Content uploaded by Przemyslaw Zielinski
Author content
All content in this area was uploaded by Przemyslaw Zielinski on Jul 29, 2022
Content may be subject to copyright.
1
Manuscript accepted for publication in Hydropower & Dams Issue 4, 2022
DEVELOPING SOCIETAL RISK TOLERABILITY LIMITS IN DAM SAFETY
Przemyslaw A. Zielinski
Leonard McDonald
1. INTRODUCTION
In the early 1990’s the dam engineering community, realizing that although traditional deterministic
engineering methods have resulted in a great record of dams’ performance, recognized that the changing
societal expectations for transparency and accountability required new improved methods for dam design,
operation and maintenance. Following other industries designing, constructing and operating hazardous
installations, it began exploring the approach of risk assessment as a solution to the problem at hand. The
initial focus of these efforts was on methods of risk analysis and later approaches to the difficult problem of
judgment of the significance of estimated risk and its application in decision-making.
Although all accidents causing loss of life are a cause for regret, the politicians, the regulators of safety and
the society in general tend to be more concerned about multiple fatalities in a single accident. When the
people exposed are the workers at the regulated facility, the risk of multiple fatalities is often referred to as
the group risk. When the exposed population includes strictly members of the public the term societal risk
is commonly used, and it is also applied as such in the dam safety community. The developments in the
area of tolerability limits for societal risk in dam safety are discussed in this paper.
Although the scalar societal risk measures, for example AWR - Aggregated Weighted Risk or SRI - Scaled
Risk Integral (Jonkman et al., 2003) were initially considered as useful indicators of societal risk, the
corresponding tolerability criteria have never been developed and since the 1990’s the evaluation of societal
risk in dam safety is commonly carried out with the help of risk tolerability limits defined on or
diagrams.
2. INITIAL DEVELOPMENTS
2.1 and diagrams
These diagrams present the relationships between the number of fatalities (N) and the annual probability
(f) of N fatalities or the annual probability (F) of N or more fatalities. Because f, F and N may span several
orders of magnitude the diagrams are usually constructed using the log-log scales.
Tolerable Risk Reference Lines are typically defined by a single point belonging to the line (commonly called
the anchor point) and the slope of the line.
2.2 The Beginning - 1990’s
In the early 1990’s British Columbia Hydro (B.C. Hydro, 1993) proposed the criterion for the evaluation of
societal life safety and economic risk as a line on the diagram relating the potential number of fatalities and
the annual probability of occurrence of dam failure (B.C. Hydro 1993, Nielsen et al., 1994). In Figure 1, the
criterion (the line PROPOSED B.C. HYDRO - INTOLERABLE) represents what in this paper is called f - N
criterion since it relates a number (N) of fatalities to the probability (f) of the event causing this outcome to
occur.
In 1994 the Australian National Committee on Large Dams (ANCOLD, 1994) issued a markedly different
set of interim criteria (see Figure 2) which followed the work of Higson (1990) on the criteria for individual
nuclear reactors. Higson’s criteria were represented by the concave curves with the slopes of the tangents
rapidly increasing for the number of fatalities greater than 100. ANCOLD preserved the curvatures of
Higson’s criteria and eliminated the parts of the curves for N less than 1 as illustrated in Figure 2. The
concepts of Limit and Objective curves depicted on Figure 2 have to do with the acceptability of risk. Any
risk above the Limit curve was regarded as unacceptable at the time and the risks below the Objective curve
were seen as acceptable.
2
Figure 1. Proposed B.C. Hydro societal life safety risk criteria (1993)
1
Figure 2. Interim societal risk criteria proposed by ANCOLD (1994)
The criteria in 1994 were considered to be conservative because the curves’ origins on the vertical axis
were at the probability levels consistent with existing ANCOLD deterministic guidelines (ANCOLD, 1986)
and they showed an accelerating reduction in expected value of life loss as N increased.
1
The diagram provides the illustration of the confusion about the relation between and criteria. The diagram relates the
probability of failure to the number of fatalities, and it is therefore a diagram. Plotting the tolerability limits proposed in the
Netherlands and the United Kingdom on such a diagram was inappropriate.
3
So far as the authors are aware, Higson’s criteria have not been adopted for the regulation of nuclear reactor
safety.
3. PROGRESS IN 2000’S
At the beginning of 2000’s the U.S. Bureau of Reclamation (USBR) issued Guidelines for Achieving Public
Protection in Dam Safety Decision-making (USBR, 2003) following publication in 1997 of an interim
document inviting comments. The 2003 document stated that “once risks have been estimated for a dam,
decision-makers need a framework for evaluating the risks to determine if action is required to reduce risks.
There is currently no commonly accepted industry standard for determining what risks are considered
acceptable”. The guidelines portion of this document defined the measure for evaluation of life loss
component of societal risk by stating that: “For dam safety decision-making, risk of life loss is measured as
the product of probability of dam failure and the consequences (life loss) associated with that failure. This
product is the expected annualized life loss at a given dam for a given loading condition and is referred to
as the estimated risk of life loss”.
Guidelines to evaluate the need and urgency to implement risk reduction activities based on estimated risk:
Estimated risk > 0.01
lives/year
There is justification for taking expedited action to reduce the risk …
Estimated risk between
0.01 and 0.001 lives/year
There is justification for taking action to reduce the risk …
Estimated risk < 0.001
lives/year
The justification to implement risk reduction actions diminishes as
estimated risks become smaller than 0.001
The diagram on Figure 3 illustrates the evaluation guidelines.
Figure 3. USBR diagram for displaying probability of failure, life loss, and risk estimates
ANCOLD had considered the expected value approach to societal risk criteria but was influenced by the US
National Research Council questioning the suitability of the metric (NRC 1985 – page 251). The USBR is
an agency regulating its own dams and has people who are competent to properly understand expected
value. Whereas, ANCOLD was providing guidance for a diverse range of owners, some competent in
mathematics, many less so.
The next edition of Australian guidelines (ANCOLD, 2003) abandoned the concept of the Limit and Objective
curves and replaced them with the single Limit of Tolerability line (Figure 4). The anchor point of the line
4
(1,
) was the same as the anchor point of the Limit curve in the 1994 Guidelines. The tolerability of
risk below the Limit was to be determined by the as low as reasonably practicable (ALARP) principle.
The dashed horizontal truncations of the Limit lines were ANCOLD’s judgment at the time of the lowest risks
that could be realistically assured considering the state of knowledge, available dam technology and
methods then available to estimate risks.
Figure 4. ANCOLD criteria for societal life safety risk (2003)
The current approach in North America to societal life safety risk evaluation follows the developments in the
United States and Australia described above and is summarized in the U.S. Federal Energy Regulatory
Commission (FERC, 2016) Guidelines.
Figure 5. FERC
Diagram for displaying Average Annual Life Loss (AALL) for Incremental
Risk
5
The Guidelines provide two diagrams (Figures 5 and 6) supporting the evaluation of societal life safety
risk.
Figure 6. FERC Societal Risk Guideline for Incremental Risk
It may seem that that these two FERC guidelines for risk evaluation are similar, if not identical, but they
represent different fundamental bases for risk evaluation. First indication that they are not equivalent is that
the anchor point (1, 10-3) is the same for two differently defined ordinate axes (the probability per annum
that the dam would fail in Figure 5 versus the probability per annum that its failure would cause N or more
fatalities in Figure 6).
The FERC guidelines require that the societal life safety risk is to be evaluated against both of the f-N and
the F-N criteria, which is redundant since the F-N approach is always more risk averse. The guidelines state
that “the value of Average Annual Life Loss (AALL) should be estimated from all potential failure modes
associated with all loading or initiating event types and considering all exposure conditions associated with
life loss. The estimated life loss plotted on the horizontal scale is the weighted average incremental life loss
(
). This value is averaged over all flood and earthquake loading magnitudes, all potential failure modes
and all exposure conditions (e.g., day and night) that are considered in the risk analysis. The average value
tends to be closer to the life loss estimated for those potential failure modes that are most likely to occur.
Simply put,
is the weighted average life loss per failure and can be computed as AALL/APF”.
It should be noted that AALL characterized as the ‘average’ is not an average value but the expected value.
The way the AALL is calculated clearly suggests that the vertical axis on Figure 6 instead of being defined
as ‘Frequency of dam failure’ should better be defined as ‘Probability of N fatalities’. Then the risk associated
with different outcomes of dam failure resulting in different numbers of fatalities can be properly displayed
on the diagram relating the probabilities of N fatalities to different values of N. As an example, consider the
case of an embankment failure due to the liquefaction of the foundation caused by an earthquake with the
probability of the failure (). Due to the characteristics of the population exposed to the breach wave, the
numbers of fatalities could vary depending on the warning time, on the season, timing within the workweek,
time of day, etc., creating K different fatality numbers . The K probabilities
associated with these life losses will be derived from and after normalizing by the (
) will provide the discrete probability function of a random variable ‘life loss’. Consequently, AALL
with
multiplied by the probability provides the expected value of life loss per year.
Therefore, the point with the coordinates (
plotted on the diagram will provide the
characterization of societal life safety risk from all failure modes, and all considered scenarios of inundation
and life loss development. The point represents the expected loss of life
caused by the failure of dam
6
having the probability of occurrence . Tolerable Risk Reference Lines depicted in Figures 5 and 6 have
the same anchor point (1, ) and the same negative 1 slope. The slope remains the same for N up to
1,000. But the metrics differ, as will now be demonstrated.
4. AND TOLERABILITY LIMITS IN EVALUATION OF SOCIETAL LIFE SAFETY
RISKS
4.1 Interpretation of terms
diagram
The interpretation of the anchor point is simply that the occurrence of exactly a single fatality due to a dam
failure has the annual probability of f. Therefore, a dam which has the annual probability of causing a single
fatality exceeding is deemed to be posing unacceptable risk.
The negative 1 slope of the reference line on the diagram has a quite simple interpretation. For
example, if we take two points on the line, say A (1, ) and B (10, ) the 10-fold increase in fatalities
between A and B (from 1 to 10) has the associated 10-fold decrease in probabilities of these events (from
to 10-4).
In general, it is always true that for any two points C and D belonging to the line, C and D
,-fold increase in fatalities will have associated -fold reduction in probabilities. This
property of the reference lines is often referred to as neutral aversion to risk. Such interpretation states that
the n-fold increase in the life loss has the corresponding n-fold reduction in the probability of consequences.
This interpretation follows the concept first presented in the original paper by Farmer (1967) when he used
the slope of negative 1.5. Farmer applied the negative 1.5 slope to his proposed criterion with the
understanding that it applies to individual outcomes (pairs of probability and consequence). His reasoning
was sound and logical, and it is still valid when applied to the risk criteria lines developed on diagrams.
The practice of partitioning of loading and other domains to obtain and values representative of the
continuous functions, can complicate the interpretation of plots. Coarse partitioning results in fewer
and higher
values than fine partitioning.
diagram
The risk tolerability reference lines on all diagrams discussed in the previous sections have the same
negative 1 slope. It is common to claim that such reference lines also present the neutral aversion to risk
but it can be easily demonstrated that such claims are false. A risk reference line can be derived
from a risk reference line as illustrated below.
If X denotes a random variable ‘loss of life’ then
Thus is greater than for all such that and the line represented by the equation
is positioned below the line on the log-log diagram if For the criteria
described above .
The relationship between and tolerability lines can be derived formally as follows.
The random variable X, ‘loss of life’ is often treated as a real number and thus X has a continuous distribution.
Most of the presently applied methods for estimation of life loss resulting from dam failures support this
position since they are predominantly based on fatality rates and provide non-integer estimates of the life
loss. However, such numbers can be rounded up or down to the closest integer number thus avoiding
difficulties in interpretation of the meaning of fractions of human life.
If X assumes only integer values its distribution is of the discrete type. The tolerability reference line is
defined as the criterion by the following formula:
The graphical representation of this formula is the series of points on an imaginary line passing through the
point (1, 10-3) and having the slope of negative 1 on the log-log scales of the diagram. The common
but erroneous interpretation of the negative 1 slope on the diagram is that it reflects the so-called
‘neutral aversion’ to risk. Such interpretation states that the n-fold increase in the life loss has the
corresponding n-fold reduction in the probability of consequences, as already explained in relation to the
work of Farmer (1967).
7
It follows that
The reference line and derived reference lines are displayed in Figure 7. Notice that the red
points are described by the text in red font on the vertical axis and the blue points by the text in blue font.
Thus, with any increase in N the decrease in () is proportional to 1/N2 and its decrease is much faster
than the increase of N. If the rate of () decrease is greater than the rate of N increase, then such
reference line can be associated with the increased aversion to risk.
The simple conclusion is that although the reference lines and as depicted in Figures 6 and 7
look identical, they represent very different risk evaluation criteria. See also Zielinski (2019).
Figure 7. risk tolerability reference line derived from line
4.2 Existing justification for the criteria
There is very little justification for the selection of the anchor point or the slope of the lines on and
diagrams.
In 1993 B.C Hydro Interim Guidelines the positioning and the slope of the line on a diagram were
justified as follows:
“In selecting an appropriate probability of an event resulting in one fatality, a review of international practice
and government legislation was conducted. A probability of 10-3 for an event resulting in one fatality appears
to be conservative upper limit above which the risk is unacceptable. This is not to say that in some case
higher risks are not accepted. For instance, in the United Kingdom, a probability of 10-1 for a one death
event is considered to be intolerable and a value of 10-4 is considered to be negligible…
The parameter which represents the relative degree of unacceptability of events with increasing undesirable
consequences is based on international practice. In the Netherlands for industrial accident hazards
associated with operational accidents it has been decided that a consequence ‘n’ time greater must
correspond to a chance ‘n’ time smaller. In the United Kingdom for industrial accidents, a consequence ‘n’
times greater corresponds to a chance ‘n’ time smaller”.
The 10-3 probability for a single fatality provided what is often called the ‘anchor point’ of the criterion line.
Its slope of negative 1 on the log-log diagram is defined by the rule of relative degree of unacceptability ‘n
times greater - n times smaller’.
In the paper (Nielsen and Hartford, 1994) following the BC Hydro Guidelines the authors provided a very
brief discussion justifying the position and shape of the criterion line but fell short of any solid arguments.
There is no evidence supporting the claim that “societal risk of 10-3 fatalities per annum for a dam is a
reasonable upper limit for tolerable societal risk” and the claim that ANCOLD (1994) guidelines “identified a
limit of tolerable societal risk like that proposed by B.C. Hydro” is erroneous since the B.C. Hydro criterion
8
line is of a f - N type and the Australian is not. In addition, the criterion then proposed by ANCOLD had a
varying and increasing negative slope (it had a concave curve on the log-log diagram).
The 1994 ANCOLD Guidelines did not offer any arguments supporting full acceptance of criteria
(including the anchor point) proposed by Higson (1990). It may be pointed out that Higson in conclusion of
his paper stated that “the criteria recommended in this article have no fundamental basis. Indeed, there is
no fundamental approach to this issue and no way of proving whether any proposed criteria are right or
wrong except by using them over a period of time and discovering whether the costs, risks and other
consequences of their use meet the requirements of society”.
In selecting the anchor point in 2003 ANCOLD also considered the advice from the Ball and Floyd (1998)
report which reviewed the societal risk criteria recommended in the United Kingdom, Hong Kong and the
Netherlands. The report stated that “A key finding is that there is a surprising degree of consistency amongst
FN-based societal risk criteria developed at different times, in different places, for different purposes and by
different routes”. Of the 7 available anchor points reviewed in Table 2 the range was (1,10-1) to (1,10-3), with
five cases having an anchor point equivalent to (1, 10-3). Whilst recognizing that a negative 1 slope had a
degree of risk aversion, Ball and Floyd used the common but erroneous term “risk neutral” to describe that
slope. They went on to say “…the evidence gathered here, while limited, tends to support an ex-ante view
of risk neutrality when considered purely in terms of multiple fatalities”. The support for a -1 slope was clear
and ANCOLD adopted that slope.
In 1999 (Von Thun, 1999), USBR used the historic failure data for the portfolio of Reclamation’s dams to
derive the value of annualized life loss. The data for the portfolio of 365 USBR dams with the average age
of 30.7 years each provided the approximate annual failure probability of 10-4 which combined with the
estimated loss of life of 10 for a single failure
2
resulted in annualized loss of life equal to approximately
.
At the time of writing the Reclamation memorandum it was considered that the “guideline should promote a
condition better than the historic rate of dam failure prior to the late 1970’s which marks the advent of Federal
and State Dam Safety Programs and the passage of Federal Dam Safety Legislation”. Therefore, the
probability of annualized loss of life due to dam failure of (close to but slightly above the historic level
) for the portfolio of Reclamation dams was proposed and accepted. Additional analysis (Von
Thun, 1999) of annual probability of life loss incurred by an individual living within a dam flood zone of a
high or significant hazard dam in the United States provided the estimate of for the period of
1980-96 but did not influence the decision.
The USBR dams dataset used for developing risk evaluation guidelines came from the USBR, the
organization with a long and successful tradition in building and operating a large portfolio of dams and as
such it provides a sound basis for calculations aiming at the identification of recommended value for the
target probability of annualized loss of life.
It may seem that accepting dam safety conditions from the period prior to implementing modern dam safety
programs as the target provided an expected value of life loss criterion that was too high. However, although
such approach contradicted the memorandum statement quoted above it might have been the right target
for Reclamation for reasons that have not been disclosed. The numbers calculated for the period after 1980
dropped well below and are now possibly approaching . But the target number has never been
updated and the present target aims at the safety levels maintained at Reclamation prior to the modern dam
safety era.
A different argument for justifying probability in selecting the anchor point for risk evaluation
guidelines was put forward by Bowles (2011) who proposed the value of at which the societal risk guideline
intersects the - axis (i.e., at fatality). Bowles stated that “a value of 1 in 1,000/year is commonly
used based on the back-ground mortality rate for people in the prime years of their life”. Notwithstanding
the fact that it is unclear why a background fatality rate is appropriate for the purpose of defining the societal
risk tolerability limits, this is still an interesting proposition since it implies that the vertical coordinate of the
anchor point can be adjusted up or down depending on the actual fatality rate of a selected population
group. These rates vary in a significant way from country to country which would suggest that the proposed
vertical coordinate of the anchor point should be adjusted according to the national mortality data of the
country following this proposition.
2
Teton Dam failure in 1976.
9
4.3 Derivation of societal risk criteria based on dam failure data
Part III of the appendix to the report Von Thun (1999) includes an analysis of fatalities from failure of high
and significant hazard dams in the United States of America over two periods:
• 1960 to 1979.
• 1980 to 1996.
In consideration of these analyses, it was our conclusion that including both high and significant hazard
dams would substantially overstate the risk to life, whereas analysis of just high hazard dams would
understate the risk, but to a minor extent. This conclusion arose from the usual definitions:
• High hazard – loss of life would be expected.
• Significant hazard – loss of life is not expected but there would be substantial adverse economic,
health and environmental consequences.
Our analysis was undertaken of high hazard dams over three periods:
• 1960 to 1979.
• 1980 to 2013.
• 1960 to 2013.
Results were obtained for:
• Expected value of lives lost from dam failure per dam per annum – denoted
E(Lives).
• Probability per annum of one or more lives lost by dam failure – denoted
F(1).
• Probability per annum of one life lost by dam failure – denoted
f(1).
The estimated data for high hazard dams are in this table.
Symbol
Definition
D
Average number of high hazard dams over the period
Y
Number of years over the period
L
Number of lives lost through dam failure over the period
F
Number of dam failures with fatalities over the period
N
The number of lives lost from a dam failure
E(Lives)
Expected value of lives lost through dam failure per dam per annum
F(1)
Probability per annum of
f(1)
Probability per annum of one life lost due to dam failure
Analysis
Period
Y
D
D*Y
L
E(Lives)
F(1)
f(1)
1960-2013
54
9,000
486,000
324
6.6710-4
5.1410-5
1.2310-5
1960-1979
20
6,000
120,000
300
2.5010-3
1.3310-4
2.5010-5
1980-2013
34
11,0000
264,000
24
6.4210-5
2.4110-5
8.0210-6
Note that:
• the expected value of lives lost per dam per annum from dam failure is the number of lives lost in a
period divided by the number of dam years for that period.
• the probability per annum of one or more lives lost is the number of dam failures with life loss over
the period divided by the number of dam years for that period.
• The probability per annum of one life lost due to dam failure is the number of dam failures with one
life lost over the period divided by the number of dam years for that period.
It follows that
E(Lives)
is normally greater than
F(1)
which is normally greater than
f(1).
In this analysis the number of lives lost should be accurate because it is based on Graham (1999) and
USBR (2014). The number of high hazard dams is accurate since about 2000, being based on ASCE (2001,
2005 and 2013) but is less accurate for earlier decades. In any event, the aim here is to demonstrate an
approach that can be taken rather than the presentation of reliable data.
Such an analysis does not tell us anything useful about societal risk criteria, unless the data can be related
to community attitudes on tolerability. But there is evidence that there was community disquiet within the
USA even prior to the failure of Teton Dam in 1976. At section B.3.2 of USACE (2014) it is said that the US
Congress passed The National Dam Inspection Act in 1972 as a response to a series of dam failures such
as Buffalo Creek Dam in West Virginia and Canyon Lake Dam in South Dakota, which together caused the
loss of 158 lives. Subsequent statutes and Presidential orders in the wake of the Teton Dam failure led to
a major improvement in dam safety practice from around 1979, which is reflected in the data in the table
10
above. There are grounds for concluding that dam failure statistics had reached the limit of tolerability by
the mid-1970s in the USA.
A final point to make is that an
F-N
criterion line does not determine the tolerability of risk. That is determined
by the ALARP principle. The limit line simply defines the risk level above which a dam owner no longer has
the opportunity to rely upon an ALARP case. Arguably it is better to err a little too high in setting the line,
rather than too low, to avoid denying owners the opportunity to rely upon an ALARP case where they should
properly have that opportunity.
Looking at the
F(1)
value of 1.33x10-4 per annum for the period 1960 to 1979 it is reasonable to see an
anchor point somewhere in the range 5.0x10-4 to 1.0x10-3 per annum as one supported by
community response to dam failures for the circumstances and culture of the USA.
Unfortunately, few countries have the data such as is publicly available in the USA. Moreover, datasets
with just a few dam failures are a problematic basis for setting criteria because a single event in the future
could radically change the data set.
5. EXAMPLE DEMONSTRATING NON-EQUIVALENCY OF CURRENTLY USED AND
CRITERIA
Consider the following example in which the life safety consequences of dam failure are characterized in
the table below.
Number of fatalities
Annual probability of causing fatalities
2
1.0010-5
20
8.0010-6
5
3.0010-6
300
1.0010-6
• Probability distribution of potential life loss using criteria
Step 1: With values listed from the smallest number of fatalities to the largest, compute the cumulative
probability per annum F of life loss Ni or greater.
i
Number of
fatalities, Ni
Annual probability of
causing fatalities, pi
Cumulative probability
1
2
1.0010-5
2.2010-5
2
5
3.0010-6
1.2010-5
3
20
8.0010-6
9.0010-6
4
300
1.0010-6
1.0010-6
Step 2: Plot the function on the log-log diagram (Figure 8)
Figure 8. Example results using criteria
11
Since the blue line representing the total risk remains partially above the tolerable risk reference line the
risk is unacceptable and must be reduced.
• Average annual life loss (AALL) using criteria
i
Number of fatalities Ni
Annual probability of causing
fatalities pi
1
2
1.010-5
0.455
2
5
3.010-6
0.136
3
20
8.010-6
0.364
4
300
1.010-6
0.045
Sum
2.210-5
1.00
Weights qi are calculated in the last column and
=
FERC Guidelines state that “the estimated life loss plotted on the horizontal scale is the weighted average
incremental life loss (
). This value is averaged over all flood and earthquake loading magnitudes, all
potential failure modes and all exposure conditions (e.g., day and night) that are considered in the risk
analysis”. The weights qi associated with the life losses Ni provide the discrete probability density function
of a random variable ‘life loss’ conditional on failure occurring. Consequently,
the expected value of life
loss associated with the probability of dam failure.
The point representing the expected loss of life
and the probability of failure is plotted on the
diagram below (Figure 9).
Since the green diamond representing the total risk remains below the tolerable risk reference line the risk
is tolerable and may remain at the present level if the ALARP requirement is met.
Figure 9. Example results using criteria
6. CULTURE AND HAZARD
Culture and hazard affect risk perception and community tolerance of risk.
A key cultural determinant is the legal system which applies within a jurisdiction. For example, one very
clear difference is that between the British common law legal system and the Civil Code legal system which
applies throughout most of Europe. Ale (2005) has examined the implications of these two legal systems
for risk evaluation criteria. Also, legal powers and obligations of entities like big dam owning Crown
Corporations in Canada differ from powers and obligations of the U.S. Federal Agencies. The important
point is that the legal system, of whatever type, has implications for the evaluation of risks.
Cultural traditions have been shown to affect risk perception in significant ways (Weber and Hsee, 1999,
Gierlach et al., 2010 and Rohrmann 2013).
12
It is reasonable to believe that the economic circumstances of a country and its background mortality
statistics would also influence the community tolerance of risk. Depending on the level of development,
economic situation of the country, the level of background risk that people tolerate and general socio-
economic realities, risk evaluation criteria appropriate in one country may be either too excessive or not
stringent enough in other jurisdictions.
The political implications of introducing new safety evaluation approaches need consideration. Such
introduction may trigger requests for full transparency by providing clear justification for the determination
of tolerable risk level. This differs from the present situation when the public trusts that engineering safety
criteria are derived in a manner ensuring appropriate and just levels of safety. Introduction of risk evaluation
criteria for dams will have certain economic consequences. In many countries the Government owns all
dams, and the costs of their operation is covered from the general budget. If the purpose of the dam safety
regulation is to protect lives, the funds spent on ensuring safety of dams may be better allocated elsewhere
(for example on better health care resulting in lowering of mortality rates) providing more benefits.
Within a given cultural setting it has been shown that risk perception and tolerance varies across hazards.
This reality has been well demonstrated by Slovic and Weber (2002). Their Figure 3 neatly captures the
many considerations influencing this variability. Caution is needed in transferring risk evaluation criteria
from one hazard to another. That may be reasonable when the risks arising from the hazards are viewed
similarly by communities, but it might be quite inappropriate in other situations where there is a wide
divergence in risk perception.
7. CONCLUSIONS - IMPLICATIONS FOR REGULATORS OF DAM SAFETY
In establishing the national life safety risk tolerability criteria, it is unfortunately a common practice to
“borrow” the criteria or guidelines from other jurisdictions that have already published their regulatory
requirements for tolerable risk.
Dam owners or regulators involved in developing risk evaluation criteria that would be appropriate for their
portfolios and jurisdictions should consider the following aspects of deriving the risk evaluation criteria:
▪ The anchor point (1, ) for the tolerable risk reference line on the FERC diagram was
selected by the USBR in 1999 based on the past performance of the USBR dams ending in 1979. It
seems that accepting dam safety conditions from the period prior to implementing modern dam safety
programs may provide an insufficiently stringent target in the XXI Century. The numbers calculated for
the period after 1980 dropped well below and are now approaching . However, the target
number has never been updated and the present target still aims at the safety levels representing the
state of safety of the dams owned by the USBR prior to the modern dam safety era.
▪ The calculated value of F(1) from the performance of USBR dams to 1979 would be around 1.0x10-4
per annum since there was one dam failure with eleven lives lost (USBR 2014).
▪ Based on an analysis of all USA high hazard dam failure data from 1960 to 1979, a case could be
made that an anchor point between and per annum was a reasonable anchor
point for the USA at the time. The analysis for the period 1980 to 2013 gives an anchor point an order
lower. The evidence is that this much lower level of risk is tolerated by the US community.
▪ The anchor point with coordinates () for the tolerable risk reference line on the diagram
was selected by ANCOLD in 2003 based on the Ball and Floyd (1998) review.
▪ Contrary to popular beliefs the risk tolerability line with negative 1 slope on the log-log diagram
does not represent the neutral aversion to risk in the common understanding of the term neutral. This
problem has already been pointed out in Ball and Floyd (1998) but has been disregarded when
developing risk tolerability lines.
▪ At the present, no self-regulatory organization, the government or non-government professional
association has ever provided a solid justification for the shape or/and the positioning of tolerable risk
lines.
▪ Introduction and application of both and criteria without full understanding of their
relationship may lead to confusion and improper interpretations. The confusion is caused primarily by
the lack of recognition that identical slopes of the risk tolerability reference lines on and
diagrams represent significantly different accounting for risk aversion.
▪ Extreme care is necessary in transferring risk evaluation criteria between jurisdictions. What needs to
be considered includes:
13
o Difference in legal arrangements for dam safety between countries
o Political aspects of introducing safety criteria that differ from traditional ways of assuring public
safety
o Societal expectations
o Cultural traditions
o Broad economic aspects of safety regulation
o Existing background natural risk
▪ Within a cultural setting care is needed in transferring risk evaluation criteria between hazards,
depending on whether the community perceives the hazards similarly or whether there is a wide
divergence in risk perception.
REFERENCES
1 Ale, B.J.M. (2005). Tolerable or Acceptable: A Comparison of Risk Regulation in the United Kingdom and in the
Netherlands. Risk Analysis, Vol. 25, No. 2.
2 ANCOLD (1986). Guidelines on Design Floods for Dams. Australian National Committee on Large Dams. Reprinted
1990.
3 ANCOLD (1994). Guidelines on Risk Assessment. Australian National Committee on Large Dams Inc. January
1994.
4 ANCOLD (2003). Guidelines on Risk Assessment. Australian National Committee on Large Dams Inc. October
2003.
5 ASCE (2001). 2001 Report Card for America’s Infrastructure.
6 ASCE (2005). Report Card for America’s Infrastructure.
7 ASCE (2013). 2013 Report Card for America’s Infrastructure.
8 Ball, D.J. and Floyd, P.J. (1998). Societal Risks: A Report Prepared for the Health and Safety Executive.
9 B.C. Hydro (1993). Guidelines for Consequence-based Dam Safety Evaluations and Improvements. Hydroelectric
Engineering Division. Report No, H2528, August 1993.
10 Bowles, D. (2011). Tolerable risk guidelines for dams: principles and applications. Proc. Conference: 3rd
International Week on Risk Analysis, Dam Safety and Dam Security, Valencia, Spain, 17 ‐ 18 October 2011 3rd
International Forum on Risk Analysis.
11 Farmer, F.R. (1967). Siting criteria - a new approach. J. British Nuclear Energy Society, 6(3).
12 FERC (2016). Risk-informed Decision-Making Guidelines. Version 4.1. U.S. Federal Energy Regulatory
Commission.
13 Gierlach, E., Belsher B. E. and Beutler, L.E. (2010). Cross-cultural differences in risk perceptions of disasters. Risk
Analysis, Vol. 30, No. 10.
14 Graham, W.J. (1999) A Procedure for Estimating Loss of Life Caused by Dam Failure, US Bureau of Reclamation,
Denver, Colorado.
15 Higson, D.J. (1990). Nuclear safety assessment criteria. Nuclear Safety, 31(2). April-June.
16 Jonkman, S.N., van Gelder, P.H.A.J.M., Vrijling, J.K. (2003). An overview of quantitative risk measures for loss of
life and economic damage. J. of Hazardous Materials, A99.
17 Nielsen, N.M., Hartford, D.N.D., & MacDonald, T.F. (1994). Selection of tolerable risk criteria for dam safety
decision making (CDSA--CE04627). Canada.
18 Nielsen, N.M., and Hartford, D.N.D. (1994). Risk analysis as an aid to engineering judgment in dam safety
evaluations. Association of State Dam Safety Officials, Annual Conference, Boston, MA.
19 NRC-US National Research Council. (1985). Safety of Dams – Flood and Earthquake Criteria. National Academy
Press, Washington, DC.
20 Rohrmann, B. (2013). Comparisons of risk perception in different cultures: Profile and synopsis of a social science
research venture conducted in 9 countries. Final Report. Downloaded from http://www.rohrmannresearch.net on
March 10, 2022.
21 Slovic, P. and Weber, E.U. (2002). Perception of Risks Posed by Extreme Events. Conference on Risk
Management Strategies in an Uncertain World, Palisades, New York, 12-13 April.
22 Von Thun, J.L. (1999). Background on Philosophy and Technical Rationale for Reclamation’s Dam Safety, Public
Protection Guidelines. Von Thun, J.L. (1999). Background on Philosophy and Technical Rationale for
Reclamation’s Dam Safety Public Protection Guidelines (Final version prepared 9-21-99. Memorandum from Larry
Von Thun to Chuck Hennig and Risk Cadre Members.
23 USACE (2014). Safety of Dams – Policy and Procedures. ER-1110-2-1156. 31 March 2014.
14
24 USBR (2003). Guidelines for Achieving Public Protection in Dam Safety Decision making. U.S. Department of the
Interior. Bureau of Reclamation. Denver, Colorado, June 15, 2003.
25 USBR (2014) RCEM – Reclamation Consequence Estimating Methodology: Dam Failure and Flood Event Case
History Compilation. Interim draft, February 2014. United States Bureau of Reclamation, Denver, Colorado.
26 Weber, E.U., and Hsee, C.K. (1999). Models and mosaics: Investigating cross-cultural differences in risk perception
and risk preference. Psychonomic Bulletin & Review. Vol 6 (4)
27 Zielinski, P.A. (2019). Risk aversion in life safety risk guidelines for dams. Hydropower & Dams Vol. 26, Issue 3.
AUTHORS’ BIO NOTES
P. Andy Zielinski, P. Eng is presently an independent consultant after retiring in 2018 from the position of
Senior Manager, Technology and Dam Safety at Ontario Power Generation in Canada. He has over 50 years
of experience in water resources engineering, including hydrologic modeling, river systems design,
development and operation, dam safety risk assessment. He holds Master of Science and Ph.D. degrees in
Civil Engineering from Warsaw Technical University and Master of Mathematics degree from the University of
Warsaw. He is the past Chairman of ICOLD Committee on Dam Safety (2004-2021) and Honorary Vice
President of ICOLD (2013-2015).
Leonard McDonald, B.E., M.Eng.Sc., is a retired civil engineer with 46 years continuous work on dams,
including design, construction oversight and safety evaluation. He was a member of the dam safety regulator,
New South Wales, Australia for 22 years, being its chairman for 12 years. He was an independent consultant
on dam safety in Australia and overseas for 18 years. He holds Bachelor of Engineering and Master of
Engineering Science degrees from the University of New South Wales, Australia. He is an honorary member
of the International Commission on Large Dams and of the Australian National Committee on Large Dams
