You are on page 1of 108









Descrierea CIP a Bibliotecii Naţionale a
Dam Safety Management / Dan Stematiu –
Bucurereşti: Conspress, 2009
ISBN xxx-xxxx-xx-x
Colecţia Carte Universitara

B-dul Lacul Tei nr. 124, sector 2, Bucureşti
Tel: (021) 242 27 19 / 169; Fax: (021) 242 07 81


The present booklet is an addendum to Dam Engineering main textbook written by the
same author. The aim of this supplement is to present the basic principles concerning
dam safety assessment, risk evaluation and risk management and some general ideas
on dam design based on probabilistic approach. A complete exposition of safety and
risk issues related to dams cannot be contained in a booklet of this size. However,
sufficient information is presented to give the reader a general picture of the problems
involved. It will be necessary for the students who want to have a true picture of this
rather difficult domain of dam safety management to consult additional books, papers
and ICOLD bulletins.
Dams are, without doubt, among the safest structures constructed by man. Indeed,
dam engineers spare no effort in order to ensure that every dam is conceived, built and
maintained according to the best experience, the most exacting criteria and the most
advanced knowledge. And these efforts are, by and large, extremely successful.
However, no matter how well a dam is built or maintained, the risk of failure cannot
be reduced to zero. Dam failures are severe threats to life and property that fully
justify the need for a better understanding of risks to the public posed by dams. The
statistics confirm the improvement of dam safety in the last decades. The yearly
probability of failure of a dam built at present is of the order of 10-5. But this low
probability can be reduced still further by the common effort of the profession
towards a better understanding and control of safety. That is the reason of the present
The booklet consists of six chapters divided into sections, each of which deals with a
certain theme related to dam safety. At the end of each chapter a short bibliographic
list, which was effectively used, is included. The basic references are the ICOLD
Bulletin 130, the papers of Kaare Hoeg, Harald Kreuzer, Pierre Londe, Gary Solomon
and Raymond Steward and the book Safety and Risk in Hydraulic Structures written
by Dan Stematiu and Stefan Ionescu.
In the first chapter some introductory notions are included. Risk definition and the
main purpose of risk analysis are presented as well as the limits of factor of safety
approach. The trade-off between extra safety (reduced risk) and the increased use of
society's resources is emphasized. A brief review of the reasons why dams fail and of
risk factors follows. Lessons from past failures are also included.
In the second chapter a brief classification of approaches to risk analysis is presented
and the risk analysis concept is decomposed into its basics: quantitative risk analysis,
evaluation of dam failure consequences and risk assessment.
The next two chapters deal with the main factors of risk: dam failure probability and
consequence. The probability of dam failure is computed by using various failure
scenarios. Failure modes identification is treated as an essential step in the process.
The main alternatives used for probability of failure evaluation – statistical data, event
trees analysis and capacity-demand procedure – are briefly presented. Some
comments regarding the difficulties in estimating uncertainty in numerical terms are
included. The consequence assessment process is treated in the book in its logical

The objectives of the author were to present clearly and concisely some principles related to dam safety and risk management. Starting from the unanimously accepted concept that absolute safety is unattainable. The last chapter is dedicated to design strategies based on risk evaluation. conditions for the tolerability of risk are identified. The emergency preparedness side of risk reduction has as main objective to evacuate people before the catastrophe occurs to bring them to safety. accidental flood routing and evaluation of loss of life and economic and environmental consequences. February 2009 Dan Stematiu 4 . It is shown that regular monitoring of a dam's behaviour throughout its operating life is essential in ensuring safety.development: dam breach modelling. Risk management issue is presented in chapter five. new guidelines for establishing extreme floods and earthquakes for dam design or safety evaluation based on tolerable levels of exposure and best strategy for monitoring improvement based on trade-off between cost and risk. The objective of this chapter is to focus attention to the new trends in dam design by presenting three branches of application: probabilistic approach is dam type selection. Then the risk reduction vectors are individually treated. This does not require extensive instrumentation but a reasonable number of carefully selected types of monitoring sensors. because it would require the spending of an unlimited amount of society’s resources. All the details have been kept to a minimum in order to achieve a better understanding of the subject.

. 51 3. Limits of Factor of Safety approach ………………………………………….2..3. 37 3...1.4.. 40 3. Teton dam ………………………………………………………………….3. Economic consequences …………………………………………………. 58 Bibliography ………………………………………………………………………….6.1....4.. 22 1.6. 37 3. Risk assessment …………………………………………………………………. 59 4. 13 1. Lessons from past failures ……………………………………………………..4. Risk factors ……………………………………………………………………. Socio-economic and other consequences of dam failure ………………….. 17 1..2.4. Loss of life ………………………………………………………………… 66 4.6. 13 1.1..5. 70 5 .6. 61 4. Dam breach modelling …………………………………………………………. DAM FAILURE PROBABILITY …………………………………………. Comments on probability of failure ………………………………………….……… 7 1.1.. Risk definition …………………………………………………………………. 66 4. 62 4.. Dam failure consequences ……………………………………………………… 34 2.5. 43 3.2..1. 23 Bibliography ………………………………………………………………………….5. 11 1.. General ……………………………………………………………………. Monte Carlo method …………………………………………………………… 58 3. 68 4. RISK ANALYSIS CONCEPT …………………………………………. Failure probabilities based on event trees ……………………. 13 1... 64 4.3.1..1... St. Concrete dam failure modes ……………………………………………….3. Failure probabilities based on statistical data ……………………………….5..4. Failure modes related to floods …………………………………………… 41 3.5. Belci dam …………………………………………………………………..6. 37 3..3... Malpasset dam ……………………………………………………………. Failure modes identification ………………………………………………….3. 44 3.1.6. Leading Causes of Dam Failure ……………………………………………….6.CONTENTS 1.2.6. CONSEQUENCE ASSESSMENT ………………………………………. 61 4.6.6.. Failure modes related to gate failures ……………………………………..1.1. The basic concept of quantitative analysis …………………………………… 33 2. Flood routing ……………………………………………………………………. Identifying consequences ………………………………………………………. 8 1. 7 1. 25 2.... Purpose of risk analysis …………………………………………… …………..4.2. Environmental consequences……………………………………………… 69 4.. Introduction ……………………………………………………………………. Failure probabilities based on reliability analysis …………………………….1. 10 1.4.. 61 4.2.. Banqiao dam ………………………………………………………………. 69 Bibliography …………………………………………………………………………. Vajont dam ………………………………………………………………… 20 1..5.. INTRODUCTION ………………………………………………….3.5.5. Evaluation of consequences ……………………………………………………. Earth dam failures modes ………………………………………………… 37 3.1.. Approaches to risk analysis …………………………………………………… 27 2.. 35 Bibliography …………………………………………………………………………..2. 27 2. 15 1... 46 3. 35 3. Francis dam …………………………………………………………….1. Failure modes related to earthquakes ……………………………………… 42 3..5.

..2. Dam surveillance …………………………………………………………. 78 5.. Emergency concept ………………………………………………………… 88 5..2. 94 6. 90 Bibliography …………………………………………………………………………. Consequence based dam safety criteria ………………………………………..108 6 .2..1. Risk treatment ………………………………………………………………..3.... 83 5..1. 92 6.4.3.. 97 6. RISK MANAGEMENT ………………………………………………………… 71 5.3.3.. 73 5. 94 6... Design criteria based on probabilistic approach ……………………………. 79 5.2. Dam monitoring instrumentation …………………………………………. DECISION STRATEGIES BASED ON RISK EVALUATION …. Dam monitoring improvement based on net expected benefit …………….1. Tolerability and acceptance of risk …………………………………………… 74 5. Introduction …………………………………………………………………….. 101 Bibliography …………………………………………………………………….. Risk reduction ………………………………………………………………….3.5.

or other events such as piping or misoperation of spillway gates. Risk definition Risk is a term of universal significance with several interpretations. probability of occurrence and the associated consequence. earthquakes. a primary consideration in dam risk assessment. Risk is estimated by the mathematical expectation of the consequences of the adverse event occuring: Risk = Probability of dam failure per year x consequences of realized failure. 7 . Human error may contribute by increasing the probability of failure in some cases and magnifying the consequences in others. or the environment. The consequences may be expressed in terms of life safety. Even if the events are not always mutually exclusive. corporate financial loss. Pr obability of Pr obability   Risk =   x  Adverse Re sponse  of Load  Given Load    x Consequences   Given Re sponse     The risk may be total risk from all scenarios. For an identified scenario the probability of failure may be defined in terms of probability of load (external stress) times probability of adverse dam response (vulnerability to failure) to that load . or environmental damages. According to International Comission on Large Dams (ICOLD) risk is a measure of the probability and severity of an adverse effect to life. health. there is no chance of combinations of more than one outcome) such that the risk can be computed by summing the individual pathway risk values.e. or in terms of socio-economic losses. Alteratively. In the traditional approach risk is the likelihood or probability of adverse consequences. The total risk can be determined by summing the values from all scenarios. It is usually assumed that the outcomes for each event are mutually exclusive (i.1 INTRODUCTION 1. property. or specific risks from individual random events such as floods. risk is estimated by the combined impact of all triplets of scenario. It is wise to maintain life safety distinct and separate from other consequences. their probabilities in a dam safety context are generally small and the resulting joint probabilities have little impact on the accuracy of the computations.1.

necessitate updating of flood estimates and re-evaluation of dam safety. 1. and administration of risks witch threaten the well-being of life and natural and socio-economic environment. More extensive floods records. Failure can be grouped into either structural failure or performance failure. and possibly changes in climatic conditions since the construction of a dam. extremely successful. the most exacting criteria and the most advanced knowledge.1.e. so that the dam cannot retain water. the probability of non-failure. Dams are. then we can define a failure as when the load exceeds the resistance and the consequent probability of failure as the probability of the loading exceeding the resistance. 8 . Failure is defined as the event in which the system fails to function with respect to its desired objectives. by and large. Probabilities of failure are usually expressed as annual probabilities of occurrence with units of (year)-1. Risk management is a comprehensive. controlling. evaluating. Similar demands apply to certification and recertification of nuclear power plants. annual exceedance probability (AEP). Society today. among the safest structures constructed by man. Reliability is defined as the complement of risk. Risk Management. dynamic strategy applied to the tasks of analyzing. without doubt. The outputs of the risk analysis effort provide a sound basis for a rational protection of individual and society against dam failure. Significant changes in physical conditions both upstream and downstream since the dam was built require a review of the risks involved. more than a relatively few years ago. It is a structured process aimed at estimating both the probability of failure of the dam or dam components and the extent of the consequences. Indeed. P(L>R). they are both considered as random variables. dam engineers spare no effort in order to ensure that every dam is conceived.Failure. If we use the variable R for resistance and the variable L for load. demands that safety evaluations be carried out and documented for activities involving risks imposed by dams on the public (as opposed to voluntary risks). In the field of dams failure is the collapse or movement of part of a dam or part of its foundation. built and maintained according to the best experience. In general. bridges and infrastructure in general. chemical plants. Because many uncertain variables define both the resistance and loading. Purpose of risk analysis The risk analysis process involves the scientific characterisation of what is known and what is uncertain about the present and future performance of the dam under examination. a failure results in the release of large quantities of water. And these efforts are. offshore structures. The occurrence of floods and earthquakes are characterised using a relationship between peak discharge for floods and peak ground acceleration (or magnitude) for earthquakes vs. i. The main issue stands with the existing dams.

The risk-oriented view point takes a risk of failure into account. Thus the residual risk has to be determined. Dam engineering field has to move from the conventional safety-oriented perspective towards the risk-oriented perspective (figure 1. and has didactic value for owner. are not costly and are essential for safety. The safety-oriented perspective assumes no risk of failure. Rettemeier & coll) Risk analysis should not be limited to a few thousand large dams. For small dams. For many applications. As the owners of these have a low income and no technical knowledge. However an absolute safety cannot be ensured technically. visual inspection and simple measurements. evaluated and managed even if failure seems unlikely. such risk analysis should be organized by authorities.The main purpose of carrying out a risk analysis is to provide decision support. the resulting numerical values do not have to be accurate in absolute terms. 9 .1). operator. Alternatives in dam safety approach (after K. Risk analysis should take into account the fact that storage of usual floods in the reservoir favours occupation of the riverbed by people at risk for exceptional floods. Consequently damage for humans. if well organized and reported. economics and the environment can be excluded with a degree of probability verging on certainty unlikely.1. but should be adapted to the tens of thousands of water storage or irrigation dams. Going through such a systematic procedure gives insight which is an essential outcome in itself. since a dam is built according to high design criteria. consultant and safety professional. but must be inherently consistent so they allow reliable relative comparisons among alternatives. The procedure pinpoints specific features and conditions of the dam and its operation where the largest risk reductions can be achieved. their cost is essentially bound with staff costs. as well as advice and rules for structural or non-structural measures. Dams safe Figure 1.

Limits of Factor of Safety approach The assessment of safety in civil engineering works is traditionally obtained through a deterministic approach. In order to take account of the many uncertainties and of the scatter in the data.2 is a simple but striking illustration of how the failure probability of an embankment may vary in a ratio of 1000/1 for the same factor of safety F = 1. soils or rocks.2. for example. In the first place because the value of the factor of safety depends on the mathematical model used and the associated definition of the factor of safety.). the users claiming that a design which complies with such a standard is perfectly safe. the test number and their coefficient of variation (after P. there will be a definite relationship between the 'load' acting on it and the 'ultimate load' of the same type that the dam is able to withstand. It is totally unjustifiable to base the stability assessment on a single figure bearing no relationship to engineering reality. a "factor of safety" is introduced. depending on the uncertainties in the input data (scatter. Unfortunately this is not true. Failure probability for a given safety factor vs. etc. 5 instead of 20 tests are available (with the same scatter) or if the coefficient of variation of the test results increases from 0.50 if.10 to 0. is measured by the "factor of safety". the latter being strictly adequate in the absence of all uncertainties. Figure 1. number of tests.3. 10 . and also to cover the fact that models are necessarily approximate. all over the world. a scalar number supposed to lump together all imperfections in the data and the model. Figure 1. to use FS = 1. It is common practice. The numerical value of the factor of safety FS has been determined empirically for different types of materials. True safety can thus lie anywhere over a broad range. for example. The margin between the real state and the limiting equilibrium state. Any reference to the value of FS therefore must state the method used in computing it.30 (for the same number of 10 tests). Londe) In each instant of a dam's life.1.50 in most of the stability analyses of geotechnical materials. quality of investigations and measurements. This numerical value has even been incorporated in many codes of practice. What is worse is that a given computed factor of safety represents a whole spectrum of widely differing failure probabilities.

is a continuously changing function of time as loads vary and the dam ages. Risk factors A broad range of natural and human hazards exist that. spillways. can compromise a dam’s integrity. a landslide in the reservoir that creates an impulse wave. the only approach capable of handling the inevitable uncertainty in the input data. Fortunately. such as an earthquake. Foundation defects: 1/3 of all dam failures Defects can occur in the foundation supporting the dam. heavy rains. This can occur along hydraulic structures. construction material characteristics. The result can compromise the structural integrity of the dam or it can quickly erode the abutment on either side of the dam. The dam structure itself can be a source of risk due to possible design or construction flaws. High uplift pressures and uncontrolled foundation seepage can also compromise the dam’s foundation. Any event causing the movement of a foundation. conduits. 1. the profession is becoming increasingly aware of the serious shortcomings of the safety factor concept and is recognizing that. This can be caused by an inadequate or dysfunctional spillway or by local large settlement of the dam crest. one must move over towards probability concepts. The foundation instability under seepage forces is the most common failure mechanism. Such seepage or leakage can even be caused by an animal burrowing in and around earthen dams. this relationship. Overtopping occurs when water levels rise rapidly and without adequate warning (for example. The school of reliability and risk analysis was born from this move. Dam failure can occur when the structure becomes weakened from internal erosion. Piping and seepage: 1/5 of all dam failures. taken separately or in combination. 11 .However. Leading causes of dam failure Overtopping: 1/3 of all dam failures globally Overtopping occurs when the level of a reservoir exceeds the capacity or height of the dam. the complexity of the dam and its appurtenant works. Structural Factors. general foundation and abutment conditions. due to flash floods. Embankment dams can be compromised when too much water seeps or leaks through the structure. and weaknesses which develop because of aging. or if a dam upstream collapses). an effect referred to as piping.5. Other reasons Dams which are improperly maintained or built with inadequate materials or unsound design can result in structural weaknesses that lead to catastrophic dam failure. seepage development. in one way or another. or cracks. which it is identified with a 'safety factor'. 1. increase the probability of dam failure and bring injury to people and property.4. the age and condition of the dam. In earthen dams the main cause of failure is erosion caused by overtopping.

Indirectly. or abutment materials have a potential for liquefaction to occur during seismic events. such as fractures. a large landslide into a reservoir behind a dam can cause an overflow wave which will exceed the capacity of the spillway and lead to failure. the probability of failure and loss of life almost always increases. landslides and sedimentation are also important contributors to risk. and strength also may present a risk to dam failure if they are inadequate for the dam loading conditions. therefore. they tend to lose their strength through material deterioration. Human Factors. making them more susceptible to dam failure. shear zones.Poor embankment design or construction can lead to cracking or sliding of the soils which may result in the uncontrolled discharge of water. Rock slides and landslides may impact dams directly by blocking a spillway or by eroding and weakening abutments. or destructive intent can interact with other hazards to compound the possibility of failure. Failure to account for these events has been costly both to dam owners and the public in general. flood potentials must be included in risk analyses for dam failure. In turn. failure of such a natural dam could then cause the overtopping of a downstream dam or by itself cause damage equivalent to the failure of a human-made dam. simple mistakes. Human behaviour is another element of dam failure risk. As dams age. The abutments and foundation may have inherent weaknesses in the form of faulting and rock condition. Flash floods can happen anywhere. both of which can lead to uncontrolled loss of water. erodibility. operational mismanagement. Construction material characteristics such as permeability. Floods from high precipitation are the most significant natural events that can impact dams and pose a hazard to people and property. foundation. earthquakes. When a natural flood occurs near a dam. relief jointing and solubility. When one dam fails. even in small watersheds. leading to immediate or delayed failure. the sudden surge of water may well be powerful enough to destroy another downstream dam. compounding the disaster. Both earthen and concrete dams can be damaged by ground motions caused by seismic activity. Earthquakes are also significant threats to dam safety. unnecessary oversights. A land (or mud) slide can form a natural dam across a stream which can then be overtopped and fail. Reservoirs with initial adequate storage capacity can lose their ability to contain flood events by losing storage from sedimentation. Some embankment. Natural Factors. 12 . Poorly installed embankment materials or spillway structures can lead to serious soil piping or seepage. Therefore. residences and businesses that would escape natural flooding can be at extreme risk from dam failure flooding. Cracks or seepage can develop. The site immediately surrounding the structure may also increase structural risk if the dam foundation is not treated properly or if excessive reservoir seepage erodes the foundation or abutments. Natural adverse events such as floods from high precipitation and floods from upstream dam failures. The sudden surge of water generated by a dam failure usually exceeds the maximum flood expected naturally.

should be removed when not in use and stored inside the padlocked building. Vegetated surfaces of a dam embankment. Francis dam 13 . Operating Factors. Another more common activity that poses a risk is the tendency for people to settle below dams.1. in fact.6. and the complexity of the equipment and operating procedures at the dam. Francis dam St. create a safety hazard to people and property include the remoteness and accessibility to the site.3. buildings. such as handles and wheels.3). manhole covers. mechanical equipment. lack of an inspection program. Vandalism for example cannot be excluded and is.6. Detachable controls. and rock riprap are particularly susceptible to damage by people. lack of operator training or experience. Operating factors that could pose a risk to dam failure.All sorts of other human behaviour should be included in risk analyses. reliability of power for electrical equipment. The construction of residences. Every precaution should be taken to limit access to a dam by unauthorized persons and vehicles. Mechanical equipment and associated control mechanisms should be protected from purposeful or inadvertent tampering. a problem faced by many dam owners. 1. and other structures in the potential flood inundation zone creates new risks. and will probably create increased risks in the future. Cross section and downstream view of the former St. Downstream steps 59 m River bed elevation Uplift relief wells 42 m Figure 1. St. Francis Dam was a 60 m high concrete gravity-arch dam constructed by the City of Los Angeles between 1924 and 1926 (figure 1. and thus. Lessons from past failures 1. poor dam maintenance procedures.

2 km downstream. moved as much as 1. weighing as much as 10.4. making it the worst American civil engineering failure of the 20th Century. killing at least 420 people. The average velocity in this reach was about 28 km/hour.The dam failed catastrophically on March 12-13.000 tons. Failure of St.4. Francis dam 14 . Figure 1. Just downstream of the dam the maximum depth of the flood was about 42 m. The sequences of the failure are presented in figure 1. 1928. Massive blocks of concrete.

5).6. Francis Dam assuming full uplift reveals that the dam becomes unstable in overturning when the reservoir rose to within 2 m of its crest! The main section of the St. 1. It was not.4. Additionally. the fragile dam itself that failed. . Malpasset dam at commissioning 15 . It appears that the landslide happened first. This portion of the dam did not fail. not last. which did not have uplift relief wells. failure started in the clay seems of a fault in the rock near the dam left abutment. only the sloping abutments. Instead. Originally intended to be 54 m high in May 1923. however. Another 3 m of height was added in July 1925 This raised the height of the dam by 11% without increasing the base width. which were not afforded uplift relief wells.The dam was not designed to incorporate the contribution of arching to its stability. which reduces the effective weight of the dam.2. shortly after construction began.5. main cause of failure was the large deformation of the geologic formation in the left abutment and piping of its material along the fault. A conventional analysis of cantilever stresses in St. A massive landslide of the dam’s eastern abutment initiated the failure and the entirety of the dam’s left abutment was carried across the downstream face of the main dam. as shown in figure 1. it was decided to raise dam 3 m in July 1924. Full uplift may have developed beneath the sloping abutments. Figure 1. There was no consideration of saturation of the concrete or of hydraulic uplift. Malpasset dam Malpasset dam was an arch dam with a height of 66 m and with 220 m long crest at its crown (figure 1. The failure also involved the reactivation of an ancient bedrock landslide which comprised the dam entire left abutment. post failure images show a massive tension crack at the dam upstream heel revealing that the dam heel was in tension and tilting downstream when the dam failed. The dam was commissioned in 1954 and it was the thinnest arch dam of its size in the world when it was completed. Francis Dam was constructed with 10 uplift relief wells set in two rows. However.

The damage was estimated at 68 million US dollars. Wave overflowed the banks but followed valley where a tremendous wall of water submerged the spurs of the valley.000 m3 of water were released. The dam body was left without support on the left abutment and failed in tension (figure 1. Failure of left abutment caused uplift and rotation about the right abutment. right side. left side.6.Dam failure occurred at 21:13 on the 29th November 1959. The condition of the left abutment after failure is presented in the same figure. PLAN VIEW PLAN VIEW Removed rock block Figure 1.6).7.3 m below the highest water level. This was the first collapse of a concrete arch dam.000. When the collapse occurred. Geological foliation at left abutment almost parallel to the arch thrust of the dam has created the premises of a stress dependent permeability of the rock. Failure mechanism and the remains of the dam A more detailed definition of the unstable block (wedge) and of the loads acting on the wedge prior the failure are presented in the figure 1. The failure was caused by the outburst of a rock block on the left abutment as consequence of high water pressure acting on the less pervious rock mass subjected to large compressive stresses. the dam was subjected to a record head of water. 16 . The water marks left by the wave revealed that the release of water was almost at once. Two large sets of faults created a ‘wedge failure’ at the left abutment. The failure occurred as the arch ruptured when the left abutment gave away. resulting from 5 days of unprecedented rainfall. 50. Wave killed 423 people instantly. The wave induced flooding in city of Frejus located 7 km downstream. which was just about 0.

It was an earth fill dam that had 122 m high creating a 27. Wedge on the left abutment 1.4 km long reservoir with a 333 Mm3 capacity. having slopes of 3. The crest width was 12 m. with joint widths varying at different elevations typically between 0.7.8).6.5 H: 1 V on the upstream and 2 H: 1 V and 3 H: 1 V on the downstream. The hydraulic was 93 m. Teton dam Teton Dam was constructed by the US Bureau of Reclamation across the Teton River approximately 64 km northeast of Idaho Falls.8 and 7. Narrow trenches 21 m deep. excavated in rock and compacted with sandy silt and a deep grout curtain beneath a grout cap were the measures taken to control the foundation seepage. and rock fragments taken from excavations and burrow areas of the river's canyon area. 17 . It had a compacted central core. a height above the bed rock of 126 m.5 cm but with occasional joints up to 30 … 40 cm wide. The bedrock on site was tertiary rhyolite welded-tuff. The dam was designed as a zoned earth and gravel fill embankment. The construction work commenced in June 1972 and the dam was completed and first filling started in November 1975. Teton dam was located in a steep-walled canyon cut by the Teton River into a volcanic plateau. which is strongly jointed.Figure 1. The embankment material consisted of clayey silt. and a 945 m long crest. sand.3. The cofferdam was incorporated into upstream shell (figure 1.

The cause of failure was attributed to piping progressing at a rapid rate through the body of the embankment. These investigations indicated the presence of an extensive interconnecting system of joints.8. A flood at an estimated peak discharge in excess of 28. 1976.MAIN CROSS SECTION CROSS SECTION WHERE FAILED STARTED ZONE 1 Figure 1.300 m3/s had occurred. Cross sections of Teton dam Percolation tests and pumping tests revealed that the joints were capable of transmitting large volumes of water. Since the amount of grout needed was a tremendous amount. A breach 46 m wide at its bottom and 79 m deep had formed. The dam failed during its first filling on June 5. releasing 308 million m3 of reservoir water. The main findings suggested that erosion on the underside of the core zone by excessive leakage through and over the grout curtain was the cause of destruction. which made the rock extremely permeable and indicated the need to seal the joints in order to reduce the leakage to acceptable quantities. The time of failure was recorded as four hours. it was concluded that it would be more economical to remove the top 20 … 25 m of rock in the abutments and incorporate a deep key trench to prevent seepage. 18 .

the deep key trenches developed arch action that induced cracking and 19 . efforts to fill the holes failed and the dam breached by the noon time. Furthermore. Earlier on the day of failure. which taken together allowed the failure to occur.Sequences of failure are presented in figure 1. Numerous open joints in abutment rock and scarcity of more suitable materials for the impervious zone were pointed out as the main causes for the failure of the dam.9. After four hours. Leaks at downstream face Breach development Figure 1.9. Sequences of the failure process The fundamental cause of failure was regarded as a combination of geological factors and design decisions. leaks were observed about 30 m below the top of the dam.

located in the Dolomite Region of the Italian Alps.hydraulic fracturing of material for impervious zone. The water. of only 11 deaths.10). The by-pass tunnel is still used for the generation of hydropower (figure 1. Vajont dam Vajont Dam built across the Vajont Valley. estimated to have had a volume of about 30 million m3. Villanova. 20. Pirago. Rivalta and Fae. The dam failure had an extremely low death toll. Figure 1.000 head of cattle killed and the power plant at dam toe was destroyed. totally decimating them. due to very efficient early warning systems. These were also attributed as possible causes of failure.10. Dam structure is slender. one of the highest in the world. about 100 km north of Venice. 25. 2 towns were destroyed. narrow gorge) and is provided with a pulvino joint (figure 1. Remarkably the dam remained unbroken by the flood. 1. Vajont dam . 20 . was completed in 1961 and used to generate hydropower.000 people were left homeless. The chord of the dam was 160 m. As a result a wave overtopped the dam by 245 m and swept onto the valley below. according to the very favourable site (a deep. and the volume of impounded water was 115 million m3.6. is an arch dam 262 m high. The dam.characteristic cross sections The Vajont reservoir disaster is a classic example of the consequences of the landslides of the reservoir banks. However. During the filling of the reservoir a block of approximately 270 million m3 detached from one wall and slid into the lake at velocities of up to 30 m/s (approx. A total 2500 lives were lost.4. 110 km/hour).11). $1 Billion was spent for cleanup over several years. then fell more than 500 m onto the villages of Longarone. The dam was never rebuilt.

It was concluded that deep-seated landslides were extremely unlikely. Hence a bypass tunnel was constructed on the opposite (right) bank such that if the reservoir was divided into two sections the level of the lake could still be controlled.11. which identified a possible prehistoric slide on the right bank. a large failure occurred when 700 000 m3 of material slid into the lake in about ten minutes. Failure occurred in a brittle 21 . However. Vajont dam and reservoir after landslide It appears that during the construction of the dam the chief engineer was concerned about the stability of the left bank of the dam. However the volume of water in the unblocked (upstream) section would still be sufficient to allow the generation of electricity. The rate of movement could be controlled by altering the level of the reservoir such as the over-topping of the dam would be avoided. with the depth of the reservoir of 180 m.Slide mass mass Sliding surface Vajont dam Figure 1. before final completion of the dam. From the beginning of October 1961 two raise and drawdown cycles were conducted. on 4 November 1960. It was assumed that by elevating the level of the reservoir in a careful manner movement of the large landslide mass could be initiated. and a number of reports were compiled on this during 1958 and 1959. At 22:38 GMT on October 9 1963 catastrophic failure of the landslide occurred. keeping the slide velocities in the range of 2 … 3 cm /day. As a result the level of the reservoir was gently dropped back to 135 m. It was realized that additional and even larger landslides could lead to the blockage of that section of the reservoir.

m. poured more than a year's rainfall in 24 hours (new records were set. Communication to the dam was largely lost due to the collapse of buildings under heavy rain and wire failures. inducing catastrophic loss of strength.. exceeding the average annual precipitation of about 800 millimetres) which weather forecasts failed to predict. failed to handle more than twice its capacity and broke upstream. however. 260 m above reservoir level. partially due to sedimentation blockage. a request to breach the dam was rejected. a 1-in-2. In August of 1975. Seven county seats were inundated.800 m3/s. The dambreak wave was 78. Evacuation orders had not been fully delivered because of weather 22 .m.manner.6.m. A wave of water was pushed up the opposite bank and destroyed the village of Casso.12. water overtopped the Banqiao dam and it too failed (figure 1.000-year flood (306 millimetres of rainfall per day). and almost wiped out an area 55 kilometers long.13). The dam was 118 meters high and had a storage capacity of 492 million m3 with 375 million m3 reserved for flood storage. This precipitated the failure of 62 dams in total.. it was sent the first dam failure warning via telegraph. Figure 1. The resulting flood waters rush downwards into the plains below at nearly 50 km/ hour. as were thousands of square kilometers of countryside and countless communities. On August 6. because of the existing flood in downstream areas.000 year flood occurred. and 701 million tons of water was released in 6 hours. On August 7 at 7:30 p.000 square kilometers. Banqiao dam The Banqiao dam was built in the early 1950s on the Ru River as part of a project to control flooding and generate electricity and as a response to severe flooding in the Huai River Basin in 1949 and 1950.5. Schematic cross-section through the Vajont valley 1. 15 kilometers wide.5 millimetres rainfall per hour and 1. A schematic cross-section through the Vajont valley after the landslide is presented in figure 1. The Dam was designed to survive a 1-in-1. at 189. The sluice gates were not able to handle the overflow of water. before over-topping the dam by up to 245 m. and created temporary lakes as large as 12. On August 8. A half hour later.060 millimetres per day. 12:30 a. at 1:00 a. the smaller Shimantan Dam.12. that was designed to survive a 1-in-500-year flood.

000 people died in the unevacuated Wencheng commune of Suipin County. Typhoon Haitang approached China and dropped heavy rains in the area but did minimal damage to dams. Banqiao Dam after the failure To protect other dams from failure. During the night of July 28-29. preventing the full opening of the gates. The dam was a clay core earthfill. 1991. After the dam failure.13. Figure 1.000 people died in the evacuated community of Shahedian just below Banqiao Dam. Belci dam Belci Dam. equipped with 2. While only 827 out of 6. Dam operating personnel tried to unblock and lower the flaps manually. and several dams deliberately destroyed by air strikes to release water in desired directions.5 x 11 m flap gates.14). of 18 m maximum height and a 240.conditions and poor communications. 1. including Banqiao in 1993 and Shimantan in 1996. several flood diversion areas were evacuated and inundated. half of a total of 36. and the other radial gate never opened. The supply of electricity to the dam failed. a clay core earthfill structure. The two central openings were provided with bottom outlets. torrential rainfall of an exceptional magnitude occurred. In 2005. During the 29 years of existence of the dam a series of significant floods were successfully routed through the reservoir.6.5 x 11 radial gates. One radial gate had been lifted by only 40 centimetres at the time of the power outage.6. was located on the Tazlau River in northeast Romania.000 m3 fill volume (figure 1. it was found that three of the four flap gates remained blocked. The spillway consisted of four overflowing bays equipped with 2. Many of the dams have been rebuilt. 23 .

Belci dam before the failure The failure has developed in two phases.spillway bay with bottom outlet spillway bay with flap gate only Figure 1.15). and the peak outflow from dam failure was about 3. A breach of 80 m wide and 3 to 4 m deep was created.200 m3/s. 24 . The first failure occurred by superficial erosion and downstream slope sliding. The second failure correspond to an enlargement of the prime breach to 100 m and deepening of it to about 6.000 m3/s.14.5 m. limited by the siltation level in the reservoir (figure 1. The peak inflow to the reservoir was about 2.

Water Power and Dam Construction. Thêse. The exceptional torrential rainfall caused widespread damage to the whole of Bacau County. 119 houses were completely destroyed. D.. Etude géotechnique de la roche de Malpasset.15. Spillway Gate Failure or Misoperation: Representative Case Histories. so even in the absence of dam failure. Slobozia.Spillway Final breach Figure 1. major downstream losses probably would have occurred. The breach in Belci dam The flood and the resulting dam failure had disastrous consequences. S. N. Paris. Vol. An analysis of the Belci dam failure. Stematiu. BIBLIOGRAPHY B e r n a i x . Diacon. the warning of the population downstream on the night of the accident was not sufficiently vigorous or efficient. Water Operation and Maintenance Bulletin. and 24 houses were damaged. Warning was initiated at 02:15 hours. No. The peak reservoir inflow was nearly 75 percent of the dam failure outflow... approximately 4 hours before the main flood hit Slobozia. However. J. and 19 were reported missing. a village 2 kilometres downstream from the dam. (1992). The main flooding of Slobozia occurred at 06:30 hours. (2003). 25 . A. 202. Bureau of Reclamation. Power Point Presentation. A total of 78 people were killed.9. Nr. Denver. 17 lives were lost. (2002). Mircea. The Malpasset Dam Failure. Dunod. Sept. Burrows. (1967). 44. was largely destroyed.

New York. K. February. H.. Why Dams Fail? www.7. Londe. Safety and risk in hydraulic structures (in Romanian). J. Hasselmann. Proceedings of 20th ICOLD Congress. The Vaiont slide. July. Proceedings of the International Workshop on Dam Safety Evaluation. Issue four. Issue 1. (1998). (2002). W..2. (1992). Ionescu. Volume 3. April. Hydropower and Dams. Power Point Presentation. Nr. Wolfe. Issue one. E. M. Non-structural measures for cost-effective risk reduction. Robby. (2002). K. Risk Assessment. Editura Didactica si Pedagogica. (2000). P a n e t . Patten. Yi Si. University of Missouri-Rolla Stematiu. (1993). Failure of Teton dam: geotechnical aspects. /hazard/dam failure.Federal Emergency Management Agency (2006). Rogers.. (2006).. Beijing. N0. Hendron. The River Dragon Has Come!: Three Gorges Dam and the Fate of China's Yangtze River and Its People. Grindelwald.New Trends in Germany. D. Francis dam failure. Water Power and Dam Construction. (2000).fema. K. M. Risk analysis for existing dams: merits and limits of credibility. New dam safety legislation and the use of risk analysis. Hydropower and Dams. Lemperiere.. Hydropower and Dams. 26 . Q76. McLaren. Probability of failure: a useful concept in design practice. Hoeg. J. P. Vol. 54. (1998). Dam Engineering. Rettemeier. La mécanique des roches appliquée aux ouvrages du génie civil. Kreuzer. D. Safety evaluation using reliability analysis. Stematiu. L'Ecole Nationale des Ponts et Chaussées. Burke. The World's Most Catastrophic Dam Failures: The August 1975 Collapse of the Banqiao and Shimantan Dams. St. Vrijling. (1985). A. Issue 5. The Netherlands. (1996). Felsmehanik und Ingeneur-geologie. Safe dams and dikes. Ionescu. K. R41. Bucharest. (1976). D. Reassessment of the St. St. how safe? Publication of Delft University of Technology.. (1992).

2.1. Approaches to risk analysis
Risk analysis processes can be grouped into three categories: Standards-based,
Qualitative and Quantitative.
Under standards-based approach (SBA) risk analysis is not carried out explicitly.
Rather, consideration of risk is implied through the selection of the design loads for
normal and unlikely events and of the safety coefficients based on a certain
classification scheme. Usually, any dam classification reflects the dam and reservoir
characteristics and the relative severity of the consequences of dam failure.
Qualitative approaches consider risk more explicitly than the standards-based
approach without characterising the uncertainty in mathematical (probabilistic) form.
The simplest of these techniques are indexing and ranking schemes that consider the
extent to which there is concern about the safety of dams and the consequences of
their failure for one or all of the following purposes:
• setting monitoring and surveillance programs;
• prioritising more detailed studies and;
• dam safety improvements.
Failure Modes and Effects Analysis (FMEA) is a formal qualitative risk analysis
technique. Interpreting the results of the FMEA may require some measure that
describes severity, importance, criticality, potential to occur, etc. Expressing the
combination of frequency and severity as a "criticality" is one way to provide a
metric. This is achieved by extending the FMEA to include criticality considerations
through Failure Modes, Effects and Criticality Analysis (FMECA).
Failure Modes and Effects Analysis process is descriptive and qualitative and
provides the engineers a comprehensive understanding of the dam. The process is
aimed at systematically developing a picture of the dam system, its components and
their interactions, and presenting details of how component failure could lead to dam
failure, the magnitudes of the failure effects and the criticality of the various
components in preventing the risks from materializing.
The term "system" is used in a general sense and its definition is a matter of
modelling convenience. Where relevant, it can and should include a series of dams in
"cascade" on the one river basin. It refers to a group of interacting, interrelated, and
interdependent elements that form the complex whole. The dam/reservoir/river basin
system is an example (figure 2.1).



Figure 2.1. Functional model of a dam / reservoir / river basin system (after ICOLD
130 Bull.)
Dams also may be represented as systems, and even subdivided into sub-systems all
the way down to basic components (e.g., earth core, filters, grout curtain and rip-rap
protection as in figure 2.2). Since the function of a dam as a whole is to retain water
(with some allowable seepage), the functional failure of a dam occurs when, for
example, the system ceases to retain water (which can include severe leakage).

Figure 2.2. System components of a fill dam (after ICOLD 130 Bull.)
Failure Mode, Effects and Criticality Analysis is an extension of the FMEA by
including the probability of occurrence and consequence to the system for each failure
mode. It provides a means of ranking the failure modes in terms of an index of risk
that incorporate representations of probability and consequences. This creates a sound
basis for prioritizing corrective or remedial actions.
The dam system components that are involved in starting certain failure mechanisms
are identified. The extent to which the damage of the given component may contribute
to the dam failure is characterized by a criticality (gravity) index IG:

IG = CM • PC • DC
- CM is a partial index that expresses the component share in the failure mechanism;
- PC is a partial index that expresses the component failure probability;
- DC is a partial index that expresses the extent to which the component failure may
be detected in advance.
Each partial index is evaluated on a scale from 1 to 5. The maximum value of the
criticality index IG =125 corresponds to the component, the failure of which has an
extremely important effect in starting the breaching mechanism (CM=5), its failure is
most likely (PC=5) and, at the same time, it is very difficult to detect in advance
An example is presented in the followings based on figure 2.3 and table 2.1. It is the
case of Aurul tailings pond.

Figure 2.3. Aurul tailings pond
The components that may be the potential causes of the failure are presented in the
table. For example, the reduction of the freeboard leads undoubtedly to the dike
breaching (CM=5) and the probability of such an event occurring is relatively high
(PC=4). However, it is not difficult to detect such a situation (DC = 1). As far as the
water collection system is concerned, its failure leads to the tailings dike breaching
due to the excessive volume and level of the accumulated water (CM=5). The failure
probability is medium (PC = 3), but the detection in advance, to permit useful
interventions, is rather difficult (DC = 4). Likewise, the indices for the rest of the
components have been established.


In a reliability analysis it is necessary to establish the chance that a given load or distribution of loads is greater than. Once the failure modes have been identified event trees and/or fault trees can be utilized to provide the framework for determination of the failure probabilities. quantitative event tree and fault tree models of system failures and associated consequences. Event tree and fault tree methods may include the use of various simulation and reliability analysis . the capacity of the structure to resist load. The connection between a fault tree and the corresponding event tree is presented in figure 2. On the left side the fault tree investigates the conditions and factors that can contribute to dam failure (called the top event). 30 . or equal to. The analyses require estimates of means and standard deviations for loads and strength parameters.1: Evaluation of gravity indices for safety parameters and pond components Parameter or component CM PC DC Freeboard Beach width Downstream slope Material granulometry of dikes Water collecting system Drainage system Pumping station Pond-plant pipes 5 4 5 3 5 5 2 3 4 4 4 4 3 2 3 4 1 1 1 3 4 4 1 2 IG= CM⋅PC⋅DC 20 16 20 36 60 40 6 24 As can be observed. On the right side the event tree identifies the possible outcomes. in other words. Event trees are currently most commonly used for analysis of dams. The output of such a fully quantitative risk analysis is a measure of the risk that includes complete mathematical specification of the uncertainty in the estimate. the water collection system has a maximum criticality index and as a consequence the maintenance of the penstock and associated pipes has first priority Quantitative approaches include formal reliability analysis methods. Risk estimation incorporates failure probability along with consequence magnitude and associated probability. the chance of failure.4. • use of physical laws and engineering relationships within and amongst mechanisms. given the occurrence of the top event. or.reservoir system and the natural conditions that cause system response. • identification of failure mechanisms.Table 2. A fully quantitative and scientific risk analysis would require: • complete identification of the physical features of the dam . and if required their probabilities.

Schematic fault and event tree connection Event Tree Analysis is a technique. Example of a quantitative Event Tree Analysis (after ICOLD 130 Bull) In dam safety applications. that is used to identify the possible outcomes. given the occurrence of an initiating event. either qualitative or quantitative.5.4.. Event Tree Analysis reveals the relationship between the functioning and failure of various mitigating systems and it is useful for identifying 31 ." e. and if required their probabilities.5. Event Tree Analysis is an inductive type of analysis where the basic question that is addressed is "What happens if.g.EVENT TREE FAULT TREE CONSEQUENCE CAUSES 1 2 „TOP“ EVENT 3 4 (DAM FAILURE) 5 6 7 SCENARIO 1 SCENARIO 2 Figure 2.. "What happens if there are high inflows?" An example of an event tree for one failure mode for a dam subjected to a flood hazard is illustrated in figure 2. Figure 2..

The faults identified in the tree can be events that are associated with component hardware failures.6. Example of a fault tree: slope sliding A special kind of risk analysis is Portfolio Risk Analysis.6% P4=2 x10-6 P3=1.1x10-4 Low shear strength Rise of seepage line Shell saturation OR OR P22 =10-5 P21=10-4 Lack of compaction P41=10-6 Fill nonhomogeneity Storm event Drainage clogging Damage of US watertightening Rapid snow melting P33=10-4 P32=10-6 P31=10-5 P42=10-6 Anisotrpic fill permeability Figure 2. A conceptual example of a fault tree for the failure of the downstream slope of an earth dam is presented in figure 2. the possible causes or failure modes on the next lower functional system level are identified. The method is “judgmental” technique and a decision analysis which results in a prioritization listing for dam safety actions within the portfolio of dams.9% 0. which is the failure mode. by which conditions and factors that can contribute to a specified undesired event (called the top event) are deductively identified. Fault Tree Analysis is a technique. human error or any other pertinent event that leads to the undesired outcome (e.6.e. individual event tree branches become the top events of the fault trees). either qualitative or that require further analysis using fault tree techniques (i. Following the step-by-step identification of undesirable system operation to successively lower system levels will lead to the desired system level. 32 .4% P1=10-4 Steeper slope 34.11x10-4 P2=1. and as such it has been found to be a beneficial framework for some owners.23 x 10-4 OR 30. organized in a logical manner and represented pictorially. Sliding of DS slope Pf = 3. Starting with the top event. dam overtopped). The risk analysis does not refer to a certain dam but to a portfolio of dams belonging to the same owner.g.1% 34. The portfolio risk analysis generally seeks to determine where maximum utility may be gained for limited risk reduction amount of money.

to R4. R1. Any 'unbalanced' input renders results of little practical relevance. Figure 2. there is the problem of balancing its refinement with the amount of information available to create the model. They trigger a response of the dam defined as 'hazardous conditions'. Kreuzer) 2. Grouped in scenarios. The basic concept of quantitative analysis The basic concept is presented on the basis of figure 2. The 'primary failure causes' are adverse events imposing on the dam. An assessment of consequences renders the risk of each scenario. The results from event trees are more reliable if available data allow quantitative approaches. first in terms of probabilities and then in monetary units. This is damaging for the credibility of risk analyses. to apply such an approach needs scrutiny of data and success in finding them.5.6. by an event tree. Hierarchy of risk analysis approaches: model selection versus level of information (after H. for example. are obtained from event trees or reliability analysis. the blocks of figure 2. In an actual analysis. the probabilities of failure. The total probability of failure is the sum of failure probabilities corresponding to each scenario. However.2.6 would be replaced by a diagram of more detailed interconnected events. see figure 2. here P1 to P4.5. 33 .As for model selection.

and environmental degradation. Dam failure consequences Dam failure consequences are typically grouped into two main categories: direct damages due to contact with the floodwaters. The direct damages are predominantly loss of life. personal grief. and indirect damages that result from the direct damages. societal trauma and loss of confidence in public institutions) cover a wide range of complex social. Kreuzer) 2. physical loss/damage to property and infrastructure. Cause-consequence analysis for dam safety evaluation (after H. There are various classification systems for further sub34 . loss of production. Indirect damages (such as costs of emergency response. economic and environmental considerations that require the input of specialist professionals.Figure 2.6.3.

BIBLIOGRAPHY Bureau of Reclamation. The decision may involve consideration of legislated requirements. (2004). ICOLD Bulletin 130. (1993). Paris. Grindelwald. and intangible) and the group that bears the risk (dam owner. 2. Proceedings of the International Workshop on Dam Safety Evaluation. Water Power and Dam Construction. Hydropower and Dams. regional or national level). Thomas Telford. (2003). Risk assessment Risk assessment is the process where the understanding of the risk (Risk Analysis) is compared to societal tolerated risks of a similar nature (Risk Evaluation). complex and poorly understood. risk based analysis and societal values and expectations. 35 .dividing consequences. (2006). (1993). New dam safety legislation and the use of risk analysis. As the dam safety profession has matured since the 1970’s it has realised that although traditional practice has served well it may not provide a comprehensive view of all the risks. April. Denver. Technical Service Center.4. Issue 5. Hoeg. the risk of long term piping in embankment dams due to inadequate filters. Probabilistic risk analysis of large dams.. R. population at risk. Risk and uncertainty in dam safety. engineering judgement. London. and community . environmental. P. (1998). codes and standards. Baecher. Examples would be the influence of human error contributing to dam risks. 45. (2000). good practice. H. Londe. G. Hydropower and Dams. Risk Assessment in Dam Safety Management. ICOLD. allowing a decision regarding the requirements for control of the risk. the contribution of lesser but more frequent flood events to dam flood risks. economic/financial. Issue one. Risk analysis for existing dams: merits and limits of credibility. The estimation of the uncertainties associated with dam failure consequences poses immense difficulties because the scenarios that must be modelled are unique. and the associated risks. local. usually according to type (such as life safety. D. Kreuzer. Colorado Hartford. Lafitte. Dam Safety Risk Analysis Methodology. Safety evaluation using reliability analysis.

N. J. Slunga. (2003). of International Symposium on Major Challenges in Tailings Dams.49. International Water Power and Dam Construction. Brauns. Helsinki University of Technology Stematiu. July. D. Hartford. Safety Evaluation of Aurul Tailings Pond following the Remedial Measures after the January 2000 Accident. (1994).. Vick. 2003. March.. Montreal. E. Dam safety risk assessment: new directions. Vick. June. Water Power and Dam Construction . (1997). S. S.Nielson. Risk Analysis in British Columbia. D.. Concept and bases of risk analysis for dams with an example application on Kyrkösjärvi dam. 36 . RESCDAM-project report. (2001). Proc.

failure mechanisms of another sub-system and failure effects of a third subsystem and so on. identification of internal failure causes may not be so straightforward and may involve consideration of interactions between failure modes of one sub-system. Identification of hazards may be relatively straightforward. In this regard. the seepage line raising has to be in accordance to permeability characteristics and embankment zoning of that particular dam and the shear strength water content dependency of its fill material in order to induce the sliding of the downstream slope.). sabotage etc. For example. Each failure mode can be due to one or more hazards or failure mode initiators. internal erosion/piping. In general.1. in accordance with natural laws. these failure mode initiators are extreme storms. mechanical equipment. General A failure mode describes how the failure of a certain dam element or component must occur to cause dam system failure. However.3. 37 . design and construction flaws in conjunction with normal hydraulic loads. the dam system is broken down into sub-systems (dam structure. earthquakes. Earth dam failures modes Earth dam failures modes can be grouped into three general categories: overtopping failures. mass movement and slope instability. failure modes are not unique features of the dam system but artefacts of how the dam system is modelled. General failure mode categories can be prepared for dams but these general categories are often too general for definitive analysis. stilling basin etc) to a level where there is a thorough understanding of the failure modes of the elementary sub-systems. and human agency (mis-operation. A brief discussion of each type follows.1.2. failure modes of earthfill dams can be broadly categorised in terms of: hydraulic overtopping.1. for the failure mode to progress from failure mode initiation (cause) through to the realisation of ultimate failure effect of interest. 3. seepage failures. A failure mechanism describes the physical processes and states that must occur. These general categories of failure modes are usually too broad for definitive analysis and should be expanded by going deeper into the system and carrying out the analysis at a more basic level. Failure modes identification 3. Taken as an initiating event the clogging of the drainage system of an earth dam. DAM FAILURE PROBABILITY 3. and structural failures. foundation.1. Typically for dams. spillway.

Figure 3. Erosion is due to uncontrolled flow of water over. and adjacent to the dam. Piping through dam fill or foundation Seepage can cause slope failure by creating high pressures in the soil pores or by saturating the slope. complete failure of the dam will probably follow in a matter of minutes. around. the discharge of muddy or discolored water. but near zero for poorly compacted earthfill.5 m and 1m for a modern compacted rockfill. Erosion of the soil begins at the downstream side of the embankment. A well vegetated earth embankment may withstand limited overtopping if its crest is level and water flows over the crest and down the face as an evenly distributed sheet without becoming concentrated.0 when the depth of water overtopping the dam is between 0. Most studies seem to accept that the probability of failure approaches 1. or a whirlpool in the reservoir. Once a whirlpool (eddy) is observed on the reservoir surface. it is almost impossible to stop. If uncontrolled. Seepage must be controlled in both velocity and quantity. This phenomenon is known as "piping.1). it can progressively erode soil from the embankment or its foundation. either in the dam proper or the foundation. sinkholes on or near the embankment. Seepage Failures All earth dams have seepage resulting from water permeating slowly through the dam and its foundation. Earth embankments are not designed to be overtopped and therefore are particularly susceptible to erosion." Piping action can be recognized by an increased seepage flow rate. As with overtopping.1. progressively works toward the reservoir. resulting in rapid failure of the dam. and eventually develops a direct connection to the reservoir (figure 3. fully developed piping is virtually impossible to control and will likely cause failure. Once erosion has begun during overtopping.Overtopping Failures Overtopping failures result from the erosive action of water on the embankment. The pressure of seepage within an embankment is difficult to 38 .

Figure 3. Piping along the bottom outlet pipe 39 . Slope failure due to seepage Breaks. Figure 3.determine without proper instrumentation. or loss of conduit material within the dam structure itself could lead to leakage of water under pressure into the interior of the dam.2). This action could cause the washing out of material from within the dam embankment. A slope which becomes saturated and develops slides may be showing signs of excessive seepage pressure (figure 3.3.3). separation of joints.2. creating the possibility for structural failure of the dam (figure 3.

and major slides will require emergency measures to ensure safety. or poorly compacted softened zone in the dam. Three major potential modes of failure of gravity dams include: 1) overstressing. A structural failure may shorten the seepage path and lead to a piping failure. Concrete dam failures usually fall into one of the following categories: . . 2) sliding along cracked surfaces in the dam or planes of weakness within the foundation. uncontrolled seepage may weaken the soil and lead to a structural failure. major settlement. or other appurtenance may lead to failure of the embankment. For example. Large cracks in an appurtenance or the embankment. Structural failure of a spillway.1. Most instability problems arise because of weak zones in the foundation or in the dam such as a bedding surface shear in the foundation. Cracking. especially if these problems occur suddenly. A gravity dam may collapse in one or more sections. The three types of failure previously described are often interrelated in a complex manner. Because high water pressures are maintained on the upstream side of the control mechanism. the lake level should be lowered. a leak which develops can cause greater internal erosion and at a faster rate. 3.Probably the most potentially serious situation is when a rupture occurs in the conduit on the upstream side of the gate. the appropriate state and local authorities notified. Potentially an arch dam may fail as a result of either excessive contraction joint opening combined with cantilever tensile cracking or movements of the abutment rock wedges formed by rock discontinuities. and professional advice sought. of a bottom outlet.Overturning or sliding resulting from erosion of the supporting foundation and / or abutments. For this reason new dams are constructed with their low level outlet controls located at the upstream side of the dam. and slides are the more common signs of structural failure of embankments. The simple fact that high pressures exist in the conduit makes the development of leaks and seepage more likely. The seriousness of all deficiencies should be evaluated by someone experienced in dam design and construction.Abutment or foundation failure due to overstressing.3. settlement. 40 . Minor defects such as cracks in the embankment may be the first visual sign of a major problem which could lead to failure of the structure. The prevailing mode of failure for gravity dams is probably sliding along the base of the dam or along planes of weakness within the foundation (figure 3. If this type of situation occurs. A qualified professional engineer can recommend appropriate permanent remedial measures. Concrete dam failure modes The evaluation of risk of exposure of concrete dams requires a close examination of all possible modes of failure.Structural failure of concrete unable to sustain imposed loads.4). . Surface erosion may result in structural failure. Structural Failures Structural failures can occur in either the embankment or the appurtenances. and 3) sliding accompanied by rotation in the downstream direction.

The effect of uncontrolled leakage through the foundation material over time can cause deterioration of rock. 3.5. In some cases. Spillway chute walls are often likely to overtop at floods less than the flood to overtop the dam. flow through the spillway may scour the foundation. and care must be taken in selecting the critical section for analysis. Floods overtopping the dam may cause scouring leading to undermining of the dam. Failure modes related to floods In the case of embankment dams failure due to flood can occur by overtopping of the embankment.Figure 3. Settlement and cracking of concrete structures and the displacement of stilling basin structures may be attributable to foundation piping.1. Once a dam is overtopped the force distribution changes and the maximum section may no longer be the critical section. In the case of concrete dams floods overtopping the dam may cause scouring leading to undermining of the dam. or overtopping the spillway chute walls.4. The evolution of such a process is shown in figure 3.4. leading to scour and undercutting of the embankment. The loss of foundation material from seepage forces may leave voids beneath the spillway. Overtopping a concrete dam can also lead to a stability failure of the dam. scour of the spillway chute or energy dissipater (leading to undercutting of the embankment). such as concrete weirs on an alluvial foundation. flow through the spillway may scour the foundation. In some cases. the overtopping can scour the dam and lead to failure. which decreases the overall support for the spillway. 41 . Sliding along the base or along planes of weakness within the foundation A potential mode of failure in concrete dams under the natural hazard of extreme flood is that of progressive sliding and separation of joints in the rock foundation. If the chute is adjacent the embankment. with the simultaneous participation of a group of monoliths in either the central or the abutment regions of the dam. such as concrete weirs on an alluvial foundation.

Earthquake induced damage to several concrete dams indicated that concrete dams are not immune to earthquake damage as had commonly been presumed. and these have mostly been the result of liquefaction of the dam or the foundation.5% of all dam failures. concrete 42 .5. Dam failure due to structure undermining 3. Earthquakes have been the cause of only around 1.5.Erosion of soil downstream of the stilling basin Failure of sheet piles by undermining Collapse of stilling basin into scour hole Dam failure Figure 3. Failure modes related to earthquakes Earthquakes can certainly cause damage to dams but complete failure of a large dam due to earthquake damage appears to be very rare. During intense earthquake motions. vertical construction joints may slip or open.1.

Earthquake wave vibrations cause sliding in soil and rock. 3. such local damage may not necessarily affect the overall stability of the structure. The only imaginable failure mechanism of arch dams under earthquake action may be triggered by the opening of the joints between neighbouring blocks.6. or in slopes above or below the reservoir. Cracks and fissures. Earthquake-induced fissures and cracks could be a result of differential settlement. Embankment dams. are susceptible to cracking and the design must eliminate the potential for internal erosion or piping as a result of water passing through a crack. These cantilevers cannot withstand the additional load share and failure occurs usually through base shear. the reduced outflow from the dam may have the benefit of reducing downstream flood damage. misoperation. Liquefaction. which renders the structure discontinuous and overloads the cantilevers. Some of the common effects caused by earthquake shaking are summarized below.1. or tensile strength failure of the embankment or foundation materials.may crack and the stored water may locally separate from the upstream face of the dam. Slides are often caused by liquefaction. Many of the existing arch dams have safely survived strong earthquakes. however. dam overtopping and possible dam failure may result. in the abutments. The failure. Deformation by earthquake can interrupt the integrity of internal filters. provided liquefiable soil conditions exist. If dam failure does not occur. or use of spillway gates may cause downstream flooding that can range from minor to catastrophic. Structural failure examples. If gates cannot be opened during a major inflow at a reservoir. A gated spillway provides for greater flexibility in reservoir operation than a dam having an uncontrolled spillway. resulting in cavitation. Certain saturated cohesionless materials such as sand and silt lose shearing resistance when subjected to the cyclic motion of an earthquake and can thus flow as in a liquid state or cause slides. Liquefaction can occur in a foundation. fault rupture movement. within the dam itself. Sliding events normally occur as a result of loss of shearing resistance along weak planes or within soils. 43 . a controlled spillway is provided with gates or other facilities so that the outflow rate can be adjusted. The upper parts of a dam are particularly vulnerable during earthquake motion. Failure modes related to gate failures A spillway may be controlled or uncontrolled. The experience gained from the field behaviour of gravity dams under seismic loads shows that certain dam portions are most likely to be damaged. particularly where the factor of safety against sliding is marginal in the static state. from little damage to total destruction of embankment dams have been observed on dams around the world as a result of earthquakes. However. The most widely used type of gate for large installations are flap and radial (or tainter) gates.

or bolted connections. 3. Failure is the collapse or movement of part of a dam or part of its foundation. i.Spillway gates fail to open could be caused by loss of electrical power. Frequency of Failure x 10-5 Year Commissioned 1700-1929 1930-2000 Concrete Gravity Masonry Gravity Overall First 5 Years After 5 years Overall First 5 Years After 5 years 15 3. a failure results in the release of large quantities of water. requiring lowering of the water level in the reservoir and/or major repair but not leading to an uncontrolled release of reservoir contents.1. In some cases. failure of automatic control systems. possibly leading to damage to spillway gates and/or overtopping and dam failure. Accident is the collapse or movement of part of a dam or its foundation. Table 3. or other design or operational defects. corrosion of wire ropes. Failure probabilities based on statistical data These methods use the historic performance of dams similar to the dam being analyzed to assess a historic failure frequency. 44 . Referring to recorded dam behavior incidents. Incidents recorded at concrete and masonry large dams. at the time of the first loading of the rock foundation. causing a sudden increase in discharge downstream from the dam. or in the first 5 years. Debris blockage of spillway gates impedes outflow. lack of maintenance.2. It is possible that some cases of misoperation go unreported. The statistical data indicate that half of these failures occurred during the first filling of the reservoir. is separated from later performance. Spillway gates operated incorrectly can release larger outflows than inflow discharges leading to severe consequences. distinction should be made between failures and accidents. Tables 3.4 54 42 520 160 34 24 Detailed studies of the statistics have established that 75% of concrete dam failures were due to a foundation failure. rope connections. and assume that the future performance of such dams will be similar.e. failure of cart-mounted hoist equipment. so that the dam cannot retain water. Spillway gates fail structurally because of a deficiency in gate design or lack of maintenance. Only failure events are the basis for assigning probabilities of failure.5 100 14 9 1. the performance of dams during first filling.1 summarize the statistics of failures and accidents for concrete and masonry large dams. undersized motors. displacement of concrete structural components. In general.

). Cause External erosion Internal erosion Instability Failure/year/dam !0-5 Europe USA Japan 3 3 6 6 15 10 3 3 Developing countries 13 10 1 15 The statistical results for embankment dams are quite different. piping. sliding.3xl0-5 and two thirds of the failures occurred after the first filling. it can be seen that a dam built at the turn of the century and still standing is in fact as safe as a modern dam.2 summarizes the statistics of failures for embankment large dams up to 1990. Table 3. is 2.6 also indicates how the frequency of failures decreases with dam age. construction date and age of dam (after P. This comparison indicates that the rock mechanics problems associated with 45 . Londe) Figure 3. Table 3. Failures recorded at large embankment dams on different geographic areas. A general conclusion of this discussion is that the yearly probability of failure of a dam built at present is of the order of 10-5. Statistic of dam failure vs. Statistic of dam failure vs. 10-5 Figure 3.6.6. This is a very small probability indeed. all causes considered (overtopping. construction date and age of dam is shown in figure 3. First of all the yearly failure probability of dams built after 1950.2. etc.Today safety performance of large dams is significantly improved as compared with the one recorded in the past due to acquired knowledge in the field of dam engineering.

In many cases. 3. An event tree consists of a series of linked nodes and branches (figure 3. An event tree allows the particular cause to be addressed. 46 . However. nor do they allow for the detailed characteristics of the dam or for the ability of those responsible for the operation of the dam to detect a problem developing and to intervene. Using the historic performance does give only a starting point to estimating probabilities of failure. the structural response (failure) probability given that the load has occurred.concrete dam foundations are globally better controlled than the soil mechanics and hydrologic problems involved in earth dam design and operation. the risk may be well understood in a statistical sense but still be uncertain at the level of individual events. all of the branches emanating from a node should represent the set of possible outcomes or states. and the magnitude of that consequence. Only 4% of all failures are due to slope instability. The event tree in figure 3. the adverse consequence given that the load and failure have both occurred. and should be done for preliminary risk analyses only. an event tree becomes the template for subsequent assignment of event probabilities and calculation of risk. The risk associated with one sequence in the event tree is the product of the load probability. Together. which branch off into final probabilities of failure for each chain of imaginable events.7 corresponds to a gated dam subject to a flood which may lead to overtopping of the dam in question. This is because most instability becomes apparent before collapse occurs. By providing a graphical representation of the logic structure for the progression of each failure mode. Failure probabilities based on event trees Principles Event trees are used to represent sequences or progressions of events that could result in adverse consequences when a dam or associated structure responds to various loading conditions. It displays the probabilities of failure of the undesired initial event (on top) in a deductive manner. a statistically significant number of similar events must have occurred to similar structures in order to allow the extrapolation of probability into the future.3. Each branch represents one possible outcome of the event or one possible state that a condition may assume. Failure probabilities based on statistics do not directly account for the reservoir loading. it is worth noting that embankment dams built after 1960 are 5 times safer than those built between 1900 and 1939. that is. Insurance companies cannot predict whether any single driver will be killed or injured in an accident. Each node represents an uncertain event or condition. For this approach to be applicable. so intervention to lower the reservoir and/or improve stability can be implemented before the dam breaches. loading conditions and the characteristics of the structure itself are unique. with the dam settling or cracking. For most dams. the analyst provides a logical sequence of conditions.7). including normal operating loads or floods. even though they can estimate the annual number of crash-related deaths and injuries with considerable precision. The total risk for the load category is the sum of the products for all event tree paths.

Thus.Pw Pw·(1-PG) + Pw·PG·(1-Ps) (1-Pw)(1-Ps) = Pw·PG·Ps (1-Pw)PG·(1-Po) (1-Pw)PG·Po·(1-Ps) (1-Pw)·Po·PG·Ps·P21 (1-Pw)·Po·PG·Ps·(1-P21) Figure 3.probabilities are multiplied.7. Event tree corresponding to an overtopping failure (after H. Kreuzer) Each box represents an uncertain event (condition) with an event probability. A chain of linked boxes implies the interference of the connected event probabilities: • 'not only event A but also event B occurs' . and calculated failure probabilities (number-indexed). Non-occurrence of the event implies complementary probability (1-Pi). • 'events of either chain A or chain B occur' . an event tree permits the systematic aggregation of probabilities along each possible event sequence. Pi. The result is a probability of failure for each chain of events. The juxtaposition of probabilities is shown in the figure for estimated event probabilities (letter-indexed). Subjective probability is a probability based on intuitively plausible numbers of expert 47 . which needs to be estimated. Event probabilities in event trees are obtained from statistical or subjective estimates.probabilities are added.

3. Overtopping is a failure event with a number of possible initiating causes. Any remedial works. Example: probability of spillway clogging (Ps in Fig.7). • erosion of dam crest or excessive settlement (for an embankment dam): • negligence or impossibility to lower reservoir prior to flood arrival. Statistical probability is deduced from observations of similar events without an underlying model.judgement. Once a failure mode has been identified. A complete risk analysis would show similar diagrams for other possible reservoir levels. • unstable slope in the reservoir. It can be caused by one or a combination of the following: • inadequate spillway capacity or insufficient freeboard (design inadequacy). and finally to consequences that result. starting with some initiator event and proceeding through events describing the response of the dam to each level of the initiator. Example: recurrence periods of extreme events. The event tree is constructed from left to right or from top to bottom. Complexity The size and complexity of the event tree depend on what is known about the dam and its expected behavior under different loading conditions. The event tree should also identify possible interventions which could terminate the development of the adverse consequence. and. In dam engineering. a process sometimes called “failure mode decomposition”. however. The best way to start creating an event tree is to establish failure modes through a failure mode screening process. They therefore need to be assessed subjectively based on expert judgement. Figure 3. Each event node is predicated on the occurrence of all directly-linked branches that precede it in the tree. have to address the cause and not the effect. The event tree of figure 3. Event tree analysis has to include also atypical failure modes that might be unique to the dam in question. These event sequences are developed all the way to breach of the dam. Failure and incident information provided in case history reports describe the progression and sequence of the events that have occurred for other dams.7 shows the cause-tofailure events for a particular reservoir level during flood occurrence. • spillway obstruction or gate malfunction (operational inadequacy). on the complexity of the 48 . The unspecified entry of overtopping into a risk analysis is fundamentally wrong because as such it appears as an effect and not as a cause. the event tree should be formulated to show the sequence of events and/or conditions which would have to take place or exist in order for the dam to respond in an adverse manner. Case histories can provide additional insight for identifying failure modes and for breaking down the modes into sequences of events. The probabilities of each reservoir level would then be estimated from projected reservoir operation (for a new dam) or operating and flood records (for an existing dam). there is hardly a chance to rely on statistical data for flood warning (for Pw) or spillway clogging (for Ps). Mathematical probability is based on treatment of data populations by mathematical functions of probabilistic concepts.7 is an example of how to assess event and failure probabilities.

and it has been shown that decomposition considerably enhances accuracy of the calculated failure probability.8(a) and 3. Figure 3. have been found to greatly aid judgmental probability assessment. Vick) Since pf in figures 3. that are less extreme. it is apparent that the greater decomposition of figure 3. Thorough decomposition also helps shift some of the burden for probability assessment onto the conceptualisation of failure events.8. which are usually 49 .8(b) are the same. like those in table 1. In this sense. that are less extreme. As with all engineering problem solving.failure modes considered.8 shows two versions of an event tree illustrating different levels of decomposition. and communication. (b) well decomposed (after S. figure l(b) can be seen as an example of 'belt and braces' principle of design: The more things that have to go wrong. the less likely failure is to occur. judgement is most easily applied to small components and later aggregated. and to some degree on the purpose of the risk analysis.8(b) yields values of component probabilities. p. values to them directly. Most engineers also find it much easier to describe the likelihood of events verbally than to assign p. Since pf in figures l(a) and l(b) are the same. Example event tree for foundation liquefaction failure mode. Fi Figure 3. clarity. Thorough decomposition also helps shift some of the burden for probability assessment onto the conceptualisation of failure events. In tailoring risk analysis procedures to this reality. conventions for transforming verbal to numerical probability statements. Too little detail can reduce the ability to target specific risk contributors and can create problems in making reasonable structural response probability estimates. p. on the number of load ranges needed. it is apparent that the greater decomposition of figure l(b) yields values of component probabilities. (a) poorly decomposed. The event tree must balance needs for comprehensiveness and detail against needs for consistency. which are usually easier to specify.

3.945 (0.3. historical reservoir elevation records are an important information source for assessing the likelihood of failure modes associated with static loading conditions. The three categories of loading conditions typically required in risk analysis are static. time of exposure to the load. have been found to greatly aid judgmental probability assessment. or by the hydraulic phenomena (seepage.1 completely uncertain (two possible outcomes) very likely 0.99 0. The more things that have to go wrong.01 very unlikely 0. For risk analysis.995) Load Ranges and Increments. figure 3. it is important to consider the data in a fashion which is consistent with the failure mode being developed.05) 0.8 (b) can be seen as an example of 'belt and braces' principle of design.9) almost certain 0. The static loading condition includes a wide variety of specific loading conditions to which a dam is routinely exposed during the course of normal operation. static and dynamic loads imposed by operating various components of the dam.9 to 0.02 (0 to . erosion. or the potential for adverse consequences. Most static loading conditions are related to the reservoir level either in terms of the magnitude of the load. like the probable maximum flood. In the case of hydrologic loads the development of flood frequency relationships and reservoir inflow hydrographs are important inputs to the risk analysis process. and seismic. In this sense. Verbal to numerical probability convention Verbal description virtually impossible Probability equivalent 0.1 (0.85 (0. cavitation) associated with water passing through and around the dam. the less likely failure is to occur. 50 . For most risk analyses it is likely that a Reservoir Load Frequency Curve will need to be developed.15) even chance 0.75 to0. Conventions for transforming verbal to numerical probability statements. hydrologic. Most engineers also find it much easier to describe the likelihood of events verbally than to assign probability values to them directly. loads induced by landslides at the dam or on the reservoir rim. the focus of flood evaluations shifts from a single maximum event.5 0. When evaluating the historical reservoir information. Therefore.easier to specify. to describing a range of plausible inflow flood events. These loads can include hydrostatic loads and uplift forces imposed by the reservoir.5 Virtually certain 0. like those in table 3.9 Psychology studies almost impossible 0. Table 3.02 to 0.

Static (normal) Loading . This may signify stresses. Failure probabilities based on reliability analysis Basic principles A certain failure mechanism of the dam may be defined by a variable parameter X. sliding coefficients. and a threshold above which structural failure is almost certain to happen. when failure is a sliding along the foundation or on a sliding surface through the dam body. i. For reservoir levels below the elevation of this feature dam performance related to seepage is adequate. Examples of these approaches to developing load ranges are: Hydrologic Loading . The dam has survived this load. Often. It should establish the load range for which the dam is expected to perform without failure. discharges when failure is induced by exceeding the 51 .For utilization within a failure probability evaluation. Between these thresholds is a load range where structural damage or adverse consequences is possible to varying degrees.A comparison of available liquefaction susceptibility studies to potential earthquake induced peak horizontal accelerations at a dam site can be used to set the lower bound of earthquake shaking that a structure can withstand without failure. The lowest load range is very important due to its relatively high occurrence probability. The time period the reservoir water surface is below the elevation of this feature would be one bound on the static loading. Typically. Seismic Loading . For use in liquefaction evaluations.Using the recorded floods to establish the threshold of adequate spillway performance.4.. the acceleration bound below which no liquefaction is expected to occur. The most frequently used is a simple hazard curve that relates a ground motion parameter (often peak horizontal acceleration) to annual probability of exceedence. unless there is some progressive degradation mechanism at work. the maximum load already experienced by the dam may be selected as the threshold below which no structural damage or adverse consequences are expected.e. this load range is called the “threshold” range for initiation of failure. The flood or earthquake initiator events can take any value over very wide limits of the recurrence curve. It is necessary to confine these limits to a sensible range of values that can affect the structural response or consequences in a significant way. Two threshold load levels naturally suggest themselves: a threshold below which no structural damage or adverse consequences are expected. and one can usually assume that the dam will survive a repeat of this load. when failure is due to exceeding the capable stresses. The ultimate goal of a probabilistic seismic hazard assessment is specification of ground motions. consideration of ground motions organized by magnitude levels is required.There may be a structural feature located at a certain elevation (for example a more pervious layer in a compacted fill) where inundation by water begins development of potentially adverse seepage conditions. 3. The spillway either successfully passed or did not pass the flood of record. seismic hazard must explicitly contain information on the frequency of occurrence (and/or exceedence) of relevant loading parameters.

9) the failure probabilities are large and the safety factors lose the physical significance. If the distributions of L and R have large variances (the dotted line in figure or material parameters]. aleatory character of seismic loadings. where L > R. considering the pseudo-static approach. by the dead load of the moving body and by the inertia forces induced by the earthquakes. and by probability density functions fL(X) and fR(X) respectively. Figure 3.1) If the distributions of L and R values have small variances. 52 . there is a domain (hatched in the figure) where the maximum accidental values of L are larger than the minimum accidental values of R.9) the failure probabilities have reduced values. The condition for the failure not to take place is expressed by L < R. The external loads are given by the reservoir water pressure. The external loadings (L) as well as the strength capacity of the dam-foundation system (R) are aleatory variables due to: reservoir level variation. material parameter variation. a). represents a measure of the probability of failure Pf.9 shows the variation of the probability density functions characterized by the average values L0 and R0. The numerical value of the failure probability results from the convolution integral: Pf= P(L > R) = ∫ ∞ 0 FL ( X ) ∗ f R ( X ) dX (3. [Probability density function (pdf) is mathematical expression to simulate observed histograms of random variables ie.9 Load and strength capacity density functions The surface of the intersection domains. etc. The limit value R expresses internal strength of the structure. their values being grouped round the mean ones (the solid line in figure 3. etc. If L and R are well-established values as considered by the deterministic approach. A simple example – sliding failure probability of a homogeneous rockfill dam The failure mechanism consists in sliding of a downstream prism on a plane surfaces that passes through the downstream toe (figure 3.spillway capacity. The variability of L and R may be expressed by the probability functions FL(X) and FR(X). When FS > 1 it will be no failure or damage and as a consequence there appears the idea of “complete safety ". Though on the mean L0 <R0. The variable X has the value X = L as a consequence of the external loadings and becomes X = R when failure takes place. foundation different mechanical characteristics. Figure 3.10. a safety factor FS = R/L may be defined.

.log-normal for reservoir water level. b. B1 = G cos α + (hα − h) 2 (λ1 cos α − sin α ) .failure mechanism. a – seismic coefficient and tan φ .strength parameter) were: .Figure 3.type II distribution of extremes for seismic coefficient.10. that is defined by the angle α to the horizontal line.normal distribution for internal angle of friction.2) where: A1 = G sin α + 0. A2 = G cos α . may be expressed as: L= A1 + A2 a ≤ tan ϕ B1 − B2 a (3. Safety analysis of a homogeneous rockfill dam: a. . The probability function for L includes the variability of h and a and has the final expression:   B X − A −β  1 FL ( X ) = 1 − exp −  1 k  (3.4) where tan ϕ is the mean value of tan ϕ distribution. The probability density functions for each of the significant variables (h – water level. 2σ 2 2π σ   1 (3. σ the mean square deviation and X is the integration variable.5 (hα − h) 2 (λ1 sin α + cos α ) .probabilities The stability condition for the volume placed above the sliding plane. 53 . B 2 = G sin α λ1 and λ2 represent the face slopes and a is the seismic coefficient.3)   B2 X + A2     The probability density function for tan φ is given by: f R = f tan ϕ ( X ) =  ( X − tan ϕ ) 2  exp − .

Failure of a gravity dam due to overtopping Assume now that a recent safety inspection proves the operational inadequacy of a spillway and that the scenario 'Overtopping' is considered as a downstream hazard.10.63 million m3. The sealing is provided by a reinforced concrete slab. The dam height is 91 m.5 m diameter.04 and σ = 0.5) Safety analysis for Oasa dam in Romania based on this approach has led to the results presented in figure 3.The probability of failure is evaluated by the convolution integral: Pf = P ( L > tan ϕ ) = ∫ 5σ + tan ϕ A1 FL ( X ) f R ( X ) dX (3. except for a reduced area next to upstream face where the rockfill blocks especially compacted are limited to 0.11). the failure probability does not reduce beyond certain limits. Figure 3. Assessment of probability of failure due overtopping (after H. b. The probability that the dam's response to overtopping might lead to failure can be estimated by transforming the flood-pdf into a pdf of the load L acting on the dam for several overtopping levels because the level corresponding to design flood might not cause the highest risk.10. Excessive values of L would increase the risk of sliding (figure 3. Kreuzer) 54 . As results from figure 3. the crest length is of 300 m and the fill volume of about 1. b independent of the safety increase by making the downstream slope gentler.08 respectively). The dam body is homogeneous.11. The dam safety analysis consisted in estimating the failure probabilities in terms of the conventional safety factor for three values of the seismic coefficient a and two assumptions regarding the internal friction angle variability ( σ= 0.

or the quality of data sets as judged by expert assessment.Now does the dam resist sliding due to overtopping? To answer this question. This is important: mathematical probabilities should not be judged in their absolute terms. Loads implied in safety analysis 55 . For this case of overtopping. the probability of failure. shear parameters) as such. undercutting of heel and uplift on reduced foundation surface) will provide a means for judging where the dominant failure modes are to be found and where safety has to be improved first. Comparing Pf with the failure probabilities of the other scenarios (scouring.12.12. They consider modelinherent uncertainty such as the chosen type of distributions (pdf) modelling an unknown reality. only in relation to probabilities of other scenarios. The variability of each input data is expressed by its mean value and by standard deviation or coefficient of variation (mean divided by the standard deviation). The variable measuring the external load intensities is given by the resultant of forces (ΣT) being in parallel with the sliding surface. However. the pdf of the sliding resistance R is obtained by introducing random variables for the shear parameters tan φ and c'. Probability of failure for an overflow gravity dam The failure mechanism consists in sliding along the dam-rock contact surface. External loadings are presented in the figure 3. More tangible.8 x 10-5 Figure 3. the model which relates flood volume to load on the dam transfers a difficult prediction (that of floods) for assessing the probability of failure into a more tangible parameter (that of load on the dam). because it is an incremental load and it is a failure indicator which can be model tested. Applying the principles of classical reliability analysis. Pf = 5. Pf is obtained. there are also so-called 'second order errors'. They ponder the physical variability of the random variables (floods.

6) where f(SR) is the probability density function of sliding ratio. the impossibility of analytical defining of f(SR) that involves several independent random variables like water levels. The herein proposed methodology and its numerical algorithm involve six successive stages.13.The strength is given by the mobilized friction forces ( f ΣN ) depending on the friction coefficient (f) and the resultant of forces (ΣN) perpendicularly oriented to the sliding surface.6). or on the basis of some intermediate analysis as for uplifts (see figure 3. uplift forces and friction coefficients requires an indirect solving of the integral form (3. namely: . and friction coefficients. by using the sliding ratio SR = f ΣN/ΣT : 1 Pf = P ( SR <1) = ∫ f ( SR) dSR 0 (3. Even so. The stability condition ΣT< f Σ N would allow for evaluating the failure probabilities through a quite different way as compared to the integral form (3. The procedure to evaluate the probability density distribution for uplift forces 56 .1). The failure probability refers to the usual static loads and consequently seismic events and floods (extraordinary water levels) have not been taken into account. as for discharges.The defining of the probability density curves for each of the independent variables Xi on the basis of in situ measurements. Figure 3.13).

b) the sliding failure probability has been determined as Pf = 5.The replacement of the SR ratio histogram by a continuous probability density curve f(SR) and the evaluation of the failure probability Pf through numerical integration of the integral form (3.49. .The defining of the SRj histogram by assigning an ordinate p(SR)r to each subinterval ∆(SR)r. σ = 0.56 x 10-8 m/s.13) have been determined starting from the discharge probability density described by a normal distribution with Q = 6500 m3/s and σ = 0. Consequently. The probability density curve for the uplift forces has been determined on the basis of an intermediate analysis which mainly consists in evaluation of the seepage spectrum and the uplift distribution by means of numerical simulations performed based on a finite element model. The schematic presentation of the methodology for determining the uplift probability density curve is given in figure 3. The dam height is 60 m and the overflow section is characterized by 14 spillway bays with a maximum discharge capacity of 15.13.k is characterized by its mean value (Xi)k and the corresponding probability pk (Xi) of the subinterval values. The unsteady seepage analyses showed large delays in adjusting the uplifts to the upstream and downstream water levels.8 x 10-5.The discretization of the domains of independent random variable Xi into subintervals. one could fairly ascertain its quite high magnitude due to the heterogeneity of the foundation characteristics. . The upstream and downstream levels are dependent on the inflow Q.The evaluation of sliding ratios SR = f ΣN/ ΣT for all possible combinations of random variable mean values ( X i )k. thus obtaining a broad population of SRj ratios.The dividing of the whole domain of SR ratios into equal subintervals ∆(SR)r and sorting the SRj population into these subintervals. σ = 0.04. A normal distribution was selected for foundation hydraulic conductivity based on statistical processing of in situ measurements ( k = 8. It follows the same stages as for sliding ratios SR.. The probability density curves of the HUS and Hds levels (figure 3. each subinterval (Xi)k-1. the uplift forces were evaluated for all possible combination of upstream and downstream levels as independent variables.6). The proposed methodology could be easily solved out by computer codes. . the ordinate is computed by adding the total probabilities pj(Σrpj(SR)r ) which correspond to all SRj ratios classified in the subinterval.500m3/s. 57 . Through the numerical integration (figure 3.12. each being characterized by the total probability of occurrence Pj = Πj pk ( X i ) . For the probability density function of friction coefficients it has been assigned a normal distribution its characteristic parameters ( f = 0. By comparing the probability of failure value with the ones corresponding to other dam types and failure mechanisms.051) being determined based on the field data. in Romania.0613). The proposed safety analysis procedure has been applied to the Iron Gates dam on the Danube.

for low-probability load or strength values. 58 . in a region where they are very ill-defined and where the standard probability analyses loose their engineering meaning. particularly when the PMF concept is applied. 3. and that is flood-related risk. what should be the failure probability of a new dam under design nowadays? If we want to improve the safety of new dams we should set less than 10-5. in spite of much effort and the general recognition of the theoretical value of safety evaluation by reliability analysis. Monte Carlo method The Monte Carlo simulation method has come to dominate event-tree-based risk analysis for dam safety studies.3. It must be remembered that failure is usually the outcome of a combination of high loads and low strengths. but it can require a large set of values of the performance function to obtain adequate accuracy. an extraordinary situation which we have the greatest difficulty in grasping. the dam profession is still reluctant to use it in practice. Furthermore. especially at the tails of the curves. Accepting the fact that the statistical probability of failure of an existing dam is at present of the order of 10-5 per year. These are the reasons why. Comments on probability of failure The aim of the probabilistic approach is to make a quantitative estimate of safety in terms of its true meaning. but the most appropriate distributions are usually very difficult to determine. The statistics of the resulting set of values of the function can be computed and Pf calculated directly. In good engineering practice a flood with a yearly probability of the order of 10-3 is generally considered acceptable for a concrete dam. say 10-6. What failure probability is acceptable in any particular case? There is still no satisfactory answer to this question.e. whereas 10 -4 or less is required for an embankment dam. which is the probability of collapse. the method does not give insight into the relative contributions of the uncertain parameters that is obtained from other methods.6. In this approach the analyst creates a large number of sets of randomly generated values for the uncertain parameters and numerically computes the performance function for each set. Uncertainty in the data is handled by applying distribution laws to random variable parameters. Spillway capacity is set to discharge the flood whose probability of occurrence is judged to be reasonable in the light of the potential damage that might occur if the flood peak were exceeded. A major difficulty is estimating uncertainty in numerical terms.5. both for loading and for resistance. one serious difficulty does arise before any computation commences. There is one area in which dam engineers have been reasoning in probabilities for very many years. According to Pierre Londe. But such a small quantity could only result from extreme values of the data distribution curves. The method has the advantage of conceptual simplicity. Statistically collated hydrological records enable river flood peak flows and volumes to be estimated on the basis of their recurrence intervals. i.

St. Coimbra. The practice of dam safety risk assessment and management: its roots. Honningsvåg. Risk and uncertainty in dam safety. ICOLD Bulletin 130. Why Dams Fail? www. D. Baecher.. Kreuzer. Paris.BIBLIOGRAPHY Bowles. (1993). ICOLD. Symp. Proc. Proc. B. Safety evaluation using reliability analysis. Ionescu. Risk Assessment in Dam Safety Management. on Safety of Dams. R. Water Operation and Maintenance Bulletin. Denver. Geilo Conf. of Int. 45. Hartford. Workshop on Dam Safety Evaluation. Risk analysis for existing dams: merits and limits of credibility. K. Stematiu. (2006).. Grindelwald. Oct. A reconnaissance of benefits. (2003). Stematiu. Ilie. (1984). (2000). L. Priscu. G. Grindelwald. H. Stematiu. T. /hazard/damfailure. Proc. and its fruit. Hangzhou. Hydropower and Dams. H. D. P. 59 .fema. (2007). Eighteenth USCOLD Annual Meeting and Lecture... Bury. D. of Int. 1998. Bureau of Reclamation. August. its branches. No. Buffalo. (2002). Lafitte. November. 1992. Federal Emergency Management Agency (2006). methods and current applications. London. Water Power and Dam Construction. Technical Service Center. (1998). Denver. 202. April. April. vol. (1993). D. 1984. (1985). 29 August 2007. Some design criteria for large dams on the basis of probabilistic concept of Safety. Water Power and Dam Construction. Londe. Glover. L. Conf. Dam Safety Risk Analysis Methodology. 1993. Issue one. A probabilistic approach for certain design loads with significant contribution in dam safety evaluation. Probabilistic risk analysis of large dams. Bureau of Reclamation. The Assessment of the Failure Probability for a Gravity Dam.. New York. D. on "Monitoring Technology of Dam Safety".. Spillway Gate Failure or Misoperation: Representative Case Histories. Proceedings of the International Workshop on Dam Safety Evaluation.. . Thomas Telford. Safety assessment of Poiana Uzului dam based on monitoring data and backanalysis. (2004). (1993). of Int. April. Anderson. 3. (1992). Risk Assessment in Dam Safety Management. Colorado. R.

CO. (1999). Water Power and Dam Construction.S. July. (1997). Dam safety risk assessment: new directions. S. U. 60 .Vick. S. 49. Vick. Considerations for estimating structural response probabilities in dam safety risk analysis. Bureau of Reclamation Technical Service Center Denver.

The resulting damage encloses far away sections of the downstream settlements and can be very high for humans. and industrial facilities) damaged by the flood. environmental effects and material losses. Still others have to do with environmental degradations. the dam-breach erosion process may be much faster for an earthfill than a rockfill embankment). Others have to do with economic costs incurred by the loss of the dam itself and its productive value. When evaluating expected costs and consequences. Introduction The failure of a dam results in a flood wave.1. and measures that might compose the target of attention in a risk analysis for dam safety. and the role of warning time achieved through surveillance and monitoring is essential in the analyses. Identifying consequences The first step in consequence assessment is identifying the consequences and subconsequences. In most of the cases the consequence assessment focuses on a few that call attention by their significant importance: loss of life within the public safety category. Figure 4. which suddenly floods the downstream settlement and causes large devastation. land. Baecher. loss of capital property within the economic category.2. injuries and illnesses as a result of the flooding. The following subchapters are almost entirely based on the considerations in chapter 10 of the book Risk and uncertainty in dam safety written by Desmond N. property losses downstream caused by the destructive forces of the flood and by the loss of productive value of the resources (infrastructure. such as deaths. The sudden failure results in a wave with large energy and high flow rate. the loss of habitat and wildlife. The area of possible consequences that could be considered in a risk analysis is large. economics and the environment. There will be special considerations for a cascade development along a river. and species and habitat loss within the environmental category. 4. one considers potential downstream damage in terms of loss of life. CONSEQUENCE ASSESSMENT 4. and appropriate preparedness and action plans may substantially decrease the computed risk. The hydraulic characteristics of this flood wave highly differ from a conventional flood wave in a river due to high precipitation. Some of these have to do with public safety. subconsequences. injuries.1 suggests such a hierarchy of consequences. 61 . D.4. for example. The time delay in the dam-breach process may be crucial for the extent of the consequences (for example. Hartford and Gregory B.

monetary economic loss and environmental damage. In these cases. (2) characterisation of land use. A consequence evaluation process has four parts: (1) physical process modelling of the dam breach and flood routing. Dam breach modelling When downstream populations are far from the dam affect both planning and the magnitude of the consequences. Assigning numerical values for lives lost. . the specific details of a dam failure have little influence on public safety. Typically. travel times and attenuation dominate the calculation of consequences. On the other hand. The important outputs of dam 62 . 4.Characterising the breach of the dam.Downstream flood routing of the flood wave. flood routing. closer to the dam site the specific details . economic activities and population within the affected area. . Direct consequences and sub-consequences (their measure units are shown in boxes with dashed lines) (after Hartford & Baecher) Consequence modelling is a broader activity than the engineering performance modelling.Assessing the impact of the flood wave downstream.breach shape. evacuation planning and other consequences of the failure. (3) forecast of physical responses and of individual and social response to the inundation. consequence modelling involves four phases: . and (4) valuation either in monetary units or other measures.1.Figure 4. width and time for the breach to develop .

breach width (b). Field observations indicate that breaches do not typically erode the entire embankment. In order to take their uncertainty into consideration one could use not one definite value for each parameter but a certain number of different values. A realistic scenario could be found in the wide range between a sudden and total dam break of an arch dam and several our long lasting erosion process considering earth dams.5 to eight times the height of the dam. An occurrence probability can assign to each of this values. Using theses parameters in a large number of combinations the calculation of the outflow will let to numerous hydrographs. The final breach depth and width and the breach formation time are the most important parameters to calculate the outflow hydrograph. Dam breach outflow hydrographs for various breach formation time 63 . Therefore.2. A hypothetical outflow hydrograph for a breach developed over various hours is shown in Figure 4. the outflow volume and the time to peak are now also values with a certain occurrence probability. we have to ask how the potential breach formation would be occurring. If we consider a real dam. Typical values for a breach bottom elevation is approximately equal to 1/3 the height of the embankment. The knowledge of historical dam break cases could help to find realistic scenarios. The failure mode depends firstly on the kind of dam. erosive velocities may cause the breach to erode to the toe of the embankment. The side slope typically varies from 0:1 to 2:1. There is a time period in which the breach will gradually develop into its ultimate dimensions. A fully formed breach in earthen dams tends to have an average width in the range of 0. flow rates through the breach could be expected to vary according to the area of the opening. however.breach modelling for consequence prediction are the arrival time of the flood wave (which affects warning time). the breach elevation may not be at the toe of the embankment. Earthen embankment breaches are typically modelled as trapezoidal broad-crested weirs in which the significant parameters are side slope horizontal: vertical (L:H).2. Time in hours Figure 4. driving head. At the end the peak discharge. and storage volume. Therefore. and breach elevation. depth of the flood and velocity of the flow.

Dams can fail slowly or suddenly depending on the physical mechanisms of failure and the remedial actions taken by dam operators to inhibit failure. velocity and depth as a function of time and distance downstream after the formation of a breach. The important factor for downstream consequences is the form of this outflow hydrograph: how quickly the breach develops. Floods hydrographs in various downstream reaches (after Hartford & Baecher) Three different approaches are used to route flood waves downstream: Numerical codes for the complete 1D and 2D St Venant equations of unsteady flow. The objective of these models is an accurate prediction of flow discharge.3). dam break models normally require a priori estimates of the time for a breach to form. The dam breach dimension and time for the breach development are strongly dependent on the structural type and size of a dam. and then more slowly drains the reservoir over several hours. Flood routing is important because these unsteady flows from dam breach experience significant peak attenuation as the flood wave moves downstream. and of the shape and width of the breach. and how quickly the pool drains. These factors typically are not outputs of dam break models but rather inputs. Outflow m3/s At dam site Near downstream Further downstream Far downstream Time Figure 4. and on corresponding warning times and the force of flooding. and Muskingum-Cunge routing with Manning's equation for flow depth. peak (breach) discharge attenuation curves coupled with Manning's equation to calculate flow depth. foundation geology and treatment during construction. 4. how large the peak discharge becomes. In practice. would be predicted given these time dependent variables. Typically. Downstream consequences depend in large measure on the rapidity with which the failure occurs.3. Dam breach modelling attempts to predict all these conditions. Flood routing Flood routing models the downstream propagation of the flood wave as it moves downstream of the dam (Figure 4. the outflow hydrograph peaks quickly within one or a few hours.Flow rates through the breach.4. how quickly the discharge builds up. 64 .

4). In addition. The biggest challenge is the spatial variability in channel and floodplain geometry and their physical properties.4. the second and third approaches using Manning's equations to approximate flow depth introduce additional error.Numerical solution to the St Venant equations provides the most accurate predictions and. It is conceptually straightforward to add parametric and model uncertainty to existing modelling approaches by probabilistic modelling of dam breach and downstream flood routing. In addition to uncertainties in the dam breach modelling. A flood map for consequences assessment 65 . sediment transport and a variety of considerations usually not included in the hydraulic routing model. uncertainties also apply to flood routing. Figure 4. thus. channel erosion. The flood contours and corresponding heights and velocities have to be plotted on topographical maps (figure 4. significant uncertainties in flood routing are generated by debris load.

and the exact conditions in the flood plain are unknown. often incorporated in geographic information systems (GIS). and (3) the severity of flooding. Evaluation of consequences 4. As a result. The number of people at risk downstream from some dams is influenced by seasonality or day of week factors. as are the human reactions. These are typically represented in downstream demographic and land-use databases. For instance.1. (2) the amount of warning provided to the people exposed. These data can be of many types. (3) population.5. In such situations.) selected for evaluation should accommodate the varying usage and occupancy of the floodplain. 4. since it is not possible to accept consequence. The 66 . there is a desire to ensure that risks associated with loss of life are eliminated. (2) land-use categories. The most important factors are: (1) the number of people occupying the dam failure flood plain. but should include: (1) topography. the extent of effective or usable warning is unknown. politically. It can lead to a week point in the dam safety assessment process. Loss of life The prime driving force in any dam safety assessment is the hazard the dam presents in terms of the potential for loss of life. the dam safety assessment attempts to define design standards to drive probability to ‘zero’. uncertainty enters any forecast of fatalities due to dam failure because the time of day and season of the year is a priori unknown. including air and water temperatures Activity in which people are engaged General health of people threatened by floodwater Type of structure in which people are located Ease of evacuation Characterising the number of potential fatalities due to a dam failure is complicated by the large number of factors that influence the death rate within a population potentially exposed to inundation. The factors influencing fatality numbers are listed below: • • • • • • • • • • Cause and type of dam failure Number of people at risk Timeliness of dam failure warning Flood depths and velocities resulting from dam failure Time of day. Since time of day can influence both when a warning is initiated as well as the number of people at risk. Estimation of the potential for loss of life is unfortunately subjective. etc. (5) economically important facilities. some tourist areas may be unused for much of the year. and time of year of failure Weather. (4) critical facilities and infrastructure. and (6) environmental or culturally important sites. particularly in jurisdictions where.Consequence forecasting depends on downstream characteristics. The number of time categories (season. land uses and exposures. Determining when dam failure warnings would be initiated is probably the most important part of estimating the loss of life that would result from dam failure. day of week. day of week.5. each study should include a day category and a night category for each dam failure scenario evaluated.

After an event that initiates dam failure. Various types of uncertainty can influence loss of life estimates. The time between the initiation of a dam failure and the emerge of a notice to evacuate a population.g. The physical factors may be functions of the event time (hour. when outside expertise and decision makers may be consulted. The empirical relation proposed by DeKay and McClelland is often used in an attempt to relate the potential loss of life associated with dam failure with warning time. Separate loss of life estimates has to be developed for each dam failure scenario. and season) and the conditions after the event (e.790 (for deep fast-flowing water) = 0. Dam failure warnings were also less likely where the reservoir was able to quickly fill and overtop the dam. LOL = potential loss of life P = total downstream population ef = exposure factor (percentage of people likely to be in residence at the time of the event) x = 2. Once the proper authorities have been notified. a notification period. extent of damage to infrastructure. The human factors include reluctance to issue an evacuation warning and degree of emergency preparedness. weekday. this is not the case for the failure of concrete dams. Quantifying uncertainty is difficult. added to the time it takes for the flood wave to travel to the population. or communications). the ‘population at risk’ and the type of flood expected. The components of warning time are dependent on physical as well as human factors. and an implementation period. time can pass before operations personnel detect a potential problem at the dam. LOL where. It also appears that timely warning is less likely for the failure of a concrete dam.759 WT (for broad shallow flood water) WT = warning time in hours. the warning may take time to reach those who must evacuate. is the warning time. in the presence of a dam tender or others.982 WT – 3. evacuation routes. a decision period. the notification period follows during which the proper emergency response authorities are contacted and convinced that an evacuation is appropriate. An evaluation of past dam failure data indicated that timely dam failure warnings were more likely when the dam failure occurred during daylight. Various causes of dam failure will result in differences in downstream flooding and therefore result in differences in the number of people at 67 . and a decision is made that the situation will lead to a dam failure.time before a warning is issued can be broken down into a detection period. Although dam failure warnings are frequently initiated before dam failure for earthfill dams. Once this decision is made. The decision period comes after the situation is observed. This is the detection period. Timely dam failure warnings were less likely when failure occurred at night or outside the presence of a dam tender or casual observer.

highways. the warning initiation time could be varied to determine sensitivity to this assumption. Buildings and most other infrastructures in the floodplain (e. that is the hazard the dam presents to the public can be defined by the total number of people that would need to be evacuated in the event of an hypothetical dam failure as opposed to the numbers of people that may potentially loose their life or be put at risk. principally including the loss of use of resources.risk as well as the severity of the flooding. and loss of use of residential property and substitution of other housing for that loss. In some ways. This does not obviate the need for quantitative estimates of the extent of these impacts. the economic consequences of failure are presumably more complex to estimate than the economic costs and benefits projected during project planning. appurtenant structures and downstream improvements. A long history of benefit-cost analysis in public investment theory provides economic and analytical guidance on how to quantify and compare economic costs. public safety consequences short of death are sometimes treated as economic variables in that their impact can enter consequence accounts through litigation and financial settlements. 4. Public safety consequences are not limited to lives lost but also include injury and disability. utility networks) are stationary. The advantage to this approach is the defined risk parameter represents a positive approach. It is recognized that the time of failure impacts both when a dam failure warning would be initiated as well as the number of people who would be at risk. Nonetheless. loss of the capital investment in the dam. As part of this approach the concept of Persons to Evacuate as a measure of downstream risk tolerance is being proposed.5. land improvements. In most of the cases the risk to public health is defined in terms of Persons at Risk (PAR) so as to allow a less emotional means of defining appropriate dam safety standards. 68 . equipment. Finally.which economically may be even more important than direct impacts include. destruction of downstream property: buildings.2. From a policy point of view. In the evaluation process the dam failure has to be assumed to occur at various times of the day or week.g. bridges. for example: loss of productive use of land for agriculture. Direct consequences are the immediate impacts of the failure or being in contact with floodwaters. and good data are often available with which to forecast damage and impairment. Direct economic consequences include. The number of people at risk (ef*P ) will likely vary depending upon the time of year. The principal categories of economic consequence of dam failure are direct consequences and indirect consequences. Indirect consequences are the subsequent impacts that cascade from the direct impacts of inundation. but merely shifts them to another account. for example. or pain-and-suffering. Indirect economic consequences . Economic consequences Estimates of economic consequences are easier than corresponding estimates of public safety impacts. industry. and loss of seasonal crops. loss of power production. modelling and forecasting economic consequences of failure differ little from modelling and forecasting of costs and benefits for routine projects. and recreation. day of week and time of day during which the failure occurs.

economics and environmental impacts are the consequences of principal concern in dam failures. the calculus for evaluating environmental consequences of dam failures is inadequately developed. political or regulatory repercussions of a failure. This should be done in case of protected habitat or wildlife under government regulation. both of predicting quantitative environmental consequences of dam failure and of valuing those consequences are great. national heritage sites. This being the case.4. could come to play a major role in dam safety risk assessments in coming years. One approach is that environmental and ecological costs and benefits not be quantitatively incorporated in a consequence assessment unless a unique downstream situation demands inclusion. Ecological risk assessment may be particularly useful in watersheds as a scientific method. 4. Environmental consequences Until recently. Including environmental consequences within risk analyses for dam safety raises a number of challenges: how comprehensively to account for environmental consequences since many of which are subtle. and therefore a logical unit for environmental and ecosystem analysis. It is often difficult to reconcile the desire to make scientifically supportable predictions with the complexity of how local watershed hydrology. Important among these are the effect of dam failure on the reputation of the owner and operator of the dam. are challenging and we have little experience by which to validate predictions.5. probably greater than corresponding uncertainties in public safety or economic consequences. how to economically value those impacts in the absence of markets? The uncertainties. hydraulics and ecology work.4. now being developed for other applications. 69 .3. economic and social factors based on subjective value judgements are common in environmental analysis. Yet. or hazardous installations whose flooding would lead to the spread of contaminants. Increasingly. Such risk assessment techniques. such as dam failure floods. other and secondary consequences may inform decisions.5. environmental costs and benefits of water resource projects have not been included quantitatively in project investment decisions for most dam projects. predictions of watershed response to catastrophic assaults. Watersheds are hydrologically bounded ecosystems. public opinion and government policy seem to indicate that environmental consequences should be accounted for. political. Assessment is one of the most critically important parts of watershed management because it attempts to transform scientific data into policy-relevant information that can support decision-making and action. Socio-economic and other consequences of dam failure While public safety. how methodologically to estimate environmental impacts when understanding of ecosystem response is nascent. and the distribution of costs across affected parties or victims. Trade offs among environmental.

and bridges). R. (2004). Grindelwald. and beyond the simple cost of reconstruction.. M. Vol. Risk estimation for the hypothetical breach of dams. utility networks (power transmission and distribution. BIBLIOGRAPHY Bureau of Reclamation. that would be included in a risk analysis. Lafitte. von Hehn. Predicting Loss of Life in Cases of Dam Failure and Flash Flood. Salmon. Probabilistic risk analysis of large dams. April. Damage to these infrastructure components can have regional or national economic impacts. higher priced. Proceedings of the International Workshop on Dam Safety Evaluation. railroads. (2003). 45. D. Colorado DeKay. K. the disruption of electrical power to an identifiable factory or other installation might have to be made up for from alternative. Hydropower and Dams. London. causing a redistribution of services through other regions that would not normally be included in a dam safety risk analysis. could seriously affect public safety or economic wellbeing outside the zone of flooding. ICOLD Bulletin 130. for example. sources. H. No. Baecher. Risk Analysis. 2 Hartford.Critical infrastructure may exist downstream of a dam which. (2007). TU Dresden. navigation works. Pohl. DSO-98-004 Dam Safety Research Report Bureau of Reclamation. Water Power and Dam Construction. 13. (1993). (1998). pipelines). 70 . Risk Assessment in Dam Safety Management. A. and other lifelines upon which society depends. G. Thomas Telford... Issue 5. (1993). New dam safety legislation and the use of risk analysis. (2006). Denver. Prediction of Embankment Dam Breach Parameters. Technical Service Center. Bornschein. Hoeg. Paris. if destroyed or damaged sufficiently to impair service.. Dam Safety Risk Analysis Methodology. L. ICOLD. Risk and uncertainty in dam safety. McClelland. Institut für Wasserbau und Technische Hydromechanik. telecommunications networks and structure (relay towers). Dresda. Dam Safety Office. G. Such infrastructure includes transportation facilities and structures (highways. they may also have identifiable direct impacts. Consequence Based Dam Safety Criteria for Floods and Earthquakes. R. (1998). water supply and waste-water removal systems. G. G. However. (1993). typically of an economic nature. For example.

• “Reduce (prevent) the probability of occurrence” – typically through structural measures and dam safety management activities such as monitoring and periodic inspections. Decisions concerning the increased safety or/and reduce the consequences are based on detailed risk and safety assessment. and risk treatment (reduction). After repeated study using different alternatives the decision makers are provided with suitable alternatives for improving overall dam safety and their estimated costs. or both. If the calculated risk of the existing system is judged to be too high. risk treatment options can be grouped into the following categories: • “Avoid the risk” .5. alternatives are promoted to reduce the risk of failure. risk evaluation. 71 .” While the first three options reduce the risk to which third parties are exposed.after risks have been reduced or transferred. residual risks are retained by the owner and may require risk financing. • “Reduce (mitigate) the consequences” – for example by effective early warning systems or relocating exposed populations at risk. A comprehensive dam risk management process is illustrated in figure 5. Risk mitigation is a logical step following risk estimation. • “Transfer the risk” –by insurances arrangements. Risk mitigation aims to reduce either likelihood of an occurrence or its consequences. Risk assessment combines the first two branches and risk management combines all three. Introduction The major branches of dam safety risk management include risk analysis. • “Retain (accept) the residual risk” . RISK MANAGEMENT 5. From the management perspective. Consistent with traditional dam safety decision-making. the dam risk management process requires four supporting processes: analysis of existing information about the dam and eventually implementation of additional investigation programs.this is choice which can be made before a dam is built or perhaps through decommissioning an existing dam. These alternatives are incorporated into the risk model and re-evaluation is conducted to estimate their impacts. the fourth and fifth options only affect the risk that the owner is responsible for and not the risk to which third parties are exposed.1.1. Risk management includes risk assessment processes (analysis and evaluation of the risk in dam system) and risk control or risk reduction.

SAFETY ANALYSIS YES Figure 5. . The results of the risk analysis and risk evaluation processes are integrated and recommendations are made with respect to the risk control process.1. the type of improvement which is the most appropriate is 72 .establishment of criteria required to assess the normal and safe operation of the dam system. Risk assessment is central to the dam risk management process. Dam risk management process (after Hartford & Baecher) . . using different alternatives.risk control measures.2) will use risk assessment processes in order to evaluate the need for a dam safety improvement if the dam safety criteria are not entirely met. On the basis of repeated risk assessment processes.assessment of safety and risk of the dam in order to promote the most appropriate behaviour diagnosis and the course of action. An effective risk management program (figure 5.

depending on the case. 5. The reducing of consequences in the case of a dam failure is prevailingly referring to the removing or diminishing at maximum of human loss of life. according to a thoroughly established action schedule have beneficial effects in this respect. comprises an aggregate of structural and non-structural measures. maintenance and surveillance procedures. For the dams being in operation the basis of the safety management lies in monitoring of their behaviour and in periodical safety assessments. The increase of safety is the objective of the safety management and.2. Use of risk processes in a dam safety management If the level of risk is above the acceptable one.selected. Warning and evacuation of potentially affected population. controversial and sensitive issue that matters to society is the relation between classical engineering safety as guided by experience and codes on 73 . they should identify the safety deficiencies and start efficient measures to prevent the evolution towards failure. actions are required to increase the dam safety and to reduce the potential consequences in case of its failure. Risk assessment also helps the improvement of the operation. as it was stated. Conduct continual surveillance Periodic dam safety reviews and Management system audit Every 5 to 10 years Does the dam meet all safety requirements Dam safety assessment Traditional good practice Risk assessment No Yes Yes Operate normally and Maintain emergency preparedness Is the dam safe enough? No Improve dam safety or Reduce consequences Figure 5. The latter ones must confirm that the dams are safe or. Tolerability and acceptance of risk The most complex.2.

And secondly the point of view of the society. owners. who decides to undertake an activity weighing the risks against the direct and indirect personal benefits. because it would require the spending of an unlimited amount of society’s resources. risk takers and the public is ineffective then the course of action proposed as a result of a risk assessment may not be accepted.3. An acceptable hazardous activity should be limited to a reasonable increase to the individual's present risk. In most treatises of acceptable risk two positions are discerned. Figure 5. The differing perceptions of risk between technical expert and public audiences can be striking. The popular request for absolute safety is unattainable. The personally acceptable individual level of risk is defined as the acceptable probability of dying due to an accident caused by a third party. The point of view of the individual. considering if an activity is acceptable in terms of the risk-benefit trade off for the total population. Differences between public and engineering perception of risk Calculation of the probability of failure and the consequences of failure lead inevitably to the question: "what is acceptable or what is tolerable?" The framework for risk evaluation may consider several aspects: ƒ ƒ ƒ ƒ personal or individual acceptable or tolerable level of risk socially tolerable level of risk risk based on economic optimisation risk based on insurance type requirements.3 shows the barriers preventing mutual understanding. that have been evolving in some societies in recent years. If the risk communication between dam professionals. The question of acceptable risk is sometimes explicitly but mostly implicitly at the basis of every engineering design decision. Figure 5. regulators.the one hand and the philosophies about acceptable risk levels. 74 .

This policy factor represents the range in acceptance between different types of risk. The socially tolerable level of risk is defined for the total number of fatalities due to a hazard. The choice is the level of risk versus the cost to reduce it to a lower level. the Netherlands. Based on statistics of fatalities from human activities. from 0. Presently F/N charts are used in Australia.01times the individual background risk). but the benefits of the dam/reservoir for the potential victims may in certain situations allow a policy factor larger than 0. with F generally the cumulative failure probabilities of scenarios with loss of life and N the number of lives lost in these scenarios.01 is applied in the case of an imposed risk and 10 or more may be applied in the case of a voluntary risk like motor driving and mountaineering. It addresses the society's need to quantify involuntary risk and it is a means to assign value to life without resorting to monetary units. the situation triggers the question "is risk reduction economically grossly disproportionate or technically impractical?". The choice of an acceptable risk level may range.1. tolerable societal risk. the objective is to reduce the risk 75 .4 (the F/N representation of risk) ranges from 0. with some manoeuvring space often called "as low as reasonably possible" (ALARP). in Canada. If yes. In such a case the condition moves to insurance cover. the concept of socially acceptable risk (SAR) was developed. This is a matter of public debate. They suggest threshold lines separating acceptable from unacceptable societal risk. although not yet formally in force. and. Taking into account the number of independent similar activities a safety requirement or tolerable risk per activity can be derived. But in order to be able to appraise projects. However. The economic optimisation strategy is a widely accepted procedure and will not be discussed further.001 of the background risk to 10 or more time the background risk.001 . The individual criterion doesn't account for the societal impact of a large number of casualties due to the failure of a dam. If a dam falls within the ALARP stretch. SAR is generally depicted in so-called F/N diagrams (see figure 5.01 for tolerable risk. The factor beta in figure 5. Again a policy factor is applied to set the risk that society will tolerate. acceptable level of safety of a dam.The tolerable individual risk depends on the character of the new event. US. The individual risk.4). South Africa. yes or no. Society pays that cost one way or the other! So: the downstream community (and their legal representatives) need to be formally consulted in regard to individual dam safety evaluations. economical optimisation and financial capacity of the dam owner all have to be combined in assessing the. care should be taken to avoid a situation where a dam owner is unable to pay for the damage due to the failure of one of his dams. This is more likely to control the tolerable level of financial risk than economic optimisation. In general a dam/reservoir system would have to meet a tolerable individual risk of 10-6 (0. a position below the upper threshold line is acceptable if not. In the Netherlands a value of 10-4 per year has been taken as the background level of individual risk (politically agreed upon in parliament). A value of 0. Reactions of society to large scale accidents are generally more intense than to small scale accidents.0. society must establish their standards.

Examples of F/N charts used in some countries Holland's SAR-charts introduces the factor beta (β). social and environmental losses. The South Africans assess SAR for five categories: monetary losses. in figure 5. 76 . as part of a risk-based decision at a specific dam. It can be chosen for a particular risk case (dam breach. In USA the Bureau of Reclamation and Washington and Montana states are users of the risk analysis techniques and have established F/N charts. operational deficiency etc. which stands for the degree of voluntarism. consultation with the affected public is required as part of the final decision process". Their charts are comparatively presented.The ANCOLD chart contains the important note: "Where fatalities are expected.).4.5. Figure 5. population at risk and annual risk of fatalities per exposed hour.

5. Comparison of Societal risk criteria in USA (after 130 ICOLD bulletin) Although F/N charts turn out to be a valuable tool for judging the effect of several options to mitigate loss of life.Figure 5. they have shortcomings in respecting the views of the affected public. Some dam engineers point to the subjectivity of SAR and suggests a potential risk for loss of life less than 10-6 per year and per person. Risk for selected engineering projects (after G.6. Figure 5. Solomon) 77 .

Tolerable risk criteria have not yet been established for environmental damage except as it can be expressed in monetary values. the loss of $10 billion was considered so serious that the probability should be negligible or 10-6/year. Risk reduction As it was stated. Risk reduction branches (after R. which is the same as the probability of the death of an individual identified as being most at risk from the failure of the dam. Both these conditions yield an expected value of damage of $10. B.7. Figure 5. instead it is related to an insurance concept.It should be noted that the criterion of limiting the expected value of damages to $10. Likewise.3.C.6) is not an economic criteria. the reducing of risk associated to a certain dam is made both by increasing of its safety and by reducing the potential consequences in case of its failure (figure 5. 5.000 per year (see figure 5. this is another challenge for the future.7).000 per year. or if the society wants more safety at higher costs or less expenditure with correspondingly higher risks. Biedermann) 78 . The standards of safety should be changed as societal values and expectations (culture) change. Hydro considered that the annual probability of $100 million in damage should be no greater than 10-4 for any dam.

Both actions contribute to risk reduction acting on the first factor of the risk.8. a defect in structural safety or an external threat to safety such that the measures that are necessary to master the danger which occurred can be taken (figure 5. Elements of surveillance and their objectives 79 . Dam surveillance The goal of surveillance is to recognise as soon as possible a damage.that may be achieved through appropriate design . Figure 5. Risk reduction also includes the emergency preparedness that aims to mitigate the consequences if the dam failure happens. The latter ones must confirm that the dams are safe or. depending on the case.1.8).3. For the dams being in operation the basis of the safety management lies in monitoring of their behaviour and in periodical safety assessments. namely the probability of failure. they should identify the safety deficiencies and start efficient measures to prevent the evolution towards failure.Dam safety includes structural safety .and monitoring of the dam behaviour under operation. 5.

Figure 5. Increased importance has to be given to visual checks. For example.9 illustrates the behaviour incidents that may be detected by visual inspection of an earth dam. measurements on the instrumentation and operating tests of gates and valves as well as of emergency power unit. and the periodical safety evaluations in following the long-term behaviour as well as in verifying the structural safety. Incidents that can be relived by visual inspection of an earth dam Functional checks in which the moving parts of the gates are tested are needed from time to time to verify their readiness. The regular checks serve in particular in following the current behaviour. the appearance of a wet spot or of a spring downstream of the dam can be an indication that seepage in the foundation has changed.Regular checks of the condition and of the behaviour of the dam as well as periodical safety evaluations are needed. Figure 5. because experience shows that around 70% of all emergency situations can first be identified visually. Visual checks are needed because changes in condition and certain behaviours cannot be assessed by measurements or only with much delay.9. A complete assessment of the condition and of the behaviour may be achieve by visual checks. The wet operating tests at fairly full reservoir to 80 .

10).e. Those are time spans which lie between a week and a month. Organization of monitoring (after R. The interval between two controls is adequate when it is less than the period during which significant changes in normal behaviour can occur. The increased emphasis on the early detection of a threat does not require a very frequent surveillance or the collection of many data. Of the outmost importance is rather that the measured data which give representative information of the behaviour of the dam and of its foundation (so-called main indicators) be read at reasonable time intervals and be looked at in depth.10. i. depending upon the measured data. Measured data are analysed with sufficient depth when this is done not only by the dam wardens.within a week .verify that the spillway and bottom outlet gates can also be opened under the most adverse operating conditions is also mandatory for gated spillways. i.also at the 2nd surveillance level. at the 1s' surveillance level (figure 5. Biedermann) 81 . by the experienced civil engineer and this with the help of appropriate assessment tools like envelope curves or a numerical model to determine the expected deformation. Figure 5. but .e.

during the dam construction and first years of reservoir operation the designer should be involved in interpreting the readings. which corresponds better to the complex nature of phenomena. explain and remedy deviations from normal behaviour. fast and easily applied by the personnel with an average education. Ideally. Early diagnosis allows cost-effective prevention before damage is done.11. Since the values of the monitored parameters are generally dependent on several external factors (reservoir level.).Dam monitoring has to be organized on three levels (figure 5. but rather to observe the trend with time so as to be able to detect.11): • level I is performed at dam site and consists in visual inspections. the normal domain for a response parameter can be characterized only by values that depend on their turn on the external factors. • level II is a periodical synthesis of observations and measurements as well as of the annual technical inspections and their interpretation from standpoint of dam safety. temperatures etc. The dam behaviour analysis made at this level must be safe. Figure 5. The main purpose of the regular monitoring and visual inspection is not so much to check individual measurements against limiting values. • level III is represented by the analysis and approval of the annual safety assessment reports made by a dam monitoring commission at the national level. That is the reason why the notion of critical value should be replaced by a warning criterion. Organizational levels of the dam monitoring system The dam monitoring efficiency in a safety management program is first of all given by the activity performed at the first level. this synthesis is made by care of the owner and is performed by qualified dam engineers who draw up safety assessment reports. measurements and primary processing of the collected data as well as immediate analysis of the results. since he has an intimate knowledge of 82 . and the price for complacency may be high. the solution usually adopted is the direct comparison of the measurement data with some critical values. Consequently.

it shall thus be possible to remove and replace them.3. An efficient instrumentation system must be designed with the dam. Finally. it is necessary to check their level regularly. Instrumentation for external loads External loads (especially hydrostatic pressure) directly affect the dam behaviour. snow) are equally important data. The outside conditions affecting the dam are mostly atmospheric conditions on site (rainfall and ambient temperature for example). it is necessary to note that precipitations and the melting of snow sometimes have a direct 83 . Surveillance can still be improved and can go beyond the minimum that is required by automating data acquisition of the main indicators. rain gauge. risk of blocking outlet works). It is recommended to record if precipitations fall as rain or snow. The thermometers situated close to the surface are extremely influenced by the local external conditions (air and water). They are installed at several elevations and distributed across the thickness of the concrete section. Thermometers can be inserted in drill holes whilst isolating them thus avoiding the influence of external temperature or the one in a gallery. It is vital for safety that instruments should monitor physical quantities that are significant in the failure scenario mechanisms.2. In case of important sedimentation (changes in the loads.the engineering assumptions used. In the case of failure. The short presentation that follows is based on the paper presented by Swiss Committee on Dams on the occasion of the 22nd ICOLD Congress. The measuring range must extend beyond the normal operation level in order to follow extreme values of the water levels in case of flooding. as often as necessary according to the amount of sediments accumulating. and is therefore the best person to detect any abnormal performance and to estimate how serious it might be. The variations of temperature in the body of the dam can be followed by thermometers placed directly in the mass during the concreting. is an essential component in safety enhancement. water temperature is also a data to record. the changes in the reservoir water level must be read and recorded even if the reservoir stays empty most of the time as it is the case for detention ponds. at the same time and by the same team since it is an integral part of the design. Bathymetric readings could be performed in this case. The atmospheric conditions (temperature and air humidity. Hydrostatic pressure being an important load. by appropriate instruments. by transferring in a remote fashion the corresponding data to a place that is more or less permanently staffed and by maybe comparing daily the data with computed values. Dam monitoring instrumentation The monitoring of dams during their construction and operation. The ambient temperature has an important incidence on the deformations of a concrete dam. Moreover. Instrumental data can only be properly interpreted and their impact on safety assessed by reference to a mathematical model. 5. marked decrease of useful volume.

In certain cases. are simple geodesic methods used to measure deformations on small structures. as well as on uplift pressures. Measurements taken by inclinome- 84 . Angular and distance measurements (vector measurements) taken on external targets.12. the measurement axes are extended into the rock to also ascertain the foundation deformations. Monitoring of dam body deformations. just as alignment sightings. Local deformations.12. the seismic conditions at a site may be recorded. can be determined by the installation of extensometers. Instrumentation of concrete dams A synthesis of concrete dam instrumentation is presented in figure 5. ARCH DAM GRAVITY DAM LEGEND Figure 5. for example those of the upper part of the dam. If possible. Instrumentation of concrete dams Horizontal deformations (radial and tangential deformations) can be determined along vertical lines by direct and/or inverted pendulum measurements. it is at least necessary to foresee the measurement of crest deformations.influence on the infiltrations within the foundation. The devised network thus allows horizontal and vertical deformations of the structure to be obtained. The objective is to know the horizontal and vertical displacements at a given point. Some of the dedicated measurement devices are presented in the followings. For small dams. measurement points are located at different elevations and inside the dam or fixed on the downstream face following horizontal and vertical lines. According to the dam configuration (with or without galleries and/or shafts).

85 . Thanks to the geodetic network. of which the values usually vary as a function of the reservoir water level. Water infiltrations are directed to gallery channels and then towards discharge measurement stations. at different depths within the foundation. Inherently only relative deformations can be obtained and they must be completed by a local reference space (geodetic network) to which it is connected. Uplift pressure. are measured at the concrete-rock interface and in certain cases. can be carried out using an inverted pendulum. The discharge rate of seepage and drainage at the outlet can be measured by volume (with a recipient and stopwatch). left bank . Uplift pressures vary from upstream to downstream and it is desirable to distribute several measurement points along the base of the concrete structure and if possible at the intersection of several sections.right bank). The choice and orientation of the instruments will depend on the geology and on the direction of the forces notably transmitted in the case of arch dams. jointly with those of uplift pressures. Geodetic deformation measurements. The GPS offers an appropriate method that can be integrated to the control network consisting of points which are geologically stable and situated outside of the influence zone of the reservoir basin. measurement campaigns are dependent on the meteorological conditions. An extended network can be coupled to the local geodetic network whereby points could be measured by means of GPS (Global Positioning System). Extensometers allow rock foundation measurements to be carried out according to the different directions. Punctual horizontal measurements in two directions (for example upstream downstream. by a calibrated weir. give information relative to the state of the grout curtain and the efficiency of the drains. Abutment movements can be monitored by points installed in the immediate proximity of the dam and connected to the geodetic network.ters (with possibility for automation) allow the actual deformation to be calculated or compared with the pendulum measurement. To better ascertain foundation deformations. a venturi or by variation of water head in a tube. However. it is recommended to place extensometers in at least two directions or to create a tripod. Monitoring of foundation deformations. Knowledge of the absolute displacements is necessary to obtain indications on the long-term evolution of deformations and more particularly for the case of abnormal behaviour. These readings. A reduction of the discharge can indicate a clogging from the reservoir or also the clogging of the drainage system. This method presents the advantage of determining the absolute displacements. Seepage within the foundation creates uplift pressures the evolution of which must be followed attentively since the influence on the stability is not negligible. Seepage and uplift. it is possible to measure the displacement of benchmarks with respect to a network consisting of (assumed) fixed stations or reference points.

Instrumentation of embankment dams A synthesis of embankment dam instrumentation is presented in figure 5. In general. LEGEND: LEGEND: Figure 5. cells or tubes with manometers can also be employed. For measurements of pressure at greater depth in the foundation. For embankment dams. settlements at various elevations.13. and in particular settlements in the foundation. Instrumentation of embankment dams Monitoring of embankment deformations. horizontal displacements of points are determined by geodesic measurements such as angular and distance 86 .The measurement of uplift pressures at the concrete-rock interface can be made using a tube equipped with a manometer. but then also if possible. the objective is firstly to know the evolution of vertical deformations (settlements) and horizontal deformations at the crest. Some of the dedicated measurement devices are presented in the followings.13.

Water infiltrations must therefore be closely monitored since each deviation from the normal state represents an evolution of interstitial pressures that could place into question the safety of the water retaining structure. This can be achieved by placing pneumatic. The check will be improved with the increasing number of measurement profiles as well as the number of cells per profile. Seepage through and under an embankment dam are at the origin of interstitial pressures which take on a primordial importance for the stability of the structure. to localise the critical zone and to facilitate the investigation of causes. those coming from the grout curtain). it is important to check the evolution of interstitial pressures (in particular in the core and the foundation). at given points can be simply controlled by a tube in which we read the height of the piezometric head. Seepage rates and drainage. the measurements are reliable and durable. The evolution of infiltrations. If on 87 . the reading of the fluctuation in the level of the pyretic surface is sometimes suggested (for example downstream of the embankment dam). Level readings can be carried out using a calibrated probe which is lowered into an open drillhole or by the use of a pressure sensor with recording device.readings (vector measurements). Seepage water from embankment dams can be collected in drains situated downstream of the core or at the interface of an impermeable membrane and the body of the dam and directed to a discharge measurement station. in the case of anomalies. The total water discharge rate gives an indication of the global behaviour of the infiltrations. The interstitial pressures must not exceed the values allowed for the project. This procedure allows. Interstitial pressures and piezometric level. For embankment dams. In an embankment dam. alignment sightings and polygonal surveys. The seepage rate varies according to the reservoir elevation and it can also be influenced by atmospheric conditions and the melting of snow. in the transversal or longitudinal direction of the embankment dam. provided it exists. seepage develops because the materials of construction used are more or less permeable. we employ levelling as well as settlement meters or hydraulic settlement gauges. hydraulic or electrical pressure cells. it is also desirable to proceed with regular checks of the turbidity and periodic chemical analyses of water. Turbidity measurements allow an appreciation concerning the content of fine particles. as for the chemical analysis. Levelling is carried out in a gallery. The layout of measurement stations is delineated such as to measure partial discharges for predefined zones. Concerning vertical displacements (settlements or heaving). Finally. When these tubes are installed in permeable soil. This way of operating guarantees a certain level of redundancy which is justified by the high level of failure of cells. If the dam body consists of materials that are easily soluble or erodible or it is based on such materials. The same devices are amongst the available techniques that can be used to measure settlements in soft ground. this gives information relative to dissolved materials (for example. such as the equipotentials.

88 . Emergency strategy (after R. The emergency strategy defines three danger thresholds and specifies measures accordingly (figure 5. either the appropriate remedial works are to be performed or the water level is to be partially lowered (when a rock mass might slide or fall into the reservoir). In such a case.Danger threshold 1: It prevails when the dam specialist indicates that the event can be mastered without any doubt. 5. a time delay which is relatively long is necessary before noting a change in the piezometric level. this is due to the displacement time of the volume of water in question.the other hand.3. closed piezometric cells are more appropriate.2. Emergency concept Emergency strategy The emergency concept refers to all the preparatory measures that are needed to act as well as possible when a threat to dam failure is recognised.14.14): Figure 5. Biedermann) . To counter the occurring threat. these tubes are found in impermeable terrain.

. i. so also giving the opportunity to people close to the dam to bring themselves to safety. As a rule. after a total failure of the dam. The objective is thus to evacuate people before the catastrophe occurs. whenever population at risk is located near the dam. the water level must be preventively lowered and the preparedness of the alarm system ordered. according to a thoroughly established action schedule have beneficial effects in this respect. rupture of the dam can probably not be avoided any more. Alarm system When reaching the danger threshold 3 (respectively in case of failure). 89 .15). In this extreme situation the alarm and consequently the evacuation of the population (in all the potentially submerged areas) is to be ordered. Warning and evacuation of potentially affected population. the emergency strategy specifies that the evacuation of the people in the potentially submerged area must be ordered.. The efficiency of an alarming-evacuation plan depends on the extent to which there are clearly delimited the responsibilities of the dam owner and authorities but also on the training of population to whom the plan is addressed. an increased monitoring. The reducing of consequences in the case of a dam failure is prevailingly referring to the removing or diminishing at maximum of human loss of life. according to the dam specialist. In such a higher state of danger. and this in the whole submerged area (alarm system of type B according to figure 5. The message flows from the owner to the relevant authorities which must act accordingly. This requires an increased quantity of data as well as more frequent measurements. where the flood wave arrives in short time.e. The near zone encompasses that area which. the general alarm system (under control of central government) is used as alarming signal in the localities. a second type of siren must be installed as a complement in the near zone: water alarm sirens that are activated from the dam (alarm system of type C).Danger threshold 2: It prevails when the dam specialist cannot certify that the situation will be mastered. The aim when enforcing the former measure is to try to reduce the risk early enough and when enforcing the latter to make sure that the population can be evacuated on very short notice in case the drawdown of the reservoir does not proceed fast enough. To be able to act in the spirit of this strategy. On the other hand. is submerged within two hours at most. the dam specialist must know what the causes of the threat are and how it develops with time.Danger threshold 3: It prevails when. This is done in most of the cases with sirens within the localities and with mobile alarming teams outside of the localities. Changes in degree of alarm readiness and activation of the alarm are initiated usually from the dam owner as he is responsible for the safety of the dam and for the continuous assessment of the situation. If the small submerged area is scarcely populated the alarming sirens can be replaced by mobile alarming teams (alarm system of type A).

Biedermann) 5. This seems only possible by spatial planning measures like the restriction of new settlements to relatively higher grounds. Risk treatment The safety of a dam and the level of acceptable risk must be ensured in all its stages of existence namely designing.15. In the figure the effect of two categories of measures to reduce the risk are indicated.4. leading to a stepwise decreasing function as given in figure 5. operation. To narrow the FN/D-curve the maximal consequences of a breach must be reduced. 90 . performing.16. abandoning. If the safety of the dam is increased. Risk reduction effect In many practical cases the FN-curve is re-evaluated following the risk reduction measures. The measures and actions taken in order to fulfil this requirement are generically defined as risk treatment.Figure 5. Possible alarm systems (after R. the graph will be lowered.

a mechanism is needed to forecast failure-probability in order to permit defendable.17. As shown in Figure 5.17. the capacity-demand procedure can be used as a tool to achieve this objective. Consequently. Figure 5.such as mechanical equipment. Evaluation of intervention timing 91 . Risk reduction effects on F/N chart Timing of major rehabilitation work The capacity of some dam components deteriorates with time . spillway capacity as compared with increased flood estimation etc.16. proactive budgetary planning to be performed.Figure 5.

Santos.. Risk and uncertainty in dam safety. Beijing 2000. ( 1997). Heft 3/4. H. Florence. Baden. ICOLD. On the demand side. Q 75. (1997) Dam break flood risk and safety management at downstream valleys. a risk assessment is made which essentially involves evaluating the risks usually in terms of the economic consequences associated with a ‘do-nothing’ alternative. this do-nothing approach may represent the leastcost alternative. G. Wasser Energie Luft-89. as the structure ages. This permits the optimum timing for implementation of a particular rehabilitation alternative to be determined by calculating net present values at each year of implementation. therefore. London H o e k s t r a . of 20th ICOLD Congress. ( 1994).. In the case of a relatively new dam. However. Hartford. To assess the optimum intervention timing. Once the relationship of failure-probability with time has been established. Biedermann. Proc. R. Issue four. risk exposure is computed by considering the change in failure-probability that results from implementing the intervention alternative. (2006).The method can account for changing conditions on the capacity side. Risk Assessment in Dam Safety Management. E. (1997). Proceedings of Seminar on "Acceptable risks for extreme events in the planning and design of major infrastructure". Lima. BIBLIOGRAPHY Almeida. M c D o n a l d . M. Risk management. M. Franco. A . For each alternative. Hydropower and Dams. Ramo s. Proc. Thomas Telford. B. Non-structural measures for cost-effective risk reduction. the economics of implementing structural improvements. (2004). In this approach. ICOLD Bulletin 130. ANCOLD risk assessment guidelines. Sydney.. By assessing the direct costs associated with implementation of competing rehabilitation schemes.C. The use of risk analysis to support dam safety decisions and management. B. such as a progressive breakdown of riprap. D. various intervention alternatives can be assessed to establish a least-cost option. January. Lemperiere. L.. it is possible to make use of life cycle management models to assess the optimum timing for major capital expenditures. (2000). and the associated riskcosts. at the same point. (2002).. risk increases such that. factors such as increasing performance requirements or rising of maximum water levels can be included in the analysis. CH-5401. 92 . Kreuzer. of ICOLD Congress". R 25. Baecher. are evaluated. General report Q76. least-cost strategy shifts to selective rehabilitation or replacement.. the probability of failure and. Dam safety. L . Private paper. with respect to the base case alternative.

issue 2.).. N. Swiss Committee on Dams (2006). Geiranger. ..B. Consequence Based Dam Safety Criteria for Floods and Earthquakes. Heft 2. Ionescu. Progress in Romanian legislation based on risk management. April. (1994). D. Stematiu. 2001. ANCOLD Bulletin No 101. Proceedings of the International Workshop on Dam Safety Evaluation. B u g n a r i u . D. Dam Engineering. von Hehn. G. Proc. Grindelwald. ( 1991). St. June.. Risk Analysis in British Columbia. D.. Wasser Energie Luft-98.. International Water Power and Dam Construction. van der Spuy. M. M. . March. G. (1995). reliability and redundancy. S. Berga Ed. C. Dam monitoring instrumentation. Barker. D . A b d u l a m i t . (1993). S t e m a t i u . Oosthuizen. van der Spuy. S â r g h i u ţ ă .. Marinescu. Hartford.Nielson. J. Vick. Salmon. R ... Concept. Vol. N. Significance of predicted displacement limits in arch dam safety evaluation. Baden. P. (2001). 93 . G. CH-5401. (1998). Barcelona. Salmon. A .. Proceedings of International Symposium on "New trends and guidelines on dam safety" (L. Risk-based dam safety analysis. D. Hartford. Lessons from the application of risk assessment to dam safety. . II.. of ICOLD European Symposium on Dams in European Context. T .

The investment cost I and the failure probability Pf are evaluated for several design alternatives and then the relationship Pf = f(I) is defined. Pf.i . Because of the difficulties associated with the estimating of the damage cost. DECISION STRATEGIES BASED ON RISK EVALUATION 4. The risk (probability of failure and the cost of the damages associated to certain failure mechanism) has to be included as well as the investment cost. There also appear social consequences that are difficult to be quantitatively expressed. The common approach excludes the failure risk. The decision rule for choosing the optimum alternative is that of the minimum investment cost (I = min) and consequently only one parameter of the required equilibrium is considered. When applying the criterion of the minimum generalized cost in the dam field one has to take into account that the damage cost induced by the dam failure (flooding of the downstream area) exceeds by far the dam investment cost. The generalized cost becomes: Cg = I + C • f (I ) 94 (6. the probability of failure of each alternative is different and consequently the selection is based on the comparison of 'incomparable alternatives'. In order to overcome these inconsistencies a new design criterion is required.6. including the damage cost and the dam reconstruction cost. Ci . the minimization of Cg has to be approached by using a specific procedure. Design criteria based on probabilistic approach The concept The design implies choosing the optimum solution out of the multitude of possible alternatives based on certain decision rules. i ∗ Ci = min (6.the cost corresponding to the failure mechanism i. In most cases.1. The main objective is to obtain a reasonable equilibrium between safety and cost.2) .the failure probability corresponding to the failure mechanism i . The cost of the damages produced in the downstream area is considered to have a constant value C which does not depend on I.1) where I is the investment cost. The decision rule best corresponding to the probabilistic approach is that of minimizing the generalized cost Cg: Cg = I + ∑i Pf .

Design of the rockfill cross section on the basis of generalized cost The dotted line corresponds to I(α) estimated during the first design stage ( tan ϕ = 0.1 shows the dependence between the investment cost I of the alternatives with Cg = min and the ratio α = C / I.81.σ = 0.11 ).1.06 ).4. Ratio α for the selected dam exceeds the value of 20 and consequently the dam cross section depends but in a small measure on the damage cost accurate estimation.. mil mil =C/I Figure 6.781. Design of a rockfill dam cross section For a homogeneous rockfill dam the failure mechanism was considered to be the sliding of a downstream prism on a plane surfaces that passes through the downstream toe (see figure 3.73 for the downstream face. The optimum value of the investment cost in the final design (solid line) corresponds to an average slope of 1:1. By using the conventional factor of safety for 95 . ∂Cg  = 0  leads to a relationship between the investment cost The Cg = min criterion  I ∂   and the damage cost: C =− 1 f (I ) (6. is more obvious when selecting the dam type for the same site. a).10. Selection of the dam type The need of new design criteria. Figure 6. when the quarry showed a great heterogeneity ( tan ϕ = 0.σ = 0. based on risk evaluation.3) I Assuming that the damage cost C can be expressed as a multiple of I (C = α I) the investment cost of the optimum design alternative can be obtained for an estimated value of α. The solid line corresponds to I(α) re-estimated during the dam construction. The probability of failure is evaluated by using the procedure exposed in subchapter 3.

selected as a possible damming alternatives for a certain site. the comparison of the design alternatives on the basis of the minimum investment cost is misleading since the level of safety of the alternatives is not the same.3. promotes the rockfill dam as the best choice. 96 . Based on these analyses one can notice that the comparison of the alternatives characterized by the same factor of safety FS = 1. right side. safety analyses have been performed for a rockfill and for a gravity dam.2.55 with a mean square deviation of σ = 0. The dependency of the probability of failure on the investment cost for both gravity dam (IG) and rockfill dam (IE) is shown in figure 6. Figure 6. For the evaluation of the probability of failure. FS Investment cost per 1 m of dam Figure 6.211 IE). that is.2. The same comparison of dam types but designed to have the same probability of failure. In order to illustrate the non-consistency of the deterministic approach when applied to the dam type selection. left side shows the dependency of the probability of failure on dam volume for each dam type. A ratio of 3 between the unit costs of the concrete and the rockfill was assumed.781 with a mean square deviation of σ = 0.designing of each dam type. (IG = 1.03) and the internal angle of friction of the rockfill (mean value tan φ = 0. Selection of the dam type observing the same level of safety Under the probabilistic approach the failure scenarios were the sliding of the downstream prism along a plane which passes through the downstream toe for the rockfill dam and the sliding of the dam body along the foundation surface for the concrete gravity dam. the friction coefficient at the concrete/foundation interface (mean value f = 0.2. a truncated normal distribution was assigned for the geotechnical data obtained from the site and quarry investigation.06).

In dam classification the loss of life and economic loss are described only in qualitative terms. as a result. For large dams rated as having significant consequences in case of failure Probable Maximum Flood (PMF) or floods with 1/10. for a consistent approach several dam type layouts have first to be designed so as to ensure the same probability of failure and then be compared on the basis of the investment cost. Solomon and G. For dams in the same category. (IG = 0. it groups too many dams whose failure would have vastly different consequences in the same category.000 probability of exceedance has to be safely routed through the reservoir and dam spillways.96 x l0-4 respectively). These guidelines are presented in the followings. A uniform level of exposure would require that the permissible total probability of failure vary 97 . dams are designed and their safety evaluated based on fixed criteria for extreme events.908 IE for Pf = 9. Consequence based dam safety criteria The concept According to most of the design codes. 4. The severity of criteria concerning design floods and earthquake is relaxed in the case of dams situated in a lower category.2 x l0-4 and IG = 0. In order to be more sensitive to those gradations in downstream consequences. von Hehn. fixed design and safety evaluation criteria are assigned for floods and earthquakes. The design codes also promote a stepped approach in their selection of criteria for extreme natural events based on a certain classifying system that includes dam and reservoir characteristics as well as the dam failure consequences. Consequently. The guidelines meet the following objectives: • The criteria for dams whose failure would have catastrophic consequences in terms of loss of life and economic losses should be designed and evaluated for the most extreme conditions: the PMF and the MCE or their equivalent in terms of probability of exceedance. and. The combined probability of dam failure is referred to as the total probability of dam failure. The same dams have to withstand safely the Maximum Credible Earthquake (MCE).975 IE for Pf = 0. the total probability of dam failure would be multiplied by the consequences. This can lead to inconsistencies in interpretation. To determine the level risk at any dam. • The criteria for dams whose failure result in no loss of life and in little economic loss should remain at a certain minimum (such as a 1:200 year flood or earthquake) or as warranted by economic analysis. The existing criteria system has several shortcomings. based on the paper written by G. The classifying system is not sensitive to gradations of downstream consequences and. indicates as the best alternative the gravity dam. new guidelines are proposed by BC Hydro for the selection of criteria for earthquakes and it is required by the equilibrium between cost and safety. Proposed approach The proposed approach to the evaluation of dam safety requires determination of the combined probability of the occurrence of extreme loads and probability of dam failure under these loads.2. • The criteria for all other dams (this would cover the range from PMF/MCE to the 1:200 year event) should be in balance with their consequences of failure.

In the next step the consequences of dam failure are evaluate in terms of probable loss of life. procedures for assessing consequences of dam failure in a consistent and rational manner are required along with those for assessing the probability of failure. environmental.000 or less from the total of direct damages. consequential damage.000 or less. The consequence evaluation would be based on the potential losses which a failure would inflict upstream of. The evaluation would consider both existing and foreseeable future downstream development and land uses during the expected life of the dam. The level of exposure considered tolerable by other regulations could differ from the ones presented. economic costs of the other potential losses covering loss and/or damage to all property. as well as loss of power generation in case of dams related to water power. In order to evaluate incremental consequences of dam failure. the dam would be designed or evaluated based on the maximum loading criteria using the PMF and MCE. if possible and included.inversely with the consequences of such failure. The tolerable exposure being considered by BC Hydro is: • One fatality per 1000 years or more of dam operation but without imposing an intolerable risk to any individual. • An expected annual damage loss of $10. The method starts with performing inundation studies to assess likely downstream flooding from a dam breach due to an earthquake or flood dam failure. A more detailed discussion on the subject was presented in chapter 5 of the book. facilities.000 were selected on the basis of risks normally accepted by society. 98 . For normal loadings the factors of safety are to be in the internationally accepted range. in accordance with financial and societal requirements. To use this approach. damage to the structures is acceptable as long as it does not result in uncontrolled release of the reservoir. The tentative exposure levels of one fatality per 1000 years of operation and expected annual damage cost of $ 10. Costs are assigned to social. utilities and dam. It would include an assessment of potential loss of life. For loadings up to and including the extreme loadings as permitted by the tolerable exposure level. at. economic losses. Each dam would be designed or evaluated for safety using extreme loadings based on the incremental consequences of failure caused by floods or earthquakes. Figure 6. A standard for selecting criteria with respect to loads from natural events based on a tolerable exposure level at any dam is one which does not impose an unacceptable risk of loss of life or financial loss. social disruption and environmental damage.3 illustrates the overall method to evaluate dam safety or to select extreme design loads based on the consequences of dam failure. cultural and environmental impacts. All water-containing structures must have adequate stability to withstand the design loads. and downstream of the dam facility. social and cultural losses. the annual total probability of failure must be 1:100. Should the consequences of failure be such that in order to meet the acceptable exposure level as defined above. an estimate is also required for the flooding that would occur without dam breach.

99 . This will yield expected fatalities per 1000 years and the annual risk cost for floods. Dam safety evaluation against exposure level For evaluating the exposure to loss from an existing dam for floods. determine the probability of dam breach. Multiply the probability of the flood event range by the conditional probability of dam failure given the flood within the range and sum over all flood ranges to determine the total probability of failure due to floods. For each flood magnitude range. determine the probability of occurrence of ranges of floods extending from the smallest flood that might cause failure to the largest flood that could reasonably occur (PMF). Multiply the total probability of failure by the incremental consequences of failure due to floods to determine the level of exposure due to floods.3. Prob. Prob. Figure 6.Prob.

Probability of failure versus design flood 100 .For evaluating the exposure to loss from an existing dam for earthquakes. The evaluated exposure level (see figure 6. Should an existing dam fail to meet the criteria for tolerable level of exposure. 360 m3/s 170 Figure 6. cultural and environmental consequences should also be considered in making this determination. Total probability of failure Case study Let us assume that for the analysed dam the extreme events are only floods. Finally the total level of exposure due to floods and earthquakes is compared to the tolerable level of exposure to determine the adequacy of the level of safety of the dam in withstanding these natural hazards. determine the probability of ground motions over ranges of intensities from the smallest acceleration that might cause failure to the largest earthquake acceleration that could reasonably occur (MCE). Once the exposures levels due to floods and earthquakes are evaluated sum the levels to find the total level of exposure for the dam from these two natural events. The following case study clarifies the procedure to define such improvements. Determine the probability of dam failure for each range of earthquake intensities. The qualitative social. This exposure level will be expressed in expected fatalities per 1000 years and annual risk cost related to earthquakes. Multiply the probability of all earthquakes within the range and the corresponding probability of failure and sum for all earthquake ranges to find the total probability of failure due to earthquakes.4) overpasses the established acceptable level (20 lives would be lost due to floods induced failure in the next 1000 years. dam safety improvements should be carried out.4. Multiply the total probability of failure by the incremental consequences of dam failure to find the level of exposure due to earthquakes. The original design flood for the spillway structure is 170 m3/s. significantly more than tolerable one fatality per 1000 years or more of dam operation).

The new overall probability of failure: P’f = Pf (1-r) = Σ Pf. Consequently.3. Dam monitoring improvement based on the net expected benefit One of the most efficient measures that reduce the probability of failure is the provision of an adequate monitoring system.00005.5) all scenarios where Pf.4) where r is a measure of risk reduction effectiveness. j (6. Safety improvements have also different effects on reducing failure probabilities corresponding to different failure scenarios. which have different probabilities of failure.This estimate imposes the improvement of the dam to meet higher standards than currently exists. A series of trial dam/spillway arrangements are developed. the probability of failure corresponding to each j mechanism will be differently reduced: P’f. j ( 1-rj ) (6. If Pf is the probability of failure of an existing dam and P’f is the new probability of failure if added protection is provided one can define: Pf = P’f ( 1-r ) (6. j = Pf.6) where rj is the effectiveness in reducing the risk in mode j. j ( 1-rj ) (6.7) all scenarios 101 . and the hazards are treated separately (mutually exclusive failures) the total probability of dam failure is: Pf = Σ Pf. the added monitoring systems or the operation constrains has direct effects in reducing the probability of dam failure. the supplementary costs must be balanced by a corresponding improvement of the dam surveillance with direct effects in safety. 4. To achieve a total probability of failure equal or less than 5 x 10-5 the spillway capacity has to accommodate a 360 m3/s inflow. the total probability of failure is evaluated for each arrangement. Additional discharge capacity is required. The question is what a good monitoring system is and what the rational limits of a surveillance program are. By using the above presented methodology. If additional instrumentation is installed. j is the annual probability of failure corresponding to mechanism j. The dam can fail following several failure mechanisms. In order to observe the acceptable exposure level the total probability of failure due to floods has to be 1/ [1000/1 x 20] = 0. Figure 6. The rehabilitation of the dam. If a certain protective measure is provided. if j denotes a certain mechanism (scenario) of failure.4 shows the resulting curve of total probability of failure versus the actual capacity of discharge of each new design arrangements. Effectiveness of protective measures The effectiveness of a safety program can be quantitatively evaluated by the risk reduction that it provides.

the average annual economic loss is expressed as Pf C.8) all scenarios where r is a weighted combination of rj values. The annual risk can be defined multiplying the failure probability per year with the monetary value of the consequences.renders evident an overall risk reduction effectiveness: r = Σ ( Pf. Figure 6. A certain strategy of dam monitoring improvement will lead to a risk reduction effectiveness rs and to an average annual economic benefit: 102 . Decision strategy Assuming that dam failure warning and evacuation planning are very efficient. more often. The expected monetary loss can be reduced if the probability of failure is reduced by added protection. The framework of the process is presented in figure 6.5. a statistical approach.5. The weighting factors are the fractional or relative probabilities Pf. j / Pf ) rj (6. where Pf is the annual failure probability. Decision making process In the case of dam safety monitoring the benefits can be quantified and used as the objective function. If C denotes the monetary loss in the case of dam failure. Several strategies can be conceived and for each of them the risk reduction effectiveness and the added cost can be evaluated. The annual failure probability (rate) can be evaluated by using either a full probabilistic approach or. The final selection of the “best” strategy is based on the trade-off between cost and risk. the loss of life can be reduced to practically irreducible level and the consequences are only the economic ones and can be assessed.j / Pf characterizing the likelihood of occurrence of a certain failure scenario.

b = Pf C - P’f C = Pf C rs


Each strategy implies supplementary annual costs ∆Cs and a net expected benefit can
be defined:
bn = b - ∆Cs = Pf C rs - ∆Cs
The best monitoring improvement strategy is the one which creates the maximum
expected net benefit (see figure 6.6).
For an owner having in operation several dams, the decision concerning the best
strategy in dam monitoring improvements is based on maximizing the total expected
annual benefits with a limited annual budget.

Pf C
Expected monetary loss

Pf C (1-rS)

b= PfC rS2

Net benefit

Cost of added
protection ∆Cs




Best rs3

rs = 1


Figure 6.6. Benefits versus effectiveness of risk reduction
A case study: Srejesti dam
Strejesti dam (figure 6.7) provides storage of 250 million m3 of water for Strejesti
hydropower plant with an installed power of 50 MW and a total annual energy output
of 173 GWh/year. The Strejesti power plant is the last major plant of the Middle Olt
section development, which covers a length of 120 km with a head of 202 m.

The main earth dam and the concrete spillway have a thorough monitoring system
corresponding to the common practice in the field. It measures the water pressure and
the uplift, joint openings, settlements and horizontal movements, seepage and
deformations. The recorded parameter values and the regular visual inspections allow
for good dam surveillance and for an accurate safety assessment of the dam.

The lateral right bank dam is provided with a less elaborate monitoring system. The
seepage is collected in a seepage channel along the downstream toe of the dam and
measured in several calibrated sections. The settlements are measured by means of
annual survey using benchmarks located on the dam crest and on the downstream
berm. The seepage field in the dam body is recorded by 23 piezometer drillings
located in 9 monitoring profiles. Two hydro geological drillings are used for
underground water table measurement. The lateral dam surveillance is also done by
visual inspections conducted by dam operators.


Figure 6.7. Strejesti dam monitoring system


During the reservoir operation several incidents have been recorded. Concentrated
seepage and sinkholes have been discovered downstream of the main earth dam and
remedial works were performed. Several landslides along the left bank of the reservoir
have been activated and the remedial actions were backfills and supplementary
excavations. Along the downstream face of the lateral dam several wet spots have
been noticed, in connection with the detachment of the bituminous sealing of the
upstream concrete face joints. The upper location of the seepage line has also revealed
some deficiencies of the drainage properties of the embankment. The major incidents
were recorded during two strong earthquakes. Evident signs of liquefaction (sand
craters) appeared in several zones downstream the lateral dam (see shadow zones
corresponding to piezometer profiles P7, P8 & P11 in figure 6.7) in connection with
the lens of saturated sand in the foundation.
Taking into account the incidents produced in the past, the difficult foundation
conditions and the insufficient drainage properties of the dam body, the actual
monitoring system of the lateral dam was considered unsatisfactory. To aid the
selection of the most appropriate supplementary monitoring actions it was decided to
undertake a risk analysis of the lateral dam. The analysis was focused on the
assessment of the global probability of failure, on identification of the potential failure
mechanisms and on the evaluation of the downstream economic loss induced by a
dam breach. The results of the risk analysis are briefly presented in the followings.
The global probability of failure was selected based on statistical data. Assuming
similar conditions with the embankment dams with heights in the range of 15 m to 50
m, a global probability of failure Pf = 8.4 x 10-5 was assigned to the lateral dam.
The failure mechanisms and the associated partial probabilities of failure were
identified based on engineering judgment. Four major failure scenarios were selected
for the decision policy, all the other being included in the “unknown” mechanisms:
- dam overtopping due to: (1)faulty performance of the gates; (2)extensive
settlements and loss of freeboard; (3)sedimentation of the upstream entrance in the
reservoir leading to rise of the backwater levels. The fractional probability of the dam
overtopping mechanism is 22 %;
- piping induced by concentrated leakage through unsealed contraction joints
of the concrete face or by extensive seepage in the contact zone of the dam foundation
interface, through saturated sandy lens. The fractional probability of the piping failure
mechanism is 37 %;
- earthquake induced extensive movements of the dam body, due to
liquefaction or near liquefaction condition within the saturated sandy layers in the
upper zone of the foundation. The fractional probability of the earthquake effects in
foundation is 19 %;
- slope sliding triggered by saturated condition of the downstream shell as a
consequence of intense leakage through the upstream concrete face and lack of
drainage in the downstream zone. The fractional probability of the slope sliding
mechanism is 12 %.
All the other mechanisms or unknown scenarios have been considered with a
fractional probability of 10 %.


15 - 106 . conducted by a team of experts with monthly frequency. Table 6. -supplementary piezometer drillings located in new piezometric profiles.22 j=4 Slope sliding j=5 Unknown 0.19 0. bridges. For Strejesti lateral dam four alternatives were identified: .30 0.Consequences of the dam failure are: loss of life.20 0.60 0.000 US$/year for 200 m interval. Only the economic loss can be clearly defined in monetary terms.30 - 0. The risk reduction coefficients for each failure mechanism and for each alternative action are summarized in table 6. C = 277 200 US$/year. . The corresponding annual cost was estimated at 30 200 US$/year.000 US$/year for 400 m interval and at 306. Risk reduction effectiveness for the alternative monitoring actions has been evaluated by a panel of experts on the basis of their personal experience and on the dam safety report data. resistivity.000 US$/year for 800 m interval. With unit costs for replacement of roads. to identify permeability. Depending on the new average interval between the monitoring profiles the corresponding annual costs were estimated at 36.40 0.improved visual inspections. etc.37 j=3 Earthquake effects in foundation 0. electromagnetic field.50 0.10 0.systematic georadar and thermographic measurements along the dam crest.500 US$/ year. In order to assess the loss of life and economic consequences a dambreak simulation was undertaken.12 0. as electric field. downstream slope and the toe berm.20 0. The corresponding annual cost was estimated at 41. various services. According to the procedure defined for the decision analysis only the economic loss is considered.1.1.25 0. environmental and social effects. schools. .10 0. Risk reduction effectiveness for alternative monitoring actions.80 - - 0. The improvement of the existing monitoring system of the lateral dam can be achieved by adding one or several monitoring actions.90 0.10 r1 r2 r3 r4 r5 0. economic loss.j / Pf Risk reduction effectiveness a) Improved visual inspections b)Supplementary piezometric profiles b1) at 800 m b2) at 400 m b3) at 200 m c) Georadar and thermograph d) Other geophysical procedures 0.15 0. industrial works and houses and adding the investment cost of the dam the total estimated cost of damages was between 3150 million US$ and 3305 million US$. Failure mechanism (j) j=1 Dam overtopping j=2 Piping Relative probability of failure Pf.30 0.20 0. at 126.20 - 0.40 0. water content and seepage lines. railways.000 US$/year.75 0.supplementary geophysical measurements. The annual monetary loss (economic damages) has been evaluated as the product of failure probability and estimated cost of damages: Pf . The corresponding annual cost was estimated at 94.

200 377.7 0.2. According to the relationship (6.700 5 ∑ (Pf.40 0.827 .95 0.530 0.616 7.293 S=1 – a S=2 – a+b1 S=3 – a+b2 S=4 – a+b3 S=5 – a+c S=6 – a+b1+c S=7 – a+b2+c S=8 – a+b3+c S=9 – a+c+d 0.95 0.5 0.957 64.4 0.19 Failure mechanism (j) overtoppin g Global risk reduction effectiveness Annual costs Net benefit ∆C (US$) (US$) 0.22 0.200 165.j/Pf) Risk reduction effectiveness (rj) 0.284 -152. Costs and benefits corresponding to alternative strategies 107 bn 80.9 0.95 0.The alternative monitoring actions can be combined in order to define different monitoring improvements strategies.8 0.626 30.5 0.084 -9.200 156.814 61.60 0.200 71.70 0.95 0.30 0.321 - - 0.40 0.80 0.5 0.139 81.95 0.200 197.664 0.8) and (6.95 0.5 0.12 0.9) the global risk reduction effectiveness and the net benefit for each strategy are evaluated in table 6.105 0.608 0.430 0.5 0.95 0.30 0.337 -13.30 0.720 0.323 0.5 0.2.50 0.393 0.200 107.95 0.6 0.10 r4 r5 Relative probability of failure (Pf .35 0.45 0. Table 6.660 0.4 0.552 0.200 336. j / Pf) rj 1 Figure 6.5 0.7 0.37 r1 r2 r3 Existing monitory system 0.5 0. The risk reduction effectiveness and the corresponding costs for monitoring improvement strategies are presented in table 6.470 0.6 0.30 j=1 Dam j=2 Piping j=4 Slope sliding j=3 Earthquake effects in foundation 0.25 0.5 0.8 0.5 0.139 -177.30 0. The results of the decision analysis are plotted in figure 6. Risk reduction effectiveness and corresponding costs for monitoring improvement strategies j=5 Unknown 0.200 66.

Safety and risk in hydraulic structures (in Romanian). St. Ionescu. Decision analysis in dam safety monitoring. Beijing 2000.The effectiveness range is rs = 0. INCOLD. BIBLIOGRAPHY Kreuzer. General report Q76. (1984). Editura Didactica si Pedagogica.. Consequence Based Dam Safety Criteria for Floods and Earthquakes.2) are rapidly increasing for higher values of rs. pg. New Delhi. April. von Hehn. The use of risk analysis to support dam safety decisions and management. of Int. (1999). improved visual inspections combined with systematic georadar and thermographic measurements). The net annual benefit has a maximum value for strategy S = 5 (i.. D.329. (2000).. (1993). 0.. Proceedings of the International Workshop on Dam Safety Evaluation. Stematiu. Salmon.. Conf. Symposium on "Rehabilitation of dams". of Int. Proc. D.4 .. Proc. Stematiu. Proc. 1984. (1998). Grindelwald. Priscu. April. R. of 20th ICOLD Congress. Coimbra. 324. Some design criteria for large dams on the basis of probabilistic concept of Safety. H.8 and the costs of added monitoring strategies S = 1 to 9 (table 6. G. D. November 1998. C. on Safety of Dams.e. Abdulamit. 108 . Bucharest.. G. Stematiu..