ON THE ART OF EVENT TREE MODELING FOR PORTFOLIO RISK ANALYSES

Transcription

1 ABSTRACT ON THE ART OF EVENT TREE MODELING FOR PORTFOLIO RISK ANALYSES P.I. Hill 1, D.S. Bowles 2, R.J. Nathan 3, R. Herweynen 4 With the growing emphasis on a risk-based approach to dam safety management, event tree models are increasingly being used as an analysis tool. The simple structure of event trees belies some of the more complex issues associated with their application to dam safety risk analysis. This paper outlines some of the basic principles of event tree analysis and then demonstrates how inappropriate construction of event trees, and particularly oversimplification, can result in a bias in the estimated risk and produce misleading results when used to assess the dam against various risk criteria. Issues considered include the partitioning of the loading event and the impact of conservative assumptions such as assuming the reservoir is initially at full supply level. 1 INTRODUCTION There is an increasing use of quantitative risk analysis in dam safety management both in the assessment of existing dams and for determining the effectiveness of risk reduction alternatives. Event tree analysis is a common tool and can be used for portfolio risk analysis or detailed risk analysis for a particular dam or individual components. This paper focuses on the use of event tree analysis for portfolio risk analyses and particularly on the effect of the many simplifying assumptions that are often made. However, the issues raised are also of relevance to the application of event tree analysis in more detailed risk analysis. The simple structure of event trees can be deceptive. Bowles (2000) outlines some common pitfalls in dam safety risk assessment and a large number relate to the formulation and calculation of event trees. Henley and Kumamoto (1992) observe that, Event tree construction is an art rather than a science. There are however a number of principles that should be observed if the resulting event tree is to be mathematically valid. Other issues relate to the efficiency and effectiveness of event tree analysis. The first two sections describe some basic principles of event tree analysis for application to dam safety and provide examples for two dams. The following sections then outline some of those issues associated with the application of event tree analysis that require careful attention and which can result in a bias in the estimated risk and thus produce misleading results when used to assess the dam against various risk criteria. 2 STRUCTURE OF EVENT TREES An event tree is a graphic representation of a series of events, which form failure or accident scenarios for a dam. There is however, no unique event tree for a dam or any other system for a particular initiating event (Baird 1989). The structure of an event tree begins with a single branch (initiating event such as a flood or earthquake) on the left side. It is divided at various nodes as the tree structure is developed moving across to the terminal branches on the far right of the tree. In dam safety applications, terminal branches are the system outcome or system effect of an initiating event. Alternatively, the tree may be extended so that terminal branches represent the consequences of failure (refer Section 8). 1 Senior Hydrologist, Sinclair Knight Merz, B.E.(Hons), MEngSc., MIEAust., CPEng 2 Professor of Civil and Environmental Engineering and Director, Institute for Dam Safety Risk Management, Utah State University and Principal RAC Engineers and Economists, B.Sc. (Hons), Ph.D., P.E., P.H., F.ASCE. 3 Principal Hydrologist, Sinclair Knight Merz, BE(Hons) DIC MSc. Ph.D, SMIEAust., CPEng 4 Senior Dam Engineer, Hydro Tasmania, B.E.(Hons), Grad.Dip.Mgt. NZSOLD/ANCOLD 2001 Conference on Dams Page 1

2 Each branch in the tree represents an event. At each node, the likelihood that any one of the two or more succeeding events will occur is governed by chance, and is conditioned on the occurrence of events represented by branches to the left. Branches that emanate from chance nodes can be either continuously operating or intermittently operating (standby) systems. The different types of events are: the system response of the dam system (refer Fell et al., 2000); the timeliness and effectiveness of human actions and interventions (e.g. removal of a jammed spillway gate); the emergency response or other factors affecting survival in flooding (e.g. the likelihood that a warning leads to an effective evacuation). Conditional probability in an event tree represents the likelihood that an event, represented by a branch, occurs, given that unique series of preceding events has occurred. A series of events is defined as a pathway, which is represented by a unique path from an initiating event to an event of interest (e.g. failure) defined only by those events to its left in the tree. The probability of each pathway occurring is the product of the probability of and all conditional probabilities along the pathway. Ideally, an event tree should be constructed such that each pathway is unique and branches within a level are mutually exclusive (only one of the outcomes can occur at a time). It must be constructed so that it is collectively exhaustive (must cover all possible events). Thus, the pathway probabilities associated with identical outcomes can be summed together to give the total probability of that terminal outcome occurring given the initiating event. For example, all critical (failure) pathway probabilities could be summed to calculate the total probability of failure for a particular type of initiating event. 3 EXAMPLE EVENT TREES Two dams are used in this paper to illustrate some issues relating to event tree analysis. Dam A is a 39 m high concrete gravity dam with a central gated overflow spillway section. The spillway has five steel radial gates that are manually operated during a flood. In addition to the main embankment, there are three separate embankments. The flood and seismic event trees for Dam A are shown in Figure 1. Normal operating failure modes such as foundation defects for the concrete gravity section and piping of one Reservoir Level Gates OK 1 gate fails 2 gates fail 3 gates fail 4 gates fail All gates fail Overturning of Concrete Gravity Section Embankment 1 Embankment 2 Embankment 3 Right Embankment Left Embankment Peak Ground Acceleration LEGEND Expanded Chance Node Collapsed Chance Node Consequence Node Cracking of Concrete Gravity Section Cracking of Gate Pier Embankment 1 Embankment 2 Embankment 3 Right Embankment Left Embankment Cracking between CG Section & Right Embankment Cracking between CG Section & Left Embankment Figure 1 Flood and Seismic Event Trees for Dam A the initiating event occurring in the first branch of the embankments were also considered. NZSOLD/ANCOLD 2001 Conference on Dams Page 2

3 Reservoir Level Gates OK 1 gate fails 2 gates fail Overturning of Concrete Gravity Section Right Embankment Peak Ground Acceleration Cracking of Concrete Gravity Section Crest Deformation of Right Embankment Right Embankment 3 gates fail 4 gates fail All gates fail LEGEND Expanded Chance Node Collapsed Chance Node Consequence Node Left Embankment Figure 2 Flood and Seismic Event Trees for Dam B Dam B is a 56 m high, zoned earth embankment with a concrete gravity spillway. A gated concrete ogee shaped spillway structure is located in the middle of the embankment. This gated structure has five radial gates. There are also two saddle dams, which are not in contact with water unless the reservoir surcharges. The flood and seismic event trees for Dam B are shown in Figure 2. Normal operating failure modes were also considered. 4 DEFINITION OF INITIATING EVENTS For dam safety risk applications the initiating event is either a normal operating load, a flood or seismic event. The probability distribution of each of the initiating events needs to be defined over the full range required to assess the current risk profile and assess any upgrade options to be considered. 4.1 Normal Operating Loads Some failure mechanisms such as piping can be caused by normal operating loads and for these cases it is necessary to estimate the probability that the reservoir level will exceed a certain level. The relationship should reflect current reservoir operating conditions and if the loading is seasonal in nature, then the relationship should reflect the appropriate season. It should also be noted that some risk reduction measures (such as a gated spillway or modified operation rules) might change the reservoir level relationships. 4.2 Floods For a risk analysis the frequency of floods should be defined over the full range of interest. A single estimate of an extreme flood (for example the Probable Maximum Flood) is therefore not in itself useful unless a probability can be assigned to the estimate. Guidelines for estimating the frequency of extreme floods are contained in Book VI of Australian Rainfall and Runoff (Nathan and Weinmann, 1999) and the ANCOLD Acceptable Flood Capacity Guidelines (ANCOLD, 2000 a ). The impact of the new flood guidelines is presented in Hill et al. (2000). In order to simplify the event tree analysis the inflow floods are usually routed through the storage to produce a peak reservoir level frequency curve, which represents the initiating event. This simplifies the event tree calculations; however, there is no reason why the inflow frequency curve cannot be used as the initiating event and the routing performed as part of the event tree. Some risk reduction measures may change the routing characteristics of the reservoir and therefore separate relationships will need to be derived. In addition, consideration of spillway blockage due to debris or failure of spillway gates to open would require separate routing cases. For the purposes of a PRA, site-specific flood estimates may not be available and therefore must be estimated using regional relationships such as Nathan et al. (1994). For some dams the initial drawdown can have a significant impact on the peak reservoir levels and therefore a joint probability analysis of inflows and initial reservoir level should be undertaken. For a particular dam the impact will depend upon the routing characteristics of NZSOLD/ANCOLD 2001 Conference on Dams Page 3

4 the reservoir, the relative size of the reservoir compared to the volume of the inflow flood, and the storage behavior of the reservoir. The impact of assuming that the reservoir is initially at full supply level (FSL) is shown in Table 1 for Dam A. The estimated probability of failure and risk cost are overestimated by nearly an order of magnitude by ignoring the likelihood that initial reservoir levels will be less than FSL. For this dam however, the annualized life safety risk and risk cost are less sensitive to the assumption of the reservoir being at FSL. Table 1 Impact of assuming Dam A initially at FSL Initial FSL Joint probability Probability of 1.48 x 10-4 (1 in 6,800) 1.84 x 10-5 (1 in 54,400) Life Safety Risk 4.06 x x 10-5 (lives/year) Risk Cost ($M/year) 1.19 x x Seismic Dam engineers have commonly adopted a deterministic approach with two levels of design earthquake motion, one for serviceability, known as the Operating Basis Earthquake (OBE) and the other for the condition where severe damage is expected, but uncontrolled release of the storage is to be prevented, known as the Maximum Design Earthquake (MDE). (ANCOLD, 1998 a ) In the risk-based approach, the concept of Maximum Design Earthquake (MDE) is not applicable, since one must consider the risk arising from the full range of possible earthquake events. For the purpose of a PRA, the earthquake-initiating event is usually described using peak ground acceleration (pga) against annual exceedance probability (AEP). The corresponding system response curves in the seismic event tree relate the failure probability for each failure mode, to the peak ground accelerations. Small, near field earthquakes can generate relatively high accelerations; however, this earthquake motion has a relatively small amount of energy and is unlikely to cause significant damage to structures like dams. The magnitude of the earthquake provides an indication of the energy within an earthquake. The greater the magnitude, the greater the energy and the greater the likely extent of damage. For the purpose of a PRA, the peak ground acceleration recurrence plot can omit the contributions from the near small earthquakes. This can be achieved by only considering earthquakes exceeding a given magnitude. The peak ground acceleration plot for an Australian dam is shown in Figure 3, indicating a considerable reduction in peak ground acceleration when only large magnitude earthquakes are considered, for the higher AEP earthquakes. Adopting the upper curve may, in some cases, overstate the risk contribution due to seismic loading. Consideration of magnitude and PGA leads to a two-dimensional representation of the earthquake-initiating event, which uses two levels of event tree branches, and which can be important for dams with a liquefaction failure mode ML ML ML Annual Exceedance Probability (1 in N) Figure 3 Example PGA Data used in PRA The peak ground acceleration recurrence plot provided by the Seismology Research Centre (Victoria, Australia) is generally provided to an AEP of 1 in 100,000. In a PRA we are often interested in events beyond this and therefore this curve is generally extrapolated. Due to lack of earthquake data within Australia, there is considerable uncertainty in the peak ground motion estimates developed for dam sites within Australia. Therefore some caution needs to be taken in extrapolating the peak ground acceleration data and the impact of such assumptions should be tested in the event tree analysis. 5 PARTITIONING OF INITIATING EVENT The range of loading magnitudes (e.g. peak water levels or earthquake loading) needs to be partitioned over the full range of their possible NZSOLD/ANCOLD 2001 Conference on Dams Page 4

5 values. The same partitioning should be used for the existing dam and any upgrade options to avoid introducing any unnecessary influence from numerical errors insto estimates of risk reduction. Both the number of intervals and the range over which the initiating event is defined can significantly affect the results. 5.1 Number of Intervals The use of insufficient intervals can greatly affect the results of the event tree analysis. Depending upon the failure modes and the partitioning, this can either over or under estimate the risk. It can also make it more difficult to satisfy societal risk criteria because the distribution of potential life loss is not adequately defined. Using an insufficient number of intervals can also exacerbate the error introduced by other inadequacies such as not accounting for the initial drawdown in reservoir level or defining the initiating event over an insufficient range. 1.E-02 1.E-03 1.E-04 1.E-05 1.E-06 1.E-07 1.E intervals Alarp Risks are generally acceptable; but acceptability is subject to the marginal cost of further risk reduction 5 intervals Intolerable risks N, number of fatalities due to dam failure Figure 4 Sensitivity of F-N Curve to number of intervals The impact of adopting either 5 or 100 intervals on the estimated F-N curve for Dam B is shown in Figure 4. This figure shows that the societal risk curve is overestimated due to the limited number of intervals. This can have important implications for comparison of the current risk profile to various risk criteria and the justification of risk reduction alternatives; although it is also important to keep in perspective the effects of uncertainties in risk estimates. It is therefore important that the partitioning of the initiating event adequately represents the initiating event and all other relationships used in the event tree calculations (e.g. system response probabilities, stage-discharge relationships and consequences relationships) for the various failure scenarios and upgrade options being modeled. This can be achieved by either using: A sufficient number of intervals the appropriate number of intervals will depend upon the complexity of the failure scenarios and system response curves. For the dams considered in this paper, the results began to converge after 20 to 50 intervals and therefore 20 intervals was considered to be a minimum, but each case should be examined separately. A variable step size the initiating event should be partitioned so that there is greatest resolution for the probability range over which failure is estimated to occur. The same partitioning should be utilized for modeling the existing dam and also any upgrade options to ensure that the partitioning does not influence the estimated risk reduction. The disadvantage of using a variable step size is that it is difficult to determine the most appropriate partitioning prior to modeling the upgrade options. The selection of the most appropriate manner in which to partition the initiating event is often a trade-off between computational efficiency and numerical accuracy. It is, however, important that a bias is not introduced because of inappropriate partitioning. Given the computing power, which is now readily available, there is little NZSOLD/ANCOLD 2001 Conference on Dams Page 5

6 increase in computational effort in using a larger number of intervals. s 5.2 Range The range of initiating event loadings must begin at or below the threshold of failure. For flood loading this would normally be for the worst case of gate failure or spillway blockage. Consideration of the initiating event over an insufficient range can significantly affect the results. Figure 5 shows the sensitivity of the estimated probability of failure to the range over which the flood loading is partitioned for Dam A. The estimated probability of failure is underestimated by an order of magnitude if the maximum AEP considered is 1 in 1,000 rather than 1 in 10. This error persists even when the flood loading is partitioned into a greater number of intervals (e.g. 50). The partitioning should also cover a sufficient range to cover the less likely failure modes, which may become more important when upgrade options are modeled. 1.0E E E E-06 Maximum AEP 1 in 10 1 in in 1, Number of Intervals Figure 5 Sensitivity of Estimated Probability of Flood to Partitioning for Dam A A check that the initiating event has been partitioned appropriately is to examine the risk estimated for each interval. If a particular interval is contributing a large proportion of the total risk then a finer partitioning should be used. If such an interval is the first or last of those considered, it may indicate that the range of the calculations should be extended. Figure 6 shows the estimated probability of failure for each of the 100 intervals due to seismic loading for Dam A, for the existing situation and two upgrade options. Similar 2.5E E E E E E Existing Upgrade A Upgrade B Interval Figure 6 Distribution of seismic failure probability for Dam A plots can be produced for risk cost and life safety risk. Such outputs are a useful check to ensure that the adopted range is appropriate. NZSOLD/ANCOLD 2001 Conference on Dams Page 6

7 6 ADJUSTMENT FOR COMMON CAUSE The event tree calculations will be simplified if the events emanating from a node are mutually exclusive (i.e. only one of the outcomes can occur at a time, in which case the sum of the conditional probabilities at each node will be 1.0). Examples where the failure modes are not mutually exclusive include failure modes that can occur simultaneously at multiple sections of a dam due to a single or common cause initiating event. In such cases the event tree calculations should be adjusted using the unimodal bounds theorem or from consideration of physical dominance. 6.1 Uni-modal bounds theorem The uni-modal bounds theorem (Ang and Tang, 1984) states that if there are k positively correlated failure modes, with system response probabilities p i, the system (total) branch failure probability p f, lies between the following upper ( p ) and lower ( p ) bounds: p l f u f p f p u f k [ p ] p 1 ( 1 = p ) max i i f i 1 While the above equation does provide an approach to bounding the total branch failure probability, it does not provide a direct means of bounding individual failure mode probabilities. One approach is to adjust each of the system response probabilities as follows: p u i u Pf = p i Pf For flood and static failure modes, the adjustment should be frozen at the value that is calculated for the first loading interval for which the unadjusted sum of the branch probabilities equals or exceeds 1.0. Otherwise unrealistic adjustments may be calculated for more extreme intervals. l f i 6.2 Physical dominance In some cases, a single failure mode may dominate the other failure modes that are caused by the same common cause. In these cases the system response probabilities for the dominated failure modes should be reduced to reflect the effects of the dominant failure mode. For example, two sections of a dam may have identical crest elevations, but one may be constructed from a more highly erodible material, and therefore may have a dominant overtopping failure mode relative to the other dam section. 7 GATE RELIABILITY For those dams with spillway gates, the estimated gate reliability can have a significant impact on the results. Fault tree analysis of the various components is usually used to estimate the probability of one or more of the gates failing to operate. There are, however, very little relevant data available on spillway gate equipment and system performance. For this reason the failure probabilities often need to be based on performance data for similar components that are used under different operating environment and adjusted using engineering judgement. Hobbs and Azavedo (2000) summarise the estimation of gate reliability and conclude that for well-designed and maintained structures human factors are the limiting criteria in multiple gate operations. They also highlight the dependence of reliability on time and therefore distinguish between failure on demand and time based reliability. In order to demonstrate the results of event tree analyses to the estimated gate reliability, the five hypothetical gates reliabilities shown in Table 2 were applied to the two dams and the results are shown in Figure 7. Table 1 Hypothetical gate reliability scenarios Probability (%) Gates OK 1 Fails 2 Fail 3 Fail 4 Fail All fail A B C D E NZSOLD/ANCOLD 2001 Conference on Dams Page 7

8 1.0E E E E-07 Dam B Dam A Probability that all gates OK (%) Figure 7 Sensitivity of Flood to Gate Reliability For Dam A, gate reliabilities over a fairly narrow range (refer Table 2) result in differences in the estimated probability of failure of nearly two orders of magnitude. The estimated probability of failure for Dam A goes from 3.2 x 10-5 per year (1 in 31,000) for Scenario A, to 8.8 x 10-7 per year (1 in 1,140,000) for Scenario E. The estimated probability of failure for Dam B is far less sensitive to the estimated gate reliability. This highlights the significant impact that gate failure can have on the estimated probability of failure and the hence the importance of correctly estimating the reliability of gates in a PRA. 8 CONSEQUENCES OF FAILURE This section of the paper discusses the incorporation of consequences in event tree analysis. It does not cover the estimation of consequences, guidelines for which are contained in ANCOLD (2000 b ) and Hill et al. (2001) provides a discussion on some of the issues relating to consequence assessment. In event tree analysis the consequences of failure are usually restricted to the potential loss of life and economic or financial consequences. Other consequences such as environmental damage often do not lend themselves to quantitative analyses and are therefore usually treated in a qualitative sense. Additional branches can be appended to the event tree to represent the consequences. Consequences for both the failure and no failure outcomes should be used, rather than directly using the incremental values. This is because both failure and no failure consequences may change for risk reduction alternatives. The consequences resulting from a floodinduced failure will usually increase with the magnitude of the event because of the additional flood volume. The consequences should be truncated at the point (adjusted for common cause if necessary) where the total system response probability of failure first equals 1.0. The no failure consequences should not be truncated. Consequences resulting from a seismic induced failure will usually be independent of the magnitude of the initiating event. Different exposure conditions should be used where the consequences vary temporally. In most cases at least the exposure conditions of day and night are considered to account for the change in population at risk and the warning time. However, there may be other cases where weekday weekend/public holiday or seasonal exposure conditions also need to be considered (Figure 8). Non Holiday Season Holiday Season Weekday Weekend Day Night LEGEND Expanded Chance Node Collapsed Chance Node Consequence Node Figure 8 Example of exposure time subtree The different exposure conditions should be included as branches in the event tree rather than calculate the weighted loss of life external to the event tree as this will tend to: mask the scale and variability of potential life loss; increase potential for overlooking a nonstructural risk reduction alternative; make F-N type tolerable risk criteria harder to satisfy. Once the consequences have been appended to the overall event tree, the consequences of failure can be summarised using a range of measures including annualised incremental consequences, cost per statistical life saved, NZSOLD/ANCOLD 2001 Conference on Dams Page 8

9 and the range of potential incremental consequences. Care should be exercised when interpreting the annualised incremental consequences as the low probability high consequence nature of dam failure risks do not provide the opportunity for the averaging process, which is implicit in using annualised values for managing risk. Annualised values are used to assess against risk criteria such as the USBR Guidelines for Achieving Public Protection in Dam Safety Decision Making (USBR, 1997) and for assessing the cost effectiveness of risk reduction alternatives. The pairs of probability and incremental consequences can be considered to represent the population distribution of incremental consequences associated with the failure of a dam. For loss of life this is usually represented graphically on an F (cumulative frequency) - N (life loss severity) plot. It is obtained by the following procedure: sorting f (pathway probability) N pairs in descending order of life loss severity; cumulating f values in order corresponding from largest to smallest N values to obtained F-N pairs; plotting the cumulative histogram of F vs N. 9 UNCERTAINTY Many of the inputs to a risk analysis (particularly a PRA) are imprecise and in some cases it can be important to examine the impact of this uncertainty. The uncertainty can be explored by using either sensitivity or uncertainty analyses. Sensitivity analyses can be used to explore the effect of variations in the inputs on various risk analysis results or risk evaluation outcomes. More importantly they can be used to explore the robustness of dam safety decisions. The potential loss of life is an example of an input for which it is often desirable to undertake a sensitivity analysis. In addition to a recommended fatality rate, Graham (1999) also provides a suggested range. This range of values can be modeled using the event tree to determine the effect on the estimated measures of risk and evaluations against risk criteria. Uncertainty analyses involve assigning a probability distribution of the uncertainty associated with each initiating event and system response probability distribution. Monte Carlo simulation is then used to generate a joint probability distribution for each critical pathway. These are then combined with probability distributions for consequences to produce probability distributions of various risk measures. A full uncertainty analysis is usually not necessary for a PRA; however, it may be important to model the uncertainty in some of the inputs. One example is the uncertainty in the AEP of the PMP. Book VI of AR&R (Nathan and Weinmann, 1999) recommends that the notional upper and lower limits of the true AEP be plus or minus two orders of magnitude of AEP. A subjective probability mass function is provided for describing the uncertainty in the AEP of the PMP. The uncertainty can be directly incorporated into a risk analysis by performing an assessment for a range of AEPs and weighting the results using the associated subjective probability. 10 CONCLUSIONS Event tree analysis is a useful tool for dam safety risk analysis. Event trees have a simple structure and can be used to estimate the probability of failure of the entire dam or of individual components. The consequences of dam failure can also be appended to the event tree. The simple structure of event trees can, however, be deceptive and there are a number of principles that should be observed if the resulting event tree is to be mathematically valid. Particularly when applied in a portfolio risk analyses, there is a temptation to oversimplify the event tree (e.g. using an insufficient number of computational intervals for initiating events) and make conservative assumptions. This paper has demonstrated how this can introduce a significant bias and can produced misleading results when comparisons are made with various risk criteria. NZSOLD/ANCOLD 2001 Conference on Dams Page 9

10 11 ACKNOWLEDGMENTS Seth Munday from Sinclair Knight Merz assisted in the development of the event tree software. 12 REFERENCES ANCOLD (1994). ANCOLD Guidelines on Risk Assessment, January ANCOLD (1998 a ) Guidelines for Design of Dams for Earthquake. August ANCOLD (1998 b ). ANCOLD Guidelines on Risk Assessment: Position Paper on Revised Criteria for Acceptable Risk to Life. Prepared by the ANCOLD Working Group on Risk Assessment, August ANCOLD (2000 a ) Guidelines on Selection of Acceptable Flood Capacity for Dams. ANCOLD (2000 b ) Guidelines on Assessment of the Consequences of Dam. Ang, A. H-S., Tang, W.H., (1984) Probability Concepts in Engineering Planning and Design, Decision, Risk and Reliability. Vol. 2 John Wiley and Sons, New York. Baird, B. F. (1989) Managerial Decisions Under Uncertainty: An Introduction to the Analysis of Decision Making. John Wiley & Sons, Inc., New York, Bowles, D.S. (2000) Some Common Pitfalls in Dam Safety Risk Assessment. A paper prepared for the Department of Natural Resources and Environment, Victoria, Australia. Fell, R., Bowles, D.S., Anderson, L.R., Bell, G. (2000) The Status of Methods for Estimation of the Probability of of Dams for use in Quantitative Risk Assessment. International Commission on Large Dams 20 th Congress Beijing China Graham, W.J., (1999) A Procedure for Estimating Loss of Life Caused by Dam. DSO-99-06, Bureau of Reclamation, September Henley, E.J., Kumamoto, H. (1992) Reliability engineering and risk assessment. Prentice-Hall Inc., Englewood Cliffs, NJ. Hill, P.I. Nathan, R.J., Weinmann, P.E., and Green, J.A.H. (2000): Improved estimates of hydrologic risks for dams - impacts of the new flood guidelines. ANCOLD Bulletin 114: Hill, P.I., Cook, D., Nathan, R.J., Crowe, P., Green, J., Mayo, N. (2001) Development of a Comprehensive Approach to Consequence Assessment. ANCOLD Bulletin Issue No. 117 April 2001 pp Hobbs, G., Azavedo, D. (2000) Spillway Gate Reliability. ANCOLD 2000 Conference on Dams, Cairns, November McClelland, D.M. and Bowles, D.S., (1999). Life-Loss Estimation: What can we learn from case histories? ANCOLD Conference on Dams, Jindabyne, November Nathan, R.J., Weinmann, P.E., Gato, S.A. (1994) A Quick Method for Estimating the Probable Maximum Flood in South Eastern Australia. Water Down Under 94. Hydrology and Water Resources Symposium I.E.Aust. Nat. Conf., Publ. 94/10, pp Nathan, R.J., Weinmann, P.E., (1999) Book VI Estimation of Large to Extreme Floods in Australian Rainfall and Runoff A Guide to Flood Estimation. National Committee on Water Engineering (ed) Institution of Engineers, Australia. New South Wales Dam Safety Committee (2000) DSC11 Acceptable Flood Capacity for Dams Draft revised version 16 April USBR (1997) Guidelines for Achieving Public Protection in Dam Safety Decision Making. Interim Guidelines, US Bureau of Reclamation, US Department of Interior, Denver, Colorado. USBR (1999) Dam Safety Risk Analysis Methodology. US Bureau of Reclamation, US Department of the Interior, Technical Service Center, Denver, Colorado. NZSOLD/ANCOLD 2001 Conference on Dams Page 10