A Review of Research and Practice on the Theory and Technology of Reservoir Dam Risk Assessment

Abstract

A current trend is to implement dam risk management. Dam risk analysis is the premise of dam risk management. Methods such as PRA, FMEA/FMECA, FTA, ETA, and group dam risk analysis have been proposed in studies at home and abroad. In practice, it is found that dam breaks or accidents occur even though the dam risk calculated by the existing methods meets the acceptable risk standard, and that many occurred accidents are at variance with dam risk analysis. This indicates that the existing methods have systematic defects, and the dam risk calculated based on such methods is only a part of the actual risk. This paper reviews the dam risk analysis theory and technical research and practice, discusses and analyzes the applicability and existing defects of the dam risk analysis theory, and proposes the future development direction of the dam risk analysis theory. It is concluded that the current dam risk assessment theories are tantamount to the traditional safety factor method coupled with probability analysis. The correlation among influencing factors of dam system risk, as well as the uncertainties of the said factors are not fully considered. Difficulties and opportunities coexist in China to link the existing dam safety standard system with the dam risk management system. The next step is to use system theory to carry out theoretical research on dam operation risk assessment, strengthen the connection between dam risk theory and management status, and formulate risk prevention regulations and technical standards.

1. Introduction

Dam risk refers to the severity of the impact of dam break or flood discharge on life, property, and environment in downstream flooded areas. It is generally expressed by the product of dam break (flood discharge) possibility and dam break (flood discharge) consequence. Since the 1970s, Canada [1,2,3,4,5], the United States [6,7,8], Australia [9,10,11,12], and other countries have carried out research and practice on dam risk assessment and management [13,14,15,16,17,18,19,20] and have achieved fruitful results. Dam risk management involves the following key aspects: risk identification, risk analysis, risk assessment, risk decision-making, and risk treatment (see Figure 1). Risk analysis is the basis of risk assessment. The uncertainty of future operation of a dam is expressed in probability [21] and the consequence of dam break (flood discharge) can be calculated. The risk of the dam can be obtained by multiplying the uncertainty and the consequence. Then the risk can be assessed by comparing risk analysis with the risk standard [22], and risk control suggestions can be provided. Dam engineering experts and scholars have continuously improved dam risk analysis methods in terms of risk identification, risk rate calculation, and risk level calculation of dam groups [23,24,25], etc. However, some problems affecting dam risk analysis have not been solved. Besides dam load, nonlinear factors such as human factors, organization and management, and automatic systems are not fully considered. In dam risk theories, the uncertainty analysis and the studies on the correlation among damage modes are insufficient. The risk analysis method for cascade reservoir groups is in urgent need of research. Moreover, some problems are beyond comprehension. For example, dam breaks or accidents occur even though the dam risk calculated by the existing methods meets the acceptable risk criteria, and many occurred accidents are at variance with dam risk analysis. This indicates that the existing methods have some undiscovered systematic defects. In view of this, this paper provides an overview of various dam risk analysis theories and analyzes their applicability and defects, and points out the future development direction of the dam risk analysis theories. This paper is of certain theoretical significance for improving dam risk analysis methods. Due to the limitation of space, this paper does not include an overview of dam risk standards.

2. Literature Review

2.1. Dam Risk Analysis Methods

After years of improvement, the current dam risk assessment methods are vastly superior to those of the past 30 years. In Bulletin No.130 of the International Commission on Large Dams (ICOLD) [26], Federal Guidelines for Dam Safety Risk Management (2015), Risk and Uncertainty in Dam Safety [27], Dam Design Criteria: The Philosophy of their Selection [28], and Risk Assessment in Dam Safety Management [29], a large number of dam breaks or dangerous accidents are recorded, and dam risk assessment methods, break mode analysis, event tree, fault tree, failure mode, and effects analysis (FMEA) and criticality analysis (FMECA), and other methods are proposed, laying an important foundation for the research and practice of dam risk assessment methods. The Chinese government attaches increasing importance to risk prevention and control, regards the people-oriented concept of “people first, life first” as an important principle for disaster prevention and mitigation, and risk prevention and control in every industry or trade, and strengthens the construction of laws, regulations, and technical standards for reservoir dam risk management. Since 2000, GB/T 23694 risk management vocabulary, SL483 guidelines for flood risk mapping, SL164 regulation for simulation of dam-break flow, SL602 guidelines for assessment of flood control risk, DLT5360-2006 code for simulation of dam-break flow for hydropower and hydraulic engineering, NB/T 5360 code for calculation of dam break flood and unsteady flow for hydropower projects, SL/Z720 guidelines for emergency preparedness plan of reservoir dam safety management, Guidelines for Identification and Risk Assessment of Operation Hazard Sources of Hydropower and Hydraulic Engineering (reservoirs and sluices) (B.J.D.H. (2019) No.1486), SL 605 standard for reservoir demotion and retirement, and many other technical standards have been promulgated and implemented successfully. The energy department has issued and implemented a number of technical standards. In 2015, Nanjing Hydraulic Research Institute (NHRI) and the Dam Safety Management Center of the Ministry of Water Resources compiled technical standards such as the Guidelines on Reservoir Dam Risk Assessment and the Standard of Reservoir Dam Risk Levels, and the achievement of NHRI won the first prize of the National Award for Progress in Science and Technology in 2015. These two technical standards are being merged into the Guidelines for the Classification and Evaluation of Reservoir Dam Risk Levels, which are currently soliciting opinions across the country and will be officially issued and implemented before the end of this year. In recent years, techniques such as dam group risk prioritizing and dam risk assessment have been demonstrated and applied in Jiangxi, Sichuan, Henan, Jiangsu, Anhui, Guizhou, and other provinces.

There are many studies on dam risk analysis methods at home and abroad. The calculation and analysis of dam risk rate can be classified by information source, analysis method, granularity, time characteristic, etc. From the perspective of information sources, environmental load, data such as measured physical and mechanical indexes of dam body and dam foundation materials, and dam safety monitoring data are the main sources. In practice, dam risk calculation and analysis based on dam safety monitoring data can be traced back to the operation performance of natural and filling materials of dam body and dam foundation, and the latter contains information about dam safety risk; in terms of analysis methods, risk factor and risk mode identification [30,31,32] for dam risk calculation and analysis, risk rate calculation, combination and prioritizing of multiple dam risk values, and other analysis methods are applied, and dam risk calculation and analysis are carried out by transforming various mathematical methods [33,34,35,36,37,38]. With regards to granularity, the risk rate is calculated at levels of individual dam, system [39,40,41], and dam groups [42,43,44,45,46,47]. Several experts [47] have established the relationship between individual dam risk rate and system risk rate, and the law of transmission between individual dam risk rate and system risk rate; as to time characteristic, static dam risk rate and time-varying risk rate [48] are involved, and the latter mainly reflects the changes in dam risk over time. From the subjective and objective risks, dam risk rate can be further divided into subjective risk rate and objective risk rate, which are obtained based on subjective dam break probability and objective dam break probability, respectively. Subjective risk rate is widely used now, while objective risk rate requires reliability calculation and other calculation methods [36,37,39,40,41]. Zhou et al. [45] studied the dam design risk, and they preliminarily developed the risk dynamic assessment and control method for cascade reservoir groups based on the “Bayesian Network” theory. The method covers the full life cycle, namely, from planning to design, and thence to operation. They also proposed to enhance the understanding of possible combinations and hazards of extreme events such as floods, earthquakes, and mountain disasters. Some scholars have studied the uncertainty of dam risk rate calculation, and the relationship between risk probability and traditional safety factors [43,44]. These studies are not easy. With respect to management, prevention, and control of dam group risks, dams and reservoirs, the risk prevention and control of cascade reservoir groups have attracted more and more attention from the government and the public due to the tremendous number and wide distribution of dams, and the considerable quantities of dam and reservoir groups, and high dams and large reservoirs. Studies and technical standards related to risk management of dam and reservoir groups in river basins emerge constantly. Academician Wang Hao of the Chinese Academy of Engineering, aiming at the risk prevention and control of cascade reservoirs in the Yangtze River basin in China, has studied key scientific issues such as risk breeding mechanism and disaster chain effect of cascade reservoirs, risk design theory and risk prevention and control mechanism of cascade reservoirs, and risk early warning and emergency response mechanism of cascade reservoirs. In 2020, the National Energy Administration of China formulated the Guidelines for Risk Prevention and Control of Cascade Reservoirs, which specifies the relevant requirements for risk prevention and control at stages of planning, design, construction, operation, and decommissioning of cascade reservoirs. In 2020, The National Energy Administration of China formulated the Emergency Preparedness Plan and Requirements for Hydropower Projects in a River Basin, which specifies the emergency organization, risk assessment, contingency plan preparation, and emergency supplies preparation of for reservoirs and hydropower stations in river basins.

In recent years, based on the research and practical application at home and abroad, methods such as scenario analysis method, checklist method, pre-risk analysis method, failure mode and effect analysis method, risk matrix method, risk index method, and causal analysis method have been proposed in China, and have been gradually applied in the theories and practice of dam risk assessment [45,46]. In fact, these methods are the Chinese versions of PRA, FMEA/FMECA, etc., and they transform the dam break risk rate based on probability into a risk index.

2.2. Risk Analysis Methods for Individual Reservoir Dams

Many dam engineering experts at home and abroad have carried out theoretical studies on dam risk assessment, but their studies are within the scope of probability-based risk analysis (PRA), failure mode, effects and criticality analysis, failure mode and effects analysis (FMEA) and criticality analysis (FMECA), fault tree analysis (FTA), event tree analysis (ETA), etc. Strictly speaking, the traditional safety factor method is actually a dam risk assessment method that indicates risks by safety factor.

2.2.1. Traditional Analysis and Decision-Making Method Based on Safety Factor

The safety factor method takes FS=Capacity/demand as the analysis principle of structural safety. Generally, the safety factor should be greater than 1.0 for the analysis of structural safety, but the current reservoir dam standard systems in various countries do not support the quantitative consideration in the situation that the conventional load is not an extreme load. Dam engineers rarely mention the safety management requirements of dam systems under normal load condition because there is no corresponding quantitative standard available. In aspects such as internal erosion of dams or reliability of electronic equipment, especially in human reliability, greater challenges exist. To remedy the defects of the above-mentioned ultimate state design method, the load partial coefficient method has been developed in recent years. The new method reflects the uncertainty of dam load and is related to the concept of structural reliability. However, this method is actually a pseudo-probability method for safety inspection.

2.2.2. Dam Risk Analysis Theory Based on probability

The natural load, disasters, vulnerability, and accident consequence acting on dam system are quantitatively considered. Dam risk is the expected accident consequence, that is, the product of the dam break probability and the loss caused by dam break. This method is referred to as probabilistic risk analysis (PRA) for short. PRA is different from the engineering safety factor method. The former focuses on risk level and protection against floods, while the latter focuses on engineering safety. PRA can reasonably express the uncertainty of dam load and dam performance. It is recognized and accepted by dam professionals and can also be used for risk prioritizing of dam group risk factors. From the subjective and objective point of view, the methods of obtaining the dam break probability in the PRA method mainly include the subjective dam break probability and the objective dam break probability, and after the practical test and the complexity of the influencing factors, the applicability and feasibility of the subjective dam break probability are greater than objective dam failure probability.

2.2.3. Failure Mode and Effects Analysis (FMEA) and Criticality Analysis (FMECA)

Failure mode and effects analysis (FMEA) is one of the qualitative risk analysis methods. It can be used to analyze the consequences of accidents occurring during dam operation. Failure mode, effects, and criticality analysis (FMECA) is suitable for prioritizing risk factors of individual reservoirs. It can be used to find defects and vulnerabilities of dams and provide basis for safety improvement and risk treatment schemes of dams. FMEA only explains the scope and consequence of system failure modes, while FMECA provides occurrence probability and consequences of each failure mode. In 2019, the Ministry of Water Resources issued the Guidelines for Identification and Risk Assessment of Operation Hazard Sources of Hydropower and Hydraulic Engineering (B.J.D.H. [2019] No.1486), which recommends the risk matrix method (“LS method”) for identifying risk sources. The LS method is essentially the Chinese version of FMEA/FMECA.

2.2.4. Event Tree Analysis (ETA)

ETA can visualize the logical sequence of accidents and combines qualitative and quantitative methods to analyze dam break probability. It is very useful in dam risk decision analysis. When ETA is used for dam risk analysis, firstly the dam break path of a certain section is constructed (see Figure 2). For example, foundation piping behind the dam when the water storage level is normal → reverse erosion at the piping outlet → local emptying of the foundation under the dam → leakage channel formation after full emptying of the foundation under the dam → continuous scouring and expansion of the leakage channel → dam collapse → manual intervention → dam break [49]. Then, the failure probability of each branch on the failure path is assigned. For example, there are two branches at the manual intervention node: there is enough time to intervene, and there is not enough time to intervene (according to Moore’s Law, the conditional probabilities of the two branches on the same node adds up to 1.0). The probability of this failure path can be obtained by multiplying the conditional probabilities of each negative branch in the accident chain (such as the probability of “there is not enough time to intervene”), and the total dam break probability can be obtained by adding all the failure probabilities of the failure path. Scholars at home and abroad have tried to quantitatively calculate the probability of dam failure through theoretical methods (such as reliability method) [50]. However, due to various uncertainties such as environment, human factors, models, parameters, etc., it is very difficult to calculate the probability of dam failure by theoretical methods, and the results are not reliable. Therefore, people turn to qualitative and semi-quantitative methods based on expert experience to calculate the probability of dam failure, such as the event tree method [51]. Qualitative judgments about the possible occurrence of events are transformed into quantitative probabilities.

2.2.5. Fault Tree Method (FTA)

FTA shows explicit and readily comprehensible causal relationships. It can be used for qualitative and quantitative analyses [52,53]. According to the probability of each basic event, the probability of the top event can be calculated, and the influence of each basic event on the accident can be determined. FTA is deductive reasoning, and it is a top-down method to analyze the influence of initial failure events of complex systems; FMEA, on the contrary, is inductive reasoning, and it is a bottom-up method to analyze the influence of failure of individual components.

Among the above-mentioned risk analysis methods, PRA is a concept. Due to a number of complex influencing factors, dam break probability calculation is often not easy. Therefore, methods using dam break probability instead of risk index come into being. Both FMECA and portfolio risk assessment are based on this concept. ETA is used to construct dam break probability calculation framework, and FTA is used to analyze fault logic and probability of a specific node. FTA can discover the failure cause and logical structure of a top event theoretically, thus it is of the cause logical structure. According to the results of FTA, ETA reveals the logical sequence structure characteristics of an event from its beginning to its development, thus it is of the time sequence logical structure. The purpose of FMECA is to find out the causal relationship between the failures of dam components and the overall failures of dam system, and to identify the main failure modes of dam risks conceptually so as to provide the basis for the safe operation and management of dams. FMECA can be used to find the most dangerous failure modes.

All methods of analysis have limitations (see

Table 1. The limitations of current dam risk analysis methods.

Serial Number	Considering Aspects	FMEA/FMECA	ETA	FTA
1	Initiating aspects	The failure modes of reservoir dams should be listed comprehensively, which depends on the experience and understanding of experts	The initiating challenge is not disclosed by the analysis, but must be foreseen by the analyst.	The possibility of accident caused by the cause is presumed to be a weakness
2	Accurate aspects	The accuracy of analysis mainly depends on whether the degree of human intervention in specific failure mode is accurate	Although end events need not be anticipated operating pathways must be foreseen by the analyst.	A fault tree is not accurate unless all significant contributors to faults or failures are anticipated.
3	Ability to analyze complex systems	not suitable for dealing with complex software intensive systems, complex human-computer interactions and distributed decision-making systems that span physical and organizational boundaries	not suitable for dealing with complex software intensive systems, complex human-computer interactions and distributed decision-making systems that span physical and organizational boundaries	not suitable for dealing with complex software intensive systems, complex human-computer interactions and distributed decision-making systems that span physical and organizational boundaries
4	Expert aspects	The analysis depends heavily on the ability and expertise of the analyst for finding all necessary modes.	The analysis depends heavily on the ability and expertise of experts	The analysis depends heavily on the ability and expertise of ex-perts

Above table contents are transformed from the presentation of Dr. Des Hartford, BC Hydro, Canada in International Symposium on Dam Safety and Risk Management, named “New Directions in Risk Analysis for Dams”.

). The FMEA/FMECA method depends heavily on the ability and expertise of the analyst for finding all necessary modes, which easily lead to different results by different experts. The ETA method has the limitation of initiating problem, which is that the initiating challenge is not disclosed by the analysis, but must be foreseen by the analyst, and although end events need not be anticipated operating pathways must be foreseen by the analyst. A fault tree in FTA method is not accurate unless all significant contributors to faults or failures are anticipated.

2.3. Group Risk Assessment

Group dam risk management was first proposed by David S. Bowles of Utah State University in 1996. Group dam risk management was successfully applied in Australia firstly [54,55,56], and the purpose was to optimize the allocation of resources for a group of dams. Dam management institutions in the United States, Canada, and China have developed their own techniques for prioritizing dam group risks. Now there are many portfolio risk assessment methods, most of which establish a risk index calculation formula of individual reservoirs and specify the value determination method of various parameters in the formula. By comparing risk indexes of individual reservoirs, the results of dam group risk prioritizing can be obtained. Based on the analysis of dam operation defects, combined with relevant dam risk evaluation factors, and according to the system fuzzy comprehensive evaluation theory [57], the Dam Center of China Energy Administration establishes a comprehensive evaluation model of dam risks in operation of hydropower stations so as to realize the comprehensive evaluation of dam groups. From various dam group risk calculation methods, the factors affecting dam risk are considered, including reservoir characteristics, dam defect level, and downstream loss caused by dam break. Environmental factors, emergency management capacity, and daily management factors are also considered in some methods.

The reservoir characteristics mainly comprise storage capacity and dam height, which are considered in the method of the National Energy Administration of China, and in Andersen’s dam risk prioritizing.

Defect level of reservoir dams are considered in almost all methods, but they are expressed in different ways, such as defect severity in Canadian BC Hydro’s dam risk prioritizing method [58] (see Figure 3), structural safety factor in Andersen’s dam risk prioritizing method, dam safety level (seepage, structure, seismic resistance, flood control, and other factors are considered) in the method of the National Energy Administration of China. The influence of dam age is also considered in Andersen method and the method of the National Energy Administration of China. In addition, the idea of how to consider the dam defect level in dam group risk prioritizing proposed in the dam risk prioritizing method [59] used by Washington State, USA, is worth learning from. For example, “a dam with three minor defects should be ranked lower than a dam with one medium defect”, “dam with two medium defect risks should be ranked lower than dam with one important defect”, “when all conditions are the same, old dams should be given priority”, “dams with similar consequences and serious defects should be given priority”, and “dams with minor defects should be ranked lower than dams with major defects, regardless of the consequences”.

Andersen et al. proposed a risk index prioritizing method for earth-rock dams. This method is mainly used to prioritize tasks such as dam maintenance and reinforcement [60]. The risk indexes are not used to directly measure risks. They are used as relative indexes to generate a comprehensive evaluation from three aspects: dam characteristics, dam operation defects, and dam break consequences. Among them, dam characteristic index V is calculated by the following formula:

$$V=\frac{\left(I_1+I_2+I_3+I_4\right)}{4}\frac{\left(E_1+E_2\right)}{2}\frac{\left(D_1+D_2\right)}{2}$$

(1)

where I denotes the inherent dam characteristics that do not change with time, I₁ is dam height, I₂ is dam type, I₃ is dam foundation type, and I₄ is reservoir capacity; E denotes external characteristics that change with time, E₁ is dam age and E₂ is earthquake intensity; D denotes design-related characteristics, D₁ is flood discharge capacity, and D₂ is the safety factor of dam slope. These eight factors are assigned a score of 1 to 10.

For the determination of dam operation defect index, firstly, four main dam break modes M_i of earth-rock dams are defined, namely overtopping, surface erosion, piping and sliding, and 28 different operational performance defects CF_j are defined under each dam break mode. According to historical data and engineering experience, experts determine the conditional probability P [M_i∣F] of different dam break modes relative to dam break events, and the conditional probability P [CF_j∣M_i] of different operational performance defects relative to dam break modes, and assign a score from 0 (failure state) to 10 (safety state) to each operational performance defect CF_j according to scheduled inspection reports of the dams. Therefore, the formula for calculating the final risk R of the Andersen’s dam risk prioritizing method is as follows:

$$R=V\times H\times {\displaystyle \sum _{i,j}P\left[C{F}_j|M_i\right]}·P\left[M_i|F\right]·\frac{10-C{F}_j}{10}$$

(2)

The dam break consequence index H is determined according to the Federal Guidelines for Dam Safety—Hazard Potential Classification System for Dams issued by the Federal Emergency Management Agency (FEMA). Consequence index H is mainly scored according to loss life and economic, environmental and infrastructure loss. For example, the corresponding condition of Low potential hazard level is No potential loss of life and Low and limited to the losses of owners, with the Score of H 1. the corresponding condition of High potential hazard level is One or more casualties and Losses are caused (but this is not a necessary condition for the level), with the Score of H 10. The classification of intermediate values such as between 1 to 5 and 5 to 10 should be assigned according to expert’s experiences and corresponding loss values and other relevant guidelines.

Downstream losses are considered in the above-mentioned risk prioritizing methods, showing the importance attached to downstream losses.

As for operational environmental impact of dams, the influence of external load is considered in BC Hydro and USACE portfolio risk assessment methods, and seismic intensity in the place where the dam is located is considered in Andersen’s dam risk prioritizing method.

With respect to emergency management capacity, the ineffectiveness of temporary risk control measures in emergency situations is considered in the Canadian BC Hydro’s method, the factors that hinder providing warnings to the public are considered in the method used by Washington State, USA, the emergency response capacity of hydropower stations and the deduction of emergency management points in registration assessment are considered in the method of the National Energy Administration of China. The contingency plan is a typical index of downstream impact.

In regards to daily management, performance evaluation scores of dam safety registration management of hydropower stations are also considered in the portfolio risk assessment method of the National Energy Administration of China to reflect the dam risk caused by daily management factors. The ineffectiveness of Canadian BC hydro’s temporary risk control measures is closely related to daily management, and it is equivalent to the resilience of dam defects.

Among the above-mentioned methods, the portfolio risk assessment methods developed by BC Hydro and the energy industry of China take more factors (including the above-mentioned five factors other than environmental factor) into account, providing a useful reference.

3. Analysis of the Applicability of Dam Risk Assessment Theories

3.1. Applicability Determination According to the Level of Detail

It is unrealistic and unnecessary to conduct detailed quantitative risk analysis for all dams. According to the definition of the Australian National Committee on Large Dams (ANCOLD) [61], risk assessment is at four different levels, namely screening assessment, preliminary assessment, detailed assessment, and very detailed assessment. According to the Australian classification method, different assessment levels have different requirements for analytical methods and technical data. Risk assessments at a specific level of detail is applicable to dam risk management with corresponding granularity. Screening assessment and preliminary assessment are applicable to dam safety supervision, while detailed assessment and very detailed assessment are applicable to dam design and operation management. The dam risk calculation and analysis methods of various countries follow the same path from rough to detailed, from simple to complex, and from macro to micro. A British guide for reservoir safety risk assessment [62] defines three levels of risk assessment. The first level is qualitative risk assessment, which can be initial assessment of all reservoir dams. In the assessment, dam defects and potential accident modes are identified according to expert experience, possible accident consequences are analyzed, and a simple risk matrix is used to qualitatively describe the accident probability and accident consequences. The second level is simple quantitative risk assessment, which involves more detailed and complete accident mode identification, and requires further analysis of accident probability caused by internal and external factors, assessment of flood path in case of dam break, estimation of casualties and economic loss, and ALARP evaluation. All the analysis steps are simplified, and the full assessment for a dam takes only 1–2 days and can be completed without the help of computer software; the risk assessment at the third level is completed on the basis of the assessments at the first and second levels, and is often for key parts of dams, or for key dams.

3.2. Applicability Determination According to Stages

Dam risk assessment methods vary in terms of applicability. Generally, they can be divided into three levels by stage: design risk, construction risk, and operation risk (see Figure 4). Some problems are caused during the design and construction stages. They are inherent risks, which definitely turn into defects or deficiencies in the operation stage (such as design risks of extremely low flood control capacity or flood discharge capacity, construction risks of nonconforming construction design or techniques of dam-crossing structures, and risk due to insufficient consideration of geological conditions and seismic safety in the design process [63,64,65,66]) once the conditions are met. If these inherent risks are properly controlled in the operation stage, the risk management and control may be maintained at an acceptable level. If the management and control are problematic in the operation stage, risks or even dam break accidents may occur. There are many risks or dam break accidents caused simply by insufficient operational risk management and control. The National Energy Administration of China took the lead in issuing the Guidelines for Risk Prevention and Control of Cascade Reservoirs, in which the risk prevention and control of cascade reservoir groups in planning stage, design stage, construction stage, operation stage, and dam decommissioning are considered. The risks in the design and construction stages before operation are regarded as inherent risks, and the operational risks are acquired risks. Most accidents or dam breaks are jointly caused by inherent risk and operational risk, and many are solely caused by operational risk (active risk). No matter from the perspective of inherent risk or acquired risk, it is necessary to carry out research on operational risk management techniques. Detailed assessment of dam break risk rate based on risk probability is more suitable for design concept. Design risk can be used to check whether the design standard is appropriate in the post-operation evaluation, but this is a very complex, detailed, and time-consuming detailed risk assessment, which is very costly if a huge number of reservoirs need to be assessed. It is very important to use a moderately complex dam risk analysis method for industry management.

The existing dam risk theories can be classified by three dimensions, namely design risk, operational risk, and supervision risk. Dam risk assessment methods based on ETA and failure probability are applicable to design risk assessment; FMEA/FMECA and operational risk theories are applicable to dam operational risk assessment; and portfolio risk assessment method is applicable to supervision risk assessment.

3.3. Applicability Determination According to Probability Calculation Method

“Subjective failure probability assessment” was developed at the same time that dam risk assessment theories emerged [27,67]. Subjective probability and its application in dam security risk assessment are mainly for identifying subjective uncertainty. Subjective uncertainty is related to experts’ knowledge, while objective uncertainty is related to the natural changes in time or space. Subjective uncertainty is a thinking attribute, which is related to the scope of experts’ knowledge. If experts invest time and energy to obtain more information, the subjective uncertainty is reduced accordingly. Objective uncertainty is a natural attribute. Assessment may be more accurate if more efforts are made to understand natural attributes, but objective uncertainty can never be eliminated. Subjective probability is not an inaccurate index or a conjecture without ground. Objective probability may not be achieved or operational. The current trend is to use the subjective probability method for an entire system and use the objective probability calculation method for parts of a system. The two methods complement and promote each other.

4. Analysis of the Defects of Dam Risk Assessment Theories

4.1. Dam Risk Values Calculated Based on the Current Dam Risk Assessment Theories

The portfolio risk prioritizing technique has no obvious problems, with the same scale for measuring the risks of different dams. The problems in the comparison of calculated dam risk values with risk criteria were gradually discovered. The acceptable dam risk criteria recognized by the UK Health and Safety Committee and China’s dam risk criteria are based on the frequency of observed historical dam break accidents caused by any reasons. Sometimes accidents or failures occurred even the reservoir dam risk met the acceptable risk criteria [27], and some accidents or failures were at variance with dam risk analysis. That is to say, the existing dam risk assessment methods have systematic defects, which lead to the calculated dam risk being smaller than the actual dam risk [68], and only a part (perhaps a major part) of the actual dam risk. It seemed that the dam risk is acceptable based on the comparison of the calculated dam risk values with the risk criteria, but dam breaks occurred, which indicates that the dam risk values were problematic, and that the actual risks were not identified by using the existing risk analysis methods. Therefore, new theories and methods are needed to support the objective calculation of dam risk rate.

4.2. No Conceptual Difference between Dam Break Probability and Engineering Safety Factor Calculation

Theoretically, risk-based dam safety evaluation and decision-making methods just transform safety factor into engineering failure probability, which is essentially a probability characteristic that combines flood, earthquake, and normal operating conditions in the traditional methods based on engineering standards with dam disaster and emergency response. Such methods involve the analysis of pseudo-risk notification. They are no different from the safety factor method. More specifically, they are traditional methods coupled with risk concepts. In addition, only total dam break probability and dam risk can be obtained by the existing dam risk analysis methods. The risks of branches can only be compared with each other because there is standard for comparison. Moreover, in the assessment process, social, economic, and institutional factors, standards, operation, human factors, and other factors cannot be fully considered. In conditional probability, “human intervention” is only set before damage occurs, and it is not fully considered from the perspective of the mechanism of failure caused by human factors. From the perspective of influencing reservoir operation and flood process, the development direction of dam risk analysis is to put forward the theory and technology of dam risk assessment, clarify the different operation modes adopted in each operation link in the reservoir operation and management process, and the corresponding risk degree of each operation mode.

4.3. Defects in the Existing Dam Risk Analysis Methods

• In ETA, analysis of initial events is particularly important. However, judgment is only based on the experience of dam engineering experts. The construction of the development process and evolution path of a failure presupposes predictions by dam experts, and cannot be obtained by ETA, otherwise the analysis results of ETA may be affected.
• FTA is a useful tool for analyzing causes of dam break accidents, but it is not ideal for calculating the possibility of accidents caused by different factors. It is highly dependent on analysts, fault trees established by different analysts may produce different analysis results. For complex systems, the fault tree is large, which brings difficulties to qualitative and quantitative analyses. The results obtained by FTA are inaccurate unless all the factors contributing to dam break or dangerous failure can be identified based on experts’ experience.
• FMEA/FMECA relies heavily on the experience and judgment of dam engineering experts. Methods such as ETA, FTA, and FMEA/FMECA are highly dependent on the experience of dam engineering experts.
• Dam risk assessment method based on probability: Traditional reliability analysis methods require high-quality original data. However, due to various restrictions, the data of some influencing factors of dam systems are often insufficient; therefore, the non-probabilistic reliability analysis method for dam risk assessment have attracted much attention, but the studies on such method are few.
• Dam risk rate analysis with multi-failure mode correlation: It is often assumed that the failure modes are independent of each other in current studies [31], or the failure probability is studied in only one failure mode without considering the correlation among multiple failure modes of dam break, leading to the inconsistency between the evaluation results and the objective facts. The development trend of dam risk analysis is to explore the series, parallel, and series-parallel connections among failure modes of dam system, and to build a dam risk rate solution model with multiple failure modes.
• Traditional dam risk analysis techniques have obvious defects in dealing with modern complex influencing factors of risk. Traditional dam risk assessment techniques mainly include FMEA/FMECA, FTA, PRA, etc. All of them are based on accident path analysis. However, these risk assessment techniques have some common defects. They are not suitable for dealing with complex software-intensive systems, complex human–computer interaction systems, and distributed decision-making systems that span physical and organizational boundaries.

4.4. The Theoretical Studies on Risk Assessment of Reservoir Dam Groups

Watershed-based cascade development of hydropower resources has become a new trend in the development of water conservancy and hydropower in my country. However, the current research results are mostly risk analysis models or methods for a single dam. The research on the calculation theory and technology of dam group risk assessment is relatively rare [69,70]. Compared with a single dam, the risk analysis process of cascade reservoir dam groups is more complicated. The overall risk of cascade reservoirs depends on the combination of the location of the reservoir group, the scale of the reservoir and the height of the dam. Cascade reservoirs are generally divided into series mode, parallel mode, and mixed mode according to their location relationship (see Figure 5).

Most of China’s reservoirs are in some kind of model reservoir group. For example, for a relatively simple series model, the risk is more controllable. There is a reservoir with a large storage capacity and a safe dam structure at the most downstream. For example, Reservoir 1 and Reservoir 2 are small reservoirs, and Reservoir 3 is a large reservoir. However, if Reservoir 1 to Reservoir 3 are all medium-sized reservoirs (large or small) with similar storage capacity, if a large flow of flood discharge or dam rupture occurs in Reservoir 1, it is easy to cause the two downstream reservoirs to collapse continuously [71]. In 2021, the Yongan and Xinfa reservoirs in the Mongolia Autonomous Region of China are typical cases of this situation. The risk level of cascade reservoir groups is more complex in the parallel mode and the mixed mode. At present, there is no risk assessment method for such reservoir groups and the in-depth understanding of the regularity of risk transfer. The setting of prevention and control and flood control standards is relatively simple or unclear. For example, the design of a single reservoir does not consider the risk of benefit and the risk of failure of the upstream reservoir. For the current stage of social and economic development in my country, this is a new problem that needs to be systematically studied and solved. How to construct an evaluation model and method for the overall failure probability of a dam group system based on the study of the failure probability of a single dam, and how to conduct risk analysis and management of the dam group based on this is a topic that scientific researchers need to study in depth.

In the aspect of risk assessment theory and technical research on cascade reservoirs or dam groups, the author preliminarily considered three directions: (1) research on the method of delineating the scope of cascade reservoirs or dam groups (that is, how to consider the distribution scope of reservoirs included in the risk of dam group system); (2) how to calculate and analyze dam group risk under different reservoir group layout, different storage capacity, and different dam types and different dam heights; (3) and how about risk transmission mechanism of cascade reservoirs.

4.5. The Influencing Factors of Risk in the Existing Dam Risk Assessment Theories

• Nonlinear factors are not effectively considered in the dam risk assessment system. Nonlinear factors other than reservoir dam are not considered sufficient in current dam risk analysis methods. Factors such as human factor, organization and management, and automatic control systems are the main sources of high nonlinearity. The so-called nonlinear factors are factors that may not directly cause dam breaks or accidents, but have an indirect and long-term impact on dams and threaten dam security. The theories and practice of dam risk assessment have focused on dam structure for many years. Operational factor and automatic control system errors (in 2021, the intake gate of Xigou Dam of Xiaolangdi Reservoir was opened for no reason, resulting in overtopping) and human factor (in 2021, the stuck floaters of automatic water level gauge in Liuchong Reservoir, Anhui Province, caused the abnormal rise of water level, and no measures were taken) are ignored in dam safety risk assessment. To effectively simulate dam systems, it is necessary to regard dams as systems [72,73,74] and establish a dam system simulation method that transcends the traditional decomposition analysis methods and can be used to understand the correlation among components of a dam system and system engineering behavior.
• Duration of operating conditions is not considered in risk-based assessment theories. Even if the probability of an operating condition is small, the possibility of dam accident is directly related to the duration of the operating condition. The longer the duration, the higher the probability of dam accident. This is hardly reflected in the existing dam risk assessment models. In addition, the operating environments of dams are complex, and many risk factors change with time. It is necessary to consider the time-varying characteristics of various factors that influence the dam reliability, and to further explore methods for building dam time-varying risk rate models.

4.6. The Uncertainties in the Process of Dam Component Combination

Practice proves that many dam break accidents are caused by operation accidents instead of extreme loads. Seemingly, such dam break accidents stem from inadequate operation management. However, related research found that [27,68,75,76] the deep-seated reason is the system defects that operation management cannot “control”. Such accidents do not stem from the system failure caused by the failure of one or more links in the accident chain. Instead, all components in the dam system operate normally, but the uncoordinated relationship among some components causes local damage, which leads to system collapse. Nonlinear factors such as organization and management, manual operation, and information control in the operation of reservoirs, as well as the failure to regard reservoirs as systems, are the root causes of the above problems, which cannot be solved by the existing dam risk assessment methods. Therefore, such dam break accidents seem very “weird” and catastrophic. In the case of Xigou Dam, the correlation between the gate opening for no reason and the absence of spillway was not considered. The power supply system of the arch dam of Shuangjiang Reservoir in Guizhou was at the position scoured by discharged flood. After the emergency flood discharge, the power supply system was submerged and unable to raise the gate for flood discharge, leading to overtopping. It is necessary to develop new dam risk assessment methods that consider portfolio risks caused by uncertainties of correlation among system components. From the perspective of actual operation and system security, it is necessary to develop new dam risk analysis methods that consider the operation process to study and identify the correlation among seemingly irrelevant factors, and obtain some unexpected risk portfolios.

4.7. The Dynamic Process Risk of Operation

Most of the existing dam risk assessment theories take behavior results as risk factors. The dam risk assessment methods based on dam failure probability that are widely used at home and abroad are result-oriented rather than process-oriented risk theories, which cannot consider the operation process. The specific process of dam operation and operation management may cause dam failure or wreck, and cannot provide help or theoretical support.

On the one hand, the limitation of PRA is that only those operational accidents that are clearly identified, foreseen, and generalized into accident chains are considered in risk analysis. Those unpredictable or unconventional risk portfolios under conventional conditions cannot be clearly identified and generalized. They are often ignored in dam risk analysis by PRA, thus the analysis results may be affected. For example, Teton, Silver Lake, and Taum Sauk dams [77,78,79] had imperceptible system factors and related nonlinear factors before break.

On the other hand, the current dam risk assessment methods usually involve three types of failure modes, namely, overtopping, structural instability, and seepage. These three types are actually the results of dam failure, reflecting little information about the failure process. Dam breaks are caused by the synthetic action of various subsystems. The action process stems from a sudden failure of transmission lines, or a manual operation error of gate, or some mechanical failure, etc. A process-based dam risk assessment method is needed to analyze the reasons of reservoir water level changes (perhaps related to spillway operation), the mode of coordinative development of dam engineering and operation organization and management at a certain water level, and the resulted different dam risks. The traditional methods are dam risk assessment methods based on management results (management state). Dam risk assessment methods based on management process shift the focus from state risk to operational risk. They can provide more support in guiding dam risk management practice and developing dam risk management theories and techniques.

4.8. The Research on the Uncertainties in Existing Dam Risk Assessment Results

• The framework and technical route of the research on uncertainties in dam risk probability calculation have not yet been formed. Besides the uncertainty of parameters and indexes necessary for dam break probability calculation, there are many other uncertainties [43,80,81,82], such as analysis methods and calculation models. First of all, a framework of the research on uncertainties in dam risk calculation should be established, and then the technical route, research direction and specific research topics should be determined. Based on the consulted relevant data [27,83] and personal understanding, the authors believe that the uncertainty analysis of models should be combined with the sensitivity analysis of dam failure probability. Furthermore, distinguishing natural uncertainties from cognitive uncertainties is an important task and challenge in dam security risk management.
• The subjective dam break probability assignment method, which is widely used, has great discretion but the subjective dam break probabilities assigned vary greatly with assigners. Even if the same conversion standard of qualitative accidents and quantitative assignment is applied [84], the subjectivity of dam break probability calculation is difficult to avoid due to the differences in experts’ knowledge, professional background, and understanding level. Sometimes the assigned probabilities by different experts for the same conditions are significantly different.

4.9. Regional Risk Assessment Methods

In the reservoir dam security risk management, there is no dam risk assessment method for individual reservoirs or individual regions. The risk regression analysis, assessment, and prediction for different periods are not systematic enough. For different management objects, there is also a need to carry out dam risk assessment. From the perspective of regional management, industry management, and management object, it is necessary to develop and propose dam risk assessment theories and techniques of corresponding granularity based on the existing reservoir dam risk assessment methods.

4.10. The Dam Risk Assessment Theories and Management Techniques

The dam risk assessment theories and management techniques have not well-integrated with the reservoir dam management in China. After reservoirs are put into normal operation, they are under full-cycle management, which involves responsibility system, registration, dispatching, maintenance, patrol inspection, safety monitoring, safety in flood season, safety appraisal, reinforcement for danger elimination, contingency plans, degradation, and scrapping, etc. In these links, the concept of risk management and differentiated management based on risk level are not fully reflected. It is very important and urgent to closely combine the risk dam assessment results with all links of reservoir operation management cycle and propose requirements and systems for reservoir dam risk management in China.

4.11. Difficulties in the Method and Work of Realizing the Change in Dam Risk Concept

According to Bulletin No.130 of ICOLD [26], the main limitations of current dam risk analysis methods are as follows: it is very difficult to reliably quantify the probability of dam break or accident and assess the consequences of dam break and the related uncertainties; few widely recognized and accepted methods can be used to determine tolerable risks; and few concepts of tolerable risks are widely accepted, and there is no tolerable risk level suitable for each country. China has carried out research and practice on dam risk assessment technologies for more than 30 years, but the relevant technologies have not been brought into practical use. The reasons are as follows: (1) China’s existing safety standards for reservoir dams are systematic and have proven feasible by years of practical experience. The existing dam safety standard system does not fail to consider the concept of risk. For example, the larger the project scale, the higher the safety requirements. High safety requirements show good performance of the risk concept, but the level of quantitative risk analysis and detailed analysis is not enough. Although it is necessary and urgent to establish and reconstruct the standard system for reservoir dams based on the risk concept, the standard system based on the risk concept is different from the existing standard system. The standard systems are very different, such as what is the relationship between the probability of dam failure and the safety factor, whether the risk-based standard system is reliable in engineering planning and design, how to use two sets of standards with inconsistent theoretical methods and whether they are mature, using the risk-based standard concept amending the safety classification and flood standards in the existing engineering safety standard system is appropriate, and the establishment of a risk-based dam safety standard system affects the whole body. The above problems need to be solved quickly. (2) The concept of dam risk management is not integrated with the characteristics of Chinese reservoir management. It is not feasible to copy foreign experience. It is even more unrealistic to rely on dam engineering experts to carry out detailed and very detailed risk assessments for all reservoirs. The entry point of the dam is very critical. Simplifying the concept of probability into a risk index, strengthening the risk assessment of primary dams from the perspective of industry management, and developing risk ranking technology for group dams are the way out. (3) Relying on expert scoring is difficult to fully implement in China. It is unrealistic to require each reservoir in a province with 3000 reservoirs to obtain risk index values through expert scoring. It is very important to establish a practical risk ranking method for group dams. (4) Incorporating the risk assessment of group dams into information management is the means.

5. Exploration of the Future Development of Dam Risk Assessment Theories

5.1. Theoretical Research on Operational Risk Assessment of Reservoir Dams

The next-generation dam risk analysis theories and techniques should focus on “operational risks”, such as misunderstanding caused by electronic sensing system, important precursors of administrators’ omissions, and failure of the spillway gate system caused by maintenance problems. The current probabilistic risk analysis (PRA) provides little or no help for engineers to understand operational management risks. It is very important, crucial, and necessary to develop theories and methods for assessing operational risks in operational management.

5.2. Dam Operational Risk Based on System Theory

The author believes that the operation risk of dam system is closely related to time factors and system components, and to carry out dam risk assessment from a systematic perspective to make up for the systematic defects of existing dam risk assessment. Based on the existing dam risk analysis methods, using systems engineering, system dynamics, and other theories to study the dam operation risk assessment method, we analyzed the characteristics of the dam operation system, the relationship between system components, and the decomposition and combination methods, and explored the dam operation risk assessment method. The expression methods of interference, organization management, and human-induced random characteristics in operational risk assessment reveal a quantitative risk assessment model for the uncoordinated risk of dam system components, and a dam system operational risk assessment method can be built. The research on this subject is a fundamental change from the result-oriented to operation-oriented dam risk assessment theory, and an extension of the current dam risk assessment theories and methods.

5.3. Differentiated Management Practices Based on Dam Risks

Dam group risk prioritizing techniques are very useful for water resources administration departments at all levels to carry out supervision of the reservoir industry. They can be realized without increasing investment, and are easily accepted by in different regions. By placing high risks before low risks, and automatically providing information about risk factors, solutions, and relevant suggestions for each reservoir, strong technical support can be provided to water resources administration departments at all levels. It is necessary to strengthen the research on reservoir risk management mechanisms and measures, and develop new feasible regulations on key systems such as reservoir dam responsibility system, patrol inspection, safety monitoring, safety appraisal, contingency plans, degradation, and scrapping.

5.4. Dam Risk Assessment for Different Regions, Time Granularities, and Object Granularity

It is necessary to develop and propose comprehensive dam risk assessment methods for different regions, time granularities, and object granularities. Regional granularities include individual reservoir, county, province, river basin, and country. An omni-dam risk index calculation and analysis system should be established; time granularities include the past, current, and future. Dam risk assessment theories and technical frameworks for different time granularities should be developed; different objects refer to managers at different levels who are responsible for reservoir management within different scopes. Through dam risk assessments for different reservoirs, the management effectiveness of different managers can be evaluated.

5.5. Connection between Dam Risk Assessment Theories and Current Reservoir Dam Safety Management

It is particularly important to study and solve the problem of the connection between the standard system based on the risk concept and the existing dam safety standard system. The dam risk assessment theory and technology based on the risk concept proposed by the research can be used to assess the risk of nearly 100,000 reservoirs in China. A trial calculation can be caried out to understand the overall situation of dam risks, which serves as an important foundation for dam risk theory and technology to take root in China. Dam risk management practices can be carried out where it is possible to consider engineering safety classification (Class I, Class II, Class III, etc.) and class dam operation management classification (there is currently no classification, for example, it can also be divided into first, second, and third categories). The magnitude of engineering risk is not overly dependent on experts to assign subjective dam failure probability. Considering the role of big data, rapid online risk assessment and forecasting similar to weather forecast and large-scale flood control and drought relief situation in the second year can be carried out. It is very important to strengthen the skill training for reservoir dam managers who have not adopted risk management at present, and to link up the transition from dam safety management to risk management. China’s connection from dam safety management to risk management can be used for reference by other similar countries.

5.6. Grading Standard of Dam Risk Indexes Based on Statistical Methods

It is suggested that the risk indexes of 100,000 reservoirs should be calculated using dam group risk prioritizing methods. Based on the risk indexes and the obtained basic information of reservoir management, the risk standard of the reservoir dam industry should be established. The risk standards of the reservoir dam industry in 34 provincial administrative regions should be calculated respectively so as to provide the basis for dam risk management in these regions. An alternative scheme is to establish different risk standards for different dam ages similar to different standard physical examination indexes for elderly and young people.

5.7. Correlation between Uncertainty Analysis of Dam Risk Calculation and Failure Modes

When the risk calculation results are provided, the correspondence between the assumptions made and the risk calculation results should be clearly stated and explained. Analysis of the impact of cognitive uncertainty on dam risk assessment can be carried out, various extrapolation theories and extrapolation models in dam risk analysis can be developed, and the uncertainty of subjective understanding can be reduced; multiple risk analysis methods can be used to carry out dam risk analysis comparative analysis; the correlation between different failure modes can be analyzed and the correlation between existing failure mechanisms can be clarified so that the impact of different assumptions can be analyzed while the risk is better described. In order to better evaluate the dam failure consequences and the effectiveness of warnings and evacuations, the uncertainty of evacuation consequences should be studied.

5.8. Dam Group Risk Prioritizing Techniques Based on Modern Science and Technology Such As Artificial Intelligence and Big Data

To improve the digital, information-based, smart, and intelligent reservoir dam risk management, the technical support for differentiated management can be effectively strengthened, it is necessary to carry out the research on “dam group risk prioritizing techniques based on artificial intelligence and big data”, to determine the research direction and research topics, and establish and improve the research framework of the research.

5.9. Level of Detail for Dam Risk Assessment

The portfolio risk management of USACE can be taken for reference. The first step is to preliminarily determine the risk levels through risk assessment. The second step is to determine the next risk management procedure according to the risk assessment results. Risk assessment can be based on existing risk evaluation, dam safety appraisal, design data, construction data, operation records, and dam safety inspection and monitoring data. The risk levels obtained based on dam risk assessment results are changeable. When the engineering performance changes or more detailed information is obtained, the risk levels of dams need to be adjusted accordingly. If the assessment method is computerized, this work is completed automatically.

5.10. Risk Analysis and Management Theory Research of Cascade Reservoir Dam Groups

Cascade reservoir and hydropower station groups in river basins often involve different administrative divisions, enterprises, management departments, and institutions. They are characterized by wide scope, complex relations and a very large range of impact. There are a number of deficiencies in the internal emergency management and the external emergency management of hydropower stations. It is necessary and urgent to strengthen the research on dam accident modes, risk control standards, contingency plans, and emergency management mechanisms, which are of far-reaching and great significance to effectively ensure the safety of cascade reservoir and hydropower station groups in river basins.

5.11. Key Technologies of Dam Operational Risk Management and Control

It is proposed to start the construction of a case database of reservoir dam safety operation accidents and hidden defects, and summarize the safety risks of various types of dams; continue the in-depth research on the causes, failure modes, and failure mechanisms of dam accidents. It is also proposed to analyze the theories and models of dam security risk management and control in developed countries, and study the scientificity of “acceptable risk standards” and its applicability in China. Further, is it proposed to study and improve the dam security risk management and control systems conforming to the situation of China based on the basic principle of “people and life are paramount, and the protection of people’s life and safety should be given first priority” and with the goal of preventing serious accidents such as dam breaks.

5.12. Regulations and Technical Standards for Dam Security Risk Management and Control

It is proposed to start the formulation of regulations and technical standards such as Emergency Management Measures for Reservoir Dam Operation Safety, Guidelines for the Construction of Reservoir Dam Safety Risk Management and Control Systems, Technical Standards for Reservoir Dam Operation Safety Risk Assessment, and Guidelines for Hazard Identification and Risk Assessment of Reservoir Dams, carry out the research on new technologies, new methods, and new models of emergency drills, and improve the standardization of dam security risk management and control.

6. Conclusions

Domestic and foreign dam engineering experts have proposed PRA, FMEA/FMECA, FTA, ETA, group dam risk analysis, and other dam risk analysis and evaluation theories, but the existing dam risk analysis methods have some undiscovered system defects. The behavior results of each component in the dam system are not simply superimposed, but have different degrees of nonlinear relationship. The current dam risk analysis method does not take into account the nonlinear factors such as human factors, organizational management, and automation systems other than dam loads. In the next step, the system theory can be used to carry out theoretical research on dam operation risk assessment and to strengthen the connection with the management status quo.

The theoretical research on risk analysis and management of cascade dam reservoir groups needs to be strengthened urgently, the dam operation safety risk management and control system and key technologies must be improved, and research on the uncertainty analysis of dam risk calculation and the correlation between failure modes must be carried out based on modern science such as artificial intelligence and big data. It is recommended that sociological research experts participate deeply in the process of formulating reservoir dam risk standards so as to effectively connect natural sciences and social sciences in reservoir dam risk assessment and management.

In future research, it is necessary to strengthen the design and operation and maintenance of dam safety monitoring based on the dam risk concept, as well as the theoretical and technical research and practice of dam risk assessment based on dam safety monitoring data. Moreover, it is of significant necessity to strengthen research on reservoir dam risk management mechanisms and measures and strengthen dam risk management practices.