Contributor

Contributed By: Mark E. Baker, P.E.

Title: Principal

Organization: DamCrest Consulting

Email: [email protected]

Description & Background

Past dam failures and incidents have shown that dams can fail from a wide variety of potential failure modes at loadings less than the design loads. Critical flaws in design/construction or deterioration may exist that are not visible during a dam condition inspection. To address these risks, the dam safety industry is moving toward adoption of performing periodic comprehensive reviews to evaluate the safety of dams.  For example, such evaluations of dams can be based upon an in-depth risk assessment with identification of potential failure modes, their likelihood of occurrence, and consequences of dam failure.  Such periodic risk reviews are being performed by the Bureau of Reclamation, the US Army Corps of Engineers, the Bureau of Indian Affairs, the National Park Service, the Tennessee Valley Authority, and others.

A periodic risk review is an in-depth risk assessment of a dam and includes a multi-disciplinary team that reviews the geology, original design/construction, modifications, instrumentation data, other performance indicators and consequences. Potential failure modes (PFMs) are developed through a workshop brainstorming session based on the specifics of the dam and its appurtenant structures and considering the wide variety of past failures and incidents that have occurred at other structures. The potential failure modes that are deemed credible are assessed in more detail including consideration of physical factors for initiation, continuation, progression, detection, intervention and breach. Positive and negative factors are assessed for each credible failure mode. Consequences (both loss of life and non-loss of life) are assessed.

Findings of a risk review should be documented and typically include a description of each credible failure mode, the consequences associated with each failure mode, and a risk chart.  A review should also result in recommendations to further understand the risk, change monitoring, or to take risk reduction actions when appropriate.  Updated monitoring plans targeting potential failure modes of concern is an important outcome of a risk review. Many dam safety organizations use the periodic risk review process to assign a summary risk category rating to each dam. With several risk reviews completed, a dam safety program can better prioritize funding and resources for targeted risk mitigation projects.

The following sections outline the periodic risk review process:

Overall Process
The periodic risk review should begin with a written plan for schedule, scope, budget, and team members. There should be an initial kick-off conference call. The risk review is typically competed as follows: 1) collection and review of data about the dam, 2) dam examination in the field, 3) potential failure modes workshop, 4) analysis and report writing, 5) summary of findings and risk characterization, 6) team and panel reviews, 7) finalization of the report.

Team Composition
The risk review team should consist of all the needed technical disciplines for a particular dam in addition to staff in the field who operate/maintain the dam and program/dam owner representatives. The disciplines may include a team leader (senior engineer), peer reviewer, civil/geotech engineer, geologist, instrumentation engineer, examination engineer, field staff, and flood/earthquake loading specialists.

Quantitative Versus Semi-Quantitative
A quantitative risk review uses event trees and numeric probability assessments at each node (initiation, continuation, intervention, breach) to calculate probability of failure for each credible potential failure mode. Semi-quantitative risk reviews use numeric data for the probability of certain failure modes like flood overtopping but rely on written criteria such as verbal descriptors (very likely, likely, neutral, unlikely, very unlikely, remote) to assign probabilities to most failure modes. These verbal descriptors are rooted in numeric probability (1:100 roughly equals “very unlikely”). Both approaches consider historical failure rates of large dams and include both positive and negative factors for occurrence of each credible failure mode.

Level of Effort and Scaling
An important aspect of implementing periodic risk reviews is to scale the work to a particular dam or to an inventory of dams. Deliberate scaling of a risk review guidance document or template will ensure that periodic risk reviews for large/complex dams have the extra resources they need and small/less complex dams get reviews that are affordable. The size of the team and staff time estimates can be scaled up or down based on the following factors:

• Is a full quantitative risk assessment needed or will adequate results be obtained through a semi-quantitative approach?
• Is this the initial risk review (more effort) or is it a subsequent risk review (less effort)?
• Are the consequences of a dam failure extreme indicating a need for a full risk review, or are the consequences less severe indicating that a smaller level of effort would be adequate?
• Is a dam large and complex with many features (such as multiple outlets/spillways, gates, dikes, powerplant) or is the dam a simple embankment dam with a single spillway?
• How much data is there to review and is it easily available? A large dam with a long history may have extensive records that will require many staff days to review. In some cases, a large effort is needed to collect and scan dam data. For other dams, there is very little in the way of design/construction/performance records to be reviewed.
• Are flood and earthquake recurrence loadings and analyses going to take a lot of effort? What is already available?

Advance Work
Although a dam site inspection will be part of the periodic risk review, consideration should be given to the adequacy of inspection information for normally inaccessible features. Specialized inspections such as dive inspections, remote camera inspections of outlet works/toe drains, or climbing inspections of large gates often have long lead times and are best to be completed in advance of the review. These normally inaccessible features provide key information needed in a risk review for certain failure modes. In other cases, both field data collection and analysis in advance of the risk review could help the review team better assess a particular risk.

Potential Failure Modes Workshop and Risk Assessment
Identification and assessment of potential failure modes is usually done in a multi-discipline workshop session. The workshop typically includes the following sessions: 1) dam data summary, 2) brainstorming of failure modes (by loading type), 3) screening of failure modes to determine which are credible, and 4) listing of positive/negative factors for each credible failure mode. For semi-quantitative risk reviews, quantitative data is used for certain failure modes (e.g. flood overtopping) while most failure modes are assessed using verbal descriptors (see example in Photo Tab).  For quantitative risk reviews, an event tree is constructed with probabilities for each node (initiation through breach). Factors that make a failure mode more likely or less likely are listed in a table and contribute to the probability determination. Statistical analysis techniques can be used to improve confidence and reduce uncertainty (e.g. probabilistic distribution, exceedance curves, sensitivity studies and Monte Carlo simulation). It is important that the workshop and other analyses guard against human factors that can lead to poor risk estimates including group think, modeling bias, overconfidence bias, recency bias, etc.

Consequences
While much of the effort of a periodic risk review is spent on identifying potential failure modes and their probabilities, consequence assessment is the other critical input pertaining to risk. Some agencies interpret consequences to mean only the estimated number of lives lost if a dam failure occurs. This is done through dam breach and floodplain modeling and can be estimated using either one-dimensional or two-dimensional hydraulic analysis.  Several variables are used to estimate loss of life including flood depth and velocity in downstream populated areas, the location/type of structures that are impacted, the amount of available warning time, and the likelihood and effectiveness or warnings. While loss of life is always paramount in dam safety, dam failures have a myriad of consequences.  Evaluation of consequences other than loss of life gives the dam owner a more complete picture of the risk of their dam. The dam owner may be more knowledgeable and motivated to take actions to mitigate risk if they are aware of other potential consequences of dam failure such as loss of water supply, damage to utilities/homes/transportation, rebuilding cost, loss of hydropower, and even loss of dam owner prestige/reputation.  These other types of consequences can be listed in a multi-attribute table and do not normally need in-depth studies by economists. Risks associated with estimated life loss and the risks of other consequences are typically are shown on different plots and tables.

Risk Portrayal
Risk is portrayed on a risk plot with magnitude of consequences on the X-axis and probability of failure (quantitative or qualitative) on the Y-axis. The risk can be portrayed on a matrix or an X-Y plot (see the Photo Tab for examples of both). Risk tolerability is illustrated using colored matrix cells or areas (red for high risk, green for low risk) or with tolerability lines. Uncertainty can be shown with a cloud, a circle/ellipse, or a line with the best estimate shown as a dot. Some agencies have both an annual probability of failure tolerability line and a society risk tolerability line that govern acceptable risk. Other agencies incorporate two separate risk charts: one for loss of life risk and the other for non-loss of life risk.

Documentation
The periodic risk review report may include the following sections: Findings, Recommendations, Description of Dam & Operations, Evaluation of Design & Construction, Evaluation of Performance Monitoring & Instrumentation, Site Inspection/Examination Report, Seismic Hazard, Hydrologic Hazard, Consequences of Failure, Potential Failure Modes and Risk Analysis, Future Performance Monitoring, and Key Drawings/References. Each report section should be signed by the lead author and the peer reviewer.

Senior Team Review
The final review of the draft risk review report should be performed by a separate multi-disciplined team of senior dam safety technical specialists and other key stakeholders such as the dam owner or the dam safety program representative. The review team sends a draft of the report in advance of the review meeting. A healthy review meeting includes active discussion/deliberation with each participant bringing forth their questions, perspectives, and experience. The senior team review should provide high-level technical review of the work and result in agreement on key risk drivers, risk portrayal, dam safety case (see below) and next steps.  Furthermore, senior team review provides critically important normalizing or leveling for an inventory of dams where risk reviews are being completed by multiple review teams.

Making the Dam Safety Case
The key final product of the periodic risk review is the dam safety case presented in the findings section of the risk review report. The “dam safety case is a logical set of arguments used to advocate a position that either additional safety-related action is justified, or that no additional safety-related action is justified at a given (current) time” (Reclamation, 2011).  The case should pull key information (evidence) from the risk review assessment into a concise rationale for action/no-action. It does not merely list whether risk plotted in one zone or another. The case should include 1) the existing condition, 2) the risk estimate, 3) the estimated range of uncertainty and confidence, 4) the case to support the risk estimate, and 5) the recommended course of action. The risk review and the dam safety case support taking reasonable and prudent actions informed by the assessed risk of the dam.

Summary Risk Rating
Based on the dam safety case, each dam can be assigned a summary risk category rating (See Joint Federal Risk Categories in the Photo Tab).  This is referred to as the Dam Safety Priority Rating (Reclamation), the Dam Safety Action Classification (USACE), or the Dam Safety Action Rating (TVA) to aid in prioritization of actions. Based on this rating system, each dam should be assigned one, and only one of the following:

Level I – Critically near failure

Level II – Extremely high risk

Level III – Risk is high with high confidence or is very high with low to moderate confidence

Level IV – Low to moderate risk

Level V – Low risk

Risk Review Outcome
The periodic risk review should result in justification to take one or more of the following actions:

• No change (continue routine dam safety risk management activities and normal operations and maintenance)
• Adopt or change (increase) monitoring
• Perform field studies and analysis to better understand the risk (often to address uncertainty and lack of confidence)
• Take risk reduction actions such as: dam modifications, reservoir pool level restrictions, temporary breach, leaving the outlet works open, improving communications with the downstream population at risk, installing an early warning system, etc. In these cases, the risk reduction provided by such actions should also be evaluated to aid in decision making.

Timing
Many dam owners/regulators are conducting periodic risk reviews for each of their dams on an 8- to 12-year frequency with a separate, less in-depth team review of risk (sometimes called a Technical Response Team) on a 5-year frequency.  It is important to revisit each dam periodically to assess the current condition of the dam, identify changes in potential consequences, and evaluate risk using the best available methods at the time of the review.

References:

(1) Bureau of Reclamation. (2011).  Dam Safety References, including Interim Public Protection Guidelines.

(2) Bureau of Reclamation, (2018). Comprehensive Review Background Presentation.

(3) Colorado Dam Safety. (2013). Colorado Dam Safety Evaluation Tools.

(4) U.S. Army Corps of Engineers. Bureau of Reclamation. (2018). Risk Best Practices Training.

This lesson learned summary was peer-reviewed by Irfan Alvi, P.E., Alvi Associates, Inc.; and Gregory Richards, P.E., CFM, Gannett Fleming, Inc.  Input was also provided by representatives from the Bureau of Reclamation, U.S. Army Corps of Engineers, and Federal Energy Regulatory Commission.