“Strategic Risk Assessment for Thirteen Victorian ” STRATEGIC RISK ASSESSMENT FOR THIRTEEN VICTORIAN DAMS

Richard R. Davidson1, Shane McGrath2, Adrian Bowden3, Andrew Reynolds4

ABSTRACT Goulburn-Murray Water (G-MW) manages thirteen major dams for the State of . As part of its Improvement Program (DIP), five priority dams were identified for detailed safety and performance evaluation. Over the last three years, the design reviews have been completed and a series of dam safety issues have been identified which pose societal and financial risk. Substantial financial resources will be required to be applied over a considerable period to bring these dams into compliance with established international and Australian standards. Which of these dam safety issues should be addressed first? In what sequence and with what urgency should the actions be implemented? Can cost-effective interim targets be set? How can the remaining eight dams, which could also pose societal and financial risk, be prioritised for future detailed investigation? To answer these questions a quantitative risk assessment approach was used. The approach utilised expert engineering and consequence panels and included input to and review of the process and outcomes by a stakeholder reference panel reporting directly to the Board of G-MW. The implementation of a strategic risk management process has now begun to progressively and systematically reduce the dam safety risk across the entire dams portfolio. This process recognises that available funding for risk reduction measures is very limited, so the highest risks are reduced in an incremental fashion to achieve interim risk targets and eventually meet contemporary dam safety standards.

1. INTRODUCTION compile the ongoing minor capital and maintenance programs, no funding source had Goulburn-Murray Water (G-MW) is the largest been identified for major design deficiency of the successor bodies to the Victorian Rural upgrading works. Water Corporation and is responsible for the In October 1997, the Victorian Government operation, maintenance, renewal and dam announced, as part of a State-wide Water safety programs for thirteen State owned dams Reform Package, that it would grant G-MW and four Murray-Darling Basin Commission $18.5 million toward a Dam Improvement storages. The assets, including , the Program for the thirteen State-owned dams largest state storage and Dartmouth, the over the following five years. A condition of highest earth-rockfill dam in , have a the grant, was that customers would contribute current replacement cost of $1.5 billion. approximately an equal amount to the Program When G-MW was allocated responsibility for through price increases. managing the dams in 1995, the Authority was Subsequently G-MW has undertaken a risk faced with a number of major challenges assessment process including review by an including: a number of design deficiencies independent Stakeholder Reference Panel. The across the portfolio; inadequate funds held by risk assessment has provided a clear direction the Authority to quickly address the backlog of for a future program of dam upgrade works deficiencies; and a need to prioritise the highlighting the already recognised fact that necessary works. the identified program will exceed the initial G-MW chose to use a comprehensive Business funding grant. Risk Assessment of all its dams as a framework for planning decisions on maintenance, renewals and dam safety reviews. The details of that process were published in ANCOLD Bulletin No. 107 (ANCOLD 1997). However, whilst the methodology was used to

1 Senior Principal and Vice President, URS Australia Pty Ltd, BSE MS Eng (Civil) 2 Manager Dam Improvement Program, Goulburn - Murray Water, BEng (Civil) 3 Senior Principal, Business Risk Strategies Div. Of URS, PhD 4 Project Team Leader, Goulburn – Murray Water, BEng (Agr)

ANCOLD 2002 Conference on Dams 1 “Strategic Risk Assessment for Thirteen Victorian Dams”

2. DAM IMPROVEMENT 3. RISK ASSESSMENT PROCESS STRATEGY The risk assessment process comprised the G-MW has developed a strategy to reduce the following elements and guiding principles: risk posed by its dams using risk assessment to • Individual risk assessments of the five support a standards based approach to dam priority dams for which design reviews safety. The strategy uses varying levels of were complete to guide formulation of risk assessment for the purposes of determining reduction strategy. investigation and works priorities. • Portfolio risk assessment to prioritise The strategy uses an initial risk assessment design reviews for the remaining eight process, commonly referred to as “portfolio dams. risk assessment” to determine design review • Use of two separate, consistent measures priorities and to provide an indication of of risk: societal risk and financial risk. potential works. Following the completion of • Application of a defensible and consistent design reviews, a more detailed quantitative process. risk assessment is used in conjunction with The overall risk assessment approach was to acceptable risk to life guidelines to: develop a quantitative understanding of the • Assist in determining the severity of a risk, key contributors to risk at each of the priority by comparing the calculated risk to dams and to then prioritise the risk events indicative targets for acceptable risk to life across the entire range of priority dams so that and then deciding an appropriate time a risk-based risk management strategy could be frame for reducing risk; developed. Specifically, the process for the • Assist in devising interim, or short term, priority dams risk assessment was as follows: risk reduction measures that achieve a • Engineering information including detailed level of “acceptable” risk until funds are design reviews for each dam was reviewed available to undertake standards based by an expert Engineering Panel to apply works; and event tree analysis to identify the • Assist in deciding when business risks probability of each potential type of might be addressed ahead of low risks to failure. life. • A broad range of potential consequences The process of detailed risk assessment and was evaluated by an expert Consequences developing a risk reduction program had to Panel with respect to 1) loss of life and 2) meet the following requirements: financial cost. • Clearly present the current status of risk • A measure of risk was derived for each and how cost effective measures could be failure type and for each dam; and risk implemented to reduce risk; profiles were generated that show the total • Be subject to review and allow for inputs risk presented by each major dam and the regarding consequence assessments, by risk for all dam failure types, ranked in key stakeholders; order of decreasing risk. • Be to a level of detail that would provide • The event trees and risk profiles were used for confidence in decision making and be to develop a prioritised list of risk defendable under scrutiny; and reduction actions (a risk management • Provide risk and consequence information strategy) for all failure types applicable to in sufficient detail to support funding the priority dams. submissions to Government. • The risk reduction benefits and the costs of achieving the benefits were compared and While the formal risk assessment process was used to develop a schedule of risk only applied in detail to the organisation’s management actions. portfolio of dams this process is consistent with management’s approach to evaluation of risks in other business areas and allows the G-MW Board to consider the priority of dam upgrades in relation to other issues.

ANCOLD 2002 Conference on Dams 2 “Strategic Risk Assessment for Thirteen Victorian Dams”

Determine failure type impacts Design Reviews Innundation areas Flood depths Dam 1, Dam 2, Dam 3, Dam Flood velocities 4, Dam 5

Determine failure type consequences and costs

Identify all failure types Initial impacts - property damage, buildings, infrastructure, livestock, crops, dam repairs, G-MW revenue, heritage etc F1 - PMF, main embankment failure Consequential loss - business and industry revenue, agricultural productivity, emergency F2 - Dam crest flood, secondary embankment failure management etc F3 - Sunny day failure of main embankment Social impacts - loss of life, emergency recovery, public health, isolation, amenity, landscape value F4 - Outlet works failure (mechanical, electrical) etc F5 - Outlet works failure Environmental - vegetation, rare and threatened species, habitat, chemical contamination etc F6 - Vehicle accident

Determine failure type probabilities Calculate failure type loss of life Calculate failure type financial consequences consequences

Calculate failure type financial risk

Calculate failure type loss of life Risk = failure type probability x financial risk consequences Risk = failure type probability x loss of life consequences

Calculate total dam risk for each dam and derive risk ranked profile

KEY Total dam risk = sum of risk for dam failure types Risk Identification (Engineering Panel) Derive failure type risk ranked Risk Identification (Consequences Panel) profile Risk Analysis Figure 1. Risk Assessment Process

The dams risk assessment process was process. reviewed throughout its progress by a G-MW Stage 1 Establish the Context. Established Board-appointed Stakeholder Reference Panel. the background to the risk management The panel included a broad range of local process and determined the required level of authorities and interest groups. detail for the assessment. Stakeholders were Figure 1 summarises the links between the identified and the risk management aims and Engineering Panel, the Consequences Panel structure were developed. and the risk analysis process, and it shows how Stage 2 Risk Identification. Expert panels the dam risk profiles and the failure type risk identified and characterised the key failure profiles were developed. scenarios using event trees. For each event, the The method used to perform the priority dams probability of occurrence and the risk assessment followed the process consequences were assessed. Documentation established by the RISQUE method (Bowden of the panel’s findings was consolidated onto a et al. 2001). The RISQUE method follows a risk matrix that described each risk event and systematic methodology and is defensible with indicated probabilities and consequences. respect to current worlds best practice. It Stage 3 Risk Analysis. The probabilities and complies with the Australian Standard on risk consequences for each substantive risk event assessment (AS/NZS 4360:1991). The use of were quantified and modeled. The risk model expert panels was fundamental to this derived a range of outputs that included risk quantitative risk assessment because inputs to profiles, exposure profiles and risk maps. risk modelling (such as probability of occurrence and magnitude of consequences) Stage 4 Develop Risk Management Strategy. based on actuarial information were not Formulation of risk management strategy available for the identified risk events. utilised the results of the risk analysis process to evaluate various actions to treat key risk The risk assessment and formulation of the risk events. The benefits (risk reduction) of management strategy proceeded as a staged

ANCOLD 2002 Conference on Dams 3 “Strategic Risk Assessment for Thirteen Victorian Dams” implementing the action plan were estimated design reviews and produced dam break by modifying and re-running the risk model inundation maps for each of the dams. The until the interim risk targets were achieved. Engineering Panel reviewed the available The severity of risks was compared to information for each dam, which included indicative guideline targets in developing a design review reports, failure mode analyses, timeframe for implementation. hydrology and dam break analysis reports, issues reports, remedial works concept designs, Stage 5 Implement Strategy. Implementation geotechnical investigation reports, current and of the risk management strategy will be historic instrumentation data, construction determined by the G-MW Board and may information and photos, discussions with progressively involve actions such as original design and construction engineers, engineering remedial works, review of dam incident reports, and dam safety emergency operations, further investigations, plans. Technical representatives of each of the establishment of emergency action plans, priority dam design review teams conducted a installation of detection systems, and detailed briefing of the panel and actively community consultation. participated in the risk workshop. 4. ENGINEERING ASSESSMENT Identification of Dam Failure Scenarios. The Engineering Panel used the background The engineering assessment of each dam was information in the workshops to identify all conducted in workshops by an Engineering conceivable failure scenarios. Actual dam Panel comprised of five senior dam engineers performance was assessed and supporting covering the full range of geotechnical, engineering analyses were reviewed to structural, hydraulic and mechanical issues evaluate the probability of various failure inherent in dam safety. The well proven expert scenarios and their impacts. For all dams panel process, Barneich et al. (1996), reviewed, failure scenarios were grouped into systematically identified and provided an four primary sets of issues: hydrology / understanding of key dam failure events, hydraulics; structural; seismic; and particularly their probability of occurrence and geotechnical. In some cases, numerical the nature and extent of flooding. The ultimate analyses of the probability of failure scenarios goal of these panel workshops was to quantify were not practical, so subjective assessments risk event probability and consequences using based on panel experience and experience of the collective judgement of the panel the international dam community were participants. required. In order to be consistent, a proven Review of Design Information. Prior to guideline to estimation of event probabilities commencing the detailed risk assessment of was used, as shown in Table 1. the five priority dams, G-MW undertook

Table 1 - Event probability guidelines Description Probability Occurrence is certain 1 Occurrence of the condition or event are observed in the available database. 10-1 The occurrence of the condition or event is not observed, or is observed in one isolated 10-2 instance in the available database; several potential failure scenarios can be identified. The occurrence of the condition or event is not observed in the available database. It is 10-3 difficult to think about any plausible failure scenario; however, a single scenario could be identified after considerable effort. The condition or event has not been observed, and no plausible scenario could be 10-4 identified, even after considerable effort. The process was collaborative in that each each dam, provided factual information to expert provided their opinions and discussion assist panel members’ deliberations. ensued until consensus was achieved. G-MW personnel, including the operational staff for

ANCOLD 2002 Conference on Dams 4 “Strategic Risk Assessment for Thirteen Victorian Dams”

Development of Event Trees for Each Dam Figure 2 shows an example of an event tree Failure Scenario. Event trees were prepared which develops the probability and progressive to capture dam failure scenarios starting with outcomes of gate failure caused by an the initiating event and carrying through the earthquake. Failure can be achieved under a required sequence for a failure event that multiplicity of conditions shown by the various follows. Event trees were prepared for: pathways of the event tree. The event tree • Flood induced failure scenarios, such as indicates the probability of the outcomes for probable maximum precipitation (PMP) each path along the event tree. Similar event design flood and dam crest flood causing trees were developed for each of the overtopping of embankments and breach. hydrologic, structural, geotechnical and • Significant mechanical and electrical mechanical failure modes, including failure scenarios, such as failure or operational and intervention activities, under inoperability of spillway gates, bulkhead various initiating events. Failure probabilities failure, pipe rupture, guard gate failure, were then summed for each contributing loss of power to the spillway or outlet initiating event to produce total probabilities. tower, or various valve failures. Where the analysis identified unacceptable • Events such as deformation and cracking high probability of failure G-MW considered of embankments, instability in the the requirement for immediate action to reduce upstream or downstream slopes, or piping the risk. with storage level at full supply, historic high or other intermediate levels. 5. CONSEQUENCE ASSESSMENT • Seismic events focusing on existing dam The purpose of the Consequences Panel was to features that are susceptible to seismic assess the consequences of dam failure in deterioration or collapse such as the terms of financial cost and loss of life. The embankment or foundation; spillway panel evaluated the entire range of substantial structure, walls or hoist bridge columns; consequences (social, environmental and outlet tower, conduit and penstocks, financial) that would be inflicted by each dam bridge, and pump or failure. failure type. Inundation maps from dambreak analyses, tables of flood flow rate and depth, and various downstream cross sections, and estimates of population at risk and potential loss of life were key data used in the process.

1.0E-03 3.33E-10 Yes

1.00E-03 Uncontrolled Release Through Spillway Collapse

9.99E-01 3.33E-07 No

3.3E-04 Spillway Gate Piers Yes

1.00E-02 1.67E-10 Yes

1.00E-02 Collapse of Gates, Release Yes

9.90E-01 1.65E-08 No

5.00E-03 Flood Prior to Repair Damaged/Not Operational

9.90E-01 1.65E-06 No

9.94E-01 3.31E-04 Functional

Earthquake 0.3g Spillway Gate Failure

9.9967E-01 1.00E+00 No

Figure 2. Typical Event Tree for Spillway Gate Failure Scenario

The Consequences Panel always used the same process followed by the Consequences Panel nine members to ensure consistency of was as follows: approach and style. Each panel member represented a specific area of expertise. The

ANCOLD 2002 Conference on Dams 5 “Strategic Risk Assessment for Thirteen Victorian Dams”

Inspection of Site and Inundation Areas Identification and Quantification of At each site a briefing on the findings of the Consequences Engineering Panel was provided with a The Consequences Panel developed a checklist description of the dam, dam construction, dam of consequences that was applied to each operation, applicable failure scenarios, flood failure type. The severity of consequences inundation areas, flood flow rates and flood within each reach was estimated by depths. The briefing was followed by a trip considering the destructive force of floodwater down the valley to gain a first-hand impression for given depths and flow velocities. Other of the nature and extent of potential dam break factors were the destructive effects of debris, consequences. At selected points within the such as trees and buildings, which become inundation areas, the panel discussed potential entrained within the floodwaters. The flood extents, flood characteristics and proportion of the specified features within the potential damage. inundation area that would be destroyed, damaged, or undamaged was estimated based Consequence Data Collection on an assessment of the severity of the flood While the expert consequence panel process and used as a factor in estimation of was adopted to provide consistency in the consequential cost. consequence evaluation across the G-MW portfolio of dams, it was important that the Both direct and indirect damages were data on which the consequence assessment was assessed. Agricultural production losses were done had a consistent and justifiable basis. assessed as the farm gate value of lost This was achieved by using GIS based data production. Multiplier effects for value adding obtained from the Victorian Department of on farm production were not included. Natural Resources and Environment Corporate Environmental damage was assessed by Geospatial Data Library, local governments, estimating the re-establishment cost of affected and public utilities. Reference was also made species. to aerial photography and site inspections to Cost Uncertainty qualify information obtained from GIS. A probabilistic costing approach, where costs For each flood reach, data collected included are expressed as probability distributions was infrastructure (eg. roads, bridges, rail, used to account for inherent uncertainty electricity and other utilities), structures associated with the consequences of dam break (houses, schools, industrial facilities), land use events. For consequential costs, panel members information (agriculture, forestry, industry), were asked to provide two estimates of cost environmental features (, water which reflect the uncertainty and range of courses, remnant vegetation, endangered flora potential costs. and fauna species), archaeological issues and The first cost estimated was the median cost, or social data (population). Dam break inundation best estimate. The median cost estimate is the maps were used to develop loss of life 50% confidence level estimate, or there is a estimates and assessments of financial 50% chance that the indicated cost will be consequences. The inundation maps were exceeded. The second cost estimate was a very extended downstream of the dam to a point conservative estimate, which indicates a high where additional loss of life from incremental end cost, but not the highest conceivable cost. flooding due to dam failure was calculated to The 95% confidence level estimate would be be negligible. This extent was also used for the expected to be exceeded in only 5% of similar financial consequence assessment. Clearly cases. there could be considerable additional financial consequences resulting from the continued The spread between the two selected flow of flood water although the severity of the confidence levels provides a measure of the flood wave would be greatly reduced. This judgement of uncertainty. The costs were issues was recognised but judged that it would assumed in the risk model to be distributed as not affect the relative magnitude of total log normal distributions with attributes defined consequences at each dam and therefore would by the median and the 95th percentile values not affect the determination of priorities for provided by the panel. upgrade works. Lives Risk Criteria Current ways to present risk to life include:

ANCOLD 2002 Conference on Dams 6 “Strategic Risk Assessment for Thirteen Victorian Dams”

• Annualised lives risk (or lives risk quotient Compilation of Cost Data is also a form of societal risk); The entire range of costs for all consequences • Societal risk (in terms of F-N curves); and for each dam was compiled into a central • Individual risk. spreadsheet file. The file contained a cost matrix for each failure type. The cost matrices Lives risk was assessed and presented in all show, where applicable, the estimated cost of three ways to allow comparison. Annualised all identified consequences for each affected lives risk was found to be the most reach downstream of the dam. Future straightforward manner in which to compare consequence costs (such as lost agricultural risk between dams and failure types. productivity) were calculated in the data input At present, the types of risk where guidance on spreadsheet in net present value (NPV) terms. risk criteria can be found are societal and individual. Central to the process is the 6. RISK ANALYSIS requirement to satisfy the ALARP principle in demonstrating that the risk has been reduced as Risk analysis involved quantification and low as reasonably practicable. modelling of the constituent probabilities and consequences for each identified risk event. A ANCOLD’s individual risk criteria (ANCOLD number of techniques were applied to derive 2000) were used as a check on the ranked profiles of risk quotients as both prioritisation of G-MW’s proposed dam societal risk and financial risk. upgrading actions. All three measures of lives risk provided consistent risk ranking. A spreadsheet model was the most appropriate tool for incorporating risk modelling into the The approach taken to the calculation of Loss priority dams risk assessment. Probabilistic of Life (LOL) complies with the procedure set calculations in the analysis were performed down in ANCOLD 2000 and Graham 1999. using the Crystal Ball simulator, which is a Although these methods have many limitations commercial add-on software package to and uncertainties they were applied Microsoft Excel. The simulation software consistently across the entire dams portfolio computed spreadsheet solutions for 2000 trials, and provide a useful means of comparison. using the Monte Carlo sampling strategy. Key inputs to the Graham method are Simulation using Crystal Ball was used in the population at risk (PAR) and warning time. risk models to treat costs as probability Population at risk estimates incorporated both distributions. seasonal and temporal effects. Expected warning times were developed through The techniques that have been applied in the discussions with relevant emergency services risk assessment have been selected for their agencies and considered factors such as current suitability to define dam failure risk events level of preparedness, means by which (failure types) in financial terms, so that some warning message would be distributed and appropriate form of provision can be made that location of population. Uncertainty in PAR and accounts for their probability of occurrence warning time was included in the modelling as and consequences; and account for uncertainty probability distribution functions in a similar in the magnitude of the consequences of a dam manner to other consequence determinations. failure type. Outputs of the modelling process express the risk relationships between the dam failure types and show the magnitude of combined risk presented by all of the dam failure types. For each major dam the outputs of risk modelling included: • An exposure profile, that shows the range of cost for the dam failure types. The model outputs are presented at three levels of confidence (optimistic -50%, planning - 80% and pessimistic - 95%). • A risk profile that shows the calculated societal risk for each dam failure type and the dam as a whole. ANCOLD 2002 Conference on Dams 7 “Strategic Risk Assessment for Thirteen Victorian Dams”

• A risk map showing the relationship 7. RISK ASSESSMENT OUTCOMES between probability of occurrence, loss of life consequence and societal risk quotient The need for G-MW to implement interim for each dam failure type. measures required establishment of useful • An exposure profile, that shows the range target risk levels. Reference was made to the of consequential financial cost for the dam ANCOLD position paper on revised criteria for failure types. acceptable risk to life (ANCOLD 1998) in • A risk profile that shows the calculated establishing interim risk targets for the G-MW financial risk quotient for each dam failure risk reduction strategy. type. The following interim goals for failure type • An exposure profile that shows the risk were set to progressively reduce societal contribution to the overall financial risk and financial risk for the priority dams: Firstly, cost of the major consequence groupings reduce the risk of all failure types to levels (initial impacts, consequential loss, social below an indicative guideline “unacceptable” impacts and environmental degradation). limit (threshold) of 0.001 lives per year. • A risk map showing the relationship Secondly, reduce the risk of all failure types to between probability of occurrence, levels below an indicative guideline financial consequence and financial risk “objective” of 0.0001 lives per year. Thirdly, for each dam failure type. eventually achieve modern design criteria in Risk modelling results from each of the that all failure types comply with industry priority dams were combined to allow deterministic standards. The societal risk comparison of societal risk and financial risk ranked profile for the five priority dams of for dam failure types across the entire range of Figure 3 shows that: G-MW priority dams. The ranking of priority dams according to risk was the same for both societal risk and financial risk. • The societal risk posed by three dams is greater than the indicative guideline unacceptable limit of 0.001 lives per year.

1 $10,000,000 LOL Risk Quotient

Financial Risk Quotient 0.1 $1,000,000 First Interim Target (LOL Risk Quotient =0.001)

Second Interim Target (LOL Risk Quotient =0.0001)

0.01 $100,000

0.001 $10,000 uotient ($ pa)

0.0001 $1,000 Financial Risk Q 0.00001 $100 Loss of Life Risk Quotient (lives pa)

0.000001 $10

0.0000001 $1 Dam 2 Dam 4 Dam 1 Dam 5 Dam 3

Figure 3. Priority Dams Risk Profile •

ANCOLD 2002 Conference on Dams 8 “Strategic Risk Assessment for Thirteen Victorian Dams”

• The highest risk dam presents around 500 The reductions in societal risk and financial times (2.5 orders of magnitude) more risk risk for all failure types that would be achieved than the indicative limit. by complete engineering upgrades to industry • The risk posed by the last two priority standards are shown on Figure 5. dams must be judged against the ALARP Figure 6 shows the progressive reduction in principle. societal risk that would be achieved through The societal risk ranked profile for all of the implementation of the initial prioritised list of failure types in Figure 4 shows that: actions, against the cumulative cost. The total • The ranking of failure types according to cost to implement all of the risk reduction risk is similar for both societal risk and actions is estimated to be approximately $100 financial risk. million. The graph of Figure 6 shows that greater risk reduction is achieved by earlier • Seven failure types individually present actions on the prioritised list. The first five greater societal risk than the first interim actions, where the societal risk for every target (unacceptable limit) of 0.001 lives failure type is greater than the first interim per year. target of 0.001 lives per year, cause a reduction • Five failure types fall within the risk zone in risk of around 2.0 orders of magnitude. Also between the two interim targets. The risk Figure 6 shows that a large proportion of the for each of the remaining 16 failure types societal risk could be reduced (to around 3% of is less than the second interim target the current risk) if the first four actions were to (objective) of 0.0001 lives per year. be implemented for a relatively low cost of On the basis of the failure type risk profile, a around $ 9 million. list of 15 actions that could be progressively The dams risk reduction strategy is based on implemented to achieve standards-based the preliminary prioritised list of actions, design for the priority dams was identified by taking funding availability and project logistics the Engineering Panel and G-MW. into account.

1 $10,000,000

LOL Risk Quotient

0.1 Financial Risk Quotient $1,000,000

First Interim Target (LOL Risk Quotient =0.001) 0.01 $100,000 Second Interim Target (LOL Risk Quotient =0.0001)

0.001 $10,000

0.0001 $1,000

0.00001 $100 Financial Risk Quotient ($ pa) Quotient Risk Financial

Loss of Life Risk Quotient (lives pa) 0.000001 $10

0.0000001 $1 Dam5 F1 SDF Dam5 Dam4 F2 DCF Fail Dam1 F2 DCF Fail Dam4 F1 PMF Fail F1 PMF Dam4 Dam5 F2 Outlet Fail Dam5 F8 Outlet Fail Dam2 Dam1 F5 Outlet Fail Dam1 Dam4 F5 Spillway Fail F5 Spillway Dam4 Dam1 F4 SDF Spillway Dam1 Dam2 F5 SDF Main Fail F5 SDF Main Dam2 Fail F3 SDF Main Dam4 Dam2 F7 SDF Gate Fail Dam2 Dam2 F4 Flood Gate Fail F4 Flood Gate Dam2 Dam3 F5 Outlet Wks Fail F5 Outlet Wks Dam3 Dam4 F6 Vehicle accident F6 Vehicle Dam4 Dam3 F6 Vehicle accident F6 Vehicle Dam3 Dam4 F4 SDF Secndry Fail F4 SDF Secndry Dam4 Dam3 F3 SDF Main Emb Fail Emb F3 SDF Main Dam3 Dam3 F1 PMF Main Emb Fail Emb Main F1 PMF Dam3 Dam1 F6 Spillway Gate Open Gate F6 Spillway Dam1 Dam2 F6 SDF Secondary Fail F6 SDF Secondary Dam2 Dam2 F2 PMF Secondary Fail Secondary F2 PMF Dam2 Dam3 F2 DCF 2ndry Emb Fail Emb F2 DCF 2ndry Dam3 Dam3 F4 Outlet fail - Mech/elec Dam3 Dam2 F1 PMF Main, Scndry Fail Scndry Main, F1 PMF Dam2 Dam1 F3 SDF Embankment Fail F3 SDF Embankment Dam1 Dam2 F3 DCF Embankment Fail F3 DCF Embankment Dam2 Dam1 F1 PMF Embankment Fail Embankment F1 PMF Dam1 Figure 4. Risk Ranking of Failure Types

ANCOLD 2002 Conference on Dams 9 “Strategic Risk Assessment for Thirteen Victorian Dams”

1 $10,000,000 LOL Risk Quotient Strategy LOL Risk Quotient 0.1 $1,000,000 Strategy Financial Risk Quotient Financial Risk Quotient 0.01 First Interim Target (LOL Risk Quotient =0.001) $100,000 Second Interim Target (LOL Risk Quotient =0.0001)

0.001 $10,000

0.0001 $1,000

0.00001 $100 Financial Risk Quotient ($ pa) Quotient Risk Financial

Loss of Life Risk Quotient (lives pa) 0.000001 $10

0.0000001 $1 Dam5 F1 SDF Dam5 Dam4 F2 DCF Fail Dam1 F2 DCF Fail Dam4 F1 PMF Fail F1 PMF Dam4 Dam5 F2 Outlet Fail Dam5 F8 Outlet Fail Dam2 Dam1 F5 Outlet Fail Dam1 Dam4 F5 Spillway Fail F5 Spillway Dam4 Dam1 F4 SDF Spillway Dam1 Dam2 F5 SDF Main Fail F5 SDF Main Dam2 Fail F3 SDF Main Dam4 Dam2 F7 SDF Gate Fail Dam2 Dam2 F4 Flood Gate Fail F4 Flood Gate Dam2 Dam3 F5 Outlet Wks Fail F5 Outlet Wks Dam3 Dam4 F6 Vehicle accident F6 Vehicle Dam4 Dam3 F6 Vehicle accident F6 Vehicle Dam3 Dam4 F4 SDF Secndry Fail F4 SDF Secndry Dam4 Dam3 F3 SDF Main Emb Fail Emb F3 SDF Main Dam3 Dam3 F1 PMF Main Emb Fail Emb Main F1 PMF Dam3 Dam1 F6 Spillway Gate Open Gate F6 Spillway Dam1 Dam2 F6 SDF Secondary Fail F6 SDF Secondary Dam2 Dam2 F2 PMF Secondary Fail Secondary F2 PMF Dam2 Dam3 F2 DCF 2ndry Emb Fail Emb F2 DCF 2ndry Dam3 Dam3 F4 Outlet fail - Mech/elec Dam3 Dam1 F3 SDF Embankment Fail F3 SDF Embankment Dam1 Dam2 F1 PMF Main, Scndry Fail Scndry Main, F1 PMF Dam2 Dam2 F3 DCF Embankment Fail F3 DCF Embankment Dam2 Dam1 F1 PMF Embankment Fail Embankment F1 PMF Dam1 Figure 5. Risk Profile After Implementation of Action Plan

Proportion of Initial Risk Quotient Cumulative Cost to Implement Actions

1000 % $100,000,000

100 % $80,000,000

10 % $60,000,000

1 % $40,000,000 Cumulative Cost

0.1 % $20,000,000 Benefit(Percent of Original Risk)

0.01 % $0 foundation Act 9, Dam 5 complete fix complete fix gates #2 Emb bank filter bank Act 11, Dam 4 11, Act Dam 5 12, Act bridge new gate Act 15, Dam1 15, Act strengthen tower strengthen main embfilters Act 1, Dam 2 Int & Current Condition Current Act 2, Dam 4 Main 2, Act emb fuse plug emb fuse Act6, Dam 2 Raise emb and addemb and filters Act 4, Dam 4 Lower 4, Act spillway upgrade spillway Act 14, Dam 2 tower, Act 3, Dam 3, Act 2 Spillway Damcorners 5 8, Act Act 5, Dam 1 geotech Dam 1 geotech 5, Act and flood complete fix Act13, Dam 3 tower & Act 10, Dam 3 secndry 10, Act Act 7Dam , 2 complete Action Number Figure 6. Cumulative risk reduction for each dam upgrade action

ANCOLD 2002 Conference on Dams 10 “Strategic Risk Assessment for Thirteen Victorian Dams”

Recommended timeframes for implementation 9. STAKEHOLDER REFERENCE of upgrade works have been developed with PANEL regard to the current level of risk at each dam. • Immediate actions will be implemented Many proponents of risk assessment testify to where the calculated societal risk greatly the value of stakeholder involvement in the exceeds the unacceptable limit. Such risk assessment process. History shows that actions include operational limits, unless risk assessment procedures include an increased surveillance and upgrade of dam element of interactive participation with safety emergency plans. stakeholders then the results and conclusions reached are more likely to be challenged by • Interim actions will implemented as soon those affected by the resultant decisions. as possible over the next three years to G-MW recognised that the resultant program reduce the societal risk posed by all failure of works would affect a diverse range of types to less than the indicative guideline people, many of whom have little unacceptable limit 0.001 lives per year understanding of the risks posed by dams. For • Interim actions have also been planned for the DIP risk assessment process to fulfil its implementation within a reasonable desired purpose it was essential that broad timeframe (3 to 7 years) to reduce the risk acceptance of the risk assessment process and posed by all failure types to less than the the specifics as applied to the G-MW portfolio indicative guideline risk objective of be gained by internal decision makers and the 0.0001 lives per year. wider community. • Actions have been planned and will be To assure the G-MW Board that the risk implemented within the ultimate timeframe assessment process delivered a defensible (15 years) to achieve compliance with output and that information was presented in a standards-based criteria. form appropriate for the proposed audiences, 8. PORTFOLIO RISK ASSESSMENT G-MW convened a Stakeholder Reference Panel. The Panel membership was established Similar results were developed for the by issuing invitations to relevant organisations remaining eight dams, but with a much more of which twelve provided representatives. The limited base of information on the dam and its Panel was chaired by Mike Fitzpatrick with failure consequences. Design reviews had not membership drawn from G-MW’s customer been completed. The Engineering Panel water services committees, local government, conducted a much more limited review of Victorian Farmers Federation, catchment existing design and performance data, and had management authorities, State Emergency to judge failure modes and scenarios much Services, Victoria Police, and DNRE. Panel more subjectively. The consequences were membership was deliberately targeted at senior judged based on comparable information personnel from the various organisations, developed for the priority dams in similar recognising the detail and potential sensitivity catchment and with similar downstream of the information to which the Panel would be development in the inundation area. exposed. However, even with this limited information it While working collaboratively with G-MW, was possible to identify the priority for the the Panel was not required to reach consensus remaining design reviews and to identify a on issues raised and dissenting views were number of crucial dam safety and business risk recorded in the Panel’s final report. issues for immediate attention. G-MW have The Panel was given a series of briefings over used this information to fast track assessments six meetings. Briefings covered the of these issues within the on-going dam engineering and consequence assessment improvement program. process and specific details of deficiencies at Given the significant difference in detail of the each of the five dams studied. While the portfolio and detailed risk assessments, method of determining probabilities of failure comparison of the quantified risk is not was discussed, the Panel’s influence on the possible. results of the work was confined to the consequence determinations.

ANCOLD 2002 Conference on Dams 11 “Strategic Risk Assessment for Thirteen Victorian Dams”

In some instances Stakeholder Panel members more consistently between dams and provided feedback on specific details from between owners and portfolios. their own local knowledge. This information • Qualitative measures of risk are subject to was subsequently incorporated in the risk far more subjectivity and bias. While assessment process. In other cases more suitable for some applications they are general feedback on the methodology led to limited if comparisons to acceptable risk modifications to the consequence assessments. criteria are required. • The utility of the ALARP principle has The use of societal risk as the primary driver been demonstrated in making risk based for prioritisation of works was accepted by the decisions and defining interim levels of Panel. The Panel did however note that the risk reduction. presentation of financial risk should prove • If a reference panel approach is taken, it is valuable in seeking further funding and for important to allow sufficient time to fully emergency management/response planning. brief the panel members on the process and At the conclusion of the process the Panel to have meaningful input to the study. The reported to the G-MW Board that they six-month period for this process would be endorsed the use of risk assessment as a tool to the minimum practical time. prioritise works. The Panel was comfortable • The risk assessment model is very useful with the transparency and consistency of the during the development of design concepts risk process and satisfied that consequence and works programs to take account of risk estimates were reasonable. issues such as stability and operating water level during remedial works. 10. LESSONS LEARNED • It should be possible to “cull” low financial impact consequences early in the Many lessons were learned during the project: study to focus on the main issues. • The owner must have a clear • Good documentation is essential for a understanding of what level of detail is consistent and efficient process as panels required for the risk assessment which will move from one dam to another. The depend upon the proposed use of its process of assembling the dam design and outcomes. To ensure the necessary level of performance data alone is a very useful confidence required for detailed, costed process. dam upgrading programs, design reviews • Much is learned from past incidents. A should be available along with concept non-threatening, open and comfortable remedial works designs and consequence forum for communication and sharing of data. the lessons learned from these experiences • Appropriate resources must be utilised for is essential the engineering and consequence • Often the most useful outcome of risk assessments including both industry assessments are the discussions of dam experts and owner’s operational and failure scenarios which focus all parties on technical staff. the causes of the problems and get them to • The increasingly popular portfolio risk know their structures much better. It is not assessment process should be used with uncommon that simple non-structural caution where comprehensive design solutions present themselves which can reviews and consequence assessments have dramatically reduce risk exposure. not been undertaken, because the scope and costing of upgrade works could change significantly once these studies have been completed. However, as a means of prioritising design reviews and assessments, portfolio risk assessment is a powerful tool. • Although quantification of dam failure risk and its consequences can be a daunting and frustratingly subjective process, there are now powerful tools and processes available that allow this work to be done

ANCOLD 2002 Conference on Dams 12 “Strategic Risk Assessment for Thirteen Victorian Dams”

11. ACKNOWLEDGEMENTS

Many individuals from Goulburn-Murray Water and the Australian Dams Alliance contributed to the success of this project including the Headworks Team led by Ian Howley, Dam Safety Team led by David Stewart, Engineering and Consequence panel members from URS and DPWS, and the other design reviewers SMEC Victoria and SKM / Hydro Tasmania. Prof. Robin Fell provided valuable review and consultation throughout the process. Thanks to members of the Stakeholder Reference Panel who volunteered their time to assist Goulburn-Murray Water.

12. REFERENCES

ANCOLD 1994, Guidelines on Risk Assessment, ANCOLD 1994

ANCOLD Bulletin No. 107, December 1997

ANCOLD 1998 Position Paper on Revised Criteria for Acceptable Risk to Life, Working Group on Risk Assessment, August 1998

ANCOLD 2000. Guidelines on Selection of Acceptable Flood Capacity for Dams. March 2000.

AS/NZS 4360:1991 Risk Management, Standards Association of Australia, 1991

Bowden, A.R., Lane, M.R. and Martin, J.H., 2001, Triple Bottom Line Risk Management – Enhancing Profit, Environmental Performance and Community Benefit, Wiley, New York, 2001

J.Barneich, D. Majors, Y. Moriwaki, R. Kulkarni and R. Davidson, 1996, Application of Reliability Analysis in the Environmental Impact Report (EIR) and Design of a Major Dam Project, Uncertainty ‘96, ASCE, 1996

Graham, Wayne J., 1999. A Procedure for Estimating Loss of Life Caused by Dam Failure. September; and USBR, 1999. Policy and Procedures for Dam Safety Modification Decision Making. April 1999

ANCOLD 2002 Conference on Dams 13