Propagation Network of Tailings Dam Failure Risk: An Empirical Research and The Identication of Key Hazard Node

The tailings dam system is complex, and the dam structure changes continuously over time, which makes it dicult to identify hazards and analyze the causes of failure accidents. This paper uses hazards to represent the nodes, and the relationship between hazards to represent the edges. Based on the complex network theory, the propagation network of tailings dam failure risk is constructed. The traditional identication methods usually focus on one aspect of the information of the network, while it cannot take into account to absorb the advantages of different methods, resulting in the lack of information, which will lead to a certain difference between identied key hazards and real key hazards. In order to solve this problem, by absorbing the advantages of different methods under different hazard remediation (deleted) ratios, combined with the characteristics of multi-stage propagation of tailings dam failure risk, this paper proposes a multi-stage collaborative hazard remediation method (MCHRM) to determine the importance of hazard nodes. When the important nodes of this network that affect the network eciency are found, by consulting the monitoring data, daily inspection results and safety evaluation information of each hazard before the dam failure, we can determine the real cause of the accident from the above important nodes according to the grading standards of hazard indicators. In the application example of Feijão Dam I, this article compares the key hazards obtained by the above methods with the conclusions of the accident investigation team. It can be found that the above method has a very good effect on nding the key causes of tailings dam failure.


Introduction
The composition of tailings is very complex, which may show strong corrosive, volatile, acidic and other characteristics affected by the types of minerals mined. If the tailings can not be managed effectively, the tailings may leak under the tailings dam failure, which will pose a serious threat to the surrounding environment and communities. On January 25, 2019, the Feijão Dam I in Brazil suddenly broke. More than 200 people died or were missing in the tailings dam accident. The Dam I has a complete management system and monitoring system, using ground-based radar, satellite (InSAR), high-de nition video and drones and other advanced monitoring equipment, but before the accident, it was not found that the tailings dam had signi cant abnormal signals that may cause a failure [1] [2] . This shows that even in tailings dams with a very high level of safety management, there are still some key accident hazards that have not been discovered or effectively monitored. Therefore, the use of effective methods to timely and accurately to identify the key hazards in the tailings dam system, and to control the various hazards that induce accidents in the bud or latent state, is of great signi cance for preventing accidents and reducing the risks of tailings dam failure.
The identi cation of hazards and the determination of their characteristics are an important part of system safety management. It not only de nes the scope of research for subsequent accident analysis and prevention, and post-disaster rescue, but also provides decision basis for managers. There are dozens of commonly used methods for identifying hazards, such as failure type and impact analysis, prehazard analysis, checklist method, hazard and operability research, fault tree analysis, event tree analysis [3] . In response to the differences in research systems, based on these conventional hazard identi cation methods, scholars have proposed a series of new hazard identi cation methods that are more suitable for the research system. Based on the results of accident analysis and interviews, Nascimento F et al.
applied grounded theory and template analysis to compile a list of hazards affecting pilots' night ight capabilities [4] . With the help of safety specialists' experiences, Alizadehsalehi S et al. used BIM software used in the design of the structure to identify potential safety hazards in buildings [5] . Chen RC et al. passed a multivariate Cox regression analysis and a nomogram model to identify potential hazards related to the fatal outcome of COVID-19 [6] .
In the research on the identi cation of hazards in tailings dam, scholars have done a lot of research work. Based on the e-EcoRisk database, Rico M et al. analyzed 147 cases of tailing pond accidents around the world, and found 15 reasons for tailing dam failure [7] . Li Zhaodong et al. established a checklist of factors affecting the tailings dam accidents and assigned points to it, identi ed dangerous and harmful factors, and evaluated the safety of the tailings dam [3] . Pier-Luc Labonté-Raymond et al. have studied the impact of climate change on the drainage system of tailings ponds [8] . MG Lemos et al. identi ed the chemical, mineralogical and metallurgical properties of gold tailings located in the Santa Barbara mine [9] . Baker K E et al. applied process safety management tools to the tailings storage and transportation system and visually characterized the possible hazards and control measures to prevent accidents [10] . The safety management of tailings dam is a whole-process management, and the hazards are coupled and in uenced by each other during the whole life cycle. Therefore, the above methods are di cult to complete and systematically identify the hazards of tailings dams. In order to overcome these problems, facing the life cycle of tailings ponds and combining the four in uencing factors of natural factors, design factors, construction factors and management factors, Zhao Yiqing et al. proposed the processcausing grid method to identify hazards of tailings ponds. Although the process-causing grid method can identify the hazards of tailings dams relatively completely and systematically, it relies more on the subjective judgment of researchers, and the supporting evidence for the identi cation of hazards is not clear [11] .
Complex networks can well characterize the internal relationship between research objects(nodes) [12] , and therefore, have been widely used in many elds in recent years [13][14][15][16][17][18] . Most complex networks are scale-free, and a small number of hub nodes play a leading role in the operation of the network [19] . In order to identify the key nodes in the complex network, Yu E Y et al. generated a feature matrix for each node in the network, and used a convolutional neural network to train and predict the in uence of the node [20] . Hou B et al. used the all-around distance method to nd in uential nodes in complex networks [21] . AXZ et al. used the information transfer probability between any pair of nodes and the k-medoid clustering algorithm to identify in uential nodes in complex networks with community structure [22] . Freeman LC etc. de ned centrality in terms of the degree to which a point falls on the shortest path between others [23] . In order to rank the spreaders, an average shortest path centrality is proposed [24] . Qin Xuan et al. applied the centrality analysis of the complex network to the study on the risk of tailings pond accidents. By comparing the decline in network e ciency after deleting the high degree value, high closeness centrality and high betweenness centrality nodes, it is concluded that the nodes with high betweenness centrality have a stronger dominance effect on the accident risk network of a tailings pond [25] .
The key spreading hazards (KSN) obtained based on the complex network theory do not consider the severity of the hazards, and these hazards may be different from the real accident hazards. If these hazards are evaluated and graded, the actual impact of these hazards on the accident can be determined. The evaluation and classi cation methods of hazards are mostly safety evaluation methods. Wu Qi et al.
rstly established a leakage accident risk assessment index system, and then used the analytic hierarchy process and the fuzzy comprehensive evaluation method to quantify the in uencing factors of the accident risk, and nally calculated the hazards level [26] . Shi Zongbao et al. have rede ned safety hazards and put forward a more reasonable classi cation standard for safety hazards [27] . In the process of risk assessment, Zhao Dongfeng et al. used the consequences of accidents to approximate the consequences of hazards, and solved the problem of risk classi cation of speci c hazards [28] . Tta B et al. used epigenetic biomarkers as a tool to assess chemical hazards [29] .
In order to solve the above problems, this paper proposes an evidence-based three-dimensional hazard identi cation framework method to identify the hazards and paths of tailings dam failure. Then, the complex network theory is used to establish a propagation network of tailings dam failure risk (PNTDFR), and some structural characteristics and characteristics of the network are analyzed. Taking the network e ciency as the measurement index of risk communication capability, the MCHRM proposed in this paper is used to nd the key hazard nodes (KSN) that may cause the failure of the target tailings dam.
After the KSN is con rmed, by con rming the trigger state of the KSN, the key hazards and paths of the tailings dam failure can be obtained. Finally, the above method was applied to the Feijão Dam I, and compared with the conclusion of the Dam I failure investigation team to verify the accuracy of the method in this paper.

2.1Hazard identi cation and network establishment
The 'hazard' is the potential occurrence of an event within a prescribed time and space, and its de nition has been expanded as a process, phenomenon or human activity [36] . In order to avoid the subjectivity of hazard identi cation, this paper proposes a new hazard identi cation method from the perspective of safe production: a three-dimensional hazard identi cation framework (THIF). This method selects accident cases, laws and regulations, standard speci cations, documents and other materials as evidence for hazard identi cation, and systematically identify the hazards of the personnel, material, environment, and management in tailings dams based on the life cycle of the construction, operation, closure, and reclamation of tailings dams [38] .
This paper uses the identifying hazards of tailings dams and the evolutionary relationship between hazards to construct an adjacency matrix, and then import the adjacency matrix into Pajek software, and construct a propagation network of tailings dam failure risk (PNTDFR). The nodes in the PNTDFR represent hazards, and the edges represent the relationship between hazards. According to the status change of the hazards, the PNTDFR is divided into three layers of nodes (dormant hazard, armed hazard, activity hazard or accident) and two stages and two stages (from dormant hazard to armed hazard, from armed hazard to activity hazard) [30,38] . The initial dormant hazards can only cause other hazards and cannot be caused by other hazards, that is, the in-degree value is 0, including all initial nodes of the four in uencing factors of tailings dam break, such as oods, excessive rainfall, and excessive standard earthquakes. Armed hazards are formed by the evolution of the dormant hazards, and these armed hazards will may cause damage accidents under certain working environments or conditions, such as the rapid rise of pond water level, the dam deformation, and the tailings liquefaction. These hazards mean the imminent accidents and disasters. Active hazards are accidents that are or have occurred. If these active hazards cannot be effectively suppressed, they will lead to serious consequences and disasters, including overtopping and dam break and so on [24] .
When the network model is established, we can use complex network theory to analyze the statistical features of the PNTDFR, such as degree, betweenness centrality, network density, characteristic path length and clustering coe cient. From these characteristics, the propagation law of tailings dam failure risk. can be analyzed and discovered.

Global network e ciency and priority remediation order of hazards nodes
When the PNTDFR is a scale-free network, the PNTDFR will appear vulnerable to deliberate attacks [31] . In other words, if we can prioritize to remedy the hazard nodes that have a greater impact on network connectivity, the spreading e ciency of the network can be reduced, thereby slowing down or even blocking the spread of risks. Therefore, this paper chooses network e ciency as an index to measure the spreading ability of dam-break risk.
Global network e ciency, also known as network connectivity, refers to the di culty of average network connectivity, which is the average of the sum of the reciprocal lengths of the shortest path between all pairs of hazard nodes in the entire network [31] . Degree centrality, betweenness centrality and closeness centrality are commonly used methods to characterize the importance of nodes in complex networks. In this paper, the importance of nodes determined according to the three methods is used as the priority of hazard remediation (deletion), and then the differences of the three methods in reducing network e ciency are compared. By absorbing the advantages of different methods under different hazard remediation (deleted) ratios, combined with the characteristics of multi-stage propagation of tailings dam failure risk, this paper proposes a multi-stage collaborative hazard remediation method ((MCHRM)) to determine the importance of hazard nodes. The speci c implementation process of this method is as follows: (1) Since the rst-layer nodes (dormant hazards) only have out-degree values, and the betweenness centrality is 0, only the degree value needs to be considered in determining the remediation order of the rst-layer hazards, and priority is given to the hazard nodes with greater degree value.
(2) The second-layer nodes (armed hazards) have degree values, betweenness centrality and closeness centrality, which are the intermediate stage of dormant hazards and activity hazards. Therefore, it is necessary to consider the in uence of three indicators on risk propagation at the same time. When there are differences among three hazard remediation methods under different remediation proportions, priority is given to the remediation method that can reduce the speed of risk evolution faster.
(3) The third-layer nodes (activity hazards) are the possible accident modes of a tailings dam, and the remediation method is the same as that of the second-layer node. The hazard of dam break is the object of the accident studied in this paper, so it is not remedy.
(4) After the remediation priority of hazards at the same layer according to the corresponding methods is determined, among hazard nodes at different layers, those nodes with a smaller remediation proportion will be prioritized.
When all the hazard nodes of the PNTDFR have been treated, by observing the change trend of network e ciency, the key hazards of the PNTDFR can be determined (those hazards that can signi cantly reduce network e ciency after deleting). In this paper, these important hazard nodes are called key propagation hazards (KPH). In addition, if the MCHRM can reduce network e ciency more effectively than the commonly used methods in the past, the remediation order of hazard nodes determined by this method can better characterize the importance of different nodes in the PNTDFR.

Evaluation and classi cation of key hazards
The KPH refers to some important hazards that may occur based on the environment, structure, and management level of the target tailings dam. If you want to determine which of the hazards caused the accident, you need to determine whether these hazards are in a triggered state and how serious. Because the China Tailings Pond Safety Grade Classi cation Standard divides the tailings ponds into four levels: normal, mild, moderate, and dangerous, the paper divides the grading standards of the KPH indicators of tailings dam into four levels combining the Technical Regulations for Safety of Tailings Pond and the Code for Design of Tailings Facilities. Level 1 is a normal state, level 2 is a mild danger, level 3 is a moderate danger, and level 4 is a serious danger. In the classi cation of grading standards, the indicators that can obtain speci c values are classi ed using quantitative analysis methods. For example, the evaluation indicator of hazard 5 (heavy rainfall) is rainfall, which is calculated in the depth of the water layer per unit area within 24 hours. Hazards that are di cult to quantitatively classify are qualitatively used. For example, hazards 355 (Insu cient experience in personnel or organization quali cation problems) are divided into four levels based on the personnel's education, working hours, and quali cation levels of the institution.
When the classi cation standard of the KPH is completed, by comparing the monitoring data, daily inspection results, and safety evaluation information before the accident, the level of the KPH indicators of the studied tailings dam can be obtained, so as to determine the states of these hazards [37]. The KPH of level 1 are in a normal state and will not further evolve or cause other hazards. This part of the hazards is not the KPH that causes the tailings dam to break. The remaining hazards with a level greater than 1 are the KPH that led to the dam failure. By excluding the hazard nodes of level 1, we can determine the key hazards and spreading paths between hazards. In the accident investigation report, these key hazards are also referred to as the main cause of the accident.

Case Analysis
This

Classi cation of hazards and the relationship between Hazards
A total of 117 hazards and 535 relationships are obtained by the THIF method, as shown in Appendix A [38] . In Appendix A, the rst column indicates the categories of hazards, including four categories: environment factor, personnel factor, material factor, and management factor. The second column indicates the number (ID) of the hazards in the third column. The fourth column indicates the number of the hazards caused by the hazard in the third column. For example, the hazard named 'heavy rainfall' in the second row of the third column is numbered 5, which belongs to the environment factor. Through the THIF method, we can get the hazards that may be caused by the 'heavy rainfall'. These hazards are numbered 19, 67, 69, 150, 193 and 19.

Propagation network of Dam I failure risk
This section uses hazards of Dam I and the relationship between the hazards in Appendix A to construct the adjacency matrix, and then import it into Pajek software to construct the propagation network of Dam I failure risk (I-FRPN), as shown in Fig. 1.

Degree and degree distribution
The degree value of each node in I-FRPN can be obtained through Pajek complex network software as shown in Fig. 2. The average degree of the I-FRPN is 9.15, and the network density is 0.04, indicating that a hazard node is directly related to 9.15 hazard nodes on average, but the overall density of the I-FRPN is not large.
It can be seen from Fig. 2 that among the top 10 hazards, 355 (Insu cient experience in personnel or organization quali cation problems) is the hazard node with the largest degree value in the I-FRPN, which directly affects 61 hazards. It shows that if the personnel and organization do not have su cient experience or do not meet the corresponding quali cation requirements, the tailings dam will always be threatened throughout its life cycle. 191 (Fracture of drainage structure) is directly related to 36 hazards, which is the second largest hazard in the degree value. It is classi ed as a material factor among the four in uencing factors. The degree values of 62 (partial landslide and collapse of the dam), 64 (Dam instability), 65 (Dam deformation), 157 (Filter failure), 195 (Rapid rise of pond water level) and 327 (Safety monitoring facilities cannot fully re ect the operating status of the tailings pond) are respectively 22, 31, 26, 27, 24 and 24. These hazards belong to the material factor together with the hazard 191, and account for 70% of the top 10 hazards, highlighting the fact that the material factor plays a leading role in tailings dam safety management.
Hazard 308 (Closure design not in accordance with regulations) has a degree value of 25, which belongs to the same personnel factor as hazard 355, and these hazards are indirect factors that lead to dam break. 351 (Improper maintenance) is directly related to 24 hazards, which is the management factor, indicating that management plays an important role in the safety management of tailings dams. Cumulative degree distribution of the I-FRPN is shown in Fig. 3. The cumulative degree distribution presents a power-law distribution that has the approximate t ( ). The above result deviates from the power-law nature for lager k, which indicates that the I-FRPN has scale-free property [18] [34] . It means that a few hub nodes play a dominant role in the I-FRPN. If we can nd these key nodes, the spread of risk can be slowed down or even blocked, thus preventing the occurrence of dam break. The degree studied in this section is an important indicator for judging the importance of network nodes. In addition, there are also indicators such as betweenness centrality and closeness centrality that are also commonly used to measure the importance of nodes. In the next section, we will conduct more analysis on this aspect.

Network diameter and average path length
The network diameter, also known as the maximum path length of the network, represents the largest step length between two nodes in the network [31] . After calculation, the network diameter of the I-FRPN is 8, which means that a hazard node can affect any node in the network only after a maximum of 8 steps.
The most distant node pairs of the network are v32 and v150 or v7 and v45. Compared with some accident networks studied in the past [15,34,35] , the diameter of I-FRPN is larger, and the evolution path of the risk is complicated.
The characteristic path length is also called the average path length. After calculation, the average path length of the I-FRPN is 2.81, indicating that it takes less than 3 steps on average to transfer the risk of dam break from one hazard to another hazard. The above results show that the characteristic path length of the I-FRPN is small, and the risk of dam break can be spread quickly on the network. If no corresponding measures are taken, the emergence of a serious hazard may cause a tailings dam break in a relatively short time.

Clustering coe cient and small-world property
The clustering coe cient of the I-FRPN refers to the degree of interconnection between adjacent nodes of a hazard node in the network [34] . That is to say, there is no clustering coe cient for nodes with a degree value of 1. In this paper, the average clustering coe cient of the I-FRPN is calculated by Pajek software as 0.15. After excluding the nodes with a degree of 1, the clustering coe cients of the hazard nodes in the network are obtained, as shown in Fig. 4. It can be seen from the gure that the clustering coe cient of the hazard node in the I-FRPN is between 0-0.5. The clustering coe cients of hazard 32 (Insu cient tank length) and 220 (The maximum ow rate of ood control structure design is greater than the allowable ow rate of building materials) are both 0.5, which are the nodes with the largest clustering coe cient, indicating that the adjacent hazards of the hazard 32 and 220 have a strong correlation and show strong clustering.
Small-world networks usually have large clustering coe cients and small characteristic path lengths [31] .
In order to judge whether the clustering coe cient of the I-FRPN meets the requirements of the small world, this paper constructs a random network with the same number of nodes and the same degree value as the I-FRPN, and calculates the clustering coe cient to be 0.08, which is smaller than the clustering coe cient of the I-FRPN (0.15). The equal-sized dam failure risk random network is shown in Fig. 5. Combined with the characteristic path length of the I-FRPN is only 2.81, it can be concluded that the I-FRPN has small-world property. In other words, the break accident for Dam I has the characteristics of multi-factor coupling and short disaster path.
3.3 Priority remediation order of hazard nodes in the I-FRPN This paper rst treats(deletes) the node with the largest index value and calculates the network e ciency, and then calculates the network e ciency after every 5 hazard nodes are treated. Figure 6 shows the changes of the network e ciency under the hazard remediation methods.
In Fig. 6, it can be found that the preferential treatment of nodes with large betweenness centrality can achieve better results in the early stage (low proportion). In other words, when the remediation proportion of hazard nodes is small, the risk propagation speed can be reduced more quickly by the betweenness centrality. However, when the proportion of hazard remediation reaches 13.68%, the hazard node with a higher degree value will have a better effect of reducing risk spread.
It can be seen from Fig. 6 that the MCHRM performs better than the other three commonly used methods, whether in the early stage of the hazard node remediation or in other stages. In addition, we can also nd that all four methods show that when the proportion of node remediation reaches about 30%, the decline in network e ciency tends to slow down signi cantly. Further increasing the proportion of node remediation will not signi cantly reduce the spread e ciency of the network. In other words, when we are in the process of hazard remediation of tailings dams, if we give priority to the top 30% of hazard nodes determined by the MCHRM, we can use the vulnerability of the network to reduce network e ciency more quickly. In this paper, these hazard nodes that can quickly reduce the propagation e ciency of the I-FRPN are called key propagation nodes, and the relationship between these key nodes is called the critical propagation path.

Evaluation and classi cation of key hazards of Feijão Dam I
In order to improve the accuracy of the KPH identi cation, when determining the range of KPH, this paper will increase the priority remediation range from the top 30% of the index value to the top 45%. The I-FRPN has a total of 117 hazard nodes, and 45% of the priority g remediation proportion includes 53 nodes. According to the KPH determined by MCHRM, the order of priority remediation is shown in Table 1. The rst column of Table 1 is the serial number of the KPH, indicating the order of the remediation of the hazards. The third column is the name of the hazard to be studied, the second column is the number (ID) of the hazard, the sixth column is the level of the corresponding hazard node, and the fourth and fth columns are the degree value and the betweenness centrality of the hazard node. By consulting the monitoring data, daily inspection results and safety evaluation information of each hazard before the failure of Dam I, according to the grading standards of hazard indicators in Appendix B, the level of each hazard is obtained, as shown in Table 1.

Comparison And Analysis
In order to verify whether the key hazards (causes) of the Dam I failure accident identi ed above are reasonable, this paper compares the above results with the conclusions made by the accident investigation expert group chaired by Dr. Peter K. Robertson. The expert group concluded that the direct cause of the failure of the Dam I was the liquefaction of the tailings of the dam. The expert group conducted research on the composition of the dam body material and the dam-break trigger mechanism, and found that 6 technical problems were the main factors leading to the dam break. Compare the key hazards with a level greater than 1 in Table 2 with the main factors found by the expert group, as shown in Table 2 [33]. The above comparison results show that the method proposed in this paper can better nd the key causes of the dam failure. When the priority range of remediation is increased by 15%, it will be possible to cover all the expert groups to propose the main causes. Although the conclusions of the expert group cannot be completely equated with the true cause and risk propagation path of Dam I failure, the expert group members have rich experience and outstanding academic attainments on the issue of tailing dam failure. Therefore, expert group's conclusion is highly reliable. In addition, the failure causes and risk propagation paths of the Dam I identi ed in this paper also involve some hazard nodes and propagation paths that the expert group did not mention, which may include some problems that the expert group did not notice, which will help improve the safety management of tailings dams.

Discussion
Page 15/33 The causes of tailings dam failure are complex, and the dam structure changes continuously over time, which makes it di cult to identify hazards and analyze the causes of accidents. In order to solve this problem, this paper proposes a new method for identifying the key hazards and the risk propagation path of tailings dam failure. This method is divided into four steps: preliminary identi cation of hazards of tailings dam failure, network model construction and analysis, identifying key propagation hazards and their importance, and evaluation and classi cation of key hazards.
The biggest difference between the THIF method proposed in the preliminary identi cation stage and the previous hazard identi cation and accident cause analysis methods is that the THIF method uses accident cases, laws and regulations, documents and media as evidence of the existence of hazards and the relationship between hazards. To a certain extent, the method avoids the subjectivity of researchers in the process of identifying hazards and the relationship between hazards.
Compared with commonly used methods such as accident trees and accident chains, complex networks can more completely and systematically link these evidence-based hazards and the relationship between hazards, and characterize the evolution process of dam-break risk in the form of a network. The centrality analysis of nodes is an important direction of complex network research, and its purpose is to nd the hub nodes that play a dominant role in the operation of the network system. For the PNTDFR, the hub nodes are the key hazards for the spread of dam failure risk. If key hazard nodes can be found, and timely remediation measures can be taken, the spread of the risk of dam break can be blocked, so as to avoid the occurrence of tailings dam failure.
By utilizing the advantages of different methods under different hazard remediation (deleted) proportions in nding hub nodes, this paper proposes the MCHRM. The MCHRM can signi cantly reduce the network e ciency, but there are also the problems that the severity or level of the hazards is not considered, and the weights between nodes in the network are assumed to be equal, which will lead to a certain difference between identi ed key hazards and real key hazards from tailings dam failure. At the same time, due to the complex causes of dam failure accidents and the di culty of quanti cation, it is di cult to accurately give the weight of the relationship between hazards. In order to solve the above problems, this paper sets a certain reserve range when determining the range of key nodes in the PNTDFR, that is, increases the range of priority remediation. The speci c reserve range can be adjusted to a certain extent according to the difference of the research objects.
Although this paper has done a lot of work in order to nd the key hazards and the risk propagation paths of tailings dam failure, there are still three shortcomings: a. Although the reserve range of priority remediation can cover all key hazards of dam failure, it is di cult to give an accurate reserve ratio, and the actual application needs to combine the experience of some technical personnel. b. In the formulation of hazard classi cation standards, due to the numerous in uencing factors of hazards and the di culty of quantifying some of the in uencing factors, the classi cation standards of some nodes adopt a subjective qualitative classi cation method, which affects the accuracy of some classi cation indicators.
c. The hazard nodes and the relationships between hazards in this paper are all based on evidence (accident cases, laws and regulations, documents and media, etc.), but the reliability of different evidences is different, which will affect the accuracy of the research. In order to better solve the above problems, the author of this paper plans to study more accident cases in the next step, so as to determine a more speci c reserve range of priority remediation. At the same time, this paper will consider the evidence according to the reliability of the evidence, and select more quantitative indicators to classify the hazard indicators to improve the practicability of the above methods.

Conclusion
Based on accident cases, laws and regulations, and documents, this paper systematically has identi ed the hazards of each stage of whole life cycle in accordance with personnel, material, environment, and management factors. The hazard identi cation method is called the three-dimensional hazard identi cation framework, and by the method, 117 hazards and 535 relationships between hazards were obtained in the Dam I. This paper uses the complex network theory to propose the PNTDFR with threelayer nodes and two stages, and it is applied to the Dam I. By analyzing the characteristics of the I-FRPN, it can be obtained that the I-FRPN is a small-world and scale-free network.
By absorbing the advantages of betweenness centrality and degree centrality under different remediation proportion of hazard nodes in nding key hazard nodes, combined with the three-layer and two-stage characteristics of the PNTDFR, this paper proposes the MCHRM to identify the KPH and the priority remediation order among the KPH. By analyzing the I-FRPN, it can be found that the top 30% of the index value is the KPH. When the priority remediation range is increased from 30-45%, the KPH will cover all the causes of accidents proposed by the Dam I failure investigation expert group.
In this paper, by formulating the classi cation standards of KPH, comparing the monitoring data, daily inspection results and safety evaluation information of each hazard before the accident, it is determined that a total of 31 KPH are in the trigger state before the Dam I failure. These triggered hazards are the key hazards of the Dam I failure risk, and the relationships between the key hazards are the propagation paths of the failure risk.  190,191,192,193,195

Declarations Declaration of competing interest
The authors declare that they have no known competing nancial interests or personal relationships that could have appeared to in uence the work reported in this paper.

Figure 2
Node degree in the I-FRPN Clustering coe cient of nodes in the I-FRPN Figure 5 Equal-sized dam failure risk random network Figure 6 The impact of the four remediation sequences of hazard nodes on network e ciency Key hazards and propagation paths of Dam I failure