1. 2013 Northwest Hydro Operators Forum 11 FERC’s Expectation for EAPs David Lord, P.E., D2SI Dam Safety Risk team – Portland, Or Natural Hazards: Events and Response

2. 22 FERC Regulates 2948 Dams and Project Structures

3. 33 834 High Hazard Potential 234 Significant Hazard Potential

4. 4 EAP Planning The FERC EAP program is recognized across the world. The FERC EAP program is recognized across the world. The program depends on effective training of all participants, adequate communication with first responders, and adequate testing of all parts of the EAP. The program depends on effective training of all participants, adequate communication with first responders, and adequate testing of all parts of the EAP. Continued enthusiastic participation of owners is essential to the success of the EAP program. Continued enthusiastic participation of owners is essential to the success of the EAP program. 4

5. 5 EAP Enhancement Initiative Requirement of all high and significant hazard potential dam owners: Include in the EAP a more detailed description of your operating plan during high flow events

6. 6 EAP Enhancement Initiative Why did FERC begin this initiative? During recent storm events FERC received inquiries from several Licensees asking what pre-emptive steps they could undertake to ensure their dams safely passed the expected flood flows. We wanted to ensure that all Licensees are prepared ahead of storm events to avoid unnecessary complications during the events. During recent storm events FERC received inquiries from several Licensees asking what pre-emptive steps they could undertake to ensure their dams safely passed the expected flood flows. We wanted to ensure that all Licensees are prepared ahead of storm events to avoid unnecessary complications during the events. Make sure Licensees have a well thought out operating plan to safely pass flood flows Make sure Licensees have a well thought out operating plan to safely pass flood flows Improve communication to reduce post flood event complaints Improve communication to reduce post flood event complaints

7. 7 1.Essential operations before, during, and after flood flows reach your project. 2. A general overview tying project discharges to EAP notification procedures. 3. For projects that are remotely operated, describe what triggers sending staff to a project and at what point personnel are to be physically present at a site. 4. If the reservoir is to be drawdown describe coordination you will undertake with the resource agencies. 5. Establish trigger for discharges exceeding bank flows and when notifications are to be given to emergency responders. EAP Enhancement Initiative Key Aspects Described in EAP

8. 8 TIME SENSITIVE EAPS INITIATIVE Sudden-Failure Assessment Sudden-Failure Assessment Sudden/Unexpected Failure During Off- HoursSudden/Unexpected Failure During Off- Hours Focus on First Downstream ResidentFocus on First Downstream Resident Conservative Method (?)Conservative Method (?)

9. 9 METHOD FOR ASSESSING TIME SENSITIVE EAPS Determine Time to Impact Determine Time to Impact Determine Dam Owner’s Response Time Determine Dam Owner’s Response Time Detection TimeDetection Time Verification TimeVerification Time Notification TimeNotification Time Get Estimate of EMA’s Response Time Get Estimate of EMA’s Response Time Calculate Excess Response Time Calculate Excess Response Time Assess Results Assess Results

10. 10 SUDDEN FAILURE ASSESSMENT Time to Impact

11. 11 SUDDEN FAILURE ASSESSMENT Detection Time Amount of Time after Failure Begins until Dam Owner is Aware of Problem Amount of Time after Failure Begins until Dam Owner is Aware of Problem Typically Triggered by Instrument Typically Triggered by Instrument Assume Non-Working Hours Assume Non-Working Hours Based on Test of System Based on Test of System

12. 12 SUDDEN FAILURE ASSESSMENT Verification Time Amount of Time to Verify Problem at Dam, Once Problem Has Been Detected. Amount of Time to Verify Problem at Dam, Once Problem Has Been Detected. In Person, Cameras, Redundant Instruments In Person, Cameras, Redundant Instruments Assume Non-Working Hours Assume Non-Working Hours Based on Test/Drill Based on Test/Drill

13. 13 SUDDEN FAILURE ASSESSMENT Notification Time Amount of Time to Notify EMA After Problem is Verified Amount of Time to Notify EMA After Problem is Verified Includes Discussions Between Dam Owner Personnel before EMA Called Includes Discussions Between Dam Owner Personnel before EMA Called Based on Annual Drill/Call Down Test Based on Annual Drill/Call Down Test

14. 14 SUDDEN FAILURE ASSESSMENT EMA’s Response Time Amount of Time the EMA needs to Warn and/or Evacuate Critical Residences Amount of Time the EMA needs to Warn and/or Evacuate Critical Residences Based on Input from EMAs during Annual Orientation/Meeting Based on Input from EMAs during Annual Orientation/Meeting

15. 15 SUDDEN FAILURE ASSESSMENT Assess Results EnhancementTime Parameter Impacted Benefit Adjust trigger points on headwater/tailwater levels. DetectionQuicker detection. Install internet-accessible cameras pointed at headwater and tailwater staff gages. VerificationEliminates drive to dam to verify emergency. NotificationAllows project manager to activate EAP without talking to operator. Provides redundancy if operator is unavailable. Operator will contact EMA directly if failure is evident. NotificationAllows operator to activate EAP without talking to project manager. Provides redundancy if project manager is unavailable. Create Pre-Scripted Messages for Project Manager/Operator to inform local EMA of emergency. NotificationAllows project manager/operator to give EMA all information they would need as quickly as possible.

16. 16 SUDDEN FAILURE ASSESSMENT Assess Results StepTime ParameterTime (min) ATime to Impact30 BDetection Time10 CVerification Time5 DNotification Time5 EDam Owner’s Response Time (B + C + D) 20 FEMA Response Time20 GExcess Response Time (A – (E + F)) -10

17. 17 1.Large Negative Excess Response Time - the dam owner should be able to improve their detection, verification, & notification. 2.Time to Impact is very small (0-15 minutes) – the residents will be aware of failure before dam owner. 3.For these cases, coordinate with EMA to develop public education. What We Are Finding…

18. 18 Tighten existing HW/TW alarm set points. Install new remote monitoring systems. Thermal imaging to detect breach Solar-powered instruments POSSIBLE ENHANCEMENTS Detection Time

19. 19 POSSIBLE ENHANCEMENTS (CONT) Verification Time Install redundant/independent alarms. Install remote access cameras. Install lights on gages Verify high flows with USGS Gage/National Weather Service. Get non-employee that is closer to verify problem (e.g., local police).

20. 20 Streamline Internal Procedures (Notification Flow Chart). Add Redundancy to Callers. Preliminary Notification of EMAs Develop Pre-Scripted Messages. Use dam-owner controlled Reverse 911 system to notify several agencies at once. POSSIBLE ENHANCEMENTS (CONT) Notification Time

21. 21 Use reverse 911 system to notify residents.Use reverse 911 system to notify residents. Use system to send text messages to residents.Use system to send text messages to residents. Install sirens.Install sirens. Provide NOAA radios.Provide NOAA radios. Dam Owner Agrees to warn people directly.Dam Owner Agrees to warn people directly. POSSIBLE ENHANCEMENTS (CONT) EMA Response Time

22. 22 Dam Owner should coordinate with EMA about providing public education.Dam Owner should coordinate with EMA about providing public education. Annual flier/letter? Signs?Annual flier/letter? Signs? What should people do if river is unexpectedly high and rising?What should people do if river is unexpectedly high and rising? What to do if get Reverse 911 call or hear siren?What to do if get Reverse 911 call or hear siren? PUBLIC EDUCATION

23. 23 CAMPGROUND EDUCATION

24. 24 RESIDENT EDUCATION

25. 25

26. 26

27. 27 EXAMPLE LETTER Our records indicate you live near the White River near Blackstone Dam. Although the dam is safe, it’s possible that high flows or problems at the dam would call for evacuations. (1)If the river is unexpectedly high and rising, call 911 and move to high ground (Main Street near the Burger Shack). (2)Do not walk or drive through moving/deep standing water. If there is no safe escape from your house, go to upper floors and call 911. (3)Your phone number is in the White County automated warning system. If you receive an automated message about high flows – follow the directions in the message. If you have any questions, call Joe Rogers of the White County Emergency Management Agency at (201) 555-1313

28. 28 EXAMPLE LETTER Our records indicate you live near the White River near Blackstone Dam. Although the dam is safe, it’s possible that high flows or problems at the dam would call for evacuations. (1)If the river is unexpectedly high and rising, call 911 and move to high ground (Main Street near the Burger Shack). (2)Do not walk or drive through moving/deep standing water. If there is no safe escape from your house, go to upper floors and call 911. (3)Your phone number is in the White County automated warning system. If you receive an automated message about high flows – follow the directions in the message. If you have any questions, call Joe Rogers of the White County Emergency Management Agency at (201) 555-1313

29. 29 Hebgen Incident At Hebgen, several issues were of interest. At Hebgen, several issues were of interest. The year before the stoplog failure in 2008, PPL-Montana found that the dam failure alarm lacked a long-distance telephone access, which would have prevented the alarm from making call-outs. The year before the stoplog failure in 2008, PPL-Montana found that the dam failure alarm lacked a long-distance telephone access, which would have prevented the alarm from making call-outs. During the incident, the call-outs to 24 hour centers were made, but no one answered. During the incident, the call-outs to 24 hour centers were made, but no one answered. The trading desk did not recognize this as a call to respond to and the main generation desk lacked an answering machine for bathroom breaks, etc. The trading desk did not recognize this as a call to respond to and the main generation desk lacked an answering machine for bathroom breaks, etc.

30. 3030 Risk-Informed Decision Making (RIDM) Program In 2002, D2SI established a Potential Failure Modes Analysis (PFMA) program for all high and significant hazard (HSH) dams. In 2009, the Commission adopted a strategic plan to develop a probabilistically oriented program, titled Risk-Informed Decision Making (RIDM). D2SI recently has initiated development of RIDM engineering guidelines. Drafts of some guidelines are to be completed by September 2013.

31. 31 Tolerable Risk Concepts 31

32. 3232 Risk-Informed Decision Making (RIDM) Decisions are made by using a chart that compares F (the likelihood of failure) to N (the PLL) Decisions are made by using a chart that compares F (the likelihood of failure) to N (the PLL) The fN (or FN) charts have a one to one relationship between frequency and PLL for societal risk The fN (or FN) charts have a one to one relationship between frequency and PLL for societal risk

33. 3333 USACE Societal Tolerable Risk Chart

34. 34 Emergency Action Planning Risk is a combination of likelihood of dam failure and consequence. Risk is a combination of likelihood of dam failure and consequence. There are two ways to reduce risk; reduce the likelihood of dam failure and reduce the consequences. There are two ways to reduce risk; reduce the likelihood of dam failure and reduce the consequences. Dam safety professionals have primarily focused on reduce the likelihood of failure, but need to recognize how the other half of the equation reduces risk. Dam safety professionals have primarily focused on reduce the likelihood of failure, but need to recognize how the other half of the equation reduces risk. 34

35. 35 Emergency Action Planning EAP planning has primarily been focused on responding to unforeseen events EAP planning has primarily been focused on responding to unforeseen events However, good EAPs also reduce the consequence risk, as I will explain in a minute However, good EAPs also reduce the consequence risk, as I will explain in a minute Let’s look back at one of the tolerable risk guidelines currently being used (Slide 34). Let’s look back at one of the tolerable risk guidelines currently being used (Slide 34). 35

36. 36 Consequence (PLL) Risk Another factor in improving our EAP planning is to more properly identify where the potential life loss (PLL) risk is. Another factor in improving our EAP planning is to more properly identify where the potential life loss (PLL) risk is. Knowing where the risk is will improve both the EAP program and help owners better understand the risks inherent with owning dams. Knowing where the risk is will improve both the EAP program and help owners better understand the risks inherent with owning dams. 36

37. 37 Aerial Photo of Priest Rapids Dam Priest Rapids Project, P-2114 (Courtesy of Grant County PUD) 37

38. 38 Aerial Photo of Priest Rapids Dam Google Earth Wanapum Village Right Embankment 38

39. 39 Village Wanapum Village 39

40. 40 Wanapum Village 40

41. 41 Conclusions EAP Planning is essential to improving the life safety risk below dams. Non-failure risks need to receive adequate planning. Planning for time-sensitive potential dam failures is essential 41

42. 42 Conclusions Dam failure alarm systems should be adequately tested Owners should develop a full understanding of the potential life loss from a dam failure. Pre-planning for early intervention during a dam incident could effectively reduce the likelihood of dam failure. 42