprehensive form a modern stepwise assessment approach for risk and resilience analysis of single explosive events or sets of explosive events in urban environments that takes account of spatial information and structural properties of buildings and possible barriers and realistic expositions has been achieved.

The seven major steps introduced in Fig. 1 are resolved in detail in Sects. 3, 4, 5, 6 and 7. The main modeling and simulation approaches were given including sample parameterizations where relevant. In each case, the validation efforts on the level of each method selected were given as well as the most trusted references. In all cases sample parameterizations were given, in particular the probit damage models selected. The present approach is made very transparent by the stepwise presentation of Fig. 1 when compared to the documentation of other approaches in the free scientific literature as available of other tools.

As a key feature, fragment consequence effects as well as the combination of consequence effects of blast and fragments were detailed. This assumed statistical independence of the damaging events of individual fragments and of fragment effects and blast effects. This feature seems unique when compared to other approaches, see Table 1.

For groups of persons distributed on several exposed sites with different local individual annual consequence probability, f–N and F–N curves were derived and exemplarily computed and compared with F–N criteria. At least in traditional EOD clearance scenario assessments as conducted in German national context, such approaches are not yet best practice.

It was shown that for successful risk assessment and control as well as for resilience improvement countering explosive events, the following assessment quantities and respective criteria should be used:

• (a) Local individual risks in terms of injuries and fatalities should be controlled to avoid dangerous areas.

• (b) Individual risk profiles should be acceptable to avoid high profile risk levels of individuals, e.g., persons that care for neutralizing home-made explosive devices.

• (c) Finally, collective risks should be under control to avoid catastrophes. This is in particular prerequisite for fast response and recovery post-events, i.e., high resilience with respect to explosive threat scenarios. This can be achieved by inspecting local and total average what-if injured and fatality numbers and in particular F–N diagrams.

It was shown how to improve resilience post-events by efficiently preventing catastrophes by applying what-if assessments of scenarios. Several such assessments can be used to determine collective FN curves for assessing group risks as well as, e.g., local and overall numbers of injured.

Potential scenarios should be improved regarding risk control and resilience, e.g., by applying organizational means through access control regarding potential explosive sources and reduction of person expositions, generating more distance to potentially exposed sites and by introducing barriers at potential explosive sites and at exposed sites. In all cases, it was shown that the approach can compute the effect of such risk control and resilience enhancement measures.

In the sample cases of Oslo and Islamabad, events with very high loads were not excluded physically, e.g., by access barriers like massive bollards, ha–ha walls or barriers for providing more distance to occupied buildings. The calculations provided for Islamabad can explain the low victim numbers of foreigners and the high numbers of victims among locals, who tried to prevent the event or were in the streets in the vicinity of the hotel. Due to organizational efforts post-event the foreigners were moved to safe areas. In summary, local risks are typically mitigated using physical barriers, individual and collective risks are mitigated using training, organizational means and physical access control. These measures reduce person densities at exposed sites.

For risk and resilience communication, the present approach provides rich visualization options in 2D, 3D and by providing F–N curves, tables of local absolute injury and fatality numbers as well as of total injury and fatality numbers of scenarios.

The case studies showed that the approach is applicable for a variety of scenarios. Good conformity of real attack sequences and EQRA simulations was found, including the number of fatalities, injured and the selected structural damage example of breakage of glass.

The handling of the tool was found to be sufficiently well for experts in the field and is deemed accessible for informed and trained users with corresponding background within short time, i.e., ca. 10 days of training and self-study.

The involvement of stakeholders, decision makers, third parties and end users in the process of quantitative risk and resilience analysis was shown in detail. In particular, it was emphasized that the users expect a single input phase after which all assessment and evaluation support options are accessible within very short time. The present approach allows for sufficiently fast computations that can also be used post-event by informed users.

One first improvement option of the approach is to look for better consequence models, some of which rely on parameterizations of World War II data. Instead of TNT equivalents, also the input of other explosives could be allowed by employing TNT equivalence computations based on net explosive equivalence tables regarding blast overpressure and blast impulse. The complex blast simulation outputs could be coupled with single degree-of-freedom models for structural response or by using blast-impulse versus blast-overpressure (P-I) diagram lookup tables for improved damage assessment. A further improvement and consistency check could be to compare the total fatality numbers as computed from F–N curves with numbers as computed from local average absolute numbers.

Further improvement requiring major effort could be achieved by considering also debris throw and crater ejections. Furthermore, vehicle fragments could be considered in detail, thus extending more standard fragment launching condition characterizations and models. Also models could be selected or developed for persons exposed in vehicles instead of in buildings. Finally, many forward calculations from scenario to consequences could be used for backward or inverse calculations within a novel framework for forensic applications that allows to determine the hazard source given a spatially distributed consequence pattern. For quantifying resilience post-events beyond providing the well-founded initial loss quantities as detailed depending on geometry, materials used and person distributions, additional scenario-specific information could be used for the quantification of short-term catastrophe response and long-term reconstruction processes, including societal effects on planning.