Risk Analysis of Earth-Rock Dam Failures Based on Fuzzy Event Tree Method

Earth-rock dams make up a large proportion of the dams in China, and their failures can induce great risks. In this paper, the risks associated with earth-rock dam failure are analyzed from two aspects: the probability of a dam failure and the resulting life loss. An event tree analysis method based on fuzzy set theory is proposed to calculate the dam failure probability. The life loss associated with dam failure is summarized and refined to be suitable for Chinese dams from previous studies. The proposed method and model are applied to one reservoir dam in Jiangxi province. Both engineering and non-engineering measures are proposed to reduce the risk. The risk analysis of the dam failure has essential significance for reducing dam failure probability and improving dam risk management level.


Introduction
Earth-rock dams account for more than 90% of all of the 90,000 reservoirs in China, among which nearly 30,000 reservoirs are in operation with defects. The primary problem for decision-makers to solve is how to protect the safety of reservoirs and use the nation's most limited funds to reinforce the most in-need reservoirs [1]. The use of risk analysis to manage these dams has become an urgent problem in the dam industry [2][3][4]. Dam failure is a low-probability social catastrophic factor, which is extremely harmful. There are great numbers of downstream residents of reservoirs in China. The life loss will be great and intolerable once a dam is damaged. According to statistics, the annual average dam failure rate in China is 8.761 × 10 −4 . In the 20th century, the average annual dam failure rate of the world was 2.0 × 10 −4 , regardless of war-related reasons, which means the probability of dam failure in China is relatively high [5].
A number of studies are dedicated to investigating dam failures. Hartford et al. [6] provided a contemporary description of evolving techniques for risk-based dam safety management. They presented some new approaches (e.g., ETA method and comprehensive sections on consequence analysis), which are necessary for the estimation of risk and the planning of emergency preparedness. Rong-Yong and Zong-Kun et al. [7,8] analyzed the overflow fuzzy risk on earth dams, which makes the calculation of dam failure probability more reasonable. Graham [9] conducted an extensive evaluation of dam failures and the factors that contributed to loss of life. Masskant [10] found that the consideration of the exact spatial distribution of population growth is essential for reliable estimation of future risk of flooding. Since the 1960s, there have been many serious dam failure events in China [20], as shown in Table 2. We should investigate the dam failure events that have caused heavy loss of life, clarify the situation of life loss, and summarize its rules. It can be used for significant reference to estimate the fatalities reasonably and to reduce life loss in the future. According to the statistics in [21], the dam failure cases comprise earth dams, concrete dams, masonry dams, rockfill dams, and so on. Figure 1 compares the percentages of these types of dams in the world (excluding China) and in China. It clearly shows that the majority of cases are earth-rock dams, which account for 70.0% of dams in the world (excluding China) and 93.9% in China. Therefore, this paper chooses an earth-rock dam for failure analysis.  According to the statistics in [21], the dam failure cases comprise earth dams, concrete dams, masonry dams, rockfill dams, and so on. Figure 1 compares the percentages of these types of dams in the world (excluding China) and in China. It clearly shows that the majority of cases are earth-rock dams, which account for 70.0% of dams in the world (excluding China) and 93.9% in China. Therefore, this paper chooses an earth-rock dam for failure analysis. Earth-rock dam, one of the oldest dame types, generally refers to a dam that is constructed with local soil, stone, or mixture through throwing and rolling, etc. Such a dam has various risks in the operation, while dam failure is the most critical. Due to the complexity of the hydrogeographical environment, meteorology, hydrodynamic forces and structure of the dam, many factors can lead to dam failure. Therefore, it is very important to study the causes, modes, and paths in the earth-rock dam failure probability calculation.

Causes and Modes of Earth-Rock Dam Failure
The earth-rock dam is the dam type with the largest number of calamities and highest dam failure rate. According to the failure mechanism, these can be divided into several types: lack of flood control capacity, insufficient structural stability, seepage damage, and several other conditions. The main failure modes are dam foundation failure, overtopping, slope instability, spillway failure, and internal erosion, as shown in Figure 2 [22][23][24][25]. Earth-rock dam, one of the oldest dame types, generally refers to a dam that is constructed with local soil, stone, or mixture through throwing and rolling, etc. Such a dam has various risks in the operation, while dam failure is the most critical. Due to the complexity of the hydrogeographical environment, meteorology, hydrodynamic forces and structure of the dam, many factors can lead to dam failure. Therefore, it is very important to study the causes, modes, and paths in the earth-rock dam failure probability calculation.

Causes and Modes of Earth-Rock Dam Failure
The earth-rock dam is the dam type with the largest number of calamities and highest dam failure rate. According to the failure mechanism, these can be divided into several types: lack of flood control capacity, insufficient structural stability, seepage damage, and several other conditions. The main failure modes are dam foundation failure, overtopping, slope instability, spillway failure, and internal erosion, as shown in Figure 2 [22][23][24][25].

Event Tree Analysis (ETA)
Event tree analysis (ETA) is a logic method, either qualitative and quantitative, that is used to identify possible outcomes. ETA is widely used as a 'pre-accident' analysis technique that examines the systems in place, which would prevent accident precursors from developing into accidents. It can also be used as a 'post-accident' analysis technique that identifies consequences of an accident sequence. The application of the ETA method in dam safety, where accident initiation is postulated, is used to illustrate how various subsequent events and scenarios evolve [26].
The risk analysis of dams with the ETA method is based on a condition or load condition. By using the tracing method, the various elements of the dam and how the failure happened under the load condition are logically analyzed. Thus, the estimation of overall dam failure probability is available. The ETA method is constructed as shown in Figure 3, which attempts to generate all the resultant events caused by some excitation events such as earthquake, flood, and internal defect: The ETA method provides a logical and graphical means to illustrate the sequence of events from an initiating event to the complete set of possible outcomes. The risk analysis of dam failure with the ETA method can help us to not only understand the overall process of the system change and identify possible accidents in advance, but also take measures to effectively avoid or reduce the

Event Tree Analysis (ETA)
Event tree analysis (ETA) is a logic method, either qualitative and quantitative, that is used to identify possible outcomes. ETA is widely used as a 'pre-accident' analysis technique that examines the systems in place, which would prevent accident precursors from developing into accidents. It can also be used as a 'post-accident' analysis technique that identifies consequences of an accident sequence. The application of the ETA method in dam safety, where accident initiation is postulated, is used to illustrate how various subsequent events and scenarios evolve [26].
The risk analysis of dams with the ETA method is based on a condition or load condition. By using the tracing method, the various elements of the dam and how the failure happened under the load condition are logically analyzed. Thus, the estimation of overall dam failure probability is available. The ETA method is constructed as shown in Figure 3, which attempts to generate all the resultant events caused by some excitation events such as earthquake, flood, and internal defect:

Event Tree Analysis (ETA)
Event tree analysis (ETA) is a logic method, either qualitative and quantitative, that is used to identify possible outcomes. ETA is widely used as a 'pre-accident' analysis technique that examines the systems in place, which would prevent accident precursors from developing into accidents. It can also be used as a 'post-accident' analysis technique that identifies consequences of an accident sequence. The application of the ETA method in dam safety, where accident initiation is postulated, is used to illustrate how various subsequent events and scenarios evolve [26].
The risk analysis of dams with the ETA method is based on a condition or load condition. By using the tracing method, the various elements of the dam and how the failure happened under the load condition are logically analyzed. Thus, the estimation of overall dam failure probability is available. The ETA method is constructed as shown in Figure 3, which attempts to generate all the resultant events caused by some excitation events such as earthquake, flood, and internal defect: The ETA method provides a logical and graphical means to illustrate the sequence of events from an initiating event to the complete set of possible outcomes. The risk analysis of dam failure with the ETA method can help us to not only understand the overall process of the system change and identify possible accidents in advance, but also take measures to effectively avoid or reduce the  The ETA method provides a logical and graphical means to illustrate the sequence of events from an initiating event to the complete set of possible outcomes. The risk analysis of dam failure with the ETA method can help us to not only understand the overall process of the system change and identify possible accidents in advance, but also take measures to effectively avoid or reduce the incidence of accidents. According to the frequency of each risk factor occurrence, the probability of dam failure can be calculated.
However, the ETA method sometimes has less objective basis in estimating the probability of the event in every link of dam failure development. There is little historical data available for reference, most of which requires the experience of experts. The factors affecting dam failure are complicated and often fuzzy. In view of this, this paper also takes the fuzzy set theory into consideration to analyze the risk of earth-rock dam failure.

Fuzzy Set Theory
The concept of fuzzy set was proposed by Zadeh in 1965. The fuzzy set denotes the set of characteristic things with uncertain boundary [27]. For a fuzzy set A on the final field X, there is a is the membership degree of x to A and µ A is the membership function of fuzzy set A.

Concept of Fuzzy Numbers
Fuzzy numbers are used to deal with some fuzzy and inaccurate information, such as the "very likely" and "unlikely" language used by experts in the risk analysis of earth-rock dams which need to be quantified with fuzzy numbers combined with membership functions. In this paper, fuzzy numbers are divided into triangular fuzzy numbers and trapezoidal fuzzy numbers [28,29].
A triangular fuzzy number is expressed as A = (a, b, c), whose membership function is A trapezoidal fuzzy number is expressed as A = (a, b, c, d), whose membership function is

Operation of Fuzzy Numbers
For a given number ∀λ ∈ [0, 1], the λ-cut of fuzzy set A and B can be expressed as Then the operation between fuzzy sets can be achieved by their λ-cut sets:

Non-Fuzzification of Fuzzy Language of Experts
For the ETA of dam failure, experts often use fuzzy language for qualitative evaluation. Usually, we need to transform the fuzzy language of experts into quantitative analysis and then evaluate the safety of reservoir dams comprehensively. For the probability of dam failure, the fuzzy language can be divided into seven types: 'Extremely unlikely', 'Very unlikely', 'Less likely', 'Uncertain', 'Likely', 'Very Likely', and 'Extremely Likely'. The fuzzy numbers and corresponding λ-cut sets of them are expressed in Table 3 [30]: Table 3. Fuzzy numbers and corresponding λ-cut sets of fuzzy language.

Fuzzy Language Fuzzy Number λ-Cut Set
Extremely unlikely The membership function is expressed in Figure 4:

Non-Fuzzification of Fuzzy Language of Experts
For the ETA of dam failure, experts often use fuzzy language for qualitative evaluation. Usually, we need to transform the fuzzy language of experts into quantitative analysis and then evaluate the safety of reservoir dams comprehensively. For the probability of dam failure, the fuzzy language can be divided into seven types: 'Extremely unlikely', 'Very unlikely', 'Less likely', 'Uncertain', ' Likely', 'Very Likely', and 'Extremely Likely'. The fuzzy numbers and corresponding  -cut sets of them are expressed in Table 3 [30]: Table 3. Fuzzy numbers and corresponding  -cut sets of fuzzy language.

Fuzzy Language
Fuzzy Number

 -Cut Set
Extremely unlikely The membership function is expressed in Figure 4: Meanwhile, in the process of organizing experts' empowerment analysis, it is also necessary to analyze the credibility of different experts. In this paper, the credibility of the expert, also known as the weight of experts, is expressed as α ) represents the expert being the most trusted and 0  α represents the expert being the least trusted. In this paper, the credibility of the expert is determined from four aspects: educational degree, professional title, professional direction, and length of service. The criteria for determining the credibility of an expert are shown in Table 4:  Meanwhile, in the process of organizing experts' empowerment analysis, it is also necessary to analyze the credibility of different experts. In this paper, the credibility of the expert, also known as the weight of experts, is expressed as α (0 < α < 1). α = 1 represents the expert being the most trusted and α = 0 represents the expert being the least trusted. In this paper, the credibility of the expert is determined from four aspects: educational degree, professional title, professional direction, and length of service. The criteria for determining the credibility of an expert are shown in Table 4: If β j (j =1,2,3,4) is used to represent the evaluation scores of experts in four aspects: educational degree, professional title, professional direction and length of service, the credibility of each expert can be expressed as follows:

Integral Value Method of Non-Fuzzification for Fuzzy Number
After obtaining the corresponding λ-cut sets of fuzzy numbers, the integral value method proposed by Liou is used to calculate the fuzzy numbers [31].
where α is the index of optimism, α ∈ [0, 1]. I L (A) and I R (A) are the inverse function of left and right integral values of A respectively.
where λ u (A) and λ l (A) is upper bound and lower bound of λ-cut sets of A. The upper and lower bounds of the fuzzy number A are respectively corresponding to α = 0 and α = 1. The value of the fuzzy number is representative when α = 0.5.

Application of Dam Failure Risk Analysis
The application of the ETA method based on fuzzy set theory in dam failure risk analysis of an earth-rock dam can be summed up in the following steps [32]: (1) In view of the probable dam-breaking event, analyze the various accident paths and the accident links of the dam and establish the event tree structure chart. (2) Calculate the probability of dam failure for all dam-breaking paths under each load condition.
Invite experts to carry out a qualitative assessment of the accident. By using the ETA method of fuzzy set theory, the expert qualitative language is converted into quantitative value. The probability of each failure link in the accident path is obtained. Finally, the probability value of the dam in a burst mode is obtained by multiplying the probabilities of each failure link. The conditional probability of each link in a burst mode is p(i, j, k), i = 1, 2, ..., m; j = 1, 2, · · · , n; k = 1, 2, ..., s. where i is the reservoir water level load, j is the failure mode and k represents for each aspect. Then, the probability of burst under the I type load and j type failure mode is (3) Under the same load, the failure mode of the dam can be independent, at which time the deMorgan law can be used to calculate the burst probability under the same load.
(4) Repeat the above steps for different loads on the dam to obtain all possible dam-breaking paths and their probabilities under all possible load conditions. Assuming that the dam failures under different loads are independent of each other, the probability of the dam collapse under all different loading conditions is added, that is, the total dam probability of the dam is obtained.

Estimation Model of Dam Failure Life Loss
Evaluating the consequences of a dam failure is extremely important in the dam safety study. Dam failure can cause catastrophic losses such as life loss, property loss, environmental loss, and so on. The most important part is the loss of life. This paper focuses on estimating fatalities of a dam failure.
The estimation of dam failure life loss is affected by many factors [9]. Among these are cause and type of dam failure; number of people at risk; severity of dam break flood; timeliness of dam failure warnings; occurrence time of dam failure; ease of evacuation.
Graham summarized the seven basic steps to evaluate the dam failure life loss, which are still widely used at present. Ke-fa et al. [33,34] conducted an in-depth discussion and analysis on a large amount of data of eight dam failures that have occurred in the history of China. They summarized the basic law of the loss of life and proposed a life loss estimation method, which is suitable for Chinese conditions. In this paper, based on this method, combined with the actual situation of the studied reservoir, the potential loss of life caused by the dam failure will be evaluated.

Estimation Model Parameters of Dam Failure Life Loss
Dam-break loss of life is a result of complex factors, usually divided into population at risk (P AR ), severity degree of dam break flood (S D ), occurrence time of dam failure, warning time (W T ), and understanding of P AR to S D .
(1) Population at risk (P AR ) Population at risk refers to the number of people in the area covered by the dam-breaking flood. The larger the total population at risk is, and the closer it is to the dam site and main channel, the greater the resulting loss of life will be. P AR can be determined by survey statistics and population registration data: where i means a residential area and P ARi means population of the residential area.
When considering the P AR , other factors such as population composition, living environment, escape route, and emergency rescue capability should also be taken into consideration in order to obtain more appropriate results. Occurrence time of dam failure has a significant impact on the P AR and W T . According to the weather, occurrence time can be divided into sunny and rainy days; according to the time of day, it can be divided into daytime and night; according to the season, it can be divided into winter and summer.
O T is very important in the evaluation of life loss. If the dam break occurs on sunny days the traffic will be better; during the daytime, it is more easily found by the staff; if the dam break occurs in summer, it is good for the evacuation of P AR .
Understanding of S D for P AR will affect the success rate of rescue methods, which is an important aspect in estimation of in dam failure life loss. U D can be divided into two types: (1) U D is fuzzy: the population at risk cannot understand the severity degree of the dam break flood when they get the warning and they do not know the necessity, measure, and path of escape. (2) U D is explicit: the population at risk can understand the severity degree of the dam break flood clearly and can take the necessary measures of escape clearly.

Calculation of Estimation Model of Dam Failure Life Loss
Based on the Graham method and combined with the situation of dams in China, this paper adopts the method of estimating the loss of life of dam failure in China proposed by Lei [33].
This calculation model mainly considers three parts: the number of population at risk (P AR ), the risk mortality rate suitable for China f, and the corresponding correction coefficient ω. The formula is as follows: where the value of f is determined according to Table 5. Remarks: when it is sunny daytime, the upper limit is recommended and when it is rainy night, the lower limit is recommended.

Project Overview
Located in the upper reaches of the Zhangjiang River, Ganzhou city, Jiangxi province, a hydropower project is large (2) type of water conservancy project dominated by flood control [35]. Reservoir total capacity is 1.19 × 10 8 m 3 at the normal pool level of 220.00 m. The checked flood level is 223.70 m and dead water level is 209.00 m.
In March 2004, the dam was identified as a third-type dam, which would be reinforced in 2008. This paper analyzed the probability of dam failure and the life loss model based on the data before the reinforcement work, aiming to analyze the risk of dam failure before reinforcement and to improve the safety management level. This analysis will provide a significant reference for other dam analyses.
The layout plan of the reservoir project is shown in Figure 5: Remarks: when it is sunny daytime, the upper limit is recommended and when it is rainy night, the lower limit is recommended.

Project Overview
Located in the upper reaches of the Zhangjiang River, Ganzhou city, Jiangxi province, a hydropower project is large (2) type of water conservancy project dominated by flood control [35]. Reservoir total capacity is 1.19 × 10 8 m 3 at the normal pool level of 220.00 m. The checked flood level is 223.70 m and dead water level is 209.00 m.
In March 2004, the dam was identified as a third-type dam, which would be reinforced in 2008. This paper analyzed the probability of dam failure and the life loss model based on the data before the reinforcement work, aiming to analyze the risk of dam failure before reinforcement and to improve the safety management level. This analysis will provide a significant reference for other dam analyses.
The layout plan of the reservoir project is shown in Figure 5:

Dam Failure Modes and Paths
According to former data, the failure of earth-rock dams in China is mainly based on three conditions: (1) Failure of the dam structures caused by the water load in non-flood season, such as seepage failure; (2) Serious floods in flood season which cause dam collapse, such as overtopping, seepage damage, slope landslides, and so on; (3) The dam collapse caused by an earthquake, such as seepage damage, structural failure, and so on. As for the dam area reference, the basic earthquake intensity is less than 6 degrees in this area. This paper does not consider the dam failure caused by the earthquake load according to the relevant norms.
Aiming at the dam failure caused by the water load in flood season and non-flood season, this paper screens and analyzes all the dam failure modes and get the main failure modes and damage paths as follows [36][37][38]: The key to estimating the risk rate of dam failure by using the ETA method of fuzzy set theory is to calculate the probability of each link accident.
According to the dam failure mode and the dam break path, the event tree of the dam failure is constructed. This paper takes the case of the piping of the auxiliary dam shoulder under the condition of 223.70 m water level in flood season as an example.
Combined with the judgment of five experts (E1, E2, E3, E4, E5), the probabilities of each part of dam failure under this condition are calculated in Figure 7.

Calculation of Dam Failure Probability
The reservoir is designed according to the 500-year flood (P = 0.2%) and checked according to the 5000-year flood (P = 0.02%). When we select the characteristic load value of the dam, we select the normal water level 220.00 m as the non-flood load value with the frequency of 1.0 and the check flood level 223.70 m as the flood load with the frequency of 0.02%.
The key to estimating the risk rate of dam failure by using the ETA method of fuzzy set theory is to calculate the probability of each link accident.
According to the dam failure mode and the dam break path, the event tree of the dam failure is constructed. This paper takes the case of the piping of the auxiliary dam shoulder under the condition of 223.70 m water level in flood season as an example.
Combined with the judgment of five experts (E1, E2, E3, E4, E5), the probabilities of each part of dam failure under this condition are calculated in Figure 7. The five experts respectively evaluated D1, D2, D3, D4, D5, D6, D7, and D8 of each link of the piping event tree of the auxiliary dam shoulder [39]. The fuzzy probabilities are shown in Table 6. Considering that different experts have different understandings of the actual operation status of the dam, there are differences among experts in terms of their level of knowledge, professional standards, personal experience ability, and other factors. In order to reduce the influence of expert subjectivity on the calculation results, this paper uses the weight coefficient of five experts to revise the evaluation and get the final evaluation results [40]. The five experts respectively evaluated D1, D2, D3, D4, D5, D6, D7, and D8 of each link of the piping event tree of the auxiliary dam shoulder [39]. The fuzzy probabilities are shown in Table 6. Considering that different experts have different understandings of the actual operation status of the dam, there are differences among experts in terms of their level of knowledge, professional standards, personal experience ability, and other factors. In order to reduce the influence of expert subjectivity on the calculation results, this paper uses the weight coefficient of five experts to revise the evaluation and get the final evaluation results [40]. (15) where P i represents result of the expert's comprehensive evaluation of event i, ω ij represents the weighting coefficient of the event i of the j-th expert's evaluation, and E ij represents the evaluation result of the i-th event by the j-th expert.
The weight coefficient of experts can be calculated by 1~9 scale judgment matrix, and the judgment matrix must meet the consistency requirement, otherwise it should be rebuilt. The judgment matrix of experts are shown in Table 7. The estimated values of the fuzzy numbers in each link of the auxiliary dam shoulder are respectively: The calculation result is substituted by the Formulas (6) and (7) to calculate the fuzzy numbers. By adopting the integral value method proposed by Liou to calculate the fuzzy numbers, the fuzzy probability of each link of the auxiliary dam shoulder is obtained. Where α = 0 and α = 1 respectively correspond to the upper and lower bounds of the fuzzy numbers of the failure probability P L and P U . When α = 0.5, the calculated value obtained is the probability value P of the accident link. The following Table 8 is available: The probability of the auxiliary dam shoulder failure is: Considering the occurrence frequency of a flood season load of 223.70 m water level is 0.02%, the risk rate of the earth-rock dam with the water level of 223.70 m in the flood season and the dam failure occurring is: f × P = 0.059 × 0.0002 = 1.18 × 10 −5

Calculation of Dam Failure under Different Load Conditions
According to the method above, the dam failure probabilities occurring under other conditions can be obtained, which are shown in Figures 8-15.
Considering the occurrence frequency of a flood season load of 223.70 m water level is 0.02%, the risk rate of the earth-rock dam with the water level of 223.70 m in the flood season and the dam failure occurring is:

Calculation of Dam Failure under Different Load Conditions
According to the method above, the dam failure probabilities occurring under other conditions can be obtained, which are shown in Figure 8 to Figure 15.  Considering the occurrence frequency of a flood season load of 223.70 m water level is 0.02%, the risk rate of the earth-rock dam with the water level of 223.70 m in the flood season and the dam failure occurring is:

Calculation of Dam Failure under Different Load Conditions
According to the method above, the dam failure probabilities occurring under other conditions can be obtained, which are shown in Figure 8 to Figure 15.                          According to the above ETA method based on fuzzy set theory, we can summarize the dam failure probabilities under non-flood season and flood season load in Table 9: The probability of the dam failure is 1.16 × 10 −4 , which is higher than the maximum probability of collapse estimated by the Bureau of Reclamation 10 −4 ; thus, measures should be taken to reduce the failure probability. Table 9 shows that the main dam failure mode is the main dam foundation piping and the auxiliary dam foundation piping. The analysis results are consistent with the actual conditions of the dam. In view of the analysis results, we should focus on strengthening the reinforcement of main dam foundation and auxiliary dam foundation. During the flood season, strengthening the monitoring of flood data and paying attention to the reinforcement of the spillway are necessary.

Estimation Model of Dam Failure Life Loss
Dayu County, a total area of 1367.63 km 2 , administers 11 townships. In 2006, the county's resident population was 291,969, with an average population density of 214 persons/km 2 . The population and the buildings are dense.

Determination of Influencing Factors
(1) Population at risk (P AR ) First, identify the population at risk (P AR ). According to the flooding range of dam break floods, the following Table 10 is obtained according to the government statistics on the population distribution of the submerged area. Among them, the number of P AR in the daytime and night are different; the impact factors are 0.5 and 0.8 respectively. (2) Severity degree of dam break flood (S D ) Calculate the average D × V value of the submerging range's administrative area, as shown in the following Table 11: Table 11. Average D × V value and corresponding S D .  The understanding of P AR to S D (U D ) is shown is Table 12.

Estimation of Dam Failure Life Loss
The formula of estimation of dam failure loss of life (L OL ) is as follows: where f is according to the Figure 5. For the dam considered in this paper, the corresponding correction coefficient ω is as follows according to the relevant information, which is shown in Table 13. Then, we can make the estimation according the formula above. The results of the estimation of dam failure loss life are shown below.  In general, Combined with the calculation results from 3.2, the dam has a 1.16 × 10 −4 probability of dam failure. The possible loss of life in this case is estimated as shown in Table 18.
As can be seen from the Tables 14-18, the life loss (L OL )of dam failure is most affected by the warning time (W T ), and the occurrence time (daytime or night) also has great influence. Therefore, the dam workers should strengthen safety monitoring (especially in flood season) and improve the warning time. It is highly necessary to ensure W T is longer than one hour, which can significantly reduce the loss of life of dam failure. According to the social risk standard F-N reference map of China reservoir dams, the calculated risk of life loss is higher than 1.1 × 10 −3 , which is an intolerable risk. So the dam reinforcement project should also be carried out, which is consistent with the 3.2 research conclusion. In the event that dam engineering facilities cannot be changed and dam-breaking floods cannot be perfectly predicted, we need to strengthen the management of non-engineering measures in order to reduce the dam failure life loss. Some suggested actions below can be taken into consideration: (1) Evacuate residents in times of flood season and minimize the risk to the population; (2) Strengthen the monitoring work (especially in the flood season), improve the capability of early warning of dam breakage, and increase the warning time, which must be more than one hour; (3) Strengthen the liaison among downstream residents to ensure smooth communication; (4) Improve the level of contingency plans, ensure the availability of traffic in the submerged area and enhance the rescue capability after dam failure.

Conclusions
This paper conducted the risk analysis of an earth-rock dam failure, which involves several complicated factors. Based on the analyzed results, the following can be concluded.
(1) After considering various factors affecting the dam safety, a new model with the ETA method based on fuzzy set theory is proposed for the dam failure analysis, and good results were achieved. By using the ETA method, the probability of each link of dam failure mode can be clearly evaluated. Combined with fuzzy set theory, experienced experts are invited to carry out the evaluation and analysis. The main failure modes of the dam in non-flood season are the main dam and auxiliary dam piping, and in flood season the spillway failure needs to be considered. The project reinforcement should be carried out in a targeted manner. In summary, the dam risk is already at a high stage. It is highly necessary to reinforce the project in addition to strengthening the flood season monitoring and raising the warning time.
The dam failure risk analysis model proposed in this paper has been successfully applied to a specific water conservancy project and achieved good results. For other dams, the analysis model can also be applied to improve the operation of dam management.