WARNING SYSTEM DESIGN WHEN EARLY WARNING IS NOT EARLY ENOUGH – SILVER CREEK DAM AND HOSLER DAM CASE STUDIES

Barry K. Myers, P.E.1 Gregory C. Dutson2

ABSTRACT A successful early warning system detects and provides notification of a dam failure event with adequate warning time to allow for safe evacuation of the downstream community at risk. For most projects this can be accomplished by monitoring for and detecting a breach failure of the dam. Typically, the time that is required for the flood wave to reach the downstream communities is greater than 1 hour, which allows a reasonable amount of warning time for evacuation. What if the flood wave reaches the community in significantly less than 1 hour? This situation is the case for the two projects that are presented. The projects are Silver Creek Dam, which is a zoned earth embankment dam near Silverton, Oregon, and Hosler Dam, which is a concrete arch dam near Ashland, Oregon. Both of these projects are unique in that very little warning time is available for downstream evacuation following a breach failure of the dam. In both cases, the flood wave from a dam breach would cause loss of life and significant property damage within 10 to 15 minutes. A warning time of 10 to 15 minutes was determined to be an unacceptable amount of time for evacuating the inhabitants of the downstream communities. Therefore, the early warning system design objective for both projects was to detect a condition of “imminent failure” to allow sufficient time for evacuation. The design efforts included the use of failure modes analysis to identify the developing conditions that could lead to failure. The detection systems were then designed to monitor for the development of these developing conditions and to identify when a critical condition is reached, allowing adequate evacuation time before the dam fails. The detection systems include the use of real time monitoring using automated data acquisition systems. The designs also included the development of detailed response plans that are used for making decisions during a developing condition, including when failure of the dam is imminent and the evacuation should be initiated. Both early warning systems include a notification component that consists of a network of outdoor warning sirens and personal notification for people with disabilities. Other methods that were considered and evaluated included television or radio station broadcasts, direct notification via telephone, mobile loudspeakers, and door-to-door notification. The notification systems are also integrated into the downstream communities’ emergency response plans with detailed evacuation plans that are used to efficiently route the population out of the inundation areas minimizing traffic control problems, confusion, or panic during an evacuation. 1President, Engineered Monitoring Solutions 2Senior Systems Integrator, Engineered Monitoring Solutions

INTRODUCTION The purpose of an early warning system for a dam is to provide notification of a failure event with adequate warning time to allow for safe evacuation of the downstream community at risk. To accomplish this purpose the system must be capable of both detecting a failure event, and notifying the downstream community of the need to evacuate. The detection portion of the system provides warning to operations personnel of developing conditions of concern and ultimately failure of the dam. The detection system includes performance monitoring that is typically integrated with the on-going dam safety monitoring program for the dam. The detection system also includes a plan for responding to developing conditions of concern that are detected. The plan needs to be understandable by the personnel that are responsible for operating the dam and should be based on the specific results of the performance monitoring. Developing a good understanding of the possible failure modes for the dam and the events that would likely lead to failure is essential for proper design of the performance monitoring system and the response plan. The second portion of the warning system is the notification system. The objective of the notification system is to provide evacuation notification to the downstream inhabitants within the flood inundation area once the decision to evacuate has been made. This notification can be provided by a number of different methods including outdoor warning sirens, television or radio station broadcasts, direct notification via telephone, mobile loudspeakers, and door-to-door notification. The best system design incorporates the methods that will be most effective in delivering the notification message to the community and emergency response personnel. Parameters that should be considered in selecting the notification methods include the number of inhabitants in the inundation area, the amount of warning time available, inhabitants with disabilities such as the hearing-impaired and the blind, high occupancy facilities such as schools and public gathering locations, and the ability to perform testing on a regular interval for on-going public awareness. The notification system also includes a comprehensive evacuation plan that will be executed to efficiently route the population out of the inundation areas. The evacuation plans should be customized for the specific conditions that exist in each community. These conditions include items such as the topography of the inundation zone and distance to high ground, the number of emergency response personnel that are available to conduct the evacuation, traffic control requirements, and the location and availability of shelters. If a failure event develops in the future, the successful operation of the early warning system will depend on the level of on-going training and public awareness that has occurred. For the detection system to work properly it must be maintained and needs to become part of the regular activities of the operations personnel. A system that is fully automated with no need for human interaction will likely be ignored. In addition, training should be provided for all new operations personnel which means a comprehensive Operations and Maintenance Manual for the system is a must. For the notification system to be effective, the public must be kept aware of the hazard and the appropriate actions to take during an evacuation. This can be accomplished through

testing of the notification system on a monthly or quarterly basis, providing signage in the community indicating the evacuation routes and shelter locations, and providing informational pamphlets describing the potential hazard and the appropriate procedures for evacuation.

FAILURE MODES ANALYSES As discussed above, developing an understanding of the events that could lead to a safety condition of concern in the future is especially critical for early warning systems to assure that the appropriate actions and notification are initiated in a timely manner. Failure Modes Analysis (FMA) can be a powerful tool for identifying the potential failure scenarios that should be anticipated for a particular dam. What is FMA? Failure Modes Analysis has been used extensively in performing risk assessments. For a risk assessment the probability of failure and the consequences of failure are used to calculate the risk of loss of life or property damage for a particular dam or project. In order to evaluate the probability of failure for a dam, the failure modes must first be identified. Identifying the failure modes is typically performed by a team of experts who brain storm on different ways that the dam could fail. This brain storming includes identifying the events that would occur leading to failure. The results are usually presented as event trees. The event tree is an organization of the different possible chain of events, or scenarios, that could occur leading to the mode of failure. Probabilities (likelihood) of occurrence are then assigned to the different responses in the event trees and the probability of the scenario is calculated as the product of the responses. The probability of failure for each tree is then calculated as the sum of the different scenarios. In addition to a calculated probability of occurrence, the analysis approach provides significant insight into the different ways that the dam could fail and the events that would likely lead to the development of failure. It is this second product of the FMA that is particularly useful in designing early warning systems. The process of developing the failure mode event trees and the resulting event trees allow for a comprehensive evaluation of the dam. With this more comprehensive understanding, design of the detection system can be focused on detecting the events that would indicate the development of these potential failure modes. The data evaluation and response planning can also be more comprehensive with the knowledge of the failure scenarios and how they will likely develop. For the two early warning system projects that are presented in this paper, Silver Creek Dam and Hosler Dam, the close proximity of the downstream communities to the dam provides for less than 10 to 15 minutes of warning time before the flood wave from a breach failure causes loss of life and significant property damage. Because a warning time of only 10 to 15 minutes was considered to be unacceptable by the downstream communities, the decision was made to design the warning systems based on detecting a condition of imminent failure. The notification/evacuation for both project will be initiated when “failure is imminent” to allow more time for evacuation before the dam fails.

Failure Modes Analysis was used for these projects to identify the specific events that can be monitored to indicate a potentially developing failure mode. The results were also used to develop the decision process for determining when a “failure is imminent” condition exists and the downstream communities should be evacuated.

SILVER CREEK DAM Background The Silver Creek Dam is located roughly two miles upstream from downtown Silverton, Oregon. Silverton is located approximately 55 miles southeast of Portland, Oregon. The dam and reservoir are owned and operated by the City of Silverton and were constructed in the late 1970’s to provide raw water storage and recreational uses for the City. The crest length of the dam is 680 feet, and it has a maximum height of 65 feet. A 120-foot wide rectangular reinforced concrete chute spillway is located on the right abutment. The regulating outlet is a 42-inch inside diameter cast-in-place concrete pipe which is located on rock near the maximum embankment cross section. The dam is constructed as a zoned earth embankment dam with a 3H:1V upstream slope, a 2H:1V downstream slope and a central core.

Photograph 1: Silver Creek Dam (Standing on right abutment looking at spillway, crest, and downstream slope.)

Soon after the first filling, horizontal drains were installed from the downstream toe area and a buttress was added to the lower portion of the slope to remediate higher than expected seepage on the downstream face. A total of 10 piezometers were added to monitor the long-term seepage performance of the dam. The existing dam safety monitoring also consists of manual flow measurements from the drains using a timed bucket approach, survey of settlement monuments on the crest of the dam, and visual inspections. The results of the monitoring performed to date, have not indicated any degrading trends in the seepage performance of the dam. The results of Dam Break Analyses performed in 2000 indicated that a flood wave in excess of 10 feet would travel down the Silver Creek channel and inundate downtown Silverton within 15 minutes following a breach failure of the dam. Based on these results, the City of Silverton decided to implement an early warning system for the dam. The purpose of the early warning system is to provide advanced notice so that the inhabitants can be safely evacuated from the flood inundation area. Installation of the system is planned for completion by the end of year, 2003. Results of Failure Modes Analysis In order to provide early warning of an imminent failure condition, the potential modes of failure, and more importantly the events that lead to the failure, had to be understood. Therefore, FMA was used to identify the events that could be detected by the early warning system to provide notification of a developing condition, and to develop a plan for responding to these events. A number of different failure modes were considered that could lead to an uncontrolled release of the reservoir. Of these modes, the three that appeared to be most likely and worthy of further evaluation included the following:

Seepage Failure Under Normal Operating Conditions: The mode that was conceived for a potential seepage failure of the dam under normal operating conditions includes: 1) an increase in seepage through the embankment core; then 2) this increase results in an unstable condition developing within the embankment or on the downstream face; then 3) the unstable condition leads to a breach failure of the dam.

Failure Following an Earthquake Event: For the seismic loading condition, the failure mode that was developed includes: 1) an earthquake occurs producing ground motions at the site that are large enough to cause permanent deformations; then 2) an unstable condition in the embankment develops as a result of the deformations; then 3) the unstable condition progresses leading to a breach failure of the dam.

Failure Under Flooding Conditions: The failure mode under flooding conditions that was evaluated includes: 1) large inflows occur from rain fall and snow melt that cause a rise in the reservoir level; then 2) the higher than normal reservoir

levels result in the development of an unstable condition; then 3) the unstable condition leads to a breach failure.

An event tree was then developed for each of these three failure modes to identify the specific events that could occur as the failure modes initiate and progress to an imminent failure condition. A more detailed discussion of the results of the FMA for Silver Creek Dam is presented in (Myers, 2002). Response Plan The results of the FMA were used to develop a response plan that divides the developing failure modes into three alarm categories and provides specific actions that should be performed to respond to the alarm levels. The Alarm Response Plan is presented as Table 1. The purpose of the plan is to provide a framework that can be used by City operations personnel to make decisions regarding the condition of the dam and the appropriate level of response during a developing failure mode.

Table 1. Silver Creek Dam Alarm Response Plan

Alarm Level Safety Condition Response

Alert

Developing Condition of Concern • Piezometer level exceeds high threshold

values • Weir flows exceed high threshold values • Reservoir level within 8 feet of crest • Earthquake occurs • Network communication error

• Operator on duty notified immediately by

cell phone and uses the Monitoring Station PC to evaluate the alarm condition

• Operator conducts a site visit to observe the conditions that caused the alarm

• If the alarm is not the result of an equipment malfunction, then the operator remains on site to monitor for a developing unstable condition

Developing

Unstable Condition Develops • Instability develops on the downstream slope • Sinkhole develops on the upstream slope • Uncontrolled seepage exiting at the

downstream toe or abutment contacts • Structural failure allows uncontrolled seepage

around spillway • High reservoir level results in seepage

through the upper 4.5 feet of the embankment • Debris in the spillway reduces capacity and

causes a sudden rise in reservoir level

• Operator initiates the emergency call out list

to issue a “warning” of an unstable condition • Operator continues to monitor the situation

from the On-Site Monitoring Station • Engineering evaluation is immediately

conducted • Warning condition is removed when the

alarm conditions return to a normal level, or actions have been taken to successfully stabilize the situation

Critical

Imminent Failure Condition • Instability incorporates half of the downstream

slope • Instability or sinkhole on the upstream slope

reduces the freeboard to less than 4.5 feet • Whirlpool develops in the reservoir • Turbid flow is exiting the downstream toe or

abutment areas at an increasing rate • Reservoir level rises to within 2 feet of the

crest • Erosion/slumping occurs in the upper 4.5 feet

of the embankment under high reservoir levels

• Operator activates the notification system

from the On-Site Monitoring Station “Silver Creek Dam emergency. Evacuate the Flood Hazard Zone Immediately”

• Evacuation Plan is initiated • All clear notification “Silver Creek Dam is

Secure, it is safe to return.” is activated when the condition has been stabilized or the flood wave has passed

The three alarm levels shown on the Alarm Response Plan are directly related to the failure mode event trees. The first alarm level “Alert” corresponds to a developing condition of concern, or the initiation of one of the failure modes in the event trees. As the failure mode progresses in the event trees, an unstable condition would develop. This unstable condition corresponds to the “Developing” alarm level. Between the initiation of an unstable condition and failure of the dam is a condition where failure would be considered to be very likely or “imminent.” A determination that failure is imminent is made based on an observation of one of the safety conditions listed in Table 1 under the “Critical” alarm level. If any of these conditions are observed, then the failure mode has developed to a situation where failure would be considered likely and the evacuation plan for the early warning system would be initiated. Detection System The detection capabilities of the warning system are integrated with the decision process that is outlined in the Alarm Response Plan. A data flow diagram illustrating the connectivity of the early warning system components is presented as Figure 1.

Figure 1. Silver Creek Dam Early Warning System Data Flow Diagram The recommended detection system consists of improving the monitoring capability for both existing and new instruments installed at various locations on the dam. The improvements will include:

• Installing a vibrating wire pressure transducer to monitor the reservoir water level, and detect a high or rapidly rising reservoir level condition.

• Outfitting the existing piezometers with vibrating wire pressure transducers to detect changes in the seepage performance of the dam and abutments.

• Installing new weir box instruments to collect and measure seepage at the toe of the dam, the contact with the left abutment, and from the horizontal drains. Vibrating wire sensors will be used to monitor water levels in the weir boxes to monitor changes in the seepage performance of the dam.

• Installing an On Site Monitoring Station to provide a base station at the dam for on-site monitoring during a “Developing” alarm condition.

• Installing a new Reservoir Level Site Gauge to provide a back-up point of reference for visual monitoring of the reservoir level during a flooding condition.

All of the electronic sensors will be connected to Measurement Control Units (MCU’s). The MCU’s are microprocessor controlled data acquisition units that will be programmed to collect the data from the sensors and compare the readings to predetermined threshold values every 15 minutes. If a threshold value is exceeded, then the MCU network will initiate a phone call to the assigned city personnel to alert of a developing condition of concern. City personnel will then respond according to the “Alert” alarm level as described in Table 1. The MCU network will also be programmed to collect and store readings on a daily basis for use in long term performance and trending evaluations. As part of the on going dam safety monitoring activities, the City personnel will be using a database tool to reduce and evaluate the instrument data. The City will also be performing regularly scheduled visual inspections of the dam. Notification System and Evacuation Plan The recommended notification system will consist of an outdoor siren network with personal notification for special facilities and those with disabilities. In addition to the sirens and personal notification, certain procedures and polices such as notification flow charts, on-going testing, maintenance, and public education, will be implemented to assure proper operation of the notification system. Outdoor Siren Network: When the decision has been made to evacuate, the outdoor siren network will be used to notify the majority of the population. City, police, fire, and emergency management personnel will also be notified using the call out procedures documented in the notification flow charts. If the failure mode has developed from an “unstable condition”, then the City, police, fire, and emergency management personnel will have already been notified of a “Warning” of a developing condition. For the population within the inundation zone with disabilities, the personal notification component will be used to assure they receive the evacuation notification and assistance needed for evacuating.

To provide audible notification to the general public, four sirens will be installed at strategic locations within the inundation area as shown on Figure 2. Each of the audible sirens will be controlled by a centrally located Siren Control Unit which uses radio telemetry to communicate with the sirens. When the evacuation notice is executed, the sirens will broadcast a wail tone followed by a prerecorded voice message "Silver Creek Dam emergency, evacuate the flood hazard zone immediately". In addition to the warning tone and message, an all clear message “Silver Creek Dam is secure, it is safe to return" will be used to indicate when the flood risk has subsided.

Figure 2. Inundation Zone and Outdoor Siren locations for Silver Creek Dam.

Notification Flow Charts: The detailed call out lists of who will be notified under the “Developing” and “Critical” alarm conditions are incorporated into the City’s Emergency Action Plan as Notification Flow Charts. The Notification Flow charts will be used to notify certain City staff, police fire, and emergency management personnel that are expected to respond to the emergency action plan. Inter-agency notification will also be coordinated via the Notification Flow Charts. Personal Notification: Since the outdoor sirens will be used as the primary notification method, another vital component of the Notification System is a system or procedure to provide notification to the population within the flood inundation area with disabilities or otherwise need assistance. The police department will maintain a list of addresses of households for people with disabilities that will be affected by the flood inundation. This list of households will be used during an evacuation by police and fire personnel to notify those households personally and provide assistance as needed to evacuate the inhabitants. Emergency Action Plan: Certain policies and procedures will be incorporated into the City’s Emergency Action Plan to facilitate proper execution of an evacuation. These policies and procedures include: • Accurate and up-to-date Notification Flow Charts • A comprehensive public education program, • An on-going public awareness program, • An on-going interagency and interdepartmental coordination program, • Regular scheduled maintenance of the notification equipment, • Regular testing of the notification system and evacuation procedures.

HOSLER DAM Background Owned and operated by the City of Ashland, Oregon, Hosler Dam is a 118-foot high concrete arch dam constructed in 1928 impounding approximately 800 acre-feet of water from the East and West Forks of Ashland Creek. The dam has a centrally located overflow spillway with six vertically acting slide gates. A 24-inch steel conduit is used to convey the water through a small power plant to a filtration plant for water supply. It also has a 60-inch diameter low level outlet. Both the Federal Energy Regulatory Commission (FERC) and the Oregon Water Resources Department regulate the project. Safety inspections have been performed by independent consultants under the FERC Part 12 Subpart D requirements and have found no current structural issues of concern with the dam. The dam has also recently been evaluated for seismic stability and the results indicate that the dam is safe under the design earthquake loading conditions.

Photograph 2: Hosler Dam (Standing on left abutment looking at crest and upstream face, edge of spillway can be seen beyond stairs.) At the request of the FERC a dam-break study was performed in 2001. The results of that study indicated that a breach failure of the dam would result in inundation of the City of Ashland town center with 25 feet of water within 8 minutes of failure. Based on the results of the study, the FERC recommended that an early warning system should be installed for the dam. Installation of the system is planned for completion by February 2003. As with the Silver Creek Dam Project, the short warning time available following a dam failure event lead to the decision to initiate the notification/evacuation based on a “failure is imminent” condition. Results of Failure Modes Analysis Of the different failure modes that were considered for Hosler Dam, the following appeared to be the most likely and were therefore evaluated further using event trees.

Seepage Failure Under Normal Operating Conditions: The failure mode included: 1) an increase in seepage through the abutment rock mass; then 2) this increase results in an unstable condition developing within the abutment; then 3) the unstable condition leads to a loss of abutment support and an overturning failure of the dam.

Failure Resulting From an Earthquake Event: The failure mode that could result from an earthquake event includes: 1) an earthquake occurs producing ground motions at the site that are large enough to cause a condition of concern; then 2) an unstable condition develops within the dam or abutments; then 3) the unstable condition worsens leading to an uncontrolled release of the reservoir.

Failure Under Flooding Conditions: Failure under a high reservoir level condition caused by flooding includes: 1) large inflows occur from rain fall and snow melt that cause a rise in the reservoir level; then 2) the higher than normal reservoir levels result in overtopping of the dam and the development of an unstable condition; then 3) the unstable condition leads to an overturning failure of the dam.

Response Plan The results of the failure modes analysis were then used to identify the conditions that would indicate certain alarm levels, and a plan for responding to the progressive development of the potential failure modes. Similar to the Silver Creek Dam warning system, the Alarm Response Plan will be used by City of Ashland operations personnel to make decisions regarding the status of the dam and ultimately whether or not an imminent failure condition has been reached and the community needs to be evacuated. The Alarm Response Plan that was developed for the Hosler Dam early warning system is summarized on Table 2.

Table 2. Hosler Dam Alarm Response Plan

Alarm Level Safety Condition Response

Alert

Developing Condition of Concern • Reservoir level exceeds el. 2873.5

(spillway capacity at el. 2874) • Ground motions from earthquake exceed

threshold value • Network communication error • Change in seepage observed during weekly

visual inspection of abutments • Crest deflection exceeds threshold values

• Operator on duty notified immediately by cell

phone • Operator conducts a site visit to observe the

conditions that caused the alarm • If the alarm is not the result of an equipment

malfunction, then the operator remains on site to monitor for a developing unstable condition

• Perform an evaluation of the rock mass stability if a change in the abutment seepage or slope stability is observed

• Perform an engineering evaluation to determine cause of crest deflections

Developing

Unstable Condition Develops • Rock mass slope instability develops on the

downstream abutment areas • Localized hydraulic movement of rock

blocks occurs on the downstream abutment areas

• Surface material and vegetation is eroded on the downstream abutment areas and erosion gullies begin to form in rock mass resulting from overtopping of the dam

• Reservoir level approaching El. 2878 (4 feet of overtopping)

• Operator initiates the emergency call out list to

issue a “warning” of an unstable condition • Operator continues to monitor the situation from

the On-Site Monitoring Station • Warning condition is removed when the alarm

conditions return to a normal level, or actions have been taken to successfully stabilize the situation

Critical

Imminent Failure Condition • Rock mass slope instability progresses in an

upstream direction • Hydraulic movement of rock blocks

progresses • Erosion gullies appear to be deepening at

an increasing rate • Reservoir level reaches El. 2878

• Operator contacts City’s 911 Emergency

Dispatch with instructions to activate the notification system “Hosler Dam Emergency. Evacuate the flood hazard zone Immediately”

• Evacuation Plan is initiated • All clear notification “Hosler Dam is secure, It is

safe to return.” is activated by 911 Emergency Dispatch when notice is given that the condition has been stabilized or the flood wave has passed

Detection System The recommended detection system consists of a reservoir level monitoring instrument, two strong motion accelerographs, a reservoir level site gauge, and asphalt paved walkways along the toe of the abutments for on-going seepage observations. A data flow diagram showing the connectivity of the system is presented as Figure 3 below. The reservoir level sensor and accelerographs will be connected to a MCU that will read the sensors and compare the readings to predetermined threshold values. If a threshold value is exceeded and verified by redundant measurements, then the MCU network will indicate an alarm condition to the Water Treatment Plant Supervisory Control and Data Acquisition (SCADA) system. The SCADA system will then initiate a phone call to the “on-call” operations person and the police station 911 dispatch providing notification of an alarm condition at the dam. As described above, MCU2, which is located at the dam, will collect the data from the instruments and compare the data to threshold values. A second MCU, MCU1, will be located at the Water Treatment Plant. During a detected alarm condition, MCU2 will contact MCU1 via radio to report the alarm and MCU1 will notify the treatment plant SCADA system through a closed contact signal. MCU1 will also contact MCU2 every 4 hours to assure that the network is operating properly and to check on the status of the solar power supply for MCU1. A network communication failure will be considered as an alarm condition.

Figure 3. Hosler Dam Early Warning System Data Flow Diagram Because high reservoir levels leading to overtopping of the dam is a possible failure mode, an automated sensor will be installed to monitor the reservoir level. The instrument will be read every 15 minutes and compared to alarm threshold values. If the reservoir level rises to within 0.5 of the top of the spillway (Elevation 2873.5 feet), then the system will activate the callout procedure to City personnel to indicate a developing condition of concern. The reservoir level monitoring will also be used during an alarm condition to keep track of the reservoir level and rate of rise. A manually read reservoir level site gauge will be installed to provide an on site visual confirmation of the reservoir level during a flooding condition. This gauge will be constructed in the vicinity of the left abutment at an elevation of 2873 feet so it can be easily observed during a developing unstable condition. Two accelerometers will be installed to record the strong motions experienced at the dam during an earthquake event. One accelerometer will be installed on the dam structure and another will be installed on the left abutment. Both of these sensors will be connected to MCU2. The callout procedure to City personnel will be activated if ground motions are detected that exceed the threshold value. To improve the ability to detect changes in the seepage performance of the abutments, an asphalt-paved walkway with a ditch for seepage collection will be constructed along the toe of the left and right abutments downstream of the dam. Visual inspections will be

performed on a weekly basis by walking the toe of the slope and making observations regarding seepage and signs of instability in the abutments. Stationing will be provided along the pathway for use in referencing the observations. If a change in seepage or stability of the abutments is identified, then an evaluation of the rock mass stability in the abutment will be performed to identify if there is a developing condition of concern. A visual observation checklist and digital photographs will be used to record the observations for historical evaluation purposes. The existing SCADA system will be used as the interface for the detection system. The SCADA system will provide a singe, easy-to-use interface that the operations personnel are already comfortable and familiar with and use on a daily basis. The following alarms and operation information will be presented on the SCADA screen and is integrated with the Alarm Response Plan. Alarms:

“Reservoir Level Exceeding El. 2873.5” “Earthquake Strong Motions Exceeded 0.24g” “Network Communications Error”

Operation Information:

“MCU2 Solar Charge Error” “Seismic Event Recorded”

Notification System and Evacuation Plan The notification system is designed to provide evacuation notification to the people inhabiting the flood inundation area. This includes inhabitants with disabilities such as the hearing-impaired and the blind. In addition to the people inhabiting the flood inundation area, certain emergency response personnel must be notified in a timely fashion to assure proper and orderly execution of the emergency response plan. The evacuation notice would be issued as a result of an "imminent failure” as discussed previously. In order to properly discern a dam failure notification from other types of disasters, the notification system will also include audible instructions to the public as to the nature of the evacuation. The notification system is similar to the Silver Creek Dam system and consists of an outdoor siren network and personal notification for inhabitants with disabilities. The sirens will broadcast a wail tone followed by a pre-recorded voice message. As with Silver Creek Dam, notification flow charts will be used to notify City, police, fire, and emergency management personnel of the “Developing” and “Critical” alarm conditions. A detailed evacuation plan has also been developed including traffic control, route signage, and shelter locations. Figure 4 shows the inundation area downstream of the dam and the outdoor siren locations.

Figure 4. Hosler Dam Inundation Zone and Outdoor Warning Siren Locations

CONCLUSIONS The following conclusions are made regarding the design of early warning systems for dams and the two case studies presented herein.

• A successful early warning system requires detection of the events that could indicate a developing failure condition, and a well thought out plan that is understood and can be executed by the operations personnel regarding the appropriate response to these events.

• The detection portion of the system should be integrated with the normal

operations and safety monitoring for the dam. A system that is not used on a regular basis may not be operational during a future safety event. The system can become nonfunctional due to both mechanical problems and a lack of training for the system operators.

• The downstream community needs to be aware of the hazard and be prepared to

respond appropriately to the notification system. In this regard, police, fire, and emergency management personnel should receive training on an annual basis to review the response plan and evacuation procedures. The general public should also receive information and training on what to do and where to go during an evacuation. Recognition and awareness of the notification message that will be given to initiate the evacuation can be accomplished by monthly or quarterly testing of the notification system.

• Early warning of a failure event can be provided for downstream communities that are located close to the dam. To allow more time for evacuation, the community can be evacuated based on a “failure is imminent” condition. To accomplish this the following are needed; 1) an understanding of the events that would likely lead to failure, 2) a system to detect the occurrence of these events, 3) a process for responding to these events and deciding when an imminent failure condition exists, and 4) a system for notifying the community in a timely manner of the need to evacuate and a functioning plan for evacuating the community in safe manner.

• The two case studies presented are good examples of early warning systems that

have been designed where less than 15 minutes of warning time is available.

ACKNOWLEDGEMENTS

The authors wish to express their thanks to the following individuals for their assistance in the design of the Silver Creek Dam and Hosler Dam projects:

Rich Barstad, P.E., City of Silverton, Oregon Pieter Smeenk, P.E., City of Ashland, Oregon

REFERENCES

Myers, B.K. (2002). “Designing Dam Safety Monitoring and Early Warning Systems Using Failure Modes Analysis”, Proceedings of the 2002 Annual Conference, Association of State Dam Safety Officials, Tampa, Florida, September 2002.