Successes and Challenges in Risk Analysis of

Complex Systems: From Space Shuttles, Dirty

Bombs to Drug Safety

November 2015

Siddhartha Dalal

Chief Data Scientist, AIG

Risk Analysis vs. Resilience Analysis: Definitions

Canonical Risk Analysis Problem:

(Χ, Α, Ρ, Γ, U);

Α={Accidents}

Ρ= {P(A)}

Γ={Γ(A): Consequences}

Χ={X(A)-leading indicator of Accident A};

U={P{X(A), A}- Uncertainty in X- estimated

from past data and/or expert elicitation

Canonical Resilience Analysis Problem:

Resilience is the capability of a society to absorb unforeseen

threat events and veer back to intended performance.

(Χ, Α, Ρ, Γ, U, I, C, T):

I=Intervention to bring the system back to the original state in

time T, and Cost C -

I=I(A) or I(X(A)) Bounce Back to Original State

• Risk Mitigation, Resilience and public policy are intricately tied

together

– Examples:

Challenger Disaster

Detection of illicit nuclear material entering USA

Drug/chemical safety

• All at different time scales

• Few data points to terabytes of data

• Structured vs. unstructured data

• Different types of adversaries

Overview

3

USAF 1983 estimated space shuttle solid rocket motor failure probability = 1/35

• Rejected by NASA; Shuttle administrators claimed 1/100,000 (Colglazier & Weatherwas, 1986)

• Many of the estimates based on public relations considerations

Example 1: Space Shuttle Failure Thought to be a Low-risk Event- NASA

4

Mission 51L, January 28, 1986

24 previous flights with no failure at

higher temperature

Temperature expected around 30F

Space Shuttle Challenger

Should we launch?

EXAMPLE: COMPLEX SYSTEMS

5

Call between Morton Thiokol, Marshall &

Kennedy Space Center regarding low

temperature and effect on O-rings

Some recommended postponement till

53 degrees F

Roger Boisjoly:

“Temperature was indeed a

discriminator.”

However, “I was asked to quantify

my concerns, and I said I couldn’t

…. I had no data to quantify it”

“The Night before Tele-conference:” Jan 27, 1986 Analysis Based on a Chart

Joint Temperature Versus Number

of O-Rings having Some Thermal

Distress Identified by Flight Number

6

Challenger Launch Jan 28, 1986- 31 degrees F

7

Recommendation to

launch: “Temperature

data [is] not

conclusive on

predicting primary”

Even if there is any temperature effect – any way to quantify –

outcome uncertain – need probabilistic risk analysis

Challenger Data Analysis Error: They Forgot Zeros in Chart

Presidential Commission on the Space Shuttle Challenger Accident (1986). Report of the Presidential Commission

on the Space Shuttle Challenger Accident (Vols. 1 & 2), Washington, DC: Author

Joint Temperature Versus Number of O-Rings Having

some Thermal Distress Identified by Flight Number.

Includes Flights with No Incidents

8

Understanding Physics is Critical for Prediction

9

Physical Probabilistic Model Can Be Constructed

P{O-ring failure} for a given temperature and pressure

≥Pr{ Primary Erosion & Blowby and Secondary Erosion and Blowby}

=Pr{Primary Erosion}* Pr{Primary Blowby|Erosion} *Pr{Secondary

Erosion|…}*Pr{Secondary Blowby|…}

Pull information from other joints (e.g., Nozzle Joint, Lab Experiments,

Pressure)

Use of Bayesian Model- non-informative priors updated with past data

Challenge: How do you predict this?

No accident has occurred prior to this flight

Probability of O-ring Failure at 31o and 60oF

Dalal, Fowlkes and Hoadley (1989), J. Am. Statist. Assoc.

Mean=0.1641 Mean=0.0048

Should a teacher be sent on such a mission?

11

Findings:

• No Probabilistic Risk

Assessment (PRA)

• No experts in statistical

science involved in the

design/procedure/launch

decision processes

Policy Lessons: Findings and Recommendations of NRC

Shuttle Criticality Review Hazard Analysis Audit Committee (1988), Post-Challenger Evaluation of Space Shuttle

Risk Assessment and Management, Washington, D.C: National Academy of Science Press

Recommendations:

• Use PRA

• Use statistical inference

• Develop capability in

statistical science

12

How can we combat the threat

of nuclear smuggling?

Example 2: Worldwide Concern about Terrorism and Dirty Bomb Material

13

Protection Against Terrorists: U.S. Ports Statistics*

*2010 Statistics

Mail/ECCF

Land Border

Maritime

Air Cargo

332,622 vehicles per day

57,006 containers per day

307 Ports of Entry

representing

2,459 aircraft per day

580 vessels per day

621 Border sites to protect

14

15

Protection against terrorists: Inspection Process

Manifest, Bill

of Lading RadiationPortal

Gamma Rays

Pass

Fail

Stringent

Inspection Container through PVT Portal

15

Approach for Data Collection: Terabytes of Data

Vehicle traversing through RPM in 20 seconds, multiple detectors

Divide data into multiple channels (energy windows). Collect counts

every 0.1 seconds accumulated at 1 second counts.

Gamma Counts as a container traverses the portal.

Top Curve= Total, Bottom Curves- Eight energy bands

d

16

Original Analysis Approach Based on Total Count at a Fixed Point

Use the energy spectrum corresponding to the maximum total count

Form control charts of ratios

Limitations: Full data not being utilized

Total Count depends upon the mass of the material

Many false positives ELY, J., KOUZES, R., SCHWEPPE, J., SICILIANO, E., STRACHAN, D. and WEIER, D. (2006). The use of energy windowing to discriminate SNM from NORM in radiation portal monitors. Nuclear Instrument and Methods in Physics Research Section A 560 373-387

Gamma Counts as a container traverses the portal.

Top Curve= Total, Bottom Curves- Five energy bands

d

17

Big Challenge for Detection: Reducing # of false positives

How to improve?

• Radically redesign

hardware- ASP several

billion dollars

• New way to utilize data

and new models-

approach promoted by us

Dalal, S. R. and Han, B.. (2010): Detection of radioactive material entering international ports: A Bayesian approach

to radiation portal data, Annals of Applied Statistics, 4, 1256-1271

Source Material

Location A

% of Identified

Alarms

Location B

% of Identified

Alarms

Location C

% of Identified

Alarms

Kitty litter 34% 25% -

Medical (In, I, Tc, Tl) 16% - -

Abrasives/Scouring

pads 14% 5% -

Refractory material 8% - -

Mica 5% - -

Ferti lizer/Potash 5% 13% -

Granite/Marble slabs 4% - 10%

Ceramics/Tile/Toilets 4% 9% 28%

Trucks/cars 2% - -

Aluminum - 15% -

Earth - 11% -

Bentonite - 5% -

Salt - 5% -

Other metal - 3% -

Televisions - - 27%

Gas Tankers - - 13%

Smoke Detectors - - 4%

Other 6% 9% 18%

18

New Strategy- Energy Windows: Total vs. Energy Windowing: PVT

19

Normalized counts in each window is independent of distance

from Sensor and mass of a material Pool over distances

Performance of The New Approach is Remarkable! Rarity of False Priorities

Dalal, S.R. and Han, B. (2010): Detection of radioactive material entering international ports: A

Bayesian approach to radiation portal data, Annals of Applied Statistics, 4, 1256-1271

Table 4: Probability of classification- True vs. classified, sampled at 9 d's

TRUE/Classified WGPu HEU Fertilizer Tiles Kitty litter Road salt Background

WGPu 1 0 0 0 0 0 0

HEU 0 1 0 0 0 0 0

Fertilizer 0 0 1 0 0 0 0

Tiles 0 0 0 0.8542 0 0 0.1458

Kitty litter 0 0 0 0 1 0 0

Road salt 0 0 0 0 0 1 0

Background 0 0 0 0.2086 0 0 0.7914

Adding seemingly unrelated data makes a big difference!

Detection Probabilities

21

Public Policy Implications and Other Challenges

ASP project was

cancelled – not

thought to be

effective

How would one test

efficacy of multiple

algorithms?

Combinations

explode- and rather

intractable problem

Combinatorial Design

Testing.

Generalization of

Orthogonal Arrays

From terrorism

perspective, one

needs to account

terrorists’ strategies:

Stackelberg-type

games

22

More Challenges: Risk Mitigation Testing Schematics

23

We Design By Identifying Factors And Levels: Factors

41 factors

Full Factorial>241 Cases

24

New Designs Based on Projective Plane Theory: Factor Covering Combinatorial Designs

25

126 binary factors – 10 test cases

Dalal, S. R. and Mallows, C. M. (1998). Factor-covering designs for testing software. Technometrics. Winner of Frank Wilcoxon Prize ASQ

Dalal, Jain and Kantor (2015) IEEE HST 2015

Cohen, Dalal, Fredman. and Patton (1997). The AETG system: An approach to testing based on combinatorial designs. IEEE Transactions

of Software Engineering 23, 437-444

2- Covering Designs

F1 F2 F3 F4 F5 F6 F7

1 1 1 1 1 1 1

2 2 2 2 2 2 1

1 1 2 2 2 1 2

2 1 1 1 2 2 2

2 2 2 1 1 1 2

1 2 1 2 1 2 1

F8 F9 F10

1 1 1

1 1 1

1 2 2

2 1 2

2 2 1

2 2 2

– Pharmaceuticals/Chemicals are entering the marketplace at a faster pace

Many before their adverse effects are known

– Global beneficial impact and risks

– How do we identify drugs with adverse effects? Need an early warning radar.

Bisphenol A

Example 3: Drug/Chemical Policymaking Is Becoming Increasingly Difficult

MTBE

Chemical/Pharmaceutical Underwriting Is Becoming Increasingly Difficult

– Academic research is an early- warning system

Scientific literature is growing and dynamic

When it reaches comparative critical mass, the harmful agent becomes salient

Bisphenol A

Thalidomide

Phased Approach

1. Find a collection of objective

data- PubMed- 20 Million +

Articles

2. Statistical NLP based

approach to understand

relationships between drugs

and disease

3. Machine Learning to remove

irrelevant literature

4. Valid Bump Hunting to identify

high runners in terms of risks

5. Crowd sourcing to experts to

validate the information

USPTO: Reville, Dalal, et al (2011) SYSTEMS AND METHODS FOR EMERGING

LITIGATION RISK IDENTIFICATION:

Idea Applied to Toxins

N-Propyl Bromide

Bisphenol A

MTBE TCE

Diacetyl

29

All Became Salient Years Before Regulatory Action

N-Propyl Bromide

Bisphenol A

MTBE TCE

Diacetyl

30

All Became Salient Years Before Regulatory Action

N-Propyl Bromide

Bisphenol A

MTBE TCE

Diacetyl

Shetty, Dalal:

J. Am. Med. Informatics

Assoc. 2011

Identified in Literature Published Prior to FDA Warning

Shetty, Dalal (2011) J. Am, Med. Info.

Dalal, S. Khodyakov, D. Srinivasan, R. Strauss, S. & Adams J. (2011) ExpertLens: A System for Eliciting Opinions

from a Large Pool of Non-Collocated Experts with Diverse Knowledge: J. Technology Forecasting and Social

Change.

Rofecoxib & Heart

Disease: Recall 2004

Rosiglitazone & Liver

Toxicity: Warning in 2002

Zolpidem & Cognitive

Dysfunction: Warning

in 2007

Expert Validation

33

Risk Analysis - Challenges:

Risk Analysis has been critical in understanding and

predicting risks- however, new challenges include:

• It needs to evolve to Resilient Analysis, a new discipline

• Newer models based on non-traditional sources like

unstructured data and real-time analytics are critical for

many applications

• It needs to take into account adversarial reactions in

explicit manner

1

2

3

34