1. Introduction and initial situation

Countries with high population densities, far developed industrialisation and demanding infrastructures have an enormous damage potential, which can be released with disasters, depending on their extent. That applies to both natural disasters as well as to disasters caused by technical or human errors – including acts of sabotage and war. The general public is therefore critical of technical systems with large hazard potentials in case of their destruction or failure. Great demands are made on reliability and safety of such systems; failures need to be practically ruled out from happening. Design, construction, operation and supervision of such systems have to take this into consideration.

The population densities and the "dam densities" vary substantially within the different states of the Federal Republic of Germany. Fig. 1 shows the result, when overlaying the two characteristics in each state. It illustrates the dam-referred hazard potential within the different German states clearly.

Northrhine-Westphalia and Saxony are at the top of the list. Considering the federal state regulations concerning water management and disaster control, the aforementioned viewing, which already includes a first qualitative risk assessment, can be important for the development of regionally different risk managements.

The "public confession" of a residual risk linked to the existence of dams is considered as particularly problematic in many countries and in Germany, too. In particular the consequence, to define a measure for the individually and socially acceptable residual risk, kept many countries from applying quantitative risk assessments. However it needs to be said that the instrument does not yet seem sufficiently developed for an all-embracing correct risk analysis. Regardless of this the author is convinced of the fact that conscious planning and design of dams must have implied a type of qualitative risk assessment so far already and probably has.

With the generally increasing sensitivity of the people, professionals as well as politicians towards environmental hazards and risks, a more transparent dealing with risks connected to dams gains acceptance in this country and throughout the world. Whereas the term "risk" was excluded from the existing technical standards for dams in Germany [1], [2], it is now suggested to name the risk problem within the scope of the current revision of these standards and to give recommendations for risk management [4], [5].

The insight of the fact that there are still limits and obligations, which make an absolute safety of dams impossible even despite maximal efforts and therefore implying risks, form the background to this intention. Alone the conscious safeguarding of this risk connected to the existence of a dam makes it possible to operate an adequate risk management and designate suitable risk mitigation strategies. Fig. 2 illustrates this "safety philosophy" for dams in a very simplified manner. It needs to be added that security according to human judgement includes all necessary and appropriate measures and precautions regarding design, calculation, construction, operation and monitoring of the dam.

The author takes the view that despite of -intended or involuntary- public discussions about risks, the dam operators and the responsible supervisory authorities are obliged to go into the individual risks of a dam and at least need to qualitatively assess the risk(s) and draw conclusions to minimize the risk(s).

2. Concept for hazard and risk considerations

2.1 General safety concept

The design concept for dams illustrated in fig. 3, which is to be introduced into the revised dam standards consistently for both massive dams as well as fill dams, is the basis for hazard and risk considerations. This concept partially already applied to massive dams after the introduction of the present standard [2].

Design case regulations, which consider the occurrence probability of the different influences on the load-bearing structure are substantial constituents of the design concept. Depending on the type of influence, the estimation of its occurrence probability can take place either in a quantitative way (flood with resulting water level, seismic intensity with resulting force effects, temperature event with resulting force effects) or in a qualitative way (building material characteristics, soil characteristics, operability of installations such as grout curtains, drainages etc.). Influence combinations of different occurrence probabilities in the end lead to design cases with different occurrence probabilities. The combination of rare events among them are thereby excluded.

The qualitative and quantitative probability considerations within the design concept described above, lead to the disclosure of remaining hazards and risks and subsequently to a semi-quantitative risk assessment. It is based on a separate consideration of different relevant risks (partial risks), which can be drawn to a qualitative total evaluation of the situation. A perfect quantitative comparison between available and admissible (tolerable) risks according to fig. 5 is currently not intended.

The following partial risks are taken into consideration:

• Risk as a result of exceeding the design floods respectively the resulting water levels.
• Risk as a result of exceeding the design earthquake loads.
• Risk as a result of material characteristics dispersions (dam structure and foundation).
• Risk as a result of reduced functioning of structural installations (e.g. drainages, gaskets, grout curtains, ice-clearing systems, filters).

2.2 Risk as a result of floods

Extreme floods are the largest hazard potential for dams world-wide. More than 35 % of all dam failures can be explained by lacking safety against overflowing [6]. Design concepts for dams in relation to floods therefore are the focus of international attention. Probabilistic procedures for the calculation of failure probabilities for dams are furthest developed, although the determination of flood peaks and amounts of rare flood events are flawed with very large uncertainties.

• Design flood case 1 for the design of the spillway: The appropriate design flood inflow BHQ₁ must be controlled without any damage at all.
• Design flood case 2 for the proof of dam structure security: The appropriate design flood inflow BHQ₂ (> BHQ₁) must be carried off in such a way that the load-bearing capacity of the dam structure and thus its storage capacity are preserved. Damage to components may be accepted.

• Large and middle-sized storage structures:P_Ü (BHQ₁)=10^-3
  P_Ü (BHQ₂)=10^-4
• Small storage structures:P_Ü (BHQ₁)=2*10^-3...10^-2
  P_Ü (BHQ₂)=2*10^-4...10^-3

• Retention effect of the flood plains may be considered with BHQ₁ and with BHQ₂.
• Discharge through bottom outlets may be considered with BHQ₁ in compliance with (n­1)­condition and with BHQ₂ without any restrictions at all.
• Discharge through outlets may not be allowed with BHQ₁ and only be considered if suitable with BHQ₂.
• Emergency discharge possibilities may only be considered with BHQ₂.
• Full effectiveness of the spillway may be considered with BHQ₁ and with BHQ₂ (if valves exist, the (n­1)­condition however applies to BHQ₁)

• The freeboard f_Ges adds to Z_H1 as a result of BHQ₁ and concludes the proportion f_Wi from wind set-up, wave uprush and possibly ice packing as well as a safety part f_Si.
• The wind-dependent freeboard proportion f_Wi may be claimed by BHQ₂, the safety part f_Si must remain free, i.e. Z_H2 £ Z_H1 + f_Wi or Z_H2 £ Z_K - f_Si

The storage levels Z_H1 and Z_H2 resulting from the floods enter in loading cases 2 and 3 for load-bearing structure design. Full storage level Z_V (height of spillway crest) is set in loading case 1. Fig. 7 illustrates this order. The mentioned storage levels are considered within the proofs of stability depending on the combination of loading cases and structure conditions in the design cases I, II or III (see fig. 4 and chapter 2.3, table 1).

A hazard as a result of floods still remains for the following reasons:

• Uncertainties with the quantitative determination of BHQ₁ and particularly of BHQ₂ (probability of underestimation)
• Possibility of floods HQ > BHQ₂ (e.g. PMF)
• Relieving conditions for discharge BHQ₂, such as sacrificing a freeboard proportion and permitting structural damages.

• Consideration of a risk flood RHQ £ PMF (see fig. 7) including the consequences of a possible overflow of the crest of a dam structure (or its sealing).
• Consideration of the consequences of possible wave sloppings with Z_H2 or BHQ₂ over the crest of the dam structure.

• the dam structure is at least partly designed for overflowing,
• Z_HR £ Z_H2 thanks to emergency discharge possibilities or
• the remaining risk is acceptable.

2.3 Risk as a result of earthquakes

Although earthquakes play a rather minor role in Germany, the standards [1], [2], [3] require the consideration of seismic stresses in the loading cases for proofs of dam structure stability. In some regions (e.g. the Eifel and Vogtland) however, remarkable earthquakes have already occurred, so that this demand is quite justified.

Similar to floods, two cases are hereby differentiated. The existing standards already considered them. The amended versions specify the prerequisites, which need to be considered as follows:

• Earthquake case 1: The accessory (so-called) operation earthquake BEB is supposed to have a exceeding probability P_Ü, which corresponds to the planned period of dam utilisation (P_Ü = 10^-2 ... 2 * 10^-3). The dam structure has to tolerate this earthquake without any damages at all.
• Earthquake case 2: The accessory (so-called) safety earthquake SEB is supposed to have a exceeding probability of about P_Ü = 10^-4. The dam structure has to tolerate this earthquake in a way that its structure condition and its storage ability remain existent.

The (conventional) proofs of stability for the design cases II and III are characterised by the fact that the safety factors are gradually reduced in relation to design case I.

Due to the design rules mentioned above, a hazard remains by earthquake EB > SEB (e.g. largest possible earthquake (MEB), see fig. 9). Owing to the favourable construction methods of German dams in relation to seismic stresses and because of the altogether relatively small risk of earthquakes in Germany, it can be assumed that the structural reserves in design case III cover the remaining hazard potential. In so far special risk assessment considerations are not necessary, except if required.

Fig. 9
Earthquake cases relate to dam safety
Cas de tremblement de terre pour le dimensionnement des barrages

2.4 Risk as a result of material characteristics dispersions within the load-bearing structure

The characteristics of building materials and soil and the values respectively data describing them vary inevitably. This can be determined by production, processing or nature. This must be considered when producing proofs of structural stability. The design case regulation shown in fig. 4 contributes to this. So far it only applied to massive dams, but is to be used also for fill dams in future.

The differing material properties are considered by classifying the dispersing characteristics to different structure conditions. Structure condition A is characterised by the average material data. The characteristics deviating from the average value in an unfavourable way represent the structure conditions B or C, depending on the discrepancy measure. The classification usually underlies an sensitivity analysis. Fig. 10 illustrates the described methodology. The differing material properties are considered depending on combinations of structure conditions with loading cases in the design cases I, II or III (see table 1).

Hazards resulting from material behaviours are eliminated as far as possible with the aforementioned regulation. The nevertheless remaining hazards due to extreme deviations from the average material properties (see fig. 10) are responded to with

• the reserves of load-bearing capacity, which must be computationally proved for design case III and
• the correct supervision and monitoring of the behaviour and condition of the dam (see chapter 3).

Fig. 10
Consideration of spread of properties of materials of the structure
Prise en considération de la dispersion des valeurs caractéristiques de l'ossature porteuse

Further demands regarding the risk assessment considerations in connection with the material characteristics of the load-bearing structure are not made in the dam standards. However it is advisable that the aforementioned sensitivity analysis implies a risk assessment.

2.5 Risk as a result of failure of special structural installations

Dam structures and foundations are often equipped with structural and/or technical installations, which counteract to influences on the loadbearing structure in special way and therefore need to be considered when producing proofs of stability.

As for example:

• Drainages for the reduction of uplift pressure, joint water pressure and pore pressure.
• Grout curtains or diaphragm walls for soil cut off and for uplift pressure reduction.
• Ice clearing systems in order to prevent ice pressure.

Due to different influences these special installations can lose their operability partly or completely. This must be considered when producing proofs of stability. Again this can be done with the help of the design case regulation illustrated in fig. 4. As is the case of the varying material properties (see chapter 2.4) this design case regulation only applied to massive dams so far and is to be applied also to fill dams in future.

The consideration of possible functional conditions of the installations concerned is done by classification to different structure conditions. Full operability and efficacy regarding structural safety corresponds to structure condition A. Partial operability and efficacy characterise structure condition B. Malfunction and ineffectuality indicate structure condition C. Fig. 11 illustrates this classification. The three possible functional conditions are considered depending on the combination of structure conditions with loading cases in the design cases I, II and III when producing proofs of stability.

Fig. 11
Consideration of breakdown of special installations of the structure
Prise en compte du défaut d'éléments spéciaux d'ossature porteuse

Because of the fact that a total failure of the installations, which usually influence the structural safety in a favourable manner, is expected with structure condition C respectively design case III, hazards are impossible as a result of a failure of only one of such installation. Since the combination of rare events among each other is not permitted in accordance with the design case regulation (see chapter 2.1), hazards only remain in case of simultaneous failure of several or all available installations. These hazards are responded to with

• the reserves of load-bearing capacity, which must be computationally proved for design case III,
• the correct supervision and monitoring of the behaviour and condition of the dam including functional checks -if possible - and
• the demand that the structural and/or technical installations considered in the proofs of stability must be suitable for checking and restorable in their effect.

On condition that installations, which are out of order, are actually restored respectively re-established for the reason of the last-named demand, risk assessment considerations are not necessary in this context. Otherwise it would be necessary to assess the residual risk and reduce it according to fig. 2.

2.6 Other risks

Additionally to the -more or less quantifiable- hazards and risks specified in chapter 2.2 to 2.5 there exist further "general risks", which can be connected with deficiencies or errors during design, construction or operation of the dams. Both, the existing and the revised German dam standards contain recommendations and specifications, which serve to minimise these other risks. Some substantial rules are enumerated below:

• Demand for planners with competence and experience in the field of dam construction.
• Demand for competent, experienced and reliable site engineers and managers; if necessary consultation of specialists.
• Demand for qualified, conscious and sufficient dam personnel.
• Specification of dimensional tolerances during the planning stage.
• Drawing of a quality assurance program for the construction phase.
• Execution of a storage test program for first filling or re-filling of reservoirs.
• Listing of operational procedures for dam operation (incl. specifications for behaviour in case of danger).
• Demand for constant and extensive monitoring of the dams (see chapter 3).

Apart from the aforementioned normative specifications, the official activities -such as verification and permission of plans, acceptance of works and operation releases- also contribute to the minimisation of the general risks.

3. The importance of dam monitoring for risk Mitigation

An adequate dam monitoring is a substantial instrument for the reduction of hazard potential linked with the stock of dams and the risks resulting from it. In the long run it serves to a constant proof of dam reliability and of all its components.

Regarding the risk mitigation, two objectives can be pursued with dam monitoring:

¬An appropriate monitoring prevents damage to the dam by early detection of abnormal behaviour and/or untypical conditions and therefore contributes to avoidance of failures.

­With the help of a constant monitoring, information -which can be used for damage limitation- can be won by timely detection of an approaching or already occurred damage, on condition that a fast functioning information chain and an emergency plan is available.

In both cases the gainable time (by timely detection of the situation) plays the decisive part for seizing suitable measures for risk mitigation - such as damage repair, failure warning, safeguarding up to evacuation. A quantification of the contribution of dam monitoring to risk mitigation is difficult. A possibility is, to determine the decrease of potential damages dependent on the time between detection of the situation and seizure of counter measures (response time). Research investigations on the dependence of this response time on the measuring regime presented in [8] shows promise of such viewings.

The German dam standards have paid attention to dam monitoring ever since. The definitions on the matter however gear to the objective ¬ specified above. It corresponds to the local view that organisational and administrative regulations regarding dam failure warnings and corresponding emergency plans can not be subject of technical dam standards. The creation of these regulations to achieve the objective ­ should be part of official actions.

4. Outlook

As the author sees it, the concept for dam safety described in chapter 2 on the one hand and for consideration of the remaining hazards and resulting risks on the other hand is suitable to fulfill the great demands on reliability of German dams. It is a matter of a specific combination of qualitative and quantitative components.

The suggested concept combines reliable and effective items of the existing standards [1], [2], [3] with new understandings and ideas. It is still in discussion and will be presented to the public in 2000. From that point of view modifications are still possible. Regardless of this, the contents of this report reflects the opinions of the author. The publication of the revised standards will presumably take place in 2001 - the year of the ICOLD Annual Meeting in Germany.

The introduction of a purely probabilistic reliability and risk concept for dams is currently not on the agenda in Germany. Nevertheless the now suggested concept also offers partial possibilities for a complementary application of purely probabilistic methods - for example for ascertaining the safety part of the freeboard (see chapter 2.2).

Extensive and secured application of quantitative risk assessment still require further research work, which also consider national or regional features. At the University of Aachen (RWTH) such works are under way, which will be published in [9].

References

1. Deutsche Norm DIN 19700 Stauanlagen,
   Teil 10: Gemeinsame Festlegungen, Deutsches Institut für Normung e.V.,
   Beuth Verlag GmbH Berlin, Januar 1986
2. Deutsche Norm DIN 19700 Stauanlagen,
   Teil 11: Talsperren, Deutsches Institut für Normung e.V.,
   Beuth Verlag GmbH Berlin, Januar 1986
3. Deutsche Norm DIN 19702 Standsicherheit von Massivbauwerken im Wasserbau, Deutsches Institut für Normung e.V.,
   Beuth Verlag GmbH Berlin, Oktober 1992
4. Manuskript für den Entwurf Deutsche Norm DIN 19700 Stauanlagen,
   Teil 10: Gemeinsame Festlegungen, Deutsches Institut für Normung e.V.,
   Oktober 1999, unveröffentlicht
5. Like [4], Teil 11: Talsperren
6. Berga, L.; New trends in hydrological safety, Proceedings of the International symposium on new trends and guidelines on dam safety,
   Barcelona 17.-19.6.1998, Band 2,
   Balkema Verlag Rotterdam, 1998
7. DVWK-Merkblatt 251/1999; Statistische Analyse von Hochwasserabflüssen, Deutscher Verlag für Wasserwirtschaft und Kulturbau e.V.,
   Wirtschafts- und Verlagsgesellschaft Gas und Wasser mbH Bonn, 1999
8. Rißler, P. ; Talsperrenpraxis,
   R. Oldenbourg Verlag München Wien, 1998
9. Rettemeier, K., Falkenhagen, B., Köngeter, J.; Risk assessment – new trends in Germany, 20^th Congress, Q. 76, International Commission on Large Dams, Beijing 2000, Published by ICOLD Paris, 2000

Summary

In Germany the technical standards for dams are currently being revised. A concept is being pursued, which offers maximal safety, but additionally discloses the remaining hazards and requires the assessment and mitigation of the resulting risks. Thereby semi-quantitative reliability considerations are applied.

The normative demands particularly consider hazards and resulting risks as a result of rare floods, rare earthquakes, material characteristics dispersions within the load-bearing structure and failure of structural or technical installations with relevance to the load-bearing structure.

The revised standards presumably being published in 2001 particularly contain innovations concerning flood design and design case regulation for proofs of structural stability. The standards address the problem of hazard potential and give free reign to complementary risk assessment. No specific instructions are given for the actual risk assessment methodologies. The risk-reducing function of dam monitoring is separately stressed.

Résumé

Les normes techniques pour les barrages font l'objet actuellement d'une révision en Allemagne. Elles suivent un concept qui offre la plus grande sécurité possible tout en dévoilant les dangers restants et exigeant l'appréciation et la minimisation des risques qui en résultent. On utilise à cette occasion des considérations de fiabilité semi-quantitatives.

Les exigences normatives prennent en compte en particulier les dangers et risques en résultant dus aux crues rares, tremblement de terre rares, variations de propriétés de matériau de l'ossature porteuse et défaut d'installations constructives ou techniques pertinentes pour la sécurité sustentatoire.

Les normes révisées qui seront probablement publiées en 2001 contiennent des nouveautés en particulier concernant le dimensionnement par rapport aux crues et le règlement des cas de dimensionnement pour les justificatifs de sécurité sustentatoire.

Les normes elles-mêmes se consacrent au potentiel de danger et ouvrent des perspectives pour des appréciations de risques complémentaires. Aucune stipulation particulière n'est faite concernant les considérations de risque proprement dites.

La fonction réduisant les risques de la surveillance de barrages est mentionnée séparément.