TOLERABLE RISK FOR DAMS: HOW SAFE IS SAFE ENOUGH? David S. Bowles 1

Transcription

1 TOLERABLE RISK FOR DAMS: HOW SAFE IS SAFE ENOUGH? David S. Bowles 1 To grapple with this topic requires that we cross the boundary from the technical world of dam safety engineering into the far more subjective world of values and value judgements. ICOLD (2005) ABSTRACT Risk assessment provides an opportunity to manage dam safety using a framework of risk evaluation that is used for other types of hazardous facilities and technologies. This paper contains a presentation of risk evaluation from a broad perspective but with application to dam safety. The distinction between tolerable and acceptable risk and the difference between risk evaluation under Common Law and Napoleonic Civil Code legal systems is addressed. The common division of risk into individual and societal concerns for the purpose of tolerable risk evaluation is introduced with reference to the topic of perceived risk. Some fundamental principles upon which all individual and societal tolerable risk criteria are based are presented. The generalized framework for the tolerability of risk developed by the UK Health and Safety Executive (HSE) is summarized. The important role of the as low as reasonably practicable (ALARP) principle in risk evaluation is discussed, including aspects such as cost effectiveness, disproportionality, legal liability, optioneering and uncertainty. Examples of tolerable risk guidelines in use for dam safety in the UK, Australia and the US are presented. ROLE OF RISK EVALUATION Traditional and Risk informed Approaches The writer (Bowles 2006) has contrasted the traditional 2 and risk assessment (RA) approaches to evaluating dam safety as follows: Traditionally, dam safety has been viewed as mainly a technical matter, which has been judged and regulated using engineering standards. These standards have tended to evolve somewhat independently in subdisciplinary areas, rather than 1 Professor of Civil and Environmental Engineering and Director, Institute for Dam Safety Risk Management, Utah State University, Logan, Utah ; and Principal, RAC Engineers & Economists; Phone ; Fax ; E mail David.Bowles@usu.edu. 2 The use of the term traditional approach in this paper is consistent with the USSD (2003) definition: The commonly practiced approach to dam safety, which focuses on safety factors and standards of performance while not including the explicit computation of risk. The assessment of risk in these approaches tends to focus on the degree of conservatism used in selecting parameters for the analyses and the ICOLD (2005) definition of the standards based approach as The traditional approach to dams engineering, in which risks are controlled by following established rules as to design events and loads, structural capacity, safety coefficients and defensive design measures. 1

2 through a comprehensive and integrated consideration of the overall safety of a reservoir project. This evolution has generally taken place in isolation from other engineering fields and industries in which public safety for low probability high consequences risks are managed and regulated. As a result, the levels of risk or safety associated with dam safety standards vary significantly across different failure modes, and they differ significantly from other areas in which public safety is managed and regulated. In addition, safety management processes, which are common in other industries, have not yet been introduced to most dam owning organizations. Some are concerned about using quantitative risk assessment in dam safety for reasons such as the approach to estimating probabilities of failure. However, it is important to recognize that the traditional approach also has significant limitations in the way that it indirectly characterizes dam failure risks. Other industries have addressed similar concerns about quantitative RA, and as a result have adopted a risk informed approach (e.g. Jackson 1997) to their use, which combine traditional and RA approaches. Risk Evaluation Tolerable risk guidelines are used in risk assessment to guide the process of examining and judging the significance of estimated risks obtained using risk analysis. The outcomes of risk evaluation should be considered to be inputs to the decision process along with other considerations. They should not be used alone to prescribe decisions on How safe is safe enough? The ICOLD Bulletin 130 on Risk Assessment in Dam Safety Management (ICOLD 2005) provides the following insight on risk evaluation for dam safety: The topic of risk evaluation is not an easy one, especially for a technically minded person who may be looking for straightforward and purely quantitative approaches. There is little in the literature that provides a coherent exposition of the principles of public safety policy formulation. To grapple with this topic requires that we cross the boundary from the technical world of dam safety engineering into the far more subjective world of values and value judgements. Yet this is the reality. All technological systems, dams included, exist within that broader world and today, in many countries, society expects that it will dictate to the technological community the safety and other goals that should be met by technological systems, rather than the opposite, as has often been the case in the past. Outline of Paper This paper is organized into three major sections. The first major section addresses the definition and presentation of risk, acceptable vs. tolerable risk, the influence of Common Law vs. Napoleonic legal systems, and project specific tolerable risk. The next major section addresses the following general principles for risk evaluation: who should decide 2

3 on risk evaluation guidelines; risk perception; individual and societal concerns; the fundamental principles of equity and efficiency; pure and applied tolerable risk criteria or guidelines; and ALARP ( as low as reasonably practicable ) and disproportionality evaluation. The last major section provides some examples of risk evaluation guidelines that are being used for dam safety evaluation in the UK, Australia and the US. Some parts this paper draw on the writer s work in preparing Section 3.3 on Risk Evaluation in ICOLD Bulletin 130 on Risk Assessment in Dam Safety Management. Definition and Presentation of Risk ACCEPTABLE AND TOLERABLE RISKS Risk is defined by ICOLD (2005) as a Measure of the probability and severity of an adverse effect to life, health, property, or the environment. The primary form of the results obtained from a dam safety risk analysis is a set of probability consequences or (f,n) pairs, which are commonly estimated in the end branches of an event tree. In dam safety risk analysis, f 3 is an estimate of the probability that N fatalities occur in the event that a particular dam failure exposure scenario. This paper focuses on life safety and therefore the consequence of life loss, which is represented by the estimated number of fatalities, N. In designing an adequate risk analysis for a particular dam, the complete set of these pairs should be representative of the entire range of plausible dam failure exposure scenarios for the subject dam comprising: a) all failure modes over the entire range of initiating event conditions, and b) all exposure conditions affecting the population at risk (e.g. day or night, weekend or weekday, season of the year, time of issuance of a warning, etc.). For practical reasons only a finite number of failure scenarios can be considered, although to achieve numerical precision in the resulting risk estimates a large number of probability consequence pairs should normally be considered (Hill et al 2000). Various statistics of N can be calculated from the (f,n) pairs such as the mean number of fatalities and the standard deviation or variance of the number of fatalities. The mean is average annual of annualized life loss (ALL). The mathematical term for the mean is the expected value of the number of fatalities, N, and it is estimated as the products of the probability consequence pairs combined over all dam failure exposure scenarios. As such, it is a mathematical construct, which never actually occurs, because the actual outcome is either zero consequences for the case that a dam failure does not occur or the consequences of the dam failure exposure scenario. Risk is commonly presented in one of two graphical forms as an estimate of the entire probability distribution of potential life loss: 3 The symbol f corresponds to frequency and F corresponds to cumulative frequency both of which are commonly used in probability and statistics textbooks (e.g. Benjamin and Cornell 1970). In the context of dam safety risk analysis, f is not an observed frequency, but rather it aspects of subjective probability. 3

4 f N plot: A discrete (non cumulative) probability distribution in which each probability consequence (f,n) pair is plotted and illustrated in Figure 1. F N plot: A cumulative probability distribution illustrated in Figure 2 and in which the probability consequence (f,n) pairs are ordered in descending order of magnitude of N, and f is cumulated from largest to smallest to calculate the annual exceedance frequency. The mean of N is the area under the cumulative F N curve. 1. E 0 3 P ro babilit y C o nse que nc e ( f N ) P a irs C umula t ive pro ba bilit y ( F > =) C o ns eque nc e ( N ) 1. E E E E E E E E En d b r a nc h c on se qu e n c e ( N ) Figure 1. Discrete (non cumulative) probability distribution of N as the f N graphical representation of risk (ICOLD 2005 after Bowles 1996). 1. E End branch consequence ( N ) Figure 2. Cumulative probability distribution of N as the F N graphical representation of risk (ICOLD 2005 after Bowles 1996). Acceptable vs. Tolerable Risk The HSE (2001) emphasises that tolerable does not mean acceptable. Thus the terms acceptable risk and tolerable risk are not interchangeable terms as can be seen from a careful consideration of the following definitions: Acceptable risk is defined by the HSE (1995) as a risk, which for the purposes of life or work, everyone who might be impacted is prepared to accept assuming no changes in risk control mechanisms. Tolerable risk 4 is defined by ICOLD (2005) and adapted from HSE (2001) as a risk within a range that society can live with (1) so as to secure certain net benefits. It is (2) a range of risk that we do not regard as negligible or as something we might ignore, but rather as something we need to (3) keep under review and (4) reduce it still further if and as we can. For a modern society to exist we must take risks, but when such risks have the potential for great harm and even loss of life we cannot call these potential outcomes acceptable. 4 Numbers in parentheses identify four conditions for tolerability of risk and are referred to as such in this paper. The fourth condition can be considered to be equivalent to the ALARP principle, which is discussed in the Subsection on ALARP Evaluation, below. 4

5 However, we are prepared to tolerate or live with the potential that these consequences may occur in order to achieve the benefits that come from taking the risks, but only if the risks meet the conditions in the definition of tolerable risk above. The four conditions in the definition of tolerable risk have very practical implications and are all familiar considerations in the dam safety field as indicated below: 1) to secure certain net benefits : dams are initially constructed to provide benefits to their owners or to society in general; but some are decommissioned when they no longer serve a useful purpose or their impacts are judged to outweigh their benefits. 2) a range of risk that we do not regard as negligible or as something we might ignore : in most cases dam failure risks are not considered to be negligible, except possibly for the smallest of dams in very remote locations or for such unlikely failure modes as one caused by a large meteor impact. 3) keep under review : traditional dam safety programs include a regime of surveillance and periodic inspections and design reviews. 4) reduce it still further if and as we can : risks associated with existing dams are reduced below their design levels through structural and non structural measures, including improved dam safety management systems. HSE Framework for the Tolerability of Risk Figure 3 is taken from a generalised framework for tolerability of risk developed by the HSE (2001). It is helpful for explaining the relationship between unacceptable risk, tolerable risk, and broadly acceptable risk. The width of the triangle represents the level of risk for a type of hazard (e.g. dams) measured by individual risk and societal concerns. The three regions in Figure 3 are summarized as follows in ICOLD (2005): 1) Unacceptable risks near the top of the triangle in this region risks would be regarded as unacceptable whatever the benefits unless they can be reduced to fall in a lower region or there are exceptional reasons for the activity or practice to be retained. 2) Broadly acceptable risks near the bottom of the triangle risks falling into this region are generally regarded as insignificant and adequately controlled and would not usually require further action to reduce risks unless reasonably practicable measures are available (i.e. the ALARP principle still applies). 3) Tolerable risks between the other two regions risks in this region are typical of the risks from activities that people are prepared to tolerate in order to secure benefits, in the expectation that: the nature and level of the risks are properly assessed and the results used properly to determine control measures; the residual risks are not unduly high and kept as low as reasonably practicable (the ALARP principle); and the risks are periodically reviewed to ensure that they still meet the ALARP criteria. 5

6 Figure 3. HSE framework for the tolerability of risk (HSE 2001). In applying the generalized HSE framework in Figure 3 to the regulation and management of risks for a specific project, the following limits have sometimes been defined as boundaries between the three regions of risk: Limit of tolerability between the unacceptable and tolerable regions; and Objective limit between the tolerable and broadly acceptable regions. These limits are discussed in the Subsection on Project specific Tolerable Risk below. Common Law vs. Napoleonic Civil Code Legal Systems It is important to recognize the significance that the type of legal system has in risk evaluation and it implications for the significance of the limit of tolerability and objective limit, which are introduced in the previous subsection. The HSE framework is developed for the Common Law legal system that originated in the UK. This system underlies the legal systems in the US and Australia, for example. However, many other countries, including the Netherlands, operate under the Civil Code of Law, whereby compliance with a regulatory limit criterion provides protection against further liability. Ale (2005) makes the following important observation in a comparison of risk regulation in the UK and the Netherlands The risk criteria adopted in the United Kingdom and the Netherlands look very similar. Both countries have upper limits for allowable individual risk and both countries use criteria lines in FN curves 5. Even their numerical values do not differ a great deal. However, the interpretation differs greatly. Whereas the criteria in the Netherlands are the end of the discussion, in the United Kingdom they are the starting point. 5 This is a reference to the role of F N curves in societal risk guidelines. See also the Subsection on Definition and Presentation of Risk, above, and Figures 4 and 5 for the ANCOLD (2003) guidelines. 6

7 Thus if in the Netherlands the owner of a hazard reduces his risk to barely meet an objective limit and convinces the appropriate regulator that he has done so, he can have confidence that he has met his legal obligations to reduce the risk. In contrast, the limit of tolerability is a necessary but not necessarily a sufficient condition that the owner of the hazard must meet in a Common Law country because the owner must reduce the risk to be ALARP, and that level of risk is generally lower than the limit of tolerability. Furthermore, this requirement can only be defined with confidence retroactively as the result of a court judgement that considers whether or not the owner acted reasonably in all respects in a particular situation, and typically after a failure has occurred. Thus, under a Common Law legal system there exists no sign off by a regulator that can provide absolute protection prospectively, whereas such protection is understood to exist in principal under a Napoleonic Civil Code legal system. Hence in Civil Code countries the concept of tolerable risk is not applicable and in Common Law countries the definition of broadly acceptable risk includes no absolute guarantee that all legal obligations have been met and it incorporates the requirement that ALARP should be satisfied. Tolerable risk rather than acceptable risk is therefore becoming generally recognized as a goal for risk management in countries with Common Law legal systems. Therefore, the discussion in the following sections of this paper focuses on the Common Law legal context. Under a Civil Code system it is expected that the results from a risk assessment will demonstrate that the risk has been reduced to the objective limit with a high level of confidence. Since there are no bright lines 6 under a Common Law legal system, such that an owner can be confident that once the risk is reduced below that line or limit all legal obligations have been met, there is an incentive for the private owner of a hazard to reduce their risk to a lower level because it would be expected to provide a higher level of legal defensibility. This incentive may not exist for government dams, although the particular legal situation must be considered. This is a very important point for dam safety management regardless of whether risk assessment is used or not. Project specific Tolerable Risk The writer considers that the tolerable risk region in Figure 3 cannot be applied to a specific project (dam) without some modification. The key point is that a risk that is low enough to fall below the region of unacceptable risk is not necessarily a tolerable risk; and it would be an intolerable risk if it does not meet all four conditions for tolerable risk. In other words, the complement of an unacceptable risk includes three possibilities; intolerable risk, tolerable risk and broadly acceptable risk. To avoid the confusion that this limitation in the generalized HSE diagram (Figure 3) may lead to when applied to a 6 The writer has observed that engineers in Common Law countries are often surprised that legal considerations do not provide support for a regulatory sign off that a tolerable level of risk has been achieved. They tend to expect the situation that pertains in Civil Code countries, but that situation cannot be achieved through regulation since it is a foundational legal principle that cannot be so easily changed. 7

8 particular project, the writer suggests that the region that is shown as the tolerable region in Figure 3 should be divided into two regions as follows: Intolerable risks between the unacceptable and tolerable risk regions in this region risks are not unacceptable, but they do not satisfy all conditions for tolerable risk. Tolerable risks below the intolerable and broadly acceptable regions in this region risks satisfy all four conditions for a tolerable risk. Thus the tolerable risk region in Figure 3 applies to a broad range of risks that may be considered tolerable, but it omits another important region of intolerable risks. This limitation has lead to some significant confusion in applying the Australian Committee on Large Dams (ANCOLD 2003) tolerable risk guidelines, which have followed the HSE terminology to a large degree, including adopting the term, limit of tolerability. The writer has found that the HSE concept of broadly acceptable risk is valuable when justifying that certain risks are just generally regarded as insignificant. Examples for dams might include the destruction of a dam by impact from a large meteor or aircraft impact for a dam that is not located close to significant commercial or military aircraft movements. However, when the HSE concept of broadly acceptable risk is applied to consideration of whether a particular risk is adequately controlled and would not usually require further action to reduce risks unless reasonably practicable measures are available this seems to require the same type of evaluation that is involved to demonstrate that a risk is tolerable, including demonstration that the ALARP principle is satisfied. In this case, the distinction of broadly acceptable risks seems to be of no practical value. Based on the above considerations, the writer considers that the term limit of tolerability is inaccurate and potentially misleading. Instead the term limit of unacceptability accurately describes the boundary between the HSE unacceptable risk region and the proposed intolerable risk region. The writer considers that the term limit of intolerability is useful for describing the boundary between the intolerable and tolerable risk regions, but this limit cannot be generally defined because it should be based on a project specific evaluation of the four conditions for tolerability of risk, including ALARP. In contrast, the limit of unacceptability is commonly defined in safety regulations. Lastly, the writer sees no reason to try to define the objective limit under a Common Law legal system because project specific ALARP related considerations will always determine the legal obligations of the owner of the hazard and these cannot be superseded by a regulatory objective limit. Who Should Decide? GENERAL PRINCIPLES FOR RISK EVALUATION Dams pose many threats including to people, the economy, the environment, societal structure and the survival of a private or governmental dam owner organization. These 8

9 consequences are of concern to society as a whole. Even factors such as the financial implications of dam failure for the dam owner can have important societal implications if the cost and continuity of water or electricity supply or the value of shareholders investments would be affected. Therefore, it is generally agreed that tolerable or acceptable risk criteria that address protection of the interests of the community should be determined through the political process based on societal values. However, the Netherlands is the only known example of legislatively approved risk criteria. These criteria have played an important role in the design of that country s flood defences (TAW 1990). Where legislatures have not taken the lead, there are examples of risk evaluation criteria that have been developed by regulators (HSE 2001, PlanningNSW 2002, and NSW DSC 2004), professional bodies (ANCOLD 2003), and dam owners (Reclamation 2003). Risk Perception From the outset of this paper it is emphasized that judgements about the adequacy of dam safety, which are fundamentally judgements about public safety, are intrinsically value judgements and not technical matters, although they should be informed by sound technical information. The way that people perceive risks and apply value judgements is complex and often highly influenced by media attention and recent experience. Nevertheless, it is an important basis for decision making about risks and for establishing risk evaluation criteria. The characteristics of risks also affect the perception of risk. Although the distinction between voluntary and involuntary risks is well recognized today (Starr 1969), there are many other important characteristics of risk, such as those listed in ICOLD (2005) from Lowrance (1976): effect immediate effect delayed no alternatives available many alternatives available risk known with certainty risk not known exposure is an essential exposure is a luxury encountered occupationally encountered non occupationally common hazard dread hazard affects average people affects especially sensitive people will be used as intended likely to be misused consequences reversible consequences irreversible. These and other risk characteristics are important to consider when making comparisons between risks associated with different types of natural or technological hazards. From the above list it is clear that readily quantified measures of consequences, such as monetary losses or the number of fatalities, which are commonly the only consequences included in dam safety risk assessments, provide a partial picture of the full scope of dam failure consequences, which includes many incommensurable and intangible aspects. 9

10 Individual and Societal Concerns From studies on perceived risk, people s concerns have been grouped into two broad categories based by HSE (2001) as summarized in ICOLD (2005): 1) Individual concerns how individuals see the risk from a particular hazard affecting them and things they value personally they may be willing to live with a risk that they do not regard as negligible, if it secures them or society certain benefits provided that such risks are kept low and clearly controlled (HSE 2001). 2) Societal concerns the risks or threats from hazards which impact on society and which, if realized, could have adverse repercussions for the institutions responsible for putting in place the provisions and arrangements for protecting people. Societal concerns include multiple fatalities, exposure of especially sensitive groups, and the uneven distribution of risks and benefits. The occurrence of multiple fatalities in a single event are referred to as societal risk, which is therefore a subset of societal concerns. (HSE 2001). In general, society is more averse to a single large loss accident involving large numbers of fatalities than to many small loss accidents involving only one or two fatalities, even if the total loss from the sum of all of the small loss accidents is larger than that from the large loss accident. This societal risk aversion can be represented using slopes, which are steeper than the 1 to 1 slope on a log log F N chart 7. Local or facility risk criteria are sometimes defined using F N charts been developed in some countries for the siting of hazardous industrial plants and for land development in their vicinities. These criteria are derived from national level societal criteria based on the number of locations or facilities in a nation and the distributions of deaths for various accident types over all locations or facilities. The writer has conducted this type of derivation in an approximate manner for high hazard dams in the US. Equity and Efficiency Two fundamental principles, from which lower level principles and the associated tolerability of risk criteria are derived, are described as follows in ICOLD (2005): Equity the right of individuals and society to be protected, and the right that the interests of all are treated with fairness; and Efficiency the need for society to distribute and use available resources so as to achieve the greatest benefit. These principles are normally competing. The need to obtain an appropriate balance between them leads to the development of lower level principles and criteria for tolerability of risk. Although these principles have broad applicability across a wide 7 See examples of F N charts with 1 to 1 slopes in Figures 4 and 5. 10

11 range of cultures and political and legal systems, the development of principles at lower levels involves very complex choices that are strongly affected by societal values and the political and legal systems. Pure Criteria Morgan and Henrion (1990) have grouped risk evaluation criteria into three groups as follows: rights based criteria (the same as equity based criteria), utility based criteria, and technology based criteria. The HSE (2001) adopted these categories referring to them as pure criteria and re naming rights based criteria as equity based criteria. The three groups are as follows as summarized with examples in ICOLD (2005): a) Equity based criteria are founded on the premise that all individuals have unconditional rights to certain levels of protection. In practice, this often converts to fixing a limit to represent the maximum level of risk above which no individual can be exposed. If the risk estimate from the risk assessment is above the limit and further risk control measures cannot be introduced to reduce the risk, the risk is held to be unacceptable whatever the benefits. (HSE 2001). Examples include the following: zero risk through elimination or by not allowing its introduction; bounded or constrained risk; voluntary consent and compensation; and some form of an approved process, based on due process (Morgan and Henrion 1990). b) Utility based criteria comprise a comparison between the incremental benefits of the measure to prevent the risk of injury or detriment, and the cost 8 of the measure. (HSE 2001). The balance between benefits and cost, both expressed in monetary terms, can be deliberately skewed towards benefits by ensuring that there is gross disproportion between costs and benefits. (HSE 2001). Morgan and Henrion (1990) list the following examples of utility based criteria: deterministic and probabilistic benefit cost, cost effectiveness (including cost per statistical life saved), bounded cost, maximising a multi attribute utility function (Keeney and Raiffa 1976), and minimizing the chance of the worst possible outcome or maximizing the chance of the best possible outcome. c) Technology based criteria are founded on the idea that a satisfactory level of risk prevention is attained when 'state of the art control measures (technological, managerial, organizational) are employed to control risks whatever the circumstances. (HSE 2001). An example of a technology based criterion in the environmental field is best available (or current) technology, although it is typically applied in combination with a feasibility affordability criterion, such as costeffectiveness (Morgan and Henrion 1990). Applied Criteria Applied risk evaluation criteria are typically a hybrid of the pure criteria discussed above. Examples in dam safety are included in the last major Section of this paper. 8 Where cost is considered in broad terms, which may include time and effort in addition to monetary aspects. 11

12 The generalised framework for tolerability of risk (TOR) developed by HSE (2001) is intended to capitalise on the advantages of each of the above pure criteria whilst avoiding their disadvantages and to resemble the decision process that people use in everyday life. The HSE TOR framework utilizes an equity based criterion for risks in the unacceptable region in Figure 3 and a utility based criterion for risks falling in the other two regions. Technology based criteria may be used to complement the other criteria in all three regions, although rigid boundaries are not defined between the three regions. The factors and processes that control which region a risk falls into are context specific; with the result that different countries, and even different organisations within the same country, may classify the same risk differently but such differences may be viewed as appropriate rather than inconsistent where they are justified by differences in the way that different types of risks are valued, as illustrated in the next two paragraphs. In some cases more stringent expectations are placed on new facilities than on existing ones (e.g. ANCOLD 2003, Netherlands Ministry of Housing, Physical Planning and Environment, 1989). Vrijling (2001) provides an example of an approach to translating the findings of sociological research on risk acceptance by the community into criteria on risk to the individual in developed countries. An individual risk criterion, expressed as a probability of loss of life for the most exposed individual, is based on the degree of voluntariness with which an activity is undertaken and the perceived direct benefits of the activity. It varies over several orders of magnitude for situations in which there is complete freedom of choice to participate in the activity, such as mountaineering, to the case of an imposed risk without any direct benefit. A base value of 1 in 10,000/year is selected, which is about the lowest value of average annual background risk of death for any gender/age group (females aged around twelve years) in some of the developed countries and about an order of magnitude lower than the fatality rate for males in their late twenties. Applying Vrijling s approach to dams, it might be argued that the degree of voluntariness with which people are exposed to dam safety risks and the direct benefits of dams vary with the purpose for which a dam is used. A flood control dam that protects a community from frequent flooding and therefore provides a direct benefit to the entire community; whereas a private hydropower dam, which provides power to a distant region and only a few jobs in the community that is situated below the dam, may not provide any significant direct benefits to that community. On this basis it might be argued that a lower level of risk is justified in the case of the hydropower dam than in the case of the flood control dam. The writer has seen many examples of flood control and some water supply dams which, even if their failure risks were reduced using state of the practice structural measures, it is estimated that they would still pose risks that are classified in the unacceptable region. In these cases it might be appropriate to examine whether the essential nature of the direct project benefits might justify an exception to the application of the limit criterion that defines the unacceptable region 9. 9 See further discussion of this exception argument applied to the limit criteria in the ANCOLD tolerable risk guidelines in the Subsection on Individual Tolerable Risk, below. 12

13 ALARP Evaluation ALARP is a key consideration in satisfying the requirements for tolerability of risks under Common Law legal systems. The ALARP principle is an explicit consideration under HSE (2001) and ANCOLD (2003) tolerable risk guidelines. Although ALARP is not found in acceptable risk guidelines in countries that operate under Civil Code legal system, the IAEA (1992) has been incorporated ALARP at the international level. The following is a summary of some important aspects of the ALARP principle 10 : a) Condition for tolerable risk: ALARP is the fourth condition that must be met for risks to be considered to be tolerable (See Subsection on Acceptable vs. Tolerable Risk above). Typically a maximum limit level of risk is specified as part of tolerable risk guidelines to ensure that equity considerations are met, but risks must be further reduced until they can be considered to be ALARP. b) Cost effectiveness: Rowe (1977) proposed that cost/benefit measures, such as cost per statistical life saved (CSLS) 11, be used to assist in implementing the ALARP principle. In practice, this is commonly taken to mean that risks have been reduced to the point where it is no longer cost effective to reduce them further. OMB (1992) and Congress have promoted the use of a cost effectiveness approach to justifying the extent of governmental spending and for regulatory impact analysis for life saving measures. Bowles (2001) proposed the approach illustrated in Table 1, based on U.S. Federal Government practice, as an approach for assessing the degree of ALARP justification for implementing a risk reduction measure. Four illustrative ALARP justification ratings ( Very Strong, Strong, Moderate, and Poor ) are defined in increasing magnitude of adjusted CSLS. However, this evaluation should normally be used only to justify risk reduction below the maximum limit level with no need to justify reducing risks above that level since cost and cost effectiveness should not normally be a consideration in reducing risks to remove them from the unacceptable region. c) Willingness to pay: The HSE (2001) uses the value of preventing a fatality (VPF), determined from willingness to pay studies of the marginal improvement in safety, as a means of valuing the benefits of life safety risk reduction in cost/benefit studies. When CSLS is equal to the VPF, the expenditure might be considered to be economically efficient, but it would not meet the important disproportionality consideration discussed in the next point. The willingness to pay for risk reduction can be expected to vary between countries for similar risks and across different types of risks within the same country. d) Gross disproportion test: HSE (2001) refers to the implementation of the ALARP principle as requiring a gross disproportion test applied to individual risks and societal concerns, including societal risks. The gross disproportion is between the 10 For detailed discussions of ALARP see HSE (2002a, b, c and d) and Bowles (2004). 11 CSLS is the cost of achieving an increment of life safety risk reduction and not a value placed on a human life. For example, a CSLS of $10M would result from reducing a risk by 1 in 10,000/year for 10 persons at an annualised cost of $10,000/year as follows: CSLS = $10,000/(10*1/10,000) = $10M. 13

14 cost 12 of an additional risk reduction measure and the estimated amount of that risk reduction. To satisfy this test the CSLS would need to be significantly higher than the VPF to demonstrate a level of disproportion 13. This principle is founded on the legal obligation of dam owners to reduce risks to a point of diminishing returns where additional risk reduction would cost disproportionally more than the risk reduction benefit achieved. Table 1. ALARP strength of justification ratings (Bowles 2001) Range of Adjusted Cost per Statistical Life Saved ALARP Justification (US$M/life) Rating Greater than or equal to: Less than: Very Strong 0 3 a) Strong 3 a) 30 Moderate b) Poor 140 b) a) The Very Strong Strong rating boundary is based on the following: "The EPA has used a ceiling of $12 billion 14 per case of cancer prevented to allocate Superfund cleanup efforts while the U.S. Department of Transportation has refused regulations costing more than $3 million per life saved." (Kniesner 1997). b) The Moderate Poor rating boundary is based on the following: "The executive branch of the federal government has accepted regulations with a cost per life saved of up to $140 million even though there are programs I will soon mention that can save lives for under $10 apiece." (Kniesner 1997). e) Existing good practice: HSE (2001) states that a comparison against existing good practice could be used as an ALARP test if such practice is known to be ALARP. However, at this time, it is unclear what aspects of existing good dam safety practice would satisfy ALARP, and which would fall short or exceed the level needed to satisfy ALARP. f) Defensibility and liability: The desire by dam owners or officers of dam owning organizations to achieve a high level of defensibility against legal liability can be a strong incentive to make expenditures in risk reduction even though these expenditures are relatively disproportional to the risk reduction that is achieved. This factor is currently the subject of a governmental enquiry in the State of Western Australia, which the writer is assisting with, together with issues of whether it is more appropriate to spend funds on improving safety in other areas to which the public is exposed to risk to life or in dam safety, and the impacts on the viability of the agricultural economic sector when the high costs of dam safety risk reduction measures are passed on to the water users. g) Uncertainty in risk evaluation: ALARP carries with it an implicit recognition that absolute safety cannot be guaranteed. This is partly because of the uncertainty that exists in both the probability and consequences dimensions of risk estimates that are 12 Where cost is considered in broad terms that may include time and effort in addition to monetary aspects. 13 See the discussion on Disproportionality Ratio in the Subsection on ALARP and Disproportionality Considerations, below 14 In the writer s experience with estimating adjusted CSLS for risk reduction measures for approximately 500 dams, values have varied from zero to in excess of US$10 trillion per statistical life saved. 14

15 to be evaluated against tolerable risk guidelines, but also because unforeseen failure modes may occur. A higher degree of disproportionality is a way of providing a margin of safety to allow for these uncertainties and hence to err on the side of safety. h) Optioneering: Fundamental to evaluating whether or not ALARP is met using costeffectiveness or disproportionality approaches is the identification of any physically possible 15 options for further risk reduction. The options should include structural and non structural measures, including improvements to the owner s overall safety management system. HSE (2002d) refers to this process as Optioneering. Hence, Fischhoff et al. (1981) state, One accepts options, not risks. The identification of options requires the creative skills of experienced dam engineers and others and should be considered as an essential part of the dam owner s duty of care 16. When viewed in the context of managing a portfolio of dams, optioneering should include staging the implementation of risk reduction measures and the identification of separable construction upgrade projects 17. i) Future risk reduction: A technology watch can be used to recognize new costeffective approaches to making dams even safer in the future. Identifying new ALARP opportunities is a means of satisfying the goal of maintaining tolerable risks through satisfying the fourth condition for tolerability of risk. j) Incommensurable and intangible factors: Although quantitative tests such as those in b) and d) above can provide valuable insights for informing safety decisions, incommensurable and intangible factors should be included in the overall ALARP evaluation. EXAMPLES OF RISK EVALUATION GUIDELINES IN DAM SAFETY Three examples of tolerable risk evaluation guidelines that are being used in dam safety are summarized and compared in this section. The UK HSE Tolerability of Risk Guidelines (2001) guidelines are used for all industry in the UK and are recently for reservoir safety (Hinks et al 2004 and Hughes and Gardiner 2004). The Australian National Committee on Large Dams (ANCOLD 2003) guidelines are widely used in Australia as a supplement to the traditional approach. Reclamation s Public Protection Guidelines (Reclamation 2003) are routinely used as a significant factor in decisionmaking on the priority and degree of risk reduction. The examples cover individual tolerable risk, societal tolerable risk, and ALARP and disproportionality considerations. Individual Tolerable Risk All three examples have adopted an individual tolerable risk limit of 1 in 10,000/year. The HSE and ANCOLD apply this requirement to the identifiable individual (or group) at 15 HSE (2002b) states that Reasonable practicable is a narrower term than physically possible. 16 Duty of Care refers to the legal obligations that the owner of a hazard (e.g. a dam) has to exercise a standard of care in managing the hazard for which he is responsible. 17 See Bowles (2006) for a discussion of portfolio aspects of dam safety risk management and risk assessment and Bowles et al (1999) for a definition of SCUPs. 15

16 greatest risk. Risks above this limit are classified as unacceptable 18 and must be reduced at least to the limit and then further reduced below the limit to be ALARP. However, the Reclamation guidelines refers to this as its Annual Probability of Failure [APF or formerly the Tier 2 guideline in Reclamation (1997)] guideline and defines it as the maximum combined (i.e. totaled over all loading types and failure modes) annual probability of failure rather than a tolerable risk limit for the individual at greatest risk. Reclamation justified their APF guideline based on their desire to limit the probability of one or more failures of a Reclamation dam in their portfolio over a time horizon. The HSE and ANCOLD guidelines specifically require that the risk to the individual must be further reduced below the tolerable risk limit of 1 in 10,000/year to meet ALARP and disproportionality considerations. However, the Reclamation guidelines do not specifically refer to ALARP. Instead, for a dam with an estimated APF exceeding 1 in 10,000/year, there is said to be an increasing justification for reducing the probability of failure; and for a dam with a probability of failure less than 1 in 10,000/year, there is said to be a diminishing justification for reducing the probability of failure. ANCOLD applies the individual tolerable risk limit of 1 in 10,000/year to the case of existing dams, but applies a more stringent limit of 1 in 100,000/year to the case of new dams or major augmentations of existing dams. For both cases ANCOLD include a qualification that in exceptional circumstances Government or its agencies and not the dam owner may determine that risks exceeding the tolerable risk limits may be tolerated based on special benefits that the dam brings to society at large. This is an example of the conflict between the fundamental principles of equity and efficiency in which the maximum risk level designed to satisfy equity considerations, typically at the expense of reducing efficiency, might be relaxed on an exceptional basis because of special benefits that it is determined that society needs. McDonald (2006) states that examples of such exceptions are an expansion of the Sydney Airport in Australia and the siting of the new airport outside of Amsterdam in the Netherlands. In both cases locations close to major population areas could not be demonstrated to meet life safety risk criteria, but the benefits of proximity to the population that these airports serve were deemed by government to outweigh lower risk but more distant locations. HSE (2001) discusses the case for considering hypothetical individuals at various locations rather than just the actual individuals that might exist at the time that the risk assessment is performed. Societal Tolerable Risk Whereas the three examples of the individual tolerable risk guidelines shared the same limit value for existing dams, the societal tolerable risk guidelines are all different, as can be seen from the following summaries: 18 ANCOLD uses the term intolerable but the writer considers that term unacceptable is more precise. 16

17 a) HSE: A probability of 50 or more fatalities of more than 1 in 5,000/year is considered to be unacceptable and below this level ALARP and disproportionality considerations apply. This guideline corresponds to a single point on an F N chart and it is assumed that fatalities would be incremental fatalities in the case of flood induced failure modes. It is understood that this guideline, which is somewhat lax by international comparisons, is under review and may be replaced in the future. b) ANCOLD: Dams with failure risks that plot above a limit of tolerability 19 criterion on an F N chart of incremental life loss in Figure 4 for existing dams and in Figure 5 for new dams and major augmentations of existing dams are considered to have an unacceptable level of risk. As with the ANCOLD individual tolerable risk guideline, risks should be reduced to the limit and then further until ALARP is satisfied. 1.E 03 1.E 03 F, probability of failure per dam/year with expected loss of life N F, probability of failure per dam per year with expected loss of life >N 1.E 04 1.E 05 1.E 06 1.E 07 Risks are tolerable only if they satisfy the ALARP principle Risks are intolerable, save in extraordinary circumstances Limit of tolerability N, number of fatalities due to dam failure F, probability of failure per dam/year with expected loss of life N F, probability of failure per dam per year with expected loss of life 1.E 04 1.E 05 1.E 06 Risks are tolerable only if they satisfy the ALARP principle Risks are intolerable, save in extraordinary circumstances Limit of tolerability 1.E N, number of fatalities due to dam failure Figure 4. ANCOLD (2003) societal risk guideline for existing dams. Figure 5. ANCOLD (2003) societal risk guideline for new dams and major augmentations. c) Reclamation: The average annual or Annualized (incremental) Life Loss [ALL or formerly the Tier 1 guideline in Reclamation (1997)] due to dam failure should be less than lives/year for each loading type [i.e. flood (hydrologic), earthquake (Seismic), normal operating conditions or internal (static)] evaluated separately. Specifically, Reclamation s ALL (Tier 1) Guideline is summarized as follows: 19 The limit is referred to as the limit of tolerability in the ANCOLD (2003) tolerable risk guidelines. The writer considers that the term limit of unacceptability is precise because, for a particular dam, the risk that meets all conditions for tolerable risk (see Subsection on Acceptable vs. Tolerable Risk, above), including ALARP, would not begin until a lower level of risk than this limit and so this limit is the boundary of the unacceptable risk region with the intolerable risk region and not the tolerable risk region, as discussed in the Subsection on Project specific Tolerable Risk, above. 17

18 ALL > 0.01: Strong justification for taking actions to reduce risks for both long term and short term (7 years or less) continued operations. Category A in Figure 6 ALL > 0.001: Strong justification for taking actions to reduce risks under continued long term operations. Category B in Figure 6 ALL < 0.001: Justification for reducing risk decreases (diminishes) evaluate (cost) effectiveness and public trust responsibilities. Category B or C in Figure 6 depending on the APF, which is described in previous subsection. Similar to individual tolerable risk guidelines, the HSE (2001) and ANCOLD (2003) societal tolerable risk guidelines specifically require that risk must be reduced meet ALARP and HSE disproportionality considerations and not to just below the limit guideline itself. Reclamation (2003) does not specifically refer to ALARP, but it does make reference to the strength of justification for risk reduction and to the need to evaluate (cost) effectiveness and public trust responsibilities. The F N chart is a plot of the Annual Probability of Exceedance of Life Loss (F, greater than or equal to) vs. Incremental Loss of Life (N) (see Figure 2) for all failure scenarios for a particular reservoir, which may include more than one dam. Thus, the F N chart displays the entire estimated probability distribution of life loss for a reservoir encompassing all failure mode exposure scenarios. In contrast, ALL (estimated by the product of the probability of occurrence and the life loss, combined over all failure scenarios) represents only the average annual magnitude of life loss and masks the richness of information, including possible high probabilities for some levels of life loss, which is contained in the entire distribution. F N charts are used for societal tolerable risk guidelines in many countries; but to the writer s knowledge Reclamation s ALL approach is not now used by any other organization for dam safety or in other areas. ALARP and Disproportionality Considerations a) HSE: A key principle in achieving tolerable risk under the HSE Guidelines is reducing risks as low as reasonably practicable (ALARP). The justification of risk reduction measures can be approached through the calculation of a Disproportionality Ratio, R, which is a cost/benefit ratio that includes both economic and life safety benefits. It is calculated by subtracting the economic benefits from the annualized costs and placing the (health and) safety benefits considered in the denominator, as follows, with units shown in italics: R = ACSLS/VPF [ ] = [$/year]/ [$/year] in which: ACSLS = (c b E )/ (N b * P b N a * P a ), c > b E = 0, c b E 18

19 [$/life] = [$/year]/ {lives/year] c = Annualized cost of risk reduction measure based on annualizing capital costs using a discount rate and adding annual costs such as economic losses associated with operating restrictions [$/year] b E = Annualized economic benefit of risk reduction measure [$/year] = c Eb c Ea = E b * P b E a * P a [$/year] = [$]*[/year] c Eb = Risk cost before fix [$/year] c Ea = Risk cost after fix [$/year] E e = Economic loss associated with dam failure before fix [$] E a = Economic loss associated with dam failure after fix [$] N b = Number of fatalities before fix [fatalities] N a = Number of fatalities after fix [fatalities] P b = Probability of dam failure before fix [/year] P a = Probability of dam failure after fix [/year] VPF = Value of Preventing a Fatality [$/fatality] = Willingness to pay for life loss risk reduction 20 The Disproportionality Ratio can be evaluated using Figure 7, which is based on the following HSE guidance: Individual risk limit of 1 in 10,000/year Disproportionality Ratio 10 for a probability of life loss of 1 in 10,000/year Disproportionality Ratio 3 for a probability of life loss of 1 in 1,000,000/year Value of Preventing a Fatality (VPF) based on a willingness to pay for risk reduction = 1 M (approximately $2 M) per fatality (2001 prices) The Disproportionality Ratio should be considered along with all other relevant information in making final risk reduction decisions. As indicated in Figure 7, R would not normally be considered in cases where risk reduction is required because the probability of life loss exceeds the individual risk limit of 1 in 10,000/year and therefore existing risks are classified as unacceptable. b) ANCOLD: Tentative ALARP justification guidelines have been proposed by ANCOLD by adapting guidelines proposed by Bowles (2001) in Table 1. They are presented in Tables 2 and 3, which apply to risks just below the ANCOLD limit of tolerability and risks just above the broadly acceptable risk level, where these two probability levels are selected to correspond to the two probabilities at which HSE provide guidance for minimum disproportionality ratios, as described in a) above. 20 HSE (2001) uses about 1M per fatality (2001 prices) adjusted annually. Bowles (2004) has estimated a mid range value for VPF based on values used by several Federal government agencies of about $6 M. 19

20 HSE Tolerability of Risk 20 Dispr opo rtionality Ra tio (R) TOLERABLE RISK OPTION MAY NOT BE JUSTIFIED HSE Disproportionality Ratios INTOLERABLE RISK OPTION IS JUSTIFIED UNACCEPTABLE RISK RISK REDUCTION REQUIRED Individual Risk Limit 1.E 07 1.E 06 1.E E 04 1.E E 02 Pr oba bility of Life Loss before Risk Reduction M ea sure (P b ) (pe r year ) HSE Disproportionality Ratios R = 1.0 HSE Individual Risk Limit Strength of Tolerability Boundary Figure 6. Reclamation (2003) portrayal and categorization of risks 21. Figure 7. HSE disproportionality evaluation (Bowles 2004). Table 2: Tentative guidance on ALARP justification for risks just below the ANCOLD (2003) limit of tolerability. ALARP Justification Range of cost per statistical life saved Rating Greater than or equal to Less than (A$M/life) (US$M/life) a) (A$M/life) (US$M/life) a) Very strong Strong Moderate Poor a) Based on 1 A$ = 0.8 US$. 21 The sloping lines in Figure 6 are for Annualized Life Loss (ALL) in lives/year for Flood (Hydrologic), Earthquake (Seismic), and Normal Operating (Static or Flood Internal) initiating event types. The vertical axis is for Annual Probability of failure (APF). When individual (f,n) points plotted are plotted on Figure 6 it is an example of a discrete probability distribution plot, described in the Subsection on Definition and Presentation of Risk, above; in which case, strictly speaking, the Reclamation guidelines cannot be compared since they apply to risk aggregated over each of the three initiating events types in the case of ALL or aggregated over all types of initiating events in the case of APF. The ALL guidelines are represented by the sloping lines at 0.01 and lives/year, and the APF guideline is represented by the horizontal line at 1 in 10,000/year. However, the lines representing these guidelines can be compared to plotted points when these points represent risks aggregated across each initiating event type for ALL or over all initiating events for APF. There are conceptual problems in using this form of plot to show APF and ALL simultaneously and to the likelihood of different magnitudes of potential life loss. 20