Baecher 2023 2021 Terzaghi Lecture Geotechnical Systems Uncertainty and Risk

Lecture
2021 Terzaghi Lecture: Geotechnical Systems,

Uncertainty, and Risk
Gregory B. Baecher, Ph.D., NAE, Dist.M.ASCE 1
Abstract: Risk assessment for large engineered systems involving geotechnical uncertainties—such as dams, coastal works, industrial
Downloaded from ascelibrary.org by University of Central Florida on 11/03/23. Copyright ASCE. For personal use only; all rights reserved.
facilities, and offshore structures—has matured in recent decades. This capability is becoming an ever more pressing concern considering
increasing natural hazards and the effects of climate change. This progress and the current state of practice are reviewed by considering four
projects. An underlying theme is what we have learned about how geoprofessionals should think about uncertainty, judgment, and risk.
The organizing key is Bayesian thinking, which is neither new nor unintuitive to most geoprofessionals. However, this way of thinking
and analyzing data is powerful, even when dealing with the sparse data of geotechnical projects. The presentation builds on the past Terzaghi
Lectures of Casagrande, Whitman, and Christian. It uses examples of infrastructure systems for which geotechnical considerations were im-
portant. Reliability concepts developed in this earlier practice provide a window into the processes of integrating site characterization data,
judgment, engineering models, and predictions to achieve tolerable levels of risk. Along the way, arguments are made on the nature of uncertainty
and on the benefits of processing data, judgment, and inferences through a consistent lens. DOI: 10.1061/JGGEFK.GTENG-10201. This work
is made available under the terms of the Creative Commons Attribution 4.0 International license, https://creativecommons.org/licenses/by/4.0/.
Author keywords: Risk; Reliability; Uncertainty; Systems engineering; Bayesian.
Introduction risk analyses of large geotechnical systems and at the same time
to examine the philosophy behind that approach.
The topic is risk analysis of large geotechnical systems. Such
systems include flood and coastal protection works, hydropower
dams, large industrial facilities, offshore installations, and similar Tonen Reprised
infrastructures. All of these involve complicated geotechnical
uncertainties. The approach to the risk analysis of such complex We start with a retrospective look at the Tonen Refinery project
systems involving geotechnical uncertainties has matured in recent (1978–1982) discussed by Whitman. This was among the first risk
decades but the need for future development remains given the analyses of a large geoengineered project. Whitman asked two ques-
intensifying of natural hazards and a changing climate (Allan tions of that example: (1) is it possible to quantify risk, and
et al. 2021). (2) can geotechnical reliability be applied in practice? He adapted
There have been at least three Terzaghi Lectures related to Casagrande’s title of 20 years earlier to ask, “can we evaluate a cal-
uncertainty and risk in geotechnical practice. Casagrande (1965) culated risk?” It is important to consider Whitman’s discussion
introduced a qualitative way of thinking about “the calculated risk in the context of its time. This was an era when risks associated
in earthworks.” Whitman (1984) proposed quantifying that ap- with nuclear power were being debated, WASH-1400, US Nuclear
proach and suggested that quantification was indeed possible. Regulatory Commission (USNRC)’s Reactor Safety Study: The
Christian (2004) expanded and critiqued the quantitative approach Introduction of Risk Assessment to the Regulation Of Nuclear Re-
with later developments in reliability theory. actors had just appeared, and the National Aeronautics and Space
The present discussion focuses on the application of geotechni- Administration was trying to quantify the risks of manned space
cal risk analysis to increasingly complicated infrastructure systems. flight (NRC 1988; USNRC 2016). The years between Casagrande’s
It uses four projects to illustrate lessons learned in that evolution: lecture and Whitman’s had seen the incidents at Teton, Lower San
(1) a reprisal of the Tonen Refinery project discussed by Whitman Fernando, Buffalo Creek, Canyon Lake, Laurel Run, Toccoa Falls,
(1984), (2) the Interagency Performance Evaluation Taskforce and others (Gee 2017). He answered each question in the affirmative.
(IPET) following Hurricane Katrina, (3) the Panama Canal Natural Several lessons were learned from this early project that have be-
and Chronic Risks Study, and (4) the joint-industry study on spillway come routine in current risk analysis methods. Among these were:
systems reliability. The engineering methodologies of these exam- 1. The use of event trees for organizing uncertainties,
ples are important, but equally are the concepts underlying them. 2. A taxonomy of uncertainty for geotechnical data,
The purpose is to layout the rudiments of the current approach to 3. The importance of spatial variation of geotechnical properties,
and
1
Glenn L. Martin Institute Professor of Engineering, Dept. of Civil 4. Methods for communicating risk to stakeholders.
and Environmental Engineering, Univ. of Maryland, College Park, MD The project involved more than 100 storage tanks founded on
20742. ORCID: https://orcid.org/0000-0002-9571-9282. Email: gbaecher@ loose sandy bay fill in a seismically active harbor (Fig. 1). To protect
umd.edu
against offsite loss of product, the facilities were subdivided by fire-
Note. This manuscript was submitted on June 22, 2021; approved on
September 28, 2022; published online on January 10, 2023. Discussion walls into patios and those patios were contained within larger re-
period open until June 10, 2023; separate discussions must be submitted vetments. Many of the patios were interconnected by underground
for individual papers. This paper is part of the Journal of Geotechnical drainage systems. While the direct cost of foundation failures
and Geoenvironmental Engineering, © ASCE, ISSN 1090-0241. could be large, they would be exceeded by environmental costs.
© ASCE 03023001-1 J. Geotech. Geoenviron. Eng.
J. Geotech. Geoenviron. Eng., 2023, 149(3): 03023001

Fig. 1. (Color) Tonen refinery and tank farm, Kawasaki. (Image © 2021 Google, Landsat/Copernicus; Data SIO, NOAA, U. S. Navy, NGA, GEBCO;
Data Japan Hydrographic Association; Data LDEO-Columbia, NSF, NOAA.)
Usefulness of Event Trees in Organizing Uncertainties calculated by multiplying the successive conditional probabilities
at each node
Many of the lessons learned on the Tonen project seem obvious
today, but they were less so then. The first was how to build a PðpathÞ ¼ Pðx1 ÞPðx2 jx1 Þ · · · Pðxn jxn−1 ; : : : ; x1 Þ ð1Þ
systems model of the facility. The then-recent WASH-1400 study
used fault trees to combine the performances of the many compo- In which PðpathÞ = joint probability of the events along an
nents in a nuclear plant to calculate the probability of accident individual path through the event tree from its beginning to an out-
sequences. A fault tree is a logic diagram that reasons backward come; and fx1 ; : : : ; xn g = individual uncertainties in the tree. The
from an adverse performance to the faults necessary to cause it vertical line indicates a conditional probability of the uncertainty on
(Modarres 1993). That worked well with mechanical-electrical sys- the left given the occurrence of the uncertainties on the right. The
tems that could be fully enumerated. Yet, that was not the case for sum or integral of the uncertainties at each node must equal 1.0
the tank farm which was a more open system. The tank farm had because each node is a probability distribution of an uncertainty.
some components that could be discretely enumerated, like the Commercial software applications are widely available to do these
tanks themselves and drainage pipes and firewalls, but the perfor- calculations.
mance also depended on soil deposits under the site, some natural
and some manmade. It also depended on external hazards, specifi-
A Taxonomy of Uncertainty for Geotechnical Data
cally earthquakes, that at the time had not been part of the WASH-
1400 analysis. Event tree models were used because they were Most of the subsurface data for the Tonen project came from
flexible and could be used to combine uncertainties of many types, standard penetration tests, which were highly variable (Fig. 3).
including those based on judgment (Fig. 2). An event tree is a logic The geometry of the soil strata differed systematically across
diagram complementary to a fault tree that reasons forward from an the site, so a set of soil models was created. Yegian and Whitman
initiating event to subsequent adverse performance. (1978) recently developed a reliability model for relating blow
Event trees have since become the standard representation for count data to the probability of liquefaction triggering, and that
uncertainties in almost all dam and levee safety studies (Hartford was the approach used. Since the late 1970s, there has been a great
and Baecher 2004; FEMA 2015). They are widely used in offshore deal of work on liquefaction triggering and residual strength, but
applications (Rausand and Haugen 2020) and in mining (Brown that came later and is tangential to the present discussion (NRC
2012). In an event tree, the many uncertainties entering an analysis 2016).
are laid out graphically, with each node in the tree representing the The question arose as to what the large scatter in the in situ
probability distribution of an uncertainty. The probability of pro- data meant for engineering predictions. Some of that scatter was
ceeding down a chain of uncertain outcomes through the tree is presumably due to real variability and some due to random testing

Fig. 2. Map and event tree for a Patio 4. Each of the nodes at the fourth level had a sub-tree as shown for the single case of two tank failures.
(Reprinted from Whitman 1984, © ASCE.)
errors. However, in interpreting the data one also had to consider to some extent average out, but statistical errors and measurement
systematic biases in the measurements and biases due to statistical bias create systematic errors that do not. The latter are more concern-
and testing errors. Not each of these errors affects prediction un- ing because they create correlations of error among the predictions of
certainty in the same way. Spatial variation and measurement noise performance.

would be similarly large, but they are not. The explanation is that
some of the data scatter is not in the soil itself but due to testing
errors. Such errors add noise to the data. This can be ignored if
one can estimate how large they are. This is not simple because
most soil testing is destructive. The advent of stochastic models
of spatial variation in mining geostatistics along with modern stat-
istical methods of estimation to a large degree solved this problem
(DeGroot and Baecher 1993). The systematic errors are due to stat-
istical estimation, the physics of testing, and the pedotransfer func-
tions used to translate measurements into engineering parameters
(Phoon and Kulhawy 1999). Systematic errors do not appear in the
data scatter and are insidious because they do not average over soil
volume.
Importance of Autocorrelated Spatial Variation

The second insight was that the performance of geotechnical struc-
Fig. 3. (Color) Soil model SM1 and STP blow count data used to de- tures often depends on averages of soil properties over volumes or
scribe parts of the site patio. (Data from Lambe and Associates 1982.) areas of soil, for example, the total displacement of a volume of soil
or the total shear resistance along a landslide slip surface. Obvi-
ously, things are never quite so simple. Differential displacements
may depend on the difference between the averages in two vol-
umes, and the weakest link in a long levee depends on the weakest
section.
The data scatter in test data, in contrast, reflects averages over
the small volumes of soil mobilized in a test. The smaller the vol-
ume, the greater the variability among the measurements. The vari-
ability of the average soil property within a much larger volume
would be less than the variability among the small volumes of the
standard penetration test data because the variability averages out.
The fragilities of the tanks had been correlated to average soil
properties through a large empirical survey (Marr et al. 1982). More
recent work by Fenton and Griffiths (2008) suggests that the average
property beneath a tank may not be the best criterion for fragility.
Were the analysis being done today, it might be done differently,
but at the time, fragility was correlated to total settlement.
Fig. 4. Components of soil engineering property uncertainty. The variance in the average soil properties under a tank de-
(Reprinted from Christian et al. 1994, © ASCE.) pended on the size of the tank. The larger the tank, the smaller
the uncertainty in the average soil property (Fig. 5). In this figure,
the variances and covariances are normalized to the point variance
among test values, and the tank radius and separation distances
A simple taxonomy was developed (Fig. 4), which has later used are normalized to the autocorrelation distance as described in
on other projects (Christian et al. 1994; Baecher and Ladd 1997), in Vanmarcke (1977a).
which the variance of the uncertainty in an engineering parameter is Additionally, soil properties are spatially correlated. The proper-
approximated as ties in adjacent volumes of soil tend to be alike and those in distant
volumes tend not to be. As a result, the performances of the tank
Vartotal ¼ Vardatas catter þ Varsystemic error ð2Þ
foundations were also correlated. Nearby tanks tend to perform
alike. Since the concern was the total volume of product spilled
The total variance is the sum of the variance seen in the data plus
in an earthquake, the total number of tanks failing and the volume
that of the systematic errors due to small numbers of measurements
of product in each were of importance. The correlations among
and measurement error
tanks were important because correlations suggested higher prob-
Vardata scatter ¼ Varspatial þ Varmeasurement noise ð3Þ abilities of multiple tank failures during an earthquake.
Recognition of the importance of spatial correlation of geologi-
Varsystematic error ¼ Varstatistical error þ Varmeasurement bias ð4Þ cal properties arose in the mining industry (Krige 1962a, b) but
spread quickly to geotechnical engineering with the work of Wu
The last of these are now referred to as transfer errors. Variants (1974), Vanmarcke (1977a), Høeg and Tang (1978), and others.
of this taxonomy have been proposed by Phoon and Kulhawy In recent years, the implications of spatial correlation using numeri-
(1999), Jones et al. (2002), and others. cal modeling have been explored by Fenton and Griffiths (2008).
This simple taxonomy leads to several useful insights. The first
is that the variability reported as observed in soil engineering data is
Communicating Risk to Stakeholders
often quite large, sometimes showing coefficients of variation
(standard deviation divided by the mean) of 30% or more. No one Among the more useful things learned at Tonen was that commu-
doubts that this variability is observed, but is it applicable to reli- nicating risk (probabilities and consequences) to an owner is itself
ability calculations? If yes, then the rates of geotechnical failures challenging. None of the three earlier Terzaghi Lectures formally

Fig. 5. Spatial averaging and correlation of soil properties beneath tanks of various sizes and separations. The left-hand side (a) shows variance
reduction as a function of tank radius. The right-hand side (b) shows the covariance between the averages of soil properties under adjacent tanks as a
function of their radius and separation. (Data from Lambe and Associates 1982.)
defines risk, and their focus is largely on probabilities. The obvious frequency. A tradeoff between how much of the spatial variation
way of communicating risk is by multiplying probability and con- is modeled as aleatory and how much as epistemic can be made
sequence to get an expected value. One sometimes sees this as a by changing the granularity of the trend model. This is conceptually
formal definition of risk, but in the field of risk science, the concept similar to changing the flexibility of a regression model.
is more complex (Kaplan and Garrick 1981). In principle, one The separation of uncertainty between aleatory and epistemic
ought to be willing to pay up to this expectation to eliminate the is mostly a convenience of modeling (Faber 2005; Kiureghian and
risk, but this can be a difficult proposition for the owner. Ditlevsen 2009). Thus, while it is sometimes said that epistemic
Instead, data were collected on comparative risks for similar fa- uncertainty is reducible (with more knowledge) but aleatory un-
cilities and used to compare site-specific risks (Fig. 6). The concept certainty is not, that is at most true within the context of a set of
was that this comparative information could be used with regula- modeling assumptions (Vrouwenvelder 2003). For example, it is
tory authorities to demonstrate good faith in taking actions to re- common in probabilistic seismic hazard analysis to presume that
duce risk. The approach worked well in communicating with the earthquakes occur randomly and independently within the con-
client and in turn with regulators. Whitman published this figure in straints of a source model. In fact, the geomechanics controlling
his Terzaghi Lecture, and it has become well-known. It is fortunate the occurrence and size of the earthquakes are likely determinis-
that he did so, because otherwise, it would have quietly disap- tic, but we do not know enough to characterize the process as
peared: at the time, no one on the team thought it all that interesting. such, so we model the uncertainty as aleatory. That is a modeling
choice.
Geotechnical Uncertainty I: Probability and
Uncertainty Geotechnical Uncertainties Are (Mostly) Epistemic
The discussion to this point has dealt with modeling geotechnical Geotechnical uncertainties are mostly epistemic. They have to do
uncertainty; however, the Tonen project also led to conceptual in- with what we know, not about randomness in nature. As a result,
sights which took longer to be recognized. These are likely of more they are almost always subjective. The probability theory appropri-
consequence than the modeling tools themselves. ate to these sorts of uncertainty has to do with degrees-of-belief,
not with frequencies (Vick 2002). The lectures of Casagrande,
Whitman, and Christian call out the importance of judgment in
Probability Is in the Model, Not in the Ground geotechnical practice, which is simply another name for the sub-
Georges Matheron, the founder of geostatistics said, “probability is jectivity of most geotechnical uncertainties.
in the model, not in the ground” (Matheron 1989). There is nothing
random about in situ soil properties: they are what they are, but we
just do not know what they are. In modern risk and reliability mod- Interagency Performance Evaluation Taskforce
eling, uncertainties are commonly divided between aleatory and
epistemic. Aleatory uncertainties are those modeled as variability The second project was the IPET (2005–2009). The IPET was
(or randomness as in the toss of a coin) in nature and describable by organized under the Corps of Engineers to understand the perfor-
frequencies. Thus, one may model the spatial variations of soil mance of the hurricane protection system in New Orleans during
properties across a site as aleatory, but not the properties at a par- Hurricane Katrina (Link and Harris 2007). This, too, involved risk
ticular point. Epistemic uncertainties are those due to a lack of analysis, but now of an even larger geoengineered system. This sys-
knowledge and are described by degrees-of-belief. Soil properties tem in addition, however, protected human life (Figs. 7 and 8). The
at a particular point are unique although possibly uncertain. They system was subsequently renamed, the Hurricane and Storm
may be unknown but are not variable and not describable by Damage Risk Reduction System (HSDRRS).

Fig. 6. Generic probability versus consequence chart prepared for the Tonen project. (Reprinted from Whitman 1984, © ASCE.)
Fig. 7. (Color) Flooding of New Orleans after Hurricane Katrina in 2005. (Image courtesy of NOAA Corps/Lt. Cmdr. Mark Moran.)

Fig. 8. (Color) Subbasin definitions for the calculation of stage-storage relations. (Reprinted from USACE 2008, courtesy of US Army Corps of
Engineers.)
The Risk and Reliability Team initially involved 37 engineers

and scientists, of whom six remained active throughout the effort
[IPET8 (USACE 2008)]. As at Tonen, event tree models formed the
basis of the approach, and the same taxonomy of soil property un-
certainties informed the data analysis. Spatial variation again was
an important factor, helping to explain length effects in the long
levee reaches using the method of Vanmarcke (1977b). Important
new lessons from IPET (USACE 2009) included:
1. The use of logic trees to differentiate the effects of epistemic
versus aleatory uncertainty,
2. Appreciation for the care needed in putting numbers on engi-
neering judgment,
3. The need sometimes to incorporate legacy data and analyses in
risk models, and
4. Approaches for communicating risk to the public.
Given how IPET was structured, it made sense again, as at
Tonen, to divide the risk analysis into three parts (Fig. 9): (1) the
threat or hazard, in this case surge, wave, and flood; (2) the vulner-
ability of the engineered system to the threat (in this case, the
hydraulic and geotechnical reliability of the infrastructure); and
(3) potential consequences (in this case including loss of life). In
other contexts, e.g., homeland security, this has been called the Fig. 9. (Color) TVC approach. (Adapted from Alfaro et al. 2016.)
threat-vulnerability-consequence (TVC) approach (NRC 2010a).
TVC Approach
Fragility ≡ PðperformancejloadÞ ð5Þ
The TVC approach is widely used for natural hazards. Threats
to the system are characterized by probabilities of load levels. The probability of adverse performance as a function of load
These might be surge or flood elevations, peak ground accelera- is commonly called a fragility curve. The probability of the load is
tions, wind speeds, malicious intent, or the like. The performance combined with the fragility to generate probabilities of adverse
of the system under these loads is characterized by fragility, which performance. Consequences are then associated with adverse
is the probability of adverse performance conditioned on load performance

variability also leads to length effects, by which longer reaches have
PðconsequencesÞ ¼ PðconsequencesjperformanceÞ
a higher probability of failing somewhere than shorter reaches.
× PðperformancejloadÞ × PðloadÞ ð6Þ Failures that lead to a breach of the drainage basin perimeters
were associated with four principal failure modes: (1) levee or levee
The consequences of IPET included economic loss and potential foundation failure, (2) floodwall or floodwall foundation failure,
loss of life, and both of which were uncertain. (3) levee or floodwall erosion caused by overtopping and wave
The preHurricane Katrina protection system of New Orleans runup, and (4) failure modes associated with point features such
extended 350 miles. This perimeter was divided into 135 reaches as transitions, junctions, and closures. The performance team con-
and 197 structural point features. A reach was defined as a con- cluded that essentially no failures in the HPS originated in struc-
tinuous length of levee or wall exhibiting homogeneity of con- tural failure of the I-wall or T-wall components. The documented
struction, geotechnical conditions, hydrologic and hydraulic failures at I-wall and T-wall locations were almost all geotechnical,
loading conditions, consequences of failure, and possibly other with structural damage then resulting.
features relevant to performance and risk. A point feature was de- Four categories of engineering uncertainty were included in
fined as a structural transition, gate, pump station, drainage con- the reliability analysis: (1) geological and geotechnical uncertain-
trol structure, or other local discontinuity. A portion of the system ties involving the spatial distribution of soils and soil properties
definition near Lakefront Airport in New Orleans East is shown in within and beneath the reaches; (2) engineering mechanics uncer-
Fig. 10 (USACE 2008). This offered the opportunity to examine tainties, involving the performance of manmade systems such as
risk at the census block level or aggregated to subbasins, basins levees, floodwalls, and point features such as drainage pipes; and
(parishes), or system-wide levels. the engineering modeling of that performance, including geotech-
The frequencies of occurrence of surge and waves differ around nical performance modeling; (3) erosion uncertainties, involving
the HSDRRS. The IPET Hurricane Hazard Team developed new the performance of levees and fills around floodwalls during
statistical techniques based on numerical surge and wave models overtopping, and at points of transition between levees and flood-
to quantify these hazards. The model of hurricane occurrence used wall, in some cases leading to loss of grade or loss of support, and
a joint probability distribution of principal hurricane parameters to consequently to breaching; and (4) mechanical equipment uncer-
characterize the frequencies of storm events based on historical tainties, including gates, pumps, and other operating systems, and
storms in the Gulf of Mexico. An ensemble of about 2000 possible human operator factors affecting the performance of mechanical
hurricane tracks and characteristics (Fig. 11) was assembled and equipment.
combined with respect to individual storm probabilities to generate
hydrographs at individual reaches or point features around the pro-
Logic Trees
tection system (Fig. 12) (USACE 2009). This was judged to re-
present the range of storms that might strike New Orleans and An event tree approach was used on IPET (Fig. 14), as at Tonen, but
was used to generate the local threat at each reach expressed as now incorporating logic trees to simplify the separation of episte-
the annual probability of surge height. mic from aleatory uncertainties (Bommer and Scherbaum 2008;
Bommer 2012). The idea of logic trees is to separate out the epi-
stemic uncertainties due to lack of knowledge into their own tree
Fragility Curves and then to condition an event tree containing only aleatory uncer-
Geotechnical reliability was described by fragility curves that char- tainties on the respective branches of that epistemic logic tree
acterized the predicted performance of individual reaches or struc- (Fig. 15). This greatly simplifies the event tree calculations by
tures as a function of surge and wave levels. The fragility curves implicitly capturing the correlation structure among the aleatory
were generated from an evaluation of subsurface conditions, the events, which in the Tonen project had to be manually calculated
character of the structures, and relevant failure mechanisms defined and entered into the tree, an approach that may also overlook
previously by the IPET Performance Analysis Team. subtle correlations. The logic tree approach had the benefit of sepa-
There was neither time nor resources to reanalyze the many rating those uncertainties that can be reduced by collecting more
reaches and features. On the other hand, the New Orleans District data or improving models from those that cannot (Kiureghian and
US Army Corps of Engineers (USACE) maintained comprehensive Ditlevsen 2009).
historical design records and drawings, with some extending to the In hindsight, using event trees was not the best approach. The
creation of the District in 1803 (Fig. 13). These were used to number of end-nodes in the event trees was in the millions for each
approximate fragility curves for individual reaches based on herit- of the 76 storm scenarios used in the analysis. This caused com-
age data and engineering designs, often based on practical but ro- putation problems, reduced the number of scenarios that could be
bust methods such as first-order second-moment reliability (Duncan computed, and precluded interim results from being easily ex-
2000) or expert opinion. This provided what the team judged to tracted. Direct simulation using Monte Carlo might have been more
be reasonable fragility curves in a timely way, but obviously with powerful and cost-effective. In this case, a nested simulation ap-
less fidelity than a comprehensive reanalysis might have provided proach could have been used in which a simulation containing only
using a more modern analytical tool, which in any case was not the aleatory uncertainties is nested within an outer simulation con-
practicable. taining the epistemic uncertainties, as discussed below.
Failure was defined as breaching, which allowed water to enter a
protected polder. This failure occurred in two ways: (1) loss of
Putting Numbers on Engineering Judgment
levee or wall stability, or (2) overtopping causing the protected side
of the levee or wall to erode and breach (USACE 2007a, b; see The subjective probabilities of experts were critical to the analysis.
Table 1). The loading at which failure occurs varies along the reach Geotechnical engineers are true believers in the value of engineer-
and is not precisely known. Part of the uncertainty is due to episte- ing judgment to fill in for gaps in information or inadequacies
mic uncertainty in the average soil strength or average permeability of modeling and analysis. Peck (1980) famously championed this
along the reach, but another part is due to spatial variability within view. Yet human judgment is flawed, and a host of cognitive biases
the reach that was modeled as an aleatory uncertainty. The spatial are recognized as affecting how and how well people put numbers

Fig. 10. (Color) (a) NOLA East basin; and (b) corresponding reaches and point features as defined in the IPET8 study. (Reprinted from USACE 2008,
courtesy of US Army Corps of Engineers.)

Fig. 11. (Color) Ensemble of 76 hurricane scenarios. (Data from USACE 2008.)
Fig. 12. (Color) Modeled hydrographs for a particular hurricane at the 135 reaches around the hurricane protection system (USACE 2008). Surge
elevation is shown on the y-axis against time in days.
on their subjective uncertainty (Baecher 2019; Marr 2019, 2020; 2007 reconstruction conditions. Again, these were portrayed
Vick 2002). on probability-consequence charts, sometimes referred to today
as frequency-number (FN) charts (Fig. 16). The FN chart is a
Communicating Risk to the Public modern formalization of the concept behind Fig. 6. Here, it displays
Consequence data (property and life loss) were generated for each annual exceedance probabilities of risk to life for the preHurricane
storm scenario. The risk model generated probabilistic estimates Katrina and postreconstruction conditions. Similar results from the
of the extent and depth of inundation in each of the 27 polders. California Delta Risk Management Strategy (URS 2009) are shown
Inundation depths were used to interpolate property and life for comparison. The latter results tail off more quickly because the
loss estimates for prehurricane Katrina conditions and post population at risk is smaller.

Fig. 13. (Color) Sheet pile failure analysis by deep wedge instability from historical design files of the New Orleans District, USACE, for a specific
levee reach. (Reprinted from USACE 1972, courtesy of US Army Corps of Engineers.)
Table 1. Summary of engineering models used in calculating fragility curves

Failure mode Hazard Models and parameters Source of inputs Principal uncertainty
Static instability Still-water surge, weak Limiting equilibrium stability IPET5, soil test data, design Soil properties, still-water levels,
foundation soil’s memoranda, in situ surveys existing elevations, geotechnical
model
Under seepage Still-water surge, high Flown at calculations, IPET5, soil test data, design Soil properties, still-water levels,
permeability soil’s limiting equilibrium stability memoranda, in situ surveys existing elevations, geological
profile geometry
Still-water overtopping Still-water surge, Empirical correlations from IPET5 Still-water levels, soil fill
and scour erodible fill post Hurricane Katrina data properties, existing elevations,
scour model
Transition point feature Still-water surge, Empirical observations IPET5 Still-water levels, soil fill
erosion erodible fill during Hurricane Katrina properties, existing elevations,
scour model
Wave runup Wave heights and Empirical correlations and IPET4 Wave height and period, still-
periods, erodible fill model test results water levels, existing elevations
Sources: Data from USACE (2007a, b).
Fig. 14. (Color) Risk analysis logic diagram. (Adapted from USACE 2008.)

likely focused on a peculiar branch of statistics called, frequentism.
There is nothing incorrect with that sort of statistics, but it does not
apply to most uncertainties geotechnical engineers face. Frequentist
statistics has to do with aleatory variations of the sort found in gam-
bling, medical trials, or the national census. In contrast, geotech-
nical practice deals mostly with epistemic uncertainties, many
involving subjective judgment. Geotechnical practice involves pre-
dictions that are usually based on probabilistic characterizations of
uncertainties in states of nature, which are not admissible in fre-
quentist statistics. Dealing probabilistically with uncertainties in
states of nature requires a degree-of-belief (i.e., Bayesian) defini-
Fig. 15. Separation of epistemic uncertainty into a logic tree of tion of probability because of this inadmissibility.
epistemic uncertainties and a conditional inventory of aleatory
uncertainties.
Uncertainty about States of Nature
Two characteristics of Bayesian statistics make it fit for geotech-
nical use: it allows probabilities to be defined on states of nature
In recent years, the use of FN charts has become common
such as site conditions or engineering parameters, and it admits
in dam safety (ANCOLD 2003; FEMA 2015), industrial risk
subjective probabilities. Frequentist statistics allows neither.
(Jongejan 2008), and offshore engineering (Lacasse et al. 2019),
Frequentist and degree-of-belief statistics are not in conflict, they
among other fields. Criteria for tolerable societal risk have been
are just different. They use the same mathematical theory of
set by various organizations. Following recommendations by the
probability (Kolmogorov 1950) but differ in ways of defining un-
Australian-New Zealand Committee on Large Dams (ANCOLD
certainty (Baecher 2017). The distinction is philosophical but im-
2003) and others, these FN charts have sometimes been adopted
portant because it dictates how one draws inferences and makes
as guidelines for tolerable risk, although some organizations such
decisions.
as the Bureau of Reclamation explicitly do not use them for that
The distinction is illustrated in Fig. 17. A program of site char-
purpose (Reclamation 2011). These guidelines are typically orders
acterization results in observed data on soil engineering properties,
of magnitude lower than the risks existing along the Gulf coast or in
riverine flood hazard areas elsewhere in the United States (Fig. 16). the geometry of the subsurface, or other states of nature to be used
Riverine and coastal flood criteria in the United States have histor- in analysis and design. Frequentist statistics treats these states of
ically used a 1% annual exceedance probability as a criterion for nature as deterministic but unknown: in that theory, it is meaning-
insurance and risk mitigation. less to define probabilities on states of nature because those states
do not have frequencies. In frequentist statistics, it is the data that
are assigned probabilities, not the states of nature. Inferences are
Geotechnical Uncertainty II: Bayesian Thinking described as confidence bounds, p-values, and the like. These char-
acterize probabilities on what data might have been observed, not
The statistics course many of us took in college is mostly useless on the states of nature (Diaconis and Skyrms 2018; O’Hagan 2004).
for geotechnical practice—in the author’s opinion. That course These are direct probabilities.
Fig. 16. (Color) Calculated FN curves for IPET and in the California Delta Risk Management Project compared with ANCOLD (2003) criteria for
dam safety (USACE 2008).

existing target of the given description, but it fails to find anything.
The probability of the target existing undetected after exploration
can be logically updated using Eq. (7) to be
PðHÞPðdatajHÞ
PðHjdataÞ ¼
Fig. 17. (Color) Bayesian (inverse) probability versus frequentist PðHÞPðdatajHÞ þ ðH̄ÞPðdatajH̄Þ
(direct) probability. Bayesian probability takes the data as known and
ð0.5Þð1–0.3Þ
infers probabilities on the states of nature. Frequentist (direct) probabil- ¼ ¼ 0.4 ð9Þ
ity takes the states of nature as fixed but unknown and calculates con- ð0.5Þð1–0.3Þ þ ð0.5Þð1.0Þ
ditional probabilities on what data might result. Histogram colors
in which, H = geological detail exists; H̄ = geological detail does
suggest different data sets which might obtain.
not exist; Data = geological detail not found in exploration; PðHÞ =
prior probability geological detail exists; PðHjdataÞ = posterior
probability geological detail exists, given that it was not found;
In contrast, Bayesian statistics takes the data as known (i.e., they PðdatajHÞ = conditional probability of not finding the geological
have been observed) and calculates probabilities on the states of detail if it actually exists. There are many things to be learned from
nature that might have generated those data. Because probability this seemingly simple equation:
is interpreted as a degree-of-belief and not as a frequency, this is 1. First, data never speak for themselves. They only tell us how to
acceptable. These are inverse probabilities (Dale 1999). This is update from a prior probability (what we thought before seeing
neither new nor unintuitive to geoprofessionals, and most of us the data) to a posterior probability (what we should logically
are unwittingly Bayesians. de Mello (1975, 1977) was among think afterward). Lindley (1985) said, “today’s posterior is
the first to champion Bayesian ideas, although many others fol- tomorrow’s prior.”
lowed (Contreras 2020; Feng 2015; Gambino and Gilbert 1999; 2. Second, updating probabilities from priors to posterior is a
Garbulewski et al. 2009; Jiang et al. 2018, 2020; Juang and Zhang straightforward matter of multiplying the prior by the weight
2017; Kelly and Huang 2015; Papaioannou and Straub 2017; of evidence in the data. The weight of evidence is entirely con-
Phoon 2020; Schweckendiek 2014; Zhou et al. 2021). tained in this conditional probability of the data given the hy-
pothesis. The term of art for this conditional probability is the
likelihood.
Updating Probabilities 3. Third, at some point in history there are no data upon which to
Little is known about the eponymous Rev. Thomas Bayes (1701?– base a prior; therefore, the priors are ultimately a matter of
61) (Dale 2003). Even his likeness, which is pervasive in print and judgment and necessarily subjective.
on the web, is thought not to be him (IMS 1988). The person to 4. Fourth, this is the mathematics of learning by experience. It is
whom we owe the modern and more complete derivation of the the logic of Terzaghi’s (1961) observational approach.
theorem is Laplace (1749–1827). In the 20th century, the geophysi- Typically, the prior probability distributions in the Bayesian
cist Sir Harold Jeffreys (1891–1989) produced a long treatise on the equation are updated by site characterization, construction, and per-
inverse probability that remains in print today. This way of thinking formance data. The messiness of the mathematics of doing this up-
has a firm geoscience pedigree. dating through complicated engineering models for a long time
A simple modern representation of Bayes’ Theorem is impeded practical applications; however, the advent of numerical
methods like Markov chain Monte Carlo (MCMC) has facilitated
PðHÞPðdatajHÞ practical use (Robert and Casella 2010).
PðHjdataÞ ¼ ð7Þ
PðdataÞ Terzaghi proposed the “learn-as-you-go” approach. Peck (1969)
gave it the name, observational method. It is now an essential fea-
in which, H = some hypothesis (which could have to do with an ture of geotechnical practice. The environmental community calls
event, a probability distribution, or anything else about which one it, adaptive management. Einstein (1991) and Wu (2011) devel-
is trying to learn; PðHÞ = prior probability of the hypothesis; oped a quantitative Bayesian approach to the observational method,
PðHjdataÞ = posterior probability of the hypothesis, given the ob- as de Mello (1975) had also suggested.
served data; PðdatajHÞ = Likelihood of hypothesis based on the
data (i.e., the conditional probability of the data were the hypothesis
true); and PðdataÞ = marginal probability of the data irrespective of Site Characterization and Sampling
H (a normalizing constant).
The uncertainties of site characterization and their probabilities
The marginal probability of the data is readily found from the
are inverse probabilities. They are probabilities defined on states
total probability theorem as the weighted sum of the probability of
of nature, not probabilities on the data which are observed from
the data under the two respective hypotheses
those states. Hoek (1999) in the 2nd Glossop Lecture commented
PðdataÞ ¼ PðHÞPðdatajHÞ þ PðH̄ÞPðdatajH̄Þ ð8Þ that a geological model—conceptual, hand-drawn, or computer
rendered—is the building block upon which the design of any ma-
in which H̄ = complement, i.e., “not-H.” In more complicated jor construction project is based. It is principally the geological
applications, the normalizing constant is often determined model that generates the prior probabilities in Eq. (7). A recent ex-
numerically. ample of the importance of the geological model in interpreting the
Perhaps the simplest example is the well-studied question of statistics of deep-driven pile performance is provided by McGillivray
whether some geological detail exists at a site although undetected and Baecher (2021).
in exploration (Christian 2004). Presume that one believes that the One reads that site characterization is so uncertain because we
probability of such a detail exiting at the site before exploration is sample but a small fraction of the subsurface. This ignores statis-
performed was p ¼ 0.5. This might be a subjective judgment or tical science. Political polls in US elections sample but a tiny frac-
might be based on geological information. Perhaps a geophysical tion of the electorate, maybe 1,000 out of the 100 million who vote
survey has been undertaken with a p ¼ 0.3 chance of finding an nationally, or about 0.001% (FiveThirtyEight 2022). The inferential

uncertainty in sampling does not relate to the fraction sampled and meteorological hazards all affect the Canal. In addition, an
but to the number. A more dangerous error is what Tversky and engineered system of this scope faces chronic risks due to opera-
Kahneman (1971) call the law of small numbers. Most of us intui- tions, aging, and maintenance.
tively presume that the law of large numbers (that the properties of Important new lessons from the ACP project included (Alfaro
a sample asymptotically approach those of the universe from which et al. 2015)
they are taken as the sample size becomes large) applies to small 1. The power of qualitative risk appraisal to organize a systems risk
samples as well—which of course it does not. If we take a handful assessment,
of measurements, one is often surprised that the following meas- 2. The power of effective risk communication with manage-
urement is quite different from those already observed. One should ment, and
not be, it just reflects the variability within small samples. 3. The usefulness of scenario risk assessments.
An additional concern—mostly ignored—is whether a sample The Engineering Division of ACP had long used risk-informed
of measurements is chosen randomly. This is almost never the case thinking. An early example was its use of FN curves for communi-
in site characterization. Almost always the locations of sampling cating to management risks involved with its slope instrumentation
are what statisticians call purposive. That means the locations program for the Gaillard Cut (Fig. 19). This was but a few years after
are chosen on purpose for one of many reasons: spatial coverage, Whitman’s Terzaghi Lecture. The chart was used to communicate
least favorable places, or places that have the most influence on what the impact of a landslide control program could be on risks
design. In any event, a purposive sample is not a random sample. faced by the Authority and thus to justify a significant investment.
Why does random sampling matter? It matters because the pre- The natural and chronic risk assessment began with a qualitative
sumption of all statistical methods is that the data are random. risk register. The risk register categorized risks by type of asset at
If they are not random, then the statistical theory does not apply. the Canal (dams, locks, cuts, gates, power stations, water plants, and
The infamous Literary Digest poll in the 1932 election between others) and among various hazards (seismic, hydrologic, meteoro-
Landon and Roosevelt is a painful example (Lusinchi 2012). It logical, operational). The annual risks across the various asset types
predicted a Landon victory, while in the event, Landon won only and failure modes were compiled. Given the magnitude of these
Vermont and Maine. The nonrandom sample was taken from the risks, management considered two questions: (1) is a particular risk
magazine’s subscribers who were mostly wealthy. acceptable, and if not, and (2) how much must it be reduced or how
can it be managed? FN curves were used as a qualitative means of
Judgment versus Statistical Methods making these judgments.
Scientific and operations data were compiled to characterize
Casagrande avoided quantitative probabilities as did most of his risk, while reliability models were developed to translate those
contemporaries, choosing verbal descriptions such as “grave risk” data into actionable assessments. Risks were categorized as cata-
and “great uncertainties” instead. We know today that verbal strophic, significant, or moderate. The first set was modeled in
descriptions can be deceiving (Baecher 2019), and psychological detail; the others were managed operationally. The resulting prob-
research has demonstrated that intuition is a poor substitute for abilities and consequences were tracked to understand where risk
the laws of probability when evaluating uncertainty. Experts are remediation was called for. This comprehensive risk assessment
systematically overconfident in reporting uncertainty, ignore base allowed ACP to reduce risk while controlling costs.
rates (i.e., prior probabilities), disregard the variability of small
samples, believe in the Prosecutor’s Fallacy of reversed condition-
als (Aitken and Taroni 2004), and exhibit many other systematic Qualitative Risk
errors in reasoning about probabilities. These can all be dealt with
Beginning in 2011, a qualitative risk analysis was undertaken. The
but need to be understood.
project was divided into phases. The initial phase was the develop-
In a long set of experiments in the social sciences and medicine,
ment of a risk register. The risk register is a list of threats, facilities,
the American psychiatrist Paul Meehl (1954) and later the psy-
and facility components that might be affected by those threats
chologist Robyn Dawes (Dawes et al. 1989) demonstrated that even
and possible consequences if those threats occurred (Table 2).
simple statistical models like regression analysis significantly out-
The risk register has become a common tool in geotechnical engi-
perform clinical judgments. This was a precursor to the later work
neering, especially in underground construction. The risk registers
of Tversky and Kahneman. Recently, Morgenstern (2018) has
at ACP ran to 600 items across all asset classes, but these were
made a related suggestion concerning dam safety and risk, specifi-
cally in the relationship between empirically-driven and purely sub- reduced to a few dozen highly important risks that were then mod-
jective appraisals: “Whether precautionary or performance-based, eled and analyzed in detail.
or even utilizing subjective judgments based on experience, it is es- The purpose of the risk register was to identify as many signifi-
sential that the risk assessment process be constrained by evidence cant risks to the Canal infrastructure as possible and to rank those
and its evaluation to a higher degree than is currently the case.” risks for further analysis. The rank-ordering categorized risks into
three sets: (1) those that were thought to require further analysis and
possibly modeling to obtain quantitative assessments, (2) those
Panama Canal Natural and Chronic Risk that were significant and needed to be monitored but were thought
not deserving of detailed analysis, and (3) those that could be man-
The third project was the natural and chronic risk study—an enter- aged as part of normal operations. A qualitative risk rank was used
prise risk analysis—for the Panama Canal Authority (ACP) (2011– to compare the structures and components within the portfolio. The
2016), an attempt to quantify enterprise risk. The Panama Canal, development of a qualitative risk assessment required many work-
commissioned in 1914, is among the world’s iconic engineering ing sessions to develop categories of hazards and an inventory of
achievements (Fig. 18). The Canal transits 14,000 vessels a year critical infrastructure. ACP used its own subject matter experts in
carrying more than three percent of world maritime trade. In the multidisciplinary teams to assess the likelihoods and consequence
early 1900s, the Panama site was thought free of natural hazards and the partitioning and ordering.
and therefore favored over other crossings. History has changed In the qualitative phase, simple rankings were assigned to prob-
that appraisal, and it is now understood that seismic, hydrologic, abilities and consequences. Both the probability of the hazard and

Fig. 18. (Color) Critical infrastructure of the Panama Canal. (Image courtesy of Wikimedia Commons/Thoroe.)
the severity of consequence were ordinal-scaled from one to four.

This provided a starting point, but ordinal scales suffer many lim-
itations (Stevens 1946). Ratio scales with a true zero and defined
intervals were needed for both probability and for consequence
(Table 3). An attempt was made to anchor these semiquantitative
scales to events and outcomes with which ACP’s subject matter
experts were intuitively familiar.
Quantitative risk analysis was subsequently conducted using
the TVC approach. The hazards to which the Canal is exposed
were divided into three categories: natural, operational, and
malicious. The three most important natural hazards were seismo-
logical, hydrological, and geotechnical. A variety of others were
considered—hurricanes, tsunamis, tornadoes, and sedimentation—
but none led to catastrophic consequences. Operational hazards
were those that arise in the operations and maintenance of the
Canal and those due to aging. These included navigation incidents,
dredging and tug erosion, and time-related deterioration. The his-
torical record of adverse performances and failures suggested that
operational risks were significant for noncatastrophic outcomes.
Malicious anthropogenic hazards were the subject of a separate
study done by a separate branch of ACP.
Fig. 19. (Color) FN chart justifying the landslide control program

(LCP). 1 = slopes in Gaillard Cut (no LCP); 2 = slopes in Gaillard Risk Communication to Management
Cut (with LCP); and 3 = large igneous hills in Gaillard Cut. (L. D.
The performance of individual components was summarized either
Alfaro, personal communication, 1988, reproduced with permission.)
as a fragility curve associating a probability of failure with load,

© ASCE
Table 2. Part of the ACP risk registers for engineering and chronic risks
Type ID Event Description Component Failure mode Mode Failure cause P C
DAM Gatun Floods PMF Crest Erosion Erosion Overtopping 2 1
Upstream slope Erosion Erosion Spillway operation 1 5

Landslide Landslide Excess for when the pressure 3 5
Downstream slope Erosion Erosion Over topping 2 1
Landslide Landslide Excess pour water pressure 3 5
Landside abutment Erosion Erosion Water infiltration 3 5
Spillway abutment Erosion Erosion Overtopping from the spillway 1 5
Earthquake MCE Crest Erosion Erosion Overtopping due to settlement by 2 1
ground shaking
Upstream slope Landslide Landslide Large deformation due to liquefaction 2 5
Downstream slope Landslide Landslide Large deformation due to liquefaction 2 5
Landside abutment Deformation Deformation of section Settlement or slide due to liquefaction 3 5
Spillway abutment Deformation Deformation of section Settlement or slide due to liquefaction 3 5
Foundation Piping — Loss of material due to liquefaction or 2 1
hydraulic gradient
Aging Surrounding — Corrosion of outlet pipes and piping — — — —
structures — Deterioration of penstocks leading — — — —
to piping, erosion, slides
— Deterioration of pipes leading — — — —
to piping, erosion, slides
Seiche Large landslide Crest Erosion Overtopping by waves Overtopping from large waves 2 1
in lake Upstream slope Landslide Erosion due to wave action Erosion due to the cyclic action of waves 3 5
03023001-16
Rapid drawdown — Upstream slope Landslide Reduction of effective stresses Impact 1 1

Collision Service barge Upstream slope Impact Impact Overtopping 3 5
Hurricane — Crest Erosion Overtopping Excess pour water pressure 2 1
— Downstream slope Landslide Excess pore water pressure 3 5
Source: Data from Alfaro et al. (2015).
J. Geotech. Geoenviron. Eng.

Table 3. Semiquantitative scales for probability and for consequence
No. Verbal description Example Value
Probability
1 Very likely Small landslide, draft restrictions P > 0.1
2 Likely Landslides without controls P ¼ 0.1 to 0.01
3 Unlikely La Purisima 2010 P ¼ 0.01 to 0.001
4 Very unlikely Large earthquake P < 0.001
Consequence
1 Complete loss of navigation operations for more Loss of Gatun or Madden Dam >$10b
than a year
2 Impede operations for a long period (>1 year) or Extensive loss of toll revenue. Seriously compromise the $1–10b
create major direct or indirect economic cost reliability of important components
3 Impede operations for a short period (<1 year) or Moderate loss of toll revenue. Direct repair costs greater $500m-1b
moderate direct or indirect economic cost than $500m
4 Damages that affect canal capacity and revenues More than $100 m loss of toll revenue. Direct repair costs $100m–500m
greater than $100 m
5 Economic damages but the canal continues to Less than $100 m loss of toll revenue. Direct repair costs <100 m
operate less than $100 m. No impact on ACP reputation
Source: Data from Alfaro et al. (2016).
leading to discrete failure versus no-failure outcomes; or as a sys-

tems response curve, associating a performance indicator with load
(e.g., displacement, deformation, factor of safety). The correspond-
ing analyses were made using structural and geotechnical reliability
methods adapted to historical data. Consequences were divided into
three types: (1) direct cost, (2) lost revenues, and (3) implications
for the national economy. Due to the nature of the Canal, the eco-
nomic impact of adverse outcomes to the nation can in some cir-
cumstances be far greater than the direct damages. Only monetary
losses were considered.
Typical results for slope failures in the Gaillard Cut are shown in
Fig. 20. To the left-hand side are historical failures due to rainfall
and channel erosion. These are not catastrophic in that they
occur nearly every year and are managed by monitoring and main-
tenance, but they can be expensive. To the right-hand side are low
probability-high consequence risks associated with potential earth-
quakes. These are potentially catastrophic in that long sections of Fig. 20. (Color) Slope failures in the Gaillard Cut. Diamonds are
the slope might slide, possibly leading to a temporary closure of the “routine failures” due to rainfall and erosion. Crosses are Poisson-
Canal. The decision was made to separate catastrophic from routine lognormal approximations of historical failures. Triangles are the ap-
risks at a cost of USD 10 m. Although frequent and costly, slope proximations over ranges. Red squares are calculations of seismically
instabilities with consequences smaller than this were considered a induced failure probabilities due to ground acceleration (data from
necessary and historical cost of doing business. Alfaro et al. 2015). Tolerable risk lines are those of Fig. 6.
Scenario Risk
System simulation rather than detailed event trees was used to an earthquake would have cascading effects downstream at the
analyze risks. As had been learned in the IPET project, full- Pedro Miguel and Miraflores Locks, and the capacities of which
enumeration techniques like event trees become unwieldy for large might also have been compromised by the same earthquake. There
systems with many components and many uncertainties. Another may be nonlinear and even feedback effects within the larger sys-
benefit was also recognized, which was the utility of simulation for tem of assets. These interactions may be obvious in hindsight, but
modeling and understanding scenarios of risk simultaneously the system simulation may allow their identification ex ante by data
affecting large parts of the system. A large distributed system like mining of simulation results. This has been demonstrated in recent
the Canal comprises hundreds of assets including water retaining investigations including large-scale dam safety studies on the Göte
dams and dikes, navigation infrastructure, pumping facilities, elec- River system in Sweden (Ascila et al. 2015), the Cheakamus
trical generating stations, water treatment plants, and many others. System in British Columbia (King 2020), and the Lower Mattagami
These are mostly interconnected by the hydraulic system of water- River Project in Ontario (Zielinski 2021).
ways and structures. How does this large number of interacting
assets react to a unique natural hazard event—say, a large
earthquake—which simultaneously affects them all? An engineer- Geotechnical Uncertainty III: Safety
ing analysis of individual structures or components is clearly of
interest, but the adverse performance or failure of one may have How safe is safe enough? In Panama, the consequences of adverse
cascading effects on others (F. Nadim, personal communication, performance were mostly financial. This is not always the case with
2014). For example, the loss of a pool at Madden Dam during geotechnical risks. For example, in dam safety, life safety risk can be

significant, and the tradeoff between risk and mitigation is not simply while a reasonable and appealing concept, can be difficult to apply
financial. Portrayals of risk in the form of FN curves for this purpose in other than a qualitative way (FEMA 2015).
have become increasingly common. Whereas the projects that pre-
sented the visualization of risk were descriptive, caution is needed
in approaching FN charts as prescriptive. As Petroski (2011) has Spillway Systems Reliability
written, “Safe is not an engineering term;” it is social and political.
The fourth project was the Spillway Systems Reliability Project
FN charts are solid tools for illustrating and comparing risks, but
(SSRP) (2000–2016), a joint-industry effort of the large hydro-
one must be cautious when interpreting them as criteria. In Tonen,
power owners: British Columbia Hydro, Ontario Power Generation,
IPET, and ACP projects, situations were identified for which risks
the USACE, and Vattenfall AB. The goal was to consolidate
exceeded common tolerable criteria yet were willingly accepted for
existing knowledge on the reliability of spillway systems, develop
rational reasons. At Tonen, the project preceded modern criteria
an engineering basis for the assessment of safe discharge, establish a
and used benefit-cost thinking. At IPET, the 1%-flood criterion
methodology for spillway safety assessment, and prepare a systems-
common in US flood protection was legislated by the US Congress.
based guideline (Hartford et al. 2016). Important lessons from the

At ACP, the high risk of the Gaillard Cut slopes was deemed a
SSRP involved:
necessary cost of business.
1. The concept of emergent risk,
An FN chart for risk-to-life plots the exceedance probability of
2. Nested simulation, and
events leading to a number, N, of fatalities. The notion of risk-to-life
3. Operational safety and human factors.
criteria is sometimes attributed to the British nuclear establish-
The project was motivated in part by an observation that the
ment and the (UK) Health and Safety Executive (HSE 1992a),
traditional TVC concept of risk might not apply well to spillway
but careful reading suggests little quantitative guidance from those
reliability. The reason was that the demand on a spillway (the
agencies except on the magnitude of individual risk. HSE (2001)
“threat” in TVC) is not a simple load but is a function of the system;
suggests that existing risks to the individual should be on the order
it depends on things other than just the maximum reservoir inflow.
of 10−3 10−3 per annum for voluntary activities and 10−4 per annum
The traditional demand function mostly ignores operational and
for involuntary activities. The 10−4 per annum value is used in
system effects, including the interplay of human operators, modern
much of contemporary dam safety guidance (e.g., ANCOLD 2003).
sensors, and control systems. This realization was not an indictment
Individual risk pertains to the probability of harm to a single person;
of the risk-based approach but suggested a need to extend risk-
societal risk in contrast pertains to the probability of harm to groups
based techniques.
of people.
HSE notes, “It is not [ : : : ] for the regulatory authorities but for
Parliament and the public to weigh the benefits of [ : : : ] the risks we Emergent Risk
have outlined.” Morgenstern (2018) in his de Mello Lecture makes Many incidents and even failures of geotechnical systems occur not
a similar comment, “The vocabulary of ‘tolerable loss of life’ is because of simple extreme loadings but because of the interactions
provocative and should require stakeholder engagement as well of hazards, external disturbances, mechanical and electrical sys-
as special risk communication efforts before the criteria become tems, SCADA (supervisory control and data acquisition) systems,
legal regulations.” and human operators (Nelson 2009; Regan 2010). It is the interac-
The acceptability of risk due to natural hazards and accidents tions among these, influenced by organizational factors, training,
has been approached from many directions. Three are common: and management influences, that often contribute to incidents
(1) revealed preferences, acceptability may be compared to other and even failures. This can be seen in the recent Oroville (FERC
risks that people appear willing to accept; (2) stated preferences, 2018) and Edenville forensic reports and in National Performance
acceptability may be taken from people’s willingness-to-pay at the of Dams data (McCann 2008). The importance of such interactions
margin to reduce risks; and (3) benefit-cost analysis, acceptability is not unique to geotechnical systems but applies across the spec-
may be calculated by balancing monetized benefits including the trum of technological risks (Reason 1997; Leveson 2012).
statistical value of lives saved against monetized costs. The approach to the analysis and understanding of operational
A response within many regulatory agencies is to adopt a value of safety starts from the observation that the dominant risks to be
statistical life (VSL) for inclusion in benefit-cost analysis (Aldy and managed typically derive not from unique events but from adverse
Viscusi 2003). VSL is the marginal rate of substitution of income or combinations of more usual events. Hartford et al. called these,
wealth for mortality risk (i.e., for incremental change in risk), usu- “unusual combinations of usual conditions.” The timing of such
ally measured by willing to pay. Geotechnical engineers have been events and their magnitudes can create conditions for which the
reluctant to adopt VSL for fear of implying a “dollar value of life.” system had not been designed and which were not accounted
The same has been true in UK practice. This led in the latter instance for in preparing operational plans. The things that commonly enter
to a recognition that technological risks are seldom either safe or a linear probabilistic risk analysis (PRA) are the system inputs, an
unsafe, and the concept that if a risk is not so large as to be unac- engineering model, a set of disturbances, and the system outputs
ceptable, yet not so small that no further precaution is necessary, (Fig. 21). Disregarded are the many parts of the overall system that
then it should be “reduced to the lowest level practicable, bearing also influence safety (Rasmussen 1997; Perrow 2007). The result is
in mind the benefits flowing from its acceptance and taking into ac- that many systems failures do not fit within a simple TVC frame-
count the costs of any further reduction” (HSE 1992b). This is the As work and need to be simulated to identify behaviors that arise out of
Low as Reasonably Practicable principle (ALARP). the interactions among parts of the system. These behaviors are
ALARP seems an eminently reasonable idea, but its difficulties sometimes called “emergent” and are not easily identified ex ante.
are in its details. One detail is how to evaluate, practicable. Decompositional risk analysis tools such as failure-modes and ef-
Arguments have been made that this is a benefit-cost comparison: fects analysis, event trees, and fault tree analyses work well in PRA
what are the benefits of risk reduction and how do they sum relative but less well in uncovering systems behaviors.
to the costs of achieving them? That lands us in a circular argument For many applications in the natural sciences, social sciences,
involving VSL. ALARP seems a good idea, but its implementation and industry, simulation modeling has become a common tool for
remains problematic. The same applies to the safety case, which analysis and understanding. The use of large-scale stochastic

Fig. 21. (Color) Systems approach to spillway safety. (Adapted from Hartford et al. 2016; Leveson 2012; Rasmussen and Svedung 2000.)
simulation to study complex systems is now common in many sci- systematic uncertainties to be separately considered and the pos-
entific disciplines, especially when exploring questions that are sible correlations they generated to be accommodated implicitly.
poorly suited to traditional reliability analysis. Today, simulation A similar approach is possible with simulation. First, a simulation
approaches are used in fields as disparate as oil and gas exploration, model is developed containing only the aleatory uncertainties of
medicine, materials science, urban planning, and aerospace (NSF interest to the problem (Fig. 22). The probabilities of the aleatory
2006). Over the past decade, the US National Research Council has uncertainties are taken to be conditional on the values of the epi-
published more than a dozen reports on the use of simulation in stemic uncertainties. A second simulation loop of just the epistemic
engineering science (e.g., NRC 2002, 2008, 2010b). uncertainties is nested around the first aleatory loop. For each reali-
zation of the uncertainties in the epistemic loop, the aleatory loop is
iterated many times. Then, the epidemic loop is itself iterated many
Nested Simulation times. Finally, the two sets of results are combined. A similar ap-
A common way of approaching emergent behavior is by simula- proach was used by USACE in its risk analysis of the Herbert
tion. This might be using a Monte Carlo model, systems dynamics, Hoover Dikes (USACE 2014).
agent-based models, or one of many other similar approaches
(Gianni et al. 2018). Monte Carlo simulation of a rudimentary kind Human Factors
had been used on both Tonen and IPET. On Tonen, it was used to
A third thing that was learned on the SSRP was the importance of
extrapolate the relatively small event trees for individual patios to
human factors to operational safety. This has been emphasized in
the larger interactions among the many components of the entire
recent forensic investigations of dam incidents and failures (FERC
facility. On IPET, it was used to understand length effects on levee
2018, 2022) and has been discussed in specific detail by Alvi
reliability and to investigate combinations of failures (e.g., gate
(2013). Humans are tasked with making decisions and implement-
openings, levee penetrations, and structural discontinuities).
ing actions to operate a system in a safe and efficient way. This
The simulation approach goes beyond traditional reliability that
involves both cognitive and physical responses. Depending on the
considers ultimate geotechnical, structural, hydraulic, and other
event sequence, human errors can lead to consequences ranging
capacities treated separately to one that considers many simultane-
from minor to the shutdown of a facility or to failure. It is rea-
ous ways that a system can perform adversely (Hartford et al. sonable to incorporate human reliability in systems models as is
2016). There are good reasons for the increasing popularity of sim- routinely done in nuclear, oil and gas, and other hazardous indus-
ulation in risk analysis: simulation allows complex systems to be tries. This topic is beyond the scope of the present discussion, but
modeled easily and cheaply, computer speeds are increasing, dis- increasing attention is being paid to its importance.
crete events are readily included, interactions among differing types
of system response (e.g., physics of failure, communication and
control, and human reliability) can be represented, and the numeri- Path Forward
cal precision of simulation is often independent of the complexity
of the system being modeled. Geotechnical practice has come a long way in its use of risk and
It was observed on IPET and later in Panama that separating reliability thinking since Casagrande’s lecture in 1965. What started
epistemic and aleatory uncertainties in event tree analysis by using in the 1970s as relatively simple probabilistic versions of traditional
logic trees was powerful. This allowed model, parameter, and other design equations has evolved into risk analyses of large engineered

Fig. 22. (Color) Nested simulation for spillway safety. (Adapted from Komey 2018.)
systems, like those used in other engineering disciplines. These policy are needed. It seems inevitable that the observational
methods are now routinely applied to dam safety, large industrial approach, adaptive planning, and Bayesian methods of learning
projects, flood and coastal protection projects, offshore facilities, from experience will be a central part of that thinking.
and other large geotechnical works. They are used to inform infra- Another challenge is how society judges the tolerability of risk.
structure decisions, develop public policies, and ensure public safety. Today, life and safety risks posed by critical infrastructures vary by
The earlier Terzaghi Lectures of Casagrande, Whitman, and orders of magnitude. Regulatory agencies rely on the VSL, whereas
Christian each call out the importance of evaluated judgment in operating agencies rely on tolerable risks. Safety, however, is a so-
geotechnical practice. Data may seem objective, but they are al- cial and political question; engineering practice needs to develop
ways filtered through the lens of geology and experience. The cur- consistent and rational guidance.
rent generation of risk-informed tools that have evolved since those
lectures are consistent with that way of thinking, placing it on a
coherent conceptual footing. Data Availability Statement
Nonetheless, challenges remain. Among the most obvious chal-
lenges continues to be education. There remains confusion in prac- No data, models, or code were generated or used during the study.
tice over the nature of probability in geotechnical engineering and
the meaning of statements made about uncertainty. Whereas a ru-
dimentary understanding of probability and statistics has become Acknowledgments
necessary in most technical professions, it has languished in geo- This paper is dedicated to the memory of John T. Christian who died
technical engineering. Most practitioners appear to accept the fun- during its final editing. The author is indebted to a career-long col-
damentally subjective character of uncertainty in geotechnical laboration. The author is also indebted to the early workers in geo-
practice, and most apply some form of Bayesian thinking, inverse technical risk and reliability, many of whom he had the privilege of
probability, and observational methods whether or not done so working with and learning from. Among these are the MIT cadre
explicitly or even knowingly. from the 1970s and 80s (alphabetically): C. Allin Cornell, Herbert
We also face conceptual challenges. One is the increasing non- H. Einstein, Ronald C. Hischfeld, Charles C. Ladd, W. Allen Marr,
stationary of natural hazards. Whereas in the past the historical re- Erik Vanmarcke, Daniele Veneziano, and Robert V. Whitman. He is
cord could be extrapolated to predict the future; in a nonstationary similarly indebted to the many others who have influenced the sub-
world of climate change, the past may no longer be a prelude. sequent years and provided a review of this paper, among whom are:
Our forecasts of future hazards increasingly are functions of the Luis Alfaro, Tony Bennett, Karl Dise, Charles Dowding, Jerry
epistemic uncertainties of models and scenarios rather than the Foster, Gerald E. Galloway, Robert B. Gilbert, Fernando Guerra,
aleatory uncertainties of the historic record. Risk methodology Desmond N. D. Hartford, Suzanne Lacasse, Lewis (Ed) Link,
is up to the task, but new conceptual approaches to design and B. K. Low, Martin W. McCann, Ross McGillivray, Samuel G.

Paikowski, Robert C. Patev, K. K. Phoon, Timo Schwekendiek, Bommer, J. J. 2012. “Challenges of building logic trees for probabilistic
Nate Snorteland, Romanas Wolfsburg, Wilson Tang, T. H. Wu, seismic hazard analysis.” Earthquake Spectra 28 (4): 1723–1735.
Limin Zhang, and P. Andy Zielinski. The author also appreciates https://doi.org/10.1193/1.4000079.
the detailed suggestions of anonymous reviews of early versions Bommer, J. J., and F. Scherbaum. 2008. “The use and misuse of logic trees
in probabilistic seismic hazard analysis.” Earthquake Spectra 24 (4):
of this paper which have been drawn upon for its improvement.
997–1009. https://doi.org/10.1193/1.2977755.
Brown, E. T. 2012. “Risk assessment and management in underground
rock engineering—An overview.” J. Rock Mech. Geotech. Eng. 4 (3):
Notation 193–204. https://doi.org/10.3724/SP.J.1235.2012.00193.
Casagrande, A. 1965. “The role of the ‘calculated risk’ in earthwork and
The following symbols are used in this paper: foundation engineering.” J. Soil Mech. Found. Div. 91 (4): 1–40. https://
PðconsequencesÞ = probability of consequences; doi.org/10.1061/JSFEAQ.0000754.
PðdataÞ = marginal probability of data; Christian, J. T. 2004. “Geotechnical engineering reliability: How well do
we know what we are doing?” J. Geotech. Geoenviron. Eng. 130 (10):
PðdatajHÞ = likelihood of hypothesis given data;

985–1003. https://doi.org/10.1061/(ASCE)1090-0241(2004)130:10(985).
PðHjdataÞ = posterior probability of hypothesis; Christian, J. T., C. C. Ladd, and G. B. Baecher. 1994. “Reliability applied to
PðHÞ = prior (marginal) probability of hypothesis; slope stability analysis.” J. Geotech. Eng. 120 (12): 2180–2207. https://
PðloadÞ = probability of load; doi.org/10.1061/(ASCE)0733-9410(1994)120:12(2180).
PðpathÞ = the joint probability of events along a path Contreras, L. 2020. “Bayesian methods to treat geotechnical uncertainty
through an event tree; in risk-based design of open pit slopes.” Ph.D. thesis, School of Civil
Engineering, Univ. of Queensland.
Pðperfor manceÞ = probability of performance;
Dale, A. I. 1999. A history of inverse probability: From Thomas Bayes to
Vardata scatter = variance in soil parameter estimate due to Karl Pearson. New York: Springer.
data scatter; Dale, A. I. 2003. Most honourable remembrance: The life and work of
Varmeasurement bias = variance in soil parameter estimate due to Thomas Bayes. Studies and sources in the history of mathematics and
measurement bias; physical sciences. New York: Springer.
Varspatial = variance in soil parameter estimate due to Dawes, R. M., D. Faust, and P. E. Meehl, 1989. “Clinical versus Actuarial
spatial variation; Judgment.” Science 243 (4899): 1668–1674.
Varstatistical = variance in soil parameter estimate due to DeGroot, D., and G. Baecher. 1993. “Estimating autocovariance of in-situ
soil properties.” J. Geotech. Eng. 119 (1): 147–166. https://doi.org/10
statistical error;
.1061/(ASCE)0733-9410(1993)119:1(147).
Varsystematic error = variance in soil parameter estimate due to de Mello, V. F. B. 1975. “The philosophy of statistics and probability
systematic errors; applied in soil engineering, general report.” In Proc., 2nd ICASP, 63.
Vartotal = total variance in soil parameter estimate; Stuttgart, Germany: ICASP.
fx1 ; : : : ; xn g = individual uncertainties in an event tree; and de Mello, V. F. B. 1977. “Reflections on design decisions of practical sig-
θ = parameter. nificance to embankment dams, 17th Rankine Lecture.” Geotéchnique
27 (3): 281–355. https://doi.org/10.1680/geot.1977.27.3.281.
Diaconis, P., and B. Skyrms. 2018. Ten great ideas about chance.
Princeton, NJ: Princeton University Press.
References Duncan, J. 2000. “Factors of safety and reliability in geotechnical engineer-
ing.” J. Geotech. Geoenviron. Eng.126 (4): 307–316. https://doi.org/10
Aitken, C. G. G., and F. Taroni. 2004. Statistics and the evaluation of .1061/(ASCE)1090-0241(2000)126:4(307).
evidence for forensic scientists. Hoboken, NJ: Wiley. Einstein, H. H. 1991. “Observation, Quantification, and Judgment:
Aldy, J. E., and W. K. Viscusi. 2003. Age variations in workers’ value Terzaghi and Engineering Geology.” J. Geotech. Geoenviron. Eng.
of statistical life. Cambridge, UK: National Bureau of Economic 117 (11): 1772–1778. https://doi.org/10.1061/(ASCE)0733-9410(1991)
Research. 117:11(1772).
Alfaro, L. D., G. B. Baecher, F. Guerra, and R. C. Patev. 2015. “Assessing Faber, M. H. 2005. “On the treatment of uncertainties and probabilities in
and managing natural risks at the Panama Canal.” In Proc., 12th Int. engineering decision analysis.” J. Offshore Mech. Arct. Eng. 127 (3):
Conf. on Applications of Statistics and Probability in Civil Engineering, 243–248. https://doi.org/10.1115/1.1951776.
ICASP12. Vancouver, BC, Canada: Univ. of British Columbia. FEMA. 2015. Federal guidelines for dam safety risk management.
Alfaro, L. D., G. B. Baecher, F. Guerra, and R. C. Patev. 2016. ACP Washington, DC: FEMA.
physical risk management program. Balboa, Panama: Panama Canal Feng, X. 2015. “Application of Bayesian approach in geotechnical engi-
Authority. neering.” Ph.D. dissertation, Departamento de Ingeniería y Morfología
Allan, R. P., et al. 2021. IPCC, 2021: Summary for Policymakers. de, Universidad Politéchnica de Madrid.
Cambridge, UK: Cambridge University Press. Fenton, G. A., and D. V. Griffiths. 2008. Risk assessment in geotechnical
Alvi, I. 2013. “Human factors in dam failures.” In Proc., Association of engineering. Hoboken, NJ: Wiley.
State Dam Safety Officials Annual Conf. 2013, 778–788. Providence, FERC (Federal Energy Regulatory Commission). 2018. Independent
RI: ASDSO. forensic team report Oroville dam spillway incident. Washington, DC:
ANCOLD (Australian National Committee on Large Dams). 2003. Guide- FERC.
lines on risk assessment. Sydney, Australia: ANCOLD. FERC (Federal Energy Regulatory Commission). 2022. Independent foren-
Ascila, R., D. Hartford, and Z. A. Zielinski. 2015. Systems engineering sic team report, investigation of failures of Edenville and Sanford dams.
analysis of dam safety at operating facilities. Louisville, KY: USSD. Washington, DC: FERC.
Baecher, G. B. 2017. “Bayesian thinking in geotechnics (2nd Lacasse FiveThirtyEight. 2022. “Latest polls.” Accessed July 4, 2022. https://
Lecture).” In Geo-Risk 2017, 1–18. Denver: ASCE. projects.fivethirtyeight.com/polls/.
Baecher, G. B. 2019. “Putting numbers on geotechnical judgment.” In Proc., Gambino, S. J., and R. B. Gilbert. 1999. “Modeling spatial variability in
27th Buchanan Lecture Monograph. College Park, MD: Univ. of pile capacity for reliability-based design.” In Analysis, design, construc-
Maryland. tion, and testing of deep foundations, edited by J. M. Roesset, 135–149.
Baecher, G. B., and C. C. Ladd. 1997. “Formal observational approach to New York: ASCE.
staged loading.” Transp. Res. Rec. 1582 (1): 49–52. https://doi.org/10 Garbulewski, K., S. Jabłonowski, and S. Rabarijoely. 2009. “Advantage of
.3141/1582-08. Bayesian approach to geotechnical designing.” Ann. Warsaw Univ. Life

Sci.-SGGW Land Reclam. 41 (2): 83–93. https://doi.org/10.2478 Lambe and Associates. 1982. Earthquake risk to patio 4 and site 400.
/v10060-008-0052-z. Edited by R. V. Whitman, W. A. Marr, and G. B. Baecher. East
Gee, N. 2017. “The impact of dam failures on the development of dam Pepperell, MA: Lambe and Associates.
safety legislation and policy in the 1970s.” In Proc., Annual Meeting. Leveson, N. G. 2012. Engineering a safer world: Systems thinking applied
San Antonio: Association of State Dam Safety Officials. to safety. Cambridge, MA: MIT Press.
Gianni, D., A. D’Ambrogio, and A. Tolk. 2018. Modeling and simulation- Lindley, D. V. 1985. Making decisions. London: Wiley.
based systems engineering handbook. Boca Raton, FL: CRC Press. Link, L. E., and J. Harris. 2007. “Hurricane Katrina interagency perfor-
Hartford, D. N., and G. B. Baecher. 2004. Risk and uncertainty in dam mance evaluation task force.” In Proc., World Environmental and
safety. London: Thomas Telford. Water Resources Congress, 1–10. Tampa, FL: ASCE.
Hartford, D. N., G. B. Baecher, P. A. Zielinski, R. C. Patev, R. Ascila, and Lusinchi, D. 2012. “‘President’ Landon and the 1936 literary digest poll:
K. Rytters. 2016. Operational safety of dams and reservoirs. London: Were automobile and telephone owners to blame?” Soc. Sci. History
ICE Publishing. 36 (1): 23–54. https://doi.org/10.1017/S014555320001035X.
Høeg, K., and W. H. Tang. 1978. Probabilistic considerations in the foun- Marr, W. A. 2019. “Geotechnical judgment and risk, ASCE geo-institute
dation engineering for offshore structures. Oslo, Norway: Norwegian
seed medal lecture.” In Proc., ASCE Geocongress 2019. Philadelphia:

Geotechnical Institute. ASCE.
Hoek, E. 1999. “Putting numbers to geology—An engineer’s viewpoint.”
Marr, W. A. 2020. “Geotechnical judgement.” Geostrata Mag. 24 (1):
Q. J. Eng. Geol. Hydrogeol. 32 (1): 1–19. https://doi.org/10.1144/GSL
30–35. https://doi.org/10.1061/geosek.0000056.
.QJEG.1999.032.P1.01.
Marr, W. A., J. A. Ramos, and T. W. Lambe. 1982. “Criteria for settlement
HSE (Health and Safety Executive). 1992a. Safety assessment principles
of tanks.” J. Geotech. Eng. Div. 108 (8): 1017–1039. https://doi.org/10
for nuclear plants. London: HSE.
.1061/AJGEB6.0001326.
HSE (Health and Safety Executive). 1992b. The tolerability of risk from
Matheron, G. 1989. Estimating and choosing: An essay on probability in
nuclear power stations. London: HSE.
HSE (Health and Safety Executive). 2001. Reducing risks, protecting practice. Berlin: Springer-Verlag.
people—HSE’s decision making process. London: HSE. McCann, M. W. 2008. “National performance of dams program.” Accessed
IMS. 1988. “The Reverend Thomas Bayes, FRS (1701?-1761). Who is this February 6, 2020. http://npdp.stanford.edu.
gentleman? When and where was he born?” Inst. Math. Stat. Bull. McGillivray, R., and G. B. Baecher. 2021. Optimizing analysis of geotech-
17 (3): 276–278. nical data.” Fla. Eng. J. 8–25.
Jiang, S.-H., I. Papaioannou, and D. Straub. 2018. “Bayesian updating of Meehl, P. E. 1954. Clinical versus statistical prediction: A theoretical
slope reliability in spatially variable soils with in-situ measurements.” analysis and a review of the evidence. Northvale, NJ: Echo Point
Eng. Geol. 239 (May): 310–320. https://doi.org/10.1016/j.enggeo.2018 Books & Media.
.03.021. Modarres, M. 1993. What every engineer should know about reliability and
Jiang, S.-H., I. Papaioannou, and D. Straub. 2020. “Optimization of site- risk analysis. Boca Raton, FL: Taylor & Francis.
exploration programs for slope-reliability assessment.” ASCE-ASME J. Morgenstern, N. R. 2018. “Geotechnical risk, regulation, and public policy
Risk Uncertainty Eng. Syst. Part A: Civ. Eng. 6 (1): 04020004. https:// (Victor de Mello Lecture).” Soils Rocks 41 (2): 107–129. https://doi.org
doi.org/10.1061/AJRUA6.0001042. /10.28927/SR.412107.
Jones, A. L., S. L. Kramer, and P. Arduino. 2002. Estimation of uncertainty Nelson, P. P. 2009. Complex infrastructure systems. Wollongong, NSW,
in geotechnical properties for performance-based earthquake engineer- Australia: Univ. of Wollongong.
ing. PEER Rep. No. 2002/16. Berkeley, CA: Pacific Earthquake Engi- NRC (National Research Council). 1988. Post-challenger evaluation
neering Research Center, College of Engineering, Univ. of California, of space shuttle risk assessment and management. Washington, DC:
Berkeley. National Academies Press.
Jongejan, R. B. 2008. How safe is safe enough? The government’s response NRC (National Research Council). 2002. Modeling and simulation
to industrial and flood risks. Delft, Netherlands: Technical Univ. Delft. in manufacturing and defense acquisition: Pathways to success.
Juang, C. H., and J. Zhang. 2017. “Bayesian methods for geotechnical Washington, DC: National Academies Press.
applications—A practical guide.” In Geotechnical safety and reliability, NRC (National Research Council). 2008. Behavioral modeling and
215–246. Denver: ASCE. simulation: From individuals to societies. Washington, DC: National
Kaplan, S., and B. J. Garrick. 1981. “On the quantitative definition of Academies Press.
risk.” Risk Anal. 1 (1): 11–27. https://doi.org/10.1111/j.1539-6924 NRC (National Research Council). 2010a. Review of the department
.1981.tb01350.x. of homeland security’s approach to risk analysis. Washington, DC:
Kelly, R., and J. Huang. 2015. “Bayesian updating for one-dimensional National Research Council.
consolidation measurements.” Can. Geotech. J. 52 (9): 1318–1330.
NRC (National Research Council). 2010b. Simulation methods for reliabil-
https://doi.org/10.1139/cgj-2014-0338.
ity and availability of complex systems. Washington, DC: National
King, L. M. 2020. Using a systems approach to analyze the operational
Academies Press.
safety of dams. London, ON, Canada: Univ. of Western Ontario.
NRC (National Research Council). 2016. State of the art and practice in the
Kiureghian, A. D., and O. Ditlevsen. 2009. “Aleatory or epistemic? Does it
assessment of earthquake-induced soil liquefaction and its consequences.
matter?” Struct. Saf. 31 (2): 105–112. https://doi.org/10.1016/j.strusafe
.2008.06.020. Washington, DC: National Academies Press.
Kolmogorov, A. N. 1950. Foundations of the theory of probability (trans- NSF (National Science Foundation). 2006. Simulation-based engineering
lated from the 1933 version). Translated by N. Morrison. New York: science. Washington, DC: NSF.
Chelsea Pub. Co. O’Hagan, A. 2004. “Focus: Dicing with the unknown.” Significance 1 (3):
Komey, A. 2018. “A systems reliability approach to modeling operational 132–133.
risks in complex engineered systems.” Ph.D. dissertation, Dept. of Civil Papaioannou, I., and D. Straub. 2017. “Learning soil parameters and
and Environmental Engineering, Univ. of Maryland. updating geotechnical reliability estimates under spatial variability—
Krige, D. G. 1962a. “Statistical applications in mine valuation (1).” J. Inst. Theory and application to shallow foundations.” Georisk Assess. Man-
Mine Surv. South Afr. 12 (2): 45–84. age. Risk Eng. Syst. Geohazards 11 (1): 116–128. https://doi.org/10
Krige, D. G. 1962b. “Statistical applications in mine valuation (2).” J. Inst. .1080/17499518.2016.1250280.
Mine Surv. South Afr. 12 (3): 95–136. Peck, R. B. 1969. “Advantages and limitations of the observation method in
Lacasse, S., F. Nadim, N. Boylan, Z. Liu, and Y. J. Choi. 2019. “Risk applied soil mechanics.” Géotechnique 19 (2): 171–187. https://doi.org
Assessment and Management for Geotechnical Design of Offshore /10.1680/geot.1969.19.2.171.
Installations.” In Proc., Offshore Technology Conf. Houston: OnePetro. Peck, R. B. 1980. “Where has all the judgment gone?” Can. Geotech. J.
https://doi.org/10.4043/29398-MS. 17 (4): 584–590. https://doi.org/10.1139/t80-065.

Perrow, C. 2007. The next catastrophe: Reducing our vulnerabilities to hurricane protection system: Final report of the interagency perfor-
natural, industrial, and terrorist disasters. Princeton, NJ: Princeton mance evaluation task force. IPET5. Washington, DC: USACE.
University Press. USACE. 2008. Volume VIII: Engineering and operational risk and reli-
Petroski, H. 2011. “How safe is safe enough?” Accessed March 29, 2021. ability analysis in Performance evaluation of the New Orleans and
https://www.npr.org/2011/04/05/135145451/how-safe-is-safe-enough-to southeast Louisiana hurricane protection system: Final report of the
-engineers-it-depends. interagency performance evaluation task force. IPET8. Washington,
Phoon, K. K., and F. H. Kulhawy. 1999. “Characterization of geotechnical DC: USACE.
variability.” Can. Geotech. J. 36 (4): 612–624. https://doi.org/10.1139 USACE. 2009. A general description of vulnerability to flooding and
/t99-038. risk for New Orleans and Vicinity: Past, present, and future: Supple-
Phoon, K.-K. 2020. “The story of statistics in geotechnical engineering.” mental report of the interagency performance evaluation task force.
Georisk Assess. Manage. Risk Eng. Syst. Geohazards 14 (1): 3–25. Washington, DC: USACE.
https://doi.org/10.1080/17499518.2019.1700423. USACE. 2014. Herbert hoover dike hydrologic hazard assessment DRAFT.
Rasmussen, J. 1997. “Risk management in a dynamic society: A modelling Denver: USACE.
problem.” Saf. Sci. 27 (2–3): 183–213. https://doi.org/10.1016/S0925 USNRC (US Nuclear Regulatory Commission). 2016. WASH-1400 the re-
-7535(97)00052-0. actor safety study: The introduction of risk assessment to the regulation
Rasmussen, J., and I. Svedung. 2000. Proactive risk management in a dy- of nuclear reactors. Washington, DC: USNRC.
namic society. Karlstad, Sweden: Swedish Rescue Services Agency. Vanmarcke, E. H. 1977a. “Probabilistic modeling of soil profiles.” J. Geo-
Rausand, M., and S. Haugen. 2020. Risk assessment: Theory, methods, and tech. Eng. Div. 103 (11): 1227–1246. https://doi.org/10.1061/AJGEB6
applications. Wiley series in statistics in practice. Hoboken, NJ: Wiley. .0000517.
Reason, J. T. 1997. Managing the risks of organizational accidents.
Vanmarcke, E. H. 1977b. “Reliability of earth slopes.” J. Geotech. Eng.
Aldershot, UK: Ashgate Publishing Company.
Div. 103 (11): 1247–1265. https://doi.org/10.1061/AJGEB6.0000518.
Reclamation. 2011. Dam safety public protection guidelines (interim).
Vick, S. G. 2002. Degrees of belief: Subjective probability and engineering
Denver: US Bureau of Reclamation.
judgment. Reston, VA: ASCE.
Regan, P. 2010. Dams as systems—A holistic approach to dam safety.
Vrouwenvelder, A. C. W. M. 2003. “Uncertainty analysis for flood defense
Sacramento, CA: US Society on Dams.
systems in the Netherland.” In Proc., ESREL, European Safety and
Robert, C. P., and G. Casella. 2010. Monte Carlo statistical methods.
Reliability Conf. 2003, 11–18. Maastricht, Netherlands: A.A. Balkema
New York: Springer.
Schweckendiek, T. 2014. On reducing piping uncertainties—A Bayesian Publishers.
decision approach. Delft, Netherlands: Delft Univ. of Technology. Whitman, R. V. 1984. “Evaluating calculated risk in geotechnical engi-
Stevens, S. S. 1946. “On the theory of scales of measurement.” Science neering.” J. Geotech. Eng. 110 (2): 143–188. https://doi.org/10.1061
103 (2684): 677–680. /(ASCE)0733-9410(1984)110:2(143).
Terzaghi, K. 1961. “Past and future of applied soil mechanics.” J. Boston Wu, T. H. 1974. “Uncertainty, safety, and decision in soil engineering.”
Soc. Civ. Eng. 48: 110–139. J. Geotech. Eng. Div. 100 (3): 329–348. https://doi.org/10.1061
Tversky, A., and D. Kahneman. 1971. “Belief in the law of small numbers.” /AJGEB6.0000026.
Psychol. Bull. 76 (2): 105–110. https://doi.org/10.1037/h0031322. Wu, T. H. 2011. “2008 peck lecture: The observational method: Case his-
URS. 2009. Delta risk management strategy executive summary. tory and models.” J. Geotech. Geoenviron. Eng. 137 (10): 862–873.
Sacramento, CA: California Department of Water Resources. https://doi.org/10.1061/(ASCE)GT.1943-5606.0000509.
USACE. 1972. New Orleans east lakefront levee Paris road to south point, Yegian, M. K., and R. V. Whitman. 1978. “Risk analysis for ground failure
Lake Pontchartrain. Washington, DC: USACE. by liquefaction.” J. Geotech. Eng. Div. 104 (7): 921–938. https://doi.org
USACE. 2007a. Volume IV: The storm in Performance evaluation of the /10.1061/AJGEB6.0000672.
New Orleans and southeast Louisiana hurricane protection system: Zhou, W.-H., Z.-Y. Yin, and K.-V. Yuen. 2021. Practice of Bayesian prob-
Final report of the interagency performance evaluation task force. ability theory in geotechnical engineering. Singapore: Springer.
IPET4. Washington, DC: USACE. Zielinski, P. A. 2021. “Dams as complex systems.” In Proc., Annual Meet-
USACE. 2007b. Volume V: The performance levees and floodwalls in ing of the Canadian Dam Association, 12. Markham, ON, Canada:
Performance evaluation of the New Orleans and southeast Louisiana Canadian Dam Association.

Baecher 2023 2021 Terzaghi Lecture Geotechnical Systems Uncertainty and Risk

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Baecher 2023 2021 Terzaghi Lecture Geotechnical Systems Uncertainty and Risk

Uploaded by

Copyright:

Available Formats

Lecture

2021 Terzaghi Lecture: Geotechnical Systems,

© ASCE 03023001-1 J. Geotech. Geoenviron. Eng.

J. Geotech. Geoenviron. Eng., 2023, 149(3): 03023001

© ASCE 03023001-2 J. Geotech. Geoenviron. Eng.

J. Geotech. Geoenviron. Eng., 2023, 149(3): 03023001

© ASCE 03023001-3 J. Geotech. Geoenviron. Eng.

J. Geotech. Geoenviron. Eng., 2023, 149(3): 03023001

Importance of Autocorrelated Spatial Variation

© ASCE 03023001-4 J. Geotech. Geoenviron. Eng.

J. Geotech. Geoenviron. Eng., 2023, 149(3): 03023001

© ASCE 03023001-5 J. Geotech. Geoenviron. Eng.

J. Geotech. Geoenviron. Eng., 2023, 149(3): 03023001

© ASCE 03023001-6 J. Geotech. Geoenviron. Eng.

J. Geotech. Geoenviron. Eng., 2023, 149(3): 03023001

The Risk and Reliability Team initially involved 37 engineers

© ASCE 03023001-7 J. Geotech. Geoenviron. Eng.

J. Geotech. Geoenviron. Eng., 2023, 149(3): 03023001

© ASCE 03023001-8 J. Geotech. Geoenviron. Eng.

J. Geotech. Geoenviron. Eng., 2023, 149(3): 03023001

© ASCE 03023001-9 J. Geotech. Geoenviron. Eng.

J. Geotech. Geoenviron. Eng., 2023, 149(3): 03023001

© ASCE 03023001-10 J. Geotech. Geoenviron. Eng.

J. Geotech. Geoenviron. Eng., 2023, 149(3): 03023001

Table 1. Summary of engineering models used in calculating fragility curves

© ASCE 03023001-11 J. Geotech. Geoenviron. Eng.

J. Geotech. Geoenviron. Eng., 2023, 149(3): 03023001

© ASCE 03023001-12 J. Geotech. Geoenviron. Eng.

J. Geotech. Geoenviron. Eng., 2023, 149(3): 03023001

© ASCE 03023001-13 J. Geotech. Geoenviron. Eng.

J. Geotech. Geoenviron. Eng., 2023, 149(3): 03023001

© ASCE 03023001-14 J. Geotech. Geoenviron. Eng.

J. Geotech. Geoenviron. Eng., 2023, 149(3): 03023001

the severity of consequence were ordinal-scaled from one to four.

Fig. 19. (Color) FN chart justifying the landslide control program

© ASCE 03023001-15 J. Geotech. Geoenviron. Eng.

J. Geotech. Geoenviron. Eng., 2023, 149(3): 03023001

Upstream slope Erosion Erosion Spillway operation 1 5

Rapid drawdown — Upstream slope Landslide Reduction of effective stresses Impact 1 1

J. Geotech. Geoenviron. Eng., 2023, 149(3): 03023001

leading to discrete failure versus no-failure outcomes; or as a sys-

© ASCE 03023001-17 J. Geotech. Geoenviron. Eng.

J. Geotech. Geoenviron. Eng., 2023, 149(3): 03023001

based guideline (Hartford et al. 2016). Important lessons from the

© ASCE 03023001-18 J. Geotech. Geoenviron. Eng.

J. Geotech. Geoenviron. Eng., 2023, 149(3): 03023001

© ASCE 03023001-19 J. Geotech. Geoenviron. Eng.

J. Geotech. Geoenviron. Eng., 2023, 149(3): 03023001

© ASCE 03023001-20 J. Geotech. Geoenviron. Eng.

J. Geotech. Geoenviron. Eng., 2023, 149(3): 03023001

PðdatajHÞ = likelihood of hypothesis given data;

© ASCE 03023001-21 J. Geotech. Geoenviron. Eng.

J. Geotech. Geoenviron. Eng., 2023, 149(3): 03023001

seed medal lecture.” In Proc., ASCE Geocongress 2019. Philadelphia:

© ASCE 03023001-22 J. Geotech. Geoenviron. Eng.

J. Geotech. Geoenviron. Eng., 2023, 149(3): 03023001

© ASCE 03023001-23 J. Geotech. Geoenviron. Eng.

J. Geotech. Geoenviron. Eng., 2023, 149(3): 03023001

You might also like