8 occurred after 1960 resulting in at least one

fatality. Graham found that loss of life resulting from dam failure is highly influenced by three factors: (1) the number of people occupying the dam failure floodplain; (2) the amount of warning that is provided to the people exposed to dangerous flooding; and (3) the severity of the flooding [10].

The Graham method for estimating LOL gives conditional probability of fatality directly. The loss of life was estimated as multiplying the Population at risk by the conditional probability of fatality. Here, the fatality rate is the fractions of people expected to die. The factors influencing on the estimation of fatalities are flood severity, amount of warning and a measure of whether people understand the severity of the flooding [10].

2.7 Estimation of Probability of the Overall Dam Failure Scenario

The estimation of probability of overall dam failure scenarios should consider the downstream conditions. The overall dam failure scenarios are comprised of two key sub- scenarios;

 The states and conditions that contribute to or attend the dam failure mechanism leading to breach of the dam - the scenario “at the dam”;

 The states and conditions that exist in the dam-break affected zone - the “downstream” scenario.

Probability of the overall dam failure scenario is estimated by multiplying the probability of the dam failure by the exposure factor – dam failure at a time when that exposure scenario applies.

In each failure scenario, there is the corresponding “no failure” scenario, in which all states and conditions are the same, except that the dam does not fail. The annual probability of the “no failure” scenario is 1.0 minus the annual probability of the failure scenario.

2.7.1 Exposure Factor

Population at risk and their vulnerability vary according to time of day, day of week and season of the year, as a minimum. This fact gives rise to the concept of exposure scenario and exposure factor.

Such exposure factors directly affect the risk imposed on particular individuals (individual risk), but only affect the estimation of LOL if

they change the PAR at particular times [1]. For example, if there are a number of large schools in the dam-break zone, the population at risk may reduce significantly outside school hours. Other kind of exposure factors can be defined by proper judgement. Exposure factors should be in the range of 0 to 1.0 [1].

2.8 Estimation of Risks

In the general case, risk is estimated by the combined impact of all triplets of scenario, probability of occurrence and the associated consequences. The annualised risk can be estimated as the product of the probability of overall dam failure scenario and the consequences. Risk to life can be reported as, the individual risk to life for the person or group most at risk and societal risk to life. 2.8.1 Individual Risk of Life

The assessment of individual risk to life is based on the person or group most at risk. Usually it is a small group, such as the occupants of a single house or a small hamlet, because it is not practicable to say that any one member of that group bears a higher risk than the any other member. All members are taken to bear the same risk and it is this risk that is computed as the individual risk.

For each failure scenario, the contribution to individual risk is computed as the product of [1]:

 The annual probability of the overall failure scenario; and

 The conditional probability of fatality, given dam failure.

2.8.2 Societal Risk of Life

The primary outcome of a quantitative risk analysis is a series of estimated probability of failure and estimated consequences pairs, one pair for each specified overall failure scenario. These are termed “f,N” pairs (for risk to life), and should be reported to the decision maker, since they represent potential dam failure outcomes.

These pairs show a decision maker the failure scenarios that could occur, the likelihood that they will occur, and the best estimate of loss of life if they do occur. It is helpful to report them in both tabular and graphical format. It is conventional to have “f” on the vertical axis using a log scale, and “N” on the horizontal axis using a log scale [1]. The pairs will plot as a cloud of points, generally with no pattern to them.

9 F , pr o b a b il it y o f fa il ure p e r d a m p e r y e a r wi th e x p e c te d l o ss o f li fe > N

Expected value of life loss (lives per annum) is the product of “f” and “N”. The product “f ×N” aggregated over all scenarios, is often given as the correct measure of risk, but in reality is a special case of the general definition of risk. ANOCOLD guidelines on risk assessment [1], prefers the way of presenting the societal risk is the use of F–N plots, where “F” is the complementary cumulative distribution function, the estimated annual probability of a failure expected to result in the loss of “N” or more lives.

2.8.3 Uncertainty in the Risks

In quantitative analysis, uncertainty of both probability and consequences should be reported. This need to report uncertainty may be less critical for studies that simply aim to rank the relative risk. In risk analysis the estimates of probability incorporate many of the uncertainties. In consequence analysis, uncertainty needs to be dealt with separately for each type of consequence.

2.9 Risk Evaluation

The determination of tolerable levels of risk is fraught with difficulty. If the dams cannot be made absolutely risk free, then we need to know the tolerable risks. Risk assessment typically requires tolerable risk policies and criteria. It is the responsibility of the dam owner to ensure that the policies and criteria are set, and to endorse them. The dam owner needs to decide what risks are tolerable.

The tolerable risk to life should be identified if the dams are not absolutely risk free. In any particular case, all three guidelines on tolerability of life safety risk are to be satisfied; that is:

 The individual risk guideline;  The societal risk guidelines;

 The ALARP (As Low As Reasonably Practicable) requirement.

The tolerability of life safety risks are discussed in the following sections.

2.9.1 Evaluation of Individual Risks

The tolerable risk criteria accepted by ANCOLD was considered as suitable for ancient Sri Lankan earth dams.

For existing dams, ANCOLD guidelines on risk assessment propose that [1];

 The limit for individual risk to the person or group, which is most at risk, is 10-4 _per annum, except in exceptional circumstance;  The risks are to be lower than the limits of tolerability to an extent (between the limit

value and broadly acceptable value level) determined in accordance with the ALARP principle.

 The average/broadly acceptable individual risk to the person or group is 10-6 _per annum.

2.9.2 Evaluation of Societal Risks

There are two main approaches to societal risk criteria;

• F-N lines;

• Expected annual life loss values.

ANCOLD follows the F-N lines approach while the USBR (1997) follows the expected value approach. ANCOLD guidelines on risk assessment [1] propose that for existing dams, a societal risk that is higher than the limit curve shown in Figure 7 is unacceptable, except in exceptional circumstances. Also the risks are to be lower than the limits of tolerability to an extent determined in accordance with the ALARP principle.

The horizontal truncation of Figure 7 is without precedent, but represents ANCOLD’s present judgement of the lowest risks that can be realistically assured in light of [1];

 Present knowledge and dam’s technology;  Methods available to estimate the risks.

N, number of fatalities due to dam failure Figure 7 - Revised ANCOLD Societal Risk Guideline for Existing Dams [1]

For societal risk, the New South Wales Dam Safety Committee has adopted a negligible level, which is two orders lower than (one hundredth of) the limit of tolerability. The DSC regards the negligible level of risk as usually acceptably low. So it can be taken that the risk is negligible if it is two orders lower than the limit of tolerability. ALARP should be satisfied for risk in between limit value and negligible value.

10