Dam safety and risk assessment

Flattening the downstream slope FS increases but probability of failure has a lower bound – no complete safety exists Safety analysis of a homogeneous rockfill dam: a- failure mechanism

Why the need for dam safety evaluation

Dams are, without doubt, among the safest structures constructed by man

Dam engineers spare no effort in order to ensure that every dam is conceived, built and maintained according to the best experience, the most exacting criteria and the most advanced knowledge Efforts are, by and large, extremely successful

However, no matter how well a dam is built or maintained, the risk of failure cannot be reduced to zero Dam failures are severe threats to life and property that fully justify the need for a better understanding of risks to the public posed

by dams

Society today, more than a relatively few years ago, demands that safety evaluations be carried out and documented for activities involving risks imposed on the public (as opposed to voluntary risks)

Dam Safety and Risk Assessment

Definition

In the traditional approach risk is the likelihood or probability of adverse consequences In the field of dams:

Risk = Probability of dam failure per year x consequences of realized failure.

For an identified scenario the probability of failure may be defined in terms of probability of load (external stress) times probability of adverse dam response (vulnerability to failure) to that load

Risk = [Probability of Load]x[Probability of adverse]x[Consequences]

response given load given responce Dam failure is the collapse or movement of part of a dam or part of its foundation, so that the dam cannot retain water Reliability is defined as the complement of risk, i.e the probability of non-failure.

If we use the variable R for resistance and the variable L for load, then we

can define a failure as when the load exceeds the resistance and the consequent probability of failure as the probability of the loading exceeding

the resistance, P(L>R).

Why the need for dam safety evaluation

Dams are, without doubt, among the safest structures constructed by man

Dam engineers spare no effort in order to ensure that every dam is conceived, built and maintained according to the best experience, the most exacting criteria and the most advanced knowledge Efforts are, by and large, extremely successful

However, no matter how well a dam is built or maintained, the risk of failure cannot be reduced to zero Dam failures are severe threats to life and property that fully justify the need for a better understanding of risks to the public posed

by dams

Society today, more than a relatively few years ago, demands that safety evaluations be carried out and documented for activities involving risks imposed on the public (as opposed to voluntary risks)

Dam Safety and Risk Assessment

Definition

In the traditional approach risk is the likelihood or probability of adverse consequences In the field of dams:

Risk = Probability of dam failure per year x consequences of realized failure.

For an identified scenario the probability of failure may be defined in terms of probability of load (external stress) times probability of adverse dam response (vulnerability to failure) to that load

Risk = [Probability of Load]x[Probability of adverse]x[Consequences]

response given load given responce Dam failure is the collapse or movement of part of a dam or part of its foundation, so that the dam cannot retain water Reliability is defined as the complement of risk, i.e the probability of non-failure.

If we use the variable R for resistance and the variable L for load, then we

can define a failure as when the load exceeds the resistance and the consequent probability of failure as the probability of the loading exceeding

the resistance, P(L>R).

1

Risk analysis process involves the scientific characterisation of what

is known and what is uncertain about the present and future performance of the dam

Risk management is a strategy applied to the tasks of analyzing, evaluating, controlling, and administration of risks witch threaten the well-being of life and natural and socio-economic environment.

The main purpose of carrying out a risk analysis is to provide decision support For many applications, the resulting numerical values do not have to be accurate in absolute terms, but must be inherently

consistent so they allow reliable relative comparisons among alter-natives.

The main issue stands with the existing dams More extensive floods records, and possibly changes in climatic conditions since the construction

of a dam, necessitate updating of flood estimates and re-evaluation of dam safety Significant changes in physical conditions both upstream and downstream since the dam was built require a review of the risks involved.

Dam Safety and Risk Assessment

Limits of Factor of Safety approach

The assessment of safety in civil engineering works is traditionally obtained through a deterministic approach In order to take account of the many uncertainties and of the scatter in the data, and also to cover the fact that models are necessarily approximate, a "factor of safety" is introduced.

If L and R are well-established values as considered by the deterministic

approach, a safety factor FS = R/Lmay be defined When FS > 1it will be no failure or damage and as a consequence there appears the idea of “complete safety ".

The external loadings (L) as well as the strength capacity of the dam-foundation system (R) are aleatory variables due to: reservoir level variation, aleatory

character of seismic loadings, material parameter variation, foundation different mechanical characteristics, etc

Though on the mean L0<R0 , there is a domain where the maximum accidental

values of L are larger than the minimum accidental values of R

Risk analysis process involves the scientific characterisation of what

is known and what is uncertain about the present and future performance of the dam

Risk management is a strategy applied to the tasks of analyzing, evaluating, controlling, and administration of risks witch threaten the well-being of life and natural and socio-economic environment.

The main purpose of carrying out a risk analysis is to provide decision support For many applications, the resulting numerical values do not have to be accurate in absolute terms, but must be inherently

consistent so they allow reliable relative comparisons among alter-natives.

The main issue stands with the existing dams More extensive floods records, and possibly changes in climatic conditions since the construction

of a dam, necessitate updating of flood estimates and re-evaluation of dam safety Significant changes in physical conditions both upstream and downstream since the dam was built require a review of the risks involved.

Dam Safety and Risk Assessment

Limits of Factor of Safety approach

The assessment of safety in civil engineering works is traditionally obtained through a deterministic approach In order to take account of the many uncertainties and of the scatter in the data, and also to cover the fact that models are necessarily approximate, a "factor of safety" is introduced.

If L and R are well-established values as considered by the deterministic

approach, a safety factor FS = R/Lmay be defined When FS > 1it will be no failure or damage and as a consequence there appears the idea of “complete safety ".

The external loadings (L) as well as the strength capacity of the dam-foundation system (R) are aleatory variables due to: reservoir level variation, aleatory

character of seismic loadings, material parameter variation, foundation different mechanical characteristics, etc

Though on the mean L0<R0 , there is a domain where the maximum accidental

values of L are larger than the minimum accidental values of R

2

The surface of the intersection domains, where L > R, represents a measure of the probability of failure P f If the distributions of L and R have large variances

the failure probabilities are large and the safety factors lose its physical significance.

Flattening the downstream slope FS increases but probability of failure has

a lower bound – no complete safety exists

Safety analysis of a homogeneous rockfill dam:

a- failure mechanism; b- probabilities

FS

Dam Safety and Risk Assessment

Limits of Factor of Safety approach

Since an absolute safety cannot be ensured technically, dam engineering field has to move from the conventional safety-oriented perspective towards the risk-oriented perspective

The risk-oriented view point takes a risk of failure into account Thus the residual risk has to be determined, evaluated and managed even if failure seems unlikely.

Dams

safe

Limits of Factor of Safety approach

The surface of the intersection domains, where L > R, represents a measure of the probability of failure P f If the distributions of L and R have large variances

the failure probabilities are large and the safety factors lose its physical significance.

Flattening the downstream slope FS increases but probability of failure has

a lower bound – no complete safety exists

Safety analysis of a homogeneous rockfill dam:

a- failure mechanism; b- probabilities

FS

Dam Safety and Risk Assessment

Limits of Factor of Safety approach

Since an absolute safety cannot be ensured technically, dam engineering field has to move from the conventional safety-oriented perspective towards the risk-oriented perspective

The risk-oriented view point takes a risk of failure into account Thus the residual risk has to be determined, evaluated and managed even if failure seems unlikely.

Dams

safe

3

Dam Safety and Risk Assessment

Lessons from past failures

St Francis damMain cause of failure was the large deformation of the geologic formation in the left abutment and piping of its material along the fault A massive landslide of the dam’s eastern abutment initiated the failure

The dam failed catastrophically on March 12-13, 1928, killing at least 420 people Just downstream of the dam the maximum depth of the flood was about 42 m The average velocity in this reach was about 28 km/hour

Lessons from past failures

Dam Safety and Risk Assessment

Lessons from past failures

St Francis damMain cause of failure was the large deformation of the geologic formation in the left abutment and piping of its material along the fault A massive landslide of the dam’s eastern abutment initiated the failure

The dam failed catastrophically on March 12-13, 1928, killing at least 420 people Just downstream of the dam the maximum depth of the flood was about 42 m The average velocity in this reach was about 28 km/hour

4

Malpasset dam Malpasset dam was an arch dam with a height of 66 m and with 220 m long crest at its crown The dam was commissioned in 1954 and it was the thinnest arch dam of its size in the world when it was completed.

Dam Safety and Risk Assessment

Lessons from past failures

Malpasset dam The failure occurred as the arch ruptured when the left abutment gave away The dam body was left without support on the left abutment and failed in tension

Removed rock block

PLAN VIEW

Lessons from past failures

Malpasset dam Malpasset dam was an arch dam with a height of 66 m and with 220 m long crest at its crown The dam was commissioned in 1954 and it was the thinnest arch dam of its size in the world when it was completed.

Dam Safety and Risk Assessment

Lessons from past failures

Malpasset dam The failure occurred as the arch ruptured when the left abutment gave away The dam body was left without support on the left abutment and failed in tension

Removed rock block

PLAN VIEW

5

Malpasset dam The failure was caused by the outburst of a rock block on the left abutment as

consequence of high water pressure acting on the less pervious rock mass subjected to large compressive stresses.

50,000,000 m 3 of water were released The wave induced flooding in city of Frejus located 7 km downstream

Wave killed 423 people instantly.

Dam Safety and Risk Assessment

Lessons from past failures Teton dam

Teton Dam was an earth fill dam that had 122 m high creating a 27.4 km long reservoir with a 333 Mm 3 capacity The construction work commenced in June

1972 and the dam was completed and first filling started in November 1975

The dam failed during its first filling on June 5, 1976

The cause of failure was attributed to piping progressing at a rapid rate through the body of the embankment Erosion

on the underside of the core zone by excessive leakage through and over the grout curtain was the cause of destruction.

MAIN CROSS SECTION

CROSS SECTION WHERE FAILED STARTED

ZONE 1

Lessons from past failures Belci dam

During the night of July 28-29, 1991, torrential rainfall of an exceptional magnitude occurred The supply of electricity to the dam failed , preventing the full opening of the gates.

Failure occurred by external erosion and downstream slope sliding A breach of

100 m wide and about 6.5 m deep was created 3000 m 3 /s realised downstream.

Spillway Final breach

Failure mechanism - overtopping CONSEQUENCES:

17 Loss of Life;

119 Destroyed houses;

Erosion and clogging of downstream river bed

Dam Safety and Risk Assessment

Risk analysis approaches

Three categories: Standards-based, Qualitative and Quantitative.

Standards-based approach (SBA) - Risk analysis is not carried out explicitly

Consideration of risk is implied through the selection of the design loads for normal and unlikely events and of the safety coefficients based on a certain classification scheme

Qualitative approaches consider risk more explicitly than the based approach without characterising the uncertainty in probabilistic form.

standards-The simplest of these techniques are indexing and ranking schemes.

Failure Modes and Effects Analysis (FMEA) is a formal qualitative risk analysis technique Interpreting the results of the FMEA may require some measure that describes severity, importance, criticality, potential to occur, etc

Failure Modes, Effects and Criticality Analysis (FMECA) expresses by indexes the frequency and severity of the failure mechanism and its consequences ("criticality" ).

8

Failure Mode, Effects and Criticality Analysis provides a means of ranking the failure modes in terms of an index of risk that incorporate representations of probability and consequences.

The dam system components that are involved in starting certain failure mechanisms are identified The extent to which the damage of the given component may contribute to the dam failure is characterized by a criticality (gravity) index IG :

IG = CM • PC • DC

where:

- CM is a partial index that expresses the component share in the failure

mechanism;

- PC is a partial index that expresses the component failure probability;

- DC is a partial index that expresses the extent to which the component

failure may be detected in advance

Each partial index is evaluated on a scale from 1 to 5 The maximum value of the

criticality index IG =125 corresponds to the component, the failure of which has

an extremely important effect in starting the dam failure mechanism (CM=5), its failure is most likely (PC=5) and, at the same time, it is very difficult to detect in advance (DC=5).

Dam Safety and Risk Assessment

Risk analysis approachesExample FMECA:

Structural failure of a clay core earth fill dam Components:

8

32

60

4048

1

4454

4

2323

2

4544

Rip-rap / upstream shell failureImproper drainage under rapid draw-down/ upstream shell failureImproper downstream filter / pipingWeek layer in foundation / sliding of dam body or its downstream shellWindows in grout curtain / piping into foundation

IG = CMxPCxDCDC

PCCMComponent that fails / dam failure mechanism

Notes: The rip-rap failure may induce slope sliding (CM =2), the probability of such an event

occurring is relatively high (PC=4) However, it is not difficult to detect such a situation (DC = 1)

Improper downstream filter leads undoubtedly to piping if the core cracks (CM=5) The probability of cracking is medium (PC = 3), but the detection in advance, to permit useful interventions, is rather difficult (DC = 4) Likewise, the indices for the rest of the components have been established

Risk analysis approaches

Failure Mode, Effects and Criticality Analysis provides a means of ranking the failure modes in terms of an index of risk that incorporate representations of probability and consequences.

The dam system components that are involved in starting certain failure mechanisms are identified The extent to which the damage of the given component may contribute to the dam failure is characterized by a criticality (gravity) index IG :

IG = CM • PC • DC

where:

- CM is a partial index that expresses the component share in the failure

mechanism;

- PC is a partial index that expresses the component failure probability;

- DC is a partial index that expresses the extent to which the component

failure may be detected in advance

Each partial index is evaluated on a scale from 1 to 5 The maximum value of the

criticality index IG =125 corresponds to the component, the failure of which has

an extremely important effect in starting the dam failure mechanism (CM=5), its failure is most likely (PC=5) and, at the same time, it is very difficult to detect in advance (DC=5).

Dam Safety and Risk Assessment

Risk analysis approachesExample FMECA:

Structural failure of a clay core earth fill dam Components:

8

32

60

4048

1

4454

4

2323

2

4544

Rip-rap / upstream shell failureImproper drainage under rapid draw-down/ upstream shell failureImproper downstream filter / pipingWeek layer in foundation / sliding of dam body or its downstream shellWindows in grout curtain / piping into foundation

IG = CMxPCxDCDC

PCCMComponent that fails / dam failure mechanism

Notes: The rip-rap failure may induce slope sliding (CM =2), the probability of such an event

occurring is relatively high (PC=4) However, it is not difficult to detect such a situation (DC = 1)

Improper downstream filter leads undoubtedly to piping if the core cracks (CM=5) The probability of cracking is medium (PC = 3), but the detection in advance, to permit useful interventions, is rather difficult (DC = 4) Likewise, the indices for the rest of the components have been established 9

Concept of quantitative analysis

Grouped in scenarios, the probabilities of failure, here P1

to P4, are obtained from event trees or reliability analysis

The total probability of failure is the sum of failure probabilities corresponding to each scenario

An assessment of consequences renders the risk

of each scenario, R1, to R4, first

in terms of probabilities and then in monetary units

Dam Safety and Risk Assessment

Risk analysis approaches

Failure probabilities based on reliability analysis

A certain failure mechanism of the dam may be defined by a variable parameter X:

• stresses, when failure is due to exceeding the capable stresses,

• sliding coefficients, when failure is a sliding along the foundation

• discharges when failure is induced by exceeding the spillway capacity, etc

X = L as a consequence of the external loadings;

X = R expresses internal strength of the structure.

The variability of L and R may be expressed by the probability functions F L (X) and F R (X), and by

probability density functions fL(X) and fR(X) respectively

The surface of the intersection domains,

where L > R, represents a measure of the probability of failure P f

Pf= P(L > R) = F L(X) f R(X)dX

∫∞

Risk analysis approaches

Concept of quantitative analysis

Grouped in scenarios, the probabilities of failure, here P1

to P4, are obtained from event trees or reliability analysis

The total probability of failure is the sum of failure probabilities corresponding to each scenario

An assessment of consequences renders the risk

of each scenario, R1, to R4, first

in terms of probabilities and then in monetary units

Dam Safety and Risk Assessment

Risk analysis approaches

Failure probabilities based on reliability analysis

A certain failure mechanism of the dam may be defined by a variable parameter X:

• stresses, when failure is due to exceeding the capable stresses,

• sliding coefficients, when failure is a sliding along the foundation

• discharges when failure is induced by exceeding the spillway capacity, etc

X = L as a consequence of the external loadings;

X = R expresses internal strength of the structure.

The variability of L and R may be expressed by the probability functions F L (X) and F R (X), and by

probability density functions fL(X) and fR(X) respectively

The surface of the intersection domains,

where L > R, represents a measure of the probability of failure P f

Pf= P(L > R) = F L(X) f R(X)dX

∫∞

10

Failure probabilities based on reliability analysis

The probability that the dam's response to overtopping might lead to failure can be estimated by transforming the flood-pdf into a pdf of the load

L.

The pdf of the sliding

resistance R is obtained by

introducing random variables

for the shear parameters tan φ and c'.

Applying the principles of classical reliability analysis,

the probability of failure, P f is obtained

Dam Safety and Risk Assessment

Risk analysis approaches

Failure probabilities based on probabilistic trees

Once the failure modes have been identified event trees and/or fault trees can be utilized to provide the framework for determination of the failure probabilities

SCENARIO 1 SCENARIO 2

On the left side the fault tree investigates the conditions and factors that can contribute

to dam failure (called the top event) On the right side the event tree identifies the possible outcomes, and if required their probabilities, given the occurrence of the top event

Risk analysis approaches

Failure probabilities based on reliability analysis

The probability that the dam's response to overtopping might lead to failure can be estimated by transforming the flood-pdf into a pdf of the load

L.

The pdf of the sliding

resistance R is obtained by

introducing random variables

for the shear parameters tan φ and c'.

Applying the principles of classical reliability analysis,

the probability of failure, P f is obtained

Dam Safety and Risk Assessment

Risk analysis approaches

Failure probabilities based on probabilistic trees

Once the failure modes have been identified event trees and/or fault trees can be utilized to provide the framework for determination of the failure probabilities

SCENARIO 1 SCENARIO 2

On the left side the fault tree investigates the conditions and factors that can contribute

to dam failure (called the top event) On the right side the event tree identifies the possible outcomes, and if required their probabilities, given the occurrence of the top event

11

Fault tree analysis

A technique, either qualitative or quantitative,

by which conditions and factors that can contribute to a specified undesired event (called the top event) are deductively identified, organized in a logical manner and represented pictorially.

Example:

fault tree for the failure of the downstream slope of an earth dam

Dam Safety and Risk Assessment

Risk analysis approaches

Event tree analysis

A technique, either qualitative or quantitative, that is used to identify the possible outcomes, and if required their probabilities, given the occurrence of an initiating event

Event Tree Analysis is an inductive type of analysis where the basic question that is addressed is "What happens if "

Example:

event tree for one failure mode of a dam subjected to flood hazard

Risk analysis approaches

Fault tree analysis

A technique, either qualitative or quantitative,

by which conditions and factors that can contribute to a specified undesired event (called the top event) are deductively identified, organized in a logical manner and represented pictorially.

Example:

fault tree for the failure of the downstream slope of an earth dam

Dam Safety and Risk Assessment

Risk analysis approaches

Event tree analysis

A technique, either qualitative or quantitative, that is used to identify the possible outcomes, and if required their probabilities, given the occurrence of an initiating event

Event Tree Analysis is an inductive type of analysis where the basic question that is addressed is "What happens if "

Example:

event tree for one failure mode of a dam subjected to flood hazard

12

Selection of approach

A problem of balancing its refinement with the amount of information available to create the model

The results from event trees are more reliable

if available data allow quantitative

approaches.

Dam Safety and Risk Assessment

Evaluation of failure probability

Failure modes identification

A failure modedescribes how the failure of a certain dam element or component must occur to cause dam system failure.

Each failure mode can be due to one or more hazards or failure mode initiators Typically for dams, these failure mode initiators are extreme storms, earthquakes, design and construction flaws in conjunction with normal hydraulic loads, and human agency

A failure mechanism describes the physical processes and states that must occur, in accordance with natural laws, for the failure mode to progress from failure mode initiation (cause) through to the realisation of dam failure

Taken as an initiating event the clogging of the drainage system of an earth dam, the seepage line raising has to be in accordance to permeability characteristics and embankment zoning of that particular dam and the shear strength water content dependency of its fill material in order to induce the sliding of the downstream slope

Risk analysis approaches

Selection of approach

A problem of balancing its refinement with the amount of information available to create the model

The results from event trees are more reliable

if available data allow quantitative

approaches.

Dam Safety and Risk Assessment

Evaluation of failure probability

Failure modes identification

A failure modedescribes how the failure of a certain dam element or component must occur to cause dam system failure.

Each failure mode can be due to one or more hazards or failure mode initiators Typically for dams, these failure mode initiators are extreme storms, earthquakes, design and construction flaws in conjunction with normal hydraulic loads, and human agency

A failure mechanism describes the physical processes and states that must occur, in accordance with natural laws, for the failure mode to progress from failure mode initiation (cause) through to the realisation of dam failure

Taken as an initiating event the clogging of the drainage system of an earth dam, the seepage line raising has to be in accordance to permeability characteristics and embankment zoning of that particular dam and the shear strength water content dependency of its fill material in order to induce the sliding of the downstream slope

13

Failure modes identification

failures, seepage failures, and structural failures

Overtopping failures result from the erosive action of water on the embankment Erosion is due to uncontrolled flow of water over, around, and adjacent to the dam

Progressive erosion toward reservoir Piping - erosion of the soil begins at

the downstream side of the embankment, progressively works toward the reservoir.

Dam Safety and Risk Assessment

Evaluation of failure probability

Failure modes identification

Earth dam failures modes

Structural failures can occur in either the embankment or the foundation.

Most instability problems arise because of weak zones in the foundation or in the dam such as a bedding surface shear in the foundation, or poorly compacted softened zone in the dam.

Evaluation of failure probability

Failure modes identification

failures, seepage failures, and structural failures

Overtopping failures result from the erosive action of water on the embankment Erosion is due to uncontrolled flow of water over, around, and adjacent to the dam

Progressive erosion toward reservoir Piping - erosion of the soil begins at

the downstream side of the embankment, progressively works toward the reservoir.

Dam Safety and Risk Assessment

Evaluation of failure probability

Failure modes identification

Earth dam failures modes

Structural failures can occur in either the embankment or the foundation.

Most instability problems arise because of weak zones in the foundation or in the dam such as a bedding surface shear in the foundation, or poorly compacted softened zone in the dam.

14