Natural Hazards and Earth System Sciences Optimal design under uncertainty of a passive defense structure against snow avalanches : from a general Bayesian framework to a simple analytical model

For snow avalanches, passive defense structures are generally designed by considering high return period events. In this paper, taking inspiration from other natural hazards, an alternative method based on the maximization of the economic benefit of the defense structure is proposed. A general Bayesian framework is described first. Special attention is given to the problem of taking the poor local information into account in the decision-making process. Therefore, simplifying assumptions are made. The avalanche hazard is represented by a Peak Over Threshold (POT) model. The influence of the dam is quantified in terms of runout distance reduction with a simple relation derived from small-scale experiments using granular media. The costs corresponding to dam construction and the damage to the element at risk are roughly evaluated for each dam height-hazard value pair, with damage evaluation corresponding to the maximal expected loss. Both the classical and the Bayesian risk functions can then be computed analytically. The results are illustrated with a case study from the French avalanche database. A sensitivity analysis is performed and modelling assumptions are discussed in addition to possible further developments. Correspondence to: N. Eckert (nicolas.eckert@cemagref.fr)


Introduction
Mitigation against natural hazards traditionally involves computing high return period events for the design of defense structures (Ancey et al., 2004;Eckert et al., 2007).Nowadays such methods are strongly contested in fields such as hydrology (Krzysztofowicz, 1983;Bernier, 2003) and engineering (Jordaan, 2005) by economic approaches that aim at optimizing the use of public funds.Their principle is to choose the design value that minimizes the expected loss.The model describing the stochasticity of the phenomenon is therefore combined with a utility function and then the expected loss associated with each value of the decisional variable is computed.Technical difficulties are overcome as a result of important methodological developments concerning simulation-based algorithms (Müller, 1999;Amzal et al., 2006).
In the avalanche field, however, return period-based methods remain particularly pregnant (Ancey et al., 2004;Eckert et al., 2007) and we are not aware of applications of decision theory to the design of defense structures.Nevertheless, costbenefit analyses have been proposed to test the economic efficiency of different projected defense structures a priori (Wilhelm, 1997;Wilhelm, 1999) or to evaluate their efficiency a posteriori (Fuchs and McAlpin, 2005).In such approaches, the optimization of the defense structure is performed with regards to the considered scenarii only, without taking into account the full variability of the avalanche phenomenon.This can lead to seriously question the optimality of the structure retained if a large range of avalanche magnitude is likely to occur on the considered site and if the expected loss is highly sensitive to the hazard magnitude.The latter point is emphasized by Fuchs et al. (2005), who show that the total N. Eckert et al.: Bayesian optimal design of an avalanche dam loss in case of an extreme avalanche can greatly increase if a slight increase in the runout area is considered.On the other hand, when the optimization of a defense structure is carried out with respect to a given scenario, the retained defense structure is obviously more efficient if this scenario occurs than if the optimum computed by averaging all over the hazard distribution is retained.
Risk computations have also been performed in the avalanche field, but mainly for hazard mapping purposes (Keylock et al., 1999;Chernouss and Fedorenko, 2001;Barbolini et al., 2004a;Grêt-Regamey and Straub, 2006); most authors use the annual probability of being killed by an avalanche as a definition of risk.This type of method is included in the current legislation in Iceland (Jonasson et al., 1999, Arnalds et al., 2004).
This paper illustrates the potential of a decision theoretical framework for the design of a passive avalanche defense structure, i.e. a defense structure that does not decrease the avalanche release probability but reduces the damage to the elements at risk.More precisely, we focus on the case of a vertical dam protecting one or several buildings situated at a known position on the avalanche path.Critical points by comparison with hydraulics are as follows: (i) the local information available for avalanche studies is generally poor.In addition, because of the complex nature of the flowing fluid (Dent and Lang, 1980;Bouchet et al., 2004), (ii) the evaluation of the influence of the dam on the flow in the runout zone where the elements at risk are situated is not easy, and (iii) complex hazard models are generally used (Harbitz et al., 1998), making stochastic approaches too timeconsuming for operational purposes.Problem (i) is treated within a Bayesian framework (Krzysztofowicz, 2001;Girard and Parent, 2004;Clark, 2005) that allows uncertainty due to the lack of local information being processed up to the decision.Problem (ii) is addressed by incorporating a semiempirical formulation of the dam's influence into the stochastic avalanche model.Problem (iii) is overcome by considering simplifying assumptions for the quantification of both the hazard and the cost evaluation, so that the risk computations can be performed analytically.
Section 2 briefly presents the elementary bricks that are needed for the Bayesian optimal design of an avalanche dam.Section 3 proposes strong assumptions and puts the bricks together, so as to obtain the analytical expression of the risk functions.Section 4 applies the model obtained to a real case study from the French avalanche database.Section 5 discusses the results with special attention devoted to modelling assumptions and possible further developments.Section 6 offers a general conclusion highlighting the relevance of the decisional model for real case applications.

Hazard model and associated uncertainty
For convenience, the avalanche is assumed to move along a curvilinear two-dimensional profile whose equation in a Cartesian frame is z=f (x), where z is the altitude and x the distance measured along a horizontal axis starting at the top of the path and following the avalanche thalweg.A distinction is made between avalanche magnitude y and avalanche frequency a. Avalanche magnitude includes all the quantitative characteristics that vary from one event to another: runout distance, velocity and pressure profiles, snow volume, etc. Avalanche frequency is the number of avalanches recorded during a given winter.The stochastic hazard model is noted l (y, a |θ M , θ F ), indicating that the joint distribution l of the random numbers y and a is indexed by the parameters θ M , θ F .Finally, the hypothesis of magnitudefrequency independence is made, considering that the number of avalanches per winter does not affect their quantitative characteristics (Eq.1).This classical hypothesis in avalanche modelling is fulfilled if the number of avalanches affecting the studied path each winter is not too high (Eckert et al., 2008a).
The typical inference challenge is to obtain point estimates ∧ θ M , ∧ θ F for the parameters θ M , θ F knowing the data available on the studied site in order to use them in a predictive phase for quantifying reference hazards and/or designing defense structures.However, obtaining point estimates such as maximum likelihood point estimates can be very tricky depending on the model considered.Moreover, if data quantity is small, which is usually the case in avalanche studies, such point estimates are highly uncertain.They therefore cannot be used for prediction with a good level of confidence, and rigorous engineering practices should take into account this lack of information on the model's parameters.Bayesian inference (Bayes, 1763) is appropriate, offering a fair quantification of the state of knowledge given the data through the posterior distribution p (θ M , θ F |data ).Its computation is carried out by processing the model using Bayes theorem (Eq.2) at the cost of the specification of a prior distribution π (θ M , θ F ).

Cost quantification and risk computation
Let us assume that one building is situated at the abscissa x b of the runout zone.The construction of a vertical protective dam at the abscissa x d is envisaged and the problem is to choose the dam height h d that minimizes economic losses.The cost function C (h d , y, a) is the basic tool for a costbenefit analysis.It quantifies the cost of each decision, (i.e., each dam height h d ) for each hazard value (i.e., each pair y, a).A general additive form for the cost function is given by Eq. 3. The first term C o (h d ) quantifies the cost of constructing a dam of height h d .C 1 (h d , y tk ) is the cost of the damage inflicted by the avalanche k ∈ [1, a t ] of the year t ∈ [1, +∞[ given that the dam height is h d and that a t avalanches have been observed during the winter t.This cost has to be actualized, assuming a known annual interest rate i t for the year t.The second term of Eq. 3 therefore quantifies the total damage inflicted on the building by the successive snow avalanches that occur starting at the time of the dam construction.Note that the damage caused to the dam by the successive avalanches is not explicitly taken into account in this formula (see Sect. 5.3 for discussion).
Under the strong hypothesis of stationarity, all the y tk 's are identically distributed.In addition, under the magnitudefrequency independence hypothesis, the total cost depends on the expected number of avalanches E [a] only.The cost function can therefore be considerably simplified (Eq.4), with a total actualization rate A depending on the annual interest rates only (Eq. 5).
For an easy quantification of the pertinence of the decision, a reference state has to be introduced.We define the utility function u (h d , y, a) as the cost difference for a given hazard value between the construction of a dam of height h d and no dam (Eq.6).Note that in the general decision theoretical framework, the utility function generally has a more specific definition including the behavior of the decision maker managing risk.We assume here that the decision maker behaves neutrally toward risk, which should be the case if substantial public funds are involved.
The expected utility is known as the classical risk R C (h d , θ M , θ F ).It is a function of the decisional variable h d and the parameters θ M , θ F describing the hazard model (Eq.7).It quantifies the mean economic loss that must be expected if an obstacle h d is constructed instead of maintaining the existing situation.More simply, it is the opposite of the expected economic benefit of the dam construction.With the utility model proposed, only the integration over the magnitude variability is necessary (Eq.8).According to the classical risk setting, the optimal dam height h * C minimizes the expected utility and is obtained by solving Eq. 9. Note that, in all computations performed in this paper, this h * C is the effective height seen by the incoming avalanche.For practical purposes, the mean depth of the snow cover has therefore to be added.
Obviously, the solution of Eq. 9 is a function of the parameters θ M , θ F .Current engineering practice is to plug point estimates The classical optimal design procedure therefore assumes perfect knowledge of the avalanche model's parameters.However, disconnecting the statistical problem from the decisional problem may have undesirable consequences.Indeed, the decisional problem is then treated as if the hazard parameters were perfectly known, which is unrealistic with poor local information.Moreover, the classical risk setting does not account for a discrepancy between the statisticians's and decision maker's points of view when inferring model parameters.The statistician generally searches for point estimates minimizing a variance criterion, which is a symmetrical quadratic function.On the contrary, decision makers may consider nonsymmetrical cost functions since overestimating the design value is obviously more acceptable than underestimating it.The Bayesian risk R B (h d ) takes into account the additional uncertainty affecting the hazard by averaging throughout the posterior distribution of the parameters (Eq.10), clearly incorporating the estimation error into the decisional process.The Bayesian risk can therefore be seen as a function of h d only, which makes it easy to determine the Bayesian optimal height h * B (Eq. 11).Obviously, it is also a function of the prior knowledge and of the data used for inference.

Linear model for obstacle effects
The influence of obstacles on avalanche flows is still imperfectly known.Nevertheless, significant progress in their comprehension has been made over the last few years based  (2001).Raw data measured in Grenoble and Bologna are available in Faug et al. (2003).
on important research using full-scale experiments (Lied et al., 2001) and small-scale experiments (Faug, 2004) as well as numerical modeling (Naaim et al., 2004).The extensive literature on this topic is reviewed by Faug et al. (2008).For instance, converging results have been obtained while studying the influence of a vertical dam on a so-called reference hazard, a given avalanche defined by its flow depth, runout distance, longitudinal velocity profile, etc.More precisely, a first-order development of the energy dissipation induced by a dam assuming a punctual "black box" effect on the flow gives a linear relationship between the runout distance reduction and the ratio between the dam height h d and the depth of the reference flow without the dam h o (Faug et al., 2008).The reference runout distance x stop o is therefore reduced to x stop (h d ), with a proportionality coefficient α quantifying the dissipation power of the dam (Eq.12).The theoretical relationship is largely supported by several small-scale experiments on rapid granular avalanches with typical Froude numbers higher than 2-3 (Hákonardóttir et al., 2001;Faug et al., 2003).Figure 1, for instance, shows good agreement between the model and experimental data, with nearly all the observations falling into the 95% confidence interval.Moreover, these results are compatible with recent analysis of full-scale snow avalanches overflowing a dam that shows a linear scaling between x stop (h d ) and h d (Gauer and Kristensen, 2005;Faug et al., 2008).The proportionality coefficient α is known to be around 0.14 for dry granular materials modelling dry dense avalanches (see Sect. 5.2 for discussion and Sect.4.4.4 for a sensitivity analysis).
Obviously, the semi-analytical relation of Eq. 12 has a number of limitations.The most obvious ones are x stop (h d )−x d >0 and h d <h o × 1 α , since for higher dams the avalanche flow is fully stopped and x stop (h obs )−x d drops to zero.Other limitations related to the flow regime will be discussed in Sect.5.2.
Finally, it is important to mention that the reference runout x stop o and the reference flow depth h o were unknown for the full-scale observations of avalanches overtopping dams, which did not allow verifying Eq. 12 and consequently estimating the value of α on real avalanches.The value chosen for α is thereby the value obtained from the rapid laboratory granular avalanches.Sufficient knowledge is assumed for α by setting α= ∧ α =0.1376 for all the computations.This latter hypothesis is discussed in Sect.4.4.4.

A conjugate POT model for monovariate avalanche hazard
Quantifying avalanche hazard generally involves multivariate modelling of avalanche magnitude to account for at least runout distance, flow depth and pressure variations in the runout zone.Nevertheless, avalanche magnitude is limited in this paper to runout distance, i.e., the most critical value for avalanche hazard mapping.Moreover, the runout distances exceeding the dam abscissa without a dam are assumed to be exponentially distributed (Eq.13), so that y=x stop o , θ M =ρ.
More classically, the number of exceedences occurring during a given winter is assumed to be Poisson-distributed (Eq.14), so that θ F =λ.The mathematical expectation of the frequency model used in the cost function is then simply the parameter λ.The runout abscissa x stop T corresponding to any return period T can be easily computed (Eq.15).This very simple hazard model with two parameters only (ρ, λ) is well known in hydrology (Parent and Bernier, 2003) as a Peak Over Threshold (POT) model (Coles, 2001).Its relevance in the field of snow avalanches is discussed in Sect.5.1.
The analytical computation of the posterior distribution of the parameters ρ, λ is possible with hypotheses for mathematical convenience.Conjugate Gamma priors are chosen for both parameters of the hazard model with two pairs a ρ , b ρ and (a λ , b λ ) to be specified (e.g., Eq. 16).Marginal posterior distributions for λ and ρ are then still Gamma distributed, with the parameter pairs a When n and m are large enough, the prior knowledge does not play much of a role.This is especially true if poorly informative priors (Bernardo and Smith, 1994) are chosen.This will be the case in this paper, so that classical and Bayesian inferences asymptotically lead to the same estimators (Berger, 1985).

Simplified cost and utility functions
Starting from Eq. 4, two additional assumptions are made.First, the construction cost is assumed to increase linearly with dam height.Second, the damage caused to the building by a snow avalanche is assumed to depend only on runout distance, with the damage term simply modeled by the product of an indicator function with the economic value of the buildings.The indicator function The damage is therefore maximal as soon as the building is attained, whereas the building remains obviously undamaged if the avalanche does not reach its abscissa (Eq.17).This is obviously a very rough approximation, but consistent with the simplifications also made for the modelling of hazard and dam influence.Though, more elaborate formulations have been recently proposed (e.g.Barbolini et al., 2004b), but the related uncertainty is still very high.See Sect.5.3.2 for discussion.
Combining Eq. 17 and the influence of the dam on runout distances (Eq.6), the cost corresponding to the runout distance x stop (h d ) can be expressed using only the reference flow h o and the reference runout distance x stop o (Eq.18).The corresponding utility function is then easily obtained using the properties of indicator functions (Eq.19).Equation 19establishes that the dam is useful only for avalanches that flow beyond the building without the dam but are stopped before the building with the dam.

Analytical risk computations
The analytical integration of the utility function throughout the hazard model is possible (Eq.20), with a change of variables in the integral easily leading the result (Eq.21).The risk function obtained depends on the dam height and the two parameters of the hazard model.
The Bayesian risk is the mathematical expectation of the classical risk over the joint posterior distribution of the pair (ρ, λ) (Eq.22).Given the model's properties, the joint posterior distribution of the pair (ρ, λ) is simply the product of their marginal posterior distributions.The integral over λ is the mathematical expectation of a Gamma distribution.Moreover, the properties of summation to 1 of a probability distribution can be used to compute the integral over ρ (Eq.23).
Unfortunately, the analytical optimization of Eqs.21 and 23 cannot be performed, but the numerical determination of the dam heights that minimize both risk functions is easy.

Case study presentation
The case study selected is a real path from the French avalanche database (Mougin, 1922; Bélanger and Cassayre,   1).Several concavity changes that would make numerical modelling (Naaim et al., 2004) of the flow difficult occur along the slope's profile.However, the runout zone that consists in the gentle slope preceding the Arc River (x=1763 m) is rather regular, making the use of a simple stochastic model for runout distances possible.An exposed building is assumed to be situated in the runout zone.It seems unrealistic to consider a building at an abscissa corresponding to a return period of less than 10 years.In addition, an upper limit for zoning restrictions less than 1000 years is always adopted.Consequently, only buildings implanted at abscissas x b corresponding to return periods ranging from 10 to 1000 years are investigated, with special attention paid to the well-known return periods of 30, 100 and 300 years (Ancey and Richard 2000;Bardou, 2006).
The position of the dam to be designed is fixed at an abscissa theoretically corresponding to the beginning of the runout zone.In the avalanche field, the engineering practice initiated by Salm et al. (1990) considers that the runout zone begins where the local slope decreases under 10 • .When applied to this path, this empirical rule implies x d =1550 m.Note that in reality some avalanches have on this path stopped on steeper slopes (Fig. 2), but they are of no relevance for risk assessment as their runout distances are very short.
During the 1973-2003 time period, 28 avalanches exceeding x d were recorded by the local forestry service.The most extreme runout distance recorded corresponds to the Arc River, but beyond it, the terrain remains rather flat, making it possible for extreme avalanches to reach higher abscissas.

Bayesian inference of the POT model
Poorly informative priors are used, a λ =a ρ =0.001 and b λ =b ρ =0.01, respectively, so that a λ =31.001, b λ =28.01, a ρ =1208.7 and b ρ =28.01.Figures 3 and 4  =0.0232.The frequency parameter corresponds to the mean exceedence rate, whereas the magnitude parameter is the inverse of the mean of the exceedences.The River abscissa corresponds to a return period greater than 100 years, whereas the 1000-year return period abscissa is situated 80 m beyond the Arc River (Table 2).The frequency model given λ= ∧ λ is very close to the observed avalanche activity, which indicates that a Poisson model describes the randomness of the number of exceedences well (Fig. 3).The adequacy between the data and the magnitude model given ρ= ∧ ρ is less satisfactory, with the empirical distribution being strongly discrete.A part of this discrepancy can be attributed to the strong dependency of runout distance distribution on local topography, which makes many avalanches stop at abscissas corresponding to a significant decrease in the local slope.Nevertheless, a large part of this discrepancy is also caused by observation errors: only runout altitudes are recorded in the French avalanche database, so that runout abscissas are not actually observed and have to be recomputed using the topographic relationship z=f (x).For avalanches that stop on the valley floor, this topographic relationship is obviously poorly defined, so that the true distribution of runout distances is probably less discrete than suggested by the raw observations.

Parameterization
For both cost and utility functions, the depth of the reference flow is necessary.However, it is not modelled with a monovariate POT model and therefore has to be considered as constant from one avalanche to another (see Sect. 5.1 for discussion).For simplicity and to cope for the available information, a mean reference flow h o =1 m was assumed.This implies h d < 1 α =7.15 m for the relationship describing the influence of the dam to be valid.Another solution would have been to compute the flow depth corresponding to each past event from the deposit volumes (e.g.Meunier et al.,

Classical risk for a building situated at a 100-year runout abscissa
Figure 5 shows the risk function obtained for a building abscissa corresponding to a return period of 100 years.It is always negative, which indicates that the construction of a dam always decreases the mean expected loss and therefore contributes an economic benefit.Besides, it is nicely shaped, with a clear optimal dam height of 3.02 m.More precisely, for a dam height of 0 m, the expected benefit of the dam construction is obviously 0, as it corresponds to the reference state.The expected benefit then increases up to around C 55 000 at the optimal height.For higher dams, the economic benefit decreases again, indicating that the additional protective effect no longer compensates the additional construction cost.For high dams, the risk function tends to increase linearly with the dam height according to the cost function chosen.Note that the obtained optimal height may appear very small with regards to the size of the avalanche path.But this height is a direct consequence of the chosen building value and building position.Indeed, a single house with no inhabitants attained by a centennial avalanche only is considered, so that it cannot be economically justified to build a higher dam.

Bayesian risk for a building situated at a 100-year runout abscissa
Figure 5 also shows the corresponding Bayesian risk function.The Bayesian risk function is relatively close to the classical risk function in terms of shape and value.Nevertheless the Bayesian optimal height (3.58 m) is slightly higher than the classical optimal height (3.02 m), with a relative difference of 18.5%.Moreover, the benefit expected from the construction of the optimal dam is higher when the Bayesian computation is used ( C 81 219) than when the classical computation is used (C 55 249).These effects should be attributed to the explicit incorporation of hazard uncertainty into the decisional process.Using the posterior distribution of hazard parameters instead of point estimates adds estimation error to the variability of the natural process.This is especially critical for the extreme events that attain high return period abscissas such as the 100-year return period abscissa and justify the dam construction.It is therefore understandable that an additional protection effort appears as economically advantageous when parameter uncertainty is taken into account for the decision.
It can also be noted that the risk function around the optimum is flatter for the Bayesian risk than for the classical risk, indicating that a large range of dam heights corresponds to very close risk values.This is due to the smoothing effect of averaging over the posterior distribution of the model's parameters.It reflects the poor lever of local information fairly well and should therefore not be seen as a drawback of choosing the Bayesian framework instead of the classical one.Moreover, from a more practical point of view, it can also be argued that different choices with different trade-offs between investment and protection corresponding roughly to a similar economic efficiency are then possible, giving more latitude for a political decision.
Note that poorly informative priors were used for the computation of the Bayesian risk function, so that both risk functions contain the same information and can be compared.For instance, the difference between the two optima is attributable to the lack of local knowledge only, and not to the influence of the priors.For an engineering project, informative priors can be used if available, but then, an additional sensitivity analysis is required.

Sensitivity analysis
As the analytical expressions of both classical and Bayesian risk functions are available, a full sensitivity analysis to the choice of the different numerical values can easily be conducted.In addition to parameter uncertainty, different factors can be investigated: hazard magnitude, hazard frequency, position of the building and costs.Illustrations are provided in this section using mainly Bayesian risks, but the same conclusions hold for classical risks, with always h * B ≥h * C .

Hazard magnitude and position of the buildings
The risk function depends on the combination of hazard magnitude with the distance between the buildings and the dam, i.e., the product ρ× (x b −x d ) for the classical risk function and the sum a ρ +x b −x d for the Bayesian risk function.Any change in hazard magnitude can therefore be compensated by modifying the position of the building in order to obtain the same function.Depending on the distance x b −x d rather than on the abscissas themselves confirms that the local topography is not taken into account in the hazard model.For a given distance x b −x d , the optimal height obviously increases with the hazard magnitude.And for a given hazard magnitude, the optimal dam height decreases and drops to zero when the distance between the building and the dam increases, which indicates that for a building situated very far away from the dam, the defense structure is not efficient at all from a strictly economic point of view.For instance, Fig. 6 shows that the optimal dam height decreases from 5.69 m to 1.19 m when the return period of the considered abscissa increases from 10 to 1000 years (Table 2).The corresponding expected benefit is very high for abscissa corresponding to "small" return periods, e.g., C 782 000 for a building situated at a 10-year return period abscissa, because in this case numerous avalanches that would have destroyed the building without the dam are stopped by the dam before the building (Table 3).But the optimal height is then very poorly defined with a rather constant benefit for 5 m≤h d <7.14 m.On the other hand, for a 1000-year return period abscissa, even if the risk function is negative around the optimal height, the expected benefit is so small (around C 3000 at the optimal dam height) that the principle of a dam construction must be questioned.
Finally, it should be noted that a significant difference between the classical and Bayesian optima exists for all building positions, with always h * B ≥h * C and b * B ≥b * C .Moreover, these differences increase with the return period of the building abscissa, for example from 5% to 250% for the optimal height (Table 2) and from 8.7% to more than 1250% for the expected benefit (Table 3) for building abscissas corresponding to return periods ranging from 10 to 1000 years.Taking estimation error into account therefore affects especially the optimal design of a defense structure protecting buildings threatened only by the most extreme events.This result is quite intuitive given that estimation error particularly affects the evaluation of the highest quantiles of the hazard distribution, making extreme runout distances more probable than if perfect knowledge of the hazard is assumed.

Hazard frequency
The damage term of the risk function is directly proportional to the mean avalanche frequency.This explains that the higher the mean avalanche frequency, the higher the optimal dam height.Moreover, the expected benefit is nearly proportional to the avalanche frequency for small dam heights.For example, the Bayesian optimal height drops to 2.98 m and the corresponding expected benefit is nearly halved if the exceedence rate drops from 0.9 to 0.45 avalanches.year−1 , whereas the optimal dam height increases to 4.03 m and the corresponding expected benefit is nearly doubled if the avalanche rate increases from 0.9 to 1.8 avalanches.year−1 (Fig. 7).

Cost ratio
The effect of costs on the risk function can be studied by considering the ratio between the construction price and the actualized damage cost A×C 1 C o .As one would expect, there is a minimal value of the ratio for the optimal height to exist.Figure 8, for instance, indicates that when the ratio is divided by ten by setting the building value to C 30 000 instead of C 300 000, this minimal ratio is nearly attained, so a dam construction is not advisable.Conversely, for very high values of the ratio, the optimal dam height increases only slowly with the ratio because the dam is already high enough to stop nearly all avalanches before the exposed building.For example, Fig. 8 shows that if the ratio is multiplied by ten, the optimal height is only 0.72 m higher than if the ratio is multiplied by two.Moreover, for such high values of the ratio, the optimal height becomes poorly defined, with the risk function having a shape very close to what is observed in Fig. 6 for small building abscissas.Between the extreme cases of a very small or a very high cost ratio, the optimal height is well defined.

Parameter α
Until now, the α parameter was assumed to be perfectly known.A first option for studying the sensitivity of the Bayesian risk function to the value of α is to replace the point estimate used before by the values corresponding to the upper and lower limits of the confidence interval derived from the analysis of the experimental data.Figure 9 (left) shows that the risk functions obtained are only slightly different.But a slight sensitivity exists, especially around the optimal height, with an optimal design of 3.71 m instead of 3.46 m if the more pessimistic value of α is retained.
Alternatively, it can also be considered that α is a parameter of the model and that the true Bayesian risk function has to be obtained by integrating over its posterior distribution.Hypothesizing independence between α and the parameters of the hazard model, the true Bayesian risk function R B (h d ) is then given by Eq. 24 where p (α |data ) is the posterior distribution of α derived from the analysis of the small-scale experiments.The latter one is Gaussian if a conjugate normal-inverse Gamma model is considered for the linear regression (e.g., Gelman et al., 1995).However, it must be integrated numerically.Figure 9 (right) compares R B (h d ), and R B (h d ), showing no sensitivity to the uncertainty concerning α for the case study.

Topographic dependence
For physical variables such as river discharges, POT models rely on mathematical justifications, with Pickands (1975) proving an asymptotic convergence of any tail of distribution to a POT model where the magnitude follows a generalized Pareto distribution as soon as the threshold is high enough.For snow avalanche runout distances, this theoretical justification does not, however, hold because the distribution of runout distances depends substantially on the slope profile (Meunier and Ancey, 2004;Eckert et al., 2008a).Nevertheless, a type of POT model known as the runout ratio model is well known in the avalanche field and it has been used for more than 20 years by avalanche practitioners.In this model, the exceedences of the so-called Beta point corresponding to the beginning of the runout zone are normalized using topographic characteristics of the path (to compare data from different paths) and then fitted using extreme value distributions (McClung and Lied 1987;McClung, 2000;McClung, 2001;Keylock 2005).The choice of the threshold is not based on theoretical considerations (Coles, 2001).The key point is that the statistical model is then considered an empirical model rather than a true limit distribution.It is applied to very regular paths only, so as to make assumable the assumption that the exceedence probability of a given abscissa depends on the normalized distance with the beta point only.This pragmatic point of view is also adopted in this paper.We use a POT model with a threshold fixed by topographic considerations and an imposed exponential tail, which is assumed to give a realistic representation of the variability of avalanche runout distances on a regular path.The hypothesis of the independence between runout distances and local concavity changes appears in the risk functions obtained, which depend only on the distance between the dam and the building.

Monovariate versus multivariate
Beyond the problem of the topographical dependence, the choice of a POT model for avalanche runout distances can also be severely questioned because it offers only a monovariate vision of avalanche hazard.For instance, the flow depth that is necessary for the computation of the influence of the dam has to be assumed constant from one avalanche to another, which is not very realistic because a significant correlation between runout distances and flow depths may exist for some paths.
A very similar monovariate framework can be constructed by considering snow volumes instead of runout distances and using a POT model for the volumes exceeding a threshold to be specified.The influence of the dam can then be expressed in terms of volume storage for slow avalanches with typical Froude numbers around 1 (Faug, 2004), and the damage to the building can be quantified as a function of the volume of snow exceeding the dam.However, this type of risk model, often used for floods (Parent and Bernier, 2007), does not take into account the distance between the dam and the building, which is obviously not more suitable for a fluid with a complex rheology such as snow.Research is therefore in progress to keep a similar general Bayesian risk framework, but to consider a multivariate statistical-numerical model for avalanche propagation and numerical risk computations rather than simple analytical expressions.suggested (Faug et al., 2008).The relevance of the computations proposed to engineering practices is therefore limited to the case of a vertical avalanche dam impacted by rapid noncohesive flows.
In reality, however, different kinds of avalanches are observed because of the changing nature of the fluid involved (Ancey, 2006) and only dry dense snow avalanches -which are characterized by densities around 300 kg.m −3 , flow paths following the topography, and a low level of cohesion -correspond to the experimental case.Moreover, the engineering practice generally considers different geometries of passive defense structures.This preliminary approach therefore deserves to be further detailed by incorporating the influence of other types of hazards (wet snow avalanches, powder snow avalanches, etc.) on different defense structures (deflective dams, protective mounds, etc.), so as to propose different tools for the various situations that can be encountered in an operational context.Working with a numerical multivariate avalanche model would then be helpful, so as to describe the variability of the relevant quantities.

Global economic value versus reality
For a risk computation on a real case study, the elements at risk are not limited to a single building at a fixed position and the number and nature of the exposed buildings, their furniture, the number of inhabitants and the fraction of time they live inside, etc., have to be counted and evaluated.This task can be achieved using an interdisciplinary approach (Fuchs et al., 2004;Fuchs and Bründl, 2005;Keiler, 2004).A critical point is how to take into account human lives.Mathematical convenience is to follow insurance techniques and to give an economic value to a human life.Alternatively, all the computations can be carried out by considering only human lives and expressing the cost function in terms of probability of being killed, as in the Icelandic legislation for hazard mapping (Arnalds et al., 2004).Since this is not the focus of the paper, this problem was overlooked by considering only a global economic value for a single building situated at a fixed position of the runout zone.Obviously, if several buildings with furniture, cars, etc., are approximatively situated at the same abscissa, the formalism remains identical.This is also true if the choice is made to give an economic value to a human life.If not, however, the cost formulation has to be reconsidered.

Hypothesis for cost modelling
Of even greater concern are the limitations of the proposed cost function that assumes a cost construction that is linear with the dam height, a supposedly unbreakable dam and a damage term represented by a step function.For the construction cost, the model could easily be improved by a careful economic study of different engineering projects, so as N. Eckert et al.: Bayesian optimal design of an avalanche dam to obtain a more realistic representation of the cost increase with the dam height increase.
The hypothesis of an unbreakable dam could also be relaxed with an additional term quantifying the mean annual repair cost.However, with a well-designed dam (a very long structural return period such as 300 years), the mean annual reconstruction cost is small with respect to the mean annual damage to the exposed building, so that it can be neglected in a preliminary approximation.Moreover, the repair cost can be simply included in the construction cost C o with the definition of an amortizing period and a computation of its total actualization, as is done in Sect.2.2 for the damage to the building.
For the damage cost, modelling improvements are much less straightforward.The damage inflected by a snow avalanche to a building is known to depend on impact pressure, flow depth, variation of the pressure with time, etc.But the relation between hazard magnitude and damage intensity is still unclear (Keylock and Barbolini, 2002;Berthet-Rambaud, 2004).In addition, the impact pressure itself remains hard to quantify (Sovilla et al., 2008), so that empirical velocity-dependant damage formulations are generally considered (Jonasson et al., 1999;Barbolini et al., 2004a).Our step function, obviously a very rough approximation, can therefore be justified by the current lack of knowledge.However, this preliminary approach has a direct interpretation in terms of maximal loss (total destruction of the building), and is therefore well suited for the quantification of the maximal expected benefit of the dam construction.Moreover, it can be amended using the more complex damage formulations proposed in the literature and involving other variables such as velocity or pressure.This will be done in association with the multivariate hazard model and the numerical computations of the risk functions mentioned earlier.

Conclusion and relevance for practical applications
In this paper, a general Bayesian framework for optimal design of an avalanche dam was proposed, with particular attention given to the problem of handling the uncertainty stemming from the lack of local information from inference to decision.The other major difference with previous risk computations in the avalanche field is the explicit incorporation of a passive defense structure in the modeling framework and its optimization with regards to the full variability of the damageable phenomenon.Such an approach can be contested if a specific protection against very frequent or extremely rare events is searched.However, this is a general question in decision theory (Berger, 1985).Moreover, it can be argued that the choice of a defense structure that minimizes the mean expected loss instead of the loss associated with a given scenario (e.g.centennial) corresponds to a rational behaviour for a decision maker facing risk.
Strong simplifying assumptions discussed in details in Section 5 have been introduced.They concern the hazard model, the model for dam influence and the cost quantification.As a consequence, a rough evaluation of the optimal height and of the expected benefit of the dam construction is obtained.On the other hand, theses assumptions allow obtaining a simple decisional model that proposes an analytical expression of the Bayesian risk function.
As it is shown with the case study, this decisional model highlights the main effects in this type of engineering example, for instance the more cautious design value that should be recommended when parameter uncertainty is taken into account and the maximal benefit that can then be expected from the dam construction.Moreover, a sensitivity analysis for different factors, e.g.avalanche magnitude, avalanche frequency, cost ratios and dissipation power of the dam, can be performed at very low computational costs.It for example shows the increase of the optimal dam height with the value of the elements at risk.The low effective optimal dam height obtained for a building situated at a centennial abscissa has to be attributed to the chosen economic value of the exposed building.
For a real case study, this decisional model can therefore be used as a first approximation to compute an optimal dam height and to perform a sensitivity analysis at no computational cost.However, it has evident limitations.For instance, it can be used only for very regular paths because runout distance distribution depends upon the slope's profile.Moreover, given that avalanche magnitude is limited to runout distance of dense snow avalanches, it is difficult to propose easy analytical improvements of both dam influence and cost quantification.
This implies that our decisional model is rather relevant for the theoretical background it offers than for its operational potential.For a similar optimal design procedure giving a more realistic representation of the avalanche flow and its interaction with defense structures and elements at risk, the most limitative assumptions have to be relaxed in order to find a better compromise between physical realism and computation times.A multivariate numerical model of avalanche hazard needs therefore to be incorporated into the stochastic framework, which will be done in a shortcoming paper (Eckert et al., 2008b
ρ , b ρ and a λ , b λ combining the prior knowledge and the information conveyed by Nat.Hazards Earth Syst.Sci., 8, 1067-1081, 2008 www.nat-hazards-earth-syst-sci.net/8/1067/2008/N. Eckert et al.: Bayesian optimal design of an avalanche dam 1071 the data.More precisely, with a data set of n avalanches exceeding the threshold x d in m years and S(n) the sum of these exceedences, a λ =a λ +m, b λ =b λ +n, a ρ =a ρ +S(n) and b ρ =b ρ +n.

Fig. 3 .
Fig. 3. Frequency model.Data versus model given λ= illustrate the posterior Gamma distributions of model parameters as well as a comparison between the data and the model.The posterior distributions of both parameters are nicely shaped, with a variance much lower than for the prior distributions, which reflects the amount of information conveyed by the data.Bayesian estimators of the model's parameters equal the posterior means under the assumption of a quadratic loss function, i.e., E a λ ,b λ[λ]

Table 1 .
Main characteristics of the case study.
2004).It is situated in the township of Bessans, in the Savoie department.It is 1763 m long from its top to the Arc River, with a vertical drop of 1175 m (Fig.2).It is only very slightly channeled and the average slope is steep (Table

Table 2 .
Classical and Bayesian optimal heights for buildings situated at abscissas corresponding to different return periods.

Table 3 .
Expected benefit of the optimal dam construction for buildings situated at abscissas corresponding to different return periods, classical and Bayesian computations. ).