Prioritization of hydroelectric power plant earth dam safety procedures: a multi-criteria approach

The number of procedures focused on dam safety is very large, mainly due to the rules established by different regulatory bodies, the guidelines that are part of the recommended best practices for engineering works, and the common sense and conservatism present in dam operation and maintenance because of the large socioeconomic and environmental impacts that any incident with a dam can cause. In practice, the vulnerability of a dam is inversely proportional to the improvement of safety procedures, such as monitoring and sensing, and the staff’s capacity to interpret the information in timely fashion. Therefore, establishing priorities for these procedures is essential for the plant management to define the scheduling and detailing of inspections and monitoring, as well as training needs. The MCDA model described here was specified based on regulations and practical public domain guidelines. The subjective estimation of preferences was done by the staff of a hydroelectric plant located in central Brazil. It employed the Simos method combined with a procedure adopted to convert the scores to the format of paired comparisons. The weights for dam safety procedures were obtained using the fuzzy AHP method. The method allowed obtaining the classification of safety procedures according to their priorities, and thus provided the plant management with elements to better schedule monitoring and staff training.


Introduction
Vulnerability and reliability are antagonistic concepts. The former is a more wide-ranging concept, with much broader implications. While reliability focuses on the possibility of maintaining the performance of infrastructure elements, vulnerability focuses on the potential for disrupting these elements or degrading them to a point where performance is diminished. Vulnerable does not necessarily mean unreliable, nor does unreliable necessarily mean vulnerable. Reliability is a probabilistic measure of elements in an infrastructure system and their ability not to fail or malfunction, given a series of established benchmarks or performance guidelines (Murray and Grubesic 2007), while vulnerability is a fragility or defect in the design, operation and/or management, making the infrastructure subject to failure or stoppage when exposed to a hazard or threat (Zio 2016).
Dams are key assets in terms of critical infrastructure (Murray and Grubesic 2007). The extent and severity of a cascading effect depends on how tightly coupled and vulnerable the infrastructure systems are (Little 2002). In eventdriven risk models, the probability of occurrence of events or hazards of a certain level are inputs triggering the probability of poor performance or vulnerability, which results in the probability of a set of likely consequences. Depending on the adverse effect of the event on the facility's performance, the consequence can be dam failure (Baecher 2016). The assessment of the physical vulnerability of elements at risk as part of the risk analysis is an essential aspect for the development of strategies and structural measures for risk reduction. Understanding, analyzing, and where possible quantifying physical vulnerability is a prerequisite for designing strategies and adopting tools for this reduction (Papathoma-Köhle 2016). A dam fails due to a severe event that can result from heavy rainfall, earthquakes, strong winds, snow and ice, volcanic action, landslides, tsunamis, and wildfires. All of these events can cause some degree of risk to dams and related infrastructure. To these natural hazards, one can add terrorist acts, design defects, excessively long service lives, aging materials, and unsatisfactory maintenance (Little 2002). When any of these events occurs, the extent of the dam's vulnerability determines whether or not it remains intact. One or a combination of the following vulnerabilities may cause its failure: (a) inadequate design caused by the inability to predict extreme environmental events or insufficient site assessment; (b) design flaws; (c) faults or poor engineering practices and inadequate site supervision during construction and filling of the reservoir; and (d) deficient surveillance, monitoring, and maintenance (Donnelly and Acharya 2020). With respect to the last item, a significant probability of failure is due to human factors, including maintenance, inattention to regular testing, faulty communication during an emergency, or incorrect action at the moment before the occurrence. This involves both cognitive and physical responses that, depending on the event sequence, can have results ranging from minor loss to catastrophic failure (Baecher 2016). Most failed dams either did not have any monitoring system or had a system that was out of order (ICOLD 1995). The most usual safety indicators can be classified into three categories: mechanical effects, such as deformation and displacement; hydraulic effects, such as seepage and pore water pressure; and environmental effects, such as high reservoir water levels, precipitation, and temperature (Santillán et al. 2013). Among these indicators, the monitoring of pore water pressure is essential to assure dam geotechnical stability because it detects the internal erosion and seepage problems (Pan and Dias 2016;Pagano et al. 2010), although the materials used in the internal structure of dams are arranged in zones to enhance the potential filtering capability to arrest piping if it starts (Koelewijn and Bridle 2017). The prudent maintenance practice uses all possible means to better understand dam performance, making inspection and monitoring methods more efficient. The actions developed and followed are: detailed monitoring and inspection through instrumentation, reading and interpretation of data; detailed emergency action plans, classified by type of hazard, containing stepby-step actions to be carried out by the people in charge; periodic reviews of the dam's status and evolutionary evaluation of indicators; detailed investigation of the indicators that reveal risk of failure; and preparation of a remediation plan and rehabilitation procedure (Adamo et al. 2017). The regulatory provisions on dam inspection and monitoring are consolidated (ICOLD 2015) and evaluation of dam inspection and monitoring is commonly found in the academic literature (Seyed-Kolbadi et al. 2020;Li et al. 2020;ASCE 2018;Mizuno and Hirose 2009;Lewin et al. 2003). In the case of risk assessment, safety and vulnerability of dams, several studies have been published. Andersen et al. (1999) proposed a multistep approach for the ranking of maintenance and repair actions and monitoring of embankment dams, where the most important action in terms of dam safety in the worst condition was preferred. Curt et al. (2008) adopted a possibility theory-based approach to validate different uncertain pieces of information based on sensory evaluations and global judgments. Curt and Talon (2013) suggested a method based on identification and assessment of criteria for the various sources of imperfection through visual observations, monitoring, calculation, and construction measurement. Then the ELECTRE TRI method was used to aggregate the values resulting from the assessment of the criteria. Vojteková and Vojtek (2020) applied a technique involving multi-criteria decision analysis (MCDA) and a geographic information system (GIS) to identify and analyze landslide susceptibility at a local spatial scale. Larrauri and Lall (2020) obtained dam hazard ranking through AHP in a model focused primarily on identification of methods for the rapid quantification of the trigger probability of dam failure, and identification of the critical infrastructure that would be impacted if the dam fails. The fuzzy analytic hierarchy process (FAHP) has also been used in risk assessment (Arce et al. 2015;Govindan et al. 2015;Zou et al. 2013;Chan and Wang 2013;Arikana et al. 2013;Li et al. 2013;Avdi et al. 2013;Zeng et al. 2007). Masoumi et al. (2018) adopted an integrated decision model based on the fuzzy hierarchy process (FAHP) and fuzzy technique for order of preference by similarity to ideal solution (FTOPSIS) to evaluate nine criteria and 42 alternative geotechnical instruments for monitoring and sensing of a clay core embankment dam. Jing et al. (2018) proposed a method for risk assessment of small reservoirs without monitoring equipment and verified the applicability and effectiveness of this method in two engineering cases. Yucesan and Kahraman (2019) adopted a Pythagorean fuzzy analytical hierarchy process (PFAHP) using linguistic expressions to calculate the weights of 20 hazards in the operation of hydroelectric power plants. Ribas and Pérez-Díaz (2019) used fuzzy approximate reasoning for dam safety risk assessment with FAHP to rank the indicators in a two-stage risk assessment process. Wijitkosum and Sriburi (2019) described four main factors influencing drought: climate, physical factors, soil and land utilization factors, each containing ten sub-criteria to identify severity levels and specific issues. Since each hydroelectric plant has its own characteristics and the number of procedures and records to support mitigating vulnerability is large, the proposed method establishes a priority order for the operation, inspection, sensing and maintenance procedures related to risk mitigation, aiming at supporting the planning of the instrumented health monitoring of an earth dam as well as better scheduling of training activities. This paper is organized into five sections including this introduction. The materials and methods section presents the main characteristics of the FAHP and the Simos technique. It also describes the three methodological phases -specification, scoring and weighting. The case study section describes the earth dam to which we performed the proposed method. The results and discussion section defines the monitoring procedures and their degrees of importance as estimated by the experts. The paper concludes by summarizing the main points and the practical consequences of the results.

Fuzzy analytic hierarchy process
The Analytic Hierarchy Process (AHP) is a method that organizes a list of criteria in order of priority. The procedure uses pairwise comparisons, whose order of importance refers to an ordinal scale and depends on the subjective judgment of an expert. The expert is asked to estimate by how much one criterion dominates another with respect to a given attribute (Saaty 2008).
AHP is a method that measures intangibles in relative terms, so when the expert tries to subjectively assess the relative importance between two criteria, he or she is conditioned to bounded rationality and heuristics (Hilbert 2012). The first situation occurs because the brain's ability to process information is biologically limited, and the second occurs because the specialist tries to use shortcuts in the judgment to reduce the cognitive effort. This anomaly inherent in the subjective estimation procedure results in comparisons that incorporate biases and errors. To incorporate imprecision in the process of comparing criteria, a viable alternative is the fuzzification of scores using the FAHP. The technique takes the treatment of inaccuracy into account through a measure that represents the degree of fuzziness (δ). This metric is adopted to determine the α-cuts, boundaries of a fuzzy set characterized by a membership function, which are assigned to each pairwise comparison. This concept allows a given evaluation to have a clear numerical representation of something vague and imprecise, characteristic of the natural language used in the decision-making process (Klir and Yuan 1995).
The first solution for the FAHP method was proposed by Van Laarhoven and Pedrycz (1983), in which the fuzzified weights result from the normalized estimated values of a logarithmic regression. Buckley (1985) proposed a simpler approach, in which the criteria weights are equal to the relative means of the geometric means calculated along the columns of the fuzzy pairwise comparison matrix. Mikhailov (2000Mikhailov ( , 2002Mikhailov ( , 2003 proposed a solution of a linear programming problem which maximizes the consistency index or degree of satisfaction restricted to a set of inequalities based on the α-cuts and a certain degree of tolerance. The FAHP solution proposed by Chang (1996) is a synthesizing method whose algorithm resolves hierarchy problems associated with fuzzy logic (Zhu et al. 1999), which has proven to be practical and transparent (Kahraman et al. 2003). However, the method has some practical problems. One occurs whenever zero is used as divisor or data are out of range (Zhu et al. 1999). Such weakness is solved by altering the fuzzified values to 1, 9 or 1/9, depending on the case. In addition, the extent analysis method may assign a zero weight to one or more dominated criteria, causing the criterion/ criteria to be disregarded in the decision process (Wang et al. 2008). This is solved by assigning high values to δ . Finally, it is difficult to meet the consistency requirement in pairwise comparison, which gets worse when the number of criteria is large. Ribas and da Silva (2015) proposed the adoption of the Simos method (Figueira and Roy 2002;Pictet and Bollinger 2005), which significantly reduces the risk of inconsistency during the comparison process and also decreases the effort of subjectively assigning the scores (Li et al. 2013). The Simos elicitation method is used to obtain the relative comparison scores of the degrees of importance between criteria. An expert receives a certain number "n" of identified cards and three times "n" of blank cards. The expert is initially invited to sort the identified cards in descending order of importance. He/she is then asked to insert blank cards among the identified cards, in which the number defines the degree of importance. The identified card positions divided by the total number of cards results in a normalized score. These scores are then converted to the Saaty scale using an eight plus one base scale.

Specification phase
The flowchart of Fig. 1 depicts the progress in three phases of the FAHP method: specification, scoring and weighting. The surveillance, instrumentation, monitoring, and data acquisition of the dam involve periodic readings and systematic analysis of the installed geotechnical instrumentation, which degree of detail and frequency of inspections depend on the age, size and location of the dam. In addition, the applicable regulations determine the elaboration of contingency plans for different hazard scenarios, such as operational actions in emergency situations, instructions, communication, and evacuation routes for those affected downstream. Each criterion is detailed for structural elements, types of measurement instruments, specific procedures for each hazard scenario and maintenance routines, as appropriate, and the sub-criteria are analyzed and compared with each other to avoid redundancies. Acronyms are assigned to the criteria and sub-criteria to facilitate identification in the FAHP model. For instance, the criterion "maintenance records" is codified by the acronym MAN and one of its sub-criteria, the "updated maintenance logbook", is codified by the acronym MAN.LOG.

Scoring phase
According to the Simos elicitation method, the expert is provided with the letters identified with the criterion acronyms and several blank letters. The letters containing the criterion identifications are lined up by the specialist in decreasing order of importance. When two criteria are judged to be of equal importance, the cards are placed side by side. Then the expert is asked to insert one, two or three blank cards between the identified cards, for comparisons as being "a little more important", "more important" or "much more important", respectively. Each criterion card has a value corresponding to its position in ascending order. If two or more criteria are tied, they will have the same value corresponding to their average position. Although the blank card occupies a position, no score is assigned to it since it is not a criterion. The Simos weights are the relative position values in percentage. Instead of performing the normalization on the 100 bases, as proposed by the Simos method, or using the perception of difference between the two criteria for the extremes of preference, according to the revised Simos method, we adopted the base scale eight plus one. The advantage of this approach is that the resulting matrix is transitive (Ribas and da Silva 2015). The result must be rounded to the nearest integer and inverted so the criteria scores are then converted to the equivalent Saaty scale. The matrix of paired comparisons contains the distances among the combination of pairs of Saaty scores. For example, if the Saaty scores for two criteria "a" and "b" are calculated as 4 and 8, respectively, the importance score of "b" over "a" will be their distance 1 + (8-4), equal to 5, while the importance score of "a" over "b" will be the inverse, 1/5. These steps from the Simos elicitation method to the Saaty paired comparison matrix must be repeated for all the subcriteria subordinated to each criterion, so that the result is a matrix of paired comparisons between criteria and several matrices of paired comparisons between sub-criteria, related to each criterion.

Weighting phase
The degree of fuzziness (δ) is set subjectively for the expert based on the extent of his/her expertise on the topic of analysis (Espino et al. 2014;Keprate and Ratnayake 2016). The purpose of δ is to compensate for the lack of precision of the specialist when making comparisons between the criteria by establishing an α-cut for a triangular membership function (TMF). The δ value is 1.0 when the expert has participated in similar projects and has demonstrated high involvement during the elicitation phase. The value of δ is 2.0 when either one of these two requirements is met and, is equal to 3.0 otherwise. A fuzzy number M ij described by a TMF assumes values in the interval {M ij | 1/9 ≤ M ij ≤ 9} and is represented by the lower (l ij = m ij-δ; ), modal (m ij ), and upper values (u ij= m ij + δ ). The fuzzy synthetic extent (S i ) for each M ij is determined, noting that each M ij is a TMF, so that S i is a triplet containing lower, modal, and upper values. When comparing two convex fuzzy numbers S 1 and S 2 , the degree of possibility must be a value between 0 and 1, determined through the min operator (Chang 1996). The weight vector is obtained by normalizing the degree of possibility vector. Then, the normalized weights calculated for the criteria and the sub-criteria are presented to the expert, who will judge whether the results are consistent with his/her expectations. If not, the scoring phase should be reevaluated. Finally, the importance degree results from multiplying the weights of the criteria, the weights of the corresponding sub-criteria and 100.

Case study
The Corumbá IV hydropower plant is located on the upper reach of the Corumbá River, at the geographical coordinates 16º19′22''S and 48º11′15''W, in Goiás state, Midwest Brazil (Fig. 2). The Corumbá River is a tributary on the right bank of the Paranaíba River, and the Corumba IV reservoir is part of the reservoir system of the Paraná River's hydrographic basin. The reservoir has approximately 173 km 2 of flooded area, a total maximum volume of about 3.7 × 10 9 m 3 (3.7 trillion liters) and a useful volume of 0.8 × 10 9 m 3 (800 billion liters). The filling of the reservoir began at the start of 2005 and the first generator went into operation about 11 months later. Its predominant shape is elongated, without excessive arms with relatively large depth. Its average depth is about 21 m. The earth dam was built on the Corumbá riverbed, with a predominant soil classified as Dystroferric Hapli Cambisol, having an approximate granulometric composition of 60% sand, 30% clay and 10% silt. Therefore, the dam is composed basically of sand and clay because of use of the construction materials found in the vicinity of the project. The completed dam is 10 m wide at the crest, 1,290 m long and has maximum height of 76 m in the stretch of the river channel. The earth dam core is built of clay soil, being impermeable and protected by other soils and externally by altered rock soils, which are more resistant. The powerhouse was built next to the left abutment of the dam and dimensioned to contain two sets of hydro-generators and their auxiliary equipment. The total installed power is 127 MW, divided into two generator sets of 63.5 MW each. The energy generated by this project serves up to two million people per month, guaranteeing energy for the Federal District and surrounding region. The turbines are of the vertical axis Francis type, with armored spiral box and elbow suction tube, suitable for direct drive of three-phase alternating current generators. The spillway, on a free runway threshold, was designed for a load of two meters and has a capacity of 1,550 m 3 per second, with a total length of 425 m. It is a surface spillway with a dissipation basin. The water empties into a concrete structure, with free edge, that is, without gates, descending through an elongated "S" shaped structure that launches the water, called ski jump. The adduction circuit consists of a tower water intake, with seven openings protected by grids, through which water is captured and taken to the intake well, which was excavated in rock and covered with reinforced concrete. After descending through the intake well, the water reaches the adduction tunnel with a length of 394 m, also excavated in rock and covered in reinforced concrete, the same tunnel that was used to divert the river during the construction phase. The final stretch of the tunnel, close to the powerhouse, metallic armor in addition to the concrete lining.

Specification phase
The vulnerability of a plant must be mitigated by means of methods, processes, instruments, and practices that are ideally able to predict and face situations of imminent danger. These elements were identified and classified according to the scope of use based on Brazilian dam safety legislation (Brasil 2010), the technical guidelines of good engineering practices recommended for public and private generation concessionaires (Eletrobras 2003) and the general guidelines for companies, aiming to ensure adequate safety conditions for dams, from construction to decommissioning (ANA 2016). Nine elements identified within their respective scopes were used as criteria in the MCDA model. The subdivision of the sub-criteria depends on the documents, processes, practices, or instruments as they were classified in the criteria. Documentation (DOC): These records must meet dam safety criteria from preliminary and feasibility studies to the final project as constructed. In this item, we analyzed the available as-built designs, construction and commissioning documentation, project description and specifications, hydrological studies, geological and geotechnical studies, seismological studies, foundation studies, spillway design and water intake design. The sub-criteria are Preconstruction engineering and design (DOC.ENG); Hydrology investigations (DOC.HYD); Geotechnical investigations (DOC. GEO); Sub-surface explorations and foundation investigations (DOC.FOU); Service spillway design (DOC.SPI); and Water intake design (DOC.WIN).
Inspections (INS): Dam safety inspections are divided into regular and special inspections, the first being carried out periodically, with frequency determined according to the risk category and potential damage, aiming at assessing and detecting the existence of anomalies. Regarding the regular safety inspection, the situation and level of danger related to regular inspections evaluates the upstream slope, downstream slope, right and left abutments, crest, spillway, water intake, reservoir, instrumentation, ducts and shielding, turbines, alternators, substation, and powerhouse. Regarding the special safety inspection, it will be prepared as instructed by a multidisciplinary team of specialists, depending on the risk category and the potential damage associated with the dam, in the construction, operation and deactivation, and must consider changes in conditions upstream and downstream of the dam. Operation (OPE): it describes the procedures for the operation of the water intake, spillway, and sluice way, to allow satisfactory operation of the dam, in addition to keeping it in safe conditions and monitoring its behavior to detect any anomalies in a timely manner. In this part, the existence of procedures to be adopted in the operation of the reservoir is verified. The sub-criteria are: reservoir levels, affluent and effluent water flows (OPE.RES); Service spillway operating records (OPE.SPI); Detailed information concerning seepage control (OPE.SEC); Bottom outlet operating records (OPE.BOT); Water intake operating records (OPE.WIN); Reservoir water quality management (OPE.QUA); Operating procedure for extreme flood events (OPE.EXT); Operating instruction in the event of general flood gate failure (OPE. GAT); and Operating procedure in the event of loss of communication (OPE.COM).
Maintenance (MAN): maintaining structures and equipment in good condition is intended to ensure that the dam is kept in fully operational and safe condition. For this purpose, the equipment must be inspected and checked at regular intervals, as part of a maintenance program appropriate to the type of equipment, age, and intensity of use. Maintenance records of current actions involving the bus, spillway, instruments, and gates are checked. The sub-criteria are Updated maintenance logbook (MAN.LOG); Drainage system maintenance procedures (MAN.DRA); Spillway gates and chute maintenance procedures (MAN.SPI); Safety instrument maintenance procedures (MAN.ITM); Water intake maintenance procedures (MAN.WIN); and Reduction of the erosive process and siltation (MAN.ERO).
Monitoring and Instrumentation (MON): it includes the instrumentation of the body of the dam, the spillway structures, and the foundations. This criterion investigates the monitoring of the following factors (some related to instrumentation): neutral pressures at the landfill, landfill settlements, surface displacements, and seepage, among others. The dam instrumentation design must be elaborated from the feasibility study and basic design phases of the hydroelectric plant. It should contain the location of the instrumentation, along with the type and quantity of devices to be used. Instrumentation is an objective tool to monitor dams, being of fundamental importance in the safety procedures adopted. The most common instruments in earth dams and their respective functions are: topographic frame of reference for monitoring vertical and horizontal displacements; settlement sensors for measuring total and differential settlements and movement of materials; inclinometers for measuring displacements inside embankment dams or foundations; piezometers for measuring water pressures inside the dam body or at the foundation; total pressure cells in the landfill, to measure the total pressure in the landfill; flow meters for measuring the piping through the body of the dam and its foundation; water level gage; and weather stations for measuring reservoir air and water temperatures and precipitation. The number of auscultation instruments to be installed in a dam depends on its height and length, geological formation of the soil and the materials used in the body of the dam. The frequency of readings should be adjusted depending on the occurrence of critical geotechnical or geological conditions, changes in construction procedures, rapid rises or falls of the reservoir level, and severe natural phenomena. Regular Revision and Updating (REV): the Brazilian Dam Safety Act (Brasil 2010) states that, based on the dam risk classification, a regular dam safety review must be carried out to verify the general state of the dam, considering the current state of the art for the design criteria, the updating of the hydrological data and changes in conditions upstream and downstream. Thus, an extensive review of the technical documentation is carried out, comprising hydrological, geological, geotechnical, and seismological studies. The electric energy regulator audits the records related to the performance of the foundation, reservoir, spillway structure, earthen dam, operation and maintenance procedures, instrumentation, and monitoring. The outcome of the audit is the reassessment of the risk category and the associated potential damage. This criterion assesses whether the information available is sufficient to meet the requirements established by the auditors. Emergency (EME): this criterion is based on the principle that the priority will be to save human lives. It must have an organized command line for emergency situations, with agile and standardized alert and communication procedures and a plan to resume operational capacity once the hazard has been controlled. The procedures must be specific to an external threat (invasion for example); fire; dam damage; inundation and leakage of chemical waste. Each threat must be determined according to the sequence of steps for device startups and shutdowns and plant evacuation. The sub-criteria are Disaster committee (EME.DIS); Emergency communication (EME.COM); Assignment of responsibilities (EME. REP); Mass care (EME.MAS); Animal care (EME.ANI); and Recovery (EME.REC). Evacuation (EVA): the population affected by the dam must be identified to enable implementing an instruction plan and escape routes, aiming to minimize the damage and risks that may occur in a hypothetical breach. Therefore, in this criterion, a survey is performed to detect the existence or absence of programs for training the population and determining the escape routes: Instruction Plan, Escape Routes and Meeting Points, Self-Rescue Zone. The sub-criteria are Jurisdiction (EVA.JUR); Administration and logistics (EVA. ADM); Flash flood alarms (EVA.ALA); Escape routes and emergency exits (EVA.ROU); Mass care facilities (EVA. MAS); and Supplies of food, water, sanitation materials, clothing, bedding and first aid items (EVA.SUP).

Scoring and weighting phases
To illustrate the scoring phase, we demonstrate the steps that were followed with the general manager (GM). Nine letters containing the identification of the criteria and several blank letters were handed to the interviewee. He was asked to rank the cards serially in order of importance, with two or more cards in parallel meaning a tie for that position. The interviewee thought that the order of importance was headed by INS and MON, second MAN, third REV and DOC, fourth OPE, and fifth PRE, EVA and EME. The degrees of importance between criteria were all judged to be "a little more important". Table 1 shows the steps of the Simos method used to obtain the criterion weights from the initial ordering, which are the criterion ranking, the number of criteria of each position, the position order, the average position, and the weights resulting from the average position divided by the sum of positions. The same table shows the scores according to the Saaty scale converted from the weights obtained by the Simos method (Ribas and Silva 2015). In this case, a change was made to the values for base 8 plus 1 for subsequent inversion. Table 2 shows the matrix of paired comparisons, which together with fuzzification degree equal to 3.0 constitute the input data of the FAHP method. The resulting weights for the criteria can be seen in the last column. The degree of fuzzification of this magnitude suggests that the experts' inaccuracy in estimating preference levels is relatively high. For example, the degree of preference of INS in relation to MAN is obtained by subtracting the two scores plus one, so the difference between the two scores (8-7) + 1 equals 2, representing slight preference for INS.
The Simos method was also used in the comparisons between the sub-criteria for each of the nine criteria. We adopted a variant of the AHP method to determine the degrees of importance, that is, instead of making crosscomparisons, we compared each set of sub-criteria within each criterion. The reasons is that we were not establishing a ranking of the alternatives, but rather trying to classify the safety methods and procedures necessary to ensure the reduction of the dam's vulnerability to the risk of incidents of any nature. To exemplify, we now demonstrate the results obtained in the interview with the GM for estimation of the weights of the safety procedures adopted in the scope of maintenance. As can be seen in Table 3, the GM estimated that, in terms of dam safety, Updated maintenance logbook (MAN.LOG); Drainage system maintenance procedures (MAN.DRA) and Reduction of the erosive process and siltation (MAN.ERO) are more important than Spillway gates and chute maintenance procedures (MAN.SPI); Security instruments maintenance procedures (MAN.ITM); and Water intake maintenance procedures (MAN.WIN). The last column shows the scores according to the Saaty scale converted from the weights obtained by the Simos method. Table 4 is assembled in the same way as Table 2. The last column shows that the weights for three of the sub-criteria are identical and much higher than the weights of the other three. This result stems from the GM's preferences, as shown in Table 3.
The procedure exemplified for the MAN criterion was performed for the others. Then, the weights obtained for the criteria according to Table 2 were multiplied by the weights obtained for the sub-criteria and by 100. The results of the GM's ranking can be seen in Table 5, in which the degrees of importance for the methods and procedures related to mitigation of the dam's vulnerability are in the range of 0.39 to 5.75, with an average of 1.42 and a standard deviation of 2.59. The degrees of Table 5 according to the GM as well as other experts were classified in four classes, where C.1 denotes the "essential" methods and procedures; C.2 those of "high importance"; C.3 those of "medium importance"; and C4 the "least important". The classifications were obtained through the quartiles calculated from the degrees of importance of each expert. The cutoff values according to the GM, for example, are 1.39, 2.36 and 3.73, for C.4, C.3, C.2 and C.1, respectively.
To obtain a single aggregated classification, it is essential to reject all hypotheses of significant difference between the estimates among the five experts: general manager (GM), electric engineer (EE), mechanical engineer (ME), civil engineer (CE), and consultant (CO). For this purpose, Spearman correlation coefficients are calculated by comparing the results between pairs of specialists. As can be seen in Table 6, the estimates of the sub-criterion positions among them have no significant differences, with p values close to zero in all cases. Such statistics confirm the inexistence of significant differences among the experts, allowing us to use the aggregated values, summarizing them in a single estimate for the entire group. Table 7 shows the importance classes estimated by the five specialists and the aggregate estimate. Most of the sub-criteria deemed essential are related to the inspection procedures of critical parts of the dam and the reliability of such instruments. Internal erosion with increased pore pressure and saturation of the dam and foundation causes loss of resistance, which explains the relevance of regular  and the operating procedures for the affluent and effluent water flows (OPE.RES). Therefore, when the experts expressed their preferences regarding the methods and procedures to mitigate the dam's vulnerability, they emphasized the actions of inspecting parts of the dam and in reacting to extreme and unexpected events. The emphasis given to procedures related to instrumentation and monitoring can be explained by their preventive characteristic. The regulatory agency responsible for hydroelectric power plants in Brazil carries out periodic inspections and requires the submission of detailed reports on inspection by a set of instruments, such as the surface landmarks used to determine horizontal and vertical displacements through periodic topographic surveys; inclinometers used to measure horizontal movements to control the stability of slopes; piezometers, used to determine pore water pressures in earth or rock masses; and gages showing variability of water levels and flow. Thus, the plant's staff is concerned with the geotechnical monitoring of the stability of the ground plant, therefore reducing the vulnerability of the dam, and with the compliance rules and regulations determined by the regulatory agency. In this scenario, the main dam hazard indicator is measured by inspection. But ensuring monitoring is an ongoing process, especially considering the application of the Dam Safety Law (Brasil 2010) and the concern about the absence of documents containing geotechnical records. The documentation and procedures related to inspection, operation and preparedness reduce the vulnerability of earth dams.

Consistency of responses
Inconsistency occurs when ordinal scales are allocated to subjective preferences of the experts. Thus, it is necessary to test what is acceptable. The consistency ratio (CR) compares the consistency index (CI) of the matrix of pairwise comparisons against the consistency index of a random-like matrix (RI). The consistency index for criterion weights is calculated as shown in Eq. (1): where λ max is the eigenvalue and n is the number of criteria. The consistency ratio in Eq.
(2) is: The denominator RI is the random index table value according to the number of criteria (Saaty and Vargas 2012). The value for a criterion to be judged as consistent must be CR ≤ 0.1 (Saaty 1990). For nine criteria, the RI value is 1.45. We tested the consistency of the experts' pairwise (1) C.I. = max .(n − 1) n (2) C.R. = C.I. R.I. comparisons for them. Table 8 shows that all the participants had CR values lower than 0.1.

Conclusion
Although we interviewed each member of the plant's staff separately, we were unable to control whether there was any communication between them outside the interview room, so we cannot guarantee there was no suggestion between them regarding the ordering of preferences, possibly introducing bias. Another limitation stems from the tendency that managers may avoid any choice or comment that might suggest a structural problem or operational difficulty with the plant. A process should be followed to allow for minimal bias. Therefore, considering the high degree of education of the respondents, the conduction of the Simos technique followed a straightforward line of reasoning.
To summarize, the Simos and FAHP techniques were used in the proposed method to allow a group of experts to assign weights to the criteria and sub-criteria representing the relative importance of a set of operational procedures and safety practices, with the objective of ensuring the availability of the most relevant and updated monitoring and sensing processes to mitigate the dam's vulnerability, often caused by inadequate assessment of its structural conditions. While the Brazilian legislation on dam safety and the technical guidelines are available to assist in specifying the MCDA model, the Simos method to estimate preferences proved to be easier, faster, and more flexible compared with the traditional paired comparison method. Moreover, since it is a ranking procedure, the conversion to the Saaty matrix made it possible to satisfy the transitivity requirement. Regarding the multi-criteria method, the fuzzification of the scores attenuated the inaccuracy of the responses, characteristic of the use of subjective numerical scales. The proposed method exploits the experience and opinion of the experts, since they are required to focus on the problem, explain and validate their estimation, and during the same process, weight the degree of importance of each relevant safety procedure. Because they were required to compare the criteria and sub-criteria, they are more likely to consider the priorities of the security procedures as proposed by the model and thus determine requirements, such as training, accessibility, and specific timelines, for updating and detailing. This case study identified that procedures for inspections and instrumentation readings; recording and dissemination of results; identification of the recipients of information; emergency alerts of extreme flood events; procedures for corrective and emergency actions; preparedness in each situation; and operational and maintenance training courses should be priorities of dam safety management. The absence of any of these elements makes it hard to monitor the activity itself, make decisions, and carry out preventive or corrective actions to reduce earth dam vulnerability.