Technical Criteria for Identifying Unbelievable Scenarios in Hypothetical Breakups

In certain hypothetical rupture studies, the analysis of extreme scenarios may indicate the possibility of failures associated with very specific combinations of events, such as the total obstruction of spillway structures combined with exceptionally frequent rainfall.

In these situations, although it is possible to identify the theoretical occurrence of overtopping, the calculated probability is often at levels below 10⁻⁶ per year. Such low probabilities are classified as negligible risk according to the concept of ALARP, even though, due to regulatory requirements, the failure mode needs to be formally considered.

Believable and Unbelievable Scenarios

The discussion about the credibility of scenarios leads to the distinction between the so-called credible scenarios and not credible in hypothetical rupture studies.

A scenario is considered credible when it is physically plausible, that is:

• When the failure mechanism can in fact occur due to the existing materials and construction arrangements;
• When supported by recognized rupture mechanisms, such as overtopping, instability, liquefaction or piping;
• When it is compatible with the current conditions of the dam, including geometry, operation, drainage, maintenance and instrumentation.

On the other hand, a scenario not credible is one that violates fundamental physical principles, such as simulating rupture volumes greater than the reservoir capacity or erosion crossing non-erodible or more resistant layers, such as sound rock or high-resistance rockfill without plausible justification.

They also qualify as not credible scenarios that require combinations of extremely low probability events, less than 10⁻⁶ per year, or that are in contradiction with evidence from inspections and audits carried out, as highlighted by ICOLD, CDA, FERC, FEMA and HSE-UK.

The ALARP Concept

The concept ALARP (As Low As Reasonably Practicable), internationally consolidated, reinforces the distinction between credible and non-credible scenarios by classifying risks into three zones:

1. Unacceptable zone – requires immediate intervention.
2. Tolerable zone – acceptable risk only if reduced to the limit of what is reasonably practicable.
3. Widely acceptable zone – risk so low that it does not require additional measures.

The practical application of this concept establishes that coexistence with negligible risks is admissible, as long as it is demonstrated that additional reductions would imply disproportionate efforts in relation to the gains achieved.

In Brazil, the ANM Resolution No. 95/2022 adopts the same understanding, defining ALARP as risk "as low as reasonably achievable." In this framework, coexistence is permissible as long as there are continuous reduction efforts to the point where additional measures become disproportionate in terms of cost, feasibility, or additional benefit.

International References and Technical Guidelines

International experience demonstrates convergence regarding the unnecessary, and even inappropriate, need to model ruptures under impossible physical or statistical conditions. The main technical guidelines recognize that only scenarios with plausible mechanisms and statistically significant probabilities should be considered in rupture studies, while unlikely events do not contribute to safety and can distort risk assessment.

As an example, the following international references stand out, which corroborate the understanding that scenarios with a probability lower than 10⁻⁶ should be considered not credible:

• ICOLD Bulletins No. 130 (2005) and No. 154 (2016).
• Canadian Dam Association (CDA, 2013 and 2021) Guidelines.
• FERC Guide (2015).
• FEMA Manual P-333 (2004).
• UK Health and Safety Executive document “Reducing Risks, Protecting People” (2001).
  
  

These documents establish that the definition of failure scenarios must be based on plausible risk mechanisms, distinguishing credible failure modes from those whose statistical or physical framework is in the realm of the improbable.

THE ICOLD, for example, emphasizes that simulating ruptures under statistically impossible or physically implausible conditions is unnecessary and even counterproductive. CDA defines as credible only those failure modes that are supported by realistic physical mechanisms, classifying as non-credible those that depend on multiple simultaneous failures or probabilities lower than 10⁻⁶.

American agencies, such as FERC and FEMA, reinforce the same guideline by establishing that breaches incompatible with the geology, construction and operation of a dam should not be modeled, as they represent unrealistic conditions.