JOURNAL OF THE AMERICAN WATER RESOURCES ASSOCIATION

VOL. 36, NO. 5

AMERICAN WATER RESOURCES ASSOCIATION

OCTOBER 2000

SHOULD DAMS BE MODIFIED FOR TIlE PROBABLE MAXIMUM FLOOD?'

Wayne J. Graham2

ABSTRACT: The probable maximum flood (PMF) currently serves

as the design standard for many U.S. dams. Floods used for design
have increased and currently thousands of dams in the U.S. would

be overtopped and possibly fail using the latest calculated PMF at

each dam site. Some researchers have suggested that modifying
dams to accommodate the PMF could be wasteful. Objections to
using the PMF for dam modification include: (1) larger spillway
capacity may increase annual downstream flood losses, (2) benefitcost ratios may be low, (3) construction accidents associated with
dam modification may cause fatalities, and (4) the dollar amount
spent to save lives by making dams safer is often very high. Based
on these objections, a procedure is presented for evaluating the
effectiveness of a proposed dam modification. A change in spillway

design policy is recommended. Accepting the status quo at a dam

that cannot accommodate the PMF may be the best course of

action.
(KEY TERMS: dam safety; safety; floods; probable maximum precipitation; probable maximum flood; dams; risk; economics.)

may be expected from the most severe combination of

critical meteorologic and hydrologic conditions that

are reasonably possible in the drainage basin under

study" (FEMA, 1998).

Many hydrologists and hydrotechnical organizations are reluctant to assign a recurrence interval to
the PMF, something that must be done in order to
estimate costs and benefits of a proposed modification. The National Research Council provided guid-

ance in 1985 suggesting that for the purpose of

computing risk costs, "a more reasonable value of the
return period" of the PMF would be 1,000,000 years
(NRC, 1985:286). Based on this assumption, the PMF
is 10,000 times less likely to occur than the "100-year"
flood.

Various professional organizations and Federal

interagency committees have developed guidelines
regarding the PMF and dam safety. For the last 50

INTRODUCTION

years, the general criterion for large dams built

upstream of populated areas has been that dams

Large floods can occur anytime during the life of a

dam. If the spillway and reservoir cannot accommodate the flood inflow, dam overtopping and failure can
potentially result. In order to minimize dam failures
due to overtopping, it is current practice in the United
States to estimate extreme precipitation which leads
to an extreme flood and then design or modify a dam
to withstand the extreme flood. The Probable Maximum Precipitation (PMP) is defined as "theoretically,

should not fail during the PMF. The current Federal

Guidelines suggest, and the laws of many states

require, that dams be capable of withstanding the
PMF in cases where danger to life and property downstream from the dam during the PMF is greater with
dam failure than without dam failure (FEMA, 1998).
The current guidelines allow agencies to determine an
inflow design flood using an incremental hazard eval-

uation or risk analysis which considers the significance of consequences attributable to dam failure

the greatest depth of precipitation for a given dura-

(FEMA, 1998).

tion that is physically possible over a given size storm

area at a particular geographic location during a cer-

Table 1 lists every U.S. dam failure that caused

more than 50 fatalities (W. Graham, 1999). Only three

of these dams failed from overtopping and most of the

tain time of the year" (FEMA, 1998). The Probable

Maximum Flood (PMF) is defined as "the flood that

1Paper No. 99138 of the Journal of the American Water Resources Association. Discussions are open until June 1, 2001.
2Hydraulic Engineer, D-8540, Water Resources Services, Bureau of Reclamation, Denver Federal Center, Denver, Colorado 80225-0007
(E-Mail: wgraham@do.usbr.gov).
JOURNAL OF THE AMERICAN WATER RESOURCES ASSOCIATION

953

JAWRA

Graham
TABLE 1. U.S. Dam Failures Causing More Than 50 Fatalities.

Dam
Williamsburg

South Fork
Walnut Grove

Austin
St. Francis
Buffalo Creek
Canyon Lake

Age of
Dam

Deaths

1911

9
9
2
2

138
2209
85
78

1928

420

1972
1972

State

Year

Massachusetts
Pennsylvania
Arizona
Pennsylvania

1874
1889
1890

California
West Virginia
South Dakota

125

39

unknown

Failure Cause
Seepage
Overtopping
Overtopping
Structural Defect
Structural Defect
Slumping of Mine Waste
Overtopping

failures occurred when the dams were only a few

This paper was written to stimulate discussion

years old.
There are approximately 24,000 dams in the Unit-

regarding appropriate PMF policy. The views

ed States sized and located such that dam failure

would pose a threat to human life or property (FEMA,
1995-1996). Thousands of these significant and high

hazard potential dams would be threatened during

expressed may or may not represent the views of the

staff and management of the Bureau of Reclamation
and should not be construed as representing official
Reclamation policy.

the PMF because many of the dams were not

designed using current PMF procedures. Very few of
these dams, however, have failed. During the last 25

years, U.S. dam failures caused an average of five

deaths per year, with approximately three deaths per
year from dams that failed from overtopping (Graham, 1999b). Flooding in the U.S., including flooding

from dam failure, causes approximately 120 deaths

per year (Wood, 1997). Providing perspective, approxi-

mately 5,000 pedestrians die in the U.S. every year

due to motor vehicle accidents (U.S. Bureau of the
Census, 1998).
Several engineering journal articles or reports have

A Task Force on Spillway Design Floods was estab-

lished by the American Society of Civil Engineers

(ASCE) in 1956. A paper presented by a task force
member at a 1962 Symposium on Hydrology concluded that "for large major structures that would be sub-

ject to possible failure if the selected capacity were

exceeded, there would be few instances, if any, where

anything less than provision for the probable maxi-

suggested that modifying existing dams to pass the

latest estimated PMF is often wasteful (Dawdy and

mum flood can be justified" (Snyder, 1964).

"Criteria and Practices Utilized in Determining the

Required Capacity of Spillways" was prepared in 1970
(USCOLD, 1970). The authors of this report compiled
questionnaire responses from Federal dam builders,
regulators, and owners, as well as from private engi-

Lettenmaier, 1987; Resendiz-Carrillo and Lave, 1987,

1990; Lave et al., 1990; Dubler and Grigg, 1996; Lave
and Balvanyos, 1998). The basis for the criticism has
primarily focused on two issues: (1) the economic cost
of dam modification is much higher than the benefits,

neering firms. All respondents stated that current

and (2) the modifications were not cost effective in

policies of their agencies or firms were consistent with

saving lives.

This paper presents a procedure for evaluating the

effectiveness of a proposed modification at an existing
dam. The procedure provides for an evaluation of the
costs and benefits of a modification measured in dollars and lives.
Blindly modifring dams to accommodate the PMF
is unwise. The example used to demonstrate the procedure shows that modifying a dam for the full PMF
may actually cause a loss of lives and a waste of dollars. The policy requiring dams to accommodate the
PMF without dam failure needs to be changed and a
more fiscally and socially responsible policy adopted.
This paper can serve as a stepping stone toward that
endeavor.
JAWRA

HISTORY OF SPILLWAY DESIGN

FLOOD CRITERIA

954

(paraphrased): "It is the policy of this agency that

high dams impounding large volumes of water be
designed so the dam and spillway are large enough to
assure that the dam will not be overtopped by floods
up to the probable maximum." The report also stated
that "policies which are now (1970) generally accepted
are not radically different from those followed 20 or
more years ago by the responding organizations."
An ASCE Task Committee on the Reevaluation of
the Adequacy of Spillways of Existing Dams described

an alternate approach in its paper, "Reevaluating

Spiliway Adequacy of Existing Dams" (ASCE, 1973).
The committee's paper was notable in that the recom-

mendations deviated from the common thinking of

the time.
JOURNAL OF THE AMERICAN WATER RESOURCES ASSOCIATION

Should Dams Be Modified for the Probable Maximum Flood?

The committee suggested that spiliway adequacy of

existing dams should be based on a thorough economic analysis of risk costs (dam failure) versus dam modification costs. The risk costs were determined using a

dollar value assigned to each fatality and the PMF

was assigned an annual recurrence probability of one
in 10,000. The committee recognized that citizens are
exposed to risk of death or injury from thousands of
different causes. The committee developed a proce-

dure enabling resources to be directed to dam

improvements only when the action made sense in a
greater societal context. It is interesting that the committee members (except for one) were able to reach
consensus on their recommendations. The commit-

tee's work generated a storm of controversy, and

acceptance of their recommendations by the civil engineering community was low. Some critics of the committee's recommendations disagreed with assigning a

recurrence interval to the PMF while others objected

to assigning a dollar value to lives lost. Perhaps the
committee's timing was poor since two major U.S.
dam failures occurred in 1972, just prior to publication of its recommendations (Graham, 1999b). One of
the 1973 committee members recently wrote, "After

all these years, I still think the committee's report

merits strong consideration" (Buehler, 1997).
The 1979 "Federal Guidelines for Dam Safety" was

published at the end of a decade that experienced

numerous dam failures in the United States (Ad Hoc
Interagency Committee on Dam Safety, 1979). These
guidelines state, "when flooding could cause significant hazards to life or major property damage, the

flood selected for design should have virtually no

agency specific criteria. This opened the door for

agencies to use other methods to determine the signif-

icance of the consequences. Risk analysis is an

approach to this evaluation.
In 1984 another ASCE committee was formed. The
Task Committee on Spillway Design Flood Selection

prepared, "Evaluation Procedures for Hydrologic

Safety of Dams," in 1988 (ASCE, 1988). Their proce-

dure suggested that a PMF design was warranted

when there were 100 or more people residing in areas
that would be flooded during the first four hours after
the dam failure. A quantitative risk assessment was

suggested for less hazardous dams. The relative

weighing of non-monetary consequences and their
comparison to dollar savings was assumed to be a
matter of judgement. Consequently, no criteria were
provided for making a final safety design decision.
New "Federal Guidelines for Selecting and Accommodating Inflow Design Floods for Dams" were pub-

lished in October 1998 (FEMA, 1998). "Acceptable

incremental consequences" is introduced as the basis
for determining an appropriate inflow design flood.
The difference in threat to life or property caused by
flooding with and without dam failure is defined as
the incremental consequences. The guidelines recommend an iterative approach to analyze increasingly
larger flood inflows until an acceptable flood inflow is
identified, or the full PMF is reached. It further recommends two feet or less of additional flood-water

elevation due to dam failure as one criterion that

might indicate acceptability, but since this measure is

arbitrary and its estimate is uncertain, "engineering

judgement and further analysis" may be required
before decisions based on this criterion are made. The
guidelines suggest that the PMF should be adopted as
the inflow design flood if the PMF causes dam failure

chance of being exceeded" (p. 19). This apparent recommendation to use the PMF sold short the potential
to use risk analysis that the guideline also supported.
The National Research Council published "Flood
and Earthquake Criteria" in 1985. The criteria stated,
".

and results in unacceptable incremental consequences. The guidelines state: "there are times when
(selecting the inflow design flood using the incremental hazard procedure) becomes difficult and it may be

. . it is apparent that there is not one universally

satisfactory approach to establishing spillway capaci-

necessary to conduct further analyses with a risk-

ty criteria for existing high-hazard dams. There are

some dams where the additional damage and loss of
life caused by a dam failure due to overtopping may

based approach."

justify protection for the full probable maximum flood.

Other situations may indicate that protection against

the PMF is desirable but compromise.. .could be tolerated" (NRC, 1985:121).
"Federal Guidelines for Selecting and Accommodating Inflow Design Floods for Dams," 1986, was prepared by a working group on inflow design floods of
the Interagency Committee on Dam Safety (FEMA,
1986). For existing dams where failure could result in
loss of human life, extensive property damage, or serious social impacts, the suggestion was made to equate
the inflow design flood to the PMF. These guidelines

MANY DAMS WOULD OVERTOP DURING

A PROBABLE MAXIMUM FLOOD

Many existing dams would be overtopped by the

PMF because: (1) some dams were designed and

constructed before PMF concepts were fully developed, (2) some dams were designed using a flood
less than the PMF and, (3) some PMF estimates have
increased.
The National Program of Inspection of non-Federal
Dams was authorized by the National Dam Inspection

also suggested that Federal agencies could develop

JOURNAL OF THE AMERICAN WATER RESOURCES ASSOCIATION

955

JAWRA

Graham

Act (PL 92-367) in August 1972. In late 1977, the

Army Corps of Engineers began inspection of nonFederal dams that presented a high potential for loss
of life and property if they failed. "Early in the inspection program it became evident that very few existing

non-Federal dams in high hazard potential locations

have spiliways adequate to pass the PMF without

overtopping the dam. Hence, all but a few of the

dams inspected must be considered to have deficient
spillways" (emphasis added) (USAOCE, 1978).

If the full PMF had been retained as the safety

evaluation standard, most of the inspected non-Feder-

al dams would have been "unsafe." Criteria were

needed to distinguish between a deficient spiliway
that could not pass the PMF and an extremely inade-

quate spillway that represented a more immediate

safety problem. A flood equal to one-half the PMF
was adopted for such determinations. Dam inspectors
were told to consider a dam "unsafe" if: (1) the dam

would be overtopped by one-half the PMF, (2) the

overtopping had a reasonable probability of causing
dam failure, and (3) the dam failure would significantly increase the hazard of potential loss of life
downstream from the dam (USAOCE, 1978).

On September 30, 1981, the Corps completed its

non-Federal dam inspection program (Duscha, 1982).

Approximately 8,818 dams were inspected. Dams

selected for inspection were those that posed a high
potential for loss of life or property if they failed.
Approximately 33 percent of the inspected dams were
found to be "unsafe." Inadequate spillway and outlet
capacity (using one-half of the PMF as the evaluation
standard) was the primary deficiency at 81 percent of

the dams that were declared "unsafe." Therefore,

approximately 27 percent of the inspected dams

would be overtopped with a flood equal to one-half of

the PMF. Some of these "unsafe" dams have subsequently been removed or modified.

An article published in the Austin AmericanStatesman newspaper (Haurwitz and South, 1997)
contained information indicating that 49 percent of
the 817 high hazard dams in Texas could fail during
the PMF and 14 percent could fail during a flood half
the size of the PMF.

More than 65 percent of U.S. Bureau Reclamation

dams in Colorado would be overtopped by the PMF

There are no comprehensive or accurate estimates

of the costs to upgrade all U.S. dams that would fail

during the PMF. Lave et al. (1990) stated that

retrofitting dams for the PMF safety criterion would
cost in the tens of billions of dollars. The American
Society of Civil Engineers issued a "Report Card for
America's Infrastructure" in 1998 (ASCE, 1998). The
ASCE Report Card, based on a survey of Association
of State Dam Safety Officials members (ASDSO,
1998), suggested that 2,100 dams were unsafe and
rehabilitation of these dams would cost about $1 bil-

lion. Questioning the completeness of the Report

Card, the National Center for Performance of Dams
estimated that dam safety costs during the next 20
years would be approximately $1 billion annually
(McCann, 1998).

Much higher estimates can also be developed. The

1995-1996 National Inventory of Dams included

about 10,800 high hazard dams and 13,200 significant
hazard dams (FEMA, 1995-1996). Assuming that 50
percent of the high hazard dams and 80 percent of the
significant hazard dams require modifications of $10
million and $2 million, respectively, to adhere to PMF
design standards means that the total cost for modifications would be roughly $75 billion.

THE PMF DESIGN STANDARD

HAS BEEN CRITICIZED

The PMF design standard has been criticized. Federally owned Hyrum Dam in Utah provides a useful
example. In the late 1970s and early 1980s there were
plans to construct an auxiliary spiliway at a cost of
about $8 million. Local opposition to the project was
strong. The Hyrum City Council passed a resolution
on June 26, 1978 and sent it to Congress stating, "We
petition the Congress and Senate not to consider the

installation of the proposed safety feature as we

believe it to be an unnecessary expenditure and a
complete waste of our taxpayer's money." Congress
received opposition letters from citizens as well. This
opposition is instructive because it occurred just three

based on information contained in the 1997 Dam

Safety Information System (DSIS) database. Most of
these dams are 'high' hazard, meaning that the dams
are located such that failure would cause loss of life

or four years after the failure of Teton Dam and

despite the fact that the project would have been 100
percent federally funded. The proposal for this spill-

and/or excessive economic loss.

way modification project was withdrawn from the

Office of Management and Budget and the project

Based on the above information, it is reasonable to

assume that in 1999, most significant and high hazard non-Federal dams in the United States would be
overtopped using the latest calculated PMF at each
dam site.
JAWRA

COSTS TO MODIFY DAMS TO ACCOMMODATE

THE PROBABLE MAXIMUM FLOOD

remains inactive (USBR, 1988). An emergency

management program, consisting of mitigation, preparedness, response, and recovery action, has been
956

JOURNAL OF THE AMERICAN WATER RESOURCES ASSOCIATION

Should Dams Be Modified for the Probable Maximum Flood?

undertaken at the dam to save lives and property

have gone to "other causes of dam failure, to warning

which might be impacted by emergency incidents at

the dam.
Dam safety professionals and researchers have also
voiced their opposition or concern over the PMF standard. Benson (1964) reported evidence of "mounting

systems, protecting structures against earthquakes,

winds, and storm surges, to smoke alarms for residences, and many other safety measures." They state,
"Engineering judgment seems to have gone awry. A
benefit-cost test of retrofitting dams implies that virtually none of the retrofits was justified."
Dubler (1995) obtained opinions concerning certain
dam safety issues from the heads of state dam safety
units in nearly all of the 50 states. He found that 17
percent of dam professionals who responded believed

criticism of the subjective nature of hydrometeorological analysis and the ambiguous relation of the proba-

ble maximum precipitation and the concept of risk."

He did not advocate designing major dams to pass the
maximum computable flood.

Dawdy and Lettenmaier (1987) suggested that

more research be directed toward estimating the
probability of PMF-like floods. The allocation of
resources for improvement of flood passage requires
consideration of consequences of failure and the probability of failure. They state, "PMF-based methods
tend to lead to a false sense of security and to misallocation of resources for dam safety improvements."
Resendiz-Carrillo and Lave (1987) presented a procedure suggesting the balancing of the economic risks
from dam failure and the economic costs from a more
conservative design. The procedure was applied using
data from one site. They state, "Minimum social cost
is attained at a spiliway capacity much smaller than

that the PMF was an unreasonable design standard

but 75 percent of these professionals thought that the
public believed the PMF was an unreasonable design
standard.
Dubler and Grigg (1996) also criticized the use of
the PMF for spiliway design. Their criticism was
based on a review of the literature and on the opinion
survey from Dubler (1995). They stated that the profession and the public have neglected the need to have

a public debate on the cost-benefit question of

retrofitting existing dams. Risks exist and accidental
deaths occur; society must decide what portion of its

resources to allocate to reduce such deaths. They

state, "Spillway design flood criteria are extraordinarily conservative, resulting in what are probably many
instances of unjustified expenditures."
Lave and Balvanyos (1998) state that current safety criteria for high hazard dams focuses on protecting

that needed to handle a probably (sic) maximum

flood."

Resendiz-Carrillo and Lave (1990) evaluated dam

safety retrofits for a dam that was not able to pass the

the dam during a large flood. They suggest that the

criteria should focus on lowering property damage
and preventing flood deaths. They recommended that
dam professionals focus their attention on warning
systems to get people out of harms way. They state,
"Retrofitting existing dams that could pass a 'proba-

PMF. In the more than 50 years since the Mohawk

Dam was built, the spiliway was never used. Four dif-

ferent statistical distributions were used to estimate

the probability of extreme floods. A proposed retrofit
was expected to reduce annual flood damage by about

$50 per year or less than $1000 in present value

ble maximum flood' (PMF) when built is almost never

a good use of funds."
A PMP/PMF workshop held in 1990 included dis-

(using an interest rate of 6 percent and a useful life of

60 years). The cost (present value) of the retrofit was

$2 million. This resulted in a benefit-cost ratio of

0.0005 or $1 benefit for every $2,000 in cost. It was
stated that severe flooding would begin long before
dam failure and even skeptical individuals would recognize danger in time to evacuate. The least expensive means of enabling the dam to survive a PMF was
to raise the dam crest for about $2 million. However,
the final decision consisted of raising the dam and
widening the spiliway for more than $8 million. They
state, "Thus we conclude that retrofitting Mohawk

cussions indicating that some private dam owners

were convinced that the PMP and PMF standards
were not appropriate and some threatened to abandon their power plants and go under state regulation

Dam to survive a PMF made no sense."

Lave et al. (1990) prepared "Safety Goals for HighHazard Dams: Are Dams Too Safe?" a rather scathing
attack on the use of the PMF. They proposed a set of

is neither probable nor maximum; rather, it is an

to avoid Federal Energy Regulatory Commission reg-

ulations (FEMA, 1990). Other owners reportedly

"shopped around" for lower flood estimates. Leeway
exists regarding the selection of certain parameters
used in deriving extreme hydrologic events. "A PMF
engineering judgment about the largest flood at a particular site that should be considered for design purposes" (Lave et al., 1990). "Determining a PMF is art
as well as science" (Lave et al., 1990). "An issue jeopardizing the validity of PMPIPMF values is the ten-

safety goals for high-hazard dams. Implied within

these goals is that the PMF is not the optimal design
criterion. They suggested that the billions of dollars
that were spent in the 1980's to modify dams should
JOURNAL OF THE AMERICAN WATER RESOURCES ASSOCIATION

dency of too many individuals to calculate PMF

values according to what is more affordable for the
957

JAWRA

Graham

dam owner. . . individual dam owner's can meet their

(PMF) needs by shopping among experts for the low-

between future and current transactions. The interest

or discount rate used can be based on many considerations. In fiscal year 2000, the Federal discount rate
for use in plan formulation and evaluation is 6.625

est estimate"(FEMA, 1990).

percent. A rate of 5 percent is used in this paper

because it provides for a larger present value of future
benefits and 5 percent is the rate used by Tengs and

BASIS FOR CRITICISM OF PMF

DESIGN STANDARD

Graham (1996) in evaluating various life-saving

investments.

The cost to make all U.S. dams compliant with

PMF design criteria is estimated at approximately
$75 billion, or $3.8 billion in annual interest payments (using a discount rate of 5 percent and a 100
year payback period). Dam failure losses (from all
causes) are about $25 million annually (McCann,
1998). The potential benefit of $25 million per year
derived from preventing future dam failures is less

The major criticisms of using the full PMF for modifying dams, and the basis for the criticism, are as follows.

Spiliway Enlargements Can Increase Downstream

Flooding Resulting in an Increase in Average
Annual Flood Losses

than 1 percent of the annual interest costs associated

with retrofitting the entire dam inventory. The benefit-cost ratio is less than 0.01. Fixing all dams to pass

Most dam safety modifications, designed to eliminate hydrologic deficiencies, include increasing spillway capacity and/or strengthening or raising the dam.
Dam safety program managers may overlook the fact,

the PMF would be economically unsound.

or not be aware, that larger spillways can make

downstream flooding worse. Traditional thought

Dam Safety Modifications Could Cause Accidental

Deaths

assumes that a larger spillway produces a safer dam.

"Even ASCE (1973), when proposing risk analysis for
spiliway reevaluation, suggested that increasing spill-

Construction activities can and do kill and injure

people. There are two different ways to approach

way size always increases safety" (Langseth and

Perkins, 1984:207). "Results presented. . . show that

worker deaths in dam safety evaluations. One

approach is to ignore possible deaths because the job
one chooses, and the risk associated with the job, is
voluntary (unlike the risks posed by dam failure). In
addition, a worker not involved in a dam safety modification may be involved in an even more risky assign-

the interplay between damages resulting from overtopping failure of the dam and those associated with
successful passage of large floods can cause the total

expected damage to increase, decrease, or pass

through a minimum as the spillway size is increased.

The behavior depends on the whole system, the catchment, reservoir, dam, channel, and damage site, not
on just the spillway" (Langseth and Perkins, 1983).

ment. The second approach is to include possible

worker deaths in dam safety evaluations. To focus
"only on risk reduction achieved by a policy makes lit-

tle sense" (Viscusi, 1996). Lives saved by a policy

must be compared to the lives lost in implementing

Benefit-Cost Ratios Could be Low

the policy. "Policies that endanger our lives more than

they protect them should be rejected" (Viscusi, 1996).

Workers should not be involved in any activity that

claims more lives than it saves. If this line of thinking
prevailed not only within dam safety, but also outside

A point conveyed in nearly all of the professional

papers criticizing the PMF design policy was that

benefit-cost ratios of dam modifications were low.

dam safety, everyone would benefit.

Most of the literature failed to recognize the possibili-

The International Commission on Large Dams

ty of modifications causing an increase in average

indicated that "dam building worldwide causes several hundred job site deaths annually (and perhaps several thousands)" (ICOLD, 1989). They suggested that
"At most sites, the risk of fatal accidents to workmen
during construction is greater than the risk from dam

annual flood losses. For some mothfications, a benefit-

cost evaluation is meaningless because there are no

flood damage reduction benefits.

In comparing benefits and costs, it is necessary to

make comparisons of future costs and benefits with
those of today. One of the issues that arises is that
benefits received now or soon are worth more to people than the same benefits received later. An interest
or discount rate can be used to make comparisons
JAWRA

failure." In addition, they stated (emphasis is original): "overdesign may, in effect, increase rather than
reduce the risk to human life." The implication here is
clear: modifying a dam that already has a very small
chance of failure may increase overall risk to human
958

JOURNAL OF THE AMERICAN WATER RESOURCES ASSOCIATION

Should Dams Be Modified for the Probable Maximum Flood?

life. The statistical increase in fatal accidents from

construction may be larger than the statistical

decrease in life loss resulting from a safer dam.
Viscusi and Zeckhauser (1994) indicated that about

applied to proposed modifications to accommodate the

full PMF or floods smaller than the PMF. An interest
rate of 5 percent is suggested for converting between

present values and annual values. The reservoir

$690 million in U.S. construction industry output

inflow-frequency relationship can be determined by

would result in one fatality. This is equivalent to 0.14

drawing a straight line on log-probability graph

deaths per $100 million and appears reasonable to

use in estimating the life loss associated with dam

paper, connecting the 100-year flood discharge (or

paleo flood estimate) with the PMF which has an

modification construction.
The expenditure of $75 billion to correct hydrologic

deficiencies at U.S. dams would result in the loss of

about 105 lives as a result of construction related
accidents. An average of less than three people per
year have died in the U.S. from dam failures caused

assumed annual probability of one in 1 million (NRC,

1985). Flood losses and life loss should be determined
for a full range of flood loadings (i.e., those that cause
dam failure as well as those that do not cause failure).
Procedures for estimating loss of life caused by dam
failure are available (Graham, 1999b). The steps are

by overtopping. Projecting this same dam failure

as follows.

fatality rate into the future, the present value of lives

saved by preventing future dam failures is about 60
(using a discount rate of 5 percent). Fixing all dams to

For the Status quo, compute:

pass the PMF would result in a net loss of lives

1. Annualized Economic loss caused by flooding,

Es, (dollars).
2. Annualized Life loss caused by flooding, Ls,

assuming construction deaths would all occur in the

next few years.

(number of lives).

For each Modification designed to reduce or eliminate dam failure, compute:

The Cost-Per-Life-Saved is High

The amount of money expended in the U.S. to

reduce risk varies over a wide range. The amount
expended depends on many factors, not the least of

1. Annualized Cost of the modification, CM, (dollars).

2. Annualized Economic loss caused by flooding,

which are whether the risks are voluntary or involuntary, within one's control, common or dreaded, etc.
The cost-per-life-saved in many dam safety modifications is high, sometimes exceeding $1 billion.
Tengs and Graham (1996) estimated that a more
rational allocation of resources in the United States
could save 60,000 more lives annually than are currently being saved, at no increased cost to the taxpay-

EM, (dollars).
3. Annualized Life loss caused by flooding, LM,
(number of lives).

4. Life loss from Construction spending (0.14 lives

per $100 million expended) and convert to annualized value, Lc, (number of lives).
5. Economic Benefits derived from modification,
EB, where EB = Es - EM (dollars).

er or private sector. "How can policy makers make

decisions so that we might save more lives at less
expense? The good news is that fancy mathematical
programming techniques are not needed to achieve

6. Life Benefits derived from modification, LB,

where LB = L5 - LM - Lc (number of lives saved).

Table 2 provides recommended action to take on a

proposed modification based on the calculated values
of economic benefits (EB), life benefits (LB), and cost
(CM). Frequently, a cost-per-life-saved will need to be
computed, and infrequently, a benefit-per-life-lost will
need to be computed.
Cost-per-life-saved, used when LB is positive, and
benefit-per-life-lost, used when LB is negative, can be
computed using the parameter (CM - EB)/LB. Costper-life-saved is a very useful, although controversial,
measure. It is not meant to imply the value of life but
rather the cost to save a statistical life. The economic
benefits of a proposed dam safety modification will
rarely exceed the cost therefore generally eliminating

the optimal portfolio. The following rule of thumb, ele-

gant in its simplicity, will achieve the same results:

Invest in all interventions costing less than some

threshold (for example, $5 million per life saved) and
in none of the interventions costing more" (Tengs and
Graham, 1996).

A PROCEDURE FOR EVALUATING

PROPOSED DAM MODIFICATIONS

The steps involved in determining if a proposed

modification is sound from an economic, as well as life
loss basis, are presented below. The procedure can be
JOURNAL OF THE AMERICAN WATER RESOURCES ASSOCIATION

the need to compute benefit-per-life-lost. Based on

available information on risk-reduction in the United
959

JAWRA

Graham
TABLE 2. Recommended Action on a Proposed Modification.

EB

L8

Action

Basis for Action or Additional Computation Required

Reject

Flood damage and deaths both increase.

o to CM

Reject

Flood damage reduction benefit is less than cost; deaths

increase.

<CM

Compute

Compute Cost-Per-Life-Saved.

CM

Compute

Compute Benefit-Per-Life-Lost.

CM

Accept

Justified on flood damage reduction alone.

States (Tengs and Graham, 1996), a logical rule would

be to reject a modification if the cost-per-life-saved is
greater than $5 million or if the benefit-per-life-lost is
less than $5 million.

if overtopped by one foot and not fail with lesser overtopping. Note that floods less than about the 700-year

event would cause no damage downstream from the

dam with the existing dam or with the spillway/dam
raise alternative in place. Loss of life, not shown in
Table 3, was assumed to be 1000 out of the approxi-

mate 100,000 people located in the dam failure

floodplain (Graham, 1999). Every year there is

AN EXAMPLE

approximately one chance in 286,000 that the dam

would fail from overtopping. The loss of life in any

A large flood control dam in Colorado is being studied by the owner because the dam is unable to accom-

year will either be zero (the dam doesn't fail) or 1,000

(the dam does fail). Ls is therefore 0.004. As shown in

modate the PMF without overtopping. The dam is

used to demonstrate application of the above proce-

Table 3, the spillway/dam raise alternative would

result in significant economic damage with reservoir
inflows of as little as 15 percent of the PMF. Surely,
loss of life would occur from the large outflows capable of passing through the new spillway. The annualized loss of life from floothng, LM, can be determined

dure. The dam, fictitiously named Colorado Dam, was

completed in 1950, has a length of 2.7 miles and a

height of 140 feet. The recreational pool level is about

95 feet below the dam crest. The highest reservoir

level reached since construction was 79 feet below the
dam crest and 43 feet below the spillway sill.
In 1993, the owner prepared a Hydrologic Improvement Assessment Reconnaissance Report containing

in the same way that annualized economic losses

were determined. To demonstrate the procedure, LM
is assigned a value of 0.003. Table 4 includes a summary of annualized values associated with the status
quo and the spillway/dam raise alternative using the
recommended procedure.
The data presented in Table 4 shows that the economic benefit derived from the modification alterna-

information on several alternatives designed to prevent dam failure during the PMF. One of the alternatives called for the construction of a new spillway
combined with a nine-foot dam raise at a cost of about
$31 million. The new 200-foot wide spillway would
have a sill about 45 feet below the dam crest. Infor-

tive is negative. The annualized flood damage

mation on this dam was obtained from the 1993

downstream from the existing dam is $23,900 and

report and by attending public meetings and presentations made by the dam owner from 1997 through

jumps to about 20 times as much, $502,900, with the

spillway/dam raise alternative. (The 1993 report indicates that the dam provides annual flood control benefits of $21 million, so the annualized flood damage
with the new spillway alternative would still be far
less than if the dam were removed.) When life loss
from construction is included, LB is negative. Not only
does the new spillway greatly increase average annual flood damage, it also increases the potential number of deaths. This modification would be rejected
using the recommended guidance shown in Table 2. If
construction fatalities were not considered, this alternative would save 0.001 lives per year. The cost-per-

1999.

To evaluate the benefits and costs of the status quo

and the spiliway/dam raise alternative, a dischargefrequency curve was developed assuming that the
PMF has one chance in one million of occurring per
year (NRC, 1985). The 1993 report contained flood
damage versus reservoir inflow estimates for the status quo as well as for the spiliway/dam raise alternative. Table 3 contains estimates of annualized flood
damage based on the damage-flood frequency relationship, and the assumption that the dam would fail
JAWRA

960

JOURNAL OF THE AMERICAN WATER RESOURCES ASSOCIATION

Should Dams Be Modified for the Probable Maximum Flood?

TABLE 3. Colorado Dam Summary of Flood Damage With and Without a New Spiliway/Dam Raise

Flood Size:
Inflow to Reservoir
(cubic feet
(percent
of PMF)
per second)

Probability
of
Flood of
This Size

(per year)

Flood of
This Size
(per year)

and Reservoir
Annualized
Damage
Damage

After Construction of
Left Abutment Spiliway
and Dam Raise
Annualized
Damage
Damage

Chance

of

Existing Dam, Spillway,

0 to 15

0 to 99,000

0.9985

1 in 1.0015

$0

$0

$0

$0

15 to 25

99,000 to 166,000

0.0012

1 in 833

$0

$0

$0.2 Billion

$240,000

25 to 50

166,000 to 331,000

0.00028

1 in 3,600

$04 Billion

$11,200

$0.82 Billion

$229,000

50 to 75

331,000 to 497,000

0.000017

1 in 58,800

$0.1 Biffion

$1,700

$1.57 Billion

$26,700

75 to 100

497,000 to 662,700

0.0000035

1 in 286,000

$3.14 Billion

$11,000

$1.88 Billion

$6,600

1.0

1 in 1

TOTAL

$502,900

$23,900

TABLE 4. Summary of Annualized Values for Status Quo and New SpillwaylDam Raise.

Alternative
Measurement

Status Quo

New Spiliway Combined With Dam Raise

Life Loss Caused by Flooding

Ls = 0.004

LM = 0.003

Life Loss From Construction Spending

L = 0.0

L = 0.002

Life Benefits Derived From the Alternative

LB = -0.001

Cost of Alternative

$0

CM = $1,550,000

Economic Loss Caused by Flooding

E5 = $23,900

EM = $502,900

Economic Benefit Derived From the Modification Alternative

EB = $-479,000

(Note the negative sign)

property downstream from the dam during the PMF

is greater with dam failure than without dam failure
(FEMA, 1998). Some dams were not designed using
the PMF and at others the PMF has increased. Thousands of dams in the U.S. are subject to overtopping
and possible failure if the current PMF were to occur.
However, very few people are dying in the U.S. from

life-saved would be about $2 billion and this alternative would again be rejected using the recommended
procedure. If construction fatalities were not considered and if no deaths occur from spiliway outflows,
the cost-per-life-saved would be about $500 million,

and again rejected. Annualized damages are much

greater for the spiliway/dam raise alternative than for
the existing conditions because, as the owner reported, "A new concrete spiliway chute . . . would release
catastrophic floods . . . for a range of flood events that

dam failures caused by overtopping.

Because motor vehicles serve as the primary mode
of travel in the U.S., it is interesting to compare losses caused by dam failure with losses caused by motor
vehicle accidents. Dam failures caused by overtopping

are now controlled without downstream damage."

However, the peak outflow from the dam would still

result in an average of about 0.0001 deaths per year

per dam based on the 24,000 significant and high hazard dams in the U.S. Motor vehicle accidents cause

be less than the peak inflow for all inflows. The owner

has not yet recommended a course of action at this

dam.

about 0.0002 deaths per year for each registered

motor vehicle in the U.S. (U.S. Bureau of the Census,

1998). Therefore, an average dam is causing (from

dam failure) only half as many deaths as the average
motor vehicle (from accidents). Based on this compari-

DISCUSSION

son, U.S. dams do not appear to be a significant

Current Federal Guidelines suggest, and the laws

of many states require, that dams are capable of withstanding the PMF in cases where danger to life and
JOURNAL OF THE AMERICAN WATER RESOURCES ASSOCIATION

threat to people living downstream.

961

JAWRA

Graham

The policy of modifying dams to accommodate the

"All lifesaving measures sound good . . . Lifesaving measures vary enormously in their effective-

PMF has existed for a long time, in part, because it

reduces the need to make difficult decisions. With
issues of legal and personal liability looming, there
are many people who are reluctant to deviate from

ness, in their cost, and in their ratio of

effectiveness to cost . . . People who advocate or

fund one lifesaving measure often have no idea

how cost-effective that measure is compared to
other feasible lifesaving investments. When lives
are at stake, we believe it is particularly important to expend resources wisely. To do otherwise
is to engage in what we call "statistical murder"
a
phrase meant (with provocative intent) to
protect the interests of anonymous people whose
lives are lost when cost-effectiveness considerations are ignored" (Graham, 1999a).

the existing policy. Dam professionals do not want to

be associated with the failure of a major dam that

causes death and destruction. Some of this hesitation
or reluctance to accept the risk of dam failure can be

alleviated with nonstructural actions. Implementation or adoption of warning systems or plans to follow
in a flood emergency can significantly reduce life loss
from large spillway flows or dam failure.

A modification done in the name of dam safety

CONCLUSIONS

sounds good on the surface, but are resources wisely

spent when dams are modified for the PMF?

This paper presents a procedure for evaluating a

proposed dam modification to accommodate the PMF

or a flood less than the PMF. A modification can

RECOMMENDATION

reduce economic losses from dam failure, but can also

increase economic losses due to larger non-failure

spillway flows. A modification can result in a net
increase or decrease in lives lost. The procedure provides a method for reaching decisions based on the

The policy requiring dams to be modified for the

PMF needs to be abandoned. A new policy should be
developed and it should be based on a consideration of
positive as well as negative consequences associated
with dam modification. The policy should be based on
net changes in annualized economic benefits and life
benefits. It will sometimes be necessary to determine
if a modification is cost-effective in saving lives. The
procedure contained in this paper can form the foun-

net changes in annualized economic benefits and life

benefits. Inherent in using the procedure, is the need
to estimate the probability of various flood loadings,
dam response, and downstream consequences. The

return period for the PMF is uncertain as is dam

response to various flood loadings. The flooding
caused by spiliway releases or dam failure results in
economic damage and loss of life that can only be estimated. The procedure can be used with a range of
estimates for flood loading, dam response and conse-

dation for new policy.

ACKNOWLEDGMENTS

quences to determine the sensitivity of results to

My heartfelt thanks go to many friends and colleagues at the

changes in these parameters.

Modifying dams for the PMF can result in waste.
A dam modified to accommodate the PMF without
failure can result in a net loss of statistical lives and a
net increase in annualized flood damage. Perhaps the

Bureau of Reclamation who provided comments and suggestions on

early drafts of the manuscript. I am especially thankful for the

insightful comments and suggestions received from the three
anonymous reviewers. Their encouragement and recognition of the
importance of the paper's conclusion was stimulating.

example used in this paper was an anomaly, but it

closely mirrors a real situation. It demonstrates that
additional spillway capacity, while preventing dam

LITERATURE CITED

failure if the PMF occurs, can have very serious negative consequences. Additional spillway capacity is frequently chosen by itself or in combination with a dam

Ad Hoc Interagency Committee on Dam Safety of the Federal Coordinating Council for Science, Engineering and Thchnology, 1979.
Federal Guidelines for Dam Safety. Washington, D.C.

raise to bring a dam into compliance with existing

ASCE, 1973. ASCE Task Committee on the Reevaluation of the

Adequacy of Spillways of Existing Dams of the Committee on
Hydrometeorology of the Hydraulics Division. Reevaluating
Spifiway Capacity at Existing Dams. Journal of the Hydrau1ic

policy and law. At some "unsafe" dams, accepting the

status quo (i.e., doing nothing) may be the best course
of action.

There are important reasons why dams that

Division, ASCE 99(HY2):337-372.

ASCE, 1988. ASCE Task Committee on Spiliway Design Flood

already have a very low probability of failure should

not be fixed. John Graham from the Harvard Center
for Risk Analysis writes:
JAWRA

Selection of the Committee on Surface Water Hydrology of the

Hydraulics Division. Evaluation Procedures for Hydrologic Safety of Dams. ASCE, New York, New York, 95 pp.

962

JOURNAL OF THE AMERICAN WATER RESOURCES ASSOCIATION

Should Dams Be Modified for the Probable Maximum Flood?

ASCE, 1998. ASCE 1998 Report Card for America's Infrastructure.

Available on ASCE's website www.asce.org/govnpub/start.html.
ASDSO (Association of State Dam Safety Officials), 1998. Newsletter (March/April). ASCE Report Card. Association of State Dam
Safety Officials, Lexington, Kentucky.

NRC, 1985. National Research Council, Committee on Safety Crite-

ria for Dams. Safety of Dams: Flood and Earthquake Criteria.

National Academy Press, Washington, D.C., 321 pp.

Resendiz-Carrillo, Daniel and Lester B. Lave, 1987. Optimizing

Spillway Capacity With an Estimated Distribution of Floods.

Benson, Manuel A., 1964. Discussion of Hydrology of Spiliway

Water Resources Research 23(11):2043-2049.

Design: Large Structures-Adequate Data. Journal of the

Resendiz-Carrillo, Daniel and Lester B. Lave, 1990. Evaluating

Dam Safety Retrofits With Uncertain Benefits: The Case of
Mohawk Dam (Waihonding River, Ohio). Water Resources

Hydraulics Division, ASCE 90(HY5):297.

Buehler, Bob J., 1997. Hurrah for 'Risk Management,' Readers

Write. Civil Engineering, p.29.
Dawdy, David R. and Dennis Lettenmaier, 1987. Initiative for Risk-

Research 26(5):1093-1098.

Snyder, Franklin F., 1964. Hydrology of Spillway Design: Large

Structures-Adequate Data. Journal of the Hydraulics Division,

Based Design. Journal of Hydraulic Engineering, ASCE

113(8): 1041-1051.

ASCE 90(HY3):239-259.

Tengs, Tammy 0. and John D. Graham, 1996. The Opportunity

Costs of Haphazard Social Investments in Life-Saving. In:
Risks, Costs and Lives Saved Getting Better Results from

Dubler, James Roger, 1995. Dam Safety Policy for Spiiway Design

Floods, Master's Thesis, Civil Engineering Department, Colorado State University, Fort Collins, Colorado.

Dubler, James R. and Neil S. Grigg, 1996. Dam Safety Policy for
Spiiway Design Floods. Journal of Professional Issues in Engi-

Regulation, Robert W. Hahn, (Editor). Oxford University Press,

New York, and Oxford, Washington, D.C., p. 178.

neering Education and Practice, ASCE 122(4):163-169.

Duscha, Lloyd A., 1982. Dam Safety: U.S. Army Corps of Engineers

USAOCE, 1978. U.S. Army Office of the Chief of Engineers: A

Report to the President, Inspection of Non-Federal Dams, First
Year's Progress, Vol. 1. Department of the Army Office of the

Completes Non-Federal Dam Inspection Program. In: FEMA

FORUM, Federal Emergency Management Agency, Washington,
D.C.

Chief of Engineers, Washington, D.C., 28 pp.

USCOLD, 1970. Committee on "Failures and Accidents to Large

Dams, Other Than in Connection With the Foundation." Criteria and Practices Utilized in Determining the Required Capacity

FEMA, 1986. Federal Emergency Management Agency, State and

Local Programs and Support Directorate, Interagency Committee on Dam Safety, January 1986. Federal Guidelines for Selecting and Accommodating Inflow Design Floods for Dams, FEMA

of Spifiways as Reported by 21 United States Engineering Orga-

nizations. U.S. Committee on Large Dams, New York, New

94.

York.

USBR (U.S. Bureau of Reclamation), 1988. Memorandum, May 13,

1988, Hydrologic Safety for Hyrum Dam Hyrum Project, Utah.
Salt Lake City, Utah.
U.S. Bureau of the Census, 1998. Statistical Abstract of the United
States, 118th Edition, Tables 1029 and 1043, Washington, D.C.
Viscusi, W. Kip and Richard J. Zeckhauser, 1994. The Fatality and

FEMA, 1990. Federal Emergency Management Agency, May 1-4,

1990. Proceedings of Probable Maximum Precipitation and

Probable Maximum Flood Workshop, Berkeley Springs, West

Virginia, 25 pp.
FEMA, 1995-1996. Federal Emergency Management Agency, Water

Control Infrastructure: National Inventory of Dams, Updated

data. Prepared in cooperation with the U.S. Army Corps of

Injury Cost of Expenditures. Journal of Risk and Uncertainty

Engineers, CD-ROM.
FEMA, 1998. Federal Emergency Management Agency, Mitigation

8: 19-41.

Viscusi, W. Kip, 1996. The Dangers of Unbounded Commitments to

Regulate Risk. In: Risks, Costs and Lives Saved Getting Bet-

Directorate, Interagency Committee on Dam Safety, October

1998. Federal Guidelines for Dam Safety: Selecting and Accommodating Inflow Design Floods for Dams, FEMA 94.
Graham, John D., 1999a. An Investor's Look at Life-Saving Oppor-

ter Results from Regulation, Robert W. Hahn (Editor). Oxford

University Press, New York, and Oxford, Washington, D.C. , pp.
162-163.

tunities. Risk in Perspective, Harvard Center for Risk Analysis,

Wood, Richard A., 1997. Flood/Flash Flood Fatalities 1960

through 1996; United States, Puerto Rico and the Virgin

7(1).

Graham, Wayne J., 1999b. A Procedure for Estimating Loss of Life

Islands. In: Storm Data, National Oceanic and Atmospheric

Caused by Dam Failure. DSO-99-06, Bureau of Reclamation,

Administration 39(1): 140.

Dam Safety Office, Denver, Colorado, 44pp. (available at

www.usbr.gov/dsis/research/documentsldso-99-06.pdfl.

Haurwitz, Ralph and Jeff South, 1997. Texas Dams Hold Deadly
Threat: With Inspection a Rarity, Hundreds Might Fail in Worst
Storms. Austin ATnerican-Statesman (May 18). Austin, Texas, p.
1.

ICOLD, 1989. Savings in Dam Construction: Comments and Proposals. Bulletin 73, International Commission on Large Dams,
Paris, France.
Langseth, David E. and Frank E. Perkins, 1983. The Influence of
Dam Failure Probabilities on Spillway Analysis. Summer 1983
ASCE Hydraulics Conference.
Langseth, David E. and Frank E. Perkins, 1984. Spillway Analysis
in Dam Safety Evaluation. Report No. 298, Department of Civil
Engineering, MIT, Cambridge, Massachusetts, 310 pp.
Lave, Lester B. et al., 1990. Safety Goals for High-Hazard Dams:
Are Dams Too Safe? Water Resources Research 26(7):1383-1391.

Lave, Lester B. and Tunde Balvanyos, 1998. Risk Analysis and

Management of Dam Safety. Risk Analysis 18(4):455-462.
McCann, Martin W, 1998. Tales and Lessons Behind a Dam Safety
News Story. USCOLD Newsletter, Denver, Colorado, Issue No.
114.
JOURNAL OF THE AMERICAN WATER RESOURCES ASSOCIATION

963

JAWRA