《1. Introduction》

1. Introduction

The basic element in any sustainable structure or infrastructure project is safety. Therefore, for sustainable storage dams, the emphasis must be on the long-term safety of the dam. Today, dam safety requires an integral safety concept, which comprises the following elements:

•Structural safety;

•Dam safety monitoring;

•Operational safety and maintenance; and

•Emergency planning.

Long-term safety primarily includes the analysis of all hazards affecting the project; that is, hazards from the natural environment, hazards from the man-made environment, and project-specific and site-specific hazards. This paper discusses the special features of the seismic safety of dams, as the structural safety of large storage dams today is often governed by the earthquake load case.

For large dam projects, a site-specific seismic hazard analysis is usually recommended. These analyses are carried out by seismologists. It is important that the dam engineer, who is the end user of the results of seismic hazard analyses, clearly specifies what he or she needs, as seismologists are not familiar with the seismic safety concepts used in dam engineering. Today, large dams and the safety-relevant elements used for controlling the reservoir after a strong earthquake (such as the gates of gated spillways and the gates of bottom outlets) must be able to withstand the ground motions of the safety evaluation earthquake (SEE). The SEE ground motion parameters can be determined either by a probabilistic seismic hazard analysis (PSHA) or by a deterministic analysis in which worst-case earthquake scenarios are considered. During the SEE, inelastic deformations may occur in a dam; therefore, the seismic analysis must be carried out in the time domain. In general, seismologists provide response spectra or uniform hazard spectra as the result of their seismic hazard studies, but acceleration time histories are needed for the inelastic analysis of large dams. In addition, earthquakes create multiple seismic hazards for dams such as ground shaking, fault movements, mass movements, and other project-specific and site-specific hazards. Reservoir-triggered seismicity (RTS) may also have to be considered.

The ground motions needed by the dam engineer—that is, mainly the acceleration time histories—are not real earthquake ground motions but models of the ground motion, which allow the safe design of dams.

Furthermore, it must be kept in mind that dam safety evaluations have to be carried out several times during the long life of large storage dams.

The state-of-practice in the seismic analysis and design of dams is documented in the bulletins and guidelines [1–5] prepared by the Committee on Seismic Aspects of Dam Design of the International Commission on Large Dams (ICOLD). These are:

•Bulletin 112: Neotectonics and dams [1];

•Bulletin 120: Design features of dams to effectively resist seismic ground motion [2];

•Bulletin 123: Earthquake design and evaluation of structures appurtenant to dams [3];

•Bulletin 137: Reservoirs and seismicity—state of knowledge [4]; and

•Bulletin 148: Selecting seismic parameters for large dams [5].

Bulletins 112 and 137 are concerned with dams on faults and with RTS, respectively; that is, with special features of seismic hazard for dams. Bulletins 120 and 123 provide guidelines on seismic design concepts and constructional features for the seismic design of a dam, which will perform satisfactorily during strong earthquakes. Bulletin 148 provides updated seismic design guidelines for dams, safety-relevant elements, and appurtenant structures.

The safety-relevant elements are spillway gates and bottom outlets, which must function after an earthquake in order to control the water level in the reservoir and, in the case of damage, to lower the reservoir so that the dam can be repaired and/or strengthened.

The current paper is based on publications prepared by the ICOLD Committee on Seismic Aspects of Dam Design [1–5] and on papers published by the author [6–9]. It provides an overview of seismic hazard, seismic design and performance criteria, seismic safety of existing dams, and sustainability of large storage dams.

《2. Seismic hazard》

2. Seismic hazard

An earthquake hazard is a multi-hazard, which includes the following main hazards for a large dam project [9]:

•Ground shaking;

•Movements along faults or discontinuities in the footprint of the dam and/or the reservoir;

•Mass movements into the reservoir causing impulse waves and increase in reservoir level, damaging transmission lines, blocking access roads, and so forth; and

•Project-specific and site-specific hazards (i.e., ground deformations, seepage, liquefaction, etc.).

Ground shaking is usually considered to be the main seismic hazard. However, movements in the footprint of a concrete dam are more critical than ground shaking, as any such movements would, for example, cause a complicated crack pattern in highly statically indeterminate arch dams, which cannot be reliably predicted by numerical models. The dynamic behavior of the dam would become very complex, as cracking in the dam due to foundation movement and ground shaking would occur at the same time. Therefore, the possibility of foundation movements must be studied carefully. Even if no seismogenic fault crosses the dam foundation, a strong earthquake at a nearby fault can cause movements along discontinuities in the footprint of a dam. These discontinuities are faults, shear zones, fissures, joints, and bedding planes. Such movements are hard to estimate because they depend on the site conditions, the distance from the seismically active fault, and its maximum surface movement. Some faults may also splay near the surface and reactivate discontinuities.

Conservatively designed earth core rockfill dams can cope with such movements, whereas arch dams will be very vulnerable to them. Therefore, if there is doubt regarding the possibility of fault movements, a conservatively designed earth core rockfill dam is the appropriate solution [1,2].

Mass movements into the reservoir would create impulse waves, which may overtop the dam crest. Here, concrete dams would be more suitable than embankment dams in order to resist limited overtopping. However, with an ample freeboard, a wide dam crest, and/or an upstream parapet or wave wall, this overtopping hazard can be reduced or even eliminated.

Moreover, mass movements in the reservoir region will increase the sediment volume in the reservoir and may block the bottom outlet. However, this will usually happen in the months or years after an earthquake, leaving time for remedial action.

Rockfalls in mountainous regions could damage transmission towers, which would lead to the automatic shut-down of the power plant. However, a more critical issue would be rockfall damage of the gate control structures, equipment, emergency power generators, control units, and so forth needed for the operation of the gates of spillways and bottom outlets. These gates have to be operable after a strong earthquake because it must be possible to control or lower the reservoir and release a moderate flood after a strong earthquake. Again, if these gates are blocked, it would lead to overtopping of the dam crest, which would be a much more serious safety problem for embankment dams than for concrete dams.

Therefore, it can be concluded that input is needed from seismologists and geologists on ① ground shaking, ② movements in the footprint of a dam (this is most important if a monolithic concrete dam is planned), and ③ critical slopes in the dam and reservoir region.

Usually, seismic hazard analyses are only concerned with the estimation of ground motion parameters such as peak ground acceleration (PGA) and response spectra. Ground motion parameters can be determined by a probabilistic and/or deterministic seismic hazard analysis, as discussed by Wieland [9] and ICOLD Bulletin 148 [5]. Accordingly, the dam body and the safety-relevant elements must be able to withstand the ground motion of the SEE with a return period of 10 000 years (probabilistic analysis) or the ground motions from worst-case earthquake scenarios (deterministic analysis). In the probabilistic analysis, the mean values of the ground motion parameters shall be used, whereas in the deterministic analysis, the mean-plus-one sigma values are used. If both a probabilistic and deterministic analyses are done—which is recommended—the maximum values of the ground motion parameters shall be used.

As RTS was observed in over 100 large storage dams [4], it is also necessary for the seismologist to address this hazard and to define possible scenarios, although this task is probably as difficult as earthquake prediction. RTS is generally not a dam safety problem, as dams are designed for the worst ground motion at the site. However, it may affect buildings and infrastructure projects in the dam and reservoir region that are designed for lower seismic hazard values than dams. Moreover, frequent noise from moderate magnitude events may disturb people.

《3. Seismic design criteria》

3. Seismic design criteria

The following design earthquakes are needed for the seismic design of the different structures and elements of a large dam project [5,9]:

(1) Safety evaluation earthquake (SEE): The SEE is the earthquake ground motion a dam must be able to resist without the uncontrolled release of the reservoir. The SEE is the governing earthquake ground motion for the safety assessment and seismic design of the dam and safety-relevant components, which have to be functioning after the SEE.

(2) Design basis earthquake (DBE): The DBE, with a return period of 475 years, is used in many countries. It is the reference design earthquake for the appurtenant structures. The DBE ground motion parameters are estimated based on a PSHA. The mean values of the ground motion parameters of the DBE can be taken. (Note: The return period of the DBE may be determined in accordance with the earthquake codes and regulations for buildings and bridges in the project region.)

(3) Operating basis earthquake (OBE): The OBE may be expected to occur during the lifetime of the dam. No damage or loss of service must happen. It has a probability of occurrence of about 50% during a service life of 100 years. The return period is taken as 145 years [5]. The OBE ground motion parameters are estimated based on a PSHA. The mean values of the ground motion parameters of the OBE can be taken.

(4) Construction earthquake (CE): The CE is to be used for the design of temporary structures such as coffer dams and takes into account the service life of the temporary structure. There are different methods to calculate this design earthquake. For the temporary diversion facilities, a probability of exceedance of 10% is assumed for the design life span of the diversion facilities. Alternatively, the return period of the CE of the diversion facilities may be taken as that of the design flood of the river diversion.

The SEE ground motion can be obtained from a probabilistic and/or a deterministic seismic hazard analysis:

(1) Maximum credible earthquake (MCE): The MCE is the event that produces the largest ground motion expected at the dam site on the basis of the seismic history and the seismotectonic setup in the region. It is estimated based on deterministic earthquake scenarios. According to ICOLD [5] the ground motion parameters of the MCE shall be taken as the 84 percentiles (mean-plus-one standard deviation).

(2) Maximum design earthquake (MDE): For large dams, the return period of the MDE is taken as 10 000 years. For dams with small or limited damage potential, shorter return periods can be specified. The MDE ground motion parameters are estimated based on a PSHA. According to ICOLD [5], the mean values of the ground motion parameters of the MDE shall be taken. In a case where a single seismic source (fault) mainly contributes to the seismic hazard, uniform hazard spectra can be used for the seismic design. Otherwise, based on the deaggregation of the seismic hazard (magnitude vs. focal distance), different scenario earthquakes may be defined.

For major dams, the SEE can be taken either as the MCE or MDE ground motions. Usually, the most unfavorable ground motion parameters of these two earthquakes must be taken. If it is not possible to make a realistic assessment of the MCE, then the SEE shall be at least equal to the MDE. Accordingly, there is no difference in performance criteria for MDE, MCE, and SEE.

MDE, DBE, OBE, and CE ground motion parameters are usually determined by a probabilistic approach (mean values of ground motion parameters are recommended), while for the MCE, ground motion deterministic earthquake scenarios are used (84 percentile values of ground motion parameters shall be used). However, for the MDE, DBE, OBE, and CE, deterministic scenarios may also be defined.

The different design earthquakes are characterized by the following seismic parameters:

•The PGA of horizontal and vertical earthquake components;

•The acceleration response spectra of horizontal and vertical earthquake components, typically for 5% damping—that is, uniform hazard spectra for CE, OBE, DBE, and MDE, obtained from the PSHA (mean values), and 84 percentile values of acceleration spectra for MCE, obtained from the deterministic analysis using different attenuation models; and

•Spectrum-matched acceleration time histories for the horizontal and vertical components of the MCE ground motion, determined either from a random process or by the scaling of recorded earthquake ground motions. The artificially generated acceleration time histories of the horizontal and vertical earthquake components shall be stochastically independent. To account for aftershocks, it is recommended to increase the duration of strong ground shaking.

In case of fault movements, similar estimates are required as for the ground shaking. It appears that it is quite difficult for the dam designer to obtain quantitative estimates of fault movements for the different types of design earthquakes because the seismic hazard analyses are mainly concerned with ground shaking.

For underground structures where the effects of imposed deformations are more relevant than inertial effects, the displacement ground motion parameters or displacement time histories of the different design earthquakes are also needed.

The best description of the ground motion is by means of the acceleration time histories, which are needed for any nonlinear dynamic analysis of dams and components. It is also expected that inelastic deformations take place under the SEE ground motion. According to ICOLD [5], the following aspects of the “design acceleration time history” should be considered:

(1) The three components of the spectrum-matched acceleration time histories must be statistically independent.

(2) The acceleration time histories of the horizontal earthquake components may be assumed to act in along-river and across-river directions. No modifications in the horizontal earthquake components are needed if they are applied to other directions.

(3) The duration of strong ground shaking shall be selected in such a way that aftershocks are also covered; that is, records with a long duration of strong ground shaking shall be selected.

(4) For dams that are susceptible to damage processes that are governed by the duration of strong ground shaking, such as the build-up of pore pressures, earthquake records with a long duration of strong ground shaking shall be used. The duration of strong ground shaking depends on the magnitudes of the worst-case earthquake scenarios for a particular dam site. Empirical relations or recommendations in seismic codes or guidelines may be used as a reference.

(5) For the safety check of a dam, at least three different earthquakes shall be considered for the SEE ground motion.

Recorded or synthetic acceleration time histories may be used as an input for spectrum-matching. Synthetic records can be obtained by different methods. However, there is no real need to focus on this aspect for the dam design, as the spectrum-matched acceleration time histories with extended duration of strong ground shaking that are used for the seismic analysis and design of the dams may be quite different from real ones. Their use will, however, lead to a safe design, although seismologists and other experts who are not familiar with the seismic design of dams may find this difficult to understand or accept.

In this context, it should be mentioned that in the design of any structure, including large dams, the designer will use simplified load and analysis models that lead to a safe design, even if the load model does not comply with the real nature of the hazard; the same applies to the earthquake hazard and earthquake ground motion.

For some dams, an additional earthquake load case was defined for RTS or reservoir-induced seismicity (RIS). (Note that the term “reservoir-induced seismicity,” which has often been used in the past, is incorrect because reservoirs cannot induce earthquakes; however, they can trigger earthquakes. Therefore, the correct technical term is “reservoir-triggered seismicity.”) RTS has been observed in over 100 reservoirs, generally with a water depth of over 100 m. The largest magnitudes of RTS events reached a value of 6.3; however, in most cases, the magnitudes of these shallow-focus events were much smaller. If RTS is possible or expected in a large dam project, then the DBE and OBE ground motion parameters should cover those from the assumed RTS scenarios, as such events are expected to occur within a few years after the start of the impounding of the reservoir [4].

《4. Seismic performance criteria》

4. Seismic performance criteria

The rather general performance criteria for the dam body and safety-relevant components and equipment that are given in Ref. [5] can be interpreted as follows [9]:

(1) Performance of the dam body during OBE: No structural damage (cracks, deformations, leakage, etc.) that affects the operation of the dam and the reservoir is permitted. Minor repairable damage is acceptable.

(2) Performance of the dam body during SEE: Structural damage (cracks, deformations, leakage, etc.) is acceptable as long as the stability of the dam is ensured and no large quantities of water are released from the reservoir causing flooding in the downstream region of the dam.

(3) Performance of safety-relevant components and equipment during and after OBE: These components and equipment shall be fully operable after the OBE and therefore should behave elastically during the OBE.

(4) Performance of safety-relevant components and equipment during and after the SEE: These components and equipment must be fully operable after the SEE. Minor distortions and damage (e.g., leakage of seals of gates) are acceptable as long as they have no impact on the proper functioning of the components and equipment.

The main safety criteria for rockfill dams with an impervious core for the SEE are as follows:

(1) Loss of freeboard: After the earthquake, the reservoir level shall be below the top of the impervious core of the dam.

(2) Internal erosion: After the earthquake, at least 50% of the initial thickness of the fine filter zones must be available.

(3) Sliding safety factor of slopes: The sliding safety factor of slopes (considering the build-up of pore pressure and the residual strength parameters of embankment materials) shall be greater than 1 after the earthquake.

The second criterion also applies for earth core rockfill dams that are located on faults or discontinuities in the dam foundation, which can move during a strong earthquake. In this case, another dam site should preferably be selected; however, if this is not possible, then only a conservatively designed earth core rockfill dam—not a concrete dam—should be built [1].

For concrete dams, the main seismic safety criteria are as follows:

(1) Stability of the dam foundation; that is, the stability of wedges in the abutments of arch dams and the sliding movements of gravity structures along potential sliding surfaces in the dam foundation must be evaluated.

(2) Sliding and overturning stability of concrete blocks formed by contraction joints and cracks along lift elevations; that is, concrete blocks close to the crest in the center of dams experience the highest absolute acceleration response.

We can conclude that, after a strong earthquake, the bottom outlet(s) and the spillway gates are operable, so a moderate flood can be released safely. It has to be assumed that the power plant will be shut down and water cannot be released through the power waterways. To control the water level in the reservoir after a strong earthquake, not all the openings of a spillway have to be functional.

《5. Seismic safety and risk classification of dams》

5. Seismic safety and risk classification of dams

《5.1. Integral dam safety concept》

5.1. Integral dam safety concept

The two main goals of every safety concept are the minimization of all risks, and the mastering of the remaining risk in the best possible way. To reach these goals, a comprehensive safety concept is used for large storage dams, which includes the following key elements:

•Structural safety (main elements: geologic, hydraulic, and seismic design criteria; design criteria and methods of analysis may have to be updated when new data are available or new guidelines, regulations, or codes are introduced);

•Dam safety monitoring (main elements: dam instrumentation, periodic safety assessments by dam experts, etc.);

•Operational safety (main elements: reliable rule curves for res­e­rvoir operation under normal and extraordinary [hydrological] conditions, training of personnel, dam maintenance, sediment flushing, and engineering back-up; the most important element for a long service life is the maintenance of all structures and components); and

•Emergency planning (main elements: emergency action plans, inundation maps, water alarm systems, evacuation plans, etc.).

Therefore, as long as the proper implementation of these safety issues can be guaranteed according to this integral safety concept, a dam can be considered to be safe.

Periodic safety assessments are indispensable because they will show what measures have to be taken to maintain or improve safety and thus to even extend the life span. Deficiencies observed after commissioning must be rectified as early as possible. A detailed description of the different dam safety elements can be found in Ref. [9].

If a dam does not comply with current dam safety standards or shows unusual behavior, the most effective means of reducing the risk is lowering the reservoir level.

It must be pointed out that both new and existing large storage dams must satisfy today’s safety criteria, which are the same for new and existing dams. Therefore, a risk-based approach in which the remaining service life is taken into account cannot be recommended. In conclusion, there shall be no difference in the safety of the people living downstream of a new or an old dam. This implies that safety upgrades cannot be postponed.

《5.2. Emergency planning》

5.2. Emergency planning

As emergency planning is still rather a new feature in the dam industry in many countries, some additional discussion is provided here. In the emergency planning concept, it is assumed that every dam can fail or be destroyed—an assumption that is difficult for designers, owners, and authorities to accept. Therefore, the consequences of a dam failure, which is a flood wave caused by the uncontrolled release of the water from the reservoir, must be analyzed.

Numerous dam failure scenarios could be considered; however, the main objective of emergency planning is to save lives. Therefore, in order to prepare for alerting and evacuating people, it is necessary to focus on the worst scenarios with the greatest consequences. No failure probabilities are considered for these scenarios. The worst scenario is the instantaneous failure of a dam with a full reservoir, which may be due to military action.

In an emergency situation, the dam owner is responsible for monitoring, determining appropriate alarm levels, making notifications, implementing emergency actions at the dam, determining when an emergency situation no longer exists, and documenting all activities. In the case of an emergency, the dam owner is responsible for the immediate notification of the authorities, who are in charge of warning and evacuating the affected population.

Warning is performed by special water alarm systems. The basis for evacuation planning is a dam breach flood wave analysis, which shows the inundated area for the worst-case failure scenario, that is, the sudden failure of the dam. In addition, the arrival time of the flood wave, flow velocities, and water depth are results obtained from such an analysis.

In Switzerland, 65 large dams are equipped with a fully functional water alarm system. The first alarm systems were installed over 50 years ago. Fortunately, to date, these water alarm systems have never had to be used.

《5.3. Risk classification of dams》

5.3. Risk classification of dams

What is a large dam? Although this may seem to be a trivial question, in fact there is no universal answer when it comes to the (risk) classification of dams. For example, ICOLD categorizes a large dam as a storage dam with a height of at least 15 m. In China, dams are classified according to reservoir volume, with Class 1 having a reservoir of more than 1000 Mm3, Class 2 having a reservoir between 100 Mm3 and 1000 Mm3, Class 3 having a reservoir of less than 100 Mm3, and so on. In Switzerland, dam classification is standardized by laws and regulations, and dams with a height of at least 10 m and a reservoir volume of over 1 Mm3 fall into the highest risk class. Other definitions are used by other dam authorities, organizations, and owners. Accordingly, of the 160 large dams within the highest risk category in Switzerland, only 12 would be in Class 2 in China, and the majority would be classified as Class 3 or even below.

The risk classification of dams has far-reaching implications on the (seismic) design criteria, performance criteria, and other design requirements given in codes and regulations. Therefore, in the assessment of the seismic safety of dams in different countries and with different owners, it is necessary to first examine the risk classification of the dam.

Acceptable risk is the main issue in risk classification. A prerequisite of any quantitative risk analysis is the calculation of the probability of failure of a dam. As each dam is a prototype, this calculation can only be done approximately and with great numerical effort, including numerous sensitivity analyses. Because of such difficulties, it is more straightforward to focus on the minimization of the possible consequences of a flood wave, as is done, for example, in Switzerland.

In conclusion, the risk classification of dams is an unresolved issue as differences may be very large among different countries and owners.

《6. Sustainability of dams》

6. Sustainability of dams

A sustainable dam project is based on the following items: ① dam safety, ② environmental aspects, ③ economic aspects, and ④ social aspects. A storage dam is an infrastructure project that must provide benefits to its stakeholders (food production, electricity, water supply, flood protection, aquaculture, recreation, navigation, etc.) [8].

Technical safety is the decisive characteristic of any technology: Any technology that is unsafe has no future. Dams have been built for more than 2000 years, and some old dams are still in operation. The main prerequisite for the sustainability of dams is dam safety. Although the non-technical features of the dam ②−④ are also important, they can only be considered if the safety of the dam is guaranteed. For this reason, in the design and construction of a sustainable (multipurpose) dam, the project manager must be a dam or civil engineer and not a person with inadequate technical background and experience.

The artificial lakes created by dams must be properly managed, and dams need continuous maintenance. Many large reservoirs are used for energy production and flood protection. However, in future, reservoirs will become a more valuable source of water supply for the population and industry. Hence, the need for dams and reservoirs will persist. The requirements for sustainability and safety will remain for all dams, regardless of their particular use.

Private owners and developers of infrastructure projects use the concession period as a guideline for the design life of their dam project. For hydropower projects in Switzerland, for example, the concession period is 80 years, while in other countries, the concession period may be as short as 30 years. The holder of a dam concession will try to design all structures and equipment to fit the concession period. When the concession period has expired, the ownership of the project is usually transferred to the government. Therefore, the authorities who grant the concession and who will own the project at the end of the concession period must have a keen interest in obtaining a dam that can be used for many more years in the future.

Moreover, costs for the decommissioning of a dam are usually ignored and have to be borne by the future owner. Therefore, the government should specify that the dam design shall comply with international guidelines as published, for example, by ICOLD. The electromechanical equipment and control installations may be the only elements that have to be replaced at the end of the concession period. Thus, for a sustainable dam project, the dam body, safety-relevant elements, and other components should be designed for a long service life irrespective of the duration of the concession period. Hence, the final owner of a dam project must consider such issues at the time of the award of the concession.

The life span of any dam lasts as long as the dam is technically safe and operable. In view of the high damage potential of large storage dams, safety must be assessed based on an integral safety concept, as discussed in Section 4.1.

In general, if a dam and its safety-relevant elements (bottom outlets, spillways) are properly maintained and the aging processes can be controlled, the condition of a dam can be preserved. Thus, the life span of a dam lasts as long as proper maintenance can be ensured, which could be several hundred years.

A serious process affecting the service life of a reservoir is sedimentation. Proper sediment management strategies, which must be based on detailed studies of the river flow, sediment transport, watershed characteristics, sediment flushing devices, and so forth, can make reservoir siltation sustainable.

《7. Seismic safety of existing dams》

7. Seismic safety of existing dams

Large dams were some of the first structures to be systematically designed against earthquakes, starting in the 1930s. However, the seismic safety of older dams is unknown, as most were designed using seismic design criteria and methods of analysis that are considered obsolete today. Therefore, it is necessary to reevaluate the seismic safety of existing dams, using current seismic design criteria and modern methods of dynamic analyses, and to rehabilitate deficient dams.

The seismic safety aspects of existing dams is an important issue, as most dam codes, regulations, recommendations, and guidelines are primarily concerned with the design of new dams [7]. The design of a dam that was considered safe when it was commissioned may not remain safe forever. This fact may be contradictory to the general opinion of the owners and users of most dam structures. As earthquake engineering is still a relatively young discipline, design criteria, methods of analysis, design concepts, and so forth may be subject to changes, especially if a large dam that was designed according to the current state-of-practice should be damaged during an earthquake. Thus, there is a need for periodic checks of seismic design criteria and the earthquake safety of large dams (and other structures as well); that is, budgets for periodic seismic safety checks must be considered.

In general, dam owners and operators are reluctant to perform such checks unless there are laws and regulations and a dam safety organization with the authority and means to ensure that the rules are followed. A thorough assessment of the design criteria is usually done when dam owners are applying for a new concession for their project.

Again, the perception that a dam that was considered safe once will remain safe forever is a dangerous misconception. Therefore, several seismic safety assessments will be needed during the long service life of a dam.

To date, only an 18.5 m high embankment dam has failed during an earthquake, an event that occurred during the 2011 Tohoku earthquake in Japan, where eight people lost their lives in a flood wave caused by dam failure. This may give the impression that well-designed dams are safe against earthquakes. Nevertheless, it is necessary to reevaluate the seismic safety of existing dams based on current state-of-the-art practices and rehabilitate existing dams if necessary. As a prerequisite, the seismic hazard at dam sites must be reassessed to comply with the current seismic design criteria.

It has been this author’s concern to look into the seismic safety of existing dams since he took over the chairmanship of the ICOLD Committee on Seismic Aspects of Dam Design in 1999. Since then, several countries have been motivated to look into the seismic safety of existing dams. Through a comprehensive seismic safety review of large dams in California in the 1990s, it was found that 116 dams needed seismic improvements, including the control (lowering) of the reservoir level. In Switzerland, a seismic safety evaluation of all large dams under government control was carried out by the dam owners. The safety reports were submitted before the end of 2013. The average age of the dams was 65 years and most were designed against earthquakes using a seismic coefficient of 0.1 and a pseudo-static analysis method. For this seismic safety check, the government authorities allocated a period of 10 years; however, most reports were only completed shortly before the given deadline.

It is strongly recommended by ICOLD’s seismic committee that such seismic safety checks of older dams be carried out worldwide.

《8. Conclusions》

8. Conclusions

In the seismic design and seismic safety assessment of dams, the following items are of main concern:

(1) Seismic hazard is a multi-hazard for most dam projects. Ground shaking is the main hazard considered in all earthquake guidelines for dams. However, rockfalls and fault movements could be more critical than ground shaking.

(2) Movements of active faults in the footprint of a dam, or movements at discontinuities (faults, joints, and bedding planes), which can be activated during strong nearby earthquakes, are the most critical seismic hazard for concrete dams. If no other site can be selected, then a conservatively designed earth core rockfill dam with wide filter and transition zones would be the best solution.

(3) Today, the seismic safety of a large storage dam includes the following safety elements: ① structural safety, ② dam safety monitoring, ③ operational safety and maintenance, and ④ emergency planning. All items are equally important.

(4) Dams are not inherently safe against earthquakes. However, technology is available for designing and building dams and appurtenant structures that can safely resist the effects of strong ground shaking.

(5) The earthquake load case has evolved as the critical load case for most large dams. Since safety is the main prerequisite for sustainability, managing the various safety aspects of the earthquake (and flood) hazard is a basic requirement for sustainable dams.

(6) The assumption that a civil structure that is safe at the time of construction remains safe during its whole service life is not realistic. During the life span of a dam, several seismic safety assessments will be needed if new information on the seismic hazard becomes available, when new design and safety criteria are introduced, if the seismic risk increases due to development in the downstream valley, and so forth.

(7) Keeping a dam in a safe condition requires proper maintenance of the equipment and installations as well as the civil structures. Civil maintenance is given less attention than maintenance of the power plant facilities because the benefit of the latter can be expressed directly in terms of kW•h whereas civil maintenance and dam safety do not create a visible benefit. Therefore, a proper balance is needed.

(8) Hardly any observational data is available on the dynamic behavior of new types of dams (concrete face rockfill dams, asphalt core dams, embankment dams with upstream membranes, roller-compacted concrete (RCC) dams, etc.) and very high dams subjected to strong earthquakes.

(9) The gates of spillways and bottom outlets must be operational after a strong earthquake in order to control and lower the reservoir level. The seismic design criteria for these gate systems are the same as those for the dam body; however, the performance criteria must be strict in order to guarantee the functionality of the gates after an earthquake. The designers and suppliers of these gate systems are not yet familiar with these seismic safety requirements.

For the seismic analysis, design, and safety assessment of a dam, the following information is needed from earth scientists:

•The existence of active faults or discontinuities in the footprint of the dam, which could be reactivated during strong earthquakes, and the maximum possible movement;

•Specification of worst-case earthquake scenarios for the dam site (fault, location, focal depth, source mechanism, upper bound magnitude, and maximum fault movement);

•Identification of slopes at the dam site and in the reservoir region that could fail or move during strong earthquakes; and

•Acceleration time histories, as input for the inelastic seismic analysis of the dam. These idealized time histories represent load models, which have little in common with recorded acceleration time histories.