ICOLD Symposium on Sustainable Development of Dams and River Basins, 24th - 27th February, 2021, New Delhi

Advances in dam safety, risk assessment and management

for the seismic hazard
M. Wieland
AFRY Switzerland Ltd.(formerly Poyry Switzerland Ltd.), Zurich, Switzerland

ABSTRACT:
The ultimate objective of any dam safety management program is to ensure that people living down-
stream of new and old dams are equally safe, i.e. all dams must satisfy the same minimum safety
standards at any time. This requires that the safety of all dams must be reviewed periodically. The
basic requirement of any sustainable storage dam is technical safety. Today, an integral dam safety
concept should be used, which includes (i) structural safety, (ii) dam safety monitoring, (iii) operation-
al safety and maintenance, and (iv) emergency planning. For the dam safety assessment all hazards af-
fecting the project must be considered, i.e. hazards from the natural environment, hazards from the
man-made environment and project-specific and site-specific hazards. The role of the earthquake haz-
ard in the seismic safety of large dam projects is discussed, as today the structural safety of large stor-
age dams is often governed by the earthquake load case. By verifying the earthquake and flood safety
the technical safety of a dam can be ensured. There are other hazards, but floods and earthquakes are
among the most important ones for all dam projects. For the safety assessment of dams, existing de-
terministic analyses and different types of risk analysis may be used. Further developments are need-
ed, but it is more important that all dams should satisfy standards that are compatible with internation-
al safety standards. Earthquake safety has always played an important role. Seismic analysis methods
for concrete and embankment dams were first developed in the 1930s, which were subsequently ap-
plied universally to most large dams. These simple pseudo-static dam analysis methods are still used
today, although they are outdated. A number of developments have taken place: (i) the change from
the pseudo-static to the dynamic seismic analysis of dams, (ii) the change from the representation of
the earthquake ground shaking by a seismic coefficient to the description of the ground motion of the
safety evaluation earthquake by using other ground motion parameters including spectrum-matched
acceleration time histories, (iii) the change from a single ground shaking hazard to multiple seismic
hazards including mass movements and faulting, and (iv) the change from the safety factor and allow-
able stress concepts to rational seismic performance and safety criteria, which are mainly characterized
by inelastic dam deformations. Risk assessment is still a relatively young method in the field of dam
safety. Due to the many hazards, especially man-made hazards like sabotage, terrorism, etc. and the
fact that each dam is unique, statistical methods can hardly be used to estimate the probability of fail-
ure of dams. The estimate of the multiple consequences of dam failure is another problem in calculat-
ing the risk, yet these methods are popular in certain countries. Based on simple parameters like dam
height, dam volume and people at risk, etc. a risk classification of dams can be made, for which differ-
ent design and safety criteria are specified. This risk classification still varies greatly in various coun-
tries and makes it difficult to ensure that all people living downstream of large dams are equally safe.

1 INTRODUCTION

Dam safety has always been of great concern for dam owners, dam safety authorities and dam engi-
neers. The water load a dam has to resist and the safe release of extreme floods s have been the main
concern of dam engineers. Compared to the flood hazard that was always of primary concern, the
earthquake hazard is a quite new hazard, first introduced in dam design in the 1930s. The first modern
dams that experienced strong ground shaking were those affected by the 1906 San Francisco earth-
quake. At that time no seismic loads were considered in the analysis and safety checks on dams and
the designs were based on empirical criteria, as the earthquake hazard was poorly understood. Rational
seismic analysis concepts for concrete dams were used in the construction of Hoover dam in the USA
(Westergaard, 1936). At about the same time a method for the seismic slope stability analysis was
proposed by Mononobe et al. (1936). For both types of dams the seismic hazard (ground shaking) was
represented by a seismic coefficient. Typically a value of 0.1 was used, almost irrespective of the
seismic hazard at the dam site. For concrete dams the horizontal inertia force of the mass concrete was
taken as the product of the seismic coefficient times the dead load of the dam and the hydrodynamic
pressure from the reservoir was taken into account assuming incompressible behavior of water. For
embankment dams the earthquake load was represented by the horizontal inertia load acting in the
most unfavorable direction at the center of gravity of the sliding mass. All seismic loads were consid-
ered as static loads and, therefore, they could be analyzed in the same way as the other static loads,
which made this analysis that is called pseudo-static analysis, quite simple. This was the international
state-of-practice until 1989, when ICOLD published its first modern guideline on “Selecting Seismic
Parameters for Large Dams” (ICOLD, 1989). However, already in 1971, when several dams were
damaged during the San Fernando Earthquake in California, it was concluded that the pseudo-static
method of analysis was no longer appropriate.

The present paper is focusing on seismic safety aspects of dams, because significant changes have
taken place since the 1930s and the earthquake load case has become the dominant load case for the
design of most dams. At the time of the pseudo-static analysis, when, due to the low seismic coeffi-
cient of 0.1, the earthquake load case was almost always satisfied and based on the analysis no earth-
quake modifications were required. This situation has changed, as the pseudo-static analysis method is
inadequate for the seismic safety assessment of large dams in seismic regions. The main reason for
that is that the irregular earthquake ground motion cannot be represented by a seismic coefficient, and
there is no proper scientific relation with the peak ground acceleration.

Furthermore, the earthquake hazard is a complex hazard, which includes ground shaking, fault
movements, mass movements and other factors. There are also only a few dams, especially new types
of dam like RCC dams, concrete-face rockfill dams, asphalt core rockfill dams among others that have
not yet experienced strong ground shaking similar to that used for the seismic safety check of dams.
Therefore, after strong earthquakes, new safety aspects may emerge that either have been overlooked
or not addressed properly in the seismic design and seismic safety evaluation of these dams. There-
fore, modifications in the safety and risk assessment have to be expected in the future. In conclusion,
the earthquake safety assessment of dams is a relatively young discipline, where major developments
have taken place in the past and further improvements are expected in the future.

This overview paper is based on the following papers of the author in the field of dam safety and
earthquakes (Wieland and Mueller, 2009; Wieland, 2016; Wieland 2019; Wieland 2020).

2 DAM SAFETY

The ultimate objective of any dam safety management program is to ensure that people living down-
stream of new and old dams are equally safe, i.e. all dams must satisfy the same minimum safety
standards at any time. This requires that the safety of all dams must be reviewed periodically. We
should also not forget that the basic requirement of any sustainable storage dam is technical safety,
which is discussed in this paper.

The two main goals of every safety concept are the minimization of all risks, and dealing with the
remaining risk in the best possible way. To reach these goals a comprehensive safety concept is used
for large storage dams, which includes the following key elements (Wieland and Mueller, 2009):
(i) Structural safety (main elements: geologic, hydraulic and seismic design criteria; design criteria
and methods of analysis may have to be updated when new data are available or new guidelines, regu-
lations or codes are introduced);
 (ii) Dam safety monitoring (main elements: dam instrumentation, periodic safety assessments by
dam experts, etc.);
(iii) Operational safety (main elements: reliable rule curves for reservoir operation under normal
and extraordinary (hydrological) conditions and after earthquakes, training of personnel, dam mainte-
nance, sediment flushing, engineering back-up, etc. The most important element for a long service life
of a dam is the maintenance of all structures and components); and
(iv) Emergency planning (main elements: emergency action plans, inundation maps, water alarm
systems, evacuation plans, etc.).

When all parties responsible for dams follow this safety philosophy, a dam can be considered safe.
However, periodic safety assessments are indispensable as they will show what measures have to be
taken to maintain or improve the safety and to extend the life-span. Safety deficiencies observed after
commissioning must be rectified as early as possible.

3 HAZARDS AFFECTING LARGE STORAGE DAMS

The main hazards to be taken into account in the safety and risk assessment of dams can be classified
as follows (Note: These hazards must also be considered in the dam design.):

(i) Hazards from the natural environment, i.e.

 Heavy rainfall causing floods and mass movements at the dam site and reservoir rim; blockage
of intakes and access roads to dams due to mass movements, and an impulse wave due to mass
movement into the reservoir.
 Floating debris blocking power intakes and intakes of gated spillways.
 Strong winds causing water waves in the reservoir and erosion.
 Sediment transport causing silting up the reservoir during floods; turbidity currents in the reser-
voir may block low-level intakes, and large boulders may damage gates in mountain streams.
 Low and high temperatures, thawing and freezing, etc.
 Seismic hazard – the earthquake hazard is a multi-hazard: As strong earthquakes are rare events,
the earthquake hazard is one of the least known natural hazards. In particular, the estimate of the
ground motion at the dam site for the strongest earthquakes with a very low probability of oc-
currence is difficult to estimate and is associated with major uncertainties. Therefore, a thorough
investigation of the geologic and seismo-tectonic situation of the dam and reservoir region is re-
quired. For large dam projects the different features of the seismic multi-hazard are as follows:
1 Ground shaking causing cracks and deformations in concrete and rockfill dams, spillways,
bottom outlets and appurtenant structures (powerhouse, switchyard etc.).
2 Movements of active faults or discontinuities in the footprint of the dam or spillways.
3 Rockfalls and mass movements at dam site and in the reservoir causing impulse waves,
blocking intakes, and damaging the dam, spillway gates and appurtenant structures.
4 Liquefaction in fill dams causing large deformations in the dam and/or the foundation (liq-
uefaction of loose sediments in reservoirs and turbidity currents blocking intakes), etc.
5 Mass movements can be triggered by heavy rainfall, earthquakes or changes in ground wa-
ter table (e.g., seepage through abutments when the reservoir level is increased), etc.
6 Rockfalls and mass movements at a dam site and in the reservoir causing impulse waves,
blocking intakes, and damaging the dam, spillway gates and appurtenant structures.
7 Avalanches and ice falls causing impulse waves in the reservoir and damaging appurtenant
structures.

(ii) Project-specific and site-specific hazards, i.e.

 Blockage of spillway gates (due to floating debris, pier or gate deformations, lack of mainte-
nance), equipment failure, power supply failure, failure of emergency power supply, etc. caus-
ing overtopping of the dam.
 Differential movements of structures (structural joints, interfaces between concrete structures
and embankments etc.).
 Embankment piping or seepage (internal erosion).
  Piping along conduits through core of embankment dams.
 Foundation or abutment seepage (damaged grout curtain, dissolving of minerals, etc.), change in
ground water table.
 Reservoir-triggered seismicity: depends on tectonic stresses in the project area, existence of
faults, size of reservoir, maximum water depth, rate of reservoir impounding, etc.
 Electrical or mechanical failure of equipment used for the operation of vital gates and valves
(gantry cranes on top of spillways etc.), failure of control units, faulty software, etc.
 Ageing (corrosion, biological growth, etc.), alkali-aggregate reactions, lack of frost resistance of
concrete, and other ageing processes.
 Dam and safety-relevant elements do not satisfy current safety criteria (inadequate spillway ca-
pacity, dam has not been designed for earthquakes, etc.) and others.

(iii) Man-made hazards: Design errors and poor construction may be the most common hazards in
any infrastructure project. They can be dealt with by proper quality assurance. The man-made hazards
may include the following:
 Design errors.
 Ignoring or underestimating the hazards.
 Changes in land use in catchment area, increasing the flood hazard, etc.
 Poor construction and/or substandard construction materials.
 Lack of maintenance and deficient dam safety monitoring.
 Faulty operation of equipment, inadequate rule curves for reservoir operation, and operation
during unusual or extreme events, etc.
 Sabotage, terrorism, or acts of war.
 Cyber criminality.
 Other hazards or unknown hazards (protective measures depend on the type of hazard).

It is obvious that in the classification of these hazards, there is also some overlap, especially some
of the site-specific hazards may also be considered as natural hazards. In the context of safety assess-
ment this is not essential. It is more important that in the design and safety assessment all possible
hazards are reviewed and addressed. If hazards are evolving or have occurred then the following
measures can be taken to increase the safety of the dam and/or to reduce the consequences of a dam
failure:
 Rehabilitation,
 Partial draw-down of the reservoir,
 Full draw-down of the reservoir,
 Evacuation of population in the downstream flood area, and
 Post-event evacuation and rescue of the population.

The most difficult hazards for large dams and infrastructure projects are those, which cannot be
predicted or where the warning times are very short. These hazards are earthquakes (seismic early
warning systems give pre-warning times of a few seconds only and are not suitable for dams) and sab-
otage, terrorism and acts of war, because if such events occur only post-event evacuation and rescue is
possible. In this context it must be mentioned that any dam, however safe it is, can be destroyed by
man. The other hazards are less difficult to handle as more time is available for preventive actions.

It has to be kept in mind that most of the hazards and especially the man-made ones depend on time.
At this time, everybody talks about climate change and this gives the impression that this is the only
hazard that is changing with time. This is certainly not the case for large dam projects. Time-
dependent hazards are due to physical changes (e.g. climate change, flood and seismicity, ageing, etc.)
or due to incomplete information on hazards (e.g. weather, floods and earthquakes). Engineers in
charge of the safety of existing dams have dealt with such problems for a long time. The solution is
quite simple: Dam safety assessments have to be carried out periodically. This ensures that the safety
of a dam can be kept up-to-date. This concept is also suitable for dealing with climate change hazards
in a rational way, without having to know the future implications accurately.
4 SEISMIC SAFETY ASSESSMENT OF DAMS

4.1 Advances in seismic safety assessment of dams

Since the 1930s considerable developments in the seismic analysis and design of large storage dams
have taken place (Wieland, 2021). The main developments, documented in several ICOLD Bulletins,
may be described as follows:
(i) The change from pseudo-static analysis to dynamic seismic analysis of dams.
(ii) The change from the representation of the earthquake ground shaking by a seismic coefficient to
the description of the ground motion of the safety evaluation earthquake by other ground motion pa-
rameters including spectrum-matched acceleration time histories.
(iii) The change from the single ground shaking hazard to multiple seismic hazards including
ground shaking mass movements, faulting, etc.
(iv) The change from the sliding stability safety factor and allowable stresses concepts to rational
seismic performance criteria, characterized by dam deformations and seismic failure modes in dams.

In several countries and organizations, the old seismic analysis concepts are still used although they
have been considered obsolete and even wrong since the time of the 1971 San Fernando Earthquake in
California, where the Lower San Fernando Dam, a hydraulic-fill dam, was close to failure due to liq-
uefaction-induced dam deformations. Because the pseudo-static analysis method is simple, and since it
is used in seismic codes for buildings, many dam engineers are using and defending this outdated
method, even in areas of high seismicity, where these deficiencies are most obvious.

Periodic seismic safety assessments must be carried out for both new and old dams, using the same
modern seismic design and safety criteria. Therefore, any advances in dam safety assessment apply for
new and old dams.

4.2 Seismic input for seismic safety assessment of dams

The seismic safety assessment of dams may be done by deterministic analyses or by risk-based meth-
ods. For the seismic safety assessment the ground motion of the safety evaluation earthquake (SEE) at
the dam site is needed as well as the performance and safety criteria, which must be satisfied under
this extreme ground motion.

It must also be mentioned that for seismic safety assessments, which, today, are based on dynamic
analyses in the time domain, models of acceleration time histories are used, which are artificial earth-
quake ground motions (Wieland, 2018). The use of load models, which correspond to seismic ground
motion models, have been used very successfully in the design of civil engineering tructures for more
than 100 years and is nothing new, although many dam engineers may not have realized that.

For the seismic design of the dam body and the different structures and components of a large dam
project, different types of design earthquakes are needed (ICOLD, 2016). However, for the seismic
safety assessment of dams only the safety evaluation earthquake (SEE) has to be considered. The SEE
ground motion is the earthquake ground motion a dam must be able to resist without uncontrolled re-
lease of the reservoir, which can be obtained from a probabilistic and/or a deterministic seismic hazard
analysis, i.e.
 Maximum Credible Earthquake (MCE): The MCE is the event, which produces the largest
ground motion expected at the dam site on the basis of the seismic history and the seismotectonic
system in the region. It is estimated on the basis of the worst-case deterministic earthquake sce-
narios. According to ICOLD (2016) the ground motion parameters of the MCE shall be taken as
the 84 percentiles (mean plus one standard deviation).
 Maximum Design Earthquake (MDE): For large dams the return period of the MDE is taken as
10,000 years. For dams with small or limited damage potential shorter return periods can be spec-
ified. The MDE ground motion parameters are estimated on the basis of a probabilistic seismic
 hazard analysis. According to ICOLD (2016) the mean values of the ground motion parameters of
the MDE must be taken.

For major dams the most unfavorable ground motion parameters of the MDE and MCE should be
taken for the SEE. If it is not possible to make a realistic assessment of the MCE the SEE must be at
least equal to the MDE.

The seismic safety of the following items must be checked for the SEE:
 Dam body: Structural damage (cracks, deformations, leakage etc.) is accepted as long as the sta-
bility of the dam is ensured and the reservoir can be retained.
 Safety-critical components and equipment: These components and equipment must be fully oper-
able during and after the SEE. Minor distortions are accepted as long as they have no impact on
the proper functioning of the components and equipment (Wieland, 2017).
 Abutment rock (important for arch dams): All abutment wedges must be safe.
 Reservoir slopes: no mass movements into the reservoir are accepted, which block intakes of the
spillway or low-level outlets or which create large impulse waves in the reservoir that could cause
overtopping of the dam crest. This requirement is very important for embankment dams.

5 SEISMIC PERFORMANCE AND SAFETY CRITERIA FOR LARGE DAMS

The following, very general, performance and safety criteria for large dams subjected to strong earth-
quakes have to be taken into account:
(i) to retain the reservoir and to protect people from the catastrophic release of water from the reser-
voir,
(ii) to control the reservoir level after an earthquake as a dam could be overtopped and destroyed if
the inflowing water into the reservoir cannot be released through damaged spillways or low-level out-
lets, and
(iii) to lower the reservoir level after an earthquake (i) for repair works or (ii) for increasing the
safety of a damaged dam; lowering of the reservoir may also be required when there are doubts about
the safety of a dam.
These seismic performance criteria are different from those used in the past, when a dam was de-
clared safe, if for different load combinations including static and seismic loads, the stresses were
within the allowable stresses, the deformations were within allowable deformations, and the safety
factors against sliding, overturning and other failure modes were larger than the safety factors speci-
fied in design and dam safety guidelines. These old safety concepts are still used, but this does not rep-
resent the current state-of-practice promoted by ICOLD. If these old concepts are used, for example,
for a concrete dam located in a region of high seismicity, the dynamic tensile stresses will exceed the
allowable ones in highly stressed regions of a dam and the sliding stability safety factor may drop to
below 1. Therefore, such a dam would have to be declared unsafe, but it is not, because this concept is
not the right one for the seismic safety assessment of dams. It may only work in dams located in areas
of low seismicity, where the earthquake load combinations are not the critical ones.

These new seismic performance and safety criteria have far-reaching consequences, which go be-
yond the tasks of dam engineers – mainly civil engineers - because functionality of gates of spillways
and low-level outlets is the main task of hydro-mechanical and electro-mechanical engineers, who
may not be aware of these new requirements. Therefore, there is a need to adjust the design guidelines
for the hydro-mechanical and electro-mechanical components of spillways and low-level outlets.
These components must be designed for the SEE ground motions acting at the support of these com-
ponents.

The seismic safety of the existing gated spillways must be checked, taking into the account the
ground motion transverse to the river flow direction. Usually the spillway piers have not been de-
signed against such seismic actions. Also, low-level outlets are not provided in many dams. They are
needed to cope with the possible effects of strong earthquakes. Hopefully, in future we will see more
dams with low-level outlets.

6 NEED FOR PERIODIC SEISMIC SAFETY ASSESSMENTS OF DAMS

As dams must satisfy today‘s seismic safety criteria, there is a need to carry out periodic seismic as-
sessments. The main reasons are given below:
 New information on seismic hazard (multi-hazard) and/or seismo-tectonics is available;
 A dam has been subjected to strong earthquake shaking;
 New seismic design criteria are introduced;
 New seismic performance and safety criteria are introduced;
 New dynamic methods of analysis are introduced, such as nonlinear dynamic analysis methods;
 The seismic vulnerability of a dam has increased due to modifications, ageing etc.,
 Changes in the risk classification of dams;
 The seismic risk has increased, e.g., due to the number of people living downstream of a dam
having increased and due to economic development, etc. and
 There are doubts about the earthquake safety of the dam, etc.

With periodic safety reviews (typically every 5 years) any time-dependent changes in all hazards
can be accounted for. In practice, flood safety or seismic safety assessments may be required every 20
to 40 years depending on the rate of variation of the hazards. Reviews may be also required after ex-
treme events or dam incidents.

7 RISK ANALYSIS AND RISK ASSESSMENT

Risk analyses and risk assessments of large dams have been proposed following the probabilistic safe-
ty concept used in the nuclear power industry, in which different types of hazards are included. How-
ever, progress has been slow in the dam industry. Canada, USA, Australia, and Sweden have taken the
lead in this field. In other countries risk-based methods are, in general, not used for the safety assess-
ment of dams as, for example, in Switzerland.

Comprehensive risk assessments, which include all types of hazards listed in Section 3, are not fea-
sible, mainly because of the fact that all dams are prototypes and since most severe man-made hazards
like sabotage, terrorism and acts of war cannot be described adequately by statistical models (Wieland,
2019).

Moreover, as the annual probability of such incidents may be in the range of 0.01 to 0.001, they
would be the controlling risk contributions as the other hazards causing dam failure have annual fail-
ure probabilities, which are about two orders of magnitude less than the man-made ones. Therefore,
sabotage, terrorism and acts of war would dominate all risks, and the risks from all the other hazards –
including floods and earthquakes – would be almost negligible.

Nevertheless, risk analyses of large dams are still useful for specific hazards such as floods and
earthquakes, because they can be described quite well by probabilistic hazard analyses.

For floods, the probability of failure of embankment dams is related to the overtopping failure mode
with progressive erosion of the dam body, whereas for concrete dams, overtopping of the dam crest
may be accepted but the piers of low-head run-of-river power plants may fail due to sliding when the
water load is increased substantially.

The estimate of the probability of failure of an embankment dam, which is overtopped during a
flood, is simpler than the estimate of the probability of dam failure during a strong earthquake. There-
fore, the uncertainties in the results of risk analyses, in which the risk is taken as the product of the
probability of failure times the consequences of dam failure, are greater for earthquakes than floods.
These difficulties can be best described by the fact that in the late 1990s one of the terms of reference
of the ICOLD Committee on Seismic Aspects of Dam Design, which was related to seismic risk as-
pects of large dams, had to be postponed as no progress could be achieved. There were major difficul-
ties in defining the seismic vulnerability and probability of failure of different types of dam, which de-
pend on the design, the quality of the construction works, and the state of the dam (i.e. ageing and
maintenance).

The probabilistic description of the ground shaking hazard is standard practice today. However, as
the seismic hazard is a multi-hazard the other seismic hazards like faulting, rockfalls and landslides,
etc., must be included in such analyses to be meaningful, but the probabilistic characterization of these
hazards is less advanced than that for ground shaking.

There are different applications of risk analysis in the dam industry. Besides the risks of equipment
failure during normal operation, the best understood risk is the flood risk. But also in this case, the
flood safety of an embankment dam is checked for the PMF.

Risk analyses can be carried out for single hazards and single projects or a portfolio of dam pro-
jects. Ultimately, each dam must comply with the same minimum safety standards. Risk analyses
should not be taken as an excuse for lowering safety standards, if the hazards cannot be mitigated or
averted.

In some remote places the consequences of a dam failure with the catastrophic release of the reser-
voir may be small, and thus the risk is small. Therefore such dams could be assigned to a lower risk
class with less rigorous design and safety criteria, which, of course, is interesting economically. But
from several projects we know that the number of people coming to live in the flood plain downstream
of a dam has increased substantially after completion of the project and the risk has increased accord-
ingly. Finally, the safety of such dams with a very long life-span, if well maintained, must be in-
creased, which will be much more costly than if the dam had been designed to exhibit a higher safety
at the very beginning.

The consequences of dam failure are manifold and include, on the one hand, the losses of the dam
owner due to failure of the dam and/or power plant (e.g. loss of energy production, loss of water sup-
ply, etc.), and, on the other hand, the losses caused by a flood wave in the downstream region of the
dam. The losses in the flood plain can be summarized as follows:
 Loss of life and injuries,
 Environmental damage,
 Property damage in the flood plain,
 Damage to infrastructure in the flood plain,
 Socio-economic impact, and
 Political impact.

Usually, the losses in the flood plain greatly exceed those of the dam owner. In densely populated
western countries the consequences of dam failure are huge and in order to reduce the dam risk, it is
better to reduce the consequences than trying to reduce the probability of dam failure.

Basically, the consequences of the catastrophic release of the reservoir are the same irrespective of
the probability of failure and the type of hazard, provided they cause dam failure. Also, for dam failure
there are numerous scenarios involving several hazards that act concurrently such as, e.g., overtopping
of an old embankment dam during a flood when the dam operator is not able to open the spillway
gates, etc.

Because of the limitations of risk-based analyses, stress tests are required, as, e.g., in the finance
and nuclear industries, which rely heavily on risk analysis. Following the 2011 Fukushima nuclear in-
cident in Japan, the safety of nuclear power plants had to be checked for different deterministic earth-
quake scenarios. For dams the ground motion at a dam site produced by the worst-case earthquake
scenario, i.e. the MCE ground motion, is the main stress test. These analyses are carried out for all
dams, but risk assessments are still the exception. This critical discussion on seismic risk aspects of
dams shows that much progress is still needed to make such analyses more meaningful.

We may conclude that risk assessments have to be substituted by deterministic stress tests. PMF and
MCE ground motions are the standard stress test scenarios that have been used in the dam industry for
many decades.

8 DAM SAFETY MANAGEMENT

Different dam safety management systems could be proposed. For example, the main features of the
dam safety management system used in Switzerland are shown in Table 1, which is based on surveil-
lance and dam safety monitoring.

Table 1: Surveillance and dam safety management system in Switzerland

Level Responsibility Activities Reports

1 Owner (dam Regular inspection of condition Monitoring records and
safety engineer, (by visual observations) and be- test protocols
technical staff) haviour (by measurements). Tests
on spillway and bottom outlet
gates.
2 Experienced Analysis of the measured data and Yearly report on condi-
engineer (civil observations. Annual inspection of tion and on measured be-
engineer) the dam. haviour.
3 Experts (civil Inspection and appraisal of the Report on condition and
engineer and dam safety every five years. long-term behaviour.
geologist) Analysis of special safety
related questions.
4 Dam Safety On-site inspection. Review of the Interventions if measures
Authority annual reports and the expert’s ap- have to be implemented.
praisal. Verification of the imple-
mentation of the necessary
measures.

The responsibilities of the different parties involved in dam surveillance and dam safety monitoring
are as follows (Wieland and Mueller, 2009):
 Dam owner: The dam owner has to maintain the dam in good condition. For this purpose he es-
tablishes an organization to monitor and maintain the dam. The technical staff of the dam owner
perform regular visual inspections and measurements on a weekly or monthly basis. Automatical-
ly registered measurements are checked monthly by manual readings. The dam technician checks
the operational readiness of the outlet gates at least once a year. The results of the observations
and measurements are forwarded to an experienced engineer appointed by the dam owner.
 Experienced engineer: The experienced engineer checks the monitoring results on a continuous
basis, performs an annual inspection of the dam and compiles his report on the interpretation of
the dam’s behavior and condition in an annual report. The engineer may also act as a consultant
to the dam owner.
 Experts: Larger dams with an impounding head of at least 40 m, or 10 m with a reservoir capacity
in excess of 1Mm3, must undergo a comprehensive safety review by nominated experts every five
years. The experts (civil engineers and geologists) are recognized specialists in dam engineering
and are appointed by the owner in agreement with the dam safety authority.
 Dam safety authority: The dam safety authority reviews the annual reports of the experienced en-
gineers as well as the five-yearly appraisals of the experts. It also carries out inspections and veri-
 fies that the recommendations in the annual reports and five-yearly reports are observed and the
necessary measures are implemented.

This dam safety management system has been implemented in all large dam projects in Switzerland
and has worked well in the last 50 years. All four safety elements of the comprehensive dam safety
concept of Section 2 must be addressed. Dam safety analyses (mainly flood and earthquake safety) are
usually carried out at much longer intervals than detailed dam safety inspections.

It is important that the dam owners implement the recommendations made by the authorities and
dam experts involved in periodic inspections. Recent failures of dams in the USA show that dam own-
ers may be reluctant to make the necessary improvements because investments in upgrading dam safe-
ty do not show short-term benefits. This may be a problem when dam owners are not (civil) engineers.
But this is also a problem of the authorities, who may face legal problems enforcing safety upgrades.

The dam safety management system outlined in Table 1 includes the dam safety authorities. But on
the project level the tasks of the different people involved in dam safety are specified in emergency ac-
tion plans.

9 CONCLUSIONS

The main conclusions of this overview paper are as follows:

(1) The main objective of dam safety is that there is no difference in the safety of people living
downstream of an old or new dam. This implies that all dams must satisfy today‘s safety criteria. This
is a very ambitious goal, which has not yet been reached in many parts of the world.
(2) For the safety assessment of large storage dams a comprehensive dam safety concept should be
used, which includes (i) structural safety, (ii) dam safety monitoring, (iii) operational safety and
maintenance, and (iv) emergency planning.
(3) Detailed safety reviews should be carried out periodically, e.g., every 5 years in Switzerland. In
practice, a reanalysis of the seismic safety may only be needed when the basics of the analysis and/or
the safety criteria have changed significantly, which may be in the time frame of 20 to 40 years – not
every five years.
(4) Dam safety does not only include safety during an earthquake, but also safety after an earth-
quake, which requires safe operation of the reservoir and/or lowering of the reservoir if there are
doubts about the seismic safety of the dams and if strong aftershocks are expected.
(5) The seismic hazard is a multi-hazard for most dam projects. Ground shaking is the main hazard
considered in all earthquake guidelines for dams. The other seismic hazards may even have been ig-
nored.
(6) The worst-case consequences of dam failure include tangible and intangible losses, which
should be dealt with separately. The priority is the protection of lives, which can be achieved by water
alarm systems.
(7) Risk analyses are suitable for natural hazards like floods and earthquake ground shaking, etc. but
not for the worst man-made hazards, such as sabotage, terrorism and acts of war, which are unpredict-
able.
(8) Risk analyses should not be taken as an excuse for lowering safety standards.
(9) Stress tests define deterministic scenarios that are difficult to handle by risk analyses. The de-
terministic analysis is the usual approach that has been and is being used in the dam industry to deal
with extreme events, which is more rigorous than any dam risk analysis.
(10) Deterministic safety assessments are superior to risk-based safety assessment because, in gen-
eral, people affected by dam projects understand the meaning of safety but have difficulties with the
interpretation of risks.
 Disclaimer: The views and opinions expressed in this article are those of the author.

10 REFERENCES

ICOLD (1989) Selecting seismic parameters for large dams, Guidelines, Bulletin 72, Committee on Seismic As-
pects of Dam Design, International Commission on Large Dams (ICOLD), Paris.
ICOLD (2016) Selecting seismic parameters for large dams, Guidelines, Bulletin 148, Committee on Seismic
Aspects of Dam Design, International Commission on Large Dams (ICOLD), Paris.
Mononobe N., Takata A. and Matumura M. (1936) Seismic stability of the earth dam, Trans. 2nd Congress on
Large Dams, Washington, D.C. Q. VII, pp. 435-444.
Westergaard H. M. (1933) Water pressures on dams during earthquakes, Trans. ASCE 98(3):418–433.
Wieland M. (2016) Safety aspects of sustainable storage dams and earthquake safety of existing dams, Journal of
Engineering, Elsevier, 2016, Vol. 2, Issue (3): 325 -33, DOI: 10.1016/J.ENG.2016.03.011.
Wieland M. (2017) Seismic aspects of safety relevant hydro-mechanical and electro-mechanical elements of
large storage dams, Proc. Symposium, 85th Annual Meeting of ICOLD, Prague, July 3-7.
Wieland M. (2018) Models of earthquake ground shaking used in seismic design and safety checks of large
dams, Int. Journal of Civil Engineering, https://doi.org/10.1007/s40999-018-0339-3, June.
Wieland M. (2019) Limitations of risk and probabilistic safety analyses for large storage dams, Proc. Interna-
tional Dam Safety Conference – 2019, Bhubaneswar, Odisha, India, 13-14 February.
Wieland M. and Mueller R. (2009) Dam safety, emergency action plans, and water alarm systems, Int. Journal
Water Power and Dam Construction, January.