Dam safety, emergency action plans and water alarm systems

The modern era of dam construction in Switzerland started some 135 years ago and came to a virtual standstill in the 1970s. Since then very few new large dams have been built. However, two major arch dams have been heightened and several dams have been rehabilitated. The average age of the existing large dams is about 50 years (Figure 1). Typically, the concession period for hydro power projects is 80 years; therefore, several of the older power plants – mainly run-of-river plants – have been rehabilitated for the renewal of the concession. The expected service life of the rehabilitated power plants will be 160 years. They must satisfy the current design criteria and safety standards.

Besides ageing, the main concerns are flood and earthquake safety where safety criteria apply today, which were not applicable at the time of construction of most existing storage dams. The prerequisite for a long service life is the structural safety of the dams and appurtenant structures.

As a rule of thumb, the service life of a dam is as long as proper maintenance can be guaranteed. This means the service life can be very long. However, this will not be the case if a dam is no longer maintained and monitored, as is demonstrated by the 272m high Enguri arch dam in Georgia, which was not maintained during civil war and unrests at the time of independence in the early 1990s. This dam – the world’s highest arch dam – has shown that the safety of a dam may deteriorate very fast and even a new dam may become potentially unsafe within a few years.

The service life of a well-designed, well-constructed and well-maintained and monitored embankment and concrete dam can easily reach 100 years. But some elements such as gates and valves may have to be replaced after 40 to 50 years. The service life of electro-mechanical equipment and electronic control units is much shorter and some components may have to be exchanged as frequently as office computers as they may become technologically outdated and maintenance may no longer be available.

In the present paper the integral safety concept for large dams is discussed, which includes four major elements: structural safety, monitoring safety, operational safety, and emergency planning. The first three safety elements are well-known. However, much less is known about emergency planning, because alarm systems and evacuation of the population are often under the control of military or civil defense authorities. The reason for this is that dams are possible targets in case of war and terrorists are interested in targets with high damage potential.

Dam safety in Switzerland

Legal and administrative aspects of dam safety

The Swiss Federal Law Regarding Water Police of 22 June 1877 stipulates: “The Federal Council will ensure that the necessary steps will be taken with existing and future storage installations to avoid, as far as possible, dangers and damage resulting from the existence of the installation, from insufficient maintenance or from the effects of war.”

Based on this law a dam safety regulation was established. The present dam safety regulation has been in force since 1 January 1999, and is a revision of former regulations (Mouvet et al., 2001). The applicability of the dam safety regulation to a specific dam is based on geometric criteria (dam height and reservoir volume) and the damage potential in the downstream region (inundated area).

The regulation defines the duties of the different parties involved in dam safety, i.e. dam safety authorities, dam owners, dam engineers, and dam experts. To facilitate the application of the present dam safety regulation, the following guidelines were issued by the dam safety authority:

1. Criteria for dams subjected to dam safety regulations.

2. Structural safety of dams.

3. Safety of dams against floods.

4. Safety of dams against earthquakes.

5. Monitoring and maintenance of dams.

The supervision of the larger dams, i.e. dams with an impounding head of more than 25m, or dams with an impounding head of more than 15m and a storage capacity of at least 50,000m³, or dams with an impounding head of more than 10m and a storage capacity of at least 100,000m³, or dams with a storage capacity of at least 500,000m³, is carried out by the federal dam safety authority which employs specialised dam engineers. The safety of small dams is the responsibility of the cantons (provinces).

The safety authority examines and approves new dam construction projects, as well as projects to rehabilitate existing dams. Therefore, the owner has to submit the project drawings, the analysis and design reports, and the results of the geotechnical and hydrologic investigations to the authority for approval. The construction work may not start before approval of the final design has been given.

During construction it performs inspections and checks compliance with the approved plans. All findings are placed on record.

The initial impounding of a dam requires the authorisation of the dam safety authority.

During operation of the dam the authority supervises the surveillance organisation of the owner, of the experienced engineer and of the experts.

The reports of the experienced engineer (yearly) as well as the expert’s appraisals (five-yearly) on condition and behaviour of the dam are immediately notified to the dam safety authority.

If monitoring or inspections call for remedial actions, they have to be carried out immediately.

Basic elements of dam safety concept

The two main goals of every safety concept are the minimisation of all risks, and the mastering of the remaining risk in the best possible way (Biedermann 1997). To reach these goals a comprehensive dam safety concept was introduced in Switzerland comprising the following elements: (i) structural safety, (ii) dam monitoring and dam maintenance, and (iii) emergency planning.

i) Structural safety

Minimization of the risks calls for an appropriate design and construction of the dam. This means that the design (design criteria and design concepts) should be periodically reviewed to ensure that the structural safety will be guaranteed according to the state-of-the-art. Figure 2 shows the Sefid Rud buttress dam in Iran, which experienced much stronger earthquake actions than originally assumed in the design. The seismic design criteria and methods of dynamic analysis used for the design of the dam are considered obsolete today.

ii) Dam monitoring and dam maintenance

Risks can be minimized but never totally eliminated even if a dam has been designed and constructed according to the latest state of knowledge. Therefore, it is necessary to detect any signs of abnormal behaviour, damage, deficiencies in structural safety, and new types of threats and hazards etc. as quickly as possible, so that corrective measures can be taken in time. In order to achieve this, periodic inspections of the dam, as well as periodic safety evaluations, are needed. The purpose of the periodic inspections is to monitor the actual behaviour of the dam. The periodic safety evaluations are used for control of the long-term behaviour as well as for verification of the structural safety. The dam surveillance system used in Switzerland is shown in Table 1. The responsibilities of the different parties involved in dam surveillance and dam safety monitoring are as follows:

• Dam owner: The dam owner has to maintain the dam in good condition. For this purpose he establishes an organization to monitor and maintain the dam. The technical staff of the dam owner performs regular visual inspections and measurements on a weekly or monthly basis. Automatically registered measurements are checked monthly by manual readings. The dam technician checks the operational readiness of the outlet gates at least once a year. The results of the observations and measurements are forwarded to an experienced engineer appointed by the dam owner.

• Experienced engineer: The experienced engineer checks the monitoring results on a continuous basis, performs an annual inspection of the dam and compiles his interpretation of the dam’s behaviour and condition in an annual report. The engineer may also act as a consultant to the dam owner.

• Experts: Larger dams with an impounding head of at least 40m, or 10m with a reservoir capacity in excess of 1Mm3, must undergo a comprehensive safety review by nominated experts every five years. The experts, being civil engineers and geologists, are recognized specialists in dam engineering and are appointed by the owner in agreement with the dam safety authority.

• Dam safety authority: The dam safety authority reviews the annual reports of the experienced engineers as well as the five-year appraisals of the experts. It also carries out on-site inspections and verifies that the recommendations stated in the annual report and five-year reports are observed and the necessary measures are implemented.

iii) Emergency planning

In case of an identified hazard to the dam the situation is managed according to the emergency planning concept. It is important that the measures to be taken have been prepared in advance. These measures consist of a strategy and of emergency plans. The potentially flooded area in case of a dam break has to be determined, and the results should be presented in a flood wave inundation map. This map allows evacuation of the population in the flooded area to be planned. Further emergency planning measures include the installation or at least the specification of the alarm devices, and the organizational provisions for ensuring the evacuation of the population. The emergency strategy defines three danger levels. Specific technical and operational provisions as well as emergency actions are assigned to every danger level.

Dam safety, consequences of dam failure, and measures for risk reduction

Today, a comprehensive safety concept is used for projects with large damage potential such as large storage dams, nuclear facilities etc. For dams it includes the following key elements: (i) structural safety, (ii) dam safety monitoring, (iii) operational safety and maintenance, and (iv) emergency planning. Usually design engineers are primarily concerned with structural safety; however, for critical infrastructures like large storage dams, safety goes beyond structural safety and must include items (ii) to (iv) listed above. Operational safety, which is not considered explicitly in the Swiss dam safety concept, is an important issue, which has to be considered. A typical example is the failure of the upper reservoir of the Taum Sauk pump storage scheme in the US, which failed in December 2005 (see page XX).

The consequences of dam failure are: loss of life (reduction of loss of life is the top priority of emergency planning); environmental damage; property damage in flood plain; damage of infrastructure; loss of power plant and electricity production; socio-economic impact; political impact, etc.

These consequences can be reduced by a number of structural and non-structural measures. The structural measures are mainly related to the safety of the dam, i.e. flood safety, earthquake safety, and site conditions. The non-structural measures include the following: safe operational guidelines for reservoir under normal and abnormal operational conditions; implementation of emergency action plans; implementation of water alarm systems; training of personnel; lowering of reservoir level in case of safety concerns; periodic safety checks; engineering back-up to cope effectively with abnormal and emergency situations; land use planning (political decision); insurance coverage, third party liability coverage (protection from economic losses), etc. The non-structural measures are often more effective than structural measures.

Emergency planning in Switzerland

Emergency procedures include a plan on how to warn the authorities and how to alert the population (Pougatsch et al., 1998).

The dam owner must provide a flood wave inundation map showing the flooded area, the energy head level and the arrival time of the flood wave.

For dams with a storage capacity of more than 2Mm³ a water alarm system is mandatory in the so-called close zone. This zone will be flooded within two hours at most. This corresponds to a distance of about 30km downstream of the dam. The water alarm system consists of special sirens that can be activated directly from the dam. It has to be maintained and tested on a regular basis by the dam owner. In the distant zone – the rest of the flooded area – the alarm is released with the civil defence general alarm sirens and broadcast directives. This alarm system is installed and maintained by the cantons. In the fact, a new generation of sirens are to be installed which can operate both as water alarm sirens and as general alarm sirens.

For smaller dams with minor flooded areas the water alarm is released using the civil defence general alarm sirens.

The cantons and the municipalities are responsible for the planning and preparation of the emergency directives and for evacuation of the population.

The flood wave inundation maps are used on the one hand for emergency planning purposes and on the other hand to define the applicability of the regulations to a specific dam. The intensity of the flood wave is defined as the product of the water depth with the flow velocity and must be assessed with the limit values given in Table 2.

Emergency action plans

The main objective of emergency planning is to save lives. The economical losses of the dam owner and the owners in the flood plain can be covered by insurance.

Emergency Action Plans (EAP) are intended to help the dam owner and operator, and emergency officials to minimize the consequences of flooding caused by dam failure or the uncontrolled release of water from a reservoir. The EAP will guide the responsible personnel in identifying, monitoring, responding to, and mitigating emergency situations. It outlines “who does what, where, when, and how” in an emergency situation or unusual occurrence affecting the safety of the dam and the power plant. The EAP should be updated regularly and after important emergency events. Basically, the dam owner is responsible for maintaining a safe dam by means of safety monitoring, operations manual, maintenance, repair, and rehabilitation.

In an emergency situation, the dam owner is responsible for monitoring, determining appropriate alarm levels, making notifications, implementing emergency actions at the dam, determining when an emergency situation no longer exists, and documenting all activities. In the case of an emergency, the dam owner is responsible for immediate notification of the authorities, who are in charge of warning and evacuation of the affected population. Warning is performed by special water alarm systems as discussed in the subsequent section. The basis for evacuation planning is a dam breach flood wave analysis, which shows the inundated area for the worst case failure scenario, i.e. the sudden failure of the dam. In addition, the arrival time of the flood wave, flow velocities and water depth are results obtained from such an analysis. As a rule of thumb, it takes about two hours for a flood wave to propagate 30km.

The EAP consists of several components or tasks, namely:

• Hazard classification – a determination of the types of hazard that could affect the safety of the facility. Hazards can be associated with natural events and processes (e.g. floods, storms, earthquakes, internal erosion, etc.) (Figure 3), with the operation of safety-relevant hydro-mechanical and electro-mechanical equipment (e.g. gate jamming, failure of monitoring equipment, etc), and with damages caused intentionally by people (sabotage, terrorism, war, etc.).

• Emergency classification – determination of the level of severity of an incident or unusual behaviour of a monitoring instrument or of a mechanical/electrical part. Three levels have been distinguished: (i) internal alert, (ii) developing situation, and (iii) imminent situation. As an aid for judging the level of severity an assessment matrix can be developed (which may change from one facility to another one, depending on the dam’s characteristics and the environment) (Table 3).

Upon discovery of, or after having been notified about, an unusual scenario, two possible situations must be judged, namely whether external assistance is needed and whether there are adverse impacts with a threat to population, structures or environment. The urgency of the situation is the major factor in classifying the severity of an incident. The following alarm levels and emergency situations can be distinguished:

• i) The internal alert triggered by an unusual situation can be managed and controlled by the dam’s staff. Typical internal alert scenarios are flood warning prior to receiving information on the size of the flood and potential dangers, and also abnormal monitoring results where readings on certain instruments exceed pre-set safety limits (e.g. piezometric heads, discharge from drainage facilities or displacement of structures).

• ii) A developing situation exists when the observed incident clearly tends to turn into a serious threat to the dam’s safety and the population in the downstream area. At this stage it is not yet known whether the situation can be brought under control.

• iii) An imminent situation has developed when it has become clear that the progress of the incident or threat cannot be stopped but its consequences can still be mitigated, such as the evacuation of the population in danger.

Communication or notification of the incident could be internally only or both internally and externally. Externally means communication with local and state authorities, responsible for the execution of emergency actions. Communication can be facilitated by notification charts, which display the flow of information among concerned parties and the executive staff of the facility. Internally, the necessary measures will be carried out by an Emergency Task Group (ETG), which is composed of members of the operating staff.

Water alarm systems

In Switzerland, 65 large dams have been equipped with a water alarm system. The first systems were installed some 50 years ago. The driving force behind these systems was the military. The objective was to prevent the type of disasters which were observed in Germany, when several large dams were destroyed during World War II. Therefore, the main threats considered were acts of war. This has changed over the years.

Technology has developed very fast in recent years and water alarm systems have to take advantage mainly of the new developments in equipment and communication. The water alarm systems as such are not changing as the inundated areas remain unchanged. However, with new developments, additional warning equipment (sirens) may be needed.

A problem with triggering a water alarm is the fact that many dams are no longer monitored by the dam owner’s personnel 24 hours a day. In remote places, nobody is at the dam site in winter. Therefore, access to the dams during emergency situations is a logistical problem. During severe rainfalls or after an earthquake, roads may be blocked, etc. Also, in order to prevent false alarms, the sirens are usually not in an operational mode, i.e. they have to be activated when a predefined alarm level is reached. This will take some time if it has to be done manually. Only when the sirens are operational and the highest alarm level is reached, i.e. it has to be expected that the dam may fail, then a specific acoustic signal notifying a water alarm is released.

In Switzerland, a distinction is made between the near field of a flood wave, which is defined as the distance the flood wave will travel in two hours, and the far field beyond that time limit. The dam owners are responsible for the water alarm equipment in the near field; the normal ‘civil defense’ sirens are used in the far field. Fortunately, up to now, no emergency has developed where people had to be evacuated. Annual exercises are carried out by the authorities and the dam owners only and the proper functioning of the equipment is checked.

It is obvious that a water alarm system contributes significantly to the credibility of the dam owners and the authorities by showing that they are concerned about the safety of the people living downstream of large dams.

An example of a leaflet distributed to the population living in the area in Zurich inundated by the possible failure of the Sihlsee dam is shown in Figure 4 together with the two types of sirens used.

Conclusions

Emergency planning and the installation of water alarm systems in the downstream region of large storage dams is a must. Even if a dam is structurally safe, there are natural or man-made events that could cause failure. For emergency planning to be effective, the population affected must be involved and informed about what to do in an emergency. The first water alarm systems for dams were installed in Switzerland some 50 years ago.

The Emergency Action Plan (EAP) for storage and run-of-river facilities is an efficient dam safety management tool assisting the dam owner or operator in the handling of possible adverse impacts that may originate at the dam or in its environment. The components of the EAP, i.e. hazard identification and classification, ‘unusual situations’ matrix and emergency classification and notification charts present clear steps to follow in the case an unusual observation has been noticed requiring corrective or mitigating actions.

The EAP facilitates decision making and streamlines communication among the responsible persons. It provides support to the key response actions to be taken within the dam owner’s organization.

Martin Wieland, Chairman, icold Committee on Seismic Aspects of Dam Design, Poyry Energy Ltd., Zurich, Switzerland. Email: martin.wieland@poyry.com

Rudolf Mueller, Dam Expert, AF-Colenco Ltd., Baden, Switzerland; formerly Deputy Commissioner for Dam Safety, Swiss Federal Office for Energy, Bern, Switzerland. Email: rudolf.mueller@afconsult.com

This paper was presented at the High-Level International Forum on Water Resources and Hydropower, which was held in Beijing from October 16 – 18, 2008 in connection with the 50th anniversary of the China Institute of Water Resources and Hydropower Research (IWHR)