David S. Bowles

RAC

Engineers & Economists
Who is using risk assessment?

 Reclamation ~ 1995

 Federal Energy Regulatory Commission (FERC) 

for PFMA ~ 2002

 Planned introduction of RA (dual path likely) ~ 

2015

 Corps of Engineers (USACE) – dams & levees ~ 

2007

 USA – Tennessee Valley Authority (TVA) ~ 2011

 Some states

 Many other countries ....
Uses of risk assessment:

 Risk-informed approach

 Informing decisions about:

 Understanding existing risks

 Failure modes, probabilities and consequences

 the extent and type of risk reduction

 Structural, non-structural

 the urgency, priority and phasing of risk-reduction 

measures

 Informing business processes
Regulation of US dams

Federal dams – selfregulated

Hydropower dams –

most regulated by 

FERC (and the States)

Other dams – most 

regulated by the States
Trend in regulatory and 

governance

 Related to incorporation of risk approach into 

regulation

 From standards-setting + process to goal-setting + 

process e.g. NSW DSC:  Principle C.1: the DSC’s approach is practicable goals-based regulation and it sets its 

safety objectives accordingly

 Principle E.3: safety improvements required by the DSC may be implemented 

progressively ...

 Similar trend in governance of dam safety by owners 

that are using risk:  Reclamation & USACE: a) defined portfolio risk management process, b) emphasize 

“making the case” for safety in contrast to meeting standards, and c) re-evaluation of 

which standards are “essential”

 UK dam owner – rate case, in-house committee, “extra-practice” risk reduction 

measures not required by “regulator” but to meet safety goals

5
Outline

 Risk assessment process

 Steps in the process

 Example of results format

 Long dams – levees

 Uncertainty

 Conclusions
ICOLD Bulletin 130 terminology

Differs slightly from USACE/OMB terminology
Scoping 

& Risk

Identification

(PFMA)

The process of determining 

a) what can go wrong, why 

and how, and b) its 

consequences

FOUNDATION 

for RA
Failure

Modes 

Identification

PFMA

Risk Analysis

Risk 

Estimation

The process of quantifying risk: 

probability (f) and consequences ($, N)
Failure 

Modes 

Identification

PFMA

Risk Analysis

Risk Assessment

Decision Recommendation

Risk 

Estimation

Risk

Evaluation

The process of examining and judging 

the significance of the risk

Using 

TOLERABLE 

RISK 

GUIDELINES
Failure 

Modes 

Identification

PFMA

Risk Analysis

Risk Assessment

Decision Recommendation

Dam Safety Risk Management

Decision-Making

Risk 

Estimation

Risk

Evaluation

Risk

Control

- Structural

- Recurrent 

activities

- Periodic 

Reassessment

Scoping and Risk Identification

1) Decisions

• Existing reservoir

• Scope of potential risk management actions: Investigations | Surveillance, monitoring and measurement 

improvements, supervision and management | Interim/immediate risk reduction measures |Long-term risk 

reduction options | Non-structural risk reduction measures 

2) Decision context • Standards and good practice | Stakeholders | safety and Economic Regulators | Owner (governance, 

insurance, contractual, legal, etc.) | Societal concerns | Environmental | Critical infrastructure and national 

defence

3) Team composition and roles – stakeholders

4) Decision criteria/guidelines

• Accepted good practice | Tolerability of risk incldg. ALARP | Additional decision bases (owner & stakeholders)

5) Level of confidence desired for decision making

6) Define Reservoir System

7) Types of threats and (credible and significant) failure modes

8) Types of consequences

9) Define Risk Model Requirements and approach to uncertainty
Hazards – System Response - Consequences
Identification of Potential Failure 

Modes

 Deductive approach:

 Systematic decomposition of dam into components

 Identification of the functional interdependencies between all 

components over a complete range of magnitudes of all types of 

threats (initiating events/types of loading)

 Resources lists of threats and potential failure modes

 Use outcomes of Engineering Assessment against good practice 

BUT think beyond traditional analyses

 Inductive approach

 Lateral thinking

 Brain storming 

 Uncommon, unique or odd ball failure mode
Dam-reservoir System External 

Threats

Floods

Earthquakes

Internal 

Threats

High uplift pressures

Karst features in 

foundation

Inadequate or no 

filter

Breach 

Outcome

Non-Breach 

Outcome

System Response

Failure modes identification

Components

(Roles & Interdependencies)

Risk 

Management 

Analyses & 

Investigations

Design & 

Construction

Performance 

Indicators

Condition & 

Adequacy Site – good practice

Inspection

Evidence
Dam-reservoir System

Dam-reservoir system 

Hardware

• Reservoir

• Hillsides

• Dam(s)

• Abutments

• Foundations

• Appurtenances

• Equipment

• Instrumentation

• Communications

• Other features 

relevant to safe 

operation

Software - manuals, 

logic, procedures & 

software 

• Operations & 

maintenance 

• Monitoring & 

surveillance 

• Inspection 

• Automated or 

remote control of 

operations

• Inflow flood 

forecasts

• Management 

systems 

• Decision protocols

Liveware - Human factors

• Operations & maintenance

• Monitoring & surveillance

• Supervision & inspection

• Management – on & off site

Components

(Roles & Interdependencies)
“Resource lists”
Tolerability of Risk – Tolerable Risk Guidelines
Tolerability of Risk Framework 

(HSE 2001)

Increasing Individual Risk and Societal Concerns

Unacceptable 

Risk Region

Tolerable Risk 

Region

Broadly 

Acceptable 

Risk Region
Risk

 The probability of 

undesirable 

consequences

 Probability of an 

uncontrolled release of 

the contents of a 

reservoir

 Probability of 

consequences to life, 

health, property, or 

the environment of 

dam failure (NPP effects)

Increasing Individual Risk and Societal Concerns

Unacceptable 

Risk Region

Tolerable Risk 

Region

Broadly 

Acceptable 

Risk Region
General basis for reducing risk

Equity

Legal Liability - ALARP

Economic Efficiency (BCR) 

Increasing Individual Risk and Societal Concerns

Unacceptable 

Risk Region

Tolerable Risk 

Region

Broadly 

Acceptable 

Risk Region
TOLERABLE RISK REGION

 People are prepared to accept 

risk in the Tolerable Region to 

secure benefits (1) provided 

that:

 Not so low as to be broadly acceptable 

(2)

 Confident risks are being properly 

assessed and managed (3)

 Residual risks are periodically reviewed 

and, if appropriate, are further reduced 

to ensure that they remain as low as 

reasonably practicable (ALARP) (4)

 Tolerable risk not defined 

simply by a line

 Determined by on-going 

management not just design 

considerations

Increasing Individual Risk and Societal Concerns

Unacceptable 

Risk Region

Tolerable Risk 

Region

Broadly 

Acceptable 

Risk Region
ALARP

 Optioneering: “One accepts 

options, not risks” Fischhoff et 

al. (1981) 

 Affordability not considered  Consider risk transfers  E.g. d/s to u/s for dam raise  Accepted good practice RISK 

INFORMED

 Disproportionality of 

incremental cost to incremental 

risk reduction benefit (BCR 

goal < 1.0, e.g. 0.1 – 0.33, Ford 

Pinto class action ~ 1.0)

 Ultimately matter of judgment  Considers societal concerns

Increasing Individual Risk and Societal Concerns

Unacceptable 

Risk Region

Tolerable Risk 

Region

Broadly 

Acceptable 

Risk Region
USACE Individual Risk (IR) Limit = 1 in 10,000 /yr

 Probability of life loss for the 

most exposed individual

 IR = APF*Prob (Exposure|Failure) 

*Prob(Life Loss|Exposure&Failure)

Unacceptable 

Risk Region

Tolerable Risk 

Region

Broadly 

Acceptable 

Risk Region
USACE Societal Risk Limit

 A probability distribution (F-N 

chart) of the number of 

fatalities in the entire 

Population at Risk 

Increasing Individual Risk and Societal Concerns

Unacceptable 

Risk Region

Tolerable Risk 

Region

Broadly 

Acceptable 

Risk Region
Reclamation (2011) dam safety risk 

guidelines chart

• Different to an F-N chart

• Annual Probability of failure (APF) guideline is 

horizontal line at 1 in 10 000/year

– Originally based on Reclamation portfolio failure rates

– Now referred to as a substitute for an individual risk 

guideline

• Annualized Life Loss (ALL) guideline is sloping 

line at 0.001 lives/year 

• Reference lines not limits

– generally target about an order below sloping line

• value on horizontal axis is a weighted 

average or expected value of life loss computed 

as ALL/APF. 

– Averaging is over all initiating events or loading types, all 

intervals of loading magnitude, all failure modes and all 

exposure combinations. 

– Life loss estimates for each combination are weighted by 

the likelihood that each combination will occur.

N

N

N
USACE Adequately Safe Dam: DSAC V

1) Meets all essential 

USACE engineering

guidelines, 

2) With no unconfirmed 

dam safety issues, AND

3) With tolerable residual 

risk (including ALARP)

RISK INFORMED

Tolerable Risk 

Region

Broadly 

Acceptable 

Risk Region

Increasing Individual Risk and Societal Concerns

Unacceptable 

Risk Region

Decision - Logic Tree – Event Tree – Consequences 

Tree Tree

With Uncertainty

30

Day 

Night

 Decision – States of Nature – System Performance – Consequences

Alternatives Loading & & Exposure 

 System Response 

Decision tree

Do Nothing 

Alt 1

Alt 2

...

Alt n

 Introduction

 DAMRAE 

Background

 Uncertainty 

version 

DAMRAE-U

 Decision Tree 

– Logic Tree –

Event Tree 

 Simulation 

Types

 Example RA

 Summary

Benjamin and Cornell 1970

Fail

No-Fail

E.g. - Flaw exists or does not exist

 - Extent of liquefiable zone

Benefit: Can separate (knowledge) uncertainty about Existing 

Condition (States of Nature) from other uncertainties (loading SRP, 

consequences) 
Application of Event Trees 

• Separate trees for each type of initiating event:

 e.g. Floods & Earthquakes

 Independent & additive (fTotal = fFlood + f Earthquake)

 Joint occurences

• Branches at chance nodes can represent 

 System responses of the dam system to loading sequences

 Human actions and interventions - timeliness and 

effectiveness

 Emergency response and factors affecting survival in flooding

 Continuously operating or standby systems – e.g. spillway gates
Flood 

Event 

Tree

Flood 

Loading 

Branches

Failure 

Mode 

Branches

65

67

69

71

73

75

77

79

81

83

85

87

1 0.1 0.01 0.001 0.0001 0.00001 0.000001 0.0000001 1E-08

Peak Reservoir Stage (m)

Annual Exceedance Probability

Peak Reservoir Stage

Before Emergency Spillway With Emergency Spillway Dam Crest
Flood 

Event 

Tree

Flood Loading 

Branches ~ 

different 

numbers of 

spillway gates 

working

Failure 

Mode 

Branches

Number of Gates 

Failing to Open 

at a Time (r)

Total Probability 

of Failure to 

Open of r Gates 

at a Time

0 0.932 

1 0.056 

2 0.001 

3 0.000 

5 0.010 

Main Dam Spillway

65

67

69

71

73

75

77

79

81

83

85

87

1 0.1 0.01 0.001 0.0001 0.00001 0.000001 0.0000001 1E-08

Peak Reservoir Stage (m)

Annual Exceedance Probability

Peak Reservoir Stage

Before Emergency Spillway With Emergency Spillway Dam Crest
Flood 

Event 

Tree

Failure 

Mode 

Branches

Flood Loading 

Branches ~ 

different 

numbers of 

spillway gates 

working Exposure 

Branches ~ 

Day/Night

Consequences 

Branches ~ 

Life Loss & 

Economic 

Losses

Implications of risk approach 

for specifying flood hazards:

 Entire probability distribution of reservoir inflow floods up to 

and exceeding PMF 

 Joint probability distribution of reservoir inflow floods and 

downstream floods needed where downstream consequences are 

affected by flows originating downstream of the reservoir that is 

being evaluated. 

 Higher dimensional joint probability distributions needed in cases 

where multiple reservoirs exist in the same catchment such that spatial 

and temporal correlations. 

 Continuous simulation may be needed for large basins with 

multiple reservoirs where there can be a range of combinations of 

storage levels or for reservoirs or lakes that have limited discharge 

capacity relative to inflow flood volumes, especially where these lakes 

are subject to significant wind effects. 

36
Primary 

Loading 

Variables

1) Stillwater 

elevation (E)

2) Peak annual 

wind speed (Sn) 

normal to the dike

Loading Variables for Failure Modes

Peak Annual Wind Speed for 2 

seasons & 8 directions

Stillwater Stage-duration for 

2 wind seasons
Primary 

Loading 

Variables

1) Stillwater 

elevation (E)

2) Peak annual 

wind speed (Sn) 

normal to the dike

3) Average 

overwash 

discharge rate

4) Peak 

overtopping 

discharge rate

5) Peak setup 

elevation

6) Max setup with 

min duration for 

piping 

Max significant 

wave height and 

wave period 

Wave transformation model STWAVE and wave run-up and overwash rates 

from Automated Coastal Engineering System (ACES) for E and Sn combinations 

Overwash FM Embank Slope Instability FM All Piping FMs

Overtopping FM Flood Wall Instability FM

Secondary 

Loading 

Variables

Loading Variables for Failure Modes
Coincident Reservoir Loading
Earthquake Loading

 Peak ground acceleration 

(PGA) vs. annual exceedance 

probability (AEP) based on a 

site-specific hazard, or 

 USGS Ground Motion 

Parameter Calculator for 

latitude and longitude:

 http://earthquake.usgs.gov/rese

arch/hazmaps/design/

 Generally, Hard Rock option 

used in central and eastern 

US and Firm Rock option in 

western US.
Earthquake Loading

 Most likely magnitude (mode 

or Mhat) can be used for risk 

assessment unless 

performance is magnitude 

dependent such as for 

liquefaction.

 A deaggregated relationship 

for statistical mean and 

modal sources using USGS 

Banded Deaggregation tool:

 http://eqint.cr.usgs.gov/deaggba

nd/2002/index.php

(Ruthford et al 2011)
Coincident Pool for Earthquake Loading

 Stage-duration based on 

current operating rules 

for existing dam

 Extended to rare floods

 Modify if changes in 

operating rules are to be 

evaluated as a risk 

reduction measure

 Use seasonal stageduration relationships if 

significant differences in 

consequences with season

0

5

10

15

20

25

30

35

0.000% 0.001% 0.010% 0.100% 1.000% 10.000% 100.000%

ELEVATION NAVD88

Percent of Time Exceeded

SYNTHETIC HISTORIC FINAL

LAKE OKEECHOBEE DURATION, AUG-OCT

(Hadley, Fischer and Foley 2011)

(Bowles et al 2010)
Fragilities
Estimating system response probabilities

1) Observed frequencies

 Mass-produced mechanical and electrical components

 May need to adjust for operating and environmental differences

 Historic data on internal erosion failures and incidents (E.g. UNSW, 

USACE Internal Erosion Toolbox)

 Adjustment of historical frequencies for site-specific factors using Bayes’ 

theorem and judgment

2) Reliability analysis

 Deriving a distribution of interest from distributions on 

other variables (e.g., Taylor series expansion or Monte 

Carlo simulation)

 Distribution of Factor of Safety from distributions of strength 

parameters
Estimating system response 

probabilities

3) Subjective probability

 Expert elicitation

 Must be evidence based

4) Fault Trees

 E.g. spillway gate reliability
Focus on life loss
Life-Loss Consequences

1) Semi-Empirical 

 USBR (Graham 1999)

 Flood severity, Flood severity understanding and Warning time

 Evacuation not separately considered

2) Spatially-Distributed Dynamic Simulation

 HEC FIA (Simplified LIFESim)

 No traffic modeling and no consideration of velocity effects 

 LIFESim – USU for USACE

 External flood simulation →Fate of buildings (shelters) 

→Warning and evacuation (traffic modeling)→Loss of 

life/survival

 Uses readily available GIS data (HAZUS)

 Provides estimates with uncertainty

 LSM - BC Hydro

 Tracks individuals

Risk Analysis Calculations

 Precision Tree

 Not ideal for dam safety applications

 @Risk for uncertainty analysis

 Spreadsheets

 Inflexible, inefficient and fragile

 DAMRAE (USACE, TVA, RAC)

 RAC/USU for USACE

 More efficient than Precision Tree and Spreadsheets

 Free to federal agencies

 Commercial licenses and training for consultants 

starting in 2013

 DAMRAE-U with uncertainty analysis under 

development
Percent 

of Total

Percent 

of Total

Percent 

of Total

(/year) (year) (-) (lives/year) (-) ($/year) (-)

BASE RUN:

Existing Dam

OT Failure 1.33E-04 1 in 7,519 17% 4.43E-03 20% 1,172 17%

Spillway Wall OT Failure 3.67E-04 1 in 2,725 46% 1.36E-02 60% 3,231 46%

Lq Sec Failure 2.99E-04 1 in 3,344 37% 4.68E-03 21% 2,634 37%

7.99E-04 1 in 1,252 100% 2.27.E-02 100% 7,037 100%

Annualized Economic 

Consequences

Run

Tolerable Risk Limit 

Guidelines Evaluation 

Summary

Failure Mode

Probability of Failure (APF) Annualized Life Loss 

(ALL)

Probability of 

Failure (APF) No

Individual Risk No

Societal Risk No

Annualized Life 

Loss (ALL) No

Existing Dam Results 

Percent 

of Total

Percent 

of Total

Percent 

of Total

(/year) (year) (-) (lives/year) (-) ($/year) (-)

BASE RUN:

Existing Dam

OT Failure 1.33E-04 1 in 7,519 17% 4.43E-03 20% 1,172 17%

Spillway Wall OT Failure 3.67E-04 1 in 2,725 46% 1.36E-02 60% 3,231 46%

Lq Sec Failure 2.99E-04 1 in 3,344 37% 4.68E-03 21% 2,634 37%

7.99E-04 1 in 1,252 100% 2.27.E-02 100% 7,037 100%

Annualized Economic 

Consequences

Run

Tolerable Risk Limit 

Guidelines Evaluation 

Summary

Failure Mode

Probability of Failure (APF) Annualized Life Loss 

(ALL)

Probability of 

Failure (APF) No

Individual Risk No

Societal Risk No

Annualized Life 

Loss (ALL) No

Flood NP

Earthquake NP

Normal Operating P

Summary Engineeirng 

Assessment

50
Risk-reduction – structural

Initial Stage (0): Base Case

Stage 1: Spillway Widening

Stage 2: Earthquake Fix

Alt 1.1: Raise Dam and Spillway Walls Alt 1.2: Spillway Widening

Alt 2.1 Alt 2.2

Alternatives

Stages
Percent 

of Total

Percent 

Reduction

Percent 

of Total

Percent 

Reduction

Percent 

of Total

Percent 

Reduction

($M/year) (/year) (year) (-) (-) (lives/year) (-) (-) ($M/year) (-) (-)

BASE RUN:

Existing Dam

OT Failure 1.33E-04 1 in 7,519 17% 4.43E-03 20% 0.001 17%

Spillway Wall OT Failure 3.67E-04 1 in 2,725 46% 1.36E-02 60% 0.003 46%

Lq Sec Failure 2.99E-04 1 in 3,344 37% 4.68E-03 21% 0.003 37%

7.99E-04 1 in 1,252 100% 2.27.E-02 100% 0 100%

RISK REDUCTION RUN:

Stage 1 - Spillway widening

 1.827 OT Failure 1.14E-05 1 in 87,719 4% 91% 3.88E-04 8% 91% 0.000 4% 91%

1 Spillway Wall OT Failure 0.00E+00 1 in - 0% 100% 0.00E+00 0% 100% - 0% 100%

1 0.002 Lq Sec Failure 2.99E-04 1 in 3,344 96% 0% 4.68E-03 92% 0% 0.003 96% 0%

1

1

4 Moderate 16.66 

## 1 1

## 1 1

## 6 1

## 20 4 3.10E-04 1 in 3,222 100% 61% 5.07.E-03 100% 78% 0.003 100% 61%

26 5.35382017

Annualized Life 

Loss (ALL) No

Disproportionality 

Ratio (R) Societal Risk No

Societal Risk No

Annualized Life 

Loss (ALL) No

Probability of 

Failure (APF) No Benefit/ 

Cost Ratio

Individual Risk No

Individual Risk No

Probability of 

Failure (APF) No

Run

Cost as 

Annualized 

Cost

USACE Tolerable Risk 

Guidelines Evaluation 

Summary: Part 1) Limit 

Guidelines

USACE Tolerable Risk 

Guidelines Evaluation 

Summary: Part 2) 

ALARP Justification 

for Risk Reduction

Failure Mode

Probability of Failure (APF) Annualized Life Loss (ALL) Annualized Economic 

Consequences

Alt 1.2 (Stage 1): Spillway Widening

Plots contain: 

1) Existing 

Dam; 2) Alt 1.1: 

Raise Dam and 

Spillway Walls; 

and 3) Alt 1.2 

(Stage 1): 

Spillway 

Widening

Percent Reduction calculated from previous stage 

i.e. Stage 0: Existing Dam

Flood P

Earthquake NP

Normal Operating P

Summary Engineeirng 

Assessment

52
Risk-reduction – structural

Initial Stage (0): Base Case

Stage 1: Spillway Widening

Stage 2: Earthquake Fix

Alt 1.1: Raise Dam and Spillway Walls Alt 1.2: Spillway Widening

Alt 2.1 Alt 2.2

Alternatives

Stages
Percent 

of Total

Percent 

Reduction

Percent 

of Total

Percent 

Reduction

Percent 

of Total

Percent 

Reduction

($M/year) (/year) (year) (-) (-) (lives/year) (-) (-) ($M/year) (-) (-)

RISK REDUCTION RUN:

Stage 1 - Spillway widening

 1.827 OT Failure 1.14E-05 1 in 87,719 4% 91% 3.88E-04 8% 91% 0.000 4% 91%

1 Spillway Wall OT Failure 0.00E+00 1 in - 0% 100% 0.00E+00 0% 100% - 0% 100%

1 0.002 Lq Sec Failure 2.99E-04 1 in 3,344 96% 0% 4.68E-03 92% 0% 0.003 96% 0%

1

1

4 #NAME? 16.66 

## 1 1

## 1 1

## 6 1

## 20 4 3.10E-04 1 in 3,222 100% 61% 5.07.E-03 100% 78% 0.003 100% 61%

## #NAME?

RISK REDUCTION RUN:

Stage 2 - Earthquake Fix

 4.6 OT Failure 1.14E-05 1 in 87,719 71% 0% 3.88E-04 84% 0% 0.000 72% 0%

1 Spillway Wall OT Failure 0.00E+00 1 in - 0% 0.00E+00 0% - 0%

1 0.001 Lq Sec Failure 4.59E-06 1 in 217,865 29% 98% 7.17E-05 16% 98% 0.000 28% 98%

1

1

4 #NAME? 159.74 

## 1 1

## 1 1

## 6 1

## 20 4 1.60E-05 1 in 62,539 100% 95% 4.60.E-04 100% 91% 0.000 100% 95%

## #NAME?

Probability of Failure (APF) Annualized Life Loss (ALL) Annualized Economic 

Consequences

Run

Cost as 

Annualized 

Cost

USACE Tolerable Risk 

Guidelines Evaluation 

Summary: Part 1) Limit 

Guidelines

USACE Tolerable Risk 

Guidelines Evaluation 

Summary: Part 2) 

ALARP Justification 

for Risk Reduction

Failure Mode

Annualized Life 

Loss (ALL)

YesALARP?

Disproportionality 

Ratio (R) Societal Risk YesALARP?

Probability of 

Failure (APF)

YesALARP? Benefit/ 

Cost Ratio

Individual Risk YesALARP?

Annualized Life 

Loss (ALL) No

Disproportionality 

Ratio (R) Societal Risk No

Probability of 

Failure (APF) No Benefit/ 

Cost Ratio

Individual Risk No

Stage 2: Earthquake Fix

Plots contain: 

1) Stage 0: 

Existing Dam; 

2) Stage 1 (Alt 

1.2): Spillway 

Widening; and 

3) Stage 2: 

Earthquake Fix 

Percent Reduction calculated from previous stage 

i.e. Stage 1 (Alt 1.2): Spillway Widening

Percent Reduction calculated from previous stage 

i.e. Stage 0: Existing Dam

Flood P

Earthquake P

Normal Operating P

Summary Engineeirng 

Assessment

54

 A Logical Set of Arguments...

 Recommending additional safety-related action is justified, or no 

additional safety-related action is justified. 

 The case is convincing when owners or regulators 

sense that the following are coherent:

 the dam's existing condition and ability to withstand future loading, 

 the risk estimates, 

 and the recommended actions.

 Numbers are not the sole basis for decision-making

 Address the sensitivity (uncertainty) ... to key 

parameters ... and recommended actions

Recommend and make the case for 

a decision

Nate Snorteland – USSD 2010
Length Effects
Length Effects are different to shifts in 

geotechnical conditions

 the issue of length effects is related to the degree of spatial correlation in these 

properties rather than that the soils are classified to be the same or to have similar 

properties.

 “correlation” here refers to an expected tendency for the failure of more than 

one adjacent CSR to occur during the same loading event combination and

within the same geotechnical conditions. 
Length 

Effects

Probability of failure for n CSRs assuming 

independent failure modes (DeMorgan):

P(System failure) = 1 - ∏ k=1,n (1-pk)

= 1 – (1-p1)*(1-p2)* ... *(1-pn)

assuming dependent failure modes:

P(System failure) = Max k=1,n(pk)

0 10 20 30 40 50

Perfectly Uncorrelated (r1=0)

0 10 20 30 40 50

Moderately Correlated (r1=0.65)

0 10 20 30 40 50

Highly Correlated (r1=0.9)

0 10 20 30 40 50

Perfectly Correlated (r1=1.0)

7

4

2

0
Length 

Effects

Probability of failure for n CSRs assuming 

independent failure modes (DeMorgan):

P(System failure) = 1 - ∏ k=1,n (1-pk)

= 1 – (1-p1)*(1-p2)* ... *(1-pn)

assuming dependent failure modes:

P(System failure) = Max k=1,n(pk)

0 10 20 30 40 50

Perfectly Uncorrelated (r1=0)

0 10 20 30 40 50

Moderately Correlated (r1=0.65)

0 10 20 30 40 50

Highly Correlated (r1=0.9)

0 10 20 30 40 50

Perfectly Correlated (r1=1.0)

7

4

2

0

All failure modes 

considered 

independent at the 

CSR level (1,600 feet) 

except piping through 

foundation
Length 

Effects

Probability of failure for n CSRs assuming 

independent failure modes (DeMorgan):

P(System failure) = 1 - ∏ k=1,n (1-pk)

= 1 – (1-p1)*(1-p2)* ... *(1-pn)

assuming dependent failure modes:

P(System failure) = Max k=1,n(pk)

0 10 20 30 40 50

Perfectly Uncorrelated (r1=0)

0 10 20 30 40 50

Moderately Correlated (r1=0.65)

0 10 20 30 40 50

Highly Correlated (r1=0.9)

0 10 20 30 40 50

Perfectly Correlated (r1=1.0)

7

4

2

0

All failure modes 

considered 

independent at the 

CSR level (1,600 feet) 

except piping through 

foundation – used 

average of dependent 

& independent cases
Charlwood, Bowles, Muller, Regan & Halpin – Trends in US Dam Safety – ICOLD 2007 62

Risk Management: 

Examples of Long Dam/ 

Levee System Risk Profiles

Individual Risk (/year)

Tolerable Risk Limit (1 in 10,000/yr)

Life Loss (lives)

Probability of failure (/year)

Societal Risk

Tol Risk Limit

64

 Introduction

 DAMRAE 

Background

 Uncertainty 

version 

DAMRAE-U

 Simulation 

Types

 Example RA

 Summary

Simulation Types

Event 

Tree

 APF, ALL, etc

Event 

Tree

 APF, ALL, etc

Logic 

Tree

Event 

Tree

 APF, ALL, etc

Logic Tree

Event 

Tree APF, ALL, etc

 Deterministic Mode • INPUTS: Natural variabilities in 

loading, SRPs & consequences

• INPUTS: No (knowledge) uncertainties

• RESULTS: Only natural variabilities

Uncertainty Mode

 Event Tree (ET) Simulation (Type-0)

• INPUTS: Natural variabilities in 

loading, SRPs & consequences

• INPUTS: ET uncertainties 

• RESULTS: Lumps uncertainties & 

natural variabilities 

 Logic Tree (LT)-Event Tree Type-I 

Simulation

• INPUTS: Separates uncertainties into 

LT (Existing condition) and ET 

variables

• RESULTS: Lumps LT & ET 

uncertainties and natural variabilities 

Logic Tree-Event Tree Type-II

Simulation

• INPUTS: Separates uncertainties into 

LT and ET variables

• RESULTS: Separates LT (Existing 

condition) uncertainties into separate 

curves of ET uncertainty and natural 

variabilities
65

0

10

20

30

40

50

60

70

80

90

100

1.E-06 1.E-05 1.E-04 1.E-03 1.E-02 1.E-01 1.E+00

Percentiles

Total Probability of Failure (/year)

USACE Tolerable Risk Limit Base Condition Risk Reduction Measure

0

10

20

30

40

50

60

70

80

90

100

1.E-06 1.E-05 1.E-04 1.E-03 1.E-02 1.E-01 1.E+00

Percentiles of Uncertainty in Event 

Tree

Total Probability of Failure (/year)

95th Percentile

0

20

40

60

80

100

1.E-06 1.E-05 1.E-04 1.E-03 1.E-02 1.E-01 1.E+00

Percentiles of 

Uncertainty in Logic 

Tree

Total Probability of Failure (/year)

 Introduction

 DAMRAE 

Background

 Uncertainty 

version 

DAMRAE-U

 Simulation 

Types

 Example RA -

Results

 Summary 0

10

20

30

40

50

60

70

80

90

100

1.E-06 1.E-05 1.E-04 1.E-03 1.E-02 1.E-01 1.E+00

Percentiles of Uncertainty in Event 

Tree

Total Probability of Failure (/year)

95th Percentile

0

20

40

60

80

100

1.E-06 1.E-05 1.E-04 1.E-03 1.E-02 1.E-01 1.E+00

Percentiles of Uncertainty 

in Logic Tree

Total Probability of Failure (/year)

Results: Annual Probability of Failure (APF)

Type I 

simulation

Type II 

simulation

Piping Risk Reduction Measure

Variability and 

Knowledge 

uncertainty in 

Event Tree

Existing condition uncertainty (piping elevation threshold) in Logic Tree

Base Condition

Tolerable Risk Limit 1 

in 10,000 /year
66

0

10

20

30

40

50

60

70

80

90

100

1.E-05 1.E-04 1.E-03 1.E-02 1.E-01 1.E+00

Percentiles

Total Annualized Incremental Life Loss (lives/year)

USACE Tolerable Risk Limit Base Condition Risk Reduction Measure

0

10

20

30

40

50

60

70

80

90

100

1.E-04 1.E-03 1.E-02 1.E-01 1.E+00

Percentiles of Uncertainty in Event 

Tree

Total Annualized Incremental Life Loss (lives/year)

95th Percentile

0

20

40

60

80

100

1.E-04 1.E-03 1.E-02 1.E-01 1.E+00

Percentiles of 

Uncertainty in Logic 

Tree

Total Annualized Incremental Life Loss (lives/year)

0

10

20

30

40

50

60

70

80

90

100

1.E-05 1.E-04 1.E-03 1.E-02 1.E-01 1.E+00

Percentiles of Uncertainty in Event 

Tree

Total Annualized Incremental Life Loss (lives/year)

95th Percentile

0

20

40

60

80

100

1.E-05 1.E-04 1.E-03 1.E-02 1.E-01 1.E+00

Percentiles of 

Uncertainty in Logic 

Tree

Total Annualized Incremental Life Loss (lives/year)

 Introduction

 DAMRAE 

Background

 Uncertainty 

version 

DAMRAE-U

 Simulation 

Types

 Example RA -

Results

 Summary

Results: Annualized life loss estimates (ALL)

Type I 

simulation

Type II 

simulation

Piping Risk Reduction Measure

Variability and 

Knowledge 

uncertainty in Event 

Tree

Existing condition uncertainty (piping elevation threshold) in Logic Tree

Base Condition

Tolerable Risk Limit 

0.001 lives/year
67

1.E-08

1.E-07

1.E-06

1.E-05

1.E-04

1.E-03

1.E-02

1.E-01

1 10 100 1,000 10,000

Annual Probability of Failure (APF), 

f

Average Incremental Life Loss, Ñ

f-Ñ Chart

0.001 Lives/yr

APF = 1 in 10,000 

(0.0001) per year

Low Probability -

High Consequence 

Events

Initial Stage

ii) 98.4%

iii) 0.10%

i) 1.50%

1.E-08

1.E-07

1.E-06

1.E-05

1.E-04

1.E-03

1.E-02

1.E-01

1 10 100 1,000 10,000

Annual Probability of Failure (APF), 

f

Average Incremental Life Loss, Ñ

f-Ñ Chart

0.001 Lives/yr

APF = 1 in 10,000 

(0.0001) per year

Low Probability -

High Consequence 

Events

Risk Reduction 

Measure

ii) 19.4%

iii) 80.6%

i) 0.00%

0%

10%

20%

30%

40%

50%

60%

70%

80%

90%

100%

0 10 20 30 40 50 60 70 80 90 100

Confidence as Percent Exceedance

Percentiles of Uncertianty in Logic Tree

APF ≥1 in 10,000 APF<1 in 10,000 AND ALL ≥0.001

APF<1 in 10,000 AND ALL<0.001

0%

10%

20%

30%

40%

50%

60%

70%

80%

90%

100%

0 10 20 30 40 50 60 70 80 90 100

Confidence as Percent Exceedance

Percentiles of Uncertianty in Logic Tree

APF ≥1 in 10,000 APF<1 in 10,000 AND ALL ≥0.001

APF<1 in 10,000 AND ALL<0.001

 Introduction

 DAMRAE 

Background

 Uncertainty 

version 

DAMRAE-U

 Simulation 

Types

 Example RA -

Results

 Summary

Region i) APF≥1 in 10,000

Does not meets APF TRG

Type II 

simulation

Type I 

simulation

Base Condition Piping Risk Reduction Measure

Knowledge uncertainty (piping elevation threshold) in Logic tree

Region ii) APF<1 in 10,000 

and ALL≥0.001

Meets APF but not ALL TRG

Region iii) APF<1 in 10,000 

and ALL<0.001

Meets APF & ALL TRG

Results: f-Ñ Charts (APF, f vs Average Life Loss, Ñ)

Variability and Knowledge 

uncertainty in Event Tree
68

1.E-08

1.E-07

1.E-06

1.E-05

1.E-04

1.E-03

1 10 100 1,000 10,000

Annual Probability of Incremental Life Loss, 

F≥N

Incremental Life Loss, N

F-N Chart

5th Percentile

50th Percentile

95th Percentile

Limit of 

Tolerability for 

Existing Dams

1.E-08

1.E-07

1.E-06

1.E-05

1.E-04

1.E-03

1 10 100 1,000 10,000

Annual Probability of Incremental Life Loss, 

F≥N

Incremental Life Loss, N

F-N Chart

5th Percentile

50th Percentile

95th Percentile

Limit of 

Tolerability for 

Existing Dams

0%

10%

20%

30%

40%

50%

60%

70%

80%

90%

100%

0 10 20 30 40 50 60 70 80 90 100

Confidence in Meeting Societal Risk 

Guidelines

Percentiles of Uncertainty in Event Tree

Base Condition Risk Reduction Measure

 Introduction

 DAMRAE 

Background

 Uncertainty 

version 

DAMRAE-U

 Simulation 

Types

 Example RA -

Results

 Summary Type II 

simulation

Base Condition Piping Risk Reduction Measure

Type I 

simulation

Variability and 

Knowledge 

uncertainty in Event 

Tree

Knowledge uncertainty (piping elevation threshold) in Logic tree

Results: F-N Charts (AEP, F vs Life Loss, N)

Variability and Knowledge 

uncertainty in Event Tree

Information for assessing external 

hazards at NPPs

 Flood hazard characterization

 at all upstream dams and intervening areas below last dam and NPP 

 Dam performance

 full range of hazards including reliability of discharge facilities (e.g. spillway 

gates, effects of debris and ice, etc.)

 Dam breach modeling for all failure modes

 Flood routing and inundation modeling

 for full range of no-breach and breach floods

 Performance of “perimeter” flooding protection (IA)

 e.g. levees, closures, etc.

 Characterization of flooding risk at NPP (IA)

 all flooding paths

 All relevant flooding attributes and effects

 peak elevations, time for EM, residual reservoir storage, power generation after dam 

failure, time for emergency measures)
Some areas for improvement

 More systematic use of Failure Modes Identification

 Better risk assessment scoping and risk model 

formulation

 Length effects

 PFHA

 System response probability estimation

 Reliability of discharge facilities (spillway gates)

 Software designed for dam safety RA – e.g. DAMRAE

 Better consideration of uncertainties

 Effect on Non-breach/Non-failure risk

 “Making the case” to decision makers – deliberative 

process

 Better integration with owner’s business including 71
Home Page (including links to selected papers):

http://uwrl.usu.edu/people/faculty/bowles.html