The classification of dams strictly for dam safety purposes is somewhat different from the classification a dam owner may wish to make to protect his asset. This is because although the intent of the dam owner and a dam safety official are the same (that is, to ensure the long term safe operation of a dam), the underlying motivations are different.
Classifying dams for dam safety purposes
For the purposes of dam safety, the classification system is used to provide guidance to the evaluator. The classification is also used to determine surveillance requirements, dam safety review scheduling, inspection frequency and other tasks needed to ensure an appropriate level of safety is maintained. The underlying concept is that the dam needs to be constructed and maintained in a state that third party losses in the event of a hypothetical dam failure do not exceed acceptable levels.
Based on the classification of the dam, the conditions that the dam needs to resist (such as the design earthquake and flood) to ensure that it does not present an unacceptable danger to the environment or the public are selected. This is established by determining the incremental effects that might occur if the dam were to fail. These effects are measured in three ways:
• Incremental losses to the environment.
• Incremental economic loss.
• Incremental risk to human life.
It is essential to remember that the intent of the dam safety classification is to protect the public and the environment in case of a dam break. Therefore, it is necessary to establish whether or not a dam failure event would, in fact, cause incremental losses. For example, for many smaller dams, tailwater levels during an extreme event, such as the probable maximum flood (PMF), can be many metres above the crest of the structure. In these cases, the dam becomes ‘drowned out’ such that, even if the dam were to fail during the flood, the effects of the failure would be unnoticeable. In this case, it would not benefit the public to design the dam to resist the effects of the PMF since the same losses would occur with or without a failure. For such cases, progressively higher frequency floods are assessed in order to determine the magnitude of the flood that would result in unacceptable incremental losses. This flood is then selected as the IDF (inflow design flood).
Alternatively, a dam may be found to pose no risk in case of a flood. However, it may be found to pose an unacceptable hazard to the public if it were to fail as a result of a random loading such as might be generated by an earthquake. In such cases, designing the dam to resist the earthquake is necessary to protect the public. However, there would be no benefit to the public to design this example dam to resist the PMF. For this reason, for dam safety purposes, it is necessary to identify both the hazards posed by a dam if it were to fail during flood, and the hazards associated with failure during a random event (i.e. the so called ‘sunny day’ or ‘normal’ condition).
Owner’s classification
The dam owner also has a vested interest in protecting the public. It is, therefore, necessary for the owner to determine incremental third party losses associated with a hypothetical dam failure event, and ensure that his structure satisfies dam safety standards such that failure of the dam does not result in unacceptable losses. In addition, the owner also wishes to protect his asset. Therefore, it is often necessary to assess his own internal costs that might occur in the event of a dam failure. These internal costs might include:
• Loss of generation.
• Costs to re-build the asset.
• Costs to repair damages caused by flooding of generation equipment.
It is important to recognise that these internal costs are the owner’s risk that does not impact public safety. As such, the dam should not be classified for dam safety purposes using these criteria. However, the internal owner’s risk (IOR) needs to be assessed as it may be in the owner’s interest to provide additional protection to his dam to reduce his economic exposure in the event of a dam failure event. This classification should not, however, be confused with the ICC (incremental consequence category) or ihp (incremental hazard potential) classification for public safety purposes. Essentially, this classification, that is the IOR, is based on economic considerations and the amount of risk that the owner can tolerate. As such, the criteria for this classification must be set by the owner to suit his particular financial circumstances. In all cases, this classification would, by definition, be the same as or greater than what would be required to satisfy dam safety (or third party) concerns
Regulatory requirements
Dam safety is a fundamental concern of responsible dam owners and regulators alike.
Dam safety is a fundamental concern of responsible dam owners and regulators alike. Studies of the risks associated with dam ownership was initiated in the US decades ago that resulted in the issuance of official guidelines by the Office of Energy Projects in 1991. In Canada, the Canadian Dam Association (CDA) has also performed similar assessments that led to the development of a comprehensive set of dam safety guidelines that outline recommended methods and standards for the evaluation of water-retaining structures and spillways patterned after the Federal Regulatory Commission (FERC) guidelines. The application of these guidelines is voluntary, but they are widely recognised across Canada.
There are no national standards for dam safety in Canada. Similar to the situation in Austrialia, the actual formal regulations for dam safety are formulated and administered on a provincial basis. In Canada, provinces enact dam safety regulations specific to the needs of that province. This results in some differences in the dam safety standards in the various provincial legislation, however, the general philosophy of the regulations is more or less consistent. Internationally, there are examples of both national and provincial regulators depending on the country and its political considerations. However, as indicated below (taken from ‘Regulatory Frameworks for Dam Safety’ the World Bank, 2002) the most common method is to enact federal legislation:
• Federal and state legislation – the US
• Provincial legislation – Canada and Australia
• Federal legislation – 17 countries
In Canada, the provinces of British Columbia, Alberta and Quebec have enacted dam safety regulations. Each have specific differences but the general intent is in accordance with the CDA guiding principles. The Ontario government, through the Ministry of Natural Resources (MNR), is in the process of developing a provincial dam safety guideline and various draft issues of the guideline have been circulated. Although they were developed, in part, based on the CDA guidelines, they have a somewhat broader approach (i.e. environmental consequences are considered). In addition, the proposed Ontario guidelines tend to be more perceptive and encompass certain aspects of the Ontario Lakes and Rivers Improvement Act that are not part of the national CDA guidelines. They are quite specific in terms of risk to human life, and the economic and social risks. As with most of the guidelines, the Ontario Dam Safety Guidelines (ODSG) concentrate solely on potential third party damages. These guidelines are not in force and have not yet been enacted in any way as yet, although the MNR and various local conservation authorities are using the proposed provincial guidelines for their own dams. Presently, work continues on the review of these guidelines and it is understood that dam safety legislation is still planned for the near future.
For this reason, in Ontario, and in other jurisdictions across Canada, the practice of dam safety is not driven by regulations or legislation. Rather, it is driven by a dam owner’s sense of stewardship and responsibility, and in recognition of the often significant potential liabilities that accompany many dams.
Comparison of US dam safety regulations and guidelines
Differences in the various types of classification systems that exist in the US were examined on the basis of a review of the FERC and CDA guidelines as well as existing and pending provincial dam safety regulations. A summary of the comparative incremental consequence categories, related to elements of and the degree of risk to downstream stakeholders, is presented in Figure 1.
Threshold levels for the classification systems based on Incremental Hazard Potential (IHP) or Incremental Consequence Category (ICC) are also shown in Table 1. This provides a useful backdrop for discussion purposes although, as discussed as follows, hazard and consequence based guidelines are not strictly comparable.
Hazard potential vs. consequence
The degree of risk that a dam structure imposes to downstream interests will vary depending on the size of the structure, the volume of water retained and the type and extent of downstream development. Various dam safety guidelines have attempted to normalise and quantify the incremental consequences of a dam break by establishing various categories of dams based on the degree of exposure. All of the guidelines that were reviewed as part of this current assessment are consistent in one respect. The fundamental approach to assessing the risks of dam failure is that evaluation of increasing degree of exposure should be based on both the potential for loss of life and the potential for escalating third party property/environmental damages. These two elements are considered somewhat independently, with greater emphasis placed on the loss of life exposure.
In reviewing the various guidelines, it should be noted that a fundamental difference exists between an incremental hazard and incremental consequences. When dams are classified based on the hazard they present, the classification of the dam does not change regardless of any mitigation measures that may be implemented to mitigate the risk. For example, if, during a flood, there were an incremental risk of inundation and loss of life, the dam would be classified as a high hazard structure. This rating would not reduce if appropriate warning measures were instituted such that all persons could be effectively evacuated in the event of a dam break. In other words, the dam will still present the same level of hazard regardless of what measures are used to reduce exposure.
Consequence based ratings, on the other hand, would change in the event that measures are taken to reduce or eliminate incremental losses following a dam failure. For the same dam described above, if measures were taken to ensure evacuation of residents was accomplished before the flood wave reached the town site, the incremental downstream consequences would be eliminated and the ICC classification could be reduced from high to low. This fundamental difference however, can be mitigated if warning time is removed from the evaluation of the consequences of failure. Indeed, the term Incremental Consequence Classification has been determined by the CDA to be much more politically acceptable that a Hazard Classification. The reason for this is that the general public are more comfortable living downstream from a high consequence dam than they would be living downstream from a high hazard dam.
Guidelines based on incremental hazard potential
The original FERC guidelines provided three hazard classifications:
• High – clear danger to human life and/or serious third party damage. potential:
• Significant – Possible danger to human life and/or significant damage. potential:
• Low potential – no expected danger to human life and some downstream damage.
The draft Ontario Dam Safety Guidelines are similar, concentrating on third party exposure in the assessment of risk. In this case, four categories are recognised:
• A high hazard potential where potential damages may exceed C$10M (US$8M) and the exposure includes large residential or concentrated commercial or industrial areas. In this category, potential damage to major highways or railways located downstream and significant environmentally damage is flagged. The threshold for incremental loss of life (ILOL) for a high category dam is set at one.
• A significant classification is applied to a structure in which incremental loss of life in the event of a dam failure would not be expected and potential damages fall between C$1M (US0.8M) to C$10M (US$8M).
• The low category is applied to dams in which a failure would result in no loss of life and third party damages would be less than C$1M (US0.8M).
• The very low hazard potential, is provided for small dams where there is no potential for loss of life and the potential for damage as a result of a dam failure is less than C$1M (US$0.8M).
The wording for the loss of life exposure can, potentially, be a problem for an evaluator, especially where recreational activities are prevalent on the reservoir or where transient individuals, such as fisherman, frequent the area downstream of the dam. For example, consider the case of a dam in which failure would not result in inundation of any dwellings or any economic/environmental loss. In the event of a large flood event, it would be unlikely that boaters or fishermen would be on the reservoir/river. Therefore, for the flood case the IHP could be considered low. In the case of an earthquake, there might be some transient use near the dam. However, for a dam in a remote location, the combined probability of infrequent transient use occurring at the same time as an earthquake would be very low. Therefore, the dam could be classified a low hazard structure. On the other hand, if the dam is situated in a prime tourist area, where boaters and fisherman make use of the reservoir and the stream downstream of the structure, it might be reasonably expected that someone could be present when an earthquake occurs. In this case, the dam would be classified as having a high ICC for the ‘sunny day’ earthquake case but would probably still be judged to be a low consequence dam for the flood case since it would still be very unlikely that recreational activities would be ongoing during a major flood event.
The problem for the evaluator occurs when regulators choose to specify that, for a low hazard dam the potential for loss of life is ‘none’ without any qualifying text. In the litigious post 9/11 days in the US, such words can lead to very conservative dam classifications that, ultimately do not serve the public interest. A far better choice of words is ‘none expected’.
Guidelines based on incremental consequences
The CDA guidelines make use of the consequences of dam failure to establish the dam classification. The classification categories that were considered relevant correspond, in name, to the hazard potential ratings suggested by FERC with an additional category added to differentiate between serious and potentially catastrophic failure consequences. This very high consequence category was included by the CDA to cover the condition were a dam break could result in a large number of incremental fatalities and/or extreme damage potential. The motivation for adding an additional category was to define the types of structures that warranted correspondingly stringent design requirements including the ability to safely pass the PMF and withstand the Maximum Credible Earthquake (MCE).
The less stringent high category allows recognition of the potential risk to a reduced number of persons and lower property damages. It then provides an appropriate relaxation in design standards that equates to a reasonable economic tradeoff between owners obligation to meet the standards of design and an acceptable level of risk.
For life safety risk, the guidelines suggest that the threshold between very high and high correspond to a ‘large number’ versus ‘some’ fatalities and the establishment of a more definitive criteria should be consistent with societal expectations. The assessment of damages under the CDA guidelines includes socio-economic, financial and environmental considerations; it does not, however, dictate the extent or limitations of the assessment of the potential loss. The Ontario Power Generation (OPG) dam safety technical division undertook an interpretation of these CDA guidelines, in the absence of a provincial regulation. They have adopted an ILOL of 100 people or more, which is considered to meet reasonable societal expectations. The exact risk on a probabilistic basis to the public using this criterion is, in fact, generally very low as it would combine the probabilities of an extreme event and the probability of persons not being able to escape in the event of a dam failure. As an example, if a dam were designed to resist the PMF, the approximate probability of occurrence of the extreme event can be in excess of 1:1,000,000 years. Clearly then, the risk is very small and the use of such thresholds can be justified.
For the assessment of potential damages OPG has incorporated both third party and owner’s exposure to consequential damages. Owner’s risk was evaluated in terms of the costs associated with loss of generation opportunity at a dam and the possible sequential failure of other downstream generating facilities, plus the capital expenditures to rebuild the facilities. However, the adoption of this approach to evaluating potential consequential damages, within the context of the CDA definition of damage magnitudes, tends to skew the judgement of acceptable risk, especially for a large corporate entity, which can withstand a large economic loss. The difficulty with this is that a uniform benchmark for assessing third party and public risk is not possible. In addition, as discussed previously, it is not strictly appropriate to include the owner’s risk in a normalised assessment of public risk. It is therefore, considered that a better approach would be to assess the owner’s risks separately as the IOR and any upgrading of the dam safety be based on the owners own criteria developed in relation to his tolerance for risk.
The Quebec Dam Safety Draft Regulation divides structures into five consequence categories. These are based on the characteristics of the inundated area that is entirely attributable to the failure of the dam (that is, incremental flooding associated with dam failure). The regulation does not specify actual ILOL thresholds. Rather, the guidelines stipulate that requirement to evaluate population density downstream with acceptable threshold values based on the population at risk (PAR). In this way, the Quebec guidelines resemble the Ontario approach in that the hazard posed by the dam to persons downstream (i.e. the persons at risk) is evaluated, as opposed to a determination of the consequences of failure (i.e. ILOL). As discussed in a companion article (Donnelly and Morgenrioth, 2005), this type of approach has some very significant political and practical advantages. In fact, as part of a general update of the CDA guidelines that are being performed by the CDA, the author will be proposing that this approach, or a modification to this approach, be adopted.
Under the Quebec regulations:
• The very high category is applicable to when permanent residential areas are flooded that result in an incremental PAR greater than 2000, or where an industrial area with more than 500 employees is incrementally flooded. Property damage is categorised in terms of downstream established infrastructure and services. This would include an industrial park or dangerous substance storage facility. In addition, a second downstream dam with a very high classification would dictate a similar classification at an upstream dam.
• The high category covers incrementally flooded residential developments with 10 or more permanent residences and incremental PAR of less than 2000. Incrementally flooded industrial areas with between 50 to 499 employees are also covered by the category. Incremental property damage includes risks to an autoroute, main railway and power transmission lines and large year-round commercial recreational operations. A second downstream dam with the level of risk also dictates a high designation to the upstream dam.
• The moderate category is applied when there is some incremental PAR, to communities with less than 10 permanent residences incrementally flooded or to industries that could be incrementally flooded that have less than 50 employees. National and regional class highways fall into this category. As do similar classes railways and secondary power transmission lines. Smaller scale commercial recreational facilities are also included as well as a second dam downstream with similar failure risks.
• The low category is applied to situations where the incremental PAR is limited to 10 or less seasonal residences, such as cottages as well as local roads, agricultural land and/or seasonal commercial recreational facilities.
• The very low category is reserved for dams located in uninhabited regions with downstream exposure limited to forests, mining interests, private roads or second dam with similar failure risks.
The British Columbia Dam Safety Regulation provides four incremental consequence categories that are identical to the CDA designations:
• The very high category uses a threshold of 100 ILOL, similar to the OPG standard. Incremental economic, social and environmental loss potential concentrates on third party exposure and must exceed C$100M (US$80M). This category also specifies incremental risk to permanent residential, commercial and industrial areas, major transportation routes and heavily used recreational areas.
• The high category is applied where an ILOL of less than 100 is possible and the potential incremental risk of third party damage falls between C$1M (US$0.8M) and C$100M (US$80M).
• The low category is for structures in which there is very low potential for incremental loss of life in areas where the downstream region is composed primarily of rural and agricultural areas. Minor third party incremental damages, not exceeding C$0.1M (US$80,000) are considered to be acceptable
Alberta was the first province in Canada to adopt dam safety legislation, enacting the regulation in the 1970’s. In this case, dam classification is hazard based with the categories essentially mirroring those used by in the US. Here, as with Ontario, ‘where a potential for incremental loss of life exists, the PMF shall be used as the IDF.’
The main difference between hazard and consequence based classifications is that the former require elimination of the hazard (by, say, relocating affected dwellings before an event occurs) as opposed to mitigating the effects of the hazard (by, say, evacuating people from affected dwellings after an event has occurred) in order to change the dam classification. With this important difference in mind, it is then possible to compare the various threshold values that define the ICC or IHP classification of a structure.
Most of the various guidelines have quite similar threshold values with the respect to the tolerable risk associated with incremental loss of life. For example, the threshold values used by The British Columbia regulations, and the standard currently used by OPG, are similar. In both cases, a very high category dam is stipulated as being one where ILOL is 100 or greater and between 1 and 100 for the high ICC category. As discussed previously, the Quebec draft regulation does not discuss ILOL. However, the IPAR (incremental persons at risk) thresholds for the very high and high categories reflect a similar level of risk. The Quebec regulation is therefore somewhat easier to apply in this respect by an evaluator however as judgement regarding the potential for loss of life to residences that are incrementally flooded is eliminated. The Alberta and Ontario draft guidelines are considerably more stringent with respect to ILOL than these guidelines with tolerable ILOL threshold for the high IHP category is set at one.
Potential downstream property damage is limited to third party exposures in all of the guidelines reviewed. The magnitude of the threshold values for economic third party risk is slightly different in each of the various guidelines reviewed. However, the differences are not overly significant.
The practice of grouping the incremental owner’s risk as part an ICC assessment for dam safety purposes is fundamentally incorrect. However, the evaluation of an owner’s potential loss is important to assess corporate exposure and needs to be established according to criteria developed by the owner.
Selection of design parameters based on the dam classifications
In establishing ICC classifications for dam safety purposes, threshold limits for both life safety and economic risk must be established. A review of the threshold limits established by the various example organisations discussed previously follows.
Incremental loss of life
Assessment of the potential exposure to ILOL must consider the total PAR at any given moment, the basic timing of the event and whether or not any effective warning action can be implemented.
For example, a ‘normal’, or ‘sunny day’, type of dam failure will often result in the highest potential for ILOL. This is because the dam break would occur where there is little or no indication of the impending failure. In addition, failure can occur during periods that are commonly associated with placid antecedent water levels and velocities along the watercourse. In cases when residences can be flooded, the most severe ‘normal’ dam failure would be associated with a late night occurrence. In this situation, permanent inhabitants of the area are most susceptible over a large portion of the year, with no effective warning available. On the other hand, casual and recreational users of the waterway would not generally be at risk. In cases when no residences are flooded, a sudden dam failure during daylight hours in the summer would represent the most severe condition, placing casual and recreational users on or near the river at risk.
Generally, in remote north Canadian locations, where exposed populated areas are either small or are located sufficiently out of the flood plain, casual and recreational users make up the majority of the PAR. Water-based sporting events such as fishing or boating can yield a high concentration of PAR. However, the duration of such an event is short. In this case, a probability-based adjustment to overall exposure of the PAR is appropriate. Little or no ILOL under flood-induced dam failure conditions can be rationalised if a well-devised flood management plan is in place for a dam or series of dams on a river system. This allows ample warning time to be issued following recognition of a potential failure event, which in turn initiates an organised and systematic evacuation procedure. To facilitate an analytical assessment of potential ILOL, for any given PAR, an empirical relationship developed by DeKay and McClelland was used. The various input parameters are discussed for each dam site.
ILOL is therefore assessed based on the PAR multiplied by an exposure factor. This typically ranges from about 0.7 for a permanent residence (i.e. implying 70% occupancy at any time of the year) to values as low as 1% for a weekend event that occurs once a year, but attracts a significant number of people. Using the adjusted PAR and the DeKay and McClelland relationship the potential ILOL for a dam failure event can be assessed for either the flood or normal failure scenario. Determination of the appropriate flood and earthquake is then established on the basis of the calculated ILOL and selected threshold limits such as the example limits listed in table 2. However, great care should be used any time an assessment of this type is proposed. Indeed, if one takes the approach that warning time should not be considered in the dam classification, this approach should not be used at all.
There remains some judgment in the selection of the appropriate parameters for those categories in which a range of threshold values are specified. For selection of parameters for incremental loss of life hazards, Figure 2 can be used that would result in the selection of a progressively conservative flood or earthquake for increasing risks.
Incremental third party economic and environmental losses
The assessment of ICC values for dam safety purposes is based on an assessment of third party socioeconomic, financial and environmental damage potential. The owners direct loss is not included in this assessment. These losses are considered in developing the IOR (Incremental Owners Risk), which is evaluated separately to determine if any additional protection is required. Again, there is a range of specified values for some of the categories. A similar chart can therefore be developed to assist in the selection of the appropriate flood frequencies and earthquake.
As summarised in Figure 3, the final process leading to the selection of the IDF and DBE (design basis earthquake) for dam safety evaluations is iterative. Once selected, these values are used to assess the ability of the dam to provide the level of safety required ensuring that the dam does not pose an unacceptable risk to the public. Note that this does not imply zero risk. It becomes the task of the regulator, or organisation in areas that have no dam safety legislation to determine what constitutes acceptable risk.
Author Info:
C. Richard Donnelly, Project Manager, Hydropower Division, P.Eng.,Acres International Limited, Niagara Falls, Ontario, Tele: 905-374-5200, Fax: 905-374-1157, E-mail: rdonnelly@acres.com. The author would like to acknowledge Harvey Walsh and Dale Peters for their advice and input.
