Click for next page ( 242


The National Academies | 500 Fifth St. N.W. | Washington, D.C. 20001
Copyright © National Academy of Sciences. All rights reserved.
Terms of Use and Privacy Statement



Below are the first 10 and last 10 pages of uncorrected machine-read text (when available) of this chapter, followed by the top 30 algorithmically extracted key phrases from the chapter as a whole.
Intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text on the opening pages of each chapter. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

Do not use for reproduction, copying, pasting, or reading; exclusively for search engines.

OCR for page 241
APPENDIX E Risk Analysis Approach to Dam Safely Evaluations This Appendix considers the issues involved in decision analysis proce- dures addressing the consequences of dam operation and dam failure during extraordinary flood events. Issues addressed are extrapolation of the fre- quency curve to the probable maximum flood (PMF), calculation of the consequences of large floods and the matrix decision approach, calculation and use of expected costs, and finally the justification of doing a careful risk analysis of project operations. An example of the application of risk analysis to design alternatives for a hypothetical reservoir problem is outlined. EXTRAPOLATION OF FREQUENCY CURVES A complete risk-based analysis sometimes requires an extension of flood- frequency curves beyond the 50-, 100-, or 500-year return periods, which is usually considered as defining the outer limits of the ability to make credible frequency estimates. As discussed in Appendix D, this is generally unjustified from available systematic flood flow records and records of historical floods. This poses a difficult problem if a frequency curve out to the PMF is to be employed unless some means is adopted to assign return periods to events such as the calculated PMF. Procedures for estimating the return period of PMF events are also discussed in Appendix D. Such direct methods are very involved. Lacking a simple alternative, a reasonable result can be obtained by considering the PMF to be the one in a million (106) year event, or the one in 10,000 (104) year event. Since use of the latter value would lead to higher estimates of risk-costs, it may be considered the more conservative assump- 241

OCR for page 241
242 do 8- ~VH38lO ]~,NDSID CQ 'Q 'Q _ 3 V

OCR for page 241
Appendix E 243 tion. Buehler (1984) recommended use of the 106 value. With such an as- sumption, one can extend the standard (Bulletin 17) frequency curve (on lognormal probability paper) to pass through the PMF with the specified exceedance probability. Figure E-1 provides an example of lognormal paper that can be used for this purpose. Here 104 and 106 represent a very conserva- tive and a more reasonable value of the return period of PMF estimates, even though higher return period values have been suggested and in some cases are more likely (Newton, 1983~. Ideally, these target values would be a function of the region of the country in which one was working, and the size of the river basin of concern for both of these factors should explain varia- tions in the return periods of PMF estimates. There are several reasonable pathways of extending the empirical fre- quency curve from the 100-year flood to the PMF. A simple linear extension of the empirical frequency curve from the 100-year flood to the PMF on lognormal paper is one reasonable procedure. The Bureau of Reclamation (1981a) uses a log-flow versus log-exceedance probability graph to extend the frequency curve; their guidelines also specify that the frequency curve should pass through a box bouncied vertically by 40 and 60 percent of the PMF and horizontally by vertical lines drawn at the 200- and 500-year return periods. In practice, curves often are drawn to just pass through the lower right-hand corner of that box. Thus, the general effect of their proce- dure is to make the 0.4 PMF flood the 500-year event, irrespective of the size of the 100-year flood or the return period assigned to the PMF. The Bureau s box constraint adds little to the analysis. While they may describe hydrologic experience in parts of southern California, these bounds should not be arbitrarily imposed upon flood-frequency curves for river basins in that region or elsewhere. Research should address the impact and advisability of using different axis scales to extend frequency curves to the PMF. However, because one is interpolating between the PMF with a speci- fied exceedance probability and a specified 100-year flood, the differences should not be too great and should generally result in smaller variations in damage estimates than do use of either 1O-4 or 10-6 as alternative values for the exceedance probability of the PMF. Other problems arise when one attempts to make the flood-frequency curve approach the PMF flood asymptotically, as the Bureau suggests. Such efforts seem to reflect the mistaken belief that the PMF estimate is in fact the maximum possible flood that can occur. This is certainly not true (see discus- sion in Chapter 2 and Newton (1983~) . Furthermore, the practice of treating the PMF estimates as the maximum possible flood can yield physically im- plausible bimodal flood distributions whose use can distort risk-cost analy- ses. This procedure implicitly assigns the values of 1O-4 or 10-6 to the event that the PMF estimate occurs rather than to the event that the PMF is

OCR for page 241
244 Appendix E exceeded. Finally, this practice tempts one to think that if a dam were just designed for the PMF estimate, then there would be no risk of the dam overtopping. This is not the case. The PMF estimate is indeed a very large flood, but it can be exceecled. Clearly, care should be exerciser! when extending flood-frequency rela- tionships to PMF values. Additional research is clearly needed in this area. At present, reasonable and realistic risk investigations can be conducted by a linear extension (on lognormal paper or some reasonable alternative) of the frequency curve out through the PMF estimate, which is assigned a return period of 106 years, or the smaller and more conservative value of 104 years. By using alternative flood-frequency relationships that jointly span the rea- sonable range one can capture the sensitivity of the expected damage costs and, in particular, the ranking of the alternative projects, to our uncertainty as to the true flood-frequency relationship. One should also remember that available flood records yield 100-year flood estimates with considerable uncertainty (Kite, 1977~; thus it can be appropriate to include the sensitivity analysis, both alternative values of the exceedance probability of the PMF and also the 100-year flood. Procedures for calculating confidence intervals for the 100-year flood are available (Stedinger, 1983c). EVALUATING RISKS A risk-based analysis needs to consider the consequences and costs of reservoir operation (including damages from high lake levels and discharge, and also damage to the dam and from interruption of services) and the relative likelihood of such events. In general, four metrics are used to de- scribe the consequences for each alternative considered: 1. likely loss of life; 2. economic damages from lake levels, releases, and damage to the dam; 3. the cost of actions associated with each modification of the dam, reser- voir, and associated channels and any flood warning system; and 4. the cost of discontinued or interruptions in service due to damage to or the failure of the dam because of an extraordinary hydrologic event. An American Society of Civil Engineers (ASCE) task-force (ASCE, 1973) has recommended that an economic value be assigned to loss of life so that all quantities can be added on an annual basis to obtain a total-cost function. While such a step is attractive and can be done as an extra computation, in general, initially displaying expected loss of life in a separate category is advisable. The Bureau of Reclamation (1981a, 1984) provides a discussion of how

OCR for page 241
Appendix E risk-cost analysis can be performed. The key step is to provide a numerical approximation to the expected loss of life and the expected damage costs. Comparison of project benefits in terms of only expected damages and loss of life is a problem in that it averages or integrates over many possible events. In addition and before calculating expected costs, engineers should compute and examine matrices such as that in Figure E-2, which can show expected loss of life and economic damages associated with each alternative project over a range of inflow floods. As noted by Interagency Committee on Dam Safety (ICODS) (1983, pp. 30-31), such calculations are necessary for risk- cost analyses. One big unknown in any analysis of damages anticipated from dam over- topping and failure is the rate of breach development ant] the size of breach that will develop. Fortunately, we do not have many case histories of breach of large dams on which to base such estimates. A sensitivity analysis assum- ing a range of rate of development and size of breaches could show if these assumptions are critical for a specific case. Intentionally breaching or destroying a clam, or widening or lowering a spillway, can result in increased discharges for modest 50- to 200-year return period floods, thereby increasing downstream damage cost associated with relatively likely events even though such structural modifications allow pas- sage of the relatively improbable PMF without structural failure. On the other hancl, given the size of near-PMF floods even without structural failure of the dam, sudden or progressive dam breach during a flood may have a 245 Flow Rate 10,000 (100-yr flood) Proposal 20,000 30,000 50,000 70,000 . Dl2 D13 D14 Dls (L12) (L13) (L14) , (L15) D52 Ds3 Ds4 D5s (L52) (L53) (Ls4) (L55) 90,000 cfs (PM F) Do nothing Dll (Lll) Dl6 (~16) Modify spillway1 Modify spillway2 Change operating policy plus modification1 Breach Ds1 dam (Lsl) Ds6 (L56) FIGURE E-2 Sample decision matrix for risk analysis (expected damages Djj associated with proposal i and inflow flood level j and also the corresponding expected loss of life).

OCR for page 241
246 Appendix E very modest incremental impact on potential loss of life and economic dam- ages. All these issues should be considered when selecting an appropriate modification of a structure and can be considered even before probabilities are employed to calculate expected loss of life and damage costs. AN EXAMPLE To illustrate the use of risk analyses and the balancing of the increment of property and lives at risk due to spillway inadequacies against retrofitting costs, we consider an example that is a generalization of several studies conducted by the Bureau of Reclamation. In this example, a reservoir con- structed in the 1920s has a storage capacity 20,000 acre-feet. It has been found to have an inadequate spillway due to defects in the design of the spillway as well as a design discharge, which is substantially smaller than current PMF estimate. The PMF for the dam is currently estimated to be 120,000 cubic feet per second (cfs), while the 100-year flood is 20,000 cfs. The current spillway, given the design defects, is estimated to be capable of carrying 50,000 cfs. The minimum damage flood is 10,000 cfs, which is about the 50-year flood. Alternative designs have been considered. One can (1) do nothing, (2) modify the existing spillway to pass 75,000 cfs, (3) rebuild the spillway and raise the dam so that it can pass the PMF, or (4) lower the spillway crest and lengthen it so that the full PMF can be passed without raising the dam. Table E-1 summarizes these options and their amortized annual costs. The question is whether to stay with the current spillway with capacity of 50,000 cfs, to increase the capacity to 75,000 cfs for an annual cost of TABLE E-1 Design Options and Costs for Illustrative Example Design Flow Annual Cost Option (cfs) ($/yr) 1. Do nothing 50,000 0 2. Modify exist- 75,000 80,000 ing spillway 3. Rebuild spill- 120,000 200,000 way and raise dam Rebuild spill- 120,000 120,000 way and lower or lengthen crest

OCR for page 241
Appendix E $80,000, or to increase the capacity to the full PMF of 120,000 cfs at an annual cost of either $120,000 or $200,000. A key ingredient in any decision may be the expected downstream (and sometimes upstream) property damages that result from large flood flows and reservoir operations. In this example, damages in the valley below the dam (designated by M) are assumed to rise monotonically toward an upper bound or maximum M if the dam does not fail. Any actual failure of this large dam is assumed to result in a flood wave that causes the maximum damages. The mathematical form of the damage function and other details of this analysis are provided at the end of Appendix D. Clearly some trade-off is necessary between lives at risk, the possible cost of the project's destruction and the resulting loss of benefits, and the incre- mental flood damages that would result should the dam fail. In this example, the incremental risk of loss of life due to clam failure during an extraordinary flood event is assumed to be negligible. Down- stream residents would have been evacuated already or could be evacuated before the flood wave from a dam failure would reach them. One must also consider the possible cost of replacing the dam should it fail and the cost of loss of services until the dam is again operational if that is the chosen course of action. The cost of reconstructing the dam and the present value of loss of services until the dam could be replaced are denoted by the letter L. Thus, if a flood overtops the reservoir, causing a breach, the total losses M + L are those due to downstream property damage and loss of the reservoir and the services not supplied until the reservoir can be rebuilt. The matrices of costs that result from five different but reasonable combi- nations of M, L, and a third (damage-shape) parameter are shown in Table E-2. Each matrix represents the damage costs that occur from the flood flows or M + L if the dam is overtopped and by assumption fails. One must be careful when interpreting the cost functions because they are discontinuous at the spillway design flood. For example in case 1, if option 2 were pursued and a 75,000 cfs flood occurred, then downstream damages would be $9.6 million. However, a 76,000-cfs flood is assumed to overtop the reservoir causing total damages of $40 million. In the first three cases in Table E-2 the committee has considered a range of L values representing a relatively low-cost dam with small loss of service costs to either a high-cost dam and/or high loss of service costs. Cases 4 and 5 correspond to low loss of service costs with two high downstream damage cost cases. Two things stand out in matrices: (1) the higher the spillway design discharge, the larger the range over which dam failure is avoided and damages stay below the maximum, and (2) the fourth inexpensive option of lowering, or lengthening, the spillway results in larger damage costs. What is not simple is the trade-off of annual modification costs in the $80,000- 247

OCR for page 241
248 Appendix E TABLE E-2 Matrices of Damages (in millions) for Different Flows and Design Options Design Peak Flood Flow Option 20K 50K 100K 120K Case 1: M = $20 million, L = $20 million 1 1.9 6.6 2 1.9 6.6 3 1.9 6.6 4 3.6 11 Case 2: M = $20 million, L = $100 million 1 1.9 6.6 2 1.9 6.6 3 1.9 6.6 4 3.6 11 2 3 2 3 4 Case 3: M = $20 million, L = $400 million 1.9 6.6 1.9 6.6 1.9 6.6 3.6 11 Case 4: M = $100 million, L = $20 million 9.5 33 9.5 33 9.5 33 18 55 2 3 40 9.6 9.6 15 120 9.6 9.6 15 420 9.6 9.6 15 120 48 48 73 Case 5: M = $200 million, L = $20 million 5.9 23 5.9 23 5.9 23 9.8 36 220 35 35 55 40 40 12 17 120 120 12 17 420 420 12 17 120 120 59 83 220 220 47 72 40 40 13 18 120 120 13 18 420 420 13 18 120 120 67 89 220 220 56 85 NOTE: In the first four cases, the damage function shape parameter s (see Appendix D) equaled 1 x 10-5 for design options 1-3 and 2 x 10-5 for design option 4 (lower spillway crest); for case 5 the values were 3 x 10-6 and 5 x 10-6, respectively. $200,000 range with possible but very unlikely damages in the $10,000,000- $420,000,000 range. To trade off dam failure prevention costs with possible flood damage and dam failure costs, an extended flood-frequency curve was constructed. A shifted exponential distribution was used to describe the flood-frequency distribution. Its two parameters were chosen so that 20,000 cfs was the 100- year flood (or 1 percent chance event) and the PMF of 120,000 cfs was the T-

OCR for page 241
Appendix E 249 year event for T = 104 or 106. The expected damages due to flood events between the minimum damage flood of 10,000 cfs and the PMF were then calculated analytically (see Appendix D). The results are given in Table E-3 along with the sum of the expected damages plus the annualized construc- tion costs from Table E-1. Examination of Table E-3 illustrates a range of situations that might be encountered. In case 1, on an economic basis, no construction seems justi- fied; even when the PMF is only the 10,000-year event, the least total cost option is to do nothing. This is consistent with the Table E-2 matrix for this case, which shows that damages in the event of a dam failure are of the same order of magnitude as damages without a failure. Going to case 2, L increases from $20 million to $100 million. As a result, on an economic basis, option 2 with a 75,000-cfs spillway gives lowest indi- cated average annual cost if the PMF is only the 10,000-year flood, whereas to do nothing is indicated if the PMF is the million-year event. Finally, in case 3 the cost of loss of the dam is very large, $400 million, and the inexpensive 120,000-cfs spillway design (option 4 involving lowering the crest) gives indicted lowest cost for T = 104, while the 75,000-cfs spillway design (option 2) shows lowest cost if T = 106. Unfortunately, the least cost solution in both cases 2 and 3 is sensitive to T. Cases 4 and 5 consider situations where downstream damages are the important factor rather than the loss of the dam and the services it provides. In case 4, building the 75,000-cfs spillway (option 2) only shows lowest indicated cost if T is as small as 104. In case 5, with M = $200 million, construction seems to give lowest indicated cost options, though different T values again lead to different decisions. However, in both cases 4 and 5, the lower crest 120,000-cfs spillway (option 4) is very unattractive because of the larger downstream damages it causes at all inflow levels up to and including the PMF. This stands in contrast to case 3, which had relatively small down- stream damage potential, making the low-cost, lower crest spillway more attractive on an indicated cost basis. One should also remember that this analysis is based solely on the dollar values of property damage and excludes loss of life, which is assumed not to be a concern in this case. USE OF EXPECTED COSTS Actually calculating the expected costs and benefits associated with differ- ent designs provides some guidance or confirmation as to which design alternatives on balance are most attractive. However, an expected cost anal- ysis does have some practical and philosophical problems. On the practical side, at the extreme, one is multiplying estimates of large costs times rather poor estimates of small probabilities. The resultant prod-

OCR for page 241
250 Appendix E TABLE E-3 Expected Damages for Different Design Options, Cases, and Return Periods T Assigned to PMF Expected Annual Damages ($1,000/yr) Option T= 104 T= 106 Expected Annual Damages Plus Construction Costs ($1,000/yr) - T= 106 Case 1: M = $20 million, L = $20 million 1 130 70 130 70 2 75 50 155 130 3 55 50 255 250 4 94 90 214 210 Case 2: M = $20 million, L = $100 million 1 320 120 320 120 2 130 55 210 135 3 55 50 255 250 4 95 90 215 210 Case 3: M = $20 million, L = $400 million 1 1050 310 1050 310 2 340 75 420 155 3 55 50 255 250 4 95 90 215 210 Case 4: M = $100 million, L = $20 million 1 460 300 460 300 2 320 250 400 330 3 275 245 475 445 4 470 450 590 570 Case 5: M = $200 million, L = $20 million 1 640 280 640 280 2 310 170 390 250 3 185 160 385 360 4 300 260 420 380 NOTE: Minimum cost value is underlined for each case and value of T.

OCR for page 241
Appendix E 251 uct may be a very imprecise estimate of the desired expected cost associated with extreme events. Thus, these calculations only provide a credible guide for decision making if sensitivity analyses considering alternative but credi- ble costs and flood-frequency relationships yield a similar ranking of the alternatives. An even more philosophical question is whether expected loss of life and expected damages are appropriate metrics to describe possible catastrophic events that are unlikely to occur in contrast to construction costs, which definitely will be experienced. Few argue against the use of probabilities in the analysis of recurring events without catastrophic consequences; exam- ples are the analysis of the cost and benefits associated with frequent floods, year-to-year hydropower operations, or recurring navigational issues on waterways. However, the failure of a major dam in an extraordinary flood should not be a recurring event for which one can weigh the average annual costs that will be experienced from failures with the costs paid to reduce the likely severity and frequency of those failures. The issue is how much mem- bers of society are willing to pay to avoid such unlikely events. It is highly plausible that they are willing to pay more than the expected cost. The cost society should bear to avoid the consequences of dam failure (both immediate and those due to the inability of the facility to continue to provide the anticipated services) is difficult to determine. When loss of life is a major issue, most people agree that little risk is acceptable and PMF standards for safety are appropriate. But why not a little more or a little less? LOSS OF LIFE CALCULATIONS The balancing of reservoir construction and retrofitting costs against the expected incremental property damage costs from improbable but possible dam failure is a balancing of monies expended for protection versus proper- ties damaged for which monetary compensation can be provided. This com- parison can be performed on an annual cost basis (amortized reservoir construction costs versus the expected incremental damages avoided per year) given an interest rate and a planning period. Alternatively, given the interest rate and a planning period, one can make the equivalent comparison between the present value of the two time streams. Loss of life considerations pose fundamentally different considerations, particularly in a time value context. First, one must be willing to specify the amount of federal monies that society is willing to expend to avoid an accidental death or on average one accidental death that could occur during the next fiscal year. While no one is anxious to specify a particular dollar value for such a death, reasonable ranges can be surmised. The question dam safety raises is, how much is society willing to pay today

OCR for page 241
252 Appendix E to avoid an accidental death that could occur in 25, 50, or 100 years? If the interest is 10 percent per year (or 5 percent per year) and society would be willing to pay as much as $1 million per expected accidental death avoided in the immediate future, would society be willing to pay only the present value of $1 million in 50 years at 10 percent per year, which is $8,519 (or $87,200 for i = 5 percent), to avoid an expected death at that time? Certainly the first value is too small and probably also the second. Discounting the value of life with the discount rate for federal expendi- tures does not seem appropriate. An alternative is not to discount the value assigned to loss of life or to discount it very little. If this is done, one must be careful not to compare amortized capital and construction costs with annual expected loss of life values; that would be equivalent to discounting the value of life at the discount rate for construction costs. What are the consequences of not discounting loss of life? If loss of life is not discounted, then it is easiest to compare the cost of construction and spillway modification costs with the present value of incremental damages avoided (calculated with the interest rate for property) and the incremental expected number of accidental deaths avoided per year times the number of years in the planning period. Thus, if a dam modification in expectation saves 0.02 lives per year, this is equivalent to saving 1 life in 50 years, 2 lives in 100 years, and 4 lives in 200 years. Because the number of expected lives the dam modification is credited with saving increases linearly with time, and the dam may be around for a long time, the value of life can loom large in the analysis. Of course, if the expected lives lost per year is only 1O-4, then after 200 years the expected loss of life is still only 0. 02. With these considerations before us and given the long service lives of many dams, there is no rigorous method to decide how to properly balance construction and spillway modification costs with loss of life values. Clearly, absolute safety cannot in general be provided. However, our society seems willing to spend large sums of money so that federal dams and other large projects do not put people's lives at risk without their explicit consent, re- gardless of what people choose to do voluntarily. Clearly the federal govern- rnent wants to continue to protect the lives of its citizens. ADVANTAGES AND LIMITATIONS OF RISK ANALYSIS APPROACH In Chapter 5 some of the limitations and advantages of the risk analysis approach are outlined. For example, a key feature of the matrix decision approach and expected cost analyses is that the selected design is not con- fined to a specified SEF. The analysis probably would include the PMF as one of the safety evaluation floods, but no single flood is specified as the unique inflow hydrograph against which a design should be tested. This is as

OCR for page 241
Appendix E 253 it should be, because no single event can capture the character of all of the small and large floods to which a dam may be subjected. Strict reliance on PMF as inflow design floods or some other unique safety evaluation flood in a real sense can distract designer and public attention from the real flood risk, which is probably due to less extreme but much more likely hydrologic events as well as from structural and foundation problems with the dam. which can also cause dam failure. Kirby (1978) suggests that just"the concept of probable maximum flood diverts our attention toward the illu- sion of absolute safety and away from the hard necessity to accept risk and minimize it by balancing opposing risk." The matrix decision table may make these trade offs more apparent. Dams are major social investments, and their failures due to the occur- rence of large floods is of much concern both because of the loss of the investment embodied by the dam and the likely loss of life and property such a dam failure might cause. In the design against extreme hydrologic events, dam designers have had to assess the hydrologic risk present at a particular dam site. There are basically two approaches that can or have been applied to assess that risk. One is to consider the probable maximum flood event that would occur following a probable maximum precipitation event in conjunc- tion with other unfavorable factors. The second approach would entail the probabilistic analysis of a wide range of scenarios so as to construct a flood- frequency relationship. The Harriman Dam analysis (see Appendix A, Yan- kee Atomic Electric Company) illustrates such an effort. While there are substantial difficulties in estimating the return period of the PMF or in estimating the 10,000-year flood using probabilistic tech- niques, all of the difficulties are also associated with characterizing worst case analyses such as the probable maximum flood calculation. Both ap- proaches require judgment. Neither are automatic. To be done satisfactorily, both approaches require understanding of the underlying processes generat- ing extreme events. Traditionally, the appropriate level of safety was often determined by professionals involved in the construction and regulatory agencies of the federal government. Based on their collective and joint consideration, reser- voir designs were adopted that reflected reasonable standards of safety. However, decision making patterns in our society are changing, so that a large audience, including more of the general public, is becoming involved in important social decisions. There are two dangers. The first is that the decision making and safety standard setting process will come to include so many participants and interests that acceptable and appropriate decisions cannot be made. On the other hand, the decision making process will lose its social legitimacy if too few groups or only a select group can become in- volved. This can occur if professionals treat important social decisions as

OCR for page 241
254 Appendix E simply technical issues that they feel authorized to resolve. While society once may have delegated such authority to design engineers, social decision patterns have and are continuing to change. Thus, federal dam-building agencies need to remain open to and should encourage public discussion of their design practices to assure that their practices enjoy general public and professional support. One advantage of the matrix decision approach is that, in the context on a particular decision, it displays the range of alternatives that were considered and illustrates the performance of the dam over a wide range of floods. Historically, (lam designers have appropriately been concerned that their profession not be discredited nor public confidence lost by the failure of dams during large floods or earthquakes. However, in view of the greater technical expertise available today and society's current outlook on the allo- cation of resources, safety factors and overdesign practices that once may have been appropriate may no longer be reasonable. Thus, government agencies should carefully determine if the marginal increments in damages that result from changes in operating rules, structural modifications, and dam failures on balance indicate that structural modification and operating rule changes for existing dams are both justified and well advised. The procedures discussed in this Appendix can facilitate such determinations.