BC Hydro’s Dam Safety Program and Risk Management Processes
Stephen Rigbey Director, Dam Safety, BC Hydro BC Hydro Overview
COMPLEX INFRASTRUCTURE . 80 dams at 41 sites . 31 hydroelectric facilities . ~ 9500MW installed currently . 1100 MW started construction . 3 thermal generating plants . Off-grid diesel stations
. 18,500 kilometers of transmission lines
Provincial ownership, but international implications
2 Concrete Gravity Dam
BC Hydro has 19 Major Concrete Gravity Dams: Aberfeldie Buntzen, Clayton Falls Clowhom Comox Eko Elliott Falls River Ladore Peace Canyon Puntledge Diversion Quinsam Diversion Quinsam Storage Ruskin Seton Seven Mile Spillimacheen Stave Falls & Whatshan Large Embankment Dams
WAC Bennett 183 m high; 2 km crest length Volume = 44 million m3
Large by height ; volume Mica 243m high
4 Consequences – Extreme category
Columbia River : breach at Mica Dam - flood reaches US border in 22 hrs - peaks at 48m above river bank the next day Flooding all the way to Portland >>> 10,000 people US Nuclear Plant Fraser River : breach at La Joie, Terzhagi still about 10,000 people at risk
All BC rail and road transportation routes All Power interconnects
5 Issues Database and Vulnerability Index
Deficiencies Actual – known to exist, measureable
Potential – require further investigation
Normal Conditions
Unusual Conditions flood seismic
6 Vulnerability Index-
VulnerabilityRisk = Probability Index (Actual of- Dam) Failure = (Concern x Consequence Rating(AD)) x (Frequency of Demand Scaling Factor), or,
3 Vulnerability Index (AD) = 10x (Magnitude_ of _"Concern") ) x (1-(0.1 x Ln(1/AEF))
INDEX OF VULNERABILITY
AND
Logarithmic Scaling Factor FREQUENCY OF MAGNITUDE OF "DEMAND" OF THE "CONCERN" 1.0 "FEATURE" 0.8
AND 0.6 0.4
ScalingFactor 0.2
MAGNITUDE OF "IN"- 0.0 THE GAP CRITICALITY OF EFFECTIVENESS (bewteen actual THE "FEATURE" OF INTERIM 0.00E+00 2.00E-01 4.00E-01 6.00E-01 8.00E-01 1.00E+00 and preferred) MEASURES Annual Exceedance Frequency Vulnerability does not equal Risk
Developed simply as a way to track and prioritize issues Does not justify need/urgency
NOT a robust method to track risk
Different consequences in many cases Different levels of residual risk not quantified
8 Quantifying the Proposedissues New Dam we’re Safety Indices dealing with… (All Dams)
180 Coursier decommissioning
160 New Coquitlam Dam Seven Mile upgrades Elsie rebuild 140
Known deficiencies Potential Deficiencies 120
100
80
Vulnerability Index Vulnerability
60
40 Combination of increasing knowledge (positive)
20 and deteriorating conditions (negative)
0
F02 Q2F02 Q4F02 Q2F03 Q4F03 Q2F04 Q4F04 Q2F05 Q4F05 Q2F06 Q4F06 Q2F07 Q4F07 Q2F08 Q4F08 Q2F09 Q4F09 Q2F10 Q4F10 Q2F11 Q4F11 Quarterly Reporting Metrics
Vulnerability Index 250
200
150
VI Increases VI Decreases
100 Total VI TotalVulnerability
For comparison against investigations and capital plans 50
0 F04 F04 F05 F05 F06 F06 F07 F07 F08 F08 F09 F09 F10 F10 F11 F11 F12 F12 F13 F13 Q1 Q3 Q1 Q3 Q1 Q3 Q1 Q3 Q1 Q3 Q1 Q3 Q1 Q3 Q1 Q3 Q1 Q3 Q1 Q3
10 Quarterly Reporting Metrics
F11 Q1 Risk Overall Very Low Low High Very High Extreme Consequence Consequence Consequence
20
15
10
Vulnerability Index Vulnerability
5
0
Elko
Elsie
Elliott
Mica*
Seton* Wilsey
Jordan
Comox
Ruskin*
Ladore*
La Joie*
Duncan*
Buntzen
Terzaghi*
Clowhom
Aberfeldie Wahleach Puntledge Coquitlam
Whatshan
Alouette*
Falls River John Hart*
Seven Mile
Revelstoke
Sugar Lake
Strathcona*
Stave Falls*
Quinsam (2)
Bear Creek
Cheakamus*
Clayton Falls
Spillimacheen
WAC Bennett*WAC Dam Peace Canyon
Walter Hardman
Kootenay Canal*
Heber Diversion*
Salmon River Div.
Hugh Keenleyside*
Spillway Gates AN AU PU & PN Reduction
* Active risk reduction project Prioritization of Projects
Vulnerability Index – only the starting point
Vulnerabilities relative to Consequence (LOL, PAR, Economic) . Compile, sort and compare parallel lists
Management practicality . Time to effect repairs . Sequencing with other planned work . Resource availability
Enabling projects
Corporate considerations BC Hydro’s 10-yr Capital Plan ~$20B
13 Corporate Risk Matrices - prioritization
5 Decreasing Probability RISK(logarithmic) = Probability X Consequence Decreasing 4 4+3=7 Frequency Additive if both are logarithmic or Probability 3
2 2+2=4 2+5=7
1
1 2 3 4 5 6
Increasing Consequence
14 Plants - General
Safety, Environment and Business Dam Safety
Quantitative: Financial 23 different descriptors Reliability Metrics
Qualitative: Environmental Reputational
Mixed: Accidents/Life Loss Corporate Risk Matrices
How to equate consequences?? moral and ethical issues… And how to put them in logarithmic buckets?
YOU DON’T! Consequences Corporate Response
Try to Major Insurability Limit : Complete avoid, but Crisis Change of Corporate Corporate Business Leadership Restructuring as Usual
Financial
Health and Safety Reputational 18 Corporate Risk Matrices
How to equate consequences?? moral and ethical issues… And how to put them in logarithmic buckets?
Great for broadbrush representations to a Board, but
Someone will eventually have to make the hard tradeoffs on the basis of corporate values
19 After the tradeoffs… we can’t do it all…
Reduce the Hazard Reservoir lowered Nmax in effect at LAJ
Reduce the Consequences Restricted Land Use underway at JOR
Interim Risk Management Enhanced emergency preparedness Public Education
20 But what about the justification?
- VI not the right tool - Corporate Risk Matrix simply not granular enough
…..must discuss Tolerability of Risk
103
atalities
f 4 10 Additional risk N control is required
5 CDA Revised Guidelines 10 Figure 6-2: Risk is tolerable, if 6 ALARP Example Societal Risk 10 Levels for Dam Safety 107 Risk is broadly Probability of Probability more than acceptable
1 10 100 1000 Number of fatalities, N 21 A quick history of Risk
1967 – The Farmer curves - Nuclear
22 1980’s: UK and Netherlands – other hazardous industries
Different slopes based on different “anchor points”
UK : chemical/nuclear industries
Netherlands : dykes/large scale flooding
Documented/ defensible - adopted nationally
1986: USBR “Guidelines to Decision Analysis” - no criteria
23 By 1993… move into hydro industry
Early ANCOLD lines….
BC Hydro : Significant interaction with USBR
Specific Risk and Cost Criteria for a single dam: 1 x 10-3 /yr $10,000/yr
24 BC Hydro use of Probability of Failure
Use of Event Trees and the 10-3 line throughout the latter 1990’s:
Concrete dam and spillway stability - Alouette, Ruskin, 7Mile, Stave Falls, Wahleach Debris Passage, Spill Capacity - LaJoie, Rip Rap Erosion - Terzaghi Internal Erosion - Coursier Liquifaction - Coquitlam - Hugh Keenleyside (>1 yr, > $1M !) 2 years later….
A major change in course:
- Scientific, political and legal difficulties - Societal Risk concepts problematic - Vetting had not taken place
- Use of probability without true understanding of uncertainties could not be justified in the BC Hydro context - Wouldn’t pass a ‘transparency test’ with Public Utilities Commissions
- Use of both Subjective and Quantitative Probability discontinued - Moved to the Vulnerability Index approach
26 Why use of specifically defined risk criteria still won’t work...
…at least for public utilities and private dam owners . Origins vs Current Practice . Variability in its use • Axes, mathematics • Definition of zones . Different Societal Risk Tolerances? . Ethics, transparency and public acceptance . Prioritization or Justification? . How to apply in real situations?
27 Origins
BC Hydro and USBR (1993) . Specific Risk and Cost Criteria for a single dam . 1 x 10-3 /yr “Needs discussion: and vetting…” USBR (1999) • Rational for 10-3 line documented, but • “Logic needs to be re-evaluated…”
28 Origins
Vetting and discussion STILL has not taken place… . Line ‘justified’ on basis of historical dam failure data set
..until recently: See P. Regan (2016 ASDSO): . Dam failure data set is now inappropriate for the purpose of evaluating current societal risk tolerance . Key numerical values based on possibly flawed calculations . Inconsistent with current guidance given by world-wide risk experts and with data compiled for other industries.
Needs further discussion
29 Current Practice
Although: - 1993/1999 thinking has not yet been tested/revisited - rarely if ever stated in laws and regulation for any other industry… - Approach is used in Dam Safety by various parties: . USBR, USACE, ANCOLD: NSW, HYDROTAZ…
All show the 10-3 line, all look the same, but…
30 Definition of Axes
vs Probability of Failure
103
atalities
f 4 10 Additional risk N control is required
105
Risk is tolerable, if 106 ALARP
107 Risk is broadly Probability of Probability more than acceptable
1 10 100 1000 Number of fatalities, N
31 Definition of Axes Why fatalities? PAR?
103
atalities
f 4 10 Additional risk N control is required
105
Risk is tolerable, if 106 ALARP
107 Risk is broadly Probability of Probability more than acceptable
1 10 100 1000 Number of fatalities, N
32 Choosing a Tolerability Line
103
atalities
f 4 10 Additional risk N control is required
105
Risk is tolerable, if a)Follow the crowd 106 ….but don’t askALARP questions b) Attempt to logically select one? 107 Risk is broadly Probability of Probability more than c) Have a societalacceptable debate?
1 10 100 1000 Number of fatalities, N
33 Choosing a Tolerability Line for Canada?
1
0.1 Empress of India Halifax munitions explosion 0.01
0.001 Canadian disasters
0.0001
1918 flu epidemic 0.00001
0.000001 Comet strike (10-7)
Annual Exceedence Probability (F) Probability Exceedence Annual 0.0000001 1 100 10000 1000000 Fatalities (N) 34 34 1
0.1
0.01
Canadian disasters 0.001
Cumulative FN Curve 0.0001 for Canada
0.00001
0.000001 Annual Exceedence Probability (F) Probability Exceedence Annual
0.0000001 1 100 10000 1000000 Fatalities (N)
35 1
0.1
0.01
0.001 Series3 Power (Series3) y = 7.2941x-0.834 0.0001
0.00001
Annual Exceedence Exceedence Probability (F) Annual Justification 0.000001 based on contribution to overall FN? 0.0000001 1 10 100 1000 10000 100000 1000000 Fatalities (N)
36 Mathematics Non-cumulative probability - completely different results!
103
atalities
f 4 10 Additional risk N control is required
105
Risk is tolerable, if 106 ALARP
107 Risk is broadly Probability of Probability more than acceptable
1 10 100 1000 Number of fatalities, N
37 Mathematics
ALMOST 2 ORDERS MAGNITUDE DIFFERENCE IN RISK TOLERANCE!
See various publications by Zielinski – needs verification/discussion
38 Mathematics - Uncertainty
Likely uncertainty bounds
39 Terminology
Sometimes changing between publications …and with entirely different inferences
103
atalities
f 4 10 Additional risk N control is required
105
Risk is tolerable, if 106 ALARP
107 Risk is broadly Probability of Probability more than acceptable
1 10 100 1000
Number of fatalities, N40
Terminology
Sometimes changing between publications …and with entirely different inferences
103 increasing justification intolerable
atalities
f 4 10 Additional risk N must take actioncontrol is required additional risk control required 105 unacceptable except in exceptional circumstances Risk is tolerable, if 106 ALARP
107 Risk is broadly Probability of Probability more than acceptable
1 10 100 1000
Number of fatalities, N41
Different Risk Tolerances?
Politicians Engineers Economists All look at risk differently Public . Different locations often have different perceptions
The discussions have not taken place! . Transposing criteria between industries or jurisdictions? . Engineers alone cannot dictate acceptable levels Ethics and VOSL / CBA
103
atalities
f 4 10 Additional risk N control is required
105
Risk is tolerable, if 106 ALARP
107 Risk is broadly Probability of Probability more than acceptable
1 10 100 1000 Number of fatalities, N
43 Ethics and VOSL / CBA
Possibly for large, general populations, but…
Defined populations are not statistics!
When does your child become a statistic?
44 Application: Recent Example
Campbell River
Jordan River
45 Two societies – two safety cases Guidelines Very High Extreme for seismic 1:2500 1:10000 withstand
103
atalities Jordan f 4 10 Additional risk N control is required
105
Risk is tolerable, if Campbell 106 ALARP
107 Risk is broadly Probability of Probability more than acceptable
1 10 100 1000 Number of fatalities, N
Two societies – two safety cases Both sites: No Upgrades; VeryProperty High Purchase OfferExtreme 1:500 AEP 1:2500 1:10000 Minimal incremental damages seismic Public awareness of the risk, 3 withstand Emergency10 Exercises involving entire permanent PAR Personal choice to accept, or not accept the risk atalities Jordan f 4 10 Additional risk N 25-30 controlyr Upgrade is required Program 105 Rate of risk reduction as fast as practicable
Risk is tolerable,Public ifawareness Campbellof the risk, 106 ALARPInundation mapping etc…
107 Risk is broadly Probability of Probability more than acceptable
1 10 100 1000 Number of fatalities, N
Challenges from the public Guideline 1:2500 1:10000 for seismic withstand
3 Reduce10 PAR by 1 or 2 households?
atalities
f 4 10 Additional risk N control is required
105
Risk is tolerable, if 106 ALARP
107 Risk is broadly Probability of Probability more than acceptable
1 10 100 1000 Number of fatalities, N
Challenges from the public Guideline 1:2500 1:10000 for seismic withstand
“Why103 is it ok for me to be 100x less safe”?
atalities
f 4 10 Additional risk N control is required
105
Risk is tolerable, if 106 ALARP
107 Risk is broadly Probability of Probability more than acceptable
1 10 100 1000 Number of fatalities, N
Challenges from the public Guideline 1:2500 1:10000 for seismic withstand
103
atalities
f 4 10 Additional risk N control is required
105 Risk is tolerable, if “You have to be joking…” 106 ALARP
107 Risk is broadly Probability of Probability more than acceptable
1 10 100 1000 Number of fatalities, N
Challenges from the public Guideline for seismic Personal choice to accept, or not accept the risk withstand 1:2500 1:10000 Same result 10 if3 it had been a retirement home rather than a surfing community?
atalities
f 4 10 Additional risk N control is required
105
Risk is tolerable, if 106 ALARP
107 Risk is broadly Probability of Probability more than acceptable
1 10 100 1000 Number of fatalities, N
Quantified societal risk criteria cannot withstand public scrutiny
Crown Corporation must justify all expenditures as a Public Necessity in a very public forum . Can’t hide behind “national security”
UK : “a retreat from CBA”Hopkins, McQuaid Netherlands – abandoning societal risk criteria for individual risk NSW Dam Safety Bill 2015
52 Some questions for your Board to ponder….
• How to proceed in such murky waters? • no framework even to determine how to determine tolerability of risk!
• In today’s society, is there an obligation to formally consider the views of those exposed to the hazard? • If so, to what degree does perception-based judgements enter into the decision-making process?
• When defending yourself against negligence: . Does neglecting to account for ethical risk issues open the door for a strong legal argument that acceptable risk has not been demonstrated?
53 There’s a LOT of thinking we need to do….
We need better ways to characterize and communicate risk in the context of local jurisdiction:
Answer to be found in the domain of social politics and economics, not engineering
D. Hartford Legal Framework Considerations in the development of risk acceptance criteria Structural Safety, 2008
54 END
55