See discussions, stats, and author profiles for this publication at: https://www.researchgate.

net/publication/240488954

Risk of dam failure in benefit-cost analysis

Article  in  Water Resources Research · June 1980

DOI: 10.1029/WR016i003p00449

CITATIONS READS

67 1,326

3 authors, including:

Gregory Baecher Richard de Neufville

University of Maryland, College Park Massachusetts Institute of Technology
131 PUBLICATIONS   4,175 CITATIONS    212 PUBLICATIONS   5,381 CITATIONS   

SEE PROFILE SEE PROFILE

Some of the authors of this publication are also working on these related projects:

Operational risk of dams and reservoirs View project

romanas ascila View project

All content following this page was uploaded by Gregory Baecher on 25 January 2017.

The user has requested enhancement of the downloaded file.

 WATER RESOURCES RESEARCH, VOL. 16, NO. 3, PAGES 449-456, JUNE 1980

Risk of Dam Failure in Benefit-CostAnalysis

GREGORY B. BAECHER, M. ELISABETH PATE, AND RICHARD DE NEUFVILLE

Department
of CivilEngineering,
Massachusetts
Instituteof Technology,
Cambridge,
Massachusetts
02139

A procedureis presentedfor calculatingthe costsof failure of a dam and for incorporatingtheserisk

costsinto the evaluationprocess.Basically,it involvesa calculationof expectedvalue. One criticalissue
is what the probabilityof failure shouldbe;giventhat researchwill not provideaccuratevaluesfor some
time,a defaultvalue(of 10-4 per damyear)is proposed
to be useduntil betterinformationbecomes
available.Anothercriticalquestionis whetherthe refinementof incorporatingrisk costsis worthwhile;
here,the risk-benefitfactora is introducedto be usedasa screening tool to decidethe question.The im-
portanceof implicit value ascribedto lives lost throughfailure is discussed.

INTRODUCTION to developa reasonableestimatefor currentpractice.The pa-

The adoptionof water resources projectshasbeenbasedfor per concludeswith some remarks on the prospectsfor the
severaldecadeson the notion of expectedbenefitsexceeding adoption of this or any method for incorporatingthe risk of
costs.Yet one potential costof building dams,the possibility dam failure in benefit-costanalysis.
of failure, has been conspicuouslyleft aside in these calcu-
RISK AS EXPECTATION
lations.The implicit assumptionwould seemto be that 'well-
built damsdon't fail.' Experiencehasprovedotherwise.Dams There is a long history of attemptsto combineprobability
that were thought to be 'well built,' suchas Teton Dam in the and consequenceinto a scalar measureof risk. There is like-
United States,have failed. The wisdom of sitting large dams wise a long history of disagreementover how to do so. The
abovepopulatedareas,the caseof Auburn Dam, for example, oldest and still most common way of combining probability
must therefore be questioned.It is time to recognizethat the and consequenceis through their product, the expectation.
risk of dam failures is a real costand should be incorporated However, at least since Bernoulli there has been recognition
in benefit-costanalysis. that individuals do not value uncertain propositionsby ex-
This paper presentsa procedurefor incorporatingthe risk pectation.Low-probability,high-consequence risksare not in-
of catastrophicfailure in project evaluation. This cost rests terchangeable with those of high probability, low con-
both on the probability of failure and the magnitudeof associ- sequence.Typically, individuals willingly pay a premium to
ated consequences. As arguedin detail subsequently, expected avoid high-variancerisks.
value of consequences is proposedas the measureof risk for A number of pragmaticruleshave been introducedto treat
failure of dams, in the United States at least. risk in public decisions[see,e.g., Dorfman, 1962;Rose, 1978].
__

Quantificationof the risk of failure is itself a crucialpart of One group of thesederivesfrom parallelsin private financial
the argument.The issuehere is the determinationof the prob- marketsand includesrisk discounting, shortenedpaybackpe-
ability of failure of individual dams,a questionwhich the en- riods, and similar criteria. The central argument againstthe
gineeringprofessionhas traditionally chosento avoid. On the use of thesecriteria is that public and private decisionsare
basis of the extensive but inconclusive data available the an- fundamentally different. Benefits and costs accruing from
nual probability of failure of a dam is assumedto be 10-4, publicprojectsdo not haveprivatemarkets,eventhoughthey
which appearsto be a reasonabledefault value, pending the are numerated in dollars. Furthermore, the risk behavior of
results of further research. investorsin private moneymarketsdoesnot necessarilyreflect
Discussionof potential failuresinevitably raisesthe issueof socialpreferencetoward risk. A secondgroup of methodshas
human safety and the value of life. The approachhere is to arisenby ad hoc adoption.This includesoverestimationof de-
maintain life and dollar accountsseparately.This permitsthe terministic costsor neglect of some benefits, mean-variance
calculation of comparativemeasuresof human risk incurred indifferencecurves,and similar techniques.The major argu-
for financial benefit, for example,cost-per-life-savedor bene- ment againstthesecriteriais that they lack theoreticaljustifi-
fit-per-life-exposed,which would be comparedto safetystan- cation.
dards applied to other activities in the public sector [Patd, A rather rich mathematicalstructurehas developedaround
1978].It also has the distinctadvantageof avoiding the quag- utility theory,which presentsa deductivephilosophyfor risky
mire of attempting to estimate dollar values for statistical decisions.In essence, utility theoryis basedon an assumption
lives. that expectationis an appropriate criterion for decisionbut
The paper deals first with the question of why it seems that expectationswould be taken over some function of the
proper, in this case, to deal with risks as expectation.From consequencewhich reflects'attitudes toward risk.' So, while
this base it presentsa method for calculating the expected utility theory offersa rational procedure,it transfersthe bur-
value of dam failures and discusses its use in benefit-cost anal- den of decisionto the assessment of utility functions.For an
ysis.Since the algorithm requiresan assessment of the proba- individual this assessment may be straightforward,but for so-
bility of failure, the paper then turns to this issue.It looks first ciety as a whole it is not.
at the different concepts of failure in engineering design, In a well-knownpaper,Arrow and Lind [1970]have argued
which must be understood in order to follow the debate about that risk-indifferenceand the consequentuse of expectations
the pr(•bability of f•ailure.It then reviewsthe data on failures are appropriatefor evaluatingpublic projectsinsofar as risks
are both shared by a large number of people and divided
('.,,pyright a) 1980 by the American Geophysical Union. among a large number of independentprojects.The essence
!'apcr number 9W 1720. 449
{)½)4• I •97/8½)/½)½)9W-172(}$01.½)(}
450 BAECHER ETAL.: RISK OF DAM FAILURE IN BENEFIT-COST ANALYSIS

of the argument is that, in this situation, the effectsof risk materials, materials in process and completed products, of
aversionare negligible.The reasonis that sinceboth people cleanup, loss of roads, sewers,bridges, powers and so forth.
and projectsare independent,the variancesassociatedwith
the risk can in both casesbe combined linearly so that the co- In the caseof dam failure, it seemsappropriateto divide the
efficientsof variation reducein inverseproportionto the num- floodplaininto two zoneswith differentdamageand casualty
ber of personsand projects.When both numbersare large,the ratios:zone 1, the 'ground zero' zone in the direct path of the
variation and risk aversion approximate zero. wave, where near total damagecan be assumed(damageD!)
In the United States, at least, the risks of dam failure are in and zone 2, the zone flooded by rising waters,where the dam-
fact sharedsomewhatequally acrosssociety.Federal disaster age to buildingsis lessseriousand for which a lower damage
relief programsand other forms of insurancetend to distrib- ratio must be established(damageD2). By definitionthe total
ute economicrisk acrossbroader sectorsof societythan only directdamageD is the sumof D• and D2. To the directcapital
thoseliving downstreamof federal dams. lossesmust be added emergency costsEM. As stated in the
The assumptionthat we are dealing with a large number of proceduresof the Corps of Engineers[ U.$. Departmentof the
projects,whoseprobabilitiesof failure are mutually independ- Army, 1975], emergencycosts
ent and whose individual failure would only produce mar-
ginal changesto the national economyas a whole, is also ... will include additional expensesresulting from a flood that
valid, not only for the United Statesbut for many other na- would not otherwisebe incurred, such as evacuation,reoccupa-
tions as well. Indeed, while it is possible to construct tion, flood fighting, disasterrelief, increasedexpensesof opera-
tions during the flood, increasedcostsof police, fire or military
doomsdayscenariosin which dams fail simultaneously,expe- patrol, and abnormal depreciation. Emergency costsshould be
rience indicatesthat for all practical purposesthey occur indi- determinedby a specificsurveyor researchand may not be esti-
vidually and independently.As regardsthe magnitude of the mated by applying arbitrary percentagesto the physicaldamage
estimates.
event, even the failure of a large urban dam would produce
consequenceswithin the magnitude of those suffered with
someregularity due to natural disasters. The direct loss of economic activity is the loss of output
For economic evaluations of dam failure risk, simple ex- from all sectorsof production of goodsand servicesthat can-
pectationthereforeseemsa justifiable criterion, at least in the not be producedbecauseof the unavailability of capital or la-
United States. Federal policy and failure scenariosare such bor due to flooding.These lossesmust be evaluatedat the cur-
that consequences produce only marginal economiceffects. rent market price. No attempt is made here to projectpricesof
More subtle criteria for incorporating risk suffer difficulties of the correspondinggoodsand services.Let AXi be the quantity
implementationwithout providing important increasesin ra- of output lost becauseof the unavailability of either capital or
tionalization. labor in the ith economic sector reached by the flood. If the
correspondingoutput cannot be produced elsewherein the
EXPECTED VALUE OF FAILURE
country, it is a lossto the nation. If it can be produced else-
The failure of dams, as for natural catastrophes,is followed where becausethe economydoesnot operate at its full capac-
by an economic loss that goes beyond immediate property ity, it is a lossto the region but not to the nation and resultsin
damageand lossof life. There is lossof economicactivity, fol- an interregional transfer of payments. The primary net eco-
lowed by decreasedproduction in other sectorsand possibly nomic loss to the nation is then
in other regions. Future benefits of the dam that were to be
derived are lost.
œ,
Each of these components of the cost of failure must be
evaluated for each year of the design life. One solution is to
wherej is the index of the economicsectorswhoseproduction
assumea constant rate of growth, possibly different for each
is not immediately replaceable.
componentor possiblyequal to a generalrate of regionaleco- If an economic sector inside or outside the flooded area is
nomic or population growth. Clearly, however,the procedure
not able to supplyto or receivefrom economicsectorsdirectly
for estimatingfuture benefitsand the procedurefor estimating
hit, this first sectorsuffersa lossof production. This is a sec-
potential future lossesshould be congruent.
ondary economiclossE2. The secondaryeconomiclossoccurs
Once a dam is built, its capital is irreversibly committed to
only if there is no possiblesubstitution,for example, if the
the production of future benefits and is valuable to society
possiblesourcesof supplyinsidethe nation already operateat
only to the extent that it is able to provide thosebenefits.The
their full capacity.The input-outputtable of the Department
value of a dam, the cost of losing the structureif it breaks, is
of Commerce gives a description of the intersectoral ex-
therefore the stream of foregone future benefits. It is not the
changesand thereforean estimateof secondaryeconomicloss
cost of replacement of the structure:rebuilding a new dam at in the no-substitution cases. The total economic loss E is the
the sameplace (which is seldomdone) is a new project with its
sum of the primary and secondarylossesE, + E2.
own costs and benefits. This view is consistent with the 'with
From the time the dam breaks, future benefits are lost. The
and without' method adopted by the U.S. Water Resources
value of that streamof benefitsdependson the year at which
Council.
the dam breaks t* and on the expectedbenefitsfor each year
Direct lossesat the moment of failure depend on the occu-
later on B(t) and up to the designlife of the dam T. As noted
pancy of the floodplain immediately downstreamand on the
earlier, this is equivalent to the 'value of the dam' itself. The
rapidity of release.They include, as defined by the Corps of
presentvalue of the lossof benefits,given that the dam breaks
Engineers[U.S. Departmentof the Army, 1975] in computing in year t*, is, where R is the social rate of discount,
flood damage,
... damage to or loss of buildings or parts thereof, lossof con- •. B(t)
tents including furnishings,equipment, decorations,stockof raw L(t*)= ,•.(1'• •)' (2)
 BAECHER ET AL.: RISK OF DAM FAILURE IN BENEFIT-COST ANALYSIS 451

If the annual benefitsfor eachyear of the designlife of the $5 billion has a risk-benefit factor of 10% with the failure rate
dam are assumedto be constantand equal to b, of 10-4, which we recommend. For this second case. consid-
eration of the risk costsshouldbe an important part of the
=b(1(1
+R)r-"+'-
1• evaluation.
L(t*) +R)TM
- (1+R) (3)
Or, if annualbenefits,aswell asthe costs,are assumed
to grow 'BenefitMinus Risk' to CostRatio
at a constantannual rate G, starting from the initial benefit
Using the classicalformula to computethe B/C ratio, the
B(0), the presentvalue of the lossof benefitsis introduction of the risk cost in the B/C ratio means the addi-
tion of a random variable Cr to the denominator. The ex-
L(t*)=B(0)(1+
(1G)"(I
+R)TM
+ R)TM - (1++R)
(1+ G)(1 G)
rTM (4) pectedvalue of the ratio, differentfrom the ratio of expected
values,is not directlycomputablefrom the resultsgiven by
If a dam fails at year t* -- 0, the total economiclossCr(0) is the procedure above. But a significant ratio is the 'benefit
thus minusrisk' to costratio, sincethe costsof failure (risk costs)
can be expressedas an annual decreaseof expectedbenefit
CF(O)= D(O) + E(O) + EM(O) + L(O) (5)
and the net result compared to the initial cost. The net bene-
By extensionthe presentvalue of the costof failure at year t* fit-costratio is thus a randomvariableequal to (B - CF)/C,
is and its expectedvalue on the whole of the designlife of the
damis (B - Cr)/C.
The introduction of the cost of failure in the benefit-cost
Cf(t*)
----[D(0)
+E(0)
+EM(0)]+R)t.+L(t*) (6) analysisthus reducesthe initial B/C ratio into the net B/C ra-
Note that the quantity L(t*) varieswith the expectedyearsof tio by the a factor. Subtractingthe annual expectedvalue of
benefitsremainingrather than with the yearspassed.The risk lossesfrom the annual benefitrather than addingit to the ini-
componentof the dam over it designlife C'Fis thusthe ex- tial costreflectsthe dynamicsof the process(discountingand
pected present value of the total cost of failure. This is ob- potential growth) and providesa ratio which is easyto com-
pute and interpret.
tained by multiplyingthe probabilityof failure for eachyear
by the presentvalue of the costof failure for that year:
Lossof Life
r PF(t*)CF(t*)
t*----0 (7) If the benefit-cost
analysisincludesthe potentialcostof
failure,theglobalresults
areasfollows.At a totalcostC + Cr,
The value of the probability of failure is, of course,a central societyderives from the existenceof the dam a total benefit B
questionand is discussedsubsequently. but alsoacceptsfor eachyearan expectednumberof fatalities
RISK IN BENEFIT-COST ANALYSIS •'(t).Theconstruction
costs
canbespread overthelifeof the
Risk Factor dam,sothatthenetexpected benefitof B(t) - C(t) - (•F(t)is
associatedwith F(t) in year t.
An important issue is When does the introduction of risk As Rose[1978]pointedout,potentiallossof life is likelyto
costsin the benefit-costanalysisreversethe decisionto autho- be a critical issue in the final decision. This inevitable situa-
rize or not to authorizea given dam? tionmeansthatfor a projectthatisaccepted,
lifeis implicitly
For a given year a useful conceptis that of the annual eco- set at a value that is lower than the ratio:
nomic risk-benefit factor, exclusiveof constructioncosts,
B(t)- Cc(t)- (•v(t)
a(t)= CF(t)
B(t) (8) 'life
value'
< P(t) (9)
andtotalrisk-benefit
factora = (•F/B.The lattergivesan idea The issuecannot be avoided [Buehler,1976].
of the proportionof expectedbenefitseliminated by the risk Onesolutionis to makedecisionsthat areconsistent
among
societytakes to obtain them. the various agenciesof the government.In the United States,
The total risk-benefitfactorcan serveas a screeningtool to figures between $200,000 and $1 million are considered ac-
identify when the risk costsneed to be incorporatedinto the ceptablefor decisions in the transportationsectorfor example.
evaluation.It providesa measureof the importanceof these If the life value characteristicof a dam (the fight-handsideof
costs,and when the roughpreliminaryestimatesindicatethat (9)) is way beyond the acceptablerange,the decisionis clear:
it is sufficientlysmall, we may reasonablydecideto neglect below it, the dam should not be constructed;above it, the
the risk costs and save ourselves some effort. project is acceptableprovidedthat the corresponding maxi-
For illustration, assumea large dam with a construction mal probabilityof death per year is alsoacceptable.Between
cost of $500 million, an annual initial benefit of $50 million, thosetwo figures,the questionmight be addressedby com-
and a designlife of 50 years.If the costsof failure are on the parisonto otherpublicdecisions. •
order of $2 billion, the risk-benefitfactor, with a probability Another constraintof the decisionis the implicit assump-
of failureof 10-4, is lessthanonehalf of 1%.This mightbe tionthat a maximalprobabilityof deathof 10-4 multipliedby
less than the margin of error in estimatesof benefits them- the projectednumberof casualtieson the path of the wave is
selves. acceptableto the personsliving on the groundzero zone. Both
On the other hand, a smaller urban area dam with an initial constraints,minimal benefitper life exposedand maximal ac-
cost of $50 million, an annual initial benefit of $5 million, and ceptableprobabilityof death for the most exposedindivid-
again a 50-yeardesignlife but with potentialcostsof failure of uals,have to be satisfiedto make the projectacceptable.
452 BAECHER ETAL.: RISK OF DAM FAILURE IN BENEFIT-COST ANALYSIS

TABLE 1. Failure Rates of Dams in the United States and Worldwide

Total Period, Rate

Area Reference Failures Dams* years (damyear)-•
United States Gruner [ 1963, 1967] 33 1764 40 5 X 10-4
Babb and Mermel [1968]
post-1940 dams 12 3100 14 3 x 10-4
USeOLD [1975] 74 4914 23 7 X l0 -4
U.S. Bureau of Reclamation
[Mark and Stuart-Alexander, 1 4500•- 2x l0 -4
World 1977] 125 7500 40 4x l0 -4
Middlebrooks[ 1953]
[Mark et al., 1977] 9 7833 6 2 x l0 -4
Japan Takase[1967] 1046 2 x 106 15 4x 10-5
Spain Gruner [ 1967] 150 1620 145 6x l0 -4

*Approximate.
•-Dam years.

DESIGNERS' CONCEPTS OF FAILURE
The designersof dams, civil engineers,in particular, have
different conceptsof failure. These suffuseand becloudall dis-
cussionof the probabilitiesof failure of a dam. To develop a
firm understandingof what these probabilitiesmight be, it is
thereforealso necessaryto understandthe divergentconcepts
of failure that pervade the profession.
The community responsiblefor analysis,design, and con-
structionof dams appearsdivided on two philosophicalissues.
The first division is between those who view the engineer's
role as guaranteeingsafety and thosewho view the role as bal-
ancing risk. The second is between those who consider dam
designan engineeringsciencelimited only by time and fund-
ing and those who considerdam designan art, limited abso-
lutely. Individual opinionson theseissuesare probablynot in-
dependent.
The civil engineeringprofessionhas traditionally viewed it-
self as responsiblefor guaranteeingsafety. Large civil works
must be designedso that they will not fail. This is a societal
duty many civil engineersimplicitly accept. In fulfilling this
responsibility,designersof dams often incur very high ex-
penditures in design and constructionto protect structures
from unknown conditions, for example, by requiring exten-
sive foundation grouting. The pervasivenessof this view in
civil engineering is apparent by comparing the low risk of
death due to failures of civil works with the much higher risk
of deaths due to other engineering activities,such as automo-
tive transportationor industrial accidents[Buehler,1976; Wig-
gins, 1972].
The assuranceof safety is related to the perception that
dams can be scientificallydesignedor that uncertaintiescan
be mitigated by conservativepractices.The only limitation to
z
•usCOLD
975)
MIDDLEBROOKS
dam safety is inadequate time or funding. Thorough site in-
vestigationand analysiscan lead to total assuranceof safety;
safety is not only necessarybut attainable.
The above view contrasts with the observation that dams do .
fail. Extensiveanalysisand conservativedesignmay lessenthe
chance of failure but do not totally remove it. This view is ar-
gued by Gruner [1963], Biswas and Chatterjee [1971], Chat-
terjee and Biswas[1971], Benjamin [1973], Vanmarcke[1974],
Buehler [1976], Mark and Stuart-Alexander [1977], and Rose
[1978], among others. The conclusionof this alternative view
is that risk of failure must be balancedagainstcostsof reduc-
ing the risk. In making decisionsamong alternative projects,
risk of failure is a legitimate attribute of comparison.
The conceptthat safety cannot be assuredrestsalso on con-
ceptsof the nature of uncertainty underlying dam design.In
particular, much of dam design dependson judgement, and
thus "scientific"conclusionson safety cannot be obtained. As
noted by the U.S. General AccountingOffice (GAO) [1978],
two distincttypes of uncertainty affect dam safety:that due to
recurrent events and that due to "one-time" events.
Probabilitiesof recurrenteventsare predictedby analyzing
historical frequencies.Even though the length of record may
be shortand the measurementssubjectto error, statisticalcon-
clusionscan be drawn. Processesunderlying recurrentevents
like rainfall-runoff and seismicityare complex,but the histori-
cal record can usually be assumedstatisticallyhomogeneous
and thus amenable to analysis. Although exact future time
streams of recurrent events cannot be predicted, statistical
measurescan be. Current practice in hydrology and seismic
risk incorporatesstatisticaltechniquesto estimate recurrence
intervals and exceedance probabilities for natural events.
From these analyses, annual risks can be calculated. Such
techniqueshave been usedby the Corpsof Engineers,the Bu-
reau of Reclamation, and other agencies.
Uncertainties associated with one-time events are ex-
pressionsof lack of information. Engineeringpropertiesof
foundation materials, peculiar mechanismsof failure, and
similar events are not innately random. Rather they are
poorly estimatedor misunderstood.This uncertaintyreflects
the confidence in the estimation or understanding. These
sourcesof uncertainty are necessarilysubjective, and there-
fore estimates of their probability can legitimately differ

•(1953)
,oo
,oo
amongindividuals.To saytheseuncertaintiesare subjectiveis
not to dismissthem or to suggestthey may not be analyzed.
They constitutea substantialfraction of the total uncertainty
in the predictionof dam performance,and if risksof failure
are to be treated analytically (as opposedto extrapolatedfrom
Fig. 1. Percent of dams that have failed, by decadeof construction. historicalfrequencies),they must be accountedfor. Although
 BAECHER ET AL.' RISK OF DAM FAILURE 1N BENEFIT-COST ANALYSIS 453

4O

o •o

T TT TTT TT T T T TgTT T

YEARSAFTERCOMPLETION 0 I0 20 30 40
YEARS AFTER COMPLETION
Fig. 2a. Number of dam failuresper year [USCOLD, 1975].
Fig. 2c. Numberof damaccidents
peryear[USCOLD, 1975].
subjective
opinionquantifiedasprobabilityis not in common
usein dam engineering,it hasbeenrecentlyusedin estimat- which releasedmost or all of the impounded waters and other
ingseismichazardsassociatedwithAuburnDam [Woodward- 'failures' which did not. Here, failure is taken to mean those
ClydeConsultants,
1977]and is discussed
in the literature. incidents resulting in loss of retention of the reservoir or of
suchseveritythat the dam is rendereduselesseven though the
PROBABILITIES OF DAM FAILURE
reservoir is retained. Consistentwith the definition given by
Probabilitiescan only be estimatedin three ways: by ex- the U.S. Conferenceon Large Dams [1975], an accident is
trapolationof historicalfrequencies,
by extensionof natural taken to mean an incident of lessseveritythan a failure, as de-
laws,or by quantificationof humanjudgement.One of these fined above, or of failure during construction.In somelists it
or some combination of them must be used to evaluate the is difficult to distinguishbetweenfailures and accidents.
probabilityof failureof a specificdam. Mechanisms of failure, difficult to establish even with de-
tailed postfailureinformation [e.g., IndependentPanel to Re-
Historical Basisfor Failure Rates
view Causeof Teton Darn Failure, 1976], are garbled and im-
Severalsurveysof dam failures and accidentshave been precise in the surveys.Categorizationof failure mode is
compiled[Middlebrooks,1953; Takase, 1967; Gruner, 1967; possibleonly in very broad groupingsand cannotbe usedto
Babb and Merrnel, 1968;U.S. Conferenceon Large Dams (US- infer relative probabilities.
COLD), 1975].Althoughnoneof theseclaimscompleteness, Given the inadequaciesof the historicalrecord,precisecon-
they representthe best availableinformation.Most surveys clusionsare not possible.Nevertheless,the recordis extensive
include failures dating to the late nineteenth century, but and allows aggregaterates and trends to be identified. Re-
early listingstend to be incompleteand to concernstructures ported numbersof failuresare shownin Table 1. For those
whichmay or may not havebenefitedfrom engineereddesign. surveysregisteringboth failed and unfailed damsthe failure
Informationon recentfailures(post-1940)is of betterquality, rate has been taken as the ratio of failed to total number. For
usuallyincludingengineering backgroundand servicehistory. thoselistsregisteringonly failed damsan estimateof the total
Nevertheless,failures of small dams are often still poorly number of dams has been taken from other sources. This in-
documented. troduces some error because the geographic coveragesfor
Interpretationof failurelistingsis difficultbecausethe qual- failed and total numbersmay differ and becausesomefailures
ity of data is mixedand the classof damsrepresented is not may not be listed.
homogeneous. The damsvary in level of engineeringdesign, Given the developmentand gradualimprovementof ratio-
maintenance,operationalcontrol,and otherfactors.This lim- nal dam design,failure rateswould be expectedto vary con-
its precisestatisticalanalysisof the data. Furthermore,the siderablywith year of construction,and this seemsto be re-
sourceof most listings of failure is publishedinformation flectedin the surveys(Figure 1). Dams of recentvintage have
rather than first-hand investigation.Published accountsare lower failure rates than earlier dams, even after correction for
often incomplete and sometimesspeculative.Finally, care their lessertime of exposure.
must be taken to distinguishbetween catastrophicfailures Agesof damsat failureareshownin Figure2. Abouthalf
of all failuresoccurduringthe first 5 yearsafter completion,
and the remainingseemto be distributed uniformlyoverthe
20-
ageof the dam.A similartrendseems
to existfor accidents.
This two-stagedistributionis asexpected,sincemanyserious
problems
cometo lighton firstfilling.Correction
for thebias
introduced
by differingtimesof exposure
doesnot changethe
conclusion(Figure 3).
To adjust the historicalrecord for changesin the tech-
nologyof damdesignandconstruction,
failuresof damsbuilt
in the United States after 1940 were analyzed separately.
These are shown in Table 2, as compiled from Babb and Mer-
rnel[1968]and USCOLD [1•975].
(Noticein Table2 that three
of the failures,at Whitewater Brook Upper, SheepCreek, and
IO :;>o 50 40 Wheatland I, occurredafter publicationof the Babb and Mer-
YEARS AFTER COMPLETION
mel report.) These listingswere crosscheckedto the extent
Fig.2b. Numberof damfailuresperyear[BabbandMermel,1968]. possible
amongsurveysto eliminateall but thoseappearingto
454 BAECHER ETAL.: RISK OF DAM FAILURE IN BENEFIT-COST ANALYSIS

ance may lead to events and types of physical behavior that

are even more difficult to analyze than aggregateperform-
ance, and (3) even for thosemechanismscommonlyanalyzed
by engineers,most presentmodels are deterministic.To date
no comprehensiveattempt at analytical assessmentof the
probability of failure for particular dams has been made.
Even if such analyseswere possible,becauseboth the mod-
eling and the assignmentof probabilitiesare necessarilysub-
I I I I jective, the resultsmight not be repeatable.
o Io 2o $o 40 õo
Perhapsthe most severelimitation of analytical approaches
YEARS AFTER COMPLETiON,OR OF EXPOSURE
is due to the fact that most failures of constructed facilities oc-
Fig. 3a. Size of population of dams exposedto failure. cur in waysthat cannot be analyzed.Recent studiesof the his-
torical occurrence of structural failures seem to indicate that
be total failures. Twelve such failures were identified out of possiblyas few as 10%are attributableto mechanisms
within
approximately 3200 dams built in the United Statesbetween the scopeof either present or prospectivemethodsof engi-
1940 and 1972 [USCOLD, 1975].Taking half of 32 years as neeringanalysis[Flint et al., 1976].Most failuresoccurdue to
the averageexposureperiod yields an annual failure rate of 2 accident, inadequate constructioncontrol, or poorly under-
X l0 -4 per dam year. This estimateis somewhatlower than stood physicalprocesses.There is every reasonto think this
thoseof Table 1 but within the sameorder of magnitude.Al- situationalso appliesto dams. Therefore any analytically de-
though the number of post-1940 failures is small, it is suf- rived probabilityof failure is only likely to be a lower bound.
ficient to allow a precise statisticalestimate. Analytical predictionsof probabilitiesof dam failure lead-
When a dam faild,mostdirectevidenceof the mechanism ing to more accurateestimatesthan that obtainedfrom the
of failure is destroyed.Thus only broad groupingsare possible historical record do not seempossibleat present.Fundamen-
in categorizinghistoricalfrequencies,as in Table 3, and even tally, analytical proceduressufferfrom requiring explicitiden-
these are suspect.The destructionof direct evidenceby the tification of failure mechanisms,which cannot be completely
failure itself and the summarizingof failuresin the literature enumerated. Analytical predictions also suffer by the in-
may lead to categorizationof particular failures as simple adequacyof engineeringscienceto explainfully all aspectsof
overtoppingor internal erosion(piping), when in fact these dam behavior. While future development may broaden the
are only the final result of other mechanisms.As reported, applicability of reliability modeling of dams, and while cer-
failures seemto divide into three groupsof about equal fre- tain naturally recurring hazards can be analyzed, overall re-
quency:overtoppingor spillwayinadequacy,piping or seep- liance on analytical proceduresto obtain probabilitiesof fail-
age,and otherslidesand miscellaneous causes(poorconstruc- ure seemspremature, at best, and may actually be logically
tion, earthquake effects, excessive deformation, etc.). impossible.
Decrepitude,inadequatemaintenance,and poor operational
FAILURE PROBABILITIES IN ECONOMIC ANALYSIS
procedures seemto accountfor few failuresof damsof moder-
ate to large size. On the basisof the above discussionthe probability of fail-
While categorizationof failure modesis not usedhere to in- ure of a specificdam is difficult or impossibleto assesspre-
fer probabilities,comparisonof Figure2 and Table 3 indicates cisely,given the presentlevel of engineeringscience.Never-
a fundamental separation between one-time events, such as theless,this probability may not be negligible in its effect on
weak or erodable foundation materials, and recurrent events the associatedcost of risk entering a benefit-costanalysis.
suchas high runoff and earthquakes.The former would seem The suggested procedureis to adopta consistent estimateof
to occurearly in the life of the dam, the latter over the entire probability basedon the historicalrecordand to apply this to
operationallife. As a roughfirst approximation,eachof these all damsunlessuniqueand identifiableconditionsapply. This
types of uncertaintyaccountsfor about half of all failures. base probability is here called the default value, that is, the
The GAO [U.S. GovernmentAccountingOffice, 1978] also value to be used until better estimatesof the probability of
draws a distinctionbetweenthesetwo types of uncertainty. failure can be made.
While the explicit conceptof the default value is novel for
AnalyticalMethods water resources,it is helpful to recognizethat default values
Engineeringanalysisis decompositional.It proceedsby are now implicitly used routinely in the evaluationof dams.
separatingthe engineeringdesigninto mechanisms of failure, Indeed, neglectingthe costof failures is equivalentto assum-
analyzingor estimatingeachcomponentof the failure mecha-
nismsin isolation, and recombiningthe componentsaccord-
ing to basicphysicalprinciplesand naturallaws.Thus any an-
alytical approach to estimating probabilities of failure
requiresfull enumerationof failure mechanisms,complete
identificationof natural events,processes, or propertiesaffect-
ing thosefailure mechanisms, and detailedspecification of the
engineeringrelationshipswithin and amongmechanisms. All
engineeringanalysis,includingsafetyanalysis,is deductive.
Given a set of assumptions,conclusionsfollow necessarily.
The difficulties of analytically estimating probabilities of 0 i0
,TTTTTTTTYY
TTTTT
20
I l lilT
30 40 50
YEARS AFTER COMPLETION
dam failure are that (1) dams can fail throughan essentially
infinite number of mechanisms or modes which cannot be Fig. 3b. Frequency of dam failure by year (data from USCOLD
fully enumerated,(2) detaileddecomposition
of dam perform- [1975]).
 BAECHER ET AL.: RISK OF DAM FAILURE IN BENEFIT-COST ANALYSIS 455

TABLE 2. Combined USCOLD [1975]-Babb and Mermel [1968] Listings of Failures of Post-1940
Dams

Babb and
Construction USCOLD Merrnel Height,
Name Date [ 1975] [ 1968] feet Owner or Use
Whitewater Brook Upper 1943 x (1972) 62 municipal
Little Deer Creek 1962 x x 85 Utah State Water
and Power Board
Baldwin Hills 1951 262 Los Angeleswater
supply
SheepCreek 1969 x (1970) 60 recreation
WesleyE. Seale 1958 x x 114 water supply
district
Watershead 16 1960 x 55 flood control
Watershead 3 1962 x 69 flood control
Fred Burr 1947 x 53 unknown
Stockton Creek 1949 x x 95 public utility
Wheatland I 1960 x (1969) 45 irrigation project
Eklutna 1951 x 26 flood control
Frenchman Creek 1952 x 40 Montana State

ing that the probability of failure is zero. So the immediate is- As discussed
above,the empiricalfrequencyof failure is not
sue is not whether or not to use a default value, but whether constant over the life of a dam. About half of all failures occur
we should use a value of zero, which is both wrong and un- during the first 5 yearsduring what might be interpretedas
conservative,or some finite value, which is at least approxi- first filling. The otherhalf seemsto occurrandomlyover the
mately right. remaininglife of the dam. Assuminga designlife of 100years
More broadly, the possiblechoicesfor the probability of and the averageprobabilityof failure of 10-4 per dam year
failure of a dam spanthe spectrumfrom zero, the current im- yieldsa totalprobabilityof failureof 10-2. It seemsreason-
plicit choice,through some averagevalue, perhapsmodified able, basedon the empiricaldata, to assumethat this is dis-
for specialcases,to a distributionbasedon argumentsof the tributedasshownin Figure4: half of the failuresoccurin the
characteristics of the site and the dam itself. The latter is the first 5 years,half uniformlydistributedover the remaining
most complete and attractive possibilityif we could attain it. life.
For the moment, however, it must be an ideal toward which If uniquely hazardousconditionsapply to a site (for ex-
we can only strive. The professionis therefore now con- ample,because it is locatedin a seismic
zone),analyses
should
strainedto acceptsomedefault value, and we recommendone be performedto determinewhether the probabilitydue to
based on experience.The historicalrecord supportsan aver- thesesourcesis comparableto or exceedsthe defaultvalue. If
age default value of about 10-4 failuresper dam year for ma- it does,it shouldbe usedto adjustthe default probability of
jor projects in the United States,based on the frequency of failure upwards.
failures of American dams constructed after 1940. While the The apparentdoublecountingintroducedby addingproba-
statisticalrate is actuallysomewhathigher than 10-4, it re- bilities of failure attributable to identifiable hazards to the
flectsin part failures from moderate-sizedprivate sectordams default value is thoughtto be small. While the default value
which might not be expectedto benefit from the design and includescontributionsfrom mechanismsof the typesto be an-
operational conservatismof large structures.The bulk of the alyzedspecifically,
it reflectsfailuresdueto a largenumberof
historicaldata is fairly consistent,
and 10-4 is compatiblewith mechanisms.If one mechanismcontributesto a risk at a sig-
the experienceof either the Bureau of Reclamation or the nificant fraction of the default value, such that its addition in-
Corps of Engineers.The experienceof the bureau is one fail- troducesa significantincrease,the differencebetweenits ac-
ure (Teton) in 4500 dam yearsor 2 x 10-4 failuresper dam tual contributionand that implicit in the default value is also
year. The corps has had no failures in 7900 dam years (al- significant.
thoughit has had somenotoriousaccidents).While the corps' Reduction of the default value doesnot seem appropriate,
experienceis praiseworthy,it is also consistentwith a proba- however.While each dam and dam site is unique and while
bility of failure of 10-4 per dam year. Indeed,the probability some must therefore be safer and some lesssafe than average,
of experiencingno failures in 7900 dam years,given an actual no advantageof a saferdam and sitecanbe demonstrated an-
failure rate of 10-4, is about 45% (that is, exp {-7900/ alytically.Failuresseemprimarilyassociated with conditions
10,000}). The proposeddefault value seemsjustifiable and or mechanismsthat were not analyzedor designedfor; there-
consistentwith experience. fore no considerationsof a particularstructurecan assureby

TABLE 3. Mechanismsof Failure by Percent

Gruner Middlebrooks Takase USCOLD Babb and Mermel
Mechanism [1967] [1953] [1967] [19751 [1968]

Spillwayor overtopping 23 30 28 38 36
Pipingor seepage 40 38 44 44 30
Slides 2 15 10 9 15
Miscellaneous 35 17 18 9 19
 456 BAECHERETAL.: RISK OF DAM FAILUREIN BENEFIT-COST
ANALYSIS

REFERENCES

Arrow,K. J., andR. C. Lind, Uncertaintyandtheevaluationof pub-

lic investmentdecisions,,4ruer.Ecan. Rev., 60, 364-378, 1970.
Babb, A. O., and T. W. Mermel, Catalogof dam disasters,failures,
• •0-3 and accidents, Rep. NTIS PB179243, U.S. Bur. of Reclam.,
Springfield, Va., 1968.
Baecher, G., M.-E. Patr, and R. de Neufville, NED cost determina-
tion for probability of dam failure, report, U.S. Water Resour.
o 5xlO-5 Counc., Washington, D.C., 1979.
Benjamin, J. R., Making decisionsin the face of uncertainty,paper
presented at the Engineering Foundation Conference on In-
0 5 spection, Maintenance and Rehabilitation of Old Dams, Amer.
DESIGN LIFE
Soc. Civil Eng., Pacific Grove, Calif., 1973.
YEARS AFTER COMPLETION
Biswas,A. K., and S. Chatterjee, Dam disasters:An assessment,Eng.
Fig. 4. Failurerate distributionfor time after completionof dam; J., 54, 3-8, March 1971.
defaultvalueto be usedin evaluationprocedure. Buehler, B., Dams in relation to balancedpublic safety,paper pre-
sented at Engineering Foundation Conference on Responsibility
and Liability of Public and Private Interestson Dams, Amer. Soc.
meansof analysisan upper boundon probabilityof failure Civil Eng., Pacific Grove, Calif., 1976.
lower than the historical value.
Chatterjee, S., and A. K. Biswas, The human dimension of dam
safety, Water Power, 23, 446-453, Dec. 1971.
CONCLUDING REMARKS
Dorfman, R., Basic economicand technologicconcepts:A general
statement,in Designof Water ResourceSystems,edited by A. Maass
The procedurefor incorporatingthe risk costsof failure
et al., pp. 192-258, Harvard University Press,Cambridge, Mass.,
into the evaluationof damsis straightforward.
Indeed,it fol- 1962.
lowsclassicallines,derivingits noveltyfrom the application Flint, A. R., et al., Rationalizationof safetyand serviceabilityfactors
to the pecularities of dams and from the identification of a in structural codes,Rep. 63, Constr. Ind. Res. and Inform. Ass.,
London, 1976.
plausibledefaultvaluefor theirprobabilityof failure.Being
Gruner, E. C., Catalog of Dam Disasters,Gruner Brothers, Basle,
soconventional from a theoretical
pointof view,the proposal Switzerland, 1963.
mightseemeasyto acceptand incorporateinto practice. Gruner, E. C., The safetyof reservoirs,in World Dams Today, pp.
Yet we may expectconsiderable resistance
to the adoption 104-109, Japan Dam Association,Tokyo, 1967.
of this or any other proposalfor includingthe risk costsof IndependentPanel to Review Causeof Teton Dam Failure, Report to
failure into the evaluationof water resourceprojects.For U.S. Department of the Interior and State of Idaho, U.S. Govern.
Print. Once, Washington,D.C., 1976.
starters,of course,advocates
of newprojectsarenaturallyad- Mark, R. K., and D. E. Stuart-Alexander,Disastersas a necessary
verseto add on any extra cost.This is especiallytrue in the part of benefit-costanalysis,Science,197, 1160-1162, 1977.
United States, where after decadesof remarkable construction Middlebrooks, T. A., Earth-dam practicein the United States,Trans.
the primesiteshavebeenexploited,constraining
designers
to ,4rner. Sac. Civil Eng., Centennial Volume, 697-721, 1953.
work with increasinglymarginal situations. Patr, M.-E., Public policy for earthquakeeffectsmitigation:Earth-
quake engineeringand earthquake prediction, Reœ.30, John A.
More fundamentally, manypersonsin the agencies
respon- Blume Earthquake Eng. Center, Dep. of Civil Eng., Stanford,
siblefor the constructionof damsare extremelyreluctantto Calif., 1978.
admitpubliclythat damsmay fail, howeversmallthe proba- Rose,D., Risk of catastrophicfailure of major dams,J. Hydraul.Div.
bility and the resultingexpectedcosts.They know that the ,4ruer. Sac. Civil Eng., 104(HY7), 1011-1026, 1978.
Takase,K., StatisticStudy on Failure, Damage and Deteriorationof
publicis oftenhighlyaverseto risksand mightwell oppose Earth Dams in Japan, Ninth ICOLD Congress,Q34, RI: 1-19,
projectson thesegroundsalone.Suchis the caseof the pro- 1967.
posed Auburn Dam, upstream of Sacramento, California. U.S. Conferenceon Large Dams, Committee on Failures and Acci-
Howeverinsignificantthe expectedcost,the fact that a failure dentsto Large Dams of the U.S., Lessonsfrom dam incidentsUSA,
report, Amer. Soc.Civil Eng., New York, 1975.
couldwipeout thepopulousstatecapitalmightbe enoughto U.S. Department of the Army, Once of the Chief Engineer,Evalua-
defeat the project. tion of beneficialcontributionsto national economicdevelopment
Strongpressures
will thus surelybe appliedto bury or at for flood plain managementplans, Rep. ER 1105-2-351,Washing-
least to delay considerablythe introductionof risk costsinto ton, D.C., 1975.
evaluation.
Theselobbiesshouldnot,however,
deterusfrom- U.S.General
Accounting
Once,Better
analysis
ofuncertainty
needed
for water resourcesprojects,Report to the SenateCommittee on the
confrontingthe reality that damsdo fail, often at considerable
Budget,Rep. P,4D-78-67, Washington, D.C., 1978.
cost.
Vanmarcke, E. H., DecisionAnalysisin Dam Safety Monitoring, pa-
per presented at the Engineeri.ng Foundation Conference on the
Safety of Small Dams, Amer. Soc. Civil Eng., Henniker, N.H.,
1974.
Acknowledgments.The authorsgratefully rememberthe encour-
Wiggins,J. H., The balancedrisk concept:New approachto earth-
ageme'nt andsupportof theU.S.WaterResources Council,in partic- quake building codes,Civil Eng., 42, August 1972.
ular to Leo Eisel,LewisD. Walker, and William Steele,Jr., asdirec-
Woodward-Clyde Consultants,Earthquake evaluationstudiesof the
tor and staff.We alsothankour colleagues at MIT, especially Erik Auburn Dam area, report, San Francisco,Calif., 1977.
Vanmarcke,andreviewersin theBureauof Reclamation, the Corps
of Engineers,
andthe SoilConservation
Servicefor theirthoughtful (ReceivedAugust 14, 1979;
commentson our reportto the Water Resources
Council(Baecheret revisedDecember 10, 1979;
al., 1979). accepted
December17, 1979.)
 WATER RESOURCES RESEARCH, VOL. 17, NO. 2, PAGE 447, APRIL 1981

Correction

In thepaper'Riskof Dam Failurein Benefit-Cost

Analysis'by G. B. Baecher,M. E. Pat•,
andR. de Neufville(WaterResources Research,16(3),449-456,1980),equation(7) should
read as follows:

•r-- • Pr(t*)Cr(t*)
t

(ReceivedNovember 26, 1980;

acceptedDecember 16, 1980.)

Copyright
¸ 1981by theAmericanGeophysical
Union.
Paper number 80W 1771. 447
0043-1397/81/080W- 1771501.00

View publication stats