Proceedings from the 6^th ASDSO Annual Conference

October 1-5, 1989

Albuquerque Marriott

Albuquerque, New Mexico

Published by the

Association of State Dam Safety Officials

Introduction

The body of knowledge that emerges from the collective experience of a specialized group of individuals form the structure of a profession...

E.M. Myers

American Society of Association Executives

Information exchange is one of the primary purposes for ASDSO's existance. Our national annual conference has been highly successful in helping to accomplish this goal by bringing dam safety experts together on a formal and informal basis to discuss innovations, federal and state policy, and experiences in dam safety.

This publication compiles the formal presentations made at the ASDSO 6th Annual Conference held on October 1-5, 1989 in Albuquerque, New Mexico. These speakers were chosen by the ASDSO Board of Directors from approximately 150 that submitted proposals for presentation.; the decision regarding which to cut was a difficult one, in most cases, but a very positive sign for the direction and caliber of this conference.

The majority of chosen speakers have submitted full papers for this publication -for those who were unable to do so, an abstract has been included. Biographies for each presenter are listed at the end of the Proceedings -addresses and phone numbers are listed where possible.

ASDSO thanks the New Mexico State Engineer's Office for hosting this event and for the assistance of Don Lopez, Chief of the New Mexico Design and Construction Section and his staff before and during the conference.

EVALUATION FOR A SERIES ON UTAH POWER AND LIGHT HYDROPOWER DAMS, INCLUDING RISK ASSESSMENT: The Owner Perspective

ABSTRACT

Utah Power and Light, Company (UP & L) owns a series of six dams on the Bear River in Utah and Idaho. These dams are regulated by the Federal Energy Regulatory Commission (FERC). Not all the dams currently meet the FERC's standards for flood and earthquake loading. Their internal conditions, however, have been found to meet all important FERC criteria. A dam safety evaluation study was performed to explore the suitability of site specific standards for the UP&L dams and to propose and evaluate alternative remedial actions. The investigation was performed to provide UP&L management with information for use as a basis for their proposals to the FERC for remedial actions at the Bear River dams.

Of our fifteen licensed or exempted dams, we had, in early 1987, four older dams located on one river and three others on separate rivers were questioned for safety reasons by the Federal Energy Regulatory Commission (FERC). All seven had been evaluated under the National Dam Safety Inspection Program as possible sources of significant downstream impact. These dams had also been reviewed by independent consultants, as required periodically by FERC regulations, and found to be deficient under present probable maximum flood (PMF) standards or recently revised maximum credible earthquake stability conditions. These dams had all been considered safe and sound and without significant problems in the past, and our company has always had an active policy of giving very high priority to safety problems of any kind.

We found the problem hard to comprehend or believe. We estimated that all the remedial upgrades involved would cost at least $20 million and possibly as much as $25 million for dams having a total generating capacity of about 128 megawatts. Thus we projected a remedial cost in the range of $155 to $195 per installed kilowatt, a shocking financial impact. This would increase our average cost of generation for these units by three to four mills per kilowatt-hour, no joke in our competitive, over-abundant market. One of the dams, for instance, completed in 1927, had passed a 12,700 cfs flood of record in 1986 Without difficulty; yet the projected probable maximum flood for the dam was 195,000 cfs. In another case, a 1910 dam was in the high hazard classification because of two potentially impacted homes and our inability to obtain PMF flood plain zoning development relief from the local county. In every case the PMF values seemed inordinately excessive, and at the time, FERC did not offer any encouragement when we considered challenging the National Weather Service precipitation model used as a basis for deriving the PMF. Was this safety problem real, or was it of bureaucratic manufacture?

What should we do? We were ready to fight! After we calmed down a bit we took a closer look at our options at each site. At the site with the two houses we noted some other potential problems that had yet to become FERC issues, and we decided that prudent management required us to solve these problems before they became serious. We could combine the corrective work with a planned unit upgrade at the site and keep costs under reasonable control. Another case involved a FERC Exemption for an electrically isolated generating unit installed in a thermal generating station's cooling water storage reservoir. Again the PMF value was extreme, but the dam could marginally contain the flood without overtopping. We decided to vacate the FERC Exemption and perform the minor modifications needed when required by the state involved. In this latter activity FERC was very encouraging and helpful. These decisions still left us with five problems, one involving four facilities on the Bear River in Idaho and Utah and the other involving our Viva Naughton Dam on the Hams Fork River in Wyoming.

After our initial review, we still did not know the extent of the real. problems at these five dams. What was the actual possibility of instability and flood-caused failures at each site? Given the possibility of such failures, what was their probable hazard to the public, their property and to our employees and property? These questions involved issues of existing dam conditions, probability of various failure inducing forces occurring and at what intensities, the risks of failure associated with various levels of the forces, the exposure of people and property should failure occur, and the probable level of damage associated with the exposure. We also thought it only fair that credit be given in our evaluation to the flood control and economic benefits resulting from the existence of these dams. In every case, the dams provided river regulation that had not existed in prior times, and this provided very significant irrigation and flood damage benefits to local communities as well as giving us a saleable product.

Considering, the range of questions involved, we believed that only a wide ranging technical review and risk assessment could effectively and fairly provide the safety exposure, economic impact, and benefit assessment required to -responsibly select a remedial program . The alternative seemed to be to accept the extreme FERC safety criteria without consideration of the level of benefit and the incremental cost impact that would result. This latter "deterministic" approach, called for in FERC's regulations at the time, seemed neither beneficial to the public nor ourselves. We elected the expensive, wide-ranging evaluation program, and its resulting remedial program, in preference to the apparently very expensive, arbitrary, but less controversial deterministic solution.

FERC staff was very uncomfortable with our decision, and they have our sympathy in this regard. We think they visualized the result could be a whitewash of genuine safety problems, inadvertently or intentionally superficial, politically controversial, and not result in a truly balanced evaluation or solution. They seemed particularly concerned that the technical and economic review would have insufficient depth to provide an effective information base and that insufficient information was generally available to make reliable risk judgments. They said such a "risk assessment" would miss too many factors and details, currently handled as intangible factor-of-safety components, and result in a risky model. Even if we did a proper job on the evaluation, we think that FERC was concerned about a possible precedent that would allow later, less well founded work by others to jeopardize industry safety standards. The decision to go ahead with the risk assessment was executed with mixed feelings within our own organization, too.

Given the concerns, we had no choice; the assessment had to be as thorough and complete as we could reasonably make it. We did not have the in-house resources or competence to get the job done; we needed outside professional help from individuals with a proven track record with this activity, and we needed high caliber engineering, economics, and risk evaluation professionals on the job. Since very little in-depth risk evaluation work had been done with specific dams in the past, we also needed an effective model for the study. These needs were complicated by the limited time we had to complete such an extensive study, further emphasizing the need for a highly effective, well coordinated, professional job. It was now early 1988, and FERC wanted to see the results that fall.

Picking a model for the study was easy; the only complete, tried, practical model (USBR ACER Technical Memorandum No. 7) we could find had been developed by Larry Van Thun and his staff at the US Bureau of Reclamation. Near clones have been developed by the US Corps of Engineers and by the Federal Emergency Management Agency for the same purpose but were unavailable to us. The US Bureau of Reclamation approach was well thought out and organized, seemed complete, had been put together by people with practical experience in answer to needs very similar to ours. Also, its procedures had been used for several dam safety evaluations by them and in at least two other cases that we were aware of by consulting engineers. Its methodology was recommended for existing dams by the American Society of Civil Engineers. ACER-TM-7 didn't answer all our needs or questions, but it provided a sound methodology and organization for our risk assessment.

Picking a study team was more difficult. The law required us to competitively bid the work if possible, and very limited sources existed with the combination of skills and direct dam application experience needed. We also need a team having local professional background, if possible. There was no avoiding the site-specific nature of dam risk assessments, and we did not have the time for a team to get thoroughly acquainted with five dams' local settings as well as their individual designs and construction. We needed a cross-disciplinary team capable of effectively performing incremental flood routing studies, precipitation probability evaluations, seismic evaluations, local economic and property appraisals, dam design and construction stability estimates, risk exposure and impact probability analyses, population and crop surveys, public infrastructure reviews, and so on. We also needed a team that had an existing, thorough database of dam failure information that could be correlated with the specifics of each of our dams and their settings. The team participating in this panel's presentation along with a consulting economist UP&L and outside hydrologists, several of our operating, people, and both company and consultant property managers constituted the core of our study team.

The dams in the study consist of the Viva Naughton Dam in southwestern Wyoming; the Soda, Grace, and Oneida Dams in Southeastern, Idaho, and the Cutler Dam in North Central Utah. The Viva Naughton Dam is located on the upper reaches of a Green River tributary (Colorado River drainage), the Hams Fork River. It is about 15 miles northwest of Kemmerer in a gentle, sparsely populated rangeland valley. The Soda, Grace, Oneida, and Cutler Dams are located (in the order given) on the Bear River between Bear Lake and the Great Salt Lake. Bear River is one of the first controlled rivers in the United States. UP & L regulates its flow by diverting water to and from Bear Lake which is located between Idaho and Utah and very near Wyoming.

Viva Naughton is a 90-foot high embankment dam with a 3,500 foot long crest. It was constructed in the early 1960's and raised in 1967. The elevation of the reservoir's normal high water level is 7,240 feet msl; the top of its core is at elevation 7,245 feet, and its crest is 3 feet above the top of the core. At normal high water, the reservoir stores 42,400 acre feet of water, which is largely dedicated to UP & L's Naughton power plant cooling tower consumption. In practice and on an informal basis, a major portion of the stored water is used for local municipal consumption and irrigation. The dam has a draw gated spillway capable of releasing 7,860 cfs at normal pool level and an emergency spillway blocked with a rip-rapped plug. The maximum runoff release on record is 2,500 cfs (1984), and the National Weather Service model PMF peak inflow is predicted to be 45,850 cfs. The local municipal water system has a small condemned dam and reservoir immediately downstream of Viva Naughton; this year, the dam is being repaired after years of disuse. Downstream, the river passes through the small adjacent communities of Frontier, Kemmerer, and Diamondville; otherwise, the river passes through open country. A PMF event would overtop and presumably fail this downstream dam.

Soda Dam, also known as Soda Point Dam, was built in 1924, is 488 feet wide, raises 103 feet above the stream bed, and consists of a 210 feet wide gravity section with a 5,7275 foot crest elevation on the right end, a 109 foot wide center powerhouse section. a three bay 114 foot wide concrete spillway section with a crest elevation of 5,707.5 feet, and a 55 foot wide earth embankment "plug" on the left end which has a crest at elevation 5,730 feet. Galleries exist 'in each of the concrete sections and extend 'into the embankment portion. The reservoir, with a 5,720 foot maximum normal pool elevation, can store 14,875 acre-feet of water of which 11,800 is usable by the power plant. In 1911, the dam location's record of 4,740 cfs occurred, and the dam's National Weather Service model projected that the PMF inflow is 74,600 cfs. The spillway consists of three 30 foot wide by 12.5 foot tainter gate sections is capable of passing a projected total of 63,000 cfs. The top of the embankment is essentially the same elevation as -its rock abutment; a similar situation exists between the gravity section and its right abutment. The dam is located on the left side of a wide agricultural valley at a point where the river makes a left turn from west to south at the western end of a high, steep rock hill. It is located approximately 5 miles downstream and west of Soda Springs and about 6 miles upstream and north of Grace Dam and the town of Grace. A PMF event would overtop this dam and breach the embankment plug. The gravity sections fail to meet present FERC earthquake stability criteria.

Grace Dam, located on the northern outskirts of Grace, Idaho, was built in 1951 to replace a 1910 structure. It is a rock filled, timber crib structure and is 180 feet wide by 52 feet high with a crest elevation of 5,556.4 feet. It is an integral part of a new 250 foot extension of the old dam's 127 feet wide embankment, located on the crib section's right, which has a crest elevation of 5,559.0 feet. The dam serves as a diversion structure to supply water to the Grace and Cove hydroelectric plants, located several Miles to the southwest. The associated flowline intakes are located in the old embankment section. The dam has a discharge capacity of 14,3 ) 15 cfs and a projected PMF inflow similar, to that of Soda. The spillway is a three bay flashboard scheme, sectionalized by 6 foot thick timber crib piers; it has a crest elevation of 5,547.3 feet. Both the dam and the town are located in a very wide, flat valley. A PMF event would overtop and fail this dam.

Oneida Dam, built in 191.5, is located in a deep, narrow valley 13.5 miles northeast of Preston, Idaho and roughly 30 miles south of Soda Point. Except for the dam and power plant, the valley is undeveloped grazing and forest land. The dam consists of two portions which are separated by a knoll. The concrete gravity section the right end of the multistructure, is 110 feet high, 455 feet wide, and contains a 5-section tainter gated, controlled spillway which is 79 feet wide (crest, 4,870.65 feet) on its left end and an uncontrolled 176 foot wide spillway (crest, 4,88O.9 feet) on its right end. Its center, non-overflow portion (crest elevation, 4,884.9 feet) contains two low level outlets, the inlets of which are blocked by reservoir sediment (sediment has reached elevation 4,823 feet). The spillways have a combined capacity of 16,000 cfs with the pool level at the gravity section crest and 40,800 cfs at the embankment section crest. The projected PMF inflow is 74,000 cfs; the outflow record of 5,480 cfs occurred in 1922. The concrete dam does not satisfy present FERC stability criteria and was post tension anchored in the past to satisfy prior stability criteria.

Oneida's embankment section is about 1,100 feet wide and has a maximum height of 40 feet. The freeboard at a normal high water elevation of 4,882.9 feet is 9 feet, placing the crest at elevation 4,891.9 feet. The powerhouse is located about 2,000 feet from the two penstock intakes which are located in the embankment section about one third of the way from the left abutment. The embankment would be overtopped by a PMF event.

Cutler Dam, built in 1927, is located in a gorge about 13 miles northwest of Logan, Utah in the mountains separating Cache and Great Salt Lake Valleys northeast of the lake. It is a concrete gravity arch 545 feet wide and 112 feet high with an irrigation canal intake structure in each abutment and a center four-section tainter gated spillway section. The dam is 70 feet thick at its base and 7 feet thick at the top. The tainter gates are each 14 feet high and 30 feet wide; they can pass 34,000 cfs with the pool at the dam crest. The postulated PMF inflow is 195,000 cfs and the outflow of record was 12,700 cfs in 1986. The condition of the concrete in the piers restraining the tainter gate trunnion blocks was questioned at the time of the study and has since been determined to be poor. It is doubtful that the dam would fail because of either a PMF or an MCE event, but the dam would be overtopped by a PMF and the irrigation canals built into the hillsides below the dam would probably be seriously damaged.

DAM SAFETY EVALUATION FOR A SERIES OF UTAH POWER AND LIGHT HYDROPOWER DAMS, INCLUDING RISK ASSESSMENT Work Plan, Project Description, Remedial Action

ABSTRACT

The study comprised an incremental consequence assessment and a risk assessment. The concepts and procedures for each are summarized. Each dam was evaluated considering its potential for complete or partial failure due to floods, earthquakes, internal causes, or upstream dam failure. The evaluation considered various human safety, economic and environmental factors. In this paper, the location, type and condition of each dam, various human safety factors, and economic and environmental factors are briefly presented. Also, potential failure modes and alternative remedial actions are discussed.

A dam safety evaluation of Utah Power and Light Company (UP&L) facilities on the Bear River was performed to evaluate the appropriateness of applying FERC maximum standards of Probable Maximum Flood (PMF) and Maximum Credible Earthquake (MCE) in assessing the safety of the dams. Previous FERC Part 12D studies of the facilities, performed by Harza Engineering Company, have judged the facilities to meet FERC criteria regarding protection against internally- induced failure modes, but the studies also identified the inability of the dams to meet the FERC's PMF flood loading and MCE earthquake loading-standards.

In the incremental consequence assessment, the flood water levels that would occur for a range of postulated cases of dam failure were projected and compared to the case that would have occurred if no dam existed. Flood, earthquake, and internal failure modes were considered, and the analysis was performed over a full range of loading conditions. In developing the hydrologic and earthquake loading events, the 1983 Bear River Basin Study and several inspection and safety reports by Harza Engineering Company were used so that the basis for the study was consistent with the basis for the Harza FERC Subpart 12D studies. Any increases in economic damages or life loss, exceeding the no dam case, were attributed to existence of the dam. These increases were projected for floods

Caused by general storms and by local thunderstorms, with flows ranging up to the PMF for each storm type. Earthquake-caused dam failure was also considered. However, incremental consequence assessment cannot be applied to consideration of internally-caused dam failure.

A quantitative risk assessment of an existing dam aids in identifying which factors (e.g., initiating events, failure modes, and exposure factors) or ranges of factors, contribute most to the total risk associated with dam failure. By considering the interaction of initiating events, failure modes, system responses, and resulting consequences, risk assessment provides a framework for evaluation of safety criteria appropriate to a specific dam. This approach can lead to identification of an option (remedial action alternative) that is most promising or cost effective for achieving risk reduction.

The scope of this study was such that two risk assessments were performed. A preliminary risk assessment--based upon preliminary estimates of loads, loading probabilities, system responses, extent of inundation, and consequences--was performed to identify the relative importance, sensitivities, and uncertainties associated with each dam and each initiating event. The preliminary risk assessment identified the ranges of loads appropriate for evaluating remedial action alternatives and focused the efforts of the final risk assessment to give greater emphasis to work tasks that are more significant, more sensitive, or more uncertain.

PROJECT DESCRIPTION

The UP&L Bear River facilities included in this study are:

Site specific conditions of the dam-foundation-spillway system of each facility were examined. Pertinent data on existing, conditions were obtained through site visits, review of historical design and construction data, and subsequent, field and laboratory investigations. The site conditions that were studied included surface and subsurface conditions at each dam site, hydrologic data for the entire Bear River Basin, and earthquake data for the Intermountain Seismic Belt.

After gathering and interpreting, the necessary data, a broad range of dam response scenarios that could be caused by the range of loading, conditions identified as likely to be imposed on the dam and its appurtenances was postulated. Mechanisms which traditionally have led to dam failures, such as foundation and embankment instabilities due to oversteepended slopes, inadequate filter and drainage protection, overtopping. Erosion, piping, excessive pore pressures, spillway failures, excessive uplift, undermining, adverse operating characteristics, material deterioration and inadequate energy dissipation, were considered. Generally accepted structural analyses of the concrete dams were also performed. Each postulated dam response was evaluated for the probability of that response occurring. System response relationships were developed for each dam as described in the following paper.

Consequence assessments that considered human safety, economic, and environmental factors for each of the postulated system responses were performed. The human safety assessment was performed to characterize the conditions which threaten life in the floodplain and to help in making decisions about modifying the risk of possible human life loss. This assessment involved: (1) identifying the population at risk, (2) evaluating warning time and factors which affect responses to a warning, (3) developing the exposure probability of the population at risk, and (4) estimating the possible resultant loss of life. The purpose of the economic damage assessment was to evaluate whether protection of a dam above its existing level was economically justified. The economic damages were categorized as related to failure of a dam and non-failure related so as to define appropriate benefits hereby balancing, benefits and costs related to modifying a risk condition through an investment. The environmental damage assessment was performed to define the impacts associated with the existing facilities under the various possible system response scenarios.

There are potential hydrologic failure modes for both the concrete dam and the earth embankment. Over-stress of the concrete dam was considered as the possible system response associated with the earthquake event at Soda Point Dam. Failure of the concrete dam was postulated to result in total failure oil the dam, and failure of the earth embankment was postulated to result in partial failure of the dam.

Several structural and non-structural alternative remedial actions were considered for the Soda Point Dam site. They were: (1) no action, (2) decommission the dam, (3) anchor the concrete portion of the dam to allow overtopping and raise the embankment dam on the left abutment to prevent overtopping, and (4) construct a dike at the town of Grace, Idaho to reduce flood inundation. Conceptual designs and construction cost estimates were prepared for each of these alternatives.

The 52-foot high Grace Dam is a timber crib structure, which serves a 33,000 kW power plant through a 5.5 mile penstock. It has a spillway capacity of about 14,000 cubic feet per second. The March 1983 probable maximum flood study for Grace Reservoir gave a peak inflow of 63,700 cubic feet per second. Grace Dam was built in 1910 and modified in 1951. The only potential failure mode postulated for Grace Dam was overtopping of the embankment caused by hydrologic loading. Earthquake-related failure was not considered as a possible failure initiating event due to its very remote probability of occurrence.

Three alternative remedial actions were considered for Grace Dam. These included: (1) no action, (2) decommission the dam, and (3) protect the earth embankment portion of the dam to allow overtopping. Conceptual designs and construction cost estimates were prepared for each of these alternatives.

The Oneida Dam built shortly after 1910, is a concrete gravity structure, 110-feet high, that has discharged an all-time high flow of 5,480 cubic feet per second. An earth embankment dam (separated from the main dam by a ridge) closes off a low saddle to the left of the main dam. The total spillway capacity is about 12,000 cubic feet per second. The March 1983 probable maximum flood study for the Oneida Reservoir gave a peak inflow of 74,700 cubic feet per second. The hydropower generating station has a capacity of 29,000 kW. There are potential hydrologic failure modes for both the concrete dam and the earth embankment. Overstress failure of the concrete dam and slope instability of the embankment were considered as possible system responses associated with the earthquake events. Failure of the concrete dam was postulated to result in total failure of the dam, and failure of the earth embankment was postulated to range from partial failure to total failure of the dam.

Several structural and non-structural alternative remedial actions were considered for the Oneida dam site. They were: (1) no action, (2) decommission the dam, (3) anchor the main concrete dam to allow overtopping and raise the embankment dam to prevent overtopping, (4) install a flood warning system, and (5) restrict recreation on the reservoir and below the dam. Conceptual designs and construction cost estimates were prepared for the first four of these alternatives. The fifth alternative was eliminated from consideration due to its conflict with FERC objectives of multiple use of water resources.

The 112-foot high Cutler Dam is a concrete gravity arch structure that was built in the late 1920's. The hydropower generating station has a capacity of 30.000 kW. Spillway capacity is 22,000 cubic feet per second. The March 1983 probable maximum flood study for the Cutler Reservoir gave a peak inflow of approximately 195,500 cubic feet per second. Cutler has historically spilled a peak flow of 12,600 cubic feet per second without causing significant flooding or damages in the downstream river valley.

Several structural and non-structural alternative remedial actions were considered for Cutler Dam. They were: (1) do nothing, (2) decommission the dam, (3) modify the canal intakes at both abutments to prevent overtopping, (4) raise the dam to accommodate the PMF event, (5) strengthen the spillway tainter gates to withstand the MCE event, (6) relocate houses downstream of the dam, and (7) install a flood warning system. Conceptual designs and construction cost estimates were prepared for each of these alternatives.

DAM SAFETY EVALUATION FOR A SERIES OF UTAH POWER AND LIGHT HYDROPOWER DAMS, INCLUDING RISK ASSESSMENT: Seismic and Hydrologic Considerations, System Responses and Potential for Serial Failure

ABSTRACT

A good risk assessment model must consider the potential for dam failure from all reasonably probable loading events. The most important events for a single dam can be categorized as hydrologic, seismic, and static. A variety of other rare events such as sabotage and meteorite impact could also be considered but generally are not. When are dams in series on a river, it is necessary to consider the loading caused by the failure of an upstream dam. It is also necessary to consider failure from a full range of loading conditions, not just the extreme events. It is possible, even probable, that the greatest risk in terms of both economic damages and loss of life could be due to a loading condition that is much less than the "maximum" event because the lower event has a much higher probability of occurring. The risk model must explicitly consider all reasonably probable failure modes resulting from the various initiating events. Consideration must be given to joint occurrence of the failure modes in making the risk assessment. To facilitate cost-effective risk reduction/safety improvements the model must identify which factors contribute most to the total risk of failure.

This is paper will focus on the response to seismic and hydrologic loading events for Utah Power and Lights (UP&Ls) four dams in series (Soda Point, Grace, Oneida and Cutler dams) on, the Bear River in Utah and Idaho. Other aspects of the risk assessment procedure for the Bear River project are discussed in the four comparison papers included in this technical session.

HYDROLOGIC LOADING

Hydrologic loading on a dam is due to the hydrostatic and dynamics forces acting on the reservoir/spillway/dam system during routing of the flood represented by the inflow hydrograph associated with the hydrologic event being considered.

In the probabilistic hydrologic hazard analysis, flood events were divided into general storm-caused flood events and thunder-storm-caused events because for the Bear River watershed, these events are considered to be statistically independent since they result from distinctly different types of meteorological and hydrological conditions. Floods caused by general storms in the Bear basin usually occur in late spring and early summer with storms over a large portion of the watershed combined with snowmelt. Floods caused by thunderstorms occur in summer months with intense isolated storms over a relatively, small area immediately upstream from the reservoir--there is no snowmelt runoff.

Flood frequency curves for both general storm and thunderstorm floods were established. Probable Maximum Food (PMF) hydrographs for the general storm and the thunderstorm were taken from earlier hydrologic and PMF studies performed by others. Flood frequency curves were established for both general storm and thunderstorm floods, using available flood records at selected USGS stations on the river, up to the 100-year return period. Risk-based analyses conducted in this study require the establishment of discharge-probability relationships for the entire range of flood events, from no flow over the spillway up through the PMF. Due to the lack of definite knowledge about the probability of PMF occurrence, the methodology suggested by the NRC and presented in USBR ACER Technical Memo No. 7 (1986) was followed to assign a probability of occurrence for flood events with a return period beyond one in one hundred years. The NRC method requires the construction of frequency curves in two phases. The first portion of the curve, up to a 100-year flood event, was derived as a straight-line extension of the confidence limit curves on log normal probability paper. Further, straight-line extensions were made from the 5 and 95-percent confidence limit curves at the 100-year event to the PMF level at arbitrarily assigned exceedance probabilities of 10^-6 and 10^-4 per year. The theoretical (median) frequency curve lies between the 95-percent confidence limit curves and is assigned an exceedance probability of 10^-5 per year for the PMF.

Ten different hydrologic loading ranges were used to cover a wide range of flood peaks from no flow over the spillway up to the PMF (194,500 cfs for the general storm at Cutler Dam). The system response of each dam and the resulting consequences were established for each loading range. Flood frequency curves were used to determine the event probability for each flood loading range of each dam. The annual probability of occurrence of each selected flood event (which was representative of a flood range) was read from these frequency curves and entered into the risk model. Inflow hydrographs associated with each selected flood event were developed for breach analyses and flood routing computations. The inflow hydrographs for floods other than the PMF were obtained by prorating them to either the general storm or thunderstorm PMF hydrograph.

EARTHQUAKE LOADING

Earthquake loadings on dams and their appurtenances result from earthquake-induced ground accelerations in the foundation materials at the site. Both the ground acceleration produced by the earthquakes and the duration of the strong ground shaking influence the response of a dam to earthquake loading. The acceleration of the earthquake motion is a function of the magnitude of the earthquake and the distance from the causative fault to the site. Duration of strong ground shaking is a function of the magnitude of the earthquake. Therefore, both magnitude and the distance from each site to possible causative faults must be considered in establishing the earthquake loading conditions.

Unlike the deterministic analysis of dams, the risk assessment procedure requires analysis of dams under a full range of loading conditions. Therefore, the event probability for earthquake loading must be described as an annual frequency of exceedance versus peak acceleration from earthquakes in a given magnitude occurrence.

The study area is bisected by the Intermountain Seismic Belt. The occurrence of earthquakes in the study area is common and has been documented since 1950. The Seismic Zone Map of the United States, contained in the Uniform Building Code, classifies the study area as Zone 3. Algermissen, et al. (1982) developed probabilistic estimates of maximum acceleration in rock in the contiguous United States. The maps represent contours of maximum acceleration with a 10 percent probability of being exceeded in 10-year, 50-year and 250-year exposure periods. The dams of concern on the Bear River are near the contour representing a 10% probability of exceeding an acceleration of 0.2 g in 50 years.

The seismic hazard in the region is strongly related to the presence of the 370-km long Wasatch Fault zone which extends from Gunnison, Utah on the south to Malad City, Idaho on the north. The Wasatch Fault zone is an active westward-dipping, normal fault. Geologic evidence indicates that it is active; it has had many large magnitude earthquakes during the last 10,000 years. Recent geologic studies of the Wasatch Fault suggest that the fault is segmented with at least ten identifiable segments, Machete et al. (1986). In general, each segment is capable of earthquakes with maximum magnitudes ranging from 6 1/2 to 7-1/2. Other specific faults were also considered. It is likely that there are many faults in the region that are capable of generating small to moderate earthquakes that would not rupture the ground surface. Generally, earthquakes that do not rupture the ground surface have magnitudes less than about 6 to 6-1/2. A background seismicity was used to represent these faults; it was assumed that the spatial distribution of these small to moderate earthquakes, would be uniform. The historic record was used to establish the annual frequency of exceeding given levels of acceleration.

Up to ten different earthquake loading ranges were established for each dam site from 0g up to the acceleration corresponding to the maximum credible earthquake. The maximum acceleration ranged from 0.45 g at Soda Point, Grace, and Oneida dams to 0.66 g at Cutler dam..

SYSTEM RESPONSE ANALYSIS

To estimate the probability of failure for a given dam, it is necessary to predict the response of the dam under a full range of loading conditions for each failure mode identified in the risk model. To accomplish this, it is necessary to examine the configurations, characteristics, and site-specific conditions of the dam-foundation-spillway system and to perform static and dynamic analyses of the dam. Probability of failure for each of the Bear River dams was evaluated for hydrologic, and earthquake initiating events.

As each response was settled on, the team estimated the probability of that response occurring. Probabilistic analysis methods are not well established for evaluating the response of dams to hydrologic, static, or earthquake loads; therefore, to establish the response probability curves, it was necessary to use professional judgement, deterministic analysis, and a knowledge of the past performance of dams under similar loading conditions. The general procedure for evaluating the probability of failure by a given failure mode under a range of loading conditions consists of: (1) establishing a threshold loading condition below which the probability of failure is considered to be zero, (2) establishing, an upper bound loading condition above which the probability of failure is estimated to be one, (3) estimating the probability of failure for the maximum credible loading at the site, and (4) using the bounds set in 1, 2, and 3 to develop a system response curve for each possible system response.

Since a given loading condition may be capable of inducing failure by more than one system response, probability response curves were developed to account for the joint occurrence system responses that could lead to failure. Probability response curves were developed for each loading event using the procedure by Anderson and Bowles (1987).

The hydrologic system response curve for Oneida Dam is shown on Figure 1. Note that there are two possible system response (failure modes): (1) overtopping the concrete dam, and (2) overtopping, the embankment dam. Figure 1 illustrates that once the embankment dam is overtopped, embankment dam failure would quickly become the dominant failure mode even though the concrete dam would be overtopped well before the embankment dam. Similar hydrologic system response curves were developed for each dam on the Bear River. Earthquake system response curves were also developed for each dam. These curves related probabilities of failure to maximum acceleration.

Flood events considered in the study cover the entire range of floods, up through the PMF, and included the threshold floods. Three types of initiating events at each dam were considered in the dam failure scenario. These events were: hydrologic, earthquake and internal failure.

For each flood event, the inflow hydrograph was routed through each reservoir and the downstream river reaches to the next reservoir located downstream on the Bear River, under the with and without dam failure assumptions and with the dam under existing structural condition (no rehabilitation or structural improvement). For non-flood events, only sunny day dam failure routings were performed. All flood routing computations were performed using the National Weather Service DASMBRK model.

The same flood routing computations were necessary for every proposed rehabilitation alternative considered for each dam. This information was essential for the damage assessment associated with each loading event and each proposed improvement.

Flood routings for the natural flow (assuming no dam in place) scenario were also performed. This is the base condition in the establishment of incremental flooding in the river reaches.

For Serial Dam Failure

When dams are located in series, an upstream dam can be both a threat and a means of protection to a downstream dam. Typically, at lower flows associated with a regional or local runoff event, an upstream dam will safely pass floods with some attenuation that will thereby reduce the magnitude of the flood imposed on downstream dams. However, at higher flows, the possibility of failure of the upstream dam may exist, and that would usually lead to outflows that are higher than either natural or no-failure flows under the same runoff conditions. Thus, inflows to downstream dams will be increased and the likelihood of their failure may also increase.

The four dams involved in the study on the Bear River are located in series. The event tree incorporating serial failure for initiating events at Soda Point Dam (the most upstream dam) is shown on figure 2. A similar event tree was developed for Oneida Dam. Serial failure initiating at Grace Dam was not considered because the impacts of all its failure modes are small and are completely contained in the Oneida Reservoir. Cutler Dam is the most downstream dam on the Bear River system and therefore would not initiate a serial failure.

The Hydrologic and non-flood loading events which were identified for individual dams were repeated in the serial dam failure analyses. The increase in reservoir water surface elevation of a dam due to the incoming flood from the failure of the upstream dam constitutes an additional loading condition for that dam. System response curves for different loadings were developed for each dam. The system response of the dam subjected to an upstream failure loading was evaluated by first routing the breach flow from the upstream dam failure into the reservoir under consideration. The system response then depended on the increase in the elevation of the reservoir. Downstream consequences were then evaluated depending on the system response.

Results of Serial Dam Failure

System routing analyses for the serial dam failure scenarios reveal the following, results:

1. General storm PMF at Soda Point Dam may cause Oneida Dam to fail and overtopping of Cutler Dam, even if the Soda Dam does not fail.

2. Thunderstorm PMF at Soda Point Dam would cause failure of Oneida Dam only if failure of Soda Point Dam is caused by overstress of the concrete dam. However, failure of Oneida Dam under this condition may not cause overtopping of Cutler Dam.

3. Sunny day failure (seismic or internal initiating event) at Soda Point Dam would not cause failure of Oneida or Cutler Dams.

4. General storm PMF initiating at Oneida reservoir would cause failure of the Oneida Dam and consequent overtopping of Cutler Dam.

5. Thunderstorm PMF initiating at Oneida reservoir would cause failure of the dam but may not cause overtopping of Cutler Dam.

6. Sunny day failure of Oneida Dam would not cause overtopping of Cutler Dam.

DAM SAFETY EVALUATION FOR A SERIES OF UTAH POWER AND LIGHT HYDROPOWER DAMS, INCLUDING RISK ASSESSMENT: Results

ABSTRACT

Safety evaluation results will be presented in three categories: based upon the applicable FERC guidelines, the incremental consequence assessment, and the risk assessment. Incremental consequence assessment results for floods and earthquakes show the potential for increased life loss, economic damages, or environmental damages as the result of dam failure scenarios. The risk assessment adds the perspective of the likelihood of each failure scenario occurring. Risk assessment results will be presented for floods, earthquakes, and internal failure-modes as risk of incremental life-loss, cost of improving human safety, probability of breach or partial failure, benefit-cost ratio for remedial action alternatives, and total annual cost (risk cost, plus remedial action cost) for each alternative.

Findings for the Bear River study are reported in (ECI and RAC, 1989.). In the next section of this paper risk acceptable criteria are discussed to provide a context for the interpretation of results from both an incremental consequence assessment and a risk assessment. Results for the Soda Point dam are summarized to illustrate the types of information provided by both the incremental consequence assessment and the risk assessment. These findings were used by dam owner (UP&L) and were also provided to the regulator (FERC) for use in the selection of remedial actions for the Bear River dams.

RISK ACCEPTANCE CRITERIA

For hydrologic loading, various criteria have been proposed to define a site specific, base safety condition. If an incremental consequence assessment (which is recognized in the FERC guidelines), is performed, the following criteria are commonly used as yardsticks against which downstream consequences are measured and evaluated:

• No significant incremental threat to life as a result of dam failure. "Incremental threat to-life" is defined as the difference between threat-to-life for failure and natural flow cases for inflow rates from the failure threshold up through the PMF; and "significant" can be defined as one or more lives expected to be lost as the result of a hydrologically-induced dam failure.

• Insignificant incremental economic damages. "Incremental damages" are defined as the difference between damages for failure and natural flow cases at each inflow rate from the failure threshold up through the PMF and insignificant can be defined by the ability of the dam owner to compensate for damages and the split of damages between the dam owner and others.

  These criteria can be applied for hydrologic and earthquake loading, but not for the internal static failure modes. Incremental consequence assessments cannot be meaningfully applied to internally initiated events since a failure threshold cannot be defined.

  Although incremental consequence assessment does solve the issue of properly differentiating between naturally and artificially induced damages, it provides no information on the chances that such events will happen. To add this perspective, a risk assessment was performed for the UP&L Bear River dams. Additional criteria are needed for defining a hydrologic base safety condition using risk assessment. The following criteria may be used:

• Acceptably small risk (probability) of incremental-life -loss to dam failure. Where "acceptability" can be defined either by comparison with other dams, or the failure of other types of civil works.

• Acceptably large cost-to-save-a-life for proposed remedial action. Where "acceptability" can be defined by comparison with investments made in protecting public safety in other areas such as environmental regulations.

• Acceptably small probability of dam failure. Where "acceptability" can be defined--either by comparison with historical dam failure rates, or historical failure rates of other types of civil works.

• Acceptable benefit-cost ratio or rate of return on investment in proposed remedial action. "Acceptability" is evaluated in terms of standards established by the dam owner for investments; benefits are defined as the reduction in risk costs estimated to be achievable by implementation of the remedial action alternative; and costs are those associated with providing, maintaining, and operating the alternative.

• Remedial alternatives with their capacity selected using the minimum total cost, criterion. Total cost is defined as the sum of total annual risk costs and annualized costs associated with providing, maintaining, and operating the alternative. Also, one of the remedial alternatives considered is the existing dam without modification.

  Some of these criteria address economic risk acceptance considerations. Each criterion may lead to the definition of a different base safety condition. Therefore, in this study, each dam was evaluated according to all appropriate criteria so that alternative base safety conditions could be compared. A dam owner does not have to use any single risk acceptance criteria and may introduce additional factors in his decision making process.

SUMMARY OF FINDINGS - SODA POINT DAM

Soda Point Dam is a concrete gravity structure, 103 feet high with a small embankment section at the left abutment. The dam does not meet the FERC PMF standard or the FERC maximum credible earthquake standard, but it does meet FERC criteria for the internal condition of the dam. The dam is the most upstream of the UP&L dams on the Bear River.

Failure of the existing Soda Dam is not expected to result in additional life-loss above that projected due to the effects of a natural flood without the dam in place. Therefore, upgrading of the dam to safely pass the PMF (by installing anchors in the concrete dam and raising the embankment on the left side) is not projected to reduce hazard of life-loss.

For an earthquake-caused failure of Soda Point Dam, life loss is predicted to be about five lives at the UP&L hydropower facilities at Soda Point and Grace. Upgrading the dam to withstand the maximum credible earthquake could be achieved by adding anchors to the concrete dam which would reduce predicted life-loss to zero.

Increases in economic damages due to dam failure vary with the flow rate at which dam failure is postulated. The maximum increases projected for the existing Soda Point Dam for a general storm flood is estimated to be $9 million, but only $2.2 million of these losses would be to non- UP&L parties. For thunderstorm floods, the maximum increase is projected to be about the same as for a general storm flood. In both cases, damages at Grace Hydro Facility and in Grace City are included. These levels of damages, while not small, (according to UP&L representatives) are within insurance coverages that UP&L carries.

Failure damages for earthquake failure of Soda Point Dam are projected to be up to $8.8 million with non-UP&L losses being only $0.5 million.

No chance of incremental or increased life loss is projected due to flood-caused failure of Soda Point Dam when compared with the case of no dam.

It is predicted that if an earthquake or internal failure were to occur, about five lives may be lost. The chance of an earthquake failure occurring is estimated to be 1 in 43,500 per year and 1 in 18,500 for an internal failure. These are much less likely than 1 in 5,000 per year, the historical probability of life-loss from dam failures in the United States due to all causes (i.e., flood, earthquake and internal failures). The existing, Soda Point Dam has, however, been found to satisfy FERC criteria with respect to its internal condition.

The cost of increasing human safety can be expressed on a "per statistical life saved" basis (i.e. cost-to-save-a-life. This is the cost of providing safety and not in any sense a value for human life. Since no life loss could be attributed to the Soda Point Dam under flood loading, it follows that upgrading of the dam would not be predicted to save any lives. Therefore, the cost-to-save-a- life for remedial upgrading of the flood performance of the dam is infinitely large.

The cost-to-save-a-life for installing anchors in the concrete section of the Soda Point Dam, so that it could withstand the maximum credible earthquake, is calculated to be approximately $1.9 billion per life saved.

A dam break/flood warning system was considered for reducing the hazard to human life in the event of an earthquake or internal failure of Soda Point Dam. It was calculated that cost-to-save-a-life for this system would be approximately $240 million per life saved. However, this system would not be expected to reduce life loss at the Soda Point Hydro Facility itself. If the Soda Point Dam were decommissioned, the cost-to-save-a-life was calculated to be approximately $3 billion per life saved.

These costs can be compared with costs-to-save-a-life calculated for regulated areas such as nuclear power plant design ($4 - $10 million), environmental protection ($4 million) and occupational health and safety ($4.5 million and $300 million for OSHA Benzene regulations).

The chance of a breach failure of Soda Point Dam from floods, earthquakes, and internal causes, is estimated to be 1 in 11,000 per year. This is approximately equal to the historical probability of dam failure in the United States due to all causes.

Economic benefits are predicted to be less than one percent of the estimated costs for installing anchors in the concrete dam and raising the embankment on the left side of Soda Point Dam. No structural alternatives were considered for internal failure modes since the Soda Point Dam has been found to meet FERC standards for these cases.

The sums of the predicted annualized damages (risk costs) and estimated annualized costs are: $238,000 for installing anchors in the concrete dam and raising the embankment on the left side; $3,300 for the do-nothing alternative i.e., maintain the existing dam; and $362,000 for abandoning the facility. Thus, the existing dam alternative was found to have the lowest total annual cost of these three alternatives.

A reconnaissance-level environmental evaluation of dam failure impacts was performed. For flood-caused failure scenarios, the additional area of environmental impact was predicted to be small when compared to the natural flooding case. The probability of dam breach impacts occurring was found to be approximately 1 in 11,000 per year.

CONCLUSIONS

The results summarized in this paper illustrate the types of information which can be provided by incremental consequence and risk assessment studies. This information has proven very useful to dam owner and operations and others who are responsible for making dam safety decisions. Other uses of information obtainable from these approaches include the assessment of liability exposure for dam owners and operators, the choice of interim measures for improving safety at dams which are awaiting permanent fixes, the efficient allocation of effort for dam safety studies, the sequencing of remedial actions at a group of dams which cannot be budgeted or scheduled to be performed simultaneously, and the provision of a basis for insurance coverage of dam .

The Bear River study showed that estimated dam failure probabilities were low. Predicted incremental damages were low, and in most cases damages would affect the owner to a far greater extent than other parties. The probability of life-loss was estimated to be low, and the cost-to- save-a-life was calculated to be high for all structural and nonstructural alternatives. No economic justification for alternative fixes could be shown. However, safety and social factors should also be considered in the decision-making, process. Evaluation of potential serial failure modes did not show large increases in failure probabilities from this type of initiating event. In the case of Grace Dam, a decrease in failure probability can be attributed to the protection provided by the upstream Oneida Dam.

As with other studies with which the authors have been associated, the use of incremental consequence assessment and risk assessment were shown to be valuable tools for providing inputs to the decision-making process. The approach to risk assessment used in the Bear River study did not involve placing a value on human life, nor did it involve using a specific decision criterion, such as minimum total annual cost. The selection of remedial actions was made by the dam owner and regulator using study results and other considerations.

DAM SAFETY EVALUATION FOR A SERIES OF UTAH POWER AND LIGHT HYDROPOWER DAMS, INCLUDING RISK ASSESSMENT: Owner Perspectives on the Role of the Evaluation in the Selection of Remedial Measures

ABSTRACT

In this paper, the dam owner will describe the role of dam safety evaluation results in selection of remedial measures which were proposed to, and accepted by, the FERC. For the dam owners, this paper will address the value of insights gained from this type of detailed dam safety evaluation study. The importance of understanding the hydrologic seismic, structural, safety, economic, social-environmental, and risk aspects of a dam safety decision will be illustrated through the discussion of the UP&L decision-making process.

Including the internal utility costs the risk assessment study for the five-dam cost close to $500,000. What did we get for our money besides FERC's discomfort? First and foremost, we developed an in-depth understanding of these dams' potential for failure, and we internally justified the necessary remedial activities. Without this thorough review, we would probably have had bad feelings about any of the work for a considerable time to come, and we may have otherwise sought very costly legal remedies. Second, the study developed alternatives that would probably have been missed or bypassed without this penetrating scrutiny. Based on our initial estimates and contingency plans, we feel the study came very close to saving us $IO million in current remedial costs, about 40% to 50% of the money we had anticipated spending. Third, we feel that FERC was better able to appreciate, the benefit of avoiding some of the work we would have otherwise done, and we were better able to appreciate some of their concerns. For instance, during the study it became rapidly evident that the failure of the plug section at Soda and failure of the dam at Grace would be beneficial during a PMF event. Forth, some of the work, such as the, incremental flood studies would have been needed in any case, and they were a material portion of the study cost, perhaps 20% of the total.

Procedurally, did the study go as anticipated? No, not entirely. Personally, if we had it to do again, I would insist on physical evaluation of the facilities condition being given greater emphasis. In the interest of both time and cost, information generated in prior FERC Subpart 12D independent inspections was relied upon heavily to evaluate the dams' physical condition. Subsequent developments, such as the condition of the Cutler tainter gate piers, have emphasized the need to obtain more physical evidence during a risk assessment. If you don't examine existing conditions closely, you will probably learn your lesson later.

The other lesson we have since learned is to be sure that flood routing studies are based on as good a model of the real channel geometry as possible. In several cases, we now believe, projected PMF flood routing consequences could have been shown to be less significant if flow obstructions had been modeled more effectively. For instance, it recently has been determined that sudden failure of the tainter gates at Cutler would produce a peak flow well within the same magnitude as we could expect from projected gate capacity and roughly equal to our outflow of record. Don't short change development of the details in a risk assessment

We had a good team that was determined to do a proper job of a complex, difficult study. On the whole, it was very well worth the effort.