Qualitative Modelling of Failure Scenarios for Long Linear Transport Infrastructures in Mountain Areas

Abstract

In mountain areas, long linear transport infrastructures (roads, motorways, railways, etc.) are exposed to numerous natural hazards, especially hydrological and gravity-driven events such as slope instabilities, rockfalls, or torrential hazards. These phenomena can damage infrastructure, or even lead to the destruction of large sections, causing a risk for users and a deterioration of service. Infrastructure managers face several difficulties in handling these risks. One of them is identifying and representing them, due to the scale of the infrastructure, which is composed of numerous structures and exposed to multiple hazards. In this context, a model is proposed to represent all potential failure scenarios for such infrastructures. This model is based on system reliability analysis methods: functional analysis, failure mode and effect analysis (FMEA), and fault tree analysis (FTA). It is intended to be applied to a linear infrastructure, several kilometres long, exposed to various hazards. The proposed approach allows for the identification of all possible failure modes, including damage to structures and its functional consequences. Its applicability is being tested on a simple case study.

1. Introduction

Transport infrastructures are part of the critical infrastructure systems of our societies. They enable the circulation of essential goods and services, both locally and on a large scale. Therefore, their failure can have significant socioeconomic consequences, endanger users, and generate high costs for managers [1,2]. Transport infrastructures in mountain areas also present major specific challenges [3]. In these regions, such infrastructures are exposed to numerous natural hazards, especially hydrological and gravity-driven (HG) phenomena. These hazards mainly include rockfalls, slope instabilities, floods with or without bed load transport, debris flows, and snow avalanches. They can combine into multi-hazard events, either occurring simultaneously or as a cascade effect [4]. They can lead to the covering of infrastructures, the deterioration of structures, or even their destruction and collapse in extreme cases [5,6]. Many such events, most of them of low intensity, are recorded each year in France [7]. Managing these risks, which can impact mountain infrastructures, is therefore a major concern for managers.

For infrastructure managers, risk management is part of the broader approach of asset management. The management of road, motorway or railway assets in mountain areas can involve several steps: identifying structures and hazards, assessing their condition, predicting the evolution of the infrastructure’s level of service, and planning its maintenance, repair and protection [8]. IPCC [9] defined risk as the “potential for consequences where something of value is at stake and where the outcome is uncertain” and more specifically as the “potential, when the outcome is uncertain, for adverse consequences on [list of various assets]”. In this study, from this perspective, the term risk refers to the potential, when exposed to hydrological or gravity-driven hazards, for negative consequences on the infrastructure’s level of service. This definition specifies the objectives of risk analysis in this study. It focuses on the condition of the infrastructure and its level of service, whose evolution must be predicted over several decades to plan the necessary maintenance work. In France, there is no regulatory framework taking into account the impact of HG natural hazards on transport infrastructures. The methods implemented vary from one manager to another [10]. Each manager monitors the condition of their structures and the intensity of the hazards that may impact them [11,12,13], and plans works accordingly, but there is no real risk analysis carried out to estimate the evolution of the level of service. Yet, failure scenarios for transport infrastructures due to HG natural hazards are numerous and complex. For managers, having an exhaustive knowledge of these scenarios for their infrastructure would therefore be very useful for managing their assets and identifying the infrastructure segments that need to be secured as a priority. Furthermore, climate change makes this need even more significant due to its effects on HG natural hazards [3]. There is therefore a strong operational need for methods to determine and model the failure scenarios of these infrastructures, which are likely to impact their level of service.

Several works have studied the impacts of a single gravitational hazard on roads, such as rockfalls [14,15,16] and avalanches [17,18]. These physical and statistical approaches rely on the analysis of event histories, field observations, numerical simulations, and probabilistic methods. They use different definitions and measurements of risk. Kanno et al. [15] quantify risk as a monetary cost, taking into account rockfall damage to roads and users. The works of Jaboyedoff et al. [14] and Wilhelm [18], and the Italian RO.MA. approach [16] adopt a user-centred perspective and quantify risk as the annual probability of a fatal accident. Finally, the recent Italian McRA method [17] proposes a qualitative measurement of avalanche risk, on a five-level scale. Approaches from [15,17] include the measurement of road damage, using simple and generic rules, but do not take into account the type of structures present.

There are also multi-risk methods for large-scale infrastructure networks at the level of a region. The European INFRARISK project [19] enabled the development of methods for analysing a road network exposed to floods, earthquakes, and landslides. The proposed approaches are based on Bayesian networks, spatial and temporal data analysis, fragility curves, and multi-criteria decision support. Petrova [20] also uses data analysis methods at the level of a road network for natural risk analysis. These methods work well when there is a sufficient volume of data on past events. They are therefore suitable at the level of a network or a territory, but less so at the scale of a linear infrastructure a few kilometres long.

Other works focus on multi-risk analysis at the scale of a single road structure. Argyroudis et al. [5] propose a methodology based on finite element numerical modelling and fragility curves to identify risks and study the damage done to structures. This mechanical approach allows for precise analysis, but would be impractical at the scale of a linear infrastructure spanning several kilometres with numerous structures. Similar fragility curves are proposed in the scientific literature, constructed using numerical or physical models, statistics on event histories, or expert judgement [21,22,23,24]. According to [21], those based on historical data are specific to the studied sites. Those constructed from models also depend on the assumptions considered.

Some works in the technical literature focus on HG risks for road infrastructures. In France, the Cerema Institute has developed a simplified risk analysis method based on multi-criteria decision support, presented in several technical guides for different types of road structures [25,26]. It is easy to use, covers a wide range of risks, and provides a preliminary risk analysis. In Switzerland, the Federal Roads Office has published a method for managing gravitational risks on national roads [27]. It proposes occurrence and intensity classes for a list of gravitational hazards, as well as tables of risk values expressed as monetary cost and the annual probability of fatal accidents. These methods are based on historical data and the expertise of their authors. Both are used in engineering and provide a first-order risk assessment along the infrastructure. However, they have the disadvantage of being difficult to modify, update and adapt to structures and hazards not included in their scope.

Finally, many methods have been developed for studying risks on mountain roads, but to the authors’ knowledge, there is no model that takes into account every possible failure scenario for a long linear infrastructure containing numerous structures. This can be explained by the fact that these infrastructures in mountainous areas are complex systems. They comprise numerous structures, and there are multiple interactions between the different structures and with their environment.

In this context, system reliability analysis methods developed for risk analysis in industrial sectors make it possible to model complex systems [28,29]. They have been successfully applied to long linear infrastructures, such as dikes [30,31], subway tunnels [32], urban technical networks [33], and pipelines [34]. Terzi et al. [3] compare several methods for modelling complex systems in the context of multi-risk analysis in mountain areas. Markov graphs, Petri nets, agent-based models, causal graphs, and system dynamic models allow for the modelling of feedback loops and temporal dynamics but are highly complex, which can limit the operational applicability of the method [3]. Tree-based methods (event tree, fault tree, and bow tie) are simple and visual, and enable the integration of probabilities for risk measurement. They are not suitable for modelling feedback loops and temporal dynamics. They can be preceded by a systematic risk identification step, such as functional analysis, preliminary risk analysis, and failure mode and effects analysis (FMEA) [29].

The aim of this work is to help infrastructure managers identify and represent the risks threatening their assets. To this end, it addresses the scientific question of modelling failure scenarios for long linear transport infrastructures exposed to HG natural hazards. The model to be developed should be qualitative and provide a risk analysis framework that includes all possible failure modes. It should also serve as a basis for risk measurement and the prioritisation of mitigation actions. In this article, a model based on system reliability analysis methods is presented to address this question. Its applicability is verified on a historical accident case.

2. Materials and Methods

The definition of the global approach as well as the various choices made (including the methods) are based on the literature review and a thorough analysis of current practices by linear infrastructure managers. To this end, interviews were conducted with five French infrastructure managers with respect to real sites’ management of roads, motorways and railways. These interviews allowed for the identification of managers’ needs and expectations, as well as the methods employed, the constraints faced, and limitations. This analysis was a precondition in view of producing a method that is applicable in operational contexts while being based on the recent scientific literature.

The literature review revealed that system reliability analysis methods are relevant for the risk analysis of long linear transport infrastructures in mountainous areas. The choice of these methods was reinforced by the observation of needs and difficulties in operational contexts: partial and imperfect information, the frequent need to refer to expert judgement, and the difficulty in conducting a global and exhaustive analysis.

In this section, the type of infrastructure studied is presented, as well as the three methods selected for modelling failure scenarios: functional analysis (FA), failure mode and effects analysis (FMEA), and fault tree analysis (FTA).

2.1. Long Linear Transport Infrastructures in Mountain Areas

In this work, the object of study is a section of long linear transport infrastructure, approximately 10 km long, located in a mountainous area.

To adapt to the hilly topography, the infrastructure includes many civil engineering structures such as viaducts and tunnels, as well as traffic lanes, earthworks (cuts and embankments), retaining walls, crossing structures, and protection structures against natural hazards. Crossing structures, called underpasses or overpasses, may be bridges, trenches, or hydraulic structures that allow another infrastructure or a river to cross.

This infrastructure is also exposed to various hazards, especially hydrological and gravity-driven (HG) natural hazards specific to mountainous areas: torrential hazards (floods, bed load transport, and debris flows), and various types of slope instabilities, rockfalls, and snow avalanches. Figure 1 summarises the various structures and hazards frequently found on this type of infrastructure.

2.2. Functional Analysis

Functional analysis (FA) aims to describe a studied system in structural and functional terms. It is used as a foundation for risk analysis [35]. It can be divided into two steps: external FA and internal FA [36].

• External FA consists of defining the system as a whole and identifying the need it addresses. It aims to determine the principal functions of the system and the constraints it faces.
• Internal FA describes how the system works, what it is made up of, and what solutions have been implemented. It aims to determine the functions fulfilled by the various components at a finer level of detail.

There exist many different FA methods depending on the characteristics of the studied system. A method commonly used in civil engineering is the APTE method [37]. It uses several tools such as FA tables and functional diagram blocks to identify functions through interactions and flows between the system, its components, and its environment.

In the FA produced in this work, two types of functions are considered:

• Main functions, which are the needs addressed by the system or component studied, linking two external environments through the system [38];
• Technical functions, which are imposed on the system or component by its environment.

2.3. Failure Mode and Effects Analysis

Failure mode and effects analysis (FMEA) is a systematic approach to analyzing system failures [28]. It identifies basic component failure modes, as well as their causes and their effects on the rest of the system. The use of this method meets operational needs for comprehensive risk identification and structuring qualitative expert judgement. FMEA is implemented using a five-column table. The first two columns list the components and the functions fulfilled by each, as found in the functional analysis. The other three columns list the following information:

• Failure modes (when a function is no longer fulfilled);
• The causes of the failure modes;
• The effects of the failure modes on the system and its other components.

Table 1. Typical FMEA table as implemented in this article.

Component	Function	Failure Mode	Causes	Effects
…	…	…	…	…

illustrates FMEA as implemented in this article. Functional analysis and FMEA enable a detailed and fairly exhaustive identification of possible failure modes, which can serve as a basis for scenario modelling.

2.4. Fault Tree Analysis

Among the methods available for modelling failure scenarios in complex systems, the fault tree analysis method (FTA) is well suited for the study. Indeed, this method is suitable for civil engineering structure failures [39]. It also meets the operational need for methods that are simple to use and easily understood by the various stakeholders [3]. The principle of this method is to represent, in a tree-like model, all the combinations and sequences of events that could lead to the occurrence of a single undesired event. The construction of the tree is usually based on the expertise of specialists. It is carried out deductively, starting from the undesired event and searching for intermediate and initial events that could lead to it [29]. The representation in tree form also allows for the integration of risk measurement, for example, through the use of probabilities [3].

Several authors have studied the links between FTA and FMEA [40,41]. The combined use of the two methods varies from simple cross-checking of the results to advanced analysis frameworks, alternating between the two methods depending on the needs of specific contexts. In this study, FMEA is used to develop a fault tree in a systematic manner, limiting the use of expertise that could introduce bias. Failure modes are identified using FMEA, and the fault tree refocuses the analysis on a single undesired event, retaining only the events that can lead to it and modelling cascading failure scenarios. In constructing the tree, two types of events are distinguished [38]: failure modes, as in FMEA, and phenomena, which are the causes and effects. When a phenomenon is both the effect of one failure mode and the cause of another, it forms a link between two cascading failure modes. In this way, all scenarios can be constructed.

3. Development of the Model of Failure Scenarios for Long Linear Transport Infrastructures in Mountain Areas

The model is developed in three stages, as described in Section 2, which are common in system reliability analysis. Figure 2 summarises this process. The first step is the functional analysis of the infrastructure, both external and internal, in order to characterise its operation through its main and technical functions. The second step is the identification of possible system failure modes, carried out using FMEA (failure mode and effects analysis). The third and last step is the modelling of failure scenarios using the FTA (fault tree analysis) method.

The content of the functional analysis and FMEA is based on the authors’ knowledge, on the technical guidelines related to road infrastructure [13,26,27,42], on specific scientific publications [5,6,43], and on the five interviews conducted with infrastructure managers and specialised engineers.

3.1. Input Data

In this part, the process for developing the failure scenario model is detailed. To build this model for specific case studies, the following input information is required:

• The list of structures in the studied infrastructure and their location;
• The list of (identified) hazards to which the infrastructure is exposed, and their spatial distribution;
• The list of protection structures and their location, whether or not they are managed by the same organisation as the infrastructure;
• The list and location of neighbouring infrastructures and sensitive urbanised or natural areas.

Depending on the context, the information available to the infrastructure manager may be more or less detailed and up to date. Therefore, the failure scenario model must be adapted to limited information. This explains the choice of a qualitative analysis.

3.2. Functional Analysis Implementation

3.2.1. External Functional Analysis

The study focuses on a section of road infrastructure several kilometres long. To carry out the analysis, this section is divided into distinct and homogeneous segments. This division is defined by a dual consideration of homogeneity: (i) in terms of hazards and (ii) in terms of type of structures (viaducts, tunnels, embankments, cuts, and at-grade profiles) [44]. As a result, the segments are homogeneous in terms of possible failure modes. Each segment is considered as an independent system to be studied and is composed of several structures. The only interaction between segments is to allow vehicles to travel from one segment to another, and if a segment fails, the entire infrastructure section fails.

Three levels of granularity are therefore defined, adapted to the needed precision for this study and corresponding to current engineering practices.

• G0: The section of infrastructure;
• G1: Homogeneous segments of the section of infrastructure (the systems considered);
• G2: Structures in the segments.

The environment of the system can be divided into four types: (i) stakeholders involved with the system (users, infrastructure managers, etc.); (ii) infrastructures (extension of the infrastructure on either side of the studied segment, nearby and crossing infrastructures, and urbanised areas); (iii) the natural mountain environment related to the system (particularly hydrological and gravity-driven (HG) hazards, which are the focus of this work); and (iv) the natural environment not specific to mountain areas (foundation soils and other natural hazards).

The main function of the system (G1) is to enable traffic. This means that maintaining good traffic conditions must be the main focus of the infrastructure management. It corresponds to the “level of service” referred in the introduction [8]. It is associated with user safety and the provision of transport services.

The technical functions of the system (G1) are essentially of two types: (i) to withstand the various stresses imposed by the environment, related to traffic, weather, natural hazards, or nearby infrastructures, and (ii) to have an acceptable impact on its environment, whether other infrastructures or natural areas.

Figure 3 illustrates the external functional analysis of the system with the four identified environments, the main function of the infrastructure, and examples of technical functions.

3.2.2. Internal Functional Analysis

The functions of structures (G2) concern the specific structures present in the studied infrastructure. These are the functions whose failures will be studied in the risk analysis and that could lead to the failure of the whole system (G1). There are many possible structures, including some exceptional ones (due to their dimensions or design) and some coupled ones (such as cascading retaining walls). In order to develop a method applicable to as many structures as possible, the functional analysis was carried out for generic structures: traffic lanes, earthworks (cuts and embankments), retaining walls, and crossing structures. Viaduct and tunnel segments can be considered as one single civil work (G1) or possibly broken down into elementary components (G2) such as piers, deck, abutments, etc. For every structure, four types of functions were identified:

• The main function, i.e. the needs it addresses;
• To withstand ordinary stresses to prevent failure under ordinary conditions;
• To withstand external hazards to prevent failure in case of exceptional events;
• Any other technical functions specific to each structure.

These functions are not independent, as the loss of one may lead to the loss of another (see Section 3.3), but they are not fully dependent either. Not all analyses are detailed in this article; only an extract is presented in

Table 2. Extract from the internal functional analysis table at the G2 level of granularity.

Structure	Main Functions	Technical Functions
Traffic lanes	Enable users to travel	Withstand ordinary stresses Remain unaffected by external hazards
Embankment slope	Support traffic lanes	Withstand ordinary stresses Withstand external hazards Not cause incidents in the vicinity

. Other structures are analysed in the exact same way.

The function “Withstand external hazards” is formulated differently for traffic lanes (remain unaffected by external hazards) to include any impact such as obstruction. To detail this function, a table was created to cross each identified HG hazard with each type of structure (G2) and list the possible structural impacts. An extract from this cross-table is presented in

Table 3. Extract from the cross-table describing the possible undesired consequences of natural hazards on structures (G2).

Hazard		Avalanche	Flood With(out) Bed Load Transport	Debris Flow	Slope Instability	Rockfall
Structure
Retaining wall (concrete, reinforced soil, etc.)		na	Scouring, deterioration, failure	na	Significant Deterioration; failure	Localised Deterioration
Embankment slope (earthwork without wall, traffic lanes are not considered)		na	Scouring, erosion, seepage, and failure	Slight deteriorations (if the earthwork deflects the flow)	Significant Deterioration; failure	Localised Deterioration; localised failure

na: not applicable.

.

To the authors’ knowledge, there are no recommendations and very limited scientific and technical documentation concerning the consequences of a given HG hazard on the types of structures considered here. Some [hazard–structure] pairs are practically undocumented. Therefore, this table provides a basis that may be developed and adapted to different configurations without changing the method.

Protection structures against natural hazards are not considered in the same way as other structures. Instead of including them in the functional analysis and the FMEA, they are directly integrated into the fault tree analysis as safety barriers, a formalism specific to tree-based methods for system reliability analysis (see illustration in Section 3.4). This choice is made because protection structures are not necessary for the system to function well under normal conditions. Furthermore, from an operational point of view, protection structures can be managed by other organisations. They are often directly integrated into the hazard assessment.

3.3. Failure Modes Identification—FMEA

FMEA is applied at the G2 level of granularity and to the generic structures. An extract from the FMEA table is presented in

Table 4. Extract from the FMEA table: failure modes of traffic lanes and embankment slopes.

Structure	Function	Failure Mode	Causes	Effects
Traffic lanes	Enable users to travel	Traffic affected	Deterioration, failure or obstruction of traffic lanes	Danger for users, isolation of areas, and environmental impact (in some accidents)
	Withstand ordinary stresses	Intrinsic fault in traffic lanes	Design/execution error, or ageing without appropriate maintenance	Deterioration or failure of traffic lanes
	Remain unaffected by external hazards	An external hazard directly affects traffic lanes	Cf. table structures/ hazards (Table 3)	Deterioration, failure or obstruction of traffic lanes
Embankment slope	Support traffic lanes	An embankment no longer supports the lanes properly	Deterioration or total or partial failure of an embankment slope	Deterioration or failure of traffic lanes
	Withstand ordinary stresses	Intrinsic fault in an embankment	Faulty design/execution, or ageing without appropriate maintenance	Deterioration or total or partial failure of an embankment slope
	Withstand external hazards	Impact of a hazard of higher intensity than slope strength	Cf. table structures/ hazards (Table 3)	Deterioration or total or partial failure of an embankment slope
	Not cause incidents in the vicinity	A nearby infrastructure or natural area is impacted	Deterioration, or total or partial failure of an embankment slope	Danger for nearby infrastructures or environmental impact

, applied to embankment slopes and traffic lanes.

For each function (G2) identified in the functional analysis, a failure mode is associated and then listed its possible causes and effects. The process is iterative, as an effect identified for a certain failure mode may be the cause of another. Particular attention is paid to the consistency of vocabulary to facilitate the identification of cascading failures.

Technical functions such as “Withstand stresses” are associated with structural failure modes, caused by external hazards or intrinsic faults if they occur under normal operating conditions. These intrinsic faults may be design or execution errors, or due to ageing without appropriate maintenance. Other failure modes involve a structure impacting other structures or the environment.

As with Table 3, to the authors’ knowledge, there are no recommendations and very limited scientific and technical documentation to identify all possible failure modes. The partial sources of information used to conduct this analysis are mentioned at the beginning of Section 3. Table 4 can be adapted for different configurations without changing the method. Several iterations between functional analysis and FMEA enable a robust analysis to be carried out.

3.4. Modelling of Failure Scenarios—Fault Tree Method

3.4.1. Fault Tree Construction Process

In this section, a procedure is proposed to conduct fault tree analysis from FMEA (failure mode and effects analysis), illustrated in the diagram in Figure 4. The first step is to determine the undesired event. It corresponds to the loss of the system’s main function (G1). In this study, it is any impact on traffic (traffic lanes failure mode). The fault tree analysis is then progressively conducted in a deductive manner, by identifying structure failure modes that directly lead to the undesired event, the causes of those failure modes, etc. The algorithm stops when all identified events have been analysed. The identification of the failure modes and phenomena (causes and effects) is based on the FMEA table. A Python 3 script was coded to reproduce this algorithm and automate the construction of fault trees, from the FMEA table and the hazards/structures cross-table. In comparison to manual construction, this facilitates the application of the method to large case studies. It enables the rapid processing of large FMEA tables for segments comprising multiple structures and hazards, and also accelerates the construction of the multiple fault trees when the case study includes many segments. For cases involving multiple segments with standard structures for which the tables were already made, the script can use the same generic tables for each segment, selecting only the relevant rows and columns.

Note: The tree obtained through strict application of the algorithm can then be simplified by expertise to suit the needs of infrastructure managers.

3.4.2. Resulting Model

The general architecture of the resulting model is illustrated in Figure 5. On the right is the undesired event (UE), “traffic affected”. In the centre are the intermediate events, failure modes of the structures that lead directly or indirectly to the undesired event. Finally, on the left are the initiating events, external hazards and intrinsic faults.

Following on from the functional analysis and FMEA (G2) extracts presented in Section 3.2 and Section 3.3, the associated fault tree analysis extract is shown in Figure 6. As seen in the general architecture of the tree (Figure 5), the impact on traffic is on the right and the hazards and intrinsic faults are on the left: rockfall, avalanche, flood with or without bed load transport, debris flow, slope instability, design or execution error, and ageing without appropriate maintenance. A rockfall protection structure is added as an example, using the formalism of safety barriers. In the centre are the failure modes of structures caused by hazards and intrinsic faults, which directly or indirectly affect traffic. The upper branch is the direct impact of a hazard on the lanes, resulting in their obstruction or degradation and thus impacting traffic. The middle branch corresponds to an intrinsic fault in the traffic lanes, leading to their degradation and thus affecting traffic. Finally, the lower branches correspond to the degradation or total or partial failure of the embankment slope. This can be caused by a hazard or an intrinsic fault in the embankment and results in the loss of its function of supporting the lanes. It leads to their deterioration or failure, affecting traffic.

4. Application of the Failure Scenario Model to a Historical Event

In this section, the failure scenario model developed in Section 3 is applied to a historical accident case: the rockfall that occurred in March 2006 on the RN1 coastal road on Réunion Island (France). This is a single-segment case study with two hazards, two structures and two protection structures. Its purpose is to illustrate the application of the method, the appearance of the results, and their interpretation. The following context and the event descriptions are based on the report [45] produced shortly after the rockfall.

4.1. Context

The national road RN1 is a four-lane divided road with heavy traffic, overlooked by mountainous cliffs, connecting the mains towns on the west coast of Réunion Island (France). The segment where the rockfall occurred in March 2006 comprises an embankment on the sea side, supported by a reinforced earth retaining wall. Tetrapods are installed below to break the waves. On the landward side, a cliff about 100 m high overhangs the road. The rockfall hazard was identified, with frequent events, and a gabion wall was erected to protect the road from falling rocks and boulders. The schematic cross-section in Figure 7 illustrates the context of the case study.

4.2. Modelling of Failure Scenarios

The failure scenario model developed in Section 3 is applied to this case study. The external functional analysis identified two hazards: (i) swell waves and (ii) falling rocks of various sizes. For the internal functional analysis and the failure mode and effects analysis (FMEA) the case study does not include any exceptional structures or configurations, so the analysis of the segment is taken from the generic tables. The tetrapods and the gabion wall are protection structures; they will therefore be added to the tree as safety barriers.

Figure 8 illustrates the functional analysis of the segment with a functional diagram block [36]. The FMEA is not presented as it is almost identical to the generic table shown in Table 4.

The fault tree analysis obtained for this case study is shown in Figure 9. The initiating events are the two natural hazards, for which protective structures have been installed, as well as intrinsic faults. These events pose a risk to the infrastructure if they affect the traffic, either through direct impact on the lanes or through the failure of the retaining wall.

4.3. The March 2006 Accident

On 24 March 2006, a rockfall of approximately 25,000 m³ occurred. This event destroyed the gabion protection wall, covered the traffic lanes, and caused local deterioration of the retaining wall. The damage to this latter wall did not compromise its stability and therefore did not affect the tracks. The accidental event led to two fatalities and to one serious injury, and the road was closed for several weeks.

It can be noted that the failure scenario model represents the sequence of events that occurred in the March 2006 accident. This is highlighted in blue in Figure 10. Alternative scenarios could also have occurred. For example, in the case of smaller rockfalls, the gabion wall would have retained the hazard and traffic would not have been affected. In the case of a larger magnitude event, the wall could have partially broken, causing the deterioration or failure of the traffic lanes, and the consequences would have been even more significant.

5. Discussion

The study case illustrated the applicability of the failure scenario model and its ability to include various structures and events. In this section, the advantages and limitations of the model are discussed.

5.1. Advantages of the Developed Model

The failure scenario model is suitable for complex systems. It can take into account and represent all structures and hazards in relation to long linear transport infrastructures in mountain areas. Functional logic allows for the integration of numerous phenomena and failure modes within a single framework, without limitation to a certain type of event or a certain level of knowledge. The systematic approach ensures a certain degree of comprehensiveness in the identification of failure scenarios and helps to avoid biases related to expertise.

In current practices, structural faults and identified natural hazards are regularly monitored (inspections, instrumentation, diagnostics, etc.). The failure scenario model links these events to the structural and functional consequences on the infrastructure. Functional logic and the use of FTA make it possible to represent the events leading to the undesired event, i.e., those that directly or indirectly affect traffic. Thus, the model allows for the analysis of risks: the potential, when exposed to hazards, for negative consequences on the infrastructure’s level of service.

The use of fault tree analysis allows for an intelligible and concise representation of failure scenarios. Compared to other system reliability methods, such as Petri nets or Markov graphs, it is easier to understand. This is an advantage for the operational use of the model and collaboration between multiple stakeholders (experts, infrastructure managers, operators, etc.). This formalism also makes it possible to implement probabilities and to represent risk reduction measures as safety barriers, whether they are in place or under consideration. This will be useful in a second phase, for risk assessment and the consideration of the most appropriate mitigation strategy.

5.2. Operational Benefits of the Model—Perspectives

The failure scenario model provides a comprehensive representation of all the failure scenarios for a given infrastructure, within a single framework. It enables infrastructure managers to identify and understand these scenarios, which is very helpful for management and operation. It is intended to integrate results from other approaches, such as field expertise. It can be used even when the available information is limited, especially when no quantitative data is available, which can happen in operational contexts.

Currently, the model is qualitative and does not allow for risk assessment. Future work will focus on integrating a measurement of the risk associated with each scenario. A first approach will be to use expert judgement to assign probabilities and intensity values to events of the trees [46]. A second, more advanced approach will be based on Bayesian networks to take uncertainties into account more accurately [47]. To meet the needs of operational contexts, one challenge will be the integration of heterogeneous and incomplete data, which may be more or less detailed and up to date: the results of field inspections, of numerical simulations, expert judgement, etc. Such risk assessment will help managers identify the infrastructure segments that need to be secured as a priority.

5.3. Some Remarks and Limitations of the Model

The failure scenario model only includes “or” logic gates. This is relevant because multi-risk issues are rarely a concern for the transport infrastructure managers. However, this aspect cannot be ignored, and for each “or” gate, the user may wonder if the joint occurrence of two (or more) input events is possible and more damaging. If so, the user should add a multi-risk branch to the tree. Several authors have studied multi-hazards to identify which hazards can interact [4,48]. In particular, these include the simultaneous occurrence of hazards due to a common trigger, cascading hazards, hazards that create a favourable environment for the occurrence of another hazard, or hazards that can destroy a protection structure.

Unlike many FTA in the industrial sectors, the events represented in the failure scenario model are not binary and their chain succession is not systematic. They can have different magnitudes. If the first events in a branch occur at low intensity, they will not necessarily lead to the following failure modes (see the study case as an example). In future works on risk assessment, the transition from a parent event to a child event will be described by a conditional probability based on the intensity of the parent event.

6. Conclusions

In this article, a qualitative model of failure scenarios for long linear transport infrastructures exposed to hydrological and gravity-driven natural hazards has been proposed. The applicability of the failure scenario model was then illustrated with a historical accident case study. It can help managers to comprehensively identify the failure scenarios for their infrastructure.

The model was developed using the following system reliability methods: (i) functional analysis to characterise the infrastructure’s operation, through its main and technical functions; (ii) failure modes analysis using failure mode and effects analysis (FMEA); and (iii) failure scenario modelling using fault tree analysis. Extracts from each element of the model development were presented for common structures and hazards.

This model provides a unified and comprehensive framework for gathering knowledge on the various phenomena involved in failure scenarios. Therefore, it is intended to integrate results from other approaches, such as field expertise, numerical modelling, and analysis of historical event data. The functional logic implemented allows for the representation of failure modes leading to an impact on traffic, which is the main undesired event. It is also possible to construct trees for secondary undesired events, such as negative impacts on nearby infrastructures or natural areas. In line with current engineering practices, structural damage to structures is taken into account in the model.

Future work on this model will focus on integrating a measurement of the risk associated with each scenario to provide a risk assessment. The applicability of the model will also be tested on larger and more complex case studies.