A risk evaluation method for deformation monitoring systems

In this contribution, we propose a method for statistically evaluating the risk in a deformation monitoring system. When the structure under monitoring moves beyond tolerance, the monitor system should issue an alert. Only a very small probability is acceptable of the system telling us that no change beyond a critical threshold has taken place, while in reality it has. This probability is referred to as integrity risk. We provide a formulation of integrity risk where the interaction between estimation and testing is taken into account, implying the use of conditional probabilities. In doing so, we assumed different scenarios with the alerts being dependent on both the identified hypothesis and the threat that the estimated size of deformations entails. It is hereby highlighted that a correct risk evaluation requires estimation and testing being considered together, as they are typically intimately linked. In practice, one may, however, find it simpler computation-wise to neglect the estimation–testing link. For this case, we provide an approximation of the integrity risk. This approximation may provide a too optimistic or pessimistic description of the integrity risk depending on the testing procedure and tolerances of the structure at hand. Monitoring systems, besides issuing timely alerts, are also required to provide threat estimates together with their corresponding probabilistic properties. As the testing outcome determines how the threat gets estimated, the threat estimator will then inherit the statistical properties of both estimation and testing. We derive the threat estimator b¯j\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$\bar{b}_{j}$$\end{document} and its probability density function, taking the contributions from combined estimation and testing into account. It is highlighted that although the threat estimator under the identified hypothesis Hj\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$${\mathcal {H}}_{j}$$\end{document}, i.e., b^j\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$\hat{b}_{j}$$\end{document}, is normally distributed, the estimator b¯j\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$\bar{b}_{j}$$\end{document} is not. It is explained that working with b^j\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$\hat{b}_{j}$$\end{document} instead of b¯j\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$\bar{b}_{j}$$\end{document}, thus ignoring the estimation–testing link, may provide a too optimistic description of the threat estimator’s quality. The presented method is illustrated by means of two simple deformation examples.


Introduction
Monitoring systems for both man-made structures (such as a dam, a dike, or a bridge) and natural Earth structures (such as a volcano, a fault, or tectonic plates), which-upon load or changing circumstances-may be subject to deformation and/or displacement, are safety-critical. The monitor system should timely detect a real effect, but on the other hand issue the performance of the monitoring for a specific hypothesis, the corresponding integrity risk needs to be evaluated. Such an evaluation can even already be done in the designing phase prior to the operational phase of the monitoring system when the actual measurements are collected. For example, one may tune the statistical testing procedure such that a (very) small integrity risk is guaranteed.
Many studies have so far been devoted to analysis of structural deformation measurements and designing proper deformation monitoring procedures. Pelzer (1971) was one of the first to set out a mathematical framework for geodetic deformation analysis. The analysis is based on the so-called (global) congruence test, carried out on the difference vector between the coordinates at two epochs in time, formally to find out whether shape and/or size of the pointfield has changed or not. When this test is passed, the conclusion reads that there is no deformation or displacement of the pointfield covering the object/area of interest and its surroundings. The mathematical procedure was extended and elaborated on by van Mierlo (1978). The identification of shifted points was subsequently investigated through a variety of statistical methods (Caspary and Borutta 1987;Chen et al. 1990;Niemeier 1985;Setan and Singh 2001;Sušić et al. 2017;Konakoglu and Gökalp 2018). In Eichhorn (2007), an overview of techniques and trends in geodetic deformation analysis is presented. A recent overview of geodetic deformation analysis is given in the textbook (Heunecke et al. 2013). This book also covers kinematic, static and dynamic deformation models, with the aim of estimating the deformation parameters of interest, see also (Verhoef and De Heus 1995), which proposes the use of polynomial models. A comprehensive review of dam deformation monitoring technologies is provided in Scaioni et al. (2018). Recent studies are still inspired by the earlier framework for geodetic deformation analysis, see, e.g., Durdag et al. (2018) and Yavaşoglu et al. (2018). In the latter paper, once the global congruence test has detected 'some' displacement, attempts are made to fit models consisting of position/displacement, velocity and acceleration parameters. Velocity and acceleration estimators are then tested on significance.
This paper presents a new contribution to the field of deformation monitoring and analysis. We propose a method to statistically evaluate the risk in deformation monitoring. It is highlighted that in the processing of measurements of a monitoring system, estimation and testing are intimately linked and should be considered together when presenting the quality of the output of the monitoring system (Teunissen 2018). As such, the risk assessment under a hypothesis, say H j , can only be done correctly when all testing decision probabilities are taken into account, as well as the implications of testing on the distributions of the estimators for the parameters involved. This needs eventually to be done for all hypotheses at hand in order to arrive at the overall integrity risk. This contribution is organized as follows. In Sect. 2, we first describe the null and alternative hypotheses considered for deformation monitoring analysis. The role of the misclosure space partitioning in testing these hypotheses is then highlighted, and the testing procedure is accordingly specified. It is hereby shown how the estimatorb j of a deformation parameter is formed, capturing the contributions from both testing and estimation. We also derive the distribution of the estimatorb j . The integrity risk is mathematically formulated in Sect. 3. For different scenarios, we provide a strict formulation where the estimation-testing link is taken into account, implying the use of conditional probabilities. We then provide an approximation following from neglecting the conditioning on the testing outcome, which might be considered simpler computation-wise. We hereby highlight that this approximation may provide a too optimistic or pessimistic description of the integrity risk depending on the testing procedure and tolerances of the structure under monitoring.
In Sect. 4, for a simple observational model with just a single alternative, the integrity risk is evaluated both using the strict and approximate approach. We demonstrate in graphical form the factors driving the difference between these two approaches. Assuming that a deformation has taken place, we then provide an analysis of precision of the deformation parameter estimator, with and without accounting for conditioning on testing decision. It is highlighted that negligence of this conditioning process may provide a too optimistic description of the estimator's quality. The integrity risk evaluation is then continued, but now for an actual deformation measurement system example with multiple hypotheses. Finally a summary with conclusions is presented in Sect. 5.

Null and alternative hypotheses
As our starting point, we characterize the null and alternative hypotheses, denoted by H 0 and H i , respectively. Typically in change detection, the null hypothesis H 0 is the 'all-stable, no movement' model, which, here, is assumed to be given as with E(·) the expectation operator, D(·) the dispersion operator, y ∈ R m the normally distributed random vector of observables (with the measurements typically collected at multiple epochs in time), x ∈ R n the estimable unknown parameters, A ∈ R m×n the design matrix of rank(A) = n, and Q yy ∈ R m×m the positive-definite variance matrix of y.
The redundancy of the model of observation equations under As alternative hypotheses, we consider those describing different dynamic behavior of the structure under consideration. In this contribution, we limit ourselves-for simplicity of the analyses-to movements which can be characterized by a single scalar. The observational model under H i (for i = 1, . . . , k) is of the form where c i ∈ R m describes the presumed movement signature, and b i ∈ R\{0} is the size of the nonzero movement, e.g., a displacement (step or jump), or a velocity (rate of change). With b i = 0, we are effectively back at H 0 in (1). Note that [A c i ] is a known matrix of full rank, i.e., rank([A c i ]) = n+1, and scalar b i is unknown. The hypotheses H i (i = 0, 1, . . . , k) are mutually exclusive, implying that E(y) cannot have the same location (in R m ) under different hypotheses. We further assume that the hypotheses at hand do not occur simultaneously, indicating that only one hypothesis is true at a time.
As a simple example, one could imagine that the height of a single point is repeatedly observed at several epochs in time and stacked in vector y. The all-stable, no movement null hypothesis H 0 is then represented by a model in which all observations relate to a single unknown parameter, namely the height of the point under consideration, through the design matrix A which equals a vector of all ones. One of the alternative hypotheses, say H i , could imply a sudden shift in the point height, which is supposed, for example, to occur after the third epoch. Therefore, the shift is present in the height of the point from the fourth epoch onward. Then, scalar b i represents the unknown shift, and the vector c i takes zeros as its first three entries and ones elsewhere.
Alternative hypotheses (2) imply an extension of null hypothesis (1). An extra parameter, namely b i , is introduced in the alternative hypothesis with respect to the null hypothesis, for instance, to accommodate a jump or a rate of change. The very same pair of hypotheses can also be given another interpretation. The alternative hypothesis presents the more general situation, including a possible displacement or rate of change, through parameter b i . In the null hypothesis, this parameter is constrained to zero; with b i = 0, the alternative hypothesis reduces to the null hypothesis. According to this interpretation, one is testing the significance of the extra parameter b i , for instance the rate of change being zero (null hypothesis) or not, and hence significant (alternative hypothesis).
Finally, we mention that, in practice, alternative hypotheses may also concern incidental outliers and faults in the measurements of the monitoring system, or distortions in individual benchmarks. These hypotheses are omitted in the present contribution for the sake of clarity-we focus on actual deformations.

Hypothesis testing
All information required to test the hypotheses at hand against one another is contained in the misclosure vector t ∈ R r given as where B ∈ R m×r is a full-rank matrix, with rank(B) = r , such that . . , k and c 0 b 0 = 0 (to accommodate also the null hypothesis in (1)), the misclosure vector is then distributed as The testing procedure can be established through unambiguously assigning the outcomes of t to the statistical hypotheses H i for i = 0, 1, . . . , k, which can be realized through a partitioning of the misclosure space R r . Therefore, with P i ∈ R r being a partitioning of the misclosure space, i.e., ∪ k i=0 P i = R r and P i ∩ P j = ∅, the testing procedure is unambiguously defined as (Teunissen 2018) select As (5) shows, the decisions of the testing procedure are driven by the outcome of the misclosure vector t. If H i is true, then the decision is correct if t ∈ P i , and wrong if t ∈ P j =i . As such, based on the outcomes of t, we have tabulated the set of events under H 0 and H i in Table 1. The probabilities of the occurrence of these events, denoted by P * with * = {CA, FA, MD i , CD i , WI i , CI i }, satisfy P CA + P FA = 1 Except for FA and CA events, the probabilities of other events under an alternative hypothesis, say H i , depend on the threat value b i . Also note that for the special case of having only one single alternative, say H 1 , we have P 1 = R r \P 0 which implies P WI 1 = 0, thereby P CD 1 = P CI 1 . In this study, our testing strategy comprises two steps of detection and identification, respectively, and is specified as follows -Detection: The validity of the null hypothesis (all stable) is checked through an overall model test (the redundancy needs to be r > 0). The null hypothesis H 0 is accepted if t ∈ P 0 with in which . 2 Q tt = (.) T Q −1 tt (.) and k α,r is the αpercentage of the central Chi-square distribution with r degrees of freedom. α is the false alarm probability, i.e., α = P FA , which is usually set a priori by the user.
-Identification: If the default working model H 0 is rejected in the detection step, a search is carried out among the specified alternatives H i (i = 1, . . . , k) to pinpoint the potential source of deformation (note that with r = 1 identification is not possible). The alternative hypothesis in which w i is Baarda's test statistic computed as (Baarda 1967;Teunissen 2000) It can be shown that the set of regions P i (i = 0, 1, . . . , k) in (7) and (8) forms a partitioning of the misclosure space if and only if c t i = γ c t j for any i = j and for any nonzero scalar γ ∈ R\{0} (Zaminpardaz and Teunissen 2019). This implies that for the case of r = 1 where c t i ∈ R, none of the alternative hypotheses is separable from one another.
Note that once one of the alternatives, say H i , is identified through the above procedure, then follow-on estimations, like deformation estimation, take place according to model (2). This will be discussed in the following subsection.
We remark that since t = B T y = B Tê 0 , withê 0 = y − Ax 0 , the above procedure can be (equivalently) formulated in terms of the least-squares residual vectorê 0 as well, providing a more recognizable form of the testing procedure (Teunissen 2000). Also note that here, for simplicity, we work with alternative hypotheses that are 1-dimensional extensions of the null hypothesis (cf. (2)). Nevertheless, our method is equally valid for higher-dimensional cases, provided that the selection of the H i 's can be done unambiguously (cf. (5)). Finally, note that although we use likelihood-ratiobased statistical tests through (7)-(9), our point, that testing and estimation are intimately linked, holds true for any data-driven decision procedure like p-values (Lehmann and Lösler 2016) and the Akaike Information Criterion (AIC) (Akaike 1974;Burnham and Anderson 2003).

Threat estimation
In deformation analyses, monitoring systems have the task of not only issuing timely alerts when the situation is deemed too dangerous, but also providing threat estimates with their corresponding probabilistic properties. Let b j , the movement size under H j (cf. (2)), be the threat one is concerned with. Depending on whether or not the hypothesis H j is selected through the testing procedure in (5), estimation of b j would be different; b j is estimated once H j is selected, and kept zero otherwise. Therefore, the outcome of testing determines how the deformation b j gets estimated. The probabilistic properties of such an estimation-testing combination can be captured through a unifying framework presented by Teunissen (2018). As such, the estimator of b j is given as with p j (t) being the indicator function of region P j (cf. (5)), i.e., p j (t) = 1 for t ∈ P j and p j (t) = 0 for t elsewhere, and b j the estimator of b j under H j . In this paper, we make use of Best Linear Unbiased Estimation (BLUE), from which the estimator of b j follows aŝ where Asb j is a linear function of the normally distributed misclosure vector t, with (11) and (4), we then havê Note that although estimatorb j is normally distributed, estimatorb j of (10) is not. The estimatorb j is namely, next to its dependence onb j , also nonlinearly dependent on the misclosure t through the indicator function.

The PDF of the threat estimator
To gain an understanding of the properties of the threat estimatorb j in (10), its probability density function (PDF) needs to be studied. As (10) shows, the estimatorb j is constructed from the misclosure vector t and the BLUEb j which, according to (11), is also fully driven by t. Therefore, the probabilistic characteristics ofb j are governed by those of t.
In order to derive the PDF ofb j under H i , we first apply a one-to-one transformation to the misclosure vector t as follows where c ⊥ t j ∈ R r ×(r −1) is a full-rank matrix of which the range space is orthogonal to that of c t j , i.e., c ⊥ T t j c t j = 0, which implies that the normally distributedb j andt j are independent. We remark thatt j represents the 'remaining' misclosures, once parameter b j is estimated according to model (2) for H j . In other words,t j is a misclosure vector obtained employing the alternative hypothesis H j for estimation. For the special case of having only one redundancy (r = 1), we have t ∈ R implying thatb j would be the scaled version of misclosure andt j would no longer exist. For this single-redundancy scenario, no identification can be exercised which means that only one alternative hypothesis can be considered, i.e., j = 1 and k = 1, such that rejection of H 0 implies acceptance of H 1 .
Applying transformation (13) to the regions P i (i = 0, 1, . . . , k), we obtain the new regions P i (i = 0, 1, . . . , k) defined as These regions, like P i in (5), form a partitioning of R r . We are now in a position to derive the PDF ofb j . In doing so, we discriminate between the two cases r = 1 (t ∈ R) and r > 1 (t ∈ R r >1 ).
Theorem 1 (PDF ofb j ) Letb j be given as (10). Then, the PDF ofb j under H i can be expressed as τ the indicator function of the region P j , and P(·) the probability of the occurrence of the event within parentheses.
Proof See Appendix.
As was mentioned before, case (i) is of relevance only for binary hypothesis testing as, with r = 1, one cannot discriminate between alternative hypotheses. Case (i) can be seen as a special case of (ii), since when r = 1, the indicator functionp j (b, τ ) reduces to p j (c t j b), and by substituting this into (16) one gets (15).
The above theorem shows that the PDF ofb j is constructed from two parts. The first part applies when t ∈ P j , and b j gets estimated according to (11), resulting in a normal PDF with no probability mass over a specific interval, while the second part applies when t / ∈ P j , and hence, b j is estimated as zero, which leads to all probability mass getting concentrated at b = 0. Equations (15) and (16) imply that even if the misclosure vector t of (4), and thus the estimatorb j of (12) as well, is normally distributed,b j does not have a normal distribution.
Example Let y ∈ R 2 contain the observations of a single point height over two epochs which are uncorrelated and have the same standard deviation σ . Under the null hypothesis H 0 , the height of this point, x ∈ R, is assumed to remain unchanged over time, whereas under the alternative H 1 , it is assumed that a shift of size b 1 in the height of the point occurs at the second epoch, i.e., c 1 = [0, 1] T . These two hypotheses are then formulated as with I 2 being the identity matrix of dimension two. The redundancy of H 0 is r = 1, implying that t ∈ R. For this binary hypothesis example (k = 1), the partitioning of the misclosure space R is formed by two regions, i.e., P 0 and its complement P 1 = R\P 0 = P c 0 . As r = 1 (t ∈ R), the PDF ofb 1 is obtained from (15). Figure 1 illustrates the PDF of b 1 under H 0 and H 1 assuming b 1 = 3 cm, for three different sets of values of σ and α, i.e., σ = 1/ √ 2 cm and α = 0.01 (left), σ = 1/ √ 2 cm and α = 0.1 (middle), σ = 1 cm and α = 0.01 (right). It is observed that the PDF of the threat estimatorb 1 is made of two parts: a curve and a spike (cf. (15)). The former is obtained by the normal PDF fb 1 (b|H i ) of which the probability mass is set to zero over an interval where p 1 (c t 1 b) = 0.
Therefore, the larger the σ , the wider the interval where p 1 (c t 1 b) = 0. This can also be confirmed by comparing the left and right panels. The second part of the threat estimator PDF is formed by a spike of which the height is given by P(t ∈ P 0 |H 0 ) = 1 − α for the top row and by P(t ∈ P 0 |H 1 ) for the bottom row. The former is the CA-probability (see Table 1) which depends solely on the user-determined α; the larger the α, the smaller the CA-probability, whereas the latter is the MD-probability (see Table 1) which increases when α decreases and/or σ increases.

Integrity
With the null hypothesis H 0 in (1) as the 'all-stable, no movement' model, the alternative hypotheses H j ( j = 1, . . . , k) in (2) are assumed to cover potentially dangerous deformations/movements, and their sizes are characterized through the scalars b j . The monitoring system is therefore required to issue an alert when a significant movement (e.g., displacement or velocity) has occurred. The term 'alert' here should not be confused with the term 'alarm' in Table 1. While the latter is driven by testing procedure only, the former is in addition driven by the threat estimate. The critical or threshold movement is called 'Alert Limit' and denoted by AL. A movement of this magnitude is deemed to pose an immediate dangerous threat to the structure. A region of acceptable threat values b j is then defined as B AL = [−AL, AL] which is a zero-centered region (formally with the origin excluded). Note that, in practice, AL and hence the region B AL may vary for different alternative hypotheses. In the sequel however, for simplicity, we assume that the same threshold value AL applies to all alternative hypotheses.
Definition 1 (Integrity risk) The integrity risk for a monitoring system is defined as the probability of not alerting while an alternative hypothesis, say H j , holds true, and the corresponding threat b j goes beyond the alert limit AL.
With the above definition, no risk will be involved if either H 0 is true or H j holds true while the corresponding threat b j lies below the alert limit. Therefore, the integrity risk (IR) under H 0 and H j reads  (20)) for deformation monitoring application Integrity risk under a specific hypothesis, say H j , is constructed from the probability of the corresponding missed alerts (in red). False alerts (in yellow) are inconvenient and typically imply costs or hassle (taking infrastructure out of service, or evacuating population, while this is not needed). The white areas indicate correct alerts, meaning that a critical movement occurs in reality, and the monitoring system issues indeed an alert (though this may be based on an incorrectly identified hypothesis); the word 'correct' is to be interpreted from a safety perspective. By 'no threat' (in green) we mean that the threat in reality is still below the AL, and hence deemed not immediately dangerous. The decision for H 0 , H 1 , . . . , H k is driven by the misclosure vector t, see (5) IR|H 0 = 0 where ι(b j ) is the indicator function of the region R\B AL defined as ι(b j ) = 0 for b j ∈ B AL , and ι(b j ) = 1 elsewhere. Thus, IR|H j = 0 if b j ∈ B AL . Through the testing procedure, if H 0 is selected then there would be no threat to be estimated, and in case H i =0 is selected thenb i is provided as the estimate of b i . With this in mind, the event of 'no alert' occurs when either 'H 0 is selected' or 'H i =0 is selected and b i ∈ B AL (i = 1, . . . , k),' occurs, see also where the second equality results from application of the conditional probability rule. We remark that since the events 'H 0 is selected' and 'H i =0 is selected andb i ∈ B AL (i = 1, . . . , k)' are mutually exclusive, see (5), the probability of their union, i.e., the integrity risk, can be written as the summation of their individual probabilities. The first, second and third terms on the right-hand side of (19) represent the risks incurred by the MD-event, CI-event and WI-event, respectively, see Table 1.
In (19), the integrity risk is presented in case the alternative hypothesis H j holds true. We have to consider this for all alternative models H i with i = 1, . . . , k, as all alternative hypotheses, once the movement is beyond the Alert Limit, are considered here dangerous. Assuming that H 0 and H i (i = 1, . . . , k) cover all the events that can possibly occur, we then have k i=0 P(H i ) = 1 with P(H i ) being the probability of occurrence of H i . The overall integrity risk can then be obtained using the total probability rule (Papoulis 1984) as Note that the above equation contains no H 0 -related term as under the null hypothesis there would be no integrity issue, i.e., IR|H 0 = 0, that is, false alarm is not consid-ered an integrity risk. To get a better understanding of the factors contributing to the overall risk, Table 2 visualizes the construction of the IR from the testing decisions and threat estimations.
Here, it is important to realize that the expression in (20) depends on the (true) value of b j under H j for j = 1, . . . , k (cf. (19)), which are unknown. Hence, the actual integrity risk cannot be computed but only as a function of b j ' s  ( j = 1, . . . , k). To be conservative, one can then have a look at 'worst case' scenarios by considering the largest possible value that the IR can take as a function of b j ' s ( j = 1, . . . , k), i.e., maximizing IR|H j for each j = 1, . . . , k. Also, in case the a-priori probabilities P(H j ) ( j = 1, . . . , k) are not known, one can stay with individual integrity risks IR|H j and work with k worst-case scenarios, equivalent to setting P(H j ) = 1 for j = 1, . . . , k.

Approximate integrity risk
As (19) suggests, computation of the integrity risk for a certain H j requires the computation of k conditional probabilities, i.e., probabilities ofb i ∈ B AL conditioned on t ∈ P i and H j (i = 1, . . . , k), which may impose heavy computational burden particularly when dealing with a large number of alternative hypotheses. One may, however, find it more convenient to neglect the correlation betweenb i (i = 1, . . . , k) and t, and hence the conditioning on the testing outcome, and arrive at the following approximation of the integrity risk The overall approximate integrity risk then reads It is important to note that whether IR o provides a conservative or optimistic approximation of IR depends on how the regions P i (i = 0, 1, . . . , k) and B AL are defined. We note that with IR|H j , one conditions on both the hypothesis and the testing outcome (cf. (19)), while with IR o |H j , one conditions only on the hypothesis and not on the testing outcome (cf. (21)). The difference between the integrity risk and its approximation, under H j , can be expressed as which is driven by the difference between the conditional non-normal PDFs fb i |t∈P i (b|t ∈ P i , H j ) and the normal PDFs fb i (b|H j ) (i = 1, . . . , k) over B AL . These PDFs are linked by virtue of the total probability rule as The following Lemma gives the conditional PDF fb i |t∈P i (b|t ∈ P i , H j ). Here, we again distinguish between r = 1 (t ∈ R) and r > 1 (t ∈ R r >1 ), and emphasize that the former is of relevance only for binary hypothesis testing as, with r = 1, one cannot discriminate between alternative hypotheses.

Lemma 1 (PDF ofb i |t ∈ P i ) Letb i and t be linked to each other according to (13). Then, the conditional PDF
Proof See Appendix.

Further simplification
Suppose that the goal is to correctly detect a real effect (deformation), say H j , no matter the value of the estimated threat b j . In this case, selection of an alternative hypothesis always goes with an alert. In other words, an alert will be issued if the null hypothesis is rejected and the event of 'no alert' reduces to 'H 0 is selected.' The integrity risk for this case then becomes in which there is no longer an integrity risk associated with the CI-event, nor with the WI-event. In Table 2, then only the red cells with ' 0 ' remain to contribute to the IR and the columnsb j ∈ B AL effectively vanish (with j = 1, . . . , k). This approach was exercised, for instance, in Lepadatu and Tiberius (2014), considering a single alternative hypothesis. One can easily observe that the IR in (27) is smaller than IR in (19). With the event of 'no alert' corresponding to (27), an alert is given for any value of movement when b j is estimated, with j = 1, . . . , k, leading also to a larger number of false alerts compared to the case when the event of 'no alert' is defined such as corresponding with (19).

Only subset of alternatives implying threats
So far, it was assumed that all alternative hypotheses H i (i = 1, . . . , k) can pose dangerous threats. For the case when only a subset of alternatives, say H i for i = 1, . . . , q with q ≤ k, is considered dangerous, then the event of 'no alert' contains the following events: 'H 0 is selected,' 'H i is selected and b i ∈ B AL (i = 1, . . . , q),' and 'H i is selected (i = q + 1, . . . , k).' For this scenario, the integrity risk corresponding to H j ( j = 1, . . . , q) is no longer given by (19), but by In the special case when only one alternative, say H j , is considered dangerous (q = 1) and we are only concerned with the threat b j / ∈ B AL (single-threat scenario), the integrity risk simplifies to

Numerical analysis
In this section, we illustrate the proposed method of evaluating the integrity risk and estimating the threat, by means of two examples. We evaluate the integrity risk given by (19) and also compare it with its approximation in (21). To provide insight into their characteristics, we first consider the simple observational model in (17), and then further continue with a basic, though more realistic deformation model considering multiple alternative hypotheses.

Single alternative hypothesis
For our analysis in this subsection, we consider the binary hypothesis example given in (17). Since r = 1 only, no identification is possible, just detection, with consequent partitioning of the misclosure space in P 0 = [− k α,1 σ t , k α,1 σ t ] and P c 0 .

Integrity risk
To form the single misclosure t under H 0 , we choose matrix B = [−1, 1] T , cf.
Shown in Fig. 4 [top] is the colormap of the difference IR|H 1 − IR o |H 1 as a function of b 1 horizontally, and AL vertically. The top half of this graph is left empty as integrity risk concerns those situations where the threat goes beyond the Alert Limit (cf. (18)). It is indeed observed that IR o |H 1 is always larger than IR|H 1 . Due to this conservatism and also the lower computational burden of the approximate integrity risk than the strict one, one may then be inclined to compute and use IR o |H 1 instead of IR|H 1 . However, one should also bare in mind the additional costs incurred by too conservative values of integrity risk (look at the blue area in Fig. 4 [top]).
The bottom panel in Fig. 4 illustrates a cross section of the shown colormap on top for AL = 3 cm (in red) and the corresponding graph of IR|H 1 (in blue). The integrity risk IR|H 1 (cf. (19)), for a given AL, shows a decreasing behavior as function of b 1 which can be understood by looking at the contributing factors The first term on the right-hand side, i.e., P MD , is a decreasing function of the threat value b 1 . The second term on the right-hand side equals zero if AL≤ k α,1 . Otherwise, since k α,1 < AL < b 1 , the probability mass of f t (τ |H 1 ) over P c 0 ∩ B AL will decrease as b 1 increases. Therefore, IR|H 1 for a given AL, is a decreasing function of b 1 . In the extreme case when b 1 → ∞, we have IR|H 1 → 0. Likewise, for approximate integrity risk (cf. (21)) which is computed as when b 1 → ∞, we have IR o |H 1 → 0 as a result of P(t ∈ B AL |H 1 ) → 0 and P MD → 0. Consequently, we would expect that the difference (IR|H 1 − IR o |H 1 ) → 0 in case b 1 → ∞. For completeness, we mention again that there is no integrity risk associated with H 0 .

Threat estimation precision
Assuming that model identification is successful and in this case that we have correctly detected the real effect H 1 , we now provide a precision analysis of the estimator for the corresponding deformation parameter b 1 . For such an analysis, we are interested in the separation between the estimator and its (unknown) true value, and connect this separation to a probability. For instance, we define an interval around the true value (which we do know in simulation), in the context of the example of Fig. 3, as [b 1 − r β , b 1 + r β ], and we are interested to evaluate the probability that this interval contains the estimator for b 1 (10). We first consider the normal PDF ofb 1 (in red, in Fig. 3), ignoring the conditioning of estimation on testing. We demand 95% probability from which r β=0.025 is determined. Then, no matter the actual value for b 1 , this interval will always represent 95% probability of containing the estimatorb 1 , the red line in Fig. 5. In the next step, we use the correct PDF (in blue, in Fig. 3), acknowledging the conditioning of estimation on testing, to evaluate the probability that the estimatorb 1 |CD is inside [b 1 − r 0.025 , b 1 + r 0.025 ]. Figure 5 shows this probability P(|b 1 − b 1 | < r 0.025 |CD) as a function of the true value b 1 ∈ [0, 10] (in blue), together with the constant 95% probability corresponding to the estimatorb 1 (in red). As can be seen, for b 1 < 2.5 cm, the probability P(|b 1 − b 1 | < r 0.025 |CD) is smaller than P(|b 1 − b 1 | < r 0.025 |H 1 ), implying that ignoring the conditioning on the testing decision results in a too optimistic description of the estimator's quality. When the unconditional interval P(|b 1 − b 1 | < r 0.025 |H 1 ) is used to present the estimator's quality after testing, it should in fact be made larger in order to contain 95% probability (i.e., a larger value is to be taken for r 0.025 ).  (17), assuming σ = 1/ √ 2 cm, α = 0.01. r 0.025 is chosen such that P(|b 1 − b 1 | ≤ r 0.025 |H 1 ) = 0.95

Multiple alternative hypotheses
Here, we consider a dam deformation monitoring case inspired by an example in (Heunecke et al. 2013, p. 227). Let the dam shown in Fig. 6 be subject to the load caused by water in the lake. For simplicity, we assume that the dam is vertically stable. To monitor the horizontal displacement of this dam, use is made of a 2D terrestrial survey network of six points: two (points 5, 6) are established on the dam as object points, and four (points 1, 2, 3, 4) are located in a stable area close to this dam as reference points. To determine horizontal deformations of the dam, one can then compare the object points' coordinates obtained at different times. We assume that at two times (or epochs) l = 1, 2, each point is occupied by a total station taking distance and direction measurements to the rest of the points. With six network points (two object and four reference points), we will then have 60 measurements: 30 distance measurements and 30 direction measurements. The distance and direction measurements are assumed to be normally distributed with standard deviations of 3 mm and 5 seconds of arc, respectively. The measurements are assumed to be all uncorrelated. To make the scale, orientation and location of the 2D survey network estimable, the coordinates of the reference points 1 and 2 (black triangles in Fig. 6) are assumed given. The 60 distance and direction observations at epoch l are then used to estimate the Easting and Northing of points i = 3, . . . , 6, together with the unknown instrument scale factor (one for the whole network) and six unknown orientations (one per instrument setup).
As the input for the following deformation analysis, we take the epoch-wise estimated coordinates of points i = 3, . . . , 6 and their corresponding variance matrices. With x i,l ∈ R 2 (for i = 3, . . . , 6 and l = 1, 2) containing the unknown Easting and Northing of point i at epoch l, we define x l = [x T 3,l , x T 4,l , x T 5,l , x T 6,l ] T ∈ R 8 for l = 1, 2. Under Fig. 6 Deformation monitoring of a dam, after (Heunecke et al. 2013, p. 227). The horizontal monitoring network consists of four reference points around the dam and two object points on the dam (points 5 and 6) the null hypothesis H 0 where no deformation occurs, we assume The redundancy under H 0 is r = 8. For simplicity of our analysis, we make the following assumptions about the alternative hypotheses that may occur. In case of deformation, we assume that either only one or both of the dam points are unstable, with their deformation being in the direction perpendicular to the dam in this example (the dam is supposed to be subject to load of the water in the lake, and hence points 5 and/or 6 may be pushed back, in the southwest direction). Thus we have, in case only one point is unstable, with u i ∈ R 4 the canonical unit vector having the 1 as its (i + 2) th entry, d ∈ S 2 the known unit vector in the direction perpendicular to the dam, b i ∈ R the unknown scalar deformation size parameter, and ⊗ the Kronecker product (Henderson et al. 1983). In case both of the object points 5 and 6 are unstable, we assume that they deform with the same amount as in which u 3 = u 1 + u 2 and b 3 ∈ R is the unknown deformation parameter. Note, although in the current example we have considered 1-dimensional alternative hypotheses, that our proposed risk evaluation method can be applied to more general situations where the alternative hypotheses are of multiple dimensions and different from each other. Assuming P(H i ) = 0.01 (i = 1, 2, 3) and α = 10 −3 , Fig. 7 [top] shows the overall integrity risk IR, and [bottom] its difference with the approximate one IR − IR o , as a function of AL, based on (20) and (22). The results for each value of AL are presented for the threat values b i = AL + 1mm (in blue), and AL + 5mm (in red). We note that since r = 8 > 1, our testing procedure involves both detection and identifica-tion steps (7) and (8), see also Table 1. It is observed (on top) that the overall integrity risk decreases as the AL, and thus in this case the deformation magnitudes b i (i = 1, 2, 3), increase. This indeed makes sense as larger alert limits imply that the structure under monitoring can stand larger deformations, thus encountering a lower risk of failure, and larger changes b i are more easily detected (and identified). We again notice the smaller values of the strict integrity risk compared to the approximate one.
When the AL gets larger than a specific value, the strict integrity risk IR and the difference IR − IR o both become stable, which can be explained as follows. When the AL increases, then b i , which is chosen here as b i =AL+1mm and AL+5mm, also increases as well. This in turn results in a larger CI-probability and lower MD-and WI-probabilities (see Table 1). Therefore, we have P(t ∈ P i |H i ) → 1 and where Φ(·) denotes the cumulative distribution function of the standard normal distribution. As b i = AL + 1mm and AL + 5mm, then AL − b i remains constant if AL increases which explains why the IR becomes stable when AL → ∞.
To gain an understanding of the contribution of the different hypotheses into the construction of the overall integrity risk, Fig. 8 shows the graphs of IR|H 1 , IR|H 2 and IR|H 3 , as a function of the alert limit AL for the threat value b i = AL + 1mm. It is observed, for all ranges of AL, that IR|H 2 > IR|H 3 > IR|H 1 . For the sake of simplicity, we explain this behavior for large alert limits where the integrity risk IR|H i can be approximated by (38)).
According to (12), the variance ofb i is characterized through c t i 2 Q tt which is also the indicator of minimal detectable bias (MDB) under H i (Baarda 1968;Teunissen 2000); the larger the value of c t i 2 Q tt , the smaller the MDB, and thus the better the detectability under H i . For the model at hand, we have c t 1 2 Q tt ≈ 3 × 10 5 , c t 2 2 Q tt ≈ 10 5 , c t 3 2 Q tt ≈ 2 × 10 5 (39)  . 8 Illustration of the components of the overall integrity risk for the case of blue curve in Fig. 7 [top], for b i = AL + 1mm, as a function of the alert limit AL implying that σb 2 > σb 3 > σb As Φ(·) is a monotonously increasing function of (·), we then have IR|H 2 > IR|H 3 > IR|H 1 .

Summary and conclusion
It is crucial for deformation monitoring systems to timely detect a dangerous displacement beyond tolerances of the structure under consideration. This contribution presents a method for statistically evaluating the risk in a deformation monitoring system. In order to quantify the performance of the monitoring under a particular deformation, the corresponding integrity risk needs to be evaluated. We referred to integrity risk as the probability of the monitoring system failing to issue an alert, when in fact one should have been given.
The integrity components of deformation monitoring were introduced and discussed. As deformation monitoring involves statistical testing of multiple hypotheses, the integrity risk was mathematically developed for the multiple hypothesis testing problem. In doing so, the alerts were assumed to be dependent on both the identified hypothesis and the threat that the estimated size of deformations entails. It was thereby highlighted that for a correct evaluation of the risk, estimation and testing should be considered together, as they are intimately linked in practice. This in turn leads to the use of conditional probabilities when computing the integrity risk. One may, however, find it simpler computation-wise to neglect the interaction between estimation and testing. For this case, we provided an approximation of integrity risk. It was emphasized that this approximation may provide a too optimistic or pessimistic description of the integrity risk depending on the testing procedure and tolerances of the structure at hand. The integrity risk was also formulated for some other simplified scenarios and compared with the strict formulation.
In addition to timely detecting hazardous deformations, monitoring systems are also required to provide threat estimates together with their corresponding probabilistic properties. It was shown that the outcome of testing determines how the threat gets estimated. The threat estimator b j and its associated distribution were then derived, capturing the contributions from both testing and estimation. It was emphasized that although the threat estimator under the identified hypothesis H j , i.e.,b j , is normally distributed, the estimatorb j is not due to its nonlinear dependency on the misclosure.
For a simple observational model with just a single alternative, the integrity risk was evaluated both using the strict and approximate approach. The difference between these two approaches was analyzed, and the role of different contributing factors was highlighted. We pointed out that when choosing one approach over another, one should, besides the computational burden, also take the additional costs incurred by conservatism into account. Assuming that a deformation has taken place, we then analyzed the precision of the threat estimator with and without accounting for conditioning on testing decision. It was explained that negligence of this conditioning process may provide a too optimistic description of the estimator's quality. Our evaluations were extended to a basic deformation measurement system example with multiple alternative hypotheses, where monitoring measurements were provided by a 2D terrestrial survey network.
Finally, we remark that although our analyses were presented for hypotheses of the same dimensions (1D), our risk evaluation method can be applied to more general situations where the alternative hypotheses are of different dimensions. This is due to the fact that it is driven by the concept of misclosure space partitioning and this is irrespective of the alternative hypotheses having the same dimension, or being of different dimensions. Hence, as soon as the hypothesisselection has been made unambiguous, the corresponding partitioning of the misclosure space enables a direct application of our risk evaluation method. Moreover, the method can also be used to compare the performance of different sets of partitionings P i for the same set of hypotheses and thus be used to study and compare the performances of different hypothesis-selection mechanisms.
Author contributions S.Z., P.J.G.T and C.C.J.M.T. contributed to the design, implementation of the research, analysis of the results and the writing of the manuscript.
Open Access This article is licensed under a Creative Commons Attribution 4.0 International License, which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons licence, and indicate if changes were made. The images or other third party material in this article are included in the article's Creative Commons licence, unless indicated otherwise in a credit line to the material. If material is not included in the article's Creative Commons licence and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder. To view a copy of this licence, visit http://creativecomm ons.org/licenses/by/4.0/.
Proof of Lemma 1 Using the conditional probability rule, we can write for any B ⊂ R P(b j ∈ B|t ∈ P j , H i ) The above conditional probability can be expressed in terms of the integral of the corresponding PDF, i.e., P(b j ∈ B|t ∈ P j , H i ) = B fb i |t∈P i (b|t ∈ P i , H j ) db. The probability P(b j ∈ B, t ∈ P j |H i ) is also given by the first term on the right-hand side of (41) and (43) for, respectively, the cases r = 1 and r > 1. Substituting these terms into the above equation, (25) and (26) follow since B is arbitrary.