Recently the writer got involved in that particular area of Dam Safety that deals with what the Inflow Design Flood (IDF) should be, as based on consideration to Incremental1 Risk-to-Life (IRtL). Consideration to IRtL may or may not be what determines the IDF; considerations to other incremental risks, such as to property and the environment, as well as to social and cultural values, could override and lead to a higher IDF, although in most cases, perhaps not. While considerations to all the latter types of risks are fraught with their own difficulties, this article addresses only the particular problems and issues we have encountered with the first; ie, the sizing of the IDF in view of the IRtL under high flood conditions (certain specifics, such as those of dams having flood control purposes are not addressed either). There is no denying that this has become a hot potato issue, the kind that makes us lose sleep at night, or worse, makes us reach for the Probable Maximum Flood (PMF) in desperation and angst.

The IRtL is typically expressed in (expected) Incremental Loss-of-Life (ILoL) per year, as estimated by a commonly accepted method.

Incremental Risk-to-Life posed by high flood versus same posed by other causes

Dam safety guidelines customarily classify dams by consequence categories, typically ranging from Very High to Very Low, with High and Low in between. Whether clearly spelled out or not, with ‘consequence’ is meant the ‘incremental consequence’ of dam failure, and the ‘dam failure’ referred to is ‘dam failure from all causes’. Customarily there are two groups of consequences, each afforded separate columns when tabelised: Life Safety Consequences (self-explanatory); and Other Consequences (loss and damage to property, environment etc). An example is shown in Table 1.

Tables such as this are used for many purposes, including the setting of certain criteria for the design of dams and for the subsequent operation and maintenance of them. Much of this no doubt is very appropriate. But the tables have also been used to establish the IDF, and it is still rather common to hear conversations to the effect that they be used for that purpose. At this point we part company and must take issue. The problem, as the author sees it, with using such tables for establishing the IDF is that they do not differentiate between the consequences of a failure at high flood conditions and failure at any other time. The author believes this is a serious shortcoming, both in principle and in practice.

A simple sketch should suffice to help illustrate why this is so (see Figure 1).

The information shown in this sketch can be combined with other data to derive/calculate expected Loss-of-Life (LoL) estimates and expected ILoL estimates, as based on Lives-at-Risks (LaR) and Incremental Lives-at-Risk (ILaR), both of which can be taken directly from the sketch. Using a ‘commonly accepted method’ to produce such estimates, we may get the following charts (figure 2).

The ILaR (= LaR) for a sunny day dam failure is something entirely different from the ILaR for a dam failure coinciding with the 1000-year flood. While the aggregate LaR for the latter is higher than for the former, 100 vs 80, it is clear that 50 of the 100 would already have been inundated by the 1000-year flood prior to the failure of the dam, reducing the LaR from the failure alone, ie, the ILaR, to 50. An even more spectacular difference between sunny day failure and failure at, or caused by, high flood becomes apparent when considering the LoL or ILoL values. This is caused by the fact that these values are very sensitive to warning time: while a sunny day break may come like rain from blue sky, a disastrously high flood takes time to build up, and perhaps more importantly, sounds its own warning siren, as well as driving others to sound theirs, ever more loudly as the water rises. It is therefore clear that the consequences of a sunny day dam failure are something quite different from that of a failure at high flood levels, certainly in principle, and often markedly in practice. And, realising that the consequences associated with a sunny day failure are of no concern when deliberating what the IDF should be, one cannot in good faith simply classify the dam for the ‘worst case scenario’ for ‘all intents and purposes’; it becomes mandatory to differentiate.

It is suggested that the table shown earlier be reworked to include separate columns for the establishment of the IDF, as distinguished from columns for other purposes, in principle along lines shown in the following table headings.

Having separated failure from floods exceeding IDF from failure from all other causes for reasons discussed (for completeness sake a column for economic etc consequences has been indicated, but will not be commented upon any further), it is clear that the two are also quite different as it concerns our awareness of them in real time. This in itself should warrant separating the two kinds of failure, as we can take advantage of the information this provides to bear on the IRtL the dam poses under high flood conditions.

The selection of the Inflow Design Flood

From Risk-to-Life criteria to Hazard-to-Humans criteria

Those of us involved in the planning/designing/refurbishing of embankment dams will, in the absence of hard guidelines or regulations, sooner or later be faced with an apparent dilemma:

• On the one hand we want to take a reasonable, sensible and well balanced approach to all the risk aspects associated with the dam, including IrtL.

• On the other hand there is a natural aversion, and a social and political reluctance or guardedness against the idea of considering, let alone accepting, any dam criteria that lead to a real, estimated (expected) Incremental Loss of Life (ILoL).

There are many examples found in literature dealing with one aspect or other of this matter. Some express the view that a dam should be designed to a proportionately higher standard the more deaths its failure would cause; others say that no incremental loss of life is acceptable.

On the face of it the two views are irreconcilable, and we are left without a paddle. Or so it seems.

What follows is an attempt to find a practical way out of this dilemma, a way that would respect both of the two, apparently conflicting but worthy principles involved. The approach (the Approach) taken is no doubt just one of many possibilities.

Typical present practice

At first, the Incremental Consequence of dam failure in terms of ILoL is estimated (for all flows of interest, usually beginning at the ‘sunny day’ low end). This, as already indicated, is done by a ‘commonly accepted method’, to ensure that a certain standard is obtained. Should the ILoL estimates (for any flow) show that a ‘large number of deaths’ would be the consequence of a dam failure, the process ends here, with the selection of the PMF as the IDF (ie, a dam could be graded High or Very High based on the ILoL values for a sunny day failure alone, prompting a PMF designation even where the ILoL associated with a high flood failure is very low or even nil); otherwise the more daunting task of determining (selecting) the probability P(F) (ie, the frequency of the selected IDF) of the failure event F (the occurrence of the IDF, not the failure of the dam). With this done, the assessment presently ends; ie, with

(1) IRtL = ILoLxP(F)

In this expression the first factor, ILoL, is presently pretty much a given (for any given IDF). Of course, it is estimated on the premise that the dam fails without warning at IDF, and we all know that that is unlikely to happen – flood forecasting, efforts to save the dam, information and warning broadcasts are all actions which in all likelihood will substantially soften or undermine the premise. But there is admittedly something very hazy and numerically indeterminate about the net effect of these actions, so the present custom is simply to consider the estimate as ‘conservative’, ‘to be on the safe side’.

With the ILoL thus a given (and note that many find the ILoL units to be scary-sounding units), we are left with only the P(F) to bring the IRtL down to desired level. Therefore, with the ILoL units vividly on the mind, the pressure is on to go deep with the P(F) in the bid to accommodate Principle Two2. And indeed, many apparently have become resigned and content to ‘simplify’ and take the ‘expedient way out’ as far as the IDF is concerned: go for the Probable Maximum Flood! The problem with this is that it violates Principle One, under the first bullet. Worse, it violates a fundamental design principle, which requires that all risks associated with the dam be considered in a well-balanced approach. And a design principle, we should remind ourselves, is not a management issue, but one for the engineering profession to deal with.

Suggested approach in general

First, it is suggested that the classification of dams (ie, for IDF purposes only, column A in Table) be made on the basis of the Incremental Hazard-to-Humans (IHtH) it represents; second, it is suggested that safety factor(s) (as deemed required; this article will assume two consecutive ones) be employed to ensure that the hazard ‘never materializes’.

These two suggestions, one playing into the other, should help us escape the present vunerable predicament that arises when a statistical event of nature (flood frequency) is the sole probability event that determines the IRtL.

It is suggested here that the IHtH estimates should be constituted as an Index, to be used as one among other criteria in the planning/design/refurbishment of safe embankment dams. This Index could be called the Incremental Hazard-to-Humans Index (IHtHI). The IHtHI would constitute a scale against which the dam is measured. The dam’s IHtHI value would correspond exactly to what the ILoL estimate would be for a what-if dam failure under the conditions of a given high flood and a given warning time (would suggest that a minimum one hour should be recognised), to establish the relative severity of the hazard the dam represents under these conditions. The IHtHI is thus seen purely as a theoretical consequence measure, an Index that shows the magnitude of the hazard the dam potentially represents in the abstract. It measures an intrinsic property of the dam, namely its potential to do harm under some given, hypothetical circumstances. Based on this and on prevalent hazard policy the IDF would now be determined, in complete compliance with Principle One.

But so far perhaps nothing new, except in the nuance. We must now build on this nuance to satisfy Principle Two. In practice this means that measures must be put in place to ensure that the hypothetical scenario does not materialise. We know that if the inflow at the IDF stage and beyond should continue to rise, it would only be a matter of time before the embankment dam would be overtopped and start failing. Safety measures must now therefore be enacted during that period, incorporated into and melded with ‘the regular’ (as presently conceived) Emergency Preparedness Plan (EPP). These safety measures comprise the suggested (time) safety factors.

Suggested approach in more detail

Several important considerations come into play at this point, eg: the characteristics of flood build-up; the knowledge of this build-up, both in real time and through timely and reliable forecasts; the state and circumstances of the population at risk. All of these considerations but especially the first could have a decisive effect on the safety factors, and all of them but especially the second and third consideration can and should be used to attain Principle Two at optimum cost.

The safety factors (which pertain to time, expressed in time) would be incorporated into the (already existing) EPP as follows (naturally, only one or even no safety factor may be warranted; for illustration purposes this article deals with two).

• Two safety factors, SFee and SFfe, pertain respectively to IDF-associated emergency evacuation and forced evacuation, the modifier ‘IDF-associated’ indicating that these evacuations only take place when flood conditions would reach the IDF level. SFee and SFfe are expressed as the time required for the population at risk to respectively evacuate voluntarily and be evacuated by force to safety, measured from the time the decisions are made to respectively announce the emergency evacuation and invoke the forced evacuation, until the respective evacuations reasonably should be complete. The two consecutive safety factors, when added together, are thus seen to define the total time available to assure the population’s safety under imminent IDF condition and beyond, from the time the decision to announce an IDF-associated emergency evacuation is made.

• The introduction of the time safety factors and the two phases identified above would be interwoven with the EPP. The demarcation line between the two phases would generally be drawn after considering all relevant factors, which differ from case to case, to establish its optimum position; for illustration purposes and ease of communication it is visualised here as drawn at the time when the IDF occurs.

• The duration of the first phase corresponds to SFee. The phase begins with the announcement of the IDF-associated emergency evacuation, the timing of which can be back-calculated from the time of the demarcation line of the previous bullet, using the established SFee. It now becomes apparent that it will be necessary to forecast the IDF with a lead-time which is at least equal to SFee; if this is not possible, the demarcation line must be moved to an earlier time, corresponding to a smaller flood, to accommodate SFee.

• The duration of the second phase corresponds to SFfe. It kicks in at the time when the demarcation line is reached. This means that the dam must and will remain safe from overtopping for a time at least equal to SFfe at that point. This can be achieved in one of several ways, or combination of ways, by means of freeboard, increased spilling capacity, hardening or flattening of the dam surfaces; whatever is found to be most appropriate under the circumstances, for optimal design. Of course, if increased spilling capacity is opted for, those so inclined could polemicise that the dam now in fact has been designed for a higher IDF. This is not the case: the IDF remains determined by the IHtHI and the prevailing hazard policy; the increased spilling capacity would be associated with the SFfe alone.

Note how this works to our advantage on both of the two factors, ILoL and P(F), which determines the IRtL:

• First, it mobilises the powerful independence principle in probability, bringing the overall probability down by the power of the cube (the event of interest now becomes the intersecting event of three rare events, the IDF occurrence, and the failure events of the two safety factors) rather than linearly, as the case is at present.

• Second, the ILoL for dam failure diminishes drastically, as the time afforded by the safety factors is numerically determinate and must be entered as a known parameter in the ILoL estimates.

Brief discussion of some elements of the approach

The size of the safety factors must naturally account for all elements having an effect on them, including the uncertainties in the various estimates underlying their establishment. Respecting SFee, one no doubt will find that, in most if not all cases, the lead-time with which the IDF can be forecasted far exceeds SFee, with the rather ironic effect that restraint may have to be exercised so as not to announce the IDF-associated emergency evacuation of the (expanded) EPP too early, even after one is fully aware that such an emergency evacuation is forthcoming.

In many if not all cases one will find that earlier phases of the (regular) EPP will be enacted because of high flood conditions alone, some time before the IDF-associated emergency situation develops. This will happen wherever the flood plain of lower floods has dwellings built upon it; the IDF-associated evacuation would then be just a continuation of a process already in full deployment, but a distinct phase of the (expanded) EPP none the less.

Both of the safety factors obviously would be influenced by the specifics of the (expanded) EPP. Without going into details on this, one should for instance keep in mind that there is only a remote or very remote chance that an IDF-associated flood emergency will ever be enacted over the foreseeable life of the dam, and this may have consequences for the (expanded) EPP – it is hard to keep up the vigilance year in and year out, decades on end, when apparently nothing ever happens – and the uncertainties this may entail must also be reflected in the safety factors. Routine testing and regular, monitored practices and drills which is part of the (regular) EPP in any case, should give good, reliable data for the necessary risk analysis.

IDF-associated Incremental Risk-to-Life policy

Guidelines respecting IRtL policy are for the moment rather poorly defined, intentionally so, and expressly so as to facilitate consistency with (local?) societal expectations. The Approach taken here does not change or interfere with that. This is accomplished by shifting the basis for the IDF selection criteria from an ILoL value to an IHtH Index. Then, through the deployment of IDF-associated safety factors, IRtL can be tailor-made to suit the situation at hand, the safety factors working at reducing simultaneously both the ILoL and the P(F) values. Both of the two Principles put down at the beginning of this Section can thus be upheld. It is hoped that this Approach therefore should open the way for establishing a single, industry-wide IHtH policy, leading to the establishment of uncontroversial and uniform criteria for the selection of the IDF.

Societal expectations respecting IRtL are not easy to pin down in any case, uncontroversially, especially in terms of numbers. Yet our present practice can be said to either tie, or to consider the selection of, the IDF directly to, or in light of, such numbers. The Approach outlined here avoids this through the introduction of the IHtHI and the special safety factors. The former is used to achieve the aim of Principle One and also, together with the safety factors, the aim of Principle Two.

What should be the reasonable relationships between societal expectations, IRtL policy, IHtHI, and the flood frequency of the IDF? Let us begin by looking at the last two. When multiplied they define the Incremental Hazard to Humans that the dam poses, per year (note how this is independent from the IRtL). It would make good sense in view of Principle One to standardize this Annual IHtH (AIHtH), and make it constant for all dams. Since the IHtHI is established against a what-if background, it is suggested that this matter can now be considered objectively, without fear of being or being seen as insensitive to human life. And, as there is already a formidable body of evidence pointing to what the standard reasonably should be, this is not the place to pursue the question in its particulars, other than perhaps to observe that good groundwork has been laid down by many in this area. The question of whether it is the unity mark on the IHtHI that should correspond to the 1000-year flood, mark 10 to the 10,000-year flood, etc (as much of the groundwork would suggest, when substituting its [annual] IRtL with our [annual] IHtH, value for value), or marks somewhat higher or lower, can be debated; the important thing in this respect is that the objective of Principle One be achieved, and that an industry-wide standard be established. It is believed that this should be doable and well worth pursuing. Being in compliance with an industry-wide standard should also, in addition to rendering peace of mind, be an excellent bulwark against the fear, or even the thought, of being exposed to potential legal proceedings in the future.

We now return to the table shown at end of Section 1 and propose the following in Table 3.

So, there we have it. The values for the IHtHI are the same as those indicated for ILoL in certain previous Groundwork we know of; they are derived in the same fashion as they were, from ILoL estimates (although with a warning time, only spottily recognized under present practice), but with respect to a what-if scenario of dam failure rather than a real one. Hence they are measured in IHtH units rather than in ILoL ones.

To summarise in formularistic fashion, equation (1) of Typical Present Practice has in this Approach been replaced by equation,

(2) IRtL = ILoLxP(F1)x[P(F2)]wx[P(F3)]w

in which P(F1) is the same as the P(F) of (1), ie, the annual frequency of the IDF; the P(F2) and the P(F3) are the respective probabilities of the emergency and the forced evacuations failing, with a w subscript, here simply indicating ‘weighted’, in recognition of the fact that the probability of failing to rescue one etc is different from the probability of failing to rescue all. Note again, that the ILoL of (2) would be much smaller than that of (1), as it would be derived on the basis of a warning time which is typically (SFee+ SFfe) longer than that of (1).

So what of the dam’s actual IRtL versus prevailing IRtL policy? Well, should the prevailing policy be as indicated in the groundwork, the policy would be met once the IDF were selected in accordance with the proposed IHtHI (and the suggested corresponding IDF values) in the table above, without having to resort to any safety factor. In other words, the IRtL posed by the dam would be found acceptable at the rate of 1/1000 ILoL per year (in reality somewhat less, as the dam is safe at IDF and a bit beyond), corresponding exactly to the AIHtH numerical value. If this is not acceptable, we have moved to introduce two Safety Factors through which the IRtL now can be lowered as one may wish to accommodate Principle Two.

In conclusion it is hoped that, by adopting the Approach shown here, or one that does the same or better, an Industry-wide Standard for selecting the IDF can be established.


Author Info:

For further information, contact Per Stokke, P. Eng. (ret.). Tel. +1 (204) 474-1105, email: pstokke@shaw.ca

Tables

Table 1
Table 2
Table 3