The value of integrating information from multiple hazards for flood risk analysis and management

This article presents a methodology for estimating flood risk in urban areas integrating pluvial flooding, river flooding and failure of both small and large dams. The first part includes a review of basic concepts on flood risk analysis, evaluation and management. Flood risk analyses may be developed at local, regional and national level, however a general methodology to perform a quantitative flood risk analysis including different flood hazards is still required. The second part describes the proposed methodology, which presents an integrated approach – combining pluvial, river flooding and flooding from dam failure, as applied to a case study: an urban area located downstream of a dam under construction. The methodology enhances the approach developed within the SUFRI project (“Sustainable Strategies of Urban Flood Risk Management to cope with the residual risk”, 2009–2011). This article also shows how outcomes from flood risk analysis provide better and more complete information to inform authorities, local entities and the stakeholders involved in decision-making with regard to flood risk management.


Introduction
Flooding may occur as a combination of meteorological and hydrological extreme occurrences (WMO/GWP, 2008) or as the result of human-induced threats such as terrorism, vandalism or sabotage that may cause the failure or collapse of flood defence infrastructures.In most cases, floods are additionally influenced by human factors, such as flood protection planning, urban planning, emergency management, etc. Urban areas may be affected by flooding from river courses, mountain torrents, flash floods, coastal floods, pluvial flooding, sewer flooding, groundwater flooding (in permeable areas), Mediterranean ephemeral water courses, and failure of drainage systems and flood defence infrastructures.Urban areas may present high flood risk levels due to high population density rates, multiple economic activities, infrastructure and property values (Pelling, 2003).Furthermore, present requirements of residential and industrial areas have resulted in new urban developments in flood-prone areas, increasing risk for people and inducing significant economic costs in case of flooding.
An analysis of global statistics (Jonkman, 2005) showed that inland floods (including drainage floods, river floods and flash floods) caused 175 000 fatalities and affected more than 2.2 billion people worldwide from 1975 to 2002.An example of these events is the disastrous flood in the Elbe River basin in August 2002 (Engel, 2004) that accounted for 58 fatalities and thousands of people evacuated.Coastal floods were not included in these statistics, but they may cause even more catastrophic floods in terms of loss of life, such as the flooding caused by Hurricane Katrina in 2005 (Jonkman et al., 2009), with more than 1100 fatalities in the state of Louisiana (USA).
As a result of past flood events and their consequences, social demand for higher levels of safety has become a major challenge for the governments of European countries.This demand requires methods to identify the areas that can be potentially affected by floods and to estimate societal as well as economic flood risk.Moreover, flood risk management should be addressed including not only structural but Published by Copernicus Publications on behalf of the European Geosciences Union.also non-structural measures such as flood forecasting, early warning procedures, emergency management, etc.
In the European context, three Directives have been approved in recent years to establish the basis for present and future actions in the field of flood risk and critical infrastructure management: the EU Water Framework Directive 2000/60/EC (2007), the EU Floods Directive 2007/60/ EC (2007) and the EU Critical Infrastructure Directive 2008/114/EC.According to the EU Floods Directive, all EU Member States must undertake the necessary actions to develop preliminary flood risk assessments, flood hazard and flood risk maps, and flood risk management plans at river basin district level before 2011, 2013 and 2015, respectively.
In addition, flood risk research activities have focused on the development of improved methodologies and strategies for an effective flood risk management, taking into account sustainability, public participation, risk awareness and risk communication (Thieken and Beurton, 2012).The ongoing efforts on flood risk research aim at developing methodologies to assess the existing flood risk in urban areas by integrating different sources of hazard.These methodologies should provide tools to compare and analyze measures for flood risk reduction.
In this context, this paper presents a comprehensive methodology for urban flood risk analysis, integrating pluvial flooding, river flooding and flooding from dam failure.It represents an enhancement of a methodology for urban flood risk analysis presented in Escuder-Bueno et al. (2012), incorporating potential flooding due to the existence of small or large dams as flood defence infrastructures (in case of failure or flood routing), allowing a step forward towards an integrated and comprehensive flood risk assessment and management by considering multiple flood hazards.
This paper proposes the use of risk models for flood risk analysis, as they provide a logical and mathematically rigorous framework for compiling information to estimate flood risk.The proposed methodology describes the process for combining all necessary information to estimate, analyse and evaluate flood risk, obtaining an integrated flood risk outcome which includes probabilities and consequences of all potential flood events resulting from several sources of hazard.This integrated outcome provides better and more complete information to decision-makers (e.g. by analysing flood risk for the current situation and the impact of different risk reduction measures).
This article is structured as follows.Section 1 provides the introduction and a brief overview on the legal framework and research needs in current flood risk management.Section 2 includes a summary of basic concepts and tools for estimating and analysing flood risk.Section 3 describes the proposed methodology for flood risk analysis integrating three sources of flood hazard: pluvial flooding, river flooding and flooding from dam failure.The application of the methodology to a case study is presented in Sect. 4. Concluding remarks and further research lines are described in Sect. 5.

Risk concepts
The term risk is widely used in different fields (e.g.engineering, industry, economy, etc.).Thus, different definitions can be found depending on the field of research.Efforts have been allocated in recent decades to reach a common vocabulary within the flood risk management context (e.g.Gouldby and Samuels, 2005) as a guidance for researchers and experts.The following definitions are used in this paper:

Risk, hazard and vulnerability
Based on the commonly adopted "Source-Pathway-Receptor-Consequence" model (Gouldby and Samuels, 2005), risk can be defined by the following components: the nature and probability of a source of hazard, the degree of exposure of the receptors (e.g.property, people, environment) to the hazard, the susceptibility of the receptors to the hazard, and the value of the receptors.This definition can be represented by the expression shown in Eq. ( 1).
For a risk to arise, there must be a hazard that consists of a "source" or initiator event (e.g.high rainfall or high river water discharge).A hazard is then considered as any physical event, phenomenon or human activity with the potential to result in harm.However, a hazard does not necessarily lead to harm.
Research literature identifies vulnerability as an umbrella term for a number of vulnerability-types and it can be formulated, from a traditional systems perspective (Gouldby and Samuels, 2005) as composed of two components: susceptibility and value.Thus, vulnerability is a sub-function of risk and includes the characteristics of a system that describe its potential to be harmed.Therefore, it is common practice to define also risk by the expression given in Eq. ( 2).
In practice, exposure and vulnerability are often captured in the assessment of the consequences; thus risk is commonly viewed in simple terms as the combination of probability and consequences, as shown in Eq. (3).
However, attention should be paid since there is no univocal relationship between hazard and probability.In general, probability includes not only probabilities of potential hazards (e.g.exceedance probabilities of river water levels) but also the conditional probabilities of the system response given such hazard (e.g.probability of failure of a flood defence system for a certain river water level).
Probability can be defined as the chance of occurrence of one event compared to the population of all events.In this definition, probability is dimensionless.In flood risk analysis, probability is often referenced to a specific time frame, for example, as an annual exceedance probability (then probability has units of yr −1 ).
The second risk component, consequences, represents an impact (or improvement) such as economic, social or environmental impact and may be expressed quantitatively (e.g.monetary value), by category (e.g.High, Medium, Low) or descriptively.Consequences can include the impact of flooding to different sectors such as housing, industry, transport, agriculture, the environment and human health (Meyer et al., 2013).Some descriptions of potential flood consequences are, for example, economic impact, number of people/properties affected, harm to individuals (fatalities, injury, etc.), environmental or ecological impact.
Flood consequences can be, in general, classified into direct and indirect impacts (Merz et al., 2010).Direct impacts are those which occur due to the physical contact of flood water with humans, property or any other objects.Indirect impacts are induced by the direct impacts and occur -in space or time -after the flood event.Both types of impacts can be classified into tangible and intangible impacts, depending on whether or not they can be assessed in monetary values.Different classifications of flood consequences can be found in the literature, such as the classification proposed by the CONHAZ project ("Costs of Natural Hazards"), including five categories (Meyer et al., 2013): (1) direct costs, (2) business interruption costs, (3) indirect costs, (4) intangible costs, and (5) risk mitigation costs.Reviews on assessment of societal and economic flood impact can be found in Jonkman (2007) and Merz et al. (2010), respectively.

Individual and societal risk/economic risk
In flood risk analysis, two concepts are widely used: individual risk and societal risk.Individual risk can be defined as the probability of an individual at a certain location getting killed by an accident (Jonkman et al., 2011); in the flood risk analysis context, the probability of being killed by flooding.Societal risk concerns the probability of an accident with a large number of fatalities.In the case of considering potential economic impacts, then the term economic risk is used.

Flood risk analysis
In this paper, a system is considered as the assembly of elements or components (i.e. natural, human, social, etc.) and the interconnections between them within an area under study.Flood risk can be analysed for systems of different size and complexity, such as a city, a province, a hydrological subsystem, or a country.In general, system boundaries are aligned with institutional boundaries (e.g.provinces, municipalities, etc.) or hydrological systems (e.g.river basin districts).
In this paper, the term characterization is used for the process of expressing the observed and predicted behaviour of a system and its related components, with the aim of obtaining probabilities of potential flood events and resulting consequences.
As shown in Eq. ( 3), risk can be expressed by two components: probability and consequences.Flood risk analysis is defined as the process of objectively determining risk by analysing and combining probabilities and consequences.The combining process is also called risk calculation.
Accordingly to Eq. ( 3), tools for flood risk analysis can be classified as partial or complete depending on whether they obtain one component of risk or both (Escuder-Bueno et al., 2010).In addition, they can be classified as quantitative or qualitative depending on whether or not they provide a numerical value of risk.Among these four groups, complete and quantitative tools may be the most convenient option to provide information for decision-makers.However, robustness and reliability of results will depend not only on the type of tool but also on uncertainty of input data.

Flood risk assessment
Flood risk assessment comprises understanding, evaluating (flood risk evaluation) and interpreting risk and existing societal tolerances of risk to inform decisions and actions for flood risk management.
The process of flood risk evaluation requires the comparison of risk with tolerability criteria to assess the current situation of the system and the need for risk mitigation measures.

Flood risk mitigation
Flood risk mitigation includes the reduction of the level of risk, by either reduction in the probability of a flood occurring or a reduction in consequences.With that purpose, different risk mitigation measures can be established (although distinction between risk reduction and risk mitigation measures could be drawn, both terms are used indistinctly in this paper, as proposed in Gouldby and Samuels, 2005).
In general, these measures are classified in two categories: structural and non-structural measures.Structural measures refer to any physical construction to reduce or avoid possible impacts of floods, which include engineering measures and construction of hazard-resistant and protective infrastructures.Non-structural measures may include urban planning, flood forecasting, advanced early warning systems, aids and insurance, increase of risk awareness, knowledge development, methods and operating practices for flood emergency management, etc. (Escuder-Bueno et al., 2011;Schanze et al., 2008).
In general, risk cannot be entirely eliminated since structural measures handle the consequences of a specific severe event, typically called a design event.Even in the case of perfect behaviour of the flood defence infrastructure, there is always a residual risk.Although non-structural measures may reduce part of this risk, residual risk relates to the consequences that cannot be absolutely prevented by the combination of existing structural and non-structural measures.Therefore, risk analysis and assessment should focus on obtaining the existent risk and analyse the impact of risk reduction measures.

Flood risk management
The definition given by the FLOODsite project (Gouldby and Samuels, 2005) for flood risk management is "the continuous and holistic societal analysis, assessment and mitigation of flood risk".In addition, flood risk governance is considered as the process of decision-making and implementation of risk mitigation measures.Nevertheless, flood risk management involves a wide range of considerations that cannot be easily reproduced in a concise statement.
Among other aspects, flood risk management should consider structural and non-structural measures similarly, turning into a continuing cycle of assessing, implementing and maintaining measures to achieve acceptable residual risk and aiming at a sustainable development (Klijn et al., 2008).Hence, flood risk management combines results, information and recommendations from risk analysis and assessment practices, which are used as key information for the definition and prioritization of risk reduction measures.
Prioritization of risk reduction measures is required to achieve an efficient flood risk management.This prioritization may be based on equity and efficiency principles (ICOLD, 2005): (1) equity refers to the right of individuals and society to be protected, and the right that the interests of all are treated with fairness, with the goal of placing all members of the society on an essentially equal footing in terms of level of risk that they face, and (2) efficiency refers to the need for society to distribute and use available resources so as to achieve the greatest benefit.
As stated by Halpin (2010), there can be conflict in achieving equity and efficiency.Achieving equity justifies the establishment of maximum tolerable risk limits for individual risk (e.g. the maximum failure probability of a flood defence infrastructure), regardless of the lack of economic justification or the magnitude of the cost.Efficiency is defined by the risk level where marginal benefits equal or exceed the marginal cost.Flood risk management should consider both equity and efficiency principles for evaluating risk and for defining risk mitigation measures.Further discussion and some considerations on the tension between equity and efficiency in setting standards for flood protection can be found in Van der Most (2010).
All agents involved in flood risk management (e.g.flood defence designers, operators, authorities, stakeholders, etc.) should promote and achieve an integrated and broad vision of risk management towards good flood risk governance, taking into account the context, the objectives and restrictions inherent to the flood risk management process (SPANCOLD, 2012).With that purpose, flood risk governance should cover all aspects (e.g.technical, societal, cultural, financial, etc.) related to the development, prioritization and application of risk mitigation actions to be carried out before, during and after a flood disaster event.

The use of risk models and FN-curves for flood risk analysis
Among existing tools for flood risk analysis, the use of risk models, influence diagrams, event trees and FN-curves is proposed in this paper.Risk models arise as robust, complete and quantitative flood risk analysis tools that enable the integration of all information for estimating risk.Outcomes from risk modelling can be used to represent FN-and FD-curves.
The following definitions are provided since the terms are widely used in this paper: -Risk model: a risk model is a simplified representation of the system.By characterizing system processes and variables, all relevant elements of the system are considered in the risk model.Several tools can be used to represent risk models.In this paper, influence diagrams and event trees are proposed.
-Event tree: an event tree is a detailed representation of all events that may lead to flooding in a system.The event tree starts with an initiating event (e.g. a rainfall event) and splits into several branches based on the characteristics of the initiating event (e.g. the range of possible rainfall events).For each resulting branch, the event tree splits into new branches, taking into account possible subsequent events given that the previous event has occurred (e.g.river water levels at a certain location for a given rainfall event, failure and non-failure events for such river water level, different evacuation scenarios, etc.).Each new subsequent event is then related to a conditional probability of occurrence.Once all combinations of events that may lead to flooding and their related consequences have been captured within the event tree, each path of the event tree represents a potential flood event and it is related to a joint probability, resulting from the combination of all events that compose that path.
Depending on system complexity, event trees may have thousands of paths.Therefore, influence diagrams are used as a compact representation of event trees.-Influence diagram: an influence diagram is composed by nodes and connectors.Each node includes input data on the system (loads to the system, system response or consequences) regarding one or several system variables.Connectors are used to define the relationships between nodes.The influence diagram incorporates the necessary information to define the number of branches in which the event tree splits in each node and to estimate the probability of taking each branch given that the previous events have occurred.
-FN-curves: an FN-curve is a form of presentation of the frequency and the distribution of the number of fatalities in case of flooding.The FN-curve plots F (n) against n, where F (n) is the cumulative exceedance probability of events with n or more fatalities (Evans and Verlander, 1997).Accordingly, f (n) is the exceedance probability of events with exactly n fatalities.When representing potential economic flood damages, the term FD-curve is used.The following general properties of FN-curves can be considered: (1) because f (n) ≥ 0 for all n, FN-curves are always flat or falling; (2) FN-curves are usually plotted on double logarithmic scales (to represent events with a large number of fatalities but very small frequencies, so-called "low probability-high consequence" events), and (3) the lower the curve is, the better (i.e. a lower curve implies a lower frequency of events with n or more fatalities).
Event trees are particularly applicable for risk calculation and analysis (IEC, 2009), as they allow the user to obtain and combine probabilities and consequences, but not for risk evaluation.FN-curves provide a comprehensive and robust tool to represent societal and economic risk quantitatively, thus these curves are helpful tools to support risk evaluation.
The basis of the use of FN-curves for urban flood risk analysis was presented in the "SUFRI Methodology for pluvial and river flooding risk analysis in urban areas to inform decision making" (Escuder-Bueno et al., 2011), developed within the SUFRI project ("Sustainable Strategies of Urban Flood Risk Management to cope with the residual risk"), 2nd CRUE ERA-Net funding initiative, in the period 2009-2011(Escuder-Bueno et al., 2011).
Figure 1 shows the FD-curve for a hypothetical case study as proposed in Escuder-Bueno et al. (2012).Both axes show theoretical but typical values.When representing flood risk, including the potential failure or collapse of flood defence infrastructures, FN-curves may show steps (as shown in Fig. 1).These steps represent flood events resulting from failure of one or more flood defence infrastructures.In general, these infrastructures protect an area from flooding up to a certain load level (e.g.runoff discharge, river water level).Once this level is exceeded, if failure occurs, then the resulting flooding is, in general, related to a higher number of potential fatalities when compared with the non-failure situation.Therefore, flood events which include potential failure of flood defence infrastructures show higher n values than non-failure flood events, but associated with lower probabilities ("low probability-high consequence" flood events).
As FN-curves show the probability distribution of the number of fatalities, they can be used for the evaluation of fatality risks from a societal perspective.To facilitate the evaluation of FN-curves, several criterion lines might be defined and an FN-curve should, in principle, not exceed the criterion line.An FN-criterion line is generally defined by three variables (Jonkman et al., 2011): (1) its base point or the exceedance probability of one fatality (so called C-value); (2) its slope (generally equal to −1 or −2), and (3) its probability and/or consequence cutoff (i.e. a maximum tolerable value for probability and/or consequence).Some discussion on FN-criteria can be found in the literature (Vrijling, 2001;Jonkman et al., 2011;SPANCOLD, 2012).
In addition, the use of FN-curves enables the representation of results from sensitivity and uncertainty analysis to identify the variables that contribute the most to flood risk (e.g. by incorporating different input data for load variables from different samples of Monte Carlo simulations).
Risk models are a simplified representation of the system.Consequently, results from the risk model are inherently uncertain.Sensitivity analyses can be conducted to analyse the impact on the estimated flood risk of each model variable and, thus, on the choice between alternatives for risk mitigation.For example, the use of expected, median or worstcase values can affect the results when important parameters are highly variable.There are several reviews on sensitivity analysis methods (e.g.Frey and Patil, 2002).Among them, some examples can be found in the field of flood risk (e.g.Pappenberger et al., 2008).Different methods can lead to a difference in ranking of importance of model variables.Procedures for sensitivity analyses may include, for example, one-at-a-time methods (varying one part of the input while other parts keep the same value) or variance-based techniques (e.g.Gouldby, 2007).
Uncertainty arises principally from lack of knowledge of the system or of ability to measure and to calculate risk and gives rise to potential differences between the risk estimate and its actual value.Two types of uncertainty can be defined (Gouldby and Samuels, 2005): natural variability and knowledge uncertainty.Natural variability refers to inherent variability of the real world (also called aleatory or random uncertainty), and knowledge uncertainty refers to incomplete knowledge of the system (also called epistemic uncertainty).
Different procedures and techniques can be used to reduce random and epistemic uncertainty.In general, natural variability can be characterized as random or stochastic, and probabilistic models are adopted, which involve the definition of probability distributions for stochastic variables (Gouldby, 2007).Among them, Monte Carlo techniques are the most comprehensive and robust methods.
However, epistemic uncertainty is also frequently described by probability distributions, although with a different interpretation: probability distributions for natural variables represent the relative frequency of values within an interval, whereas probability distributions for epistemic parameters (e.g.model parameters) represent the degree of knowledge or belief of the analyst that a value is within a specific interval (Merz and Thieken, 2005).
The use of uncertainty analysis has several advantages, such as the identification of weak points and critical assumptions on the model (Merz and Thieken, 2009) and may guide the required efforts for obtaining more information to improve our knowledge about the system and, consequently, to improve the risk model.
Based on the aforementioned potential use of risk models and FN-curves as robust and comprehensive tools for flood risk analysis, the proposed methodology is described in Sect.3.

Proposed methodology
The proposed methodology is divided into 11 phases.These phases are based on the methodology proposed in Escuder-Bueno et al. ( 2012) that has been adapted to incorporate the analysis of small and large dams as common flood defence infrastructures, including potential flooding from failure and non-failure cases (i.e.flooding due to discharges from flood routing).In addition, it includes aspects of risk uncertainty, risk reduction, risk management and governance.
The proposed methodology describes how to estimate flood risk from the three considered flood hazards, compiling information that is used as input data for a risk model, whose architecture definition is also part of the methodology.The model is used to perform risk calculations providing risk outcomes that can be plotted on FN-and FD-curves.Representations are then used to visualize different situations (e.g.existent risk or situations with new risk reduction measures), and propose risk reduction measures based on an integrated and comprehensive risk analysis.

Phase I: definition of the scope and aim of the study
Phase I focuses on the definition of the scope of the study.The complexity of the risk model will depend on the scope of the analysis (e.g.screening, preliminary analysis or detailed study and micro-scale, meso-scale or macro-scale).

Phase II: review of available data
Data gathering and review of all existing information is necessary for the analysis, such as information from rainfall data, hydrologic studies, hydraulic models, historical data, dam characteristics, urban characteristics (e.g.urban typology, population, economy, land uses), etc.

Phase III: definition of the current situation
Phase III includes the definition of the current situation, also called Base Case, that is, the characterization of the system and the definition of the necessary assumptions to analyse the current situation.

Phase IV: risk model architecture
In Phase IV, the risk model architecture for the Base Case is established.This model will remain the reference for the subsequent analysis of the impact of risk reduction measures.
Rainfall-runoff transfer based on hydrological studies, rainfall-runoff methods, etc.

Potential fatalities
Flood characteristics (flood depth, velocity, rise-rate, flooded areas, etc.) are obtained from resulting runoff after considering the response of the drainage system.
The drainage system network and its capacity will define resulting runoff at the study area.
Potential fatalities and economic damages are estimated based on flood characteristics (depending on resulting runoff flows).

Urban catchment area
Rainfall-runoff transfer Rainfall events at the urban catchment area Fig. 2. Generic influence diagram: independent initiating event (Scheme A1).Note: nodes outlined with solid, dotted and dashed lines refer to loads, system response and consequences, respectively.

Flood routing
Dam response modes Fig. 3. Generic influence diagram: independent initiating event (Scheme A2).Note: nodes outlined with solid, dotted and dashed lines refer to loads, system response and consequences, respectively.
As described in Sect.2, an event tree starts with an initiating event.Depending on the characteristics of the case study, two situations may be distinguished: Situation A and Situation B.
First, Situation A represents urban areas where initiating events, i.e. rainfall events within the urban and the river catchment areas, can be considered as independent phenomena, thus potential flooding from these sources of hazard are assumed independent.In this case, different influence diagrams (and the corresponding event trees) may be used to analyse each flood hazard separately.Results can be later combined to obtain total flood risk.In this methodology, two generic schemes for defining the required influence diagrams are provided in Figs. 2 and 3 (Schemes A1 and A2, respectively), which correspond to the analysis of pluvial and river flooding (including the existence of dams), respectively.
Second, Situation B represents urban areas where rainfall events within the urban and the river catchment areas are related (including, for example, the river catchment area upstream of the dam), i.e. potential flood events are the result of the same initiating event.Therefore, a unique influence diagram to represent the risk model can be used for the analysis.Figure 4 shows the (simplified) generic scheme for the risk model architecture (and the corresponding influence diagram) for this situation (Scheme B).The same architecture shown in Schemes A1 and A2 can be used for Situation B, by adding a common initiating event and two connectors: one linking the node for the initiating event to the first node of Scheme A1 shown in Fig. 2, and the second, linking the last node of Scheme A1 to the first node of Scheme A2.
The schemes given in Figs.2-4 are proposed as reference risk model architectures but they should be adapted for each case study.

Phase V: input data
Phase V includes all necessary estimations to provide the risk model with input data on three main categories: loads (nodes with solid line in Figs.2-4), system response (dotted nodes) and consequences (dashed nodes).
In most cases, outcomes from existing hydrological, hydraulic, structural or probabilistic models may be used to provide information for the risk model.However, in general, additional studies or ad hoc estimations may be required to characterize all necessary variables which are involved in the process for estimating conditional probabilities and consequences of potential flood events.
First, for nodes referring to loads, information from hydrological studies, previous water levels at reservoirs or river courses, reliability of water control structures of dams and flood routing studies are required.
Next, nodes referring to system response will require the identification of potential dam failure modes (e.g.dam break due to overtopping, internal erosion, sliding, etc.), quantification of failure probabilities, characterization of failure characteristics (e.g.breach development time, type of breach, etc.) and the analysis of non-failure cases (e.g.flow discharges due to overtopping of small dams, discharges from flood routing in large dams, etc.).All these aspects can be studied based on structural models, hydraulic models, fault tree analysis, Monte Carlo simulations, expert judgement, etc. (SPANCOLD, 2012).
Finally, nodes referring to consequences will include information based on estimation of potential economic damages and casualties (potential fatalities and economic damages are considered in this methodology).These estimates may be obtained using different methods that include the use of hydraulic models to obtain flood characteristics at the river course (i.e.river water levels) and at the site under study (e.g.flood depths).Flood depths, velocities, arrival wave times, flood severity levels, flood exposure, etc. are used to estimate potential consequences.Schemes shown in Figs. 2 and 3 are two independent schemes that start with different (and independent) initiating events: -rainfall events at the urban catchment area that result in runoff at the study site depending on the response of the drainage system; and, -rainfall events at the river catchment area that result in inflow discharges at reservoirs, and/or floods along the river course that may lead to flooding at the study site.
Regarding pluvial flooding, the first scheme (Fig. 2) shows a generic diagram that can be used to analyse flooding from rainfall events at any urban catchment area.
Regarding river flooding and dam failure, the second scheme (Fig. 3) shows a generic diagram that can be used to analyse flooding from rainfall events at the river catchment area.The scheme diverges in different branches depending on the existence of dams upstream of the urban area.In this scheme, dam failure and non-failure cases are considered (e.g.flood routing discharges).Potential consequences have to be estimated for all cases, including rebuilding costs in case of dam failure.
In some cases, it can be assumed that rainfall events in both catchment areas (urban and river catchment area) do not occur independently, then a unique influence diagram can be established, starting with a common initiating event.This approach can be used in systems where rainfall events at the urban and river catchment area are correlated, i.e. local or regional rainfall distributions do not differ substantially and spatial and temporal variability on rainfall patterns is not significant.
Different input data can be used to analyse one or several scenarios (e.g. the current situation and the situation with risk reduction measures).

Phase VI: risk calculation
In Phases IV and V, the definition of the risk model architecture provides the framework for compiling information to estimate flood risk.With that purpose, the defined influence diagram is the compact representation of the event tree that includes all possibilities that can lead to flooding.The event tree allows the estimation of conditional probabilities and consequences in a mathematically rigorous way.
Overall model (Event tree)  The risk model is a conceptual representation of the system, taking into account hazard(s), exposure to the hazard(s) and vulnerability of the system to that hazard(s).If several sources of hazard are considered, a unique influence diagram integrating information for all hazards can be used (Fig. 4).However, if hazards are considered independent, then different influence diagrams can be used to represent the system for each source of hazard separately (Figs.2-3).
For Situation A (Figs. 2-3), independent influence diagrams for analysing each flood hazard are considered.In this case, outcomes can be later incorporated to an overall scheme which obtains total flood risk due to the three sources of flood hazard, adapting input data to avoid double counting in areas potentially affected by several flood hazards.A simplified assumption is considered and potential damages in these areas are obtained by taking into account the maximum value from results for all hazards.
Figure 5 shows a general scheme of the process for combining results from three independent risk models.The outcomes from Risk Models 1, 2 and 3 (represented by the FN curves shown in Fig. 5) are used as input for an overall 3node influence diagram."Probability-consequence" pairs of all flood events from Risk Models 1, 2 and 3 are incorporated into the overall diagram in each node, respectively.
The exceedance probability functions that result from each independent risk model (Models 1, 2 and 3 in Fig. 5) are discretized into a number of intervals.Each interval has two endpoints defined by the values of the damage variable (N i , N i+1 ) and their corresponding exceedance probabilities (PE i , PE i+1 ).Intervals are generally evenly spaced in the exceedance probability axis.For each interval, the N value for the range i will be computed as the average of the pair N i , N i+1 and the probability as prob = PE i+1 − PE i .
The joint event tree (shown in Fig. 5) resulting from this diagram includes all possible combinations of events in Risk Models 1, 2 and 3.If events in Risk Models 1, 2 and 3 are considered independent, the probability of the combined event (f j km ) is obtained by multiplying the three probabilities of the corresponding events from Models 1, 2 and 3, respectively.
Finally, the overall model obtains the FN (or FD) curve that represents flood risk by integrating the three sources of flood hazard.
For Situation B (Fig. 4), the analysis may be carried out by defining a unique risk model architecture which starts with a common initiating event and combines the three sources of flood hazard.Hence, only one event tree is necessary to obtain flood risk and it provides all FN (or FD) pairs that represent all potential flood events from pluvial flooding, river flooding and flooding from dam failure and non-failure cases.

Phase VII: risk representation
The use of FN-and FD-curves is proposed in this methodology to represent outcomes of the risk model based on the schemes provided in Phase IV and outcomes from Phase VI.The basis of the use of FN-and FD-curves has been described in Sect. 2.

Phase VIII: sensitivity and uncertainty analyses
Sensitivity and uncertainty analyses may improve our knowledge of the system and help to identify key factors and reduce random and epistemic uncertainty.Results from sensitivity and uncertainty analyses may be compared with the Base Case to evaluate confidence of obtained outcomes and identify the need for further information.
When analysing the risk model for the Base Case using input data mainly from existing studies (e.g.hydrologic or hydraulic models) and minor additional estimations, sensitivity and uncertainty analyses will help to allocate efforts to develop more detailed analyses of specific variables (e.g.flood hydraulic characteristics, life-loss estimations, etc.).

Phase IX: risk evaluation
The risk outcomes obtained for the Base Case can be compared with standards or tolerability recommendations, if available.The use of FN-and FD-curves allows the comparison among current risk and tolerability recommendations and, therefore, enables a determination as to whether or not societal and economic risks are acceptable.Nevertheless, there is still a lack of tolerability recommendations for evaluating urban flood risk, except for some specific and regional studies (Jonkman et al., 2011).

Phase X: risk reduction measures
The analysis of the impact of risk reduction measures (e.g.structural or non-structural measures) is developed in Phase X by analysing different situations and by comparing new outcomes with the results of the Base Case.
Based on the Base Case risk model, risk reduction measures can be analysed by estimating new input data.Variations will depend on the type of measure.On the one hand, structural measures may need new nodes and information to characterize system response and failure modes within the risk model architecture.In general, structural measures act by reducing flood probability and modifying system response in case of flooding.On the other hand, non-structural measures generally affect flood potential consequences, reducing vulnerability of people exposed to the flood and potential economic consequences.

Phase XI: risk management and governance
The aim of analysing and evaluating current flood risk is to support decision-making on flood risk management and governance.Outcomes from risk analysis and the comparison of existent flood risk with other situations that capture the impact of risk reduction measures may help local authorities, emergency services and action forces to develop improved flood emergency action plans.
Prioritization of risk reduction measures based on equity and efficiency principles is required to allocate investments and establish risk reduction programmes.
Different risk indicators can be found in the literature to analyse and justify prioritization of risk reduction measures, e.g.individual risk (Jonkman et al., 2011), the "adjusted cost per statistical life saved" ACSLS indicator (Bowles, 2004), or the Life Quality Index (Rackwitz, 2002).These indicators consider either efficiency and/or equity principles.The analysis of different indicators for a set of risk reduction measures may support decision-making on flood risk management.In addition, there exist software tools to analyse and compare risk results based on some of the aforementioned indicators (SPANCOLD, 2012).

Case study
This section presents and summarizes the application of the proposed methodology to a real case study.The urban area is suitable for the analysis since a river crosses this town (the name of the town is not explicitly provided as requested by the river authority).The urban area is located 8 km downstream of a dam under construction.A simplified scheme of the location of the urban area is shown in Fig. 6.
The analysis followed the phases presented in Sect. 3 and it is summarized hereafter.

Phase I: definition of the scope of the study
The purpose of this analysis is to provide information on flood risk in an urban area located downstream of a dam under construction.Therefore, the scope of this analysis is to analyse societal and economic flood risk for three different situations: the current situation, the situation after dam construction, and after implementing non-structural measures of public education and warning.
In this context, the following questions will be answered: first, what the current flood risk in this urban area is, and second, how risk reduction measures would change flood risk.Results are shown to answer these questions.
The three analysed situations for the case study are: -the current situation before dam construction (natural flow regime of the river and existence of the current drainage system), denoted as Base Case; -the situation after construction of the dam, including implementation of the Dam Emergency Action Plan (DEAP-Case); and -the situation with new non-structural measures, denoted as NonSt-Case, which includes a programme on public education and warning that complements the Dam Emergency Action Plan (DEAP).
Concerning the estimation of potential consequences, potential loss of life and economic damages are obtained for residential and industrial areas.Neither the potential consequences in rural areas nor those for infrastructure are considered.Potential consequences are only estimated within the urban area and not at the whole municipality.

Location
This town is located in Spain.The municipality is divided into five urban areas.The main urban area, a traditional agricultural village with a population of about 2004 inhabitants in 2011 and an area of 31.3 km 2 , will be considered for this analysis.

General description of the system
The river and the dam are managed by the Duero River Authority.A previous analysis was carried out in 2010 at the Universitat Politècnica de València (Sanz-Jiménez et al., 2012) and provides the necessary information to estimate input data for the risk model in terms of dam failure modes, peak flow discharges, maximum water pool levels, flood depths, flooded areas, etc.It also provides data regarding the natural flow regime of the river that is used further in this analysis to define the situation for the Base Case.

Demography
Population increases during the day and in summer.Data from the Spanish National Statistics Institute showed a total amount of 2150 inhabitants in 2011 for the whole municipality (2004 inhabitants in the urban area), with an expected increase of 800 inhabitants in summer due to the existence of secondary households and 256 inhabitants during the day due to working populations.

Economy and land use
The land in the municipality is mainly devoted to residential, industrial and rural uses, as listed in Table 1.

Phase III: study of the current situation -definition of the Base Case
In this phase, the system and the Base Case are described.Flood risk is analysed by considering the following sources of flood hazard: pluvial flooding due to rainfall events at the urban catchment area and river flooding from the natural flow regime of the river.Therefore, flood events are related to two main sources of hazard: -Event 1: floods due to rainfall events that occur at the urban catchment area, which result in runoff from the combination of both urban topology characteristics and current drainage system capacity; -Event 2: floods due to rainfall events that occur at the river catchment area, which result in flow discharges along the river course.
Due to climate and topographic conditions of the study area, it can be assumed that both rainfall events are related.Consequently, the overall scheme shown in Fig. 4 has been used as reference scheme to develop the risk model architecture for this case study.

Phase IV: definition of the risk model architecture
Two influence diagrams have been developed ad hoc for the case study.The first diagram (Fig. 7) is used to analyse the current situation (i.e. the natural flow regime of the river and considering the existence of the drainage system).The second diagram (Fig. 8) makes possible the incorporation of all information regarding pluvial flooding and river flooding including the existence of the dam (Phase X).
Figures 7 and 8 show the defined influence diagrams.Tables 2 and 3 define the information provided for each node of the influence diagrams.This information is combined to estimate probabilities and consequences of all flood events.Potential consequences are estimated by combining inputs from the two types of flood events (pluvial flooding and river flooding from the natural flow regime of the river), avoiding double counting by considering the maximum number of potential fatalities and economic damages from both sources of flood hazard for each flood event.

Phase V: estimation of input data for the risk model
Input data for the risk model can be generally classified in three categories: loads, system response and consequences.In this section, information to characterize the Base Case is summarized (natural flow regime of the river and existing drainage system).
Information has been mainly obtained from existing hydrologic and hydraulic models and additional calculations have been carried out to estimate potential consequences.

Loads
Input data regarding pluvial flooding includes information of flood events resulting from rainfall episodes for return periods up to 100 yr.This upper value is based on the characteristics of the urban catchment area, where it is assumed that rainfall rates for higher return periods do not exceed significantly the obtained estimates for the rainfall event of 100 yr of return period.Maximum annual daily rainfall rates are listed in Table 4. Estimations of potential loss of life and economic damages in case of flood routing eur_nobr lives_total; Overall results including the three sources of flood hazard eur_total These values have been obtained from hydrological studies based on a rainfall gauge located 20 km from the urban area, using a Gumbel distribution (PGOU, 2009).
Concerning the natural flow regime of the river (with a mean annual peak discharge of 29.3 m 3 s −1 ), hydrographs resulting from rainfall events for return periods that range from 2 to 10 000 yr are used.Simulations from a 1-D hydraulic model in HEC-RAS for 12 different hydrographs (return periods from 2 to 10 000 yr) are used for analysing flood extent, flood depth, arrival wave time, etc. in downstream areas.

System response
Regarding pluvial flooding, the urban catchment area can be divided into four zones based on urban topology (e.g.building typology, slope and width of streets, etc.) and land-use distribution.From existing hydrologic studies, runoff rates, flood depths and velocities are obtained in the streets of all zones to estimate flood severity levels for each flood event (Escuder-Bueno et al., 2012).
Concerning the natural flow regime of the river, flooded areas, flood depths, peak discharges, and arrival wave times where the Summer category implies higher population at risk: it is considered that this increment on population occurs 2.5 months per year (2.5/12 = 0.208), from July until mid-September.Note 2: "Day"-"Night" time categories refer to different consequence estimations where Day category implies higher exposure and higher population at risk (mainly in the industrial area): a value of 9.5 h (9.5/24 = 0.396) is assumed as the average number of daily non-working hours.
provided by the analysis carried out in 2010 (Sanz-Jiménez et al., 2012) and a 1-D hydraulic model are used.

Potential consequences
The estimated population in this case study is 2004 inhabitants.However, daily and seasonal variations exist according to the available demographic data.Therefore, four time categories are set as shown in Table 5 in order to reflect that variability (where summer season ranges from 1 July to 15 September and daytime category ranges from 08:00 to 22:30 UTC + 1).Probabilities for each category are listed in Table 5. Potential fatalities for each time category and flood event are obtained by multiplying population exposed to the flood by fatality rates.For the analysis, fatality rates proposed in Escuder-Bueno et al. ( 2012) are used for estimating potential loss of life in case of pluvial and river flooding (natural flow regime of the river).
Potential economic damages are obtained by estimating direct and indirect costs from flooding.For estimating direct costs of flooding, the urban area is divided into sub-areas with similar urban characteristics (mainly building typology and land use).Then, direct costs of flooding are obtained for each sub-area by multiplying three factors: (1) a reference value (in euros per square metre) based on the land use category (two categories are considered: residential or industrial); (2) the extent of the flooding within the sub-area, and (3) a percentage of damages based on flood depth.According to existing studies (COPUT, 2002), the reference values shown in Table 6 are considered, based on a scale ranging from 0 to 100, where 100 is equivalent to an economic value of 82 C m −2 .Values are calculated based on consumer price index values for 2011.
Generic depth-damage curves were proposed by USACE (2000).Values for properties of two or more stories without basements are used for this case study, based on average urban typology for each sub-area within the urban area.Damage to content is not considered as the reference value (in euros per square metre) proposed by COPUT (2002) for different land uses does include not only the value of the structure but the content also.Therefore, the reference value differs depending on the land use to which the flooded area under consideration is assigned (two land-use categories are considered: residential and industrial).
Finally, potential economic damages are estimated for each flood event by adding direct costs among all sub-areas.The resulting total direct cost is multiplied by a factor 1.27 to incorporate indirect costs.This factor includes disruption of public services, general costs of flood control intervention or disruption of secondary activities.Values for this factor are proposed in COPUT (2002) for different municipalities in Spain, based on total population, affected area, population density, and rate of employment, among other variables.
Total costs for the Base Case in case of pluvial flooding and the natural flow regime of the river are shown in Table 7.

Phase VI: risk calculation
All previous information on loads, system response and consequences in case of pluvial and river flooding is incorporated in the risk model, represented by the influence diagram shown in Fig. 7. Risk calculations are performed using the iPresas software (Serrano-Lombillo et al., 2009), developed at the Universitat Politècnica de València.

Phase VII: risk representation
Risk outcomes from iPresas software are obtained to represent FN-and FD-curves for the situation before dam construction (Base Case).Results show that the total societal and economic risks (area under the FN-and FD-curve) have been estimated as 0.097 lives yr −1 and 3.86 M C yr −1 , respectively (Figs. 9 and 10).Total societal and economic risk can be obtained by considering the area under the FN-and FD-curves.

Phases VIII: flood risk evaluation
There are no applicable standards or tolerability criteria in terms of urban flood risk to evaluate this case study.
The main objective is to analyse the situation after the construction of the dam, including the implementation of the DEAP, and the situation after additional non-structural measures of public education and warning.

Phase IX: sensitivity and uncertainty analyses
A sensitivity analysis of the established conditional probabilities for all dam failure modes is further described in Phase X, after the study of the situation after dam construction.Uncertainty analysis is not considered for this case study.

Phase X: risk reduction measures
In addition to the Base Case, two other situations are analysed.

Situation after dam construction, including the Dam Emergency Action Plan (DEAP-Case)
Based on the Base Case, the situation after dam construction, denoted as DEAP-Case, includes also the implementation of the Dam Emergency Action Plan.Its impact can be incorporated into the risk model by estimating new loads, system response and consequences.Dam construction costs are established as 100 M C and DEAP annual maintenance costs as 0.03 M C.

Risk model architecture
Figure 8 shows the influence diagram for this case.All the information required to characterize loads, system response and consequences is listed in Table 8 (failure modes are later described).The risk model includes four dam failure modes (Sanz-Jiménez et al., 2012): two failure modes related to structural-geotechnical aspects (slippage of dam blocks) and two failure modes related to failure of outlet works (e.g.stilling basin erosion or undermining of the toe of the dam).

Loads: river flooding including the dam
Annual exceedance probabilities of different inflow rates at the reservoir are considered.Figure 11 shows inflow discharge distributions at the reservoir for five different annual exceedance probabilities (PAE, with units of yr −1 ).Dam failure is analysed based on inflow rates at the reservoir for return periods up to 100 000 yr. Estimations of feasible previous water pool levels at the reservoir are also obtained (Fig. 12).Gate reliability of bottom outlet works is estimated as 85 % (the spillway is uncontrolled).
Table 8.Failure modes considered for the analysis.

FM2
Given a certain water pool level, on the embankment of a block close to the centre but not included in the overflow section.It starts from the existence of a sliding surface with enough continuity through the San Fermín fault and a degradation of the surface (which could include a limonite-sandstone contact), giving rise to a loss of effectiveness of the drainage wells, together with feasible influences from San Fermín fault (three uplifts laws).The dam fails finally by sliding.

FM3
Given a certain water pool level, on the embankment of one of the baffle blocks, it starts from the existence of a sliding surface with enough continuity through the San Fermín fault and the existence of degradation of the surface (which could include a limonite-sandstone contact), giving rise to a loss of efficiency of the drainage wells, together with feasible influences from San Fermín fault and the possibility of drain silting and its break (six uplift laws).Finally, the dam fails by sliding.

FM5
Related to a continuous discharge through the stilling basin, and involves erosion of the basin itself or the downstream toe of the basin, by headcutting or continuous concrete degradation.The stilling basin loses its structural integrity and leaves the ground uncovered.Erosion continues and reaches the toe of the dam and it is undermined.Finally, dam failure occurs due to a hybrid mechanism of settlement, overturning and sliding.

FM6
Related to continuous overtopping, erosion on the toe of any block.This process takes place until the downstream toe is uncovered.Erosion continues undermining the toe of the dam and, finally, dam failure takes place by a hybrid mechanism of settlement, overturning and sliding.

System response: river flooding including the dam
A multidisciplinary group of professionals (33 participants), covering different areas of knowledge such as geology, hydrology, seismicity, materials, dam design, construction, monitoring, hydrology, etc. was actively involved in 2010 in the development of the different risk assessment activities to characterize loads, system response and consequences in case of failure of this dam (Sanz-Jiménez et al., 2012).Four failure modes are considered in this analysis (denoted as FM2, FM3, FM5 and FM6).These failure modes are related to potential sliding due to the existence of the San Fermín fault or failure of outlet works in a hydrological event.and two on the performance of the drainage system (good, bad).Depending on the definition of the failure mode, either three or six (3 × 2) possible uplift resulting laws had to be then considered to account for all the combinations.The conditional probabilities that characterize each failure mode were obtained by expert judgement.Two series of flow discharges are considered: discharges due to failure cases and flood routing cases (Table 9).Flooded areas are obtained based on inundation maps from hydraulic simulations using the software tool MIKE11.Flood depths and arrival wave times are also obtained from hydraulic modelling.
A sensitivity analysis of established conditional probabilities for all failure modes was also conducted.With that purpose, lower and upper estimates obtained from expert judgement are also incorporated into the risk model and results  are denoted as Case L and Case U, respectively (best estimates were used in the DEAP-Case).11 for the largest flood events in failure (Q br8 ) and non-failure cases (Q nbr6 ).

Results
Figures 13 and 14 illustrate the results for the three cases with lower (Case L), upper (Case U) and best estimates (DEAP-Case) of probabilities for failure mode characterization.As it can be observed in both graphs, the FN-and FD-curves for both cases move upwards or downwards as the dam failure probabilities shifts in comparison with the DEAP-Case.However, if total societal or economic risk is considered (area under the FN-curve and F-D curve, respectively), then risk results do not show significant differences in comparison with the DEAP-case since these values are more influenced by the impact of pluvial flooding in the urban area (high probability events).

Situation with non-structural measures of public education and warning (NonSt-Case)
Based on the DEAP-Case, the situation with new nonstructural measures, denoted as NonSt-Case, includes a Public Education and Warning Programme (PEWP).The implementation cost of this programme is 50 000 C (annual maintenance costs of 15 000 C). Its impact can be incorporated into the risk model by estimating new consequences.With regard to potential fatalities, lower fatality rates can be used for analyzing pluvial flooding for situations with advanced warning systems.In case of river flooding, including the dam, fatality rates associated with this situation are established at level 10 (highest level of flood severity understanding from advanced risk communication and public education programmes and highly coordinated emergency services) from the classification proposed by Escuder-Bueno et al. (2012).In general, the impact of non-structural measures on potential economic damages is estimated by considering the state of knowledge on the relationship between lead warning times and reduction on potential damage depending on flood depth (Messner et al., 2007;Parker et al., 2005;Penning-Rowsell et al., 1978).However, it is considered that a measure involving warning systems should be implemented along with public education actions, as it is assumed that warnings are only effective if the population at risk has a certain level of knowledge on how to act in case of a flood.Therefore, reduction of potential economic damages (e.g. from installation of waterstops to prevent water from entering households) can only be considered if public educational activities are in place.In this case, a reduction of the estimated damages can be achieved.
The annualized cost of the Public Education and Warning Programme (PEWP) is obtained based on implementation and maintenance costs and the expression given in Eq. (4).
where C A is the annualized cost of the risk reduction measure, C int is the implementation cost, C man is the maintenance cost, r is the discount rate and n the dam lifespan.
It is considered that this measure is implemented in one year, the lifespan of the dam is 75 yr and the discount rate is 5 %.As a result, the annualized cost for the programme is 17 441 C yr −1 . 1.E-10 1.E-09 1.E-08 1.E-07 1.E-06 1.E-05 1.E-04 1.E-03 1.E-02 1 Annualized costs are obtained to calculate an indicator of the economic risk reduction generated by the implementation of the measure.The ACSLS (adjusted cost per statistical life saved) indicator is used in this article (ANCOLD, 2003) and it follows the expression given in Eq. ( 5).This indicator can be used to figure out whether measures reduce risk in an efficient and equitable way.Bowles (2004), in a preliminary way, proposed that a measure is very justified with an ACSLS lower than USD 3 million and is not much justified with an ACSLS higher than USD 140 million.This indicator is defined as Results for the DEAP-Case show that approximately 360 fatalities result for an annual cumulative exceedance probability (F ) of 1 × 10 −8 for the situation after dam construction.Results show that the total probability of failure is 3.7 × 10 −7 , which corresponds to the horizontal part of the FN-curve.The combination of pluvial flooding and flood routing cases reach a maximum number of approximately three fatalities.This value is only exceeded by dam failure cases.
By comparing the DEAP-Case with the situation with nonstructural measures (NonSt-Case), it can be observed that the whole FN-curve moves to the left as the level of consequences is reduced, due to the existence of improved warning   systems and higher flood severity understanding, when all sources of hazard are considered.In this case, the maximum number of potential fatalities is approximately 70 casualties.Reduction of economic damages for flood events with low flood depths (e.g.pluvial flooding) is considered for the situation with non-structural measures of public education and warning.Therefore, the FD-curve varies for the NonSt-Case (dashed line).Economic damages for "highprobability" flood events are higher for the Base Case as it includes river flood events from the natural flow regime of the river.As it is observed from the FD-curve, dam failure increases the expected level of potential economic damages for the Base Case.
Table 12 shows the results of total societal and economic flood risk for each situation (Base Case, DEAP-Case and NonSt-Case).These values are obtained from FN-and FD-curves where they represent the area under each curve.Therefore, values are given in terms of lives yr −1 and C yr −1 (or M C yr −1 ).
Results show that a risk reduction of, approximately, 0.13 lives yr −1 may be obtained after implementing nonstructural measures of public education and warning based on the proposed programme.In addition, both ACSLS indicators for the DEAP-Case and NonSt-Case are negative, thus the implementation of both measures (dam construction and public education and warning programme) are justified in terms of efficiency.

Phase XI: risk management and governance
From the risk outcomes shown in Figs.16 and 17, it has been demonstrated that potential fatalities in case of dam failure are significant but related to low probabilities.The implementation of non-structural measures of public education, warning and improved coordination schemes in case of flood emergency may reduce existent risk by improving the implementation and impact of the Dam Emergency Action Plan.
The guiding principle for flood risk management and governance to protect this urban area should be ensuring effective communication mechanisms among dam operators, emergency services and local authorities to ensure a quick response in case of emergency (i.e.increasing available warning times).
Annual education programmes on flood risk, improved warning systems and training exercises require relatively low economic and technical resources (the annualized cost for the programme is 17 441 C yr −1 ) when compared to their potential for risk reduction.Results show that societal risk would decrease from 0.194 lives yr −1 , for the situation with only a Dam Emergency Action Plan, to 0.069 lives yr −1 , for the situation with improved public education and warning.In addition, results show that economic risk would decrease from 0.835 M C yr −1 , for the situation with only a Dam Emergency Action Plan, to 0.673 M C yr −1 , for the situation with improved public education and warning (i.e. the estimated reduction on economic risk is larger than the annualized cost of the proposed risk reduction measures).

Conclusions and further research lines
In the first part of this article main concepts on flood risk analysis, assessment and management are presented and discussed.
This article presents a comprehensive methodology to integrate the analysis of pluvial flooding, river flooding and flooding from dam failure into urban flood risk analysis to provide better and more complete information to decisionmakers on flood risk management.The methodology starts from a methodological piece developed within the SUFRI project and includes the analysis of dam failure and nonfailure cases (flood routing) to quantify and evaluate flood risk in urban areas.The goal of this methodology is to provide a tool for flood risk analysis that integrates all information regarding several sources of flood hazard.Reinforcement of best policies (e.g.urban planning, emergency management, civil protection, etc.) and good governance may be achieved by using the outcomes of flood risk analysis.
The use of risk models provides a logic and mathematically rigorous framework for compiling information.In addition, integrated societal and economic quantitative risk outcomes can be obtained.The relevance of quantitative flood risk analysis in urban areas is supported by the obtained results, indicating that FN-and FD-curves are helpful and comprehensive tools to represent flood risk.These curves are the basis to illustrate risk quantification and the effect of different measures on flood risk reduction.Thereby, they prove to be helpful in comparing and analysing mitigation measures.Furthermore, FN-and FD-curves may be used to compare estimated risks against tolerability criteria or historical data.
The proposed methodology has been applied to a case study to analyse flood risk after dam construction and the impact of the non-structural measures of public education and warning.The results suggest that, for the case study site, flooding from the river and pluvial sources results in a low number of fatalities, whereas flooding from dam failure results in a high number of fatalities.The results of the analysis of non-structural measures confirmed that current risk is sensitive to warning times.Therefore, the implementation of the Dam Emergency Action Plan, along with additional nonstructural measures of public education and warning, would considerably reduce the number of potential fatalities at the urban area in case of dam failure.Based on the existent flood risk and the potential of non-structural measures on risk reduction, it is confirmed that the implementation of an "upgraded" DEAP (including annual education programmes and improved warning systems) would reduce societal risk.Accordingly, the results show that it is of high importance to implement this plan before operation of the dam is initiated, as established in current regulation on dam safety at a national scale.
The methodology has been applied for a case study but it has been developed to be potentially applicable to any urban area.Flood risk analyses can support decision-making by providing information to prioritize risk reduction measures.Hence, it is important to measure not only the impact but also the efficiency of the different measures.The results have shown that the proposed non-structural measures of public education and warning are highly justified in terms of efficiency.However, it has to be remarked that equity (Bowles et al., 2005) is another fundamental principle from which alternatives can be prioritized and conflict should be avoided achieving both equity and efficiency (Munger et al., 2009).
Regarding tolerability risk guidelines, there is still a lack of general standards for flood risk analysis in urban areas.Applicability of FN-curves for flood risk evaluation at local, regional or national level has been under discussion during recent years (e.g.Evans and Verlander, 1997) and it is still a matter for debate in the flood community, as results vary when considering load interdependencies among flood defence systems (i.e. the impact of failure of a flood defence infrastructure in the loading conditions of downstream systems).Tolerability standards based on the use of FN-curves are still under debate (e.g. on the consideration of a maximum base point, the slope of the tolerability criterion or the influence of risk aversion).This discussion falls outside the scope of this paper.An example and some considerations on the use of individual and societal risk for the national flood safety policy in the Netherlands can be found in Jonkman et al. (2011).Further investigation might focus on developing common standards to assess urban flood risk.
The proposed methodology goes one step forward in the process towards a comprehensive flood risk management that integrates all sources of flood hazard (natural and man-made threats), analyzing all related flood defence infrastructures (e.g.dams, dikes, levees, etc.) and involves all phases from risk analysis to risk governance (Fig. 17).Within this framework, there are further research opportunities to integrate human-induced hazards and to incorporate potential failure of other flood defence infrastructures such as fluvial dike systems into quantitative flood risk analysis.

Fig. 5 .
Fig. 5. Combination of outcomes of different risk models.

Fig. 6 .
Fig. 6.Overall scheme of the urban area downstream of the dam.
where C A is the annualized cost of the risk reduction measure, E[R E ] and E[R R ] are the estimates of total economic risk before and after implementing the measure, O[R E ] and O[R R ] are the operational costs of the dam, and E[N E ] and E[N R ] are the estimates of total societal risk.In this case study, dam operational costs are considered constant.Figures15 and 16show the FN-and FD-curves, which represent societal and economic flood risk for the analysed situations: the Base Case (solid line), the DEAP-Case (dashed line) and the NonSt-Case or situation with nonstructural measures (dotted line).

Fig. 17 .
Fig. 17.Current and future research lines within the risk analysis-governance framework.
Reliability analysis of outlet works, gates, spillways, etc. that control water levels at the reservoir.It is based on historical data, fault tree analysis or expert judgement.

Table 2 .
Nodes for Risk Model 1.

Table 3 .
Nodes for Risk Model 2.

Table 4 .
Maximum annual daily rainfall rates at the case study.

Table 5 .
Time categories and probabilities.

Table 6 .
Reference costs for estimating potential economic damages.

Table 7 .
Example of estimated potential fatalities and economic damages for the Base Case.
Table 8 gives a short description of each failure mode.Different assumptions on the uplift distribution were made to account for three different hypotheses on the permeability of San Fermín Fault (very low, intermediate, and very high)

Table 9 .
Selected flow discharges in dam failure and non-failure cases for estimating consequences.

river flooding including the existence of the dam
Table10shows the established values from expert judgement for all nodes of the risk model associated with failure modes (Nodes N and D, where a, b, c denote different estimates for the same node based on discharges or overtopping heights).

Table 10 .
Probability estimates for all failure modes (lower, best and upper estimates).

Table 11 .
Example of estimated potential fatalities and economic damages for the DEAP-Case (river flooding including dam failure and flood routing).

Table 12 .
Total flood risk for the case study.