21st Century Dam Design

Advances and Adaptations

31st Annual USSD Conference

San Diego, California, April 11-15, 2011

Hosted by
Black & Veatch Corporation
GEI Consultants, Inc.
Kleinfelder, Inc.
MWH Americas, Inc.
Parsons Water and Infrastructure Inc.
URS Corporation

On the Cover
Artist's rendition of San Vicente Dam after completion of the dam raise project to increase local storage and provide
a more flexible conveyance system for use during emergencies such as earthquakes that could curtail the regions
imported water supplies. The existing 220-foot-high dam, owned by the City of San Diego, will be raised by 117
feet to increase reservoir storage capacity by 152,000 acre-feet. The project will be the tallest dam raise in the
United States and tallest roller compacted concrete dam raise in the world.

U.S. Society on Dams

Vision
To be the nation's leading organization of professionals dedicated to advancing the role of dams
for the benefit of society.
Mission USSD is dedicated to:
Advancing the knowledge of dam engineering, construction, planning, operation,
performance, rehabilitation, decommissioning, maintenance, security and safety;
Fostering dam technology for socially, environmentally and financially sustainable water
resources systems;
Providing public awareness of the role of dams in the management of the nation's water
resources;
Enhancing practices to meet current and future challenges on dams; and
Representing the United States as an active member of the International Commission on
Large Dams (ICOLD).

The information contained in this publication regarding commercial projects or firms may not be used for
advertising or promotional purposes and may not be construed as an endorsement of any product or
from by the United States Society on Dams. USSD accepts no responsibility for the statements made
or the opinions expressed in this publication.
Copyright 2011 U.S. Society on Dams
Printed in the United States of America
Library of Congress Control Number: 2011924673
ISBN 978-1-884575-52-5
U.S. Society on Dams
1616 Seventeenth Street, #483
Denver, CO 80202
Telephone: 303-628-5430
Fax: 303-628-5431
E-mail: stephens@ussdams.org
Internet: www.ussdams.org

LEVEE SAFETY AND TOLERABLE RISK IMPLICATIONS FOR SHARED

RISK, RESPONSIBILITY, AND ACCOUNTABILITY
Dale F. Munger1
David S. Bowles2
Darryl W. Davis3
Brian K. Harper4
David A. Moser5
ABSTRACT
The US Army Corps of Engineers (USACE) established a levee safety program in
November 2007 to assess and manage risks to people, property, and the environment
from inundation associated with breach or overtopping of levee systems. USACE intends
to use tolerability of risk concepts and tolerable risk guidelines in this program. USACE
committed to develop these policies in an open and coordinated manner with its federal,
state, local, and tribal stakeholders. In March 2010 USACE began this collaborative
approach with stakeholders by hosting an international workshop on tolerable risk.
Levee systems are one part of local, regional and national flood risk management
strategies. Levees complement floodplain management activities that govern floodplain
use, identify, and reduce vulnerabilities to promote resilient communities. Shared
responsibilities for floodplain management at the Federal, state and local levels require
collaborative and coordinated decision-making to ensure that flood risks are tolerable.
Levee systems help manage flood risk to existing development and at the same time
make floodplains available for more extensive uses such as residential, commercial and
industrial development. These activities produce benefits, but increased development
places an increased number of people and assets in the floodplain. Consequently, the
levee system may lead to an increase in economic risk over time, and may transform
economic risk into life-safety risk as the floodplain population increases. Development
activities and other floodplain decisions may begin to undermine the risk reduction
objectives of the levee system.
This paper provides an overview of the USACE levee safety program, a summary of
current USACE levee safety policy concepts and presents and discusses findings of the
March 2010 workshop addressing tolerable risk guidelines for levees.

U.S. Army Corps of Engineers, Portland, OR, dale.f.munger@usace.army.mil

Professor of Civil and Environmental Engineering and Director, Institute for Dam Safety Risk
Management, Utah State University, Logan, UT. Managing Principal, RAC Engineers & Economists,
Providence, UT
3
Senior Advisor, Water Resources Engineering, Institute for Water Resources, U.S. Army Corps of
Engineers, Davis, CA
4
Economist, Institute for Water Resources, U.S. Army Corps of Engineers, Galveston, Texas
5
Chief Economist, U.S. Army Corps of Engineers
2

Levee Safety and Tolerable Risk

1183

USACE LEVEE SAFETY PROGRAM

Background and Program Overview
The USACE levee safety program mission is to work with others to assess, communicate,
and manage the risks to people, property, and the environment from inundation that may
result from breach, overtopping, or malfunction of components of levee systems. The
portfolio of levee systems to which this program applies includes: 1) USACE operated
and maintained; 2) Federally authorized - local sponsor operated and maintained; and 3)
Non-Federal levee systems in the Rehabilitation and Inspection Program (RIP) under
provisions of PL 84-99. The major activities of the program are to work with partners
to: 1) routinely monitor and evaluate levee system performance; 2) identify and
communicate the risks; and, 3) identify, assess, and implement measures to manage life
safety, economic, and environmental risks that may result from potential inundation.
Prior to November 2007 the USACE levee safety effort centered on monitoring the status
of levees within the portfolio via annual inspections, or review of inspections performed
by local sponsors, to determine eligibility for inclusion in the Rehabilitation and
Inspection Program (RIP), or to determine continuing eligibility to remain in the RIP.
The RIP program provides for Federal assistance for rehabilitation of levees damaged by
flood events. These inspections were visual verifications of the local entitys compliance
with the operation and maintenance manuals and did not include the engineering
assessments needed to verify project performance or integrity. Results of the inspections
were forwarded to the local entity with recommendations for correcting any maintenance
deficiencies. Corrective actions had to be initiated by local entities to address
deficiencies to remain active in the RIP. The actions taken were not reviewed at the
national level and varied greatly.
With the formation of the USACE Levee Safety Program (USACE 2007), the inspection
requirements were changed to conform to a risk-informed process, with emphasis on life
safety. A portfolio risk management process will be used to nationally prioritize each
levee system for action to reduce risk. The risk assessment and prioritization of risk
management actions for the portfolio of levees are centrally managed while levee safety
risk management measures are locally executed.
The principal function of levee systems is to exclude flood waters from a portion of the
floodplain over a limited range of flood magnitudes for the purpose of managing flood
risk. Levees are a component of a comprehensive flood risk management strategy for a
location and not the entire strategy. Levee systems are generally of low height and do not
store water or regulate flow. A levee system is expected to exclude flood waters from the
floodplain up to a given flood elevation. However, a levee system will be overtopped if a
future flood is high enough to exceed the top of the levee. This means that there will
always be residual risks that need to be managed. Note that residual risk can be much
greater than just the risk due to water overtopping the levee because of the potential for a
breach either prior to or subsequent to overtopping.

1184

21st Century Dam Design Advances and Adaptations

Levee safety is a vital component of the overall flood risk management effort in the
United States. Flood risk management involves more than attention to flood hazard
reduction through flow regulation and river and coastal levee systems. Flood risk
management also includes actions such as reducing exposure through land use
management and evacuation of floodplain occupants when a threat of inundation occurs,
reducing vulnerability by flood proofing, constructing isolating ring levees, and
increasing individual and community resiliency through advanced preparation,
emergency action planning, purchase of flood insurance, and post-disaster assistance.
Under the principles of shared risk, shared responsibility, shared accountability, and
shared solutions, the USACE levee safety program works with stakeholders to assess the
inundation risks associated with the presence of a levee system. USACE also works with
stakeholders to recommend actions to assure that the inundation risks associated with the
presence of a levee system are tolerable. Community officials and floodplain occupants
make decisions based in part on their understanding of the inundation risk associated with
the presence of a levee system. For this reason, it is imperative that this inundation risk is
assessed and clearly communicated to the responsible officials and the public.
USACE Levee Safety Program Principles
Reduce Life-safety, Economic, and Environmental Risk: Life-safety will be held
paramount in the risk management decisions made within the USACE levee safety
program. The intent is to work with stakeholders to manage life-safety risks that result
from possible inundation resulting from levee system breach or overtopping. In concert
with stakeholders, USACE will also strive to reduce the likelihood and magnitude of
economic and environmental inundation consequences resulting from possible breach or
overtopping of levee systems.
Risk Communication and Stakeholder Participation: USACE will develop and use the
current state of the practice of stakeholder engagement and risk communication to ensure
that all affected stakeholders are part of the process. In this manner, stakeholders will be
included in determining and implementing the actions needed to meet the goal that levee
systems are managed to achieve tolerable risks. These procedures will be guided by the
following commitments: (1) stakeholders will be provided the opportunity to participate
in decisions that affect their lives through realistic and meaningful input on development
of risk management measures; and (2) communications regarding potential inundation
hazard, consequences, risk, and shared solutions will be open, transparent and
understandable to the affected public. USACE will document and routinely report the
risk communications and management decisions.
Risk-informed Decisions: Risk-informed decisions integrate traditional analyses with
estimations of the inundation risk through the application of quantitative and qualitative
risk assessment procedures, which may include experience-based judgment. To support
risk characterization for risk-informed decisions, credible and accurate information about
the inundation risks that may result from breaching or overtopping of a levee system will
be developed and kept current, as the available data and analyses permit. Therefore the
level of effort and scope of risk assessments will be scaled to provide an appropriate level

Levee Safety and Tolerable Risk

1185

of confidence considering the purpose of the risk management decisions that the risk
assessment results are to be used to inform.
Shared Responsibility and Accountability: All stakeholders have some degree of
responsibility and accountability for understanding levee system safety risk, formulating
and evaluating risk management options, and selecting and implementing risk
management solutions. To achieve both shared responsibility and shared accountability,
USACE will strive to involve stakeholders in the risk assessment and formulation of risk
management alternatives. Community officials and floodplain occupants can then make
decisions based on their common understanding of the inundation risk resulting from
levee system breach or overtopping.
Utilize a Systems Approach: All the components and segments of a levee system should
be operated, maintained, evaluated, and assessed as a system. Additionally, the
evaluation of the effectiveness of all risk management measures should be on a system
basis and not as individual components or segments within a system. The system
considerations include more than the physical components of the levee and include the
social and economic factors that lead to the presence of people, their assets, and their
vulnerability to inundation.
Periodic and Continuous Activities: The Levee Safety program will implement periodic
and continuous or routine activities that are essential for effective flood risk management.
These activities include operation and maintenance, monitoring and evaluation,
emergency response planning, inspection, and screening.
Portfolio Risk Management
The levee systems in the USACE levee safety program will be managed using a riskinformed, nation-wide perspective. The portfolio process is continuous and shall be
applied to all features of all levee systems and associated floodplains. The following are
the categories of levees in the USACE portfolio of levee systems: USACE operated and
maintained; Federally authorized - local sponsor operated and maintained; and nonFederal levee systems in the Rehabilitation and Inspection Program.
Routine levee safety activities: Execution of inspections, screening, instrumentation,
monitoring and evaluations, operations and maintenance, emergency response planning,
and other routine activities are an essential part of effective levee safety risk management
for all levee systems in the USACE portfolio.
Risk-informed management: The USACE levee safety portfolio risk management process
includes identification of levee safety issues, risk assessments, identification of options
for managing inundation risks, and prioritization of activities. Risk-management
decisions and actions are not exclusive to USACE and will include stakeholders. By
considering the entire portfolio of USACE levee systems and associated floodplains,
USACE can efficiently reduce risk by identifying and addressing those with the highest
risk first.

1186

21st Century Dam Design Advances and Adaptations

Studies and investigations: Studies and investigations will be prioritized to reduce

knowledge uncertainty and more accurately assess the risk across the portfolio of levee
systems in a cost-effective and timely manner. The urgency of actions will be
commensurate with the estimated level of risk based on currently available information.
These include actions to reduce risks in the short and long term.
Shared Risk, Responsibility, Accountability and Solutions
USACE and local sponsors have worked together to plan, design and construct levee
systems that serve to manage flood risk in communities across the country. According to
an examination of 1,200 communities nationwide, the density and value of development
in the floodplains has increased after the levee systems have been put into place (Burby
and French 1985 as reported in Burby 2006). Research indicates that flood damages have
steadily risen over time, and some researchers attribute the increase to floodplain
development decisions rather than changing precipitation rates and patterns (Pielke and
Downton 2000).
As stated previously, flood risk management involves more than attention to flood hazard
reduction through flow regulation and river and coastal levee systems. Flood risk
management also includes actions such as:

reducing exposure through land use management and evacuation of floodplain

occupants when a threat of inundation occurs,
reducing vulnerability by flood proofing, constructing isolating ring levees, and
increasing individual and community resiliency through advanced preparation,
emergency action planning, purchase of flood insurance, and post-disaster
assistance.

Under the principles of shared risk and shared responsibility, the USACE levee safety
program, working with stakeholders, assesses the inundation risks associated with the
presence of a levee system. Assessment results are used to develop actions to assure that
levee system inundation risks are managed to be tolerable. Within the tolerability of risk
framework, tolerable risks are defined by the following four conditions:

risks that society is willing to live with so as to secure certain benefits,

risks that society does not regard as negligible or something that it might ignore,
risks that society is confident that are being properly managed by the owner, and
risks that the owner keeps under review and reduces still further if and as
practicable. (Adapted from HSE 2001)

The intent of the USACE levee safety program is to ensure that inundation risks are
managed to achieve and maintain the conditions of tolerable risk in exchange for the
benefits afforded to floodplain activities. However, there is no single owner of the risk.
Instead, the risk is shared among floodplain inhabitants, the project sponsor and USACE.
Accordingly, these groups must also share responsibility for monitoring and managing
the risk.

Levee Safety and Tolerable Risk

1187

Surveys of local planners (IHBS 2002) indicate that improved risk information is one of
the items needed to improve local hazard planning. Even more important factors
identified by those surveys were the support of elected officials and "demand" from the
public. The assessments completed through the USACE levee safety program will
provide the improved risk information that is sought. The program can also use that
information in the development of public education and outreach programs as well as risk
communication strategies. The routine activities of the levee safety program will assist in
keeping the risks under review so that levee risk information can be incorporated into
routine decision-making processes at the local level. Levee safety information can be
most useful as a part of local and regional comprehensive planning rather than as a
standalone activity, because the levee safety issues can be considered simultaneously
with other important influences on floodplain activity. In this manner we can avoid
incremental erosion of levee safety.
Burby (2006) speaks of two paradoxes that combine to increase catastrophic losses from
natural hazards due to unsafe urban development in hazardous areas. First, is the safe
development paradox, which results from policies that attempt to make areas safe for
development but instead create "targets for catastrophe." The second paradox is termed
the local government paradox, which finds that insufficient attention is given to local
government policies that would reduce vulnerability, even though local populations bear
the brunt of disaster losses. This combination of paradoxes highlights the shared
responsibility of flood risk management and indicates that active integration of all
stakeholder decisions is required to ensure public safety in levee areas.
Figure 1 is a conceptual display of the forcing mechanisms that alter levee system risk
levels.

1
Likelihood

1. Original estimate of risk

2. Risk management implemented
3. Trend due to aging and wear and
tear
4. Trend due to maintenance, repairs,
and operations
5. Trend resulting from development
pressure
6. Flood plain management actions
a) Land use management
b) Flood proofing
c) Warnings and preparedness
plans

Fatalities

Figure 1. Likelihood of Inundation vs. Fatalities Representation of the Effects of Various

Factors that Influence Changes in Levee System Inundation Risk

1188

21st Century Dam Design Advances and Adaptations

It is instructive to look at the factors that influence the calculated estimate of life risk in a
levee area. First there is the flood hazard, which determines the potential for loading on
the levee system. Then there is the system response to loading, which identified through
failure modes analysis and quantified as the conditional likelihood of breach for each
failure mode over a range of levels of flood loading, with or without overtopping. This
combination of probability of loading and the conditional system response probability,
plus the likelihood of inundation occurring from overtopping without a breach, lead to an
estimate of the likelihood that the leveed area will be inundated.
The final piece of the life-risk assessment is the evaluation of the multiple factors that
determine the potential for a fatality (McClelland and Bowles 2000), including the
number of people in the area, the expected warning time, the capacity to warn and
evacuate, the response of individuals to a warning, the depth of the floodplain
(topography in relation to flood heights), the degree of shelter provided by buildings in
the flood plain and the effectiveness of rescue activities. These are the factors that are
referenced in the local government paradox, because they are often the outcomes of
decisions that determine the manner in which people and property occupy a floodplain.
Specifically, land use planning determines the locations, mix and density of residential,
industrial, commercial, and public structures, which in turn determines the number of
people present in the area. Infrastructure decisions determine transportation routes and
the location of utilities and critical facilities that contribute to community resiliency in the
event of disaster.
Not all levee systems will be found to have life-safety risks, as measured by the
likelihood and magnitude of fatalities in the levee areas. The USACE levee safety
program recognizes economic and environmental consequences as important risk metrics;
however, the program is based on the principle that life safety is paramount. It is the
intent of the program to identify systems that are not achieving tolerable life-safety risk
so that actions can be identified and taken to manage that risk. Many of these actions will
lie within the areas of responsibility of local stakeholders but it is intended that risk
information developed in the levee safety assessments will provide the basis for
achieving tolerable risk for a specific levee system and avoid outcomes described by
Burby's paradoxes.
TOLERABLE RISK GUIDELINES AND WORKSHOPS
Background
Within the overarching flood risk management context, the USACE is using risk
management approaches for dams and levee systems to: 1) make better decisions; 2)
better prioritize and justify risk reduction measures; 3) better communicate risks to
decision makers and the public; and 4) better understand and evaluate public safety risks
in an environment of shared flood risk management responsibilities. USACE application
of risk management approaches includes the potential use of a Tolerability of Risk (TOR)
framework, originally developed in the United Kingdom (HSE 2001) and adapted
elsewhere, and applied as Tolerable Risk Guidelines (TRG). Tolerability of Risk was
originally developed as a framework by the HSE to make transparent its approach to the

Levee Safety and Tolerable Risk

1189

management of risk to people arising from work activities. Tolerable risks are defined
as risks that society is willing to live with so as to secure certain benefits, risks that
society does not regard as negligible or something that it might ignore, risks that society
is confident that are being properly managed by the owner, and risks that the owner
keeps under review and reduces still further if and as practicable. (Adapted from HSE
2001 in USACE December 2010) Tolerable Risk Guidelines provide a means of
evaluating whether or not risks are tolerable according to the above definition. They can
also be of value in prioritizing actions for reducing risks.
In March 2008, USACE joined with the Bureau of Reclamation (Reclamation) of the
Department of Interior and the Office of Energy Projects - Division of Dam Safety and
Inspections of the Federal Energy Regulatory Commission (FERC) convened a workshop
entitled Workshop on Tolerable Risk Evaluation A step towards developing tolerable
risk guidelines for dams and levees. With the formation of the USACE Levee Safety
Program (USACE 2007), attention began to be directed toward adapting the newly
developed risk-informed dam safety policies and methods for application to levee
systems. The National Committee on Levee Safety (NCLS), which was authorized by
the Levee Safety Act of 2007, published its draft recommendations in January 2009
(NCLS 2009). They included Recommendation #5 that Tolerable Risk Guidelines be
developed for application in risk-informed, flood risk management (FRM) associated
with levees.
March 2010 Tolerable Risk Guidelines Workshop
A second workshop was held in March 2010 (USACE November 2010) as an early step
in the USACE engaging of the flood risk management community to collaborate in
developing policies, TRG, and procedures to further levee safety for the nation. The
workshops purpose was to examine the concepts and principles of tolerability of risk and
tolerable risk guidelines and explore their application to, and use in, managing life,
economic, and environmental risk associated with potential breach or overtopping of
levee systems. The workshop scope encompassed national and international approaches
to flood risk management, tolerability of risk, and tolerable risk guidelines as they could
apply to the USACE levee safety program. The workshop was comprised of three parts:
introductory plenary presentations that set a common information base and vocabulary
for subsequent discussions; three facilitated break-out sessions that deliberated on
questions prepared in advance; and concluding panels and plenary sessions to capture the
sense of the participants regarding what was learned and how to proceed. Invited
participants numbering about sixty were from USACE, Federal Emergency Management
Agency (FEMA), other Federal agencies, professional societies, non-governmental
organizations (NGOs), and from The Netherlands, United Kingdom, Japan, and Spain.
The following are selected topic summaries from the workshop. Please note that these
topic summaries reflect what was stated and recorded at the workshop and does not
contain any additional information or editorial opinions.
Are Structures or People Safe?: A clear distinction emerged between characterizing the
performance of the structure (levee system) and the consequences of unsatisfactory
performance of the system. Most agreed that identical levees adjacent to either an

1190

21st Century Dam Design Advances and Adaptations

uninhabited floodplain, or a highly developed floodplain were not equally safe. The
integrity of the structure is best described by characterizing its performance as related to
its design; whereas the risk to floodplain occupants is best addressed by focusing on the
persons affected. Hence, it was suggested that the USACE levee safety program should
encompass all elements of the system to include structure performance and the
consequences of unsatisfactory performance on life-safety, economic, and environmental
systems. The idea that someone could suffer harm from unsatisfactory performance of a
levee system without knowing that they were at risk was characterized as unacceptable.
There will always be the inevitable question from the public, elected officials and
government officials Is the levee safe? As professionals, we need to be prepared to
respond in an understandable and transparent way.
Levee System Failure: There was considerable discussion about whether the term
failure should be parsed into categories when communicating about a levee system: e.g.
design capacity, failure before overtopping, failure after overtopping, overtopping
without failure, and even whether the term failure was appropriate if the levee
performed up to its design but was overtopped. In general, the agreement was to use the
terms breach and overtopping as the descriptors of levee performance, and to avoid
the use of the term failure. It was urged that emphasis be placed on the persons at risk
since surely they do not care how or why they get flooded, just that they are at risk.
There was support for the idea that what is more significant was how the breach might
occur. For example, the surprise factor associated with an unexpected breach before
flood levels reach the top of the levee would likely result in substantially higher risk to
the floodplain occupants than would breaching after overtopping or just overtopping
without breach.
Shared Responsibility: We want to foster this notion of shared responsibility, but if
everyone is responsible, no one is - a sobering reality eloquently expressed. Closely
associated is, We need a way to hold institutions/people accountable. In the United
States, there is no one entity authorized to be held accountable for the myriad aspects
associated with flood risk management and levee safety. For Federal levees constructed,
operated and maintained by USACE, USACE can be held accountable for the integrity of
structural systems performance. However, land use management and control is not
within the authority of the Federal government; instead such responsibilities are generally
vested at the local government level with some degree of oversight possible at the state
level. Therefore, the decisions impacting what is behind levees, the consequence of levee
system performance (or more aptly put, exceedance), lies with non-Federal entities with
very different considerations affecting their decisions. Further, on the consequence side,
emergency management is diffused among at least Federal, state, and local government,
and likely special levee districts as well. The European participants expressed the
opinion that it would be exceedingly difficult to efficiently orchestrate and hold
accountable the various entities sharing responsibility without a basic enabling law
addressing the issue. Such an enabling law does not exist in the US. They pointed out
the obvious lack of responsibility for development (and presumably enforcement) of
strategic flood risk management planning and it was recognized that no such strategic
plans exist! There was wide-spread agreement on that view. For non-Federal FRM/levee
systems, the picture is even murkier: accountability (liability?) essentially devolves to
Levee Safety and Tolerable Risk

1191

who wins in court should someone be harmed from some aspect of the flood risk. In the
absence of legislation that would affix responsibility, or at least define shared
responsibility, the emphasis will need to be placed on adapting to each situation,
communicating risk (who is at risk and in what way), who will (or should) pay, and the
affect on the various stakeholders and officials. Thus the USACE role in a shared
responsibility environment is likely to be performing risk assessments and
communicating such to the responsible entities, and providing advice and assistance as
might be requested.
Use Tolerable Risk Guidelines for Levee Systems?: The consensus was yes, as one
participant stated it, TRG are a compact with the citizens reflecting concern for life as
well as other risks. Caveats to the general endorsement and encouragement for USACE
to continue to develop, apply, and communicate TRG were raised by participants. For
instance it was advised by some that TRG is applicable for existing infrastructure
(prioritization and ranking remediation options) and formulation/evaluation of potentially
new projects; but not for design. Considerable discussion ensued that attempted to pin
down a specific definition for design so as to better understand the caveat, but the
matter was left unsettled for now. Experience is expected to eventually shed light on the
utility of the application of TRG to these topics that were discussed and likely future
applications not yet envisioned. Another caveat was that the TRG should be developed
in an open, transparent process that engages the full body of stakeholders, in effect
making the guidelines part of the public domain. In furthering the transparency issue,
USACE was encouraged to seek independent vetting of proposed guidelines, perhaps
including such bodies as the National Academies National Research Council. An appeal
was made to engage social scientists since a significant aspect of perceiving and
tolerating risk involves social sciences considerations and not purely technical factors. A
question was posed along the line Is the US ready for national policy on the topic of
tolerable risk? The predominant answer was yes, but it was acknowledged that there
are likely to be some entities that would be horrified at the prospect, and some entities
that would push back energetically; the land development and building communities were
mentioned several times as being in this latter group. It was noted that, while TRG might
be new to the US, they have been applied in other regions of the world for more than 20
years with mostly general acceptance and endorsement. It was further noted that
significant sectors of the engineering community have migrated toward a TRG approach
in areas other than levee systems, and it is timely for USACE to step out smartly now to
further the exposure of TRG and its potential application in the US.
Tolerable Risk Guidelines Some More: As defined by the Office of Management and
Budget and adapted by USACE, risk analysis is comprised of risk assessment, risk
communications and risk management. TRG are implemented as part of all three - risk
assessment, risk management, and risk communications. As the definition of tolerable
risk implies (see Background section above), TRG provides a framework for evaluating
the tolerability of risks by considering whether the risk is securing certain benefits,
whether society does not regard the risk as negligible or something that it might ignore,
whether society is confident that the risk is being properly managed by the owner, and
that the owner is keeping the risk under review and reducing it still further if and as
practicable (risk assessment). As such TRG are not a single bright line implying a binary
1192

21st Century Dam Design Advances and Adaptations

distinction of numerical risk estimates as unacceptable or acceptable, or intolerable and

tolerable. TRG are also not a fixed probability and consequence. TRG can be used to
explain and characterize (risk communication) the significance of risks. TRG may also be
used to prioritize among options and to evaluate their urgency for action (risk
management). Tolerability of risk is a relatively new concept in the US which needs to
be explained and understood to forestall objections and push-back due to
misunderstanding. Some will believe that the use of TRG are being put forth to justify
(on a life-safety basis) bigger and more levee projects; this needs to be clearly refuted.
The objective for the application of TRG is better decision making. USACE must not
develop TRG with a narrow focus of application to its levee safety program. USACE
must think, work, and interact in the larger context of using TRG for FRM and how they
can serve all users/stakeholders. It was noted that what USACE does will set a pattern
for others. Estimating life-risk is exceedingly difficult and any estimate includes large
uncertainty. Additionally there are some who object to making such estimates on ethical
and moral grounds. Reclamation struggled to estimate loss of life for dam failures. They
chose to fall back on a generalized empirical method that estimates loss of life based on
warning time and warning effectiveness and flood severity categories on a spatially
lumped basis ignoring particular details about the local setting, demographics of
populace and evacuation effectiveness. Recently, simulation approaches using GIS data
bases have been developed to overcome many of these limitations and in one case to
include estimates of uncertainty. Just because it is difficult and the estimates uncertain
are not valid arguments for not putting life risk forward as a decision metric, making
estimates (using standardized models in a transparent way), and communicating the
estimates and associated uncertainties to inform stakeholders of risk.
Valuing Human Life: In parts of Europe and perhaps elsewhere, a monetary value is
placed on human life so that potential for life loss may be included in economic analysis.
USACE policy does not include placing a value on life and incorporating this value into
the economic analysis. Several US Federal agencies have established and periodically
update a decision guidance parameter termed value of a statistical life (VSL), although
USACE uses the term "willingness-to-pay-to-prevent-a-statistical-fatality" (WTP) for the
same idea. This parameter is used in budgetary or regulatory decision making that affect
life safety. EPA and the US Department of Transportation were mentioned as examples,
with VSL values ranging from $5M to $10M. An element of application of TRG
includes the concept of disproportionality. This brings into the decision framework the
notion that the sacrifice (money, time, trouble and effort) in implementing the risk
reduction measures should not be disproportionate to the subsequent risk reduction
achieved. A component of the evaluation of disproportionality may include estimating
the ratio of the cost to save a statistical (CSSL) for a specific risk reduction measure to
the VSL with the expectation that to meet the legal obligations of the hazard owner this
ratio should be significantly greater than 1. It was noted that US Federal agency practice
in general has focused on the CSSL for a specific risk reduction measure not significantly
exceeding VSL, although private industry in the US commonly practices the principle of
disproportionality to avoid product liability (Viscusi 1998). The ratio, CSSL/VSL, may
be different for each option for reducing risk, and such information should play a role in
the decision process for reducing risks below the limits of tolerability defined in TRG.

Levee Safety and Tolerable Risk

1193

Levee Safety Standards: The draft report of the National Committee on Levee Safety
(NCLS 2009) advocates development of national standards for levee safety. The precise
scope and make-up of such standards has not yet been formed. Concepts discussed in
this session included improved structural design guidance for such topics as seepage and
foundation stability to include resilience and robustness; and the idea that since levees
will eventually be overtopped, there should be developed and promulgated guidance that
requires design for exceedance. The latter item is a key factor in the life-safety issue
related to levees since it would lessen the likelihood of the surprise factor breaching
before overtopping - coming into play. It was suggested that potential failure modes
analysis identifying and examining significant potential modes of failure for a levee
system and not just characterizing levee systems with a somewhat generic lumped
fragility function (probability of failure conditioned on exterior water stage) will provide
richer and better information with which to make levee system safer and to communicate
levee safety risk to the populous.
USACE Role in TRG for Levee Safety: In addition to executing its currently-identified
mission for levee safety (within existing authorities), USACE should use its Bully
Pulpit to advance the nations levee safety; referred to many times in the workshop as
telling the story. The story is informing the populous of their risk associated with
levees and other flood risk management measures as well. USACE should develop its
risk assessment methods in a transparent way and make the tools available for others to
use, move the art of risk communications forward in telling the story, and be the
primarily lead by example in execution of its levee system life-safety program. USACE
is embracing tolerable risk in a risk-informed decision framework, and working within
the concept of shared responsibility and accountability. These are concepts worthy of
national implementation and USACE has an obligation to assist in making this happen.
Selected Observations about What Was Heard at the March 2010 Workshop:
Tolerable Risk Guidelines (TRG) is viewed by some in the USACE as a criticism of the
way USACE has in the past formulated projects. The TRG concept seems to challenge
the National Economic Development (NED) project focus of the present USACE project
planning guidance. This is neither the case nor the intent; incorporating TRG in planning
would simply elevate consideration of life-safety in project development. Consideration
of life-safety has always been implied by USACE policy, but not specifically emphasized
as might now be proposed. TRG should not and would not support implementing a
facility or project that would put people at greater risk than they would be without the
project. Thought needs to be given to how this relates to other aspects of Federal policy,
including the Principles and Guidelines (P&G) and the National Flood Insurance
Program (NFIP). USACE leaders need to determine how TRG and risk estimates will be
applied to the USACE civil works program and how it will affect engineering design and
judgment. A concern expressed is that the USACE will not be able to communicate the
estimated risk and TRG concepts effectively within its own agency let alone to
stakeholders.
For the most part, stakeholders are unaware of residual risks that levees pose to residents
and the transformed risks that levees create. Additionally, stakeholders are unaware of

1194

21st Century Dam Design Advances and Adaptations

their roles and responsibilities for ensuring that such levee systems are adequately safe
and function as planned. Communication plans need to acknowledge these facts and
incorporate material to inform unaware stakeholders of their exposure and their
responsibilities. USACE should inform stakeholders of what is being done ahead of time
no surprises and prepare and encourage the use of media articles that provide
communities with important information ahead of time. Leadership at all levels of
government, NGOs, and professionals must engage in the communications.
Selected Follow-on Actions/task Tabulation from March 2010 Workshop
The following is a list of follow-on actions recommended by the workshop participants:
1) Develop USACE levee safety program policies and associated guidance and
regulations; 2) develop policies and guidelines in a transparent manner with stakeholder
involvement; 3) let the idea that policies and guidance may have utility beyond the
USACE levee safety program guide the development of this policy and include a plan on
how TRG will be applied and implemented; and 4) assign tasks (TRG working group to
lead) and develop a plan and schedule for guidance documents. Concurrently: develop a
stakeholder involvement plan to include a schedule of activities (such as pilot test,
examples, briefing materials, interagency collaboration, etc.) associated with the
development and implementation of the USACE levee safety program policy.
CONCLUSION
The USACE levee safety program provides the means and opportunity to evaluate the
exposure and vulnerability of local populations to inundation risks in a structured
manner, simultaneous with assessment and evaluation of the structural integrity of the
levee systems themselves.
The routine activities of the levee safety program will assist in keeping the risks under
review so that levee risk information can be incorporated into routine decision-making
processes at the local level.
Use of the tolerability of risk concepts appears to be accepted, but establishing the actual
tolerable risk limit will require significant outreach and collaboration.
The risk assessments address more than conditional probability of exceedance. The
evaluation of failure paths that lead to inundation through overtopping or through breach
prior to overtopping of the levee system will provide information to stakeholders for
shared risk-informed risk management decisions.

Levee Safety and Tolerable Risk

1195

REFERENCES
Burby, R. J. (2006), Hurricane Katrina and the Paradoxes of Government Disaster
Policy - Bringing about Wise Governmental Decisions for Hazardous Areas, Annals of
the American Academy of Political and Social Science, March 2006.
HSE (2001), Health and Safety Executive, "Reducing Risks, Protecting People: HSEs
Decision-making Process," Risk Assessment Policy Unit, HSE Books, Her Majestys
Stationery Office, London, England, 2001.
IHBS (2002), Institute for Business & Home Safety, Are We Planning Safer
Communities? Results of a National Survey of Community Planners and Natural
Disasters, ISBN # 1-885312-27-X, 2002.
McClelland, D.M. and Bowles, D.S. (2000), Estimating Life Loss for Dam Safety and Risk
Assessment: Lessons from Case Histories. Proceedings of the 2000 Annual USCOLD
Conference, US Society on Dams (formerly US Committee on Large Dams), Denver, CO.

NLCS (2009), National Committee on Levee Safety, Recommendations for a National

Levee Safety Program, A Report to Congress from the National Committee on Levee
Safety, Draft, January 15, 2009.
Pielke, R. A. and Downton, M. W. (2000), Precipitation and Damaging Floods: Trends
in the United States, 193297, American Meteorological Society, 15 October 2000.
USACE (2007), United States Army Corps of Engineers, Levee Safety Program
Implementation, Memorandum for Major Subordinate Commands and Districts, MG
Don T. Riley, 16 November 2007.
USACE (2010 November), United States Army Corps of Engineers, Proceedings of the
Workshop -Exploration of Tolerable Risk Guidelines for the USACE Levee Safety
Program, USACE Institute for Water Resources Report 10-R-8, October 2010.
USACE (2010 December), United States Army Corps of Engineers, ER 1110-2-1156.
Safety of Dams Policy And Procedures, December 2010 (In press).
Viscusi, V.K. (1998), "Rational Risk Policy," Oxford University Press Inc., Oxford, New
York. 138 p, 1998.

1196

21st Century Dam Design Advances and Adaptations