The Consequences Panel (eight people) consisted of experts in the fields of in- frastructure engineering, agricultural economics, dam engineering (also a member of the Engineering Panel), community relations, hydrogeology, Utility corporate, ecology, and the Utility project manager. The following 16-point list shows the identified range of engineering risk events and the nature of the resultant consequences: 1. Probable Maximum Flood (PMF), overtopping, ample warning, breach of main embankment, moderate flood wave, 150-square-mile (240 sq km) inun- dation area, moderate loss of life 2. PMF, piping, breach of main embankment, ample warning, moderate flood wave, 150-square-mile (240 sq km) inundation area, moderate loss of life 3. PMF, embankment instability, breach of main embankment, ample warning, moderate flood wave, 300-square-mile (240 sq km) inundation area, moder- ate loss of life 4. Major flood, overtopping, breach of main embankment, ample warning, minor flood wave, 300-square-mile (240 sq km) inundation area, low loss of life 5. Major flood, piping, breach of main embankment, ample warning, minor flood wave, 300-square-mile (240 sq km) inundation area, low loss of life 6. Major flood, embankment instability, breach of main embankment, ample warning, minor flood wave, 300-square-mile (240 sq km) inundation area, low loss of life 7. Earthquake, cracked embankment, breach of main embankment, little warning, large flood wave, 150-square-mile (120 sq km) inundation area, high loss of life 8. Earthquake, embankment batter slip, breach of main embankment, little warning, large flood wave, 150-square-mile (120 sq km) inundation area, high loss of life 9. Earthquake, outlet tower collapse, little warning, no flood wave, local inun- dation, minor loss of life, long-term out of service 10. Earthquake, turbine pump station collapse, little warning, no flood wave, local inundation, minor loss of life, long-term out of service 11. Earthquake, spillway bridge collapse, vehicle accident, minor loss of life 12. Geotechnical instability, breach of main embankment, little warning, large flood wave, 150-square-mile (120 sq km) inundation area, high loss of life 13. Piping failure, breach of main embankment, little warning, large flood wave, 150-square-mile (120 sq km) inundation area, high loss of life 14. Guard gate mechanical or electrical failure, little warning, no flood wave, local inundation, minor loss of life, long-term out of service 15. Turbine pump station mechanical or electrical failure, little warning, no flood wave, local inundation, minor loss of life, short-term out of service 16. Geotechnical failure of upstream embankment, roadway collapse, vehicle ac- cident, minor loss of life 58 / Stage 2: Identify the Risk 3672 P-05 5/3/01 2:22 PM Page 58 The following discussion provides a full description of the first listed event (embankment overtopping during a Probable Maximum Flood event), the nature of the subsequent releases from the dam, and the range of potential consequences on the wider environment. The PMF is potentially the highest conceivable flood that could occur in the catchment and has an extremely low likelihood of occurring. During a PMF event, the flood spillway would not be able to pass the entire flood flow and the water in the pond behind the embankment would overtop the embankment. During over- topping, it is most likely that erosion of the embankment would occur, leading to a major breach of the embankment. A very large additional volume of water would be suddenly released through the breach. The water released would form a moderate, 30-ft- (10 m) high flood wave within the confines of the valley for a distance of 8 miles (13 km) below the dam. Over the wider floodplain areas, the flood wave would then progressively de- crease in height to around 3 ft (1 m) at a distance of 50 miles (80 km) downstream. The area expected to be flooded is approximately 90 square miles (235 sq km). It is likely that, during such a major flood event, rising water levels would be observed and there would be ample warning that the embankment would be over- topped. Despite the warning, however, it is anticipated that substantial physical damage and moderate loss of life would occur. The full range of potential consequences of the release is: loss of life, house and farm property damage, livestock loss, crop losses, small business revenue losses, industry revenue losses, debris clean-up, riparian vegetation damage, fauna dam- age (from low temperature or oxygen deficient water), infrastructure damage, accessibility loss, lake amenity loss, utility revenue loss, adverse community re- action, and dam repairs. The event tree in the Water Utility example case was derived by combination of the event trees developed by the engineering panel and the consequences panel. The example event tree considers the events that could lead to a sunny-day failure and the consequences that could occur. The combined event tree, shown in Figure 5.2, is typical of many risk assess- ment event trees, which in effect consist of two event trees. This figure demon- strates that a set of different initiating (or trigger) events can potentially have sequences of independent consequences that can all lead to a single risk event, in this case a sunny-day failure and catastrophic release of water. In the example, the engineering panel considered that two initiating events, earthquake and full storage conditions, could potentially follow five pathways that all lead to a breach of the embankment and sunny-day failure. The rate and volume of water released during a sunny-day failure would be catastrophic. The consequences panel recognized 14 major consequences and their financial impli- cations that could follow a sunny-day failure of the embankment. Figure 5.3 shows the likelihoods that the engineering panel attached to each branch of the engineering portion of the sunny-day failure event tree of Figure 5.2. The event tree shows that the estimated frequency of an earthquake of sufficient size (magnitude 6 or higher) is very low, at 9 × 10 -5 per annum (or around 1 in Water Utility Example / 59 3672 P-05 5/3/01 2:22 PM Page 59 Serious injury/loss of life Damages claims Compensation and legal costs House, farm property damage Damages claims Compensation and legal costs Embankment breach Sunny-day failure (high volume, very high rate) Piping failure Embankment cracks Earthquake Embankment breach DeformationBatter slip Embankment breach U/S stability fail Residual strength Storage full Embankment breach U/S stability fail Softened strength Embankment breach Piping failure Cracks below FSL Storage full Livestock loss Damages claims Compensation and legal costs Crop losses Damages claims Compensation and legal costs Small business revenue losses Consequential loss claims Compensation and legal costs Industry revenue losses Consequential loss claims Compensation and legal costs Riparian vegetation damage Vegetation restoration program Implementation costs Fauna damage (low oxygen water) Fauna restoration program Implementation costs Infrastructure damage Road, bridge, pylon repairs Repair costs Accessibility loss Alternative transport routes Compensation for additional costs Lake amenity loss Consequential loss claims Compensation and legal costs Loss of water resource Utility revenue loss Adverse community reaction Interference, excessive review Public relations and legal costs Dam repairs Investigation and construction costs TRIGGER EVENTS ENGINEERING IMPACTS FAILURE EVENT IMPACTS ON WIDER ENVIRONMENT CONSEQUENCES Earthquake causes breach of main embankment Geotechnical failure causes embankment instability leading to a breach Geotechnical failure causes piping leading to an embankment breach Figure 5.2 Dam failure event tree showing the range of events that could initiate a sunny-day failure and the resultant consequences. 60 3672 P-05 5/3/01 2:22 PM Page 60 11,000 years). Following the first branch of the event tree, the panel considered that if such an earthquake were to occur, then cracks would form (likelihood is 100 percent) in the embankment. Consequently, the relevant panel expert concluded that there would be a 1 in 10 chance that piping would form within the crack net- work. If piping were to occur, the expert assessed that there would be a 1 in 100 chance that the piping would be sufficiently extensive to cause the embankment to collapse. Figure 5.4 shows samples of the 50 and 95 percent confidence level cost esti- mates provided by the consequences panel and graphical representations of the cost distributions derived from the panel information. The samples show cost es- timates associated with infrastructure damage and adverse community reaction that were potential consequences of a sunny-day failure. All graphical distributions were provided to the appropriate panel members for review and to confirm the nature of the distributions. Water Utility Example / 61 Figure 5.3 Engineering component event tree showing the sequence of impacts, and their probabilities, if an initiating event occurs. RI 5 Earthquake: Breach of Main Embankment SUNNY-DAY FAILURE TRIGGER EVENTS Earthquake Embankment cracks Piping failure Main embankment breach Sunny-day failure (high volume, very high rate) 0.00009 1.0 0.1 0.01 Batter slip Deformation Main embankment breach Sunny-day failure (high volume, very high rate) 0.1 0.1 1.0 Annual Frequency Probability Probability Probability RI 6 Geotech: Embankment Instability, Breach of Main Embankment Storage full Residual strength U/S stability fail Main embankment breach Sunny-day failure (high volume, very high rate) 0.9 0.1 1.0 0.001 Softened strength U/S stability fail Main embankment breach Sunny-day failure (high volume, very high rate) 0.9 0.001 0.001 RI 7 Geotech: Piping, Breach of Main Embankment Storage full Cracks below FSL Piping failure Main embankment breach Sunny-day failure (high volume, very high rate) 0.9 0.1 0.01 0.01 3672 P-05 5/3/01 2:22 PM Page 61 0.13 1.96 3.79 5.62 7.45 Bridge $1m – $3m Probability 0.28 1.10 1.92 2.74 3.55 220kV Pylons $1m – $2m Probability Sunny-Day Failure Sample Issue Cost Item, CL 50%, CL 95% of log normal distribution C10 Infrastructure damage Bridge $1m – $3m 1 220kV pylons $1m – $2m 1 Roads $1m – $3m 1 C14 Adverse community reaction Board sackings $1m – $2m 1 Excessive ops checks $1m – $2m 1 Review all storages $10m – $15m 10 PR campaign $1m – $3m 1 Legal defense $1m – $4m 1 Assumption Central Value 62 3672 P-05 5/3/01 2:22 PM Page 62 0.13 1.96 3.79 5.62 7.45 Roads $1m – $3m Probability 0.26 1.10 1.92 2.74 3.55 Excessive ops checks $1m – $2m Probability 0.13 1.96 3.79 5.62 7.45 PR campaign $1m – $3m Probability 0.28 1.10 1.92 2.74 3.55 Board sackings $1m – $2m Probability 4.77 8.82 12.86 16.91 20.95 Review all storages $10m – $15m Probability 0.06 3.21 6.33 9.46 12.59 Legal defense $1m – $4m Probability Figure 5.4 Panel outputs and the related cost distributions generated from the panel’s “median” and “high” cost estimates. 63 3672 P-05 5/3/01 2:22 PM Page 63 3672 P-05 5/3/01 2:22 PM Page 64 6 S TAGE 3: A NALYZE THE R ISK Risk analysis using the RISQUE method involves quantification and modeling of the constituent probabilities and consequences for each identified risk event. The aim of risk modeling is to process the likelihood and cost information for each risk event (derived from the panel process). Risk modeling derives a quanti- tative understanding of the characteristics and distribution of risk associated with the situation under evaluation. A number of techniques are applied to derive ranked and proportional profiles of risk quotient and to estimate the potential cost (the risk cost) that may be incurred in the future due to the occurrence of risk events. Q UANTITATIVE M ODELING T ECHNIQUES Spreadsheet models are the most appropriate tools for incorporating risk modeling into the RISQUE method. All risk models discussed in this book were created in Microsoft Excel™ spreadsheets. Probabilistic calculations in the analysis were per- formed using the Crystal Ball™ simulator, which is a commercial add-on software package to Microsoft Excel™. The simulation software computes spreadsheet so- lutions for at least 2,000 trials, using the Monte Carlo sampling strategy. Simula- tion using Crystal Ball™ is used in the risk models to not only treat costs as probability distributions but also to permit random distribution of events over spec- ified time intervals. The @Risk™ software package is also an appropriate alterna- tive for performing the probabilistic calculations. The techniques that have been applied in the RISQUE method have been se- lected for their suitability to: • Define risk events in financial terms, so that some provision can be made that accounts for their likelihood of occurrence and consequences • Account for uncertainty in the likelihood of occurrence of a risk event • Account for uncertainty in the magnitude of the consequences of a risk event 65 3672 P-06 5/3/01 2:24 PM Page 65 Outputs of the modeling process express the risk relationships between the events, show the magnitude of combined risk presented by all of the events, and indicate a reasonable estimate of cost that could be incurred due to the occurrence of risk events (risk cost). Typical outputs of risk modeling include: • Estimates of risk cost at three predetermined levels of confidence. The differ- ent levels are usually representative of a low (optimistic) cost, a conservative yet realistic (planning) cost, and a high (pessimistic) cost. • A risk profile that shows each risk event ranked in order of decreasing risk quo- tient. Risk profiles are essentially prioritization tools. • An exposure profile, which shows the range of consequential cost for the ranked risk events. Exposure profiles are helpful in assessment of whether di- rect risk management action or further study of an event is more appropriate. This section describes the main aspects of the risk modeling process and key el- ements of RISQUE method models. Detailed discussion of specific risk modeling techniques is not provided here. Each application of the RISQUE method requires that case-specific conditions and information be taken into account. For this rea- son, each RISQUE method model needs to be specifically designed to integrate the unique elements of the situation under consideration with the modeling processes that apply to a wide range of conditions. Therefore, each risk model is different and cannot be constructed according to a set prescription. However, a range of insights into risk model development can be gained from the case stud- ies that are presented in Part Three. M ONTE C ARLO S IMULATION Monte Carlo simulation is a very useful tool for dealing with uncertainty. Monte Carlo simulation is particularly useful in business risk assessment for incorporating uncertainty of magnitude of consequences. Many project managers have heard of this simulation technique but are reluctant to consider its use as a routine analytical tool. To these managers, the term “Monte Carlo simulation” conjures an image of a sophisticated and complicated process, which they would most likely not under- stand and therefore would not use as a trusted decision-making tool. Monte Carlo simulation is, however, not as difficult to understand or use as it might seem. What Is Monte Carlo Simulation and How Does It Work? Monte Carlo simulation is a statistical technique that uses random numbers to ac- count for uncertainty in a mathematical model. Monte Carlo simulation is univer- sally available as commercial spreadsheet add-ins, such as the Microsoft Excel™ add-ins Crystal Ball™ and @Risk™. 66 / Stage 3: Analyze the Risk 3672 P-06 5/3/01 2:24 PM Page 66 Monte Carlo simulation recognizes variables within a calculation as probabil- ity distributions rather than single numbers. For example, a network manager con- sidering the purchase of a computer (estimated price $1,600) and color printer (estimated price $1,000) for the business would expect to pay $2,600 in total. In reality, when purchasing the equipment, the budgeted cost may be more or less than the actual purchase price, depending on where the purchases were made. Considering the computer and printer prices as single numbers does not account for variation of price in the market. In the market, the computer price could average $1,600, but the range could vary from $1,100 to $2,100. Figure 6.1 shows a graph of the computer price in 20 stores. The figure is essentially a probability distribution of computer cost. The graph shows that the distribution is uniformly bell shaped and that the most com- mon price (in four stores) is $1,600. If it is assumed that the computer will be pur- chased at any of the stores on a random basis, then there is a 4 in 20 (or 20 percent) chance that the computer will cost $1,600. The lowest price of $1,100 is available only in one store; therefore, there is a 1 in 20 (5 percent) chance that the price will be $1,100. Similarly, there is a 5 percent chance that the price will be $2,100. Judging from the computer cost distribution, it can be seen that there is a 75 per- cent chance that the cost will not exceed $1,700 (the price is more than $1,700 in five out of 20 shops). Figure 6.2 shows the cost distribution for the printer. The printer cost distribu- tion is not uniformly bell shaped but is skewed heavily toward the higher end of the cost range. This figure shows that the printer cost could vary from $500 to $1,600, with the most common cost being $800. Considering the price in all 20 stores, the average printer price is $1,000 and there is a 75 percent chance that the cost will not exceed $1,200. Taking note of the cost distributions of the computer and printer, the chance that the network manager will pay the lowest combined price of $1,600 or the highest combined price of $3,700 is considerably lower than the chance of paying around the average combined price. In this example, Monte Carlo simulation calculates the combined cost of the two items not as single numbers but as cost distributions. The results are expressed as a range of possible outcomes together with the likelihood of each outcome. Within the modeling software, the Monte Carlo simulation is complex; how- ever, the overall process is simple. Monte Carlo simulation essentially considers Monte Carlo Simulation / 67 Figure 6.1 Computer cost distribution represented by a set of numbered balls. 4 3 2 111 11 12 12 13 13 14 14 14 15 15 15 15 16 16 16 16 16 17 17 17 17 18 18 18 19 19 20 20 21 21 Frequency n = 20 Σ = 320 Mdn = 16 Mean = 16 Mo = 16 Computer Cost ($ × 100) 3672 P-06 5/3/01 2:24 PM Page 67 [...]... across the risk events They permit differentiation of events, first on the basis of risk quotient, then on the basis of the component parts: likelihood and/ or cost Risk profiles and maps can be produced in various forms to demonstrate the relationships between risk events Finally, risk profiles and maps provide inputs for risk analysis Ranked Risk Profiles Ranking risk events in order of decreasing risk. .. mining example Proportional Risk Profiles Proportional risk profiles are derived by expressing risk as a proportion of the total risk presented by all risk events Proportional risk profiles show how much risk each event, or a group of events, contributes to the total risk presented by all risk events Proportional risk profiles indicate which events contribute to most of the risk and which do not contribute... the risk map where the values intersect is equivalent to the risk quotient Risk maps usually show the variables plotted on logarithmic axes because probability and cost usually vary by orders of magnitude Lines of equal risk quotient are frequently drawn on risk maps and are very useful for comparing risk presented by highly diverse risk events In addition, risk maps clearly differentiate between risk. .. “best-estimate” approach Risk analysts also can use a probabilistic method to determine a conservative estimate of consequence (say the 80 percent confidence level) and multiply the conservative cost estimate by likelihood to derive a more conservative expression of risk quotient GENERATE RISK PROFILES AND MAPS Risk profiles and risk maps show the relationships between risk events and how the total risk is distributed... decreasing risk quotient and then graphically plotting the results creates ranked risk profiles Ranked risk profiles clearly indicate relationships, such as the relative magnitude of risk quotient for each event, and show which events are the riskiest, and those that are the least risky Ranked risk profiles are extremely useful in prioritizing risk events Figure 2.1 is an example of a ranked risk profile produced... relatively high -risk events and the risk posed by each of the remaining events A common method of selecting the threshold is to evaluate the ranked risk profile in order to identify those events that are clearly the riskiest and then select the risk threshold to include those events For example, the mining example ranked risk profile of Figure 2.1 shows that the risk posed by each of the five most risky events... perceived risk During this process, project managers evaluate the low -risk events and progressively scan upward along the risk profile When scanning a ranked risk profile, risk managers usually can identify some specific risk events that, on the basis of experience or intuition, do not pose substantial risk and that project managers would feel comfortable about excluding from the estimate of risk cost... (assisted by risk analysts) select the risk threshold on the basis of proportional risk Project managers select a risk quotient threshold that includes all risk events that together contribute to more than a given percentage of the total risk The risk threshold, which is dependent on the shape and slope of the cumulative risk curve, usually includes events that together contribute between 80 and 95 percent... (which all exceed a risk quotient of $100 per year) is substantially higher than the risk posed by the other 15 events In this case the risk analysts could select $100 per year as the risk threshold and calculate the risk cost as the combined occurrence cost of the five riskiest events However, risk analysts could have justifiably selected the threshold to include the eight most risky events, because... defines the riskiest events Threshold Based on Risk Quotient Quantified estimates of risk quotient usually do not directly relate to business costs, and a quantum of risk quotient has limited meaning in a business sense For this reason, selection of risk thresholds on the basis of risk quotient is more difficult Most ranked risk profiles show that there is a substantial difference in the quantum of risk quotient . expression of risk quotient. G ENERATE R ISK P ROFILES AND M APS Risk profiles and risk maps show the relationships between risk events and how the total risk is distributed across the risk events between risk events. Finally, risk profiles and maps provide inputs for risk analysis. Ranked Risk Profiles Ranking risk events in order of decreasing risk quotient and then graphically plot- ting. total risk presented by all risk events. Proportional risk profiles indicate which events contribute to most of the risk and which do not contribute significantly to total risk. Proportional risk