## 1. INTRODUCTION

Snow avalanche long-term forecasting is generally carried out on the basis of high-magnitude events defined by their return period, for example, Salm and others (Reference Salm, Burkard and Gubler1990). Such purely hazard-oriented approaches do not explicitly consider elements at risk (buildings, people inside, etc.), and neglect possible budgetary constraints. Therefore, they do not guarantee that unacceptable exposition levels and/or unacceptable costs cannot be reached. This is well demonstrated in Favier and others (Reference Favier, Eckert, Bertrand and Naaim2014b) by confronting standard hazard zone limits with acceptable risk levels as defined by Jónasson and others (Reference Jónasson, Sigurðsson and Arnalds1999). To overcome these limitations, risk-based zoning methods (Keylock and others, Reference Keylock, McClung and Magnusson1999; Arnalds and others, Reference Arnalds, Jonasson and Sigurdsson2004) and cost-benefit analyses (Fuchs and others, Reference Fuchs, Thoeni, McAlpin, Gruber and Bründl2007) have emerged recently, allowing socio-economic considerations to be included (Bründl and others, Reference Bründl, Romang, Bishof and Rheinberger2009) in a proper mathematical framework (Eckert and others, Reference Eckert2012).

Risk quantification requires, combining the model for avalanche hazard with a quantitative assessment of consequences. The hazard distribution is (at least partially) site-specific, and two main approaches exist to determine it. ‘Direct’ statistical inference can be used to fit explicit probability distributions on avalanche data, mainly runout distances (Lied and Bakkehoi, Reference Lied and Bakkehoi1980; Eckert and others, Reference Eckert, Parent and Richard2007; Gauer and others, Reference Gauer, Kronholm, Lied, Kristensen and Bakkehøi2010). As an alternative, statistical-dynamical approaches include hydrodynamical modelling within the probabilistic framework (Barbolini and others, Reference Barbolini, Natale and Savi2002; Meunier and Ancey, Reference Meunier and Ancey2004; Eckert and others, Reference Eckert, Parent, Faug and Naaim2008). They lead the joint distribution of all variables of interest, including that of spatio-temporal pressure fields (Eckert and others, Reference Eckert, Naaim and Parent2010b). Consequences for elements at risk are estimated using vulnerability relations. Vulnerability curves are increasing curves with values of [0, 1] quantifying the expected damage as a function of the avalanche intensity. Avalanche intensity is generally expressed in terms of impact pressure, but sometimes also of flow depth or velocity (Barbolini and others, Reference Barbolini, Cappabianca and Savi2004a, Reference Barbolini, Cappabianca, Sailer and Brebbiab). Existing vulnerability to snow avalanche relations has historically been assessed by back-analysis of well-documented events (Keylock and Barbolini, Reference Keylock and Barbolini2001; Papathoma-Köhle and others, Reference Papathoma-Köhle, Kappes, Keiler and Glade2010), but numerical approaches have emerged recently (Bertrand and others, Reference Bertrand, Naaim and Brun2010; Favier and others, Reference Favier, Bertrand, Eckert and Naaim2014a).

To minimise the residual risk after the construction of a defense structure, effects of such structures on avalanche flows must also be quantified. Semi-empirical analytic equations could be developed to describe the runout shortening caused by dam-like obstacles, refered to as interaction laws throughout the text in accordance with the literature (Faug and others, Reference Faug, Naaim, Bertrand, Lachamp and Naaim-Bouvet2003) They have been established for walls spanning the whole width of the incoming flow with the help of theoretical arguments combined with small-scale laboratory tests on granular avalanches. Specifically, two existing interaction laws correspond to idealised situations for which the runout shortening is caused by either the local dissipation of kinetic energy (purely inertial regime) or the volume reduction due to storage of the snow upstream of the dam (purely gravitational regime).

A specific difficulty remains poorly addressed in the avalanche community. Long-term forecasting deals with high magnitude events, by definition rare, whereas available data series are short and lacunar, when they exist. Hence, robust methods to extrapolate beyond the observational records should, in principle, be used (Katz and others, Reference Katz, Parlange and Naveau2002). For this, statistical models based on extreme value theory (EVT) are ideal candidates with strong mathematical justification (Leadbetter and others, Reference Leadbetter, Lindgren and Rootzén1983; Embrechts and others, Reference Embrechts, Klüppelberg and Mikosch1997; Coles, Reference Coles2001). Specifically, for univariate random numbers, block maxima (e.g. Coles (Reference Coles2001) provides a synthesis of the original work of Fisher, Tippett and Gnedenko) and exceedances above high thresholds (Pickands, Reference Pickands1975) converge as the sample size goes to infinity and under rather mild regularity conditions, to well-known distributions of three types: heavy tailed (Fréchet type), light tailed (Gumbel type) and bounded (Weibull type). These can be summarised into one unique class of limit models, namely generalized extreme value distributions for block maxima and Poisson – Generalized Pareto distributions (GPD) for peak over threshold (POT) exceedances. Both approaches are asymptotically equivalent, leading to the same prediction of high-return levels.

This framework is more or less behind most of the statistical approaches to high-return period avalanche evaluation, even if it not always explicitly advocated. For instance, Ancey (Reference Ancey2012) has discussed the behaviour of extreme avalanches with regard to outlier theory. Also, the runout ratio approach of McClung and Lied (Reference McClung and Lied1987), where normalised runouts of extreme avalanches collected over a sample of paths are fitted by a Gumbel distribution, may be seen as a specific application of the block-maxima approach. More recently, available runout samples have been studied in the search for some systematic behaviour of the tail of their distribution (Keylock, Reference Keylock2005). However, the strong dependency of runout on local topography may preclude general conclusions as soon as the path's topography is irregular. This is well shown by Eckert and others (Reference Eckert, Parent, Faug and Naaim2009), where strong discontinuities in the runout distribution tail linked to very local changes in a path's concavity are highlighted. Finally, the use of univariate EVT is emerging for characterising avalanche cycles (clusters of events, generally during a winter storm; Eckert and others (Reference Eckert2010a, Reference Eckert, Gaume and Castebrunet2011); Sielenou and others (Reference Sielenou, Eckert and Naveau2016)).

For multivariate random numbers, the class of limit models is not unique, but analogous convergence results exist, providing properties to be satisfied by multivariate extremes (e.g. Resnick, Reference Resnick1987). Yet, the framework of multivariate EVT has not been, up till now, used for snow avalanches, except in a simplified way for a few engineering studies (Naaim and others, Reference Naaim, Faug, Naaim and Eckert2010), and to evaluate, in a spatial context, extreme snowfall (Blanchet and Davison, Reference Blanchet and Davison2011; Gaume and others, Reference Gaume, Eckert, Chambon, Naaim and Bel2013) and subsequent avalanche release depths (Gaume and others, Reference Gaume, Chambon, Eckert and Naaim2012). Hence, evaluation of the joint distribution of rare avalanche flow depths, velocities, runouts, etc. generally rely on the statistical-dynamical models previously introduced. In them, the inter-variable dependence is strongly constrained by the physical equations used (Bartelt and others, Reference Bartelt, Salm and Gruberl1999; Naaim and others, Reference Naaim, Naaim-Bouvet, Faug and Bouchet2004). This has some evident advantages, but also the limitation of being not necessarily consistent with the limit results of EVT, making the most extreme events predicted questionable, while their validation on the basis of observations remains a challenging task (Schläppy and others, Reference Schläppy2014).

More generally, existing risk-based methods available for engineers in the snow avalanche field suffer from strong limitations. Standard cost-benefit analyses generally consider a limited value of potential actions/decisions, and reduce the hazard distribution to one or a few scenarios. The retained choice may therefore be far from optimal, and even be inappropriate in case of a strong sensitivity to the retained hazard scenarios. Examples can be found in the domains of defense structure efficiency assessment, (Wilhelm, Reference Wilhelm1997; Fuchs and Mc Alpin, Reference Fuchs and Mc Alpin2005; Margreth and Romang, Reference Margreth and Romang2010), and minimisation of avalanche risk to trafficked roads (Margreth and others, Reference Margreth, Stoffel and Wilhelm2003; Hendrikx and Owens, Reference Hendrikx and Owens2008). Risk-based methods that consider the full hazard distribution exist for zoning for land use planning purposes (Keylock and others, Reference Keylock, McClung and Magnusson1999; Barbolini and others, Reference Barbolini, Cappabianca and Savi2004a). However, as for the statistical-dynamical models on which they rely, these do not benefit from the theoretical justifications of EVT. Furthermore, they remain so computationally intensive that strong simplifying assumptions are generally made to reduce the numerical burden, for example, a linear relation between avalanche release depth and impact pressure in the runout zone assumed by Cappabianca and others (Reference Cappabianca, Barbolini and Natale2008). And even so, they remain little used by practitioners because of their inherent complexities, which are difficult to reconcile with operational constraints.

Up to now, to our knowledge, only two exceptions consistently combine all the elementary bricks of the risk framework within a single decisional perspective based on EVT. In Rheinberger and others (Reference Rheinberger, Bründl and Rhyner2009), a quantitative comparison of risk reductions brought about by alternative mitigation strategies to trafficked roads is performed. In Eckert and others (Reference Eckert, Parent, Faug and Naaim2008) the size of the avalanche dam that maximises the economical benefit of its construction in a land use planning application is examined. Such approaches work at better than reasonable computational cost, since they are nearly fully analytical. Yet, in Rheinberger and others (Reference Rheinberger, Bründl and Rhyner2009), the different competing decisions are too different from each other to allow a sound representation of the risk as a function of the decision. In Eckert and others (Reference Eckert, Parent, Faug and Naaim2008), the decision space is continuous and simpler and hence, better accounted for, but this arises because only the case of a dam interacting with fast dry snow avalanches (Faug and others, Reference Faug, Gauer, Lied and Naaim2008) is considered. Furthermore, in both papers, only the relatively simple case of light runout tails is considered. And even though a Bayesian analysis is made by Eckert and others (Reference Eckert, Parent, Faug and Naaim2008) to take data quantity into account in the decisional procedure, little attention is given in either paper to the question of model uncertainty or sensitivity of risk estimates and related minimisation rules to the model's choice.

On this basis, the first objective of this paper is to expand in Section 2, the pre-existing dam decisional procedure of Eckert and others (Reference Eckert, Parent, Faug and Naaim2008), to make it workable under much less restrictive assumptions regarding hazard distribution and interaction law. This leads to different analytical formulae based on extreme value statistics to quantify risk and perform the optimal design of an avalanche dam in a quick and efficient way. All computations are made with an individual risk perspective, focusing on a single element at risk (say a building) and over the long range, using an econometric actualisation term that accounts for the dam amortising duration. The second objective of the paper is to apply this in Section 3, to a real example from the French Alps, where, as usual for real-world applications, available data are seldom and presumably imperfect. We show how results can be provided in terms of intervals/bounds usable by engineers, in the spirit of the work of Favier and others (Reference Favier, Eckert, Bertrand and Naaim2014b) for vulnerability relations. In discsec, we discuss from a wider perspective, the sensitivity of risk quantification and minimisation procedures to avalanche hazard modelling choices, leading to the outcomes of the work and potential outlooks.

## 2. METHODS

### 2.1. Runout models based on extreme value statistics

#### 2.1.1. POT modelling

The Poisson – GPD peak over threshold (POT) approach is now commonly used in hydrology to estimate high quantiles (Parent and Bernier, Reference Parent and Bernier2003a; Naveau and others, Reference Naveau, Toreti, Smith and Xoplaki2014), and has gained recent interest for analysing related processes such as debris flows (Nolde and Joe, Reference Nolde and Joe2013). The reason is that Pickands (Reference Pickands1975) has shown that the Poisson GPD class of models includes all limit models for independent exceedances of asymptotically high thresholds. In practice, this ‘only’ means choosing a sufficiently high threshold and if necessary, declustering possibly dependent exceedances (Coles, Reference Coles2001), before fitting the model parameters. Specifically, the aleatory variable *A*
_{t} of threshold exceedances in a winter period follows a Poisson distribution with parameter *λ*:

The intensity of exceedances follows a GPD distribution. In our case, the avalanche runout abscissa
${X_{{\rm sto}{{\rm p}_{\rm 0}}}}$
is the intensity variable of interest. The ‘0’ index refers to the fact that no protective measure is considered (natural activity of the avalanche phenomenon). Hence, the probability density function of avalanche runouts exceeding the *x*
_{d} dam abscissa (the *d* index denotes that the chosen threshold corresponds here to the position where a dam construction is envisaged, but other choices are straightforward) is:

In practice, two different GPD parametrisations are used, with the correspondence *ξ* = −(*β*/*ρ*) and *σ* = 1/*ρ*. The (*σ*, *ξ*) couple is more interpretable in terms of physics (*σ* is a scale parameter and *ξ* a dimensionless shape parameter), whereas the (*ρ*, *β*) couple is computationally more convenient (Parent and Bernier, Reference Parent and Bernier2003b). Notably, the *ξ* parameter fully characterises the shape of the GPD tail. A heavy tail associated with the Fréchet domain corresponds to (*ξ*>0). The light exponential tail (Gumbel domain) is the (*ξ* = 0) limit case, and (*ξ*<0) characterises the bounded tail of the Weibull domain.

The one-to-one mapping between runout distance beyond *x*
_{d} and return period *T* results, for *λT* >1, from equation:

where
$F({x_{{\rm sto}{{\rm p}_{\rm 0}}}})$
is the cumulative distribution function of unperturbed (without dam) runout distances beyond the abscissa *x*
_{d}.

Replacing
$F({x_{{\rm sto}{{\rm p}_{\rm 0}}}})$
by its expression given by the integral of Eqn (2) leads to the (1 − (1/*λT*)) quantile (also denoted return level) corresponding to the return period *T* fully analytically, an enormous practical advantage, i.e.:

which is valid for (*x*
_{
T
} >*x*
_{d}). This expression shows well the crucial role of the sign of the *ξ* parameter: positive values lead to ‘explosive’ increments of the return level with *T*, faster than in the exponential case (*ξ* = 0), for which this increase is log-linear with *T*. In contrast, in the Weibull case (*ξ*<0), the quantile, for high values of *T*, tends to the limit return level *x*
_{d} + |*σ*/*ξ*|.

#### 2.1.2. Likelihood maximisation

To get best estimates
$\hat \lambda $
and
$\hat F({x_{{\rm sto}{{\rm p}_{\rm 0}}}}) = F(\hat \rho, \hat \beta )$
for *λ* and
$F({x_{{\rm sto}{{\rm p}_{\rm 0}}}})$
, respectively, the standard procedure is to use likelihood maximisation. For the Poisson distribution,
$\hat \lambda $
is simply the mean exceedance rate, i.e.
$\hat \lambda = m/{T_{{\rm obs}}}$
where
$m = \sum\nolimits_{t = 1}^{{T_{{\rm obs}}}} {{a_{\rm t}}} $
is the number of recorded exceedances of the *x*
_{d} abscissa during the *T*
_{obs} winters of observation.

The Generalized Pareto log-likelihood *l*(*ρ*, *β*) is, for *β* ≠ 0:

where
${x_{{\rm sto}{{\rm p}_{{0_i}}}}}$
, *i* in [1, *n*], is an independant and identically distributed sample of the distribution
$F({x_{{\rm sto}{{\rm p}_{\rm 0}}}})$
.

It follows that the maximum log-likelihood estimate for *ρ* is:

where

The estimate
$\hat \beta $
of *β* is obtained numerically, knowing
$\rho = \hat \rho $
, leading the log-likelihood maximum:

Classical theory of statistical estimation provides standard errors for the maximum likelihood estimates (MLE) trough:

where *E* denotes the mathematical expectation and *H*(*l*|*θ*) is the Hessian matrix of the log-likelihood *l* indexed by the parameters *θ*. Specifically, the expression of the negative Hessian of the GPD is (e.g. Coles (Reference Coles2001)):

where *sym* denotes that the matrix is symmetrical. Since MLE are asymptotically Gaussian, these standard errors allow easy construction of asymptotic confidence intervals for the estimated parameters, to fairly represent the uncertainty resulting from the limited data sample available.

#### 2.1.3. Model selection and profile likelihood maximisation

The Poisson – exponential model is a very specific limit case of the Poisson – GPD model (*ξ* = 0), with a different writing of the likelihood according to Eqn (2). Model selection is typically based on the likelihood ratio test using the *D* deviance statistics. Specifically, if ℓ_{1}(*M*
_{1}) is the maximised log-likelihood corresponding to the exponential distribution (*β* = 0) and ℓ_{0}(*M*
_{0}) the maximised log-likelihood corresponding to the GPD distribution (*β* ≠ 0), then *D* = 2{ℓ_{1}(*M*
_{1}) − ℓ_{0}(*M*
_{0})}. Its asymptotic distribution is given by the one degree of freedom *χ*
^{2} law. The null hypothesis is the choice of the exponential model. It is rejected at the
$\alpha \% $
significance level if
$D \gt {c_{{\alpha _{{\chi ^2}}}}}$
where
${c_{{\alpha _{{\chi ^2}}}}}$
is the
$1 - \alpha \% $
quantile of the one degree of freedom *χ*
^{2} (e.g.
${c_{{\alpha _{{\chi ^2}}}}} = 3.84$
for the 95% quantile).

The shape parameter *ξ* (or *β*) is often difficult to estimate on real data. Besides, the estimates
$\hat \sigma $
and
$\hat \xi $
are linked. As a consequence, the likelihood is often very similar around the optimum
$(\hat \sigma, \;\hat \xi )$
, so that different couples (*σ*, *ξ*) may well fit the data. To explore the practical implication of that, and hence, to go on with the uncertainty/sensitivity analysis to hazard model choice, we hereafter test different couples obtained by solving the profile likelihood maximisation for various possible values of *ξ*
_{0} as:

### 2.2. Avalanche/dam interaction laws

#### 2.2.1. Runout shortening by energy dissipation

It is rarely possible (for economical and/or environmental reasons) to design a catching dam that will stop all avalanches at all times. Some avalanches might overflow the dam and flow downstream. One way of quantifying the residual risk related to overflow is to estimate the avalanche runout shortening caused by the dam,
${x_{{\rm stop}}}({h_{\rm d}}) - {x_{{\rm sto}{{\rm p}_{\rm 0}}}}$
where *x*
_{xtop}(*h*
_{d}) and
${X_{{\rm sto}{{\rm p}_{\rm 0}}}}$
are the maximum runout distances with and without dam, respectively, and *h*
_{d} is the dam height. A first interaction law was established to relate the maximum runout distance downstream of a dam, *x*
_{stop}(*h*
_{d}) relative to the maximum runout distance without the dam,
${X_{{\rm sto}{{\rm p}_{\rm 0}}}}$
, to the dam height *h*
_{d} relative to the thickness of the incident avalanche-flow *h*
_{0} as:

Here, *α* is the energy dissipation coefficient quantifying the dam efficiency. It is assumed to be constant and equal to 0.14 in the present study. Due to Eqns (2) and (9), *x*
_{stop}(*h*
_{d}) is also GPD-distributed when considering the runout shortening by energy dissipation.

This interaction law was initially developed by Faug and others (Reference Faug, Naaim, Bertrand, Lachamp and Naaim-Bouvet2003), further justified and verified by Faug and others (Reference Faug, Gauer, Lied and Naaim2008), and previously used for risk and optimal design computations by Eckert and others (Reference Eckert, Parent, Faug and Naaim2008, Reference Eckert, Parent, Faug and Naaim2009, Reference Eckert2012). It is expected to be valid when local dissipations of kinetic energy prevail, which are generally verified under two conditions: (1) fast dry snow avalanches (inertial regime) characterised by relatively high Froude numbers (5–10) and (2) a dam height not too high, in order to prevent the formation of shocks upstream of the dam. If the dam height is too high, typically *h*
_{d}/*h*
_{0} 5–11 for Froude numbers in the range 5–10, propagating waves are likely to be formed upstream of the dam, which may lead to large volumes of snow retained upstream.

A positivity constraint exists with this interaction law, i.e. *h*
_{d} <(*h*
_{0}/*α*). For higher dams, all avalanches are stopped. For instance, for an incident avalanche flow *h*
_{0} = 1 m, *h*
_{d} is in the [0 m, 7.14 m] interval. Another critical upper value for the dam height that avoids the formation of shocks upstream of the dam can also be determined according to the Froude number of the flow. In theory, this critical value can be lower or >*h*
_{0}/*α*. In this paper, however, we avoid this difficulty by investigating only Froude number ranges for which the minimal height for shock formation is >*h*
_{0}/*α*.

#### 2.2.2. Runout shortening by volume catch

Another interaction law relates the maximum runout distance downstream of the dam, *x*
_{stop}(*h*
_{d}) relative to the runout distance without the dam,
${X_{{\rm sto}{{\rm p}_{\rm 0}}}}$
, to the dam height. However, it is somewhat different because it is based on the idea that the runout shortening is mainly driven by the volume reduction. As a natural deposit, caused by friction with the bottom, is likely to occur with or without the presence of the obstacle (Faug and others, Reference Faug, Naaim and Naaim-Bouvet2004), the volume retained upstream of the dam is the sum of this natural volume due to friction, *V*
_{stop} and the volume retained by the obstacle only, *V*
_{obs}(*h*
_{d}), which depends on the dam height (Fig. 1). Specifically, under the assumption of a very slow avalanche (Froude number < 1), Faug (Reference Faug2004) proposed:

where *V* is the avalanche flow volume and *n* can be either 1/2 or 1/3, depending on the characteristics of the upstream storage zone (confined or not). For a confined storage zone, *n* = 1/2 is more suitable. Furthermore, the reasonable assumption that *V*
_{stop} is much smaller that *V*
_{obs} yields:

Due to Eqns (2) and (11), *x*
_{stop}(*h*
_{d}) is also GPD-distributed when considering the runout shortening by volume catch. Finally, by assuming that the volume *V*
_{obs}(*h*
_{d}) stored upstream of the dam roughly has a triangular shape forming a line inclined at constant slope *ϕ* with the horizontal, one can explicitly relate the retained volume to the dam height *h*
_{d} when the deposit zone upstream of the dam is confined and of constant width ℓ_{d}. However, the shape of the deposit *V*
_{obs} might depend on the snow type, i.e. dry snow versus more humid snow, so that one may expect two situations to occur, described by:

with *α*
_{s} = *ψ*
_{fz} − *ϕ*, where the length *L* of the deposit upstream the dam is *L* = *h*
_{d}/tan (*α*
_{s}), *ϕ* is the angle of snow deposit (i.e. the angle with the horizontal measured in the inverse trigonometric wise, that could be <0, e.g. Fig. 2a or ≥0, e.g. Fig. 2b) and *ψ*
_{fz} is the angle of the slope.

For humid snow (very slow flows), the friction coefficient, classically denoted as *μ* in the avalanche literature, should be high (e.g. Naaim and others, Reference Naaim, Durand, Eckert and Chambon2013), resulting in larger deposits with a deposit line above the horizontal plane. In contrast, dry cold snow should flow faster with a lower friction coefficient, resulting in longer deposits with a deposit line below the horizontal plane. All assumptions and notations regarding runout shortening by volume catch are outlined in Figure 2.

In practice, the volume stored upstream of the dam is smaller or equal to the incident avalanche volume leading to the constraint *h*
_{d} < (*V* × 2 tan (*α*
_{s})/ℓ_{d})^{1/2}. The positivity constraint associated with Eqn (11) then becomes:
$h_{\rm d}^{\rm 2} {\ell _{\rm d}} \lt 2V \times \tan {\alpha _{\rm s}}$
, which is equivalent to *h*
_{d} < (2*V*/ℓ_{dtan}
*α*
_{s})^{1/2}. For example, for an incident volume *V* = 50 000 m^{3}, *ϕ* = 0°, *ψ*
_{fz} = 10° and ℓ_{d} = 100 m, *h*
_{d} is in the [0, 18.7] interval.

All in all, these considerations highlight that the runout shortening according to volume catch relation is much more flexible than that regarding energy dissipation. Indeed, whereas in Eqns (9–12) an avalanche scenario is a flow depth and a volume, respectively, with the volume catch relation, one has, in addition, the deposit angle *ϕ* (value and sign) to specify, according to the snow type one considers.

### 2.3. Individual risk and optimal design based on its minimisation

#### 2.3.1. Specific risk

Among natural hazards, risk is broadly defined as an expected damage, in accordance with mathematical theory (e.g. Merz and others (Reference Merz, Kreibich, Schwarze and Thieken2010) for floods, Mavrouli (Reference Mavrouli2010) for rockfalls, Jordaan (Reference Jordaan2005) in engineering, etc.). Following the notation of Eckert and others (Reference Eckert2012), the specific risk *r*
_{z} for an element at risk z is:

where *λ* is the annual avalanche rate, i.e. the annual frequency occurrence of an avalanche, *p*(*y*) is the multivariate avalanche intensity distribution (runout, flow depth, etc.) and
${{\cal V}_{\rm z}}(y)$
is the vulnerability of the element z to the avalanche intensity *y*.
${{\cal V}_{\rm z}}(y)$
can be either a damage level or a destruction rate, depending if a deterministic or a probabilistic (relability based) point of view is adopted. By definition, the specific risk unit at the annual timescale is a^{–1}.

In accordance with our hazard and interaction law model specifications, we describe avalanche flow within a two-dimensional cartesian frame. In it, avalanche intensity *y* is classically defined by the joint distribution of the pressure *P* and the runout distance
${X_{{\rm sto}{{\rm p}_{\rm 0}}}}$
such as
$p(y) = p(P,{X_{{\rm sto}{{\rm p}_{\rm 0}}}})$
of pressure fields *P* and runout distances
${X_{{\rm sto}{{\rm p}_{\rm 0}}}}$
. The specific risk *r*
_{b}(*x*
_{b}) for the element b at the *x*
_{b} abscissa is then:

where the notation ‘.|.’ classically denotes a conditional probability. Notations *x*
_{b},
${{\cal V}_{\rm b}}$
and *r*
_{b} (indice b) indicate that the typical element at risk we consider is a building.

We consider only building abscissas such as *x*
_{b} > *x*
_{d}, a natural choice in practice (one would not build further up in the path for evident safety reasons), which makes the link with our POT approach. Hence, the *λ* avalanche rate in Eqn (14) can be assimilated to the occurrence rate in Eqn (1). Also, the over threshold *x*
_{b} > *x*
_{d} condition should appear in all risk equations (Eqn (14) and the following), but it is dropped, for simplicity.

#### 2.3.2. Residual risk and optimal design

The dam optimal design approach we consider minimises the long-term costs obtained by summing the construction costs and the expected damages for the building at abscissa *x*
_{b}. The underlying mathematical theory (Von Neumann and Morgenstern, Reference Von Neumann and Morgenstern1953; Raiffa, Reference Raiffa1968) has been adapted to avalanche engineering by Eckert and others (Reference Eckert, Parent, Faug and Naaim2008, Reference Eckert, Parent, Faug and Naaim2009), in analogy to the precursory work by Van Danzig (Reference Van Danzig1956) for maritime dykes in Holland and by Bernier (Reference Bernier2003) for river dams. Hence, the long-term costs with a protective dam *h*
_{d} are:

where *C*
_{1} and *C*
_{0} are, respectively, the value of the building at risk at abscissa *x*
_{b} in €, the monetary currency we work with, and the value of the dam per meter height, €.*m*
^{−1}. The actualisation factor to pass from annual to long-term risk is
$A = \sum\nolimits_{t = 1}^{ + \infty} {1/{{(1 + {i_{\rm t}})}^{\rm t}}} $
with *i*
_{t} the interest rate for the year *t*. The unit of the long-term costs *R*(*x*
_{b}, *h*
_{d}) is therefore €. The subscript notation ‘
$_{{h_{\rm d}}} $
’ in Eqn (15) denotes that runout and pressure distributions are now modified in the runout zone, conditional to the dam height *h*
_{d}. As a consequence, for a fixed *h*
_{d} value, the long-term costs correspond to the residual risk after the dam construction.

We stress that *R*(*x*
_{b}, *h*
_{d}) is nothing more than *C*
_{0}
*h*
_{d} + *C*
_{1}
*Ar*
_{b}(*x*
_{b}, *h*
_{d}), with *r*
_{b}(*x*
_{b}, *h*
_{d}) the specific residual risk at the annual timescale for the building at the abscissa *x*
_{b}, defined as Eqn (14) but with the dam height *h*
_{d}. This highlights that the approach remains individual risk based, with one single element at risk at abscissa position *x*
_{b}. Note also that the damages caused to the dam by successive avalanches and the consecutive reparation costs do not appear explicitly in Eqn (15). In fact, they are included in the *C*
_{0} evaluation through the definition of a suitable amortising period, a straightforward econometrical computation. Yet, a strong underlying assumption is made: in case an avalanche severely damages or even destroys the dam, the dam still reduces the hazard for this specific avalanche event according to Eqns (9) or (11), and is repaired immediately thereafter.

Strong simplifications occur if the additional assumption of a constant step vulnerability function is made. The worst-case scenario is that the damage is maximal as soon as the element at risk is attained, whereas the considered element at risk remains obviously undamaged if the avalanche does not reach its abscissa. The integral in Eqn (15) is then reduced to
$p({X_{{\rm sto}{{\rm p}_{{h_{\rm d}}}}}} - {x_{\rm d}} \gt {x_{\rm b}} - {x_{\rm d}})$
, the probability of exceeding the abscissa *x*
_{b} with a protective dam height *h*
_{d}, so that:

where
${F_{{h_{\rm d}}}}({x_{\rm b}} - {x_{\rm d}})$
is the cumulative distribution function of runouts in *x*
_{b} with a protective dam height *h*
_{d}. This is the key assumption to keep a fully analytical decisional model with our POT approach.

Equation (16) can first be regarded as a residual risk function that, for a fixed value of *h*
_{d}, varies according to the *x*
_{b} position. It is then a linear function of the non-exceedance probability
${F_{{h_{\rm d}}}}({x_{\rm b}} - {x_{\rm d}})$
showing the decrease of the residual risk in the runout zone as one goes further and further away downstream. This directly represents/illustrates the coupling of the interaction law with the probabilistic POT hazard model. Second, Eqn (16) can be regarded as total costs depending on the dam height *h*
_{d} at a fixed *x*
_{b} position, for instance a specific position of the runout zone, which has some legal meaning (such as the limit of a hazard zone), or a position where a real element at risk/building is situated. The optimal dam height from a stake holder's perspective is then simply:

where the function
$\arg \min $
gives, for a given *x*
_{b}, the height *h*
_{d} at which *R* is minimal.

#### 2.3.3. Explicit risk formulae with the energy dissipation interaction law

According to Eqn (9), under the constraint *h*
_{d} <(*h*
_{0}/*α*), one has

In other words, the random variable
${X_{{\rm sto}{{\rm p}_{{h_{\rm d}}}}}} - {x_{\rm d}}$
remains GPD distributed, with the same shape parameter *ξ* as
${X_{{\rm sto}{{\rm p}_{\rm 0}}}} - {x_{\rm d}}$
, but with the modified scale parameter *σ*(1 − *α*(*h*
_{d}/*h*
_{0})). The expression of the residual risk for the Poisson – GPD decisional model is straightforward:

#### 2.3.4. Explicit risk formulae with the volume catch interaction law

According to Eqn (11), under the constraint *h*
_{d} <(2*V*/ℓ_{d tan}
*α*
_{s})^{1/2}, one has this time

Hence, ${X_{{\rm sto}{{\rm p}_{{h_{\rm d}}}}}} - {x_{\rm d}}$ is once again still GPD-distributed, but this time with the modified scale parameter $\sigma {\left( {1 - \left( {{{h_{\rm d}^{\rm 2}} / {(2V/{\ell _{\rm d}}\tan {\alpha _{\rm s}}}})} \right)} \right)^{1/2}}$ , leading the residual risk:

where tan(*α*
_{s}) = tan(*ψ*
_{fz} − *ϕ*) and *ϕ* is arbitrary negative for dry snow avalanches and positive for humid snow avalanches, with the standard limit case *ϕ* = 0 (Fig. 2).

#### 2.3.5. Solutions to the risk minimisation problem

None of these risk equations provide analytical solutions to Eqn (17). As a consequence, this is where a numerical search is required, spanning, for a fixed *x*
_{b} position, the possible values of *h*
_{d}. With the energy dissipation law, this has already been demonstrated by Eckert and others (Reference Eckert, Parent, Faug and Naaim2008) for the Poisson – exponential case. For the volume catch interaction law, however, because of the higher complexity of the dependency of *R*(*x*
_{b}, *h*
_{d}) on *h*
_{d}, different typical cases can be encountered: no optimum, one ‘pseudo’ optimum due to the positivity constraint, and the ‘good’ case of a minimum residual risk arising as an optimal compromise between losses and construction costs. Yet, in the latter case, relative maximum residual risks can also be observed. These different cases are detailed in Appendix. For our application, we identified which of them occurred in all configurations we tested, and only dam heights truly minimising the risk were kept. These correspond to optimal compromises between construction costs and losses, but also to the pseudo optima, i.e. dam heights just sufficient to stop all avalanches before the considered building position.

### 2.4. Quantifying uncertainty and sensitivity: intervals, bounds and indexes

Since one objective of this paper is to quantify how risk estimates and optimal design values vary across runout tail distribution types and avalanche/dam interaction laws, we propose different intervals, bounds and indexes suitable for taking into account different types of uncertainty/variability. These intervals, bounds and indexes may be usable by engineers in risk zoning and defense structure design to represent sensitivity to available data resulting from parameter estimate standard errors, and/or sensitivity to non-probabilistic model uncertainty. They also have wider interest, being somewhat interpretable in terms of respective weight of the different ingredients of the decisional analysis.

With regard to the difference to be made between model parameters and their estimates on the basis of the available data, all risk computations are performed under the classical paradigm of statistical inference. This means that we plug the maximum full/profile likelihood estimates
$(\hat \lambda, \;\hat \xi, \;\hat \sigma )$
or
$(\hat \lambda, \;\hat \sigma ({\xi _0}))$
into the Poisson – GPD model, and we evaluate return levels and risk functions accordingly, considering
$R({x_{\rm b}},\;{h_{\rm d}},\;\hat \lambda, \;\hat \xi, \;\hat \sigma )$
or
$R({x_{\rm b}},\;{h_{\rm d}},\;\hat \lambda, \;\hat \sigma ({\xi _0}))$
. Here, and in all that follows, the notation *ξ*
_{0} indicates that the GPD shape parameter is chosen and that the profile likelihood is maximised conditionally to its choice.

#### 2.4.1. Propagating uncertainty on parameter estimates

To quantify the uncertainty resulting from the limited data sample available, the usual approach is to propagate parameter standard errors (Eqn (6)) up to the quantities of interest. Starting from the MLE for the Poisson – GPD model and the associated asymptotic variance-covariance matrix, different methods exist in the literature to evaluate confidence intervals for high-return levels. Appendix presents how the, arguably, two most common of them can be adapted to the profile likelihood case, where the shape parameter value *ξ*
_{0} results from a more or less arbitrary modelling choice rather than from inference.

#### 2.4.2. Bounds and sensitivity indexes to the runout tail shape

From a different perspective, to evaluate the influence of the runout tail shape, we evaluate Eqns (18) and (19) according to the range of *ξ*
_{0} values provided by the profile likelihood maximisation procedure, i.e. when *ξ*
_{0} takes diferent values in the range [−0.3, 1.3]. We do that without a dam, and also for a given dam height and interaction law. From this set of values (one for each *ξ*
_{0}), retaining the maximum and minimum risk value at each abscissa leads to risk bound functions of the abscissa, interaction law and dam height. They constitute plausible upper/lower bounds for the risk, taking into account the variability of risk estimates towards runout distribution tail types. To summarise the spread at the abscissa *x*
_{b}, the sensitivity index
${\delta _{R({x_{_{\rm b}}}, \;{h_{_{\rm d}}} )}}$
is evaluated:

with
$\overline {R({x_{\rm b}},\;{h_{\rm d}})} $
, the mean value evaluated at the abscissa *x*
_{b} with the dam height *h*
_{d}. With the different interaction laws at hand (energy dissipation and volume catch with varying deposit shape angles), different values of
${\delta _{R({x_{_{\rm b}}}, \;{h_{_{\rm d}}} )}}$
can be obtained.

To do a similar evaluation for the optimal design procedure, we also search for a given position *x*
_{b} and interaction law, the solution
$h_{\rm d}^{\ast} $
of Eqn (17) for each possible value *ξ*
_{0}. The solution spread towards runout tail shapes is quantified from the minimum, maximum and mean optimal height at the abscissa *x*
_{b}, denoted
$h_{\rm d}^{\ast} ({x_{\rm b}})$
as:

Finally, to confront risk and optimal design sensitivity to the *ξ*
_{0} choice, we evaluate the same sensitivity index function and interaction law as:

where
$R(h_{\rm d}^{\ast} ({x_{\rm b}}))$
denotes the minimum residual risk at the abscissa *x*
_{b} given
${h_{\rm d}} = h_{\rm d}^{\ast} ({x_{\rm b}})$
. Note that the latter index is somewhat different from that provided by Eqn (20) where *h*
_{d} was fixed once for all. This time, for each value *ξ*
_{0}, the dam height considered to evaluate the risk is different, as it is the one that locally minimises the residual risk.

#### 2.4.3. Bounds and sensitivity index to the avalanche/dam interaction law

Similarly, to evaluate the sensitivity to the choice of one interaction law instead of another, we evaluate, for a given runout tail (*ξ*
_{0} is fixed), abscissa *x*
_{b} and dam height *h*
_{d}, the spread between the possible risk estimates as:

where *IL* is the interaction law considered: the volume catch interaction law with various deposit angles plus potentially, the energy dissipation interaction law.

## 3. APPLICATION AND RESULTS

### 3.1. Case study

The case study selected is situated in the township of Bessans, French Alps. The runout zone is a gentle slope, making the use of a simple stochastic model for runout distances such as the POT-GPD possible. It is, up to now, free from permanent habitations, but, due to demographic pressure, may become urbanized in the future, provided risk is estimated to be low enough in the current state or after a permanent defense structure construction. Hence, we study the potential risk reduction by a dam at the abscissa *x*
_{d}, which corresponds to the beginning of the runout zone according to a classical slope criterion. During the 1973–2003 period, 28 avalanches exceeding *x*
_{d} were recorded by the local forestry service. The risk evaluation and sensitivity analysis is performed throughout the runout zone. However, for being less case-study dependant in our conclusions, specific positions of legal importance are studied, corresponding to return periods of 10 a–ka. Table 1 summarises the constants fixed through the whole work.

### 3.2. Fitted runout distance/return period relationships

#### 3.2.1. Without dam

The maximum likelihood method supplies estimates for the Poisson (
$\hat \lambda = 0.904$
) and the GPD parameters (Table 2). The likelihood ratio test rejects the exponential distribution to the benefit of the GPD distribution at the 5% significance level. The positivity of
$\hat \xi $
, indicates that the best fitted GPD distribution belongs to the Fréchet domain and has therefore a heavy tail. However, the maximum likelihood estimate
${\hat \xi _{MLE}}$
is close to 1.1, suggesting a tail so heavy that it should be viewed with distrust since *ξ* values >0.5 are known to be rare in environmental systems. Furthermore, the associated standard error is very high (Table 2). As a consequence, the high-return levels predicted on the basis of the MLE are presumably unrealistic and, anyhow, the associated confidence intervals provided by the two uncertainty propagation methods we have implemented are so large that they are practically useless (Tables 4, 5). These results highlight that it is not possible to fit a reliable runout tail for this case study on the basis of the data only.

Our profile likelihood approach introduces extra-data information into the analysis through the choice of a *ξ*
_{0} value, somewhat arbitrary, but at least in a realistic range. Figure 3a confirms that the likelihood of the data sample under the GPD model is flat around the MLE couple, so that a wide range of other couples may nearly be as suitable in terms of data fitting (Table 3). This is even clearer when the different fitted models are compared with the data (Fig. 3b). We note that the minimum negative log-likelihood increases with decreasing values of *ξ*
_{0}, suggesting a little more confidence in a heavy tail (positive shape parameter) than in other runout types (null or negative shape parameter; Table 3).

The *ξ*
_{0} choice, however, considerably impacts the estimated runout distance/return period relationship, for instance the high-return levels of interest for hazard mapping (Fig. 3c). The values of *ξ*
_{0} < 0.5 provide
${\hat x_{100}}$
−
${\hat x_{1000}}$
arguably plausible return levels from the perspective of an expert analysis of the path. In contrast, these are clearly too high for *ξ*
_{0} > 0.5, as expected with regard to the poor confidence we may have in *ξ*
_{0} values >0.5. As a consequence, in the following, we concentrate our analysis on *ξ*
_{0} = {−0.3; − 0.1; 0; 0.1; 0.3; 0.5}, i.e. on a range of plausible values containing the three different runout tail types, but with more weight on the heavy tail Fréchet type, according to the information the data seems to contain. Furthermore, in the same spirit, when a single value is required, we focus on *ξ*
_{0} = 0.3.

In more detail, one may note that the concave/convex shape of return level plots with positive/negative *ξ*
_{0} values, respectively, makes return levels higher in the Weibull domain (*ξ*
_{0} < 0) for ‘low’ return periods, but much higher in the Fréchet domain (*ξ*
_{0} >0) for high-return periods. For the same shape parameter absolute value |*ξ*
_{0}|, the Frechet/Weibull return level plots cross on the straight line corresponding to the exponential case (*ξ*
_{0} = 0, leading to a linear behaviour in log scale). For our case study, this crossing is obtained for return periods of 50–500 a, depending on |*ξ*
_{0}|.

Regarding return level confidence intervals due to parameter uncertainty, Tables 4, 5 illustrate how the two methods detailed in Appendix perform in the case for
${\hat x_{10}}$
and
${\hat x_{100}}$
. Both approaches show well that the uncertainty becomes higher for increasing return periods, a classical and intuitive result. Also, for high-return periods, the uncertainty explodes for very high *ξ*
_{0} values, in accordance with what was already observed for the MLE.

More interestingly, the delta approach does not provide return level confidence intervals for negative shape parameters, and leads to unrealistically large return level confidence intervals for slightly positive shape parameters (the zero case seems trustworthy since the computation is performed with the exponential likelihood rather than with the GPD one). These problems, related to the variance covariance matrix approximation, do not show with the deviance-based approach, for which plausible return level confidence intervals are evaluated for all *ξ*
_{0} values tested. In addition, even for very high *ξ*
_{0} values, the high-return level confidence intervals provided by the deviance approach are much narrower than with the delta approach. These advantages are attributable to the fact that the deviance approach does not impose symmetry for return level confidence intervals. Hence, all in all, the deviance-based method seems to perform much better than the delta method in the profile likelihood context.

Finally, in Tables 4, 5, the
${\hat \xi _{MLE}}$
column provides return level confidence intervals with *ξ*
_{0} set to the MLE in the profile likelihood maximisation. If *ξ* is not set, with both approaches, the confidence interval is much larger, which illustrates well the additional uncertainty resulting from having one more free parameter to estimate (or, in contrast, the uncertainty reduction with an ‘arbitrary’ choice of *ξ*
_{0}). For example, with the deviance approach (in that case, a more classical full likelihood uncertainty propagation), the confidence intervals for
${\hat x_{10}}$
(respectively
${\hat x_{100}}$
) is
$C{I_{{{\hat x}_{10}}}} = [1586,\;1707.8]$
(respectively
$C{I_{{{\hat x}_{100}}}} = [1762.6,\;3714.6]$
) when the uncertainty on
${\hat \xi _{MLE}}$
is taken into account, i.e. intervals much larger than those displayed in Table 5.

#### 3.2.2. With a fixed dam height

Figure 4 shows the impact on the return level plots of the two interaction laws (and of the deposit shape angle for the volume catch interaction law) for different dam heights and GPD parameterisations. Logically, for both interaction laws, return levels decrease for increasing value of the dam height *h*
_{d}, which simply illustrates the ability of the dam to reduce the hazard in the runout zone. Furthermore, for a fixed GPD parametrisation and dam height, the energy dissipation law generally evaluates a higher return period for a given path abscissa than the volume catch interaction law. This suggests that the dam is more efficient in protecting potential elements at risk under the assumption of a dam/avalanche interaction governed by energy dissipation rather than by volume catch. An exception to this rule, however, is observed for the ‘extreme’ deposit angle shape *ϕ* = 9° (just below the 10° local slope, which is its maximal possible value), i.e. the case catching the highest volume of snow behind the dam. For instance, in the case where *h*
_{d} = 6 m, ℓ_{d} = 100 m and *ϕ* = 9° (Fig. 4b), all avalanches are stopped by the dam, whereas, with a similar dam height, a few exceedances are still observed with the energy dissipation law. This highlights well the higher flexibility of the volume catch interaction law due to the additional parameter *ϕ*.

Regarding the influence of *ξ*
_{0} in Figure 4, the crossing of the different return level plots on the exponential straight line for the same |*ξ*
_{0}| values occurs for return levels that slightly decrease with the dam height. This traduces that all interaction laws and dam heights impact the scale of the runout distance distribution only:
${X_{{\rm sto}{{\rm p}_{{h_{\rm d}}}}}} - {x_{\rm d}} \gt {x_{\rm b}} - {x_{\rm d}}$
remain always GPD distributed with *ξ*
_{0} shape parameter whatever the dam height and interaction law considered.

### 3.3. Residual risk estimates

#### 3.3.1. Influence of the GPD *ξ*
_{0} shape parameter

According to Eqn (16), residual risk is a linear function of exceedance probability, so that most noticeable features in residual risk plots directly derive from what is observable on return level plots. For instance, Figure 5 shows the influence of the dam height *h*
_{d} on the risk reduction with a fixed *ξ*
_{0} shape parameter, whereas Figure 6 illustrates, with a constant dam height, the influence of the GPD parametrisation, with the *ξ*
_{0} parameter taken in the [−0.3, 0.5] interval.

In Figure 5, with both interaction laws, the residual risk reduction as a function of the dam height increase is clear, for example, for a building situated at a position corresponding to the centennial runout without a dam (*x*
_{b} = 1718.4 m) and the energy dissipation law, from 74 993 € with no dam to 57 201 € with *h*
_{d} = 1 m, 35 124 € with *h*
_{d} = 3 m and 33 676 € with *h*
_{d} = 5 m.

In Figure 6a, the GPD shape parameter influence is also clear: the Fréchet-type values tested (*ξ*
_{0} > 0) provide the lowest residual risk estimates for buildings situated just above the dam abscissa but lead, by far, to the highest risk estimates further down the path, and vice versa for the Weibull-type values (*ξ*
_{0} < 0). The exponential case where *ξ*
_{0} = 0 provides intermediate residual risk estimates, and, for one given |*ξ*
_{0}|, all estimates are the same only for the abscissa position at which the Fréchet and Weibull-type return level plots cross the exponential straight line.

Figure 6b summarises, for the same constant dam height and the two interaction laws, the variability of risk estimates towards runout distribution tail types, i.e. in the plausible *ξ*
_{0} range [−0.3, 0.5], slightly positive on average. The resulting lower and upper risk bounds may be very valuable insights for practice. For example, for *h*
_{d} = 6 m and the energy dissipation law, the residual risk is estimated to be in the interval [33 180, 37 389] € for a building situated at a position corresponding to the centennial runout without dam (and *ξ*
_{0} = 0.3). The width of the inter-bounds interval depends on the position in the path: it is minimal for ‘intermediate’ abscissas where the different risk curves lead to similar estimates, and is much larger when Fréchet/Weibull-type risk estimates strongly diverge.

The *δ*
_{
R(x
b,
h
d
)
} sensitivity index (Eqn (20)) more quantitatively ascertains the spread of risk bounds towards *ξ*
_{0} values. Figure 6c shows that, as a function of building position and interaction law, the relative difference between risk estimates can be as high as 200%. This indicates that considerable errors can be made if the *ξ*
_{0} value for which the risk is minimal is chosen instead of the one maximising the risk at the considered abscissa, and vice versa. For each interaction law, *δ*
_{
R(x
b,
h
d
)
} has two modes as a function of *x*
_{b}. The first (closer to *x*
_{d}) corresponds to the position where Weibull type estimates are the highest with regard to Fréchet-type estimates, and the second mode, further down in the path, to the opposite case. For very high abscissas, all estimates drop to zero, eventually reducing the sensitivity to the runout tail shape. The local minimum between the two modes in *δ*
_{
R(x
b,
h
d
)
} corresponds to the region in the path previously discussed where all risk estimates are similar (e.g. abscissa where risk lines are crossing in Fig. 6a).

#### 3.3.2. Influence of the interaction law and of the *ϕ* deposit shape angle

For all dam heights, the energy dissipation interaction law predicts a strong risk reduction with regard to the no-dam case. Residual risk drops sharply for abscissas just above the dam and this effect is all the more marked when the dam is high. With a standard deposit shape angle *ϕ* = 0°, the volume catch interaction law predicts a much weaker risk reduction for a given dam height, with residual risk estimates dropping at much lower pace as one goes further down in the path (Fig. 5a). The only exception to the higher efficiency of the energy dissipation interaction law occurs for ‘extremal’ volume storages, for example, with *ϕ* = 9° in Figure 5b. In that case, with moderate dam heights (1–3 m), the two interaction laws lead to rather similar risk estimates and, for *h*
_{d} = 6 m, the volume catch interaction law predicts an even higher risk reduction since all avalanches are stopped before or at the dam abscissa. As a consequence, in general, for a given abscissa in the path, low and high risk bounds obtained towards possible runout tails are much higher for a given dam height with the volume catch law than with the energy dissipation law (Fig. 6b). Also the pattern in resulting sensitivity index is shifted to the right with the volume catch interaction law, with higher values further down in the path (Fig. 6c).

To further quantify the effect of *ϕ* on the risk estimation, Figure 7 systematically investigates the *h*
_{d} = 5.5 m and ℓ_{d} = 50 m case, which stays within the validity range of the two interaction laws for all *ϕ* values (for the volume catch interaction law, the limit height is 5.9 m with *V* = 50 000 m^{3}, *ϕ* = 9° and ℓ_{d} = 50 m). As expected, the residual risk increases when the deposit shape angle becomes increasingly negative and hence, the dam, under the volume catch interaction law, becomes less efficient. For this 5.5 m dam height, for which none of the interaction laws is able to stop all avalanches, the energy dissipation interaction law remains the most optimistic regarding the beneficial action of the dam. Risk estimates provided by the volume catch interaction law become close to the energy dissipation law only with the maximal *ϕ* = 9° value, and much higher with ‘less optimistic’ lower deposit shape angles (Fig. 7a).

From the set of risk curves of Figure 7a, for each position in the path, two risk bound couples can be built: the first considers the minimum and maximum risk estimates with the volume catch interaction law according to the variability on *ϕ* only (Fig. 7b(i)).The second takes into account, in addition, the minimal risk value provided by the energy dissipation interaction law (Fig. 7b(ii)). In other words, due to the higher efficiency postulated by the energy dissipation law, upper risk bounds are the same in the two cases, whereas lower bounds differ sightly. For example, without considering the energy dissipation law, the residual risk is estimated to be in the interval [35 172, 104 233] € for a building situated at a position corresponding to the centennial runout without dam (with *ξ*
_{0} = 0.3). With the inclusion of the energy dissipation law in the bounds definition, it is in the interval [31 808, 104 233] €.

The resulting sensitivity to the interaction law index *δ*′_{
R(x
b,
h
d
)
} (Eqn (23)) evaluated all over the runout zone ascertains that a maximal error of 130% (including the energy dissipation law)/105% (with the volume catch interaction law only) can be made on the risk quantification if the interaction law chosen is wrong in terms of postulated mechanism and/or deposit shape angle. As for the sensitivity to the GPD parametrisation, the width between these risk bounds and hence the *δ*′_{
R(x
b,
h
d
)
} sensitivity index is small for buildings very close to the dam (highly exposed), as well as very far down in the path (positions reached by the most extreme avalanches only). Sensitivity to interaction law is therefore maximal for buildings situated at ‘intermediate’ abscissa positions (Fig. 7c).

### 3.4. Optimal dam heights

#### 3.4.1. Influence of the shape parameter *ξ*

Since the building position in the risk minimisation is fixed, four positions are chosen: the minimal and the maximal decennial and centennial abscissas provided by these possible parameterisations without dam, that is to say {1600 m, 1690.6 m, 1718.4 m, 1765.2 m}. For these, Figure 8 shows the obtained residual risk curves, as functions of the dam height *h*
_{d}, with the energy dissipation law. For each curve, the optimal height minimising the risk is highlighted. It is more or less clear, depending on the abscissa position *x*
_{b} and the *ξ*
_{0} value considered, that a minimum can well be found on the range of *h*
_{d} values allowed by the positivity constraint. As intuitively expected, optimal dam heights are higher for buildings situated closer to the dam than for buildings located further down in the path, since it is economically more sound to protect more exposed elements at risk. Also, for very high dam heights, the risk converges to the construction cost *C*
_{0}
*h*
_{d}. This occurs as soon as the dam is high enough to stop all avalanches before the considered building abscissa, making the additional construction effort unnecessary. The same evaluation can be done considering the volume catch interaction law instead of the energy dissipation law. At this stage, we consider *ϕ* = 9°, ℓ_{d} = 100 m and *V* = 50 000 m^{3}, i.e. parameter values for which the dam is ‘efficient’ so that it is easier to determine optimal heights minimising the residual risk. This is not always the case with this interaction law (next subsection).

Table 6 summarises optimal dam heights and associated risk estimates
$R({x_{\rm b}},\;h_{\rm d}^{\ast} )$
for the two interaction laws. At first glance it appears that Fréchet like positive *ξ*
_{0} values lead to higher optimal heights and higher corresponding minimum estimates in comparison with those using Weibull- or Gumbell-like *ξ*
_{0} values. This conclusion reflects the fact that heavy tailed GPD distributions forecast more extreme avalanches than the two other tail types. This makes higher constructions economically advantageous, but the remaining risk after dam construction still higher. Note that the increase with *ξ*
_{0} is very clear with the energy dissipation interaction law, and somewhat less clear with the volume catch interaction law. This is attributable to the fact that with the advantageous volume catch parameters used here, low dam heights are already quite efficient. For instance, the 4.18 m limit height is sufficient to stop all avalanches, and it is economically sound to construct up to this height for many of the *ξ*
_{0} and *x*
_{b} values tested.

The parameters are ℓ_{d} = 100 m and *ϕ* = 9°. With these, the maximal dam height is 7.14 m with the energy dissipation law and 4.18 m with the volume catch one.

To confirm this shape parameter effect, previous calculations were generalized, with the energy dissipation law, to a large range of building positions (Fig. 9) and to a quasi continuous sample of *ξ*
_{0} values (Fig. 10), retaining in each case
$h_{\rm d}^{\ast} $
and
$R({x_{\rm b}},\;h_{\rm d}^{\ast} )$
. Overall, results illustrate very clearly that, for a given building position, the higher *ξ*
_{0}, the higher the optimal dam height and corresponding minimum risk. It also appears that the differences in optimal dam heights and corresponding residual risks obtained with different *ξ*
_{0} values strongly increase with increasingly high *x*
_{b} positions up to very high *x*
_{b} values. For example, Figure 9a illustrates the results of the optimisation procedure all along the path with a typical Fréchet-type choice (*ξ*
_{0} = 0.3) the symmetrical Weibull-type choice (*ξ*
_{0} = −0.3) and the intermediate Gumbel-type case (*ξ*
_{0} = 0). Fréchet-type optimal heights and corresponding risks estimates are systematically higher than Gumbel-type ones, themselves systematically higher than the Weibull-type ones, and these differences increase with *x*
_{b}. The same conclusions still hold with the volume catch interaction law, even if the decreasing pattern is weaker (Fig. 9b). Difference in tail types especially affects the most extreme return levels and as a consequence, the design choices controlled by these. Note however that for *x*
_{b} values so high that they are ‘never’ reached by avalanches, the optimal height and the associated residual risk logically drop to zero. This occurs for lower *x*
_{b} abscissas when *ξ*
_{0} is low (e.g. *ξ*
_{0} < 0.1) than when *ξ*
_{0} is high (e.g. *ξ*
_{0} ≥ 0.1) in our range (Fig. 10).

In terms of optimal design sensitivity indexes
${\delta _{{x_{\rm b}},\;R(h_{\rm d}^{\ast} )}}$
and
${\delta _{{x_{\rm b}},\;h_{\rm d}^{\ast}}} $
, values lower than for the risk sensitivity indexes *δ*
_{
R(x
b,
h
d
)
} and *δ*′_{
R(x
b,
h
d
)
} are obtained. Still, they remain quite high, up to 120% with the energy dissipation law and 40% with the volume catch interaction law, depending on the *x*
_{b} position (Fig. 9c). Hence, optimal dam heights and associated minimum risk estimates can be badly appraised, by a factor two if a wrong *ξ*
_{0} value is considered, for instance at high (obviously, not too high to be unattainable) abscissas in the path, where the sensitivity to the tail behaviour is the highest. Finally the scatter plot of the two indexes (Fig. 9c) shows that the *ξ*
_{0} choice is slightly more influential on the optimal design than on the corresponding risk estimate, but this effect is not very marked.

#### 3.4.2. Influence of the interaction law

Figure 11 shows the residual risk curves as a function of the dam height *h*
_{d} for various deposit shape angles. Whereas things were rather simple with the energy dissipation law (Fig. 8), here, as a result of the higher complexity of the volume catch interaction law, many cases are likely to occur. First, green squares (+; Fig. 11) are optimal heights resulting from the positivity constraint in the interaction law. Second, for the abscissa cases of Figures 8b–d, it is observed that, for the lowest deposit shape angles tested, the risk curves never stop increasing: the cost of the dam is then always high enough to dominate the total cost. Such curve shapes induce an optimal height equal to zero (black asterisk; *; Fig. 11), which never occured for the same abscissas with the energy dissipation law (Fig. 8). Third, red dots (
$ \bullet $
; Fig. 11) denote ‘true’ optimal heights resulting from the residual risk minimisation on a dam height range where the risk derivative exists. Finally, for highly negative deposit shape angles and low abscissas in the path (− 40° and − 20°; Fig. 11a), the risk decreases over a very large *h*
_{d} range and the maximal value allowed by the positivity constraint is very high. In that cases, we have stopped the analysis at 30 m, assuming that higher dams would not be allowed for environmental or technical reasons, even if they would apparently be sound from a purely economical perspective. Such limits, rather than true optimal dam heights, are all equal to 30 m. They appear as black triangles (#; Fig. 11).

To fully quantify the sensitivity of the optimal design and corresponding minimum risk estimate to the interaction law, Figure 12 spans a large set of building positions and deposit shape angles with the deposit volume interaction law, and the energy dissipation law is also considered. Figure 12a shows that with the deposit volume interaction law, for each deposit shape angle *ϕ*, an abscissa *x*
_{b} in the path can be found where the optimal dam height drops brutally from a high
$h_{\rm d}^{\ast} $
value to zero, whereas the residual risk switches to the baseline risk without the dam. This behaviour comes from the fact that, with the deposit volume interaction law, for high abscissas, strictly increasing risk curves are always obtained where the dam construction cost dominates the risk reduction due to the dam protective effect. The path position at which this optimal height drops to zero is observed to decrease with *ϕ*, since a lower value of *ϕ* implies a less efficient dam.

More generally, Figure 12a confirms that, for a given GPD parametrisation, when the optimal dam height exists, except for the highest *ϕ* value tested, it is higher with the volume catch interaction law than with the energy dissipation law, and that the corresponding remaining risk is higher as well. These effects are due to the generally lower risk reduction for a given dam height with the volume catch interaction law, except when *ϕ* is close to its maximal possible value. This is all the more true when *ϕ* is low, making the dam less efficient. For example, at the centennial abscissa *x*
_{b} = 1718.4 m (*ξ*
_{0} = 0.3), optimal heights and corresponding minimum risk are 0 m (no optimum) and 75 800 € (baseline risk) with *ϕ* = −40°, 10.6 m and 59 500 € respectively, and 4.6 m and 30 300 € with the energy dissipation law. In contrast, for *ϕ* = 9°, optimal height (4.18 m) and corresponding risk (23 100 €) are lower than with the energy dissipation law, since the limit height that stops all avalanches is reached.

Finally, Figure 12b shows the spread of the optimal dam height, when it exists, as a continuous function of the deposit shape angle and the building position, with, as written above, a maximal optimal dam height set to 30 m. For low deposit shape angles, say *ϕ*< − 10°, this maximal 30 m value is easily attained, but as the dam is weakly useful, it is rapidly (i.e. when one goes down in the path) observed that no protection is economically more advantageous than a huge dam. This (black; Fig. 12b) no-optimum domain, where the best economical choice is *h*
_{d} = 0 m, begins at abscissa 1625 m for *ϕ* = −40°, at abscissa 1662 m for *ϕ* = −20° and at abscissa 1677 m for *ϕ* = −10°. For higher deposit shape angles, the no optimum area becomes increasingly narrower, and the maximal optimal height decreases. As a limit case, for *ϕ* = 9°, the optimal height exists all over the investigated *x*
_{b} range, but it is very small (4.18 m, as written above, even smaller than the optimal height provided by the energy dissipation law at the same abscissa).

This lastly illustrates the higher complexity of the volume catch interaction law. With the energy dissipation law, high optimal dam heights are found for abscissa positions close to the dam and, the higher the dam, the higher its efficiency in reducing the risk, so that
$h_{\rm d}^{\ast} $
smoothly tends to zero with *x*
_{b}. In contrast, with the volume catch interaction law,
$h_{\rm d}^{\ast} $
is controlled primarily by *ϕ* rather than by *x*
_{b}. Low values close or equal to the limit value due to the positivity constraint correspond to the highest *ϕ* value and the risk reduction is important, whereas very high
$h_{\rm d}^{\ast} $
values can be obtained over a large range of positions in the path for low *ϕ* values. The dam is then rather inefficient in reducing risk, but still economically sound, before rapidly dropping to zero as soon as construction is no longer justified.

## 4. DISCUSSION AND CONCLUSION

### 4.1. Summary of the work done and possible extension

In snow avalanche long-term forecasting, existing risk and optimal design methods are computationally intensive and, therefore rarely used in a real engineering context. In addition, they ground on discussible assumptions for hazard modelling, for instance, regarding the distribution of extreme runouts, and their interaction with defense structures. In this work, we addressed these limitations by expanding a pre-existing quasi analytical decisional model (Eckert and others, Reference Eckert, Parent, Faug and Naaim2008) to make it usable with much wider classes of avalanche runout models based on extreme value statistics and of avalanche/defense structure interaction laws.

Specifically, we replaced the classical exponential runout model by the more general Generalized Pareto model. Coupled with a Poisson model for occurrences, the Pareto model has theoretical justifications that promote its use for modelling ‘all’ possible tails of distributions. This is a huge advantage that should make it sufficient for determining high return period events and perform risk and optimal design computations on most of the avalanche paths. Indeed, whereas the exponential distribution may fit runout data on runout zones having a regular topography compatible with a light tail behaviour only, the GPD distribution may cope also for bounded or heavy tailed runout distance distributions controlled by more complex/irregular topographies. However, when the runout zone topography is really extravagant, even the GPD may fail, and a statistical-numerical approach should be prefered (Section 4.4, below).

Regarding the defense structure, a simple flow-dam law based on local dissipation of kinetic energy was compared with a more flexible law based on the volume stored upstream of the dam. The energy dissipation interaction law provides a formula linking the runout distance in the path without a dam to the runout with a dam of height *h*
_{d}, depending on only the height of the flow *h*
_{0}. The volume catch interaction law provides the same output, but depending on the deposit volume upstream the dam and on the total volume of the avalanche. Intricately, the stored volume value of *V*
_{obs}(*h*
_{d}) not only depends on the dam height but also on the dam width and on the shape angle of the deposit upstream the dam. It is noted that, as reported in Figure 1, the deposit shape angle can be related either to the humidity rate of the snow, the velocity of the avalanche and/or the *μ* frictional effect. As a consequence, the volume catch interaction law is more flexible, allowing a more insightful inclusion of the avalanche behaviour one considers the analysis.

Combining these elementary steps, we have obtained simple risk formulae to quantify risk and perform the optimal design of an avalanche dam in a quick and efficient way that covers a variety of situations corresponding to different path topographies (tail types) and/or types of snow (deposit shape angles). From these, we showed how a detailed uncertainty propagation and sensitivity study (data quantity, stochastic avalanche modelling and flow/obstacle interaction assumptions) can be conducted, leading to intervals and bounds for risk estimates and optimal design choices. Practical implementation has been made on a typical case study from the French Alps, illustrating the approach and allowing us to more broadly discuss and evaluate the sensitivity of risk quantification and minimisation procedures for avalanche hazard modelling choices.

A somewhat criticisable point of the approach is that we used an extremely rough quantification of the costs. We did this to obtain analytical equations of the dam height and the stochastic hazard model. In fact, analytical solutions exist as soon as the residual risk can be written as:

where *k*
_{p} is a proportionality coefficient. Hence, the approach works as soon as the damage is supposed not to vary with avalanche intensity (pressure, flow depth, etc.). In Eqn (16), we considered the worst-case: *k*
_{p} = *C*
_{1}
*Aλ*, i.e. a total *C*
_{1} loss as soon as the building of value *C*
_{1} at the abscissa *x*
_{b} is attained. This is compatible with an economical point of view saying that a building loses all of its value as soon as it has been hit one time by an avalanche because nobody will be ready to buy it afterwards. More generally, it may provide a useful upper bound to stand within full approximation.

However, implementing other choices more compatible with data regarding damages by avalanches to various types of constructions is straightforward, for example, ${k_{\rm p}} = A\lambda {C_1}\overline {\cal V} $ with $\overline {\cal V} = \!{\int} p(y){{\cal V}_{\rm b}}(y)\;{\rm d}y$ the average vulnerability towards the whole range of avalanche intensities that can be derived from the vulnerability curves of, for example, Favier and others (Reference Favier, Bertrand, Eckert and Naaim2014a). In practice, $\overline {\cal V} $ may be roughly in the [0.05, 0.5] interval, depending on the considered building technology and local hazard distribution, leading to residual risk estimates systematically lower than those provided by our worst case approach.

Also, the *A* actualisation factor was used to obtain finite total risk estimates on the long range, but there is nothing against working at the annual timescale instead, as often done in risk assessment methods in the snow avalanche field (e.g. Keylock and others, Reference Keylock, McClung and Magnusson1999). This only requires transforming the total construction cost *C*
_{0}(*h*
_{d}) into an annual construction cost *C*′_{0}(*h*
_{d}) = *C*
_{0}(*h*
_{d})/*A*. This shows that the actualisation factor is interpretable, with our simple risk/costs expression, as an amortising period for our dam.

Eventually, Eqn (24) highlights well that the approach, even if originally designed as individual-risk based (Arnalds and others, Reference Arnalds, Jonasson and Sigurdsson2004), should rather be seen as ‘local-risk’ based: risk is evaluated and minimised with regard to the abscissa *x*
_{b}, without considering elements at risk possibly located at other positions in the path, but with possible consideration of many elements at risk together at the abscissa *x*
_{b} as soon as they can be combined into a single *C*
_{1} value. For instance, here, only damages to a building were studied, but similar computations could easily be performed with furniture or even humans inside the building that would be considered as elements at risk. For the latter, recent developments relating lethality rates to avalanche impacts could be used (Favier and others, Reference Favier, Eckert, Bertrand and Naaim2014b). However, this would also imply monetising human life, and we prefer to avoid this ethically contestable issue at this stage.

### 4.2. Main findings of the sensitivity analysis

Despite the theoretical interest of the GPD distribution with regard to simpler distributions (modelling ‘all’ possible tails of extreme avalanche runouts), the case study has shown the difficulty to practically fit it on real runout data. Specifically, it was impossible to obtain a realistic shape parameter estimate by simply maximising the likelihood of the data sample at hand. We strongly believe that this may occur more often than not for avalanche runout data. Since the shape parameter is specifically the one that fully determines the tail behaviour type (Fréchet, Gumbel or Weibull), this may cause huge miss-specification of high return levels, and therefore induce a bad assessment of the related risk. Here, we have proposed a practical way to tackle the difficulty: implement a profile likelihood maximisation method, given a reasonable set of possible shape parameters containing the different tail types (for our case study, [−0.3, 0.5], with a preferred value *ξ*
_{0} = 0.3), and consider the whole range of return level plots this set leads to within a sensitivity analysis in (residual) risk estimation and optimal design of a defense structure. Also, for the defense structure effect, it is, in practice, not easy to make a single choice between the two we considered and, for the deposit volume one, to select which deposit shape angle/snow type should be preferred. Furthermore, it can even be reasonably argued that risk mapping/defense structure design should be efficient according to all possible interaction processes/laws, so that making land use planning decisions on the basis of one single snow type may be contested. We therefore addressed this question as well within the sensitivity analysis, with the goal of having a comprehensive picture of the sensitivity to the different assumptions made in hazard modelling (the way the flow interacts with the structure is included in the hazard modelling).

In summary, the risk sensitivity to the GPD shape parameter was assessed as being a bit more influential with regard to the interaction law choice: up to 200% relative error according to Eqn (20), versus up to 130% relative error according to Eqn (23). However, these sensitivity indexes are both very high, and of the same order of magnitude. We conclude that the statistical distribution of runouts (and, e.g. the tail type), as well as the interaction law, are both important if one wants to properly estimate the residual risk in the runout zone according to a given dam height. In addition, the two sensitivity indexes *δ*
_{
R(x
b,
h
d
)
} (Eqn (20)) and *δ*′_{
R(x
b,
h
d
)
} (Eqn (23)) showed more (the former) or less (the latter) complex behaviours according to the abscissa position in the path, but both took their highest values for abscissa positions of interest for hazard mapping/zoning procedures. Indeed, modelling assumptions, for instance the tail behaviour, most strongly affect high magnitude events but become insignificant at abscissa almost never reached by avalanches. As a consequence, the very high sensitivity to hazard modelling assumptions we have highlighted may well be critical in practice for engineers and stakeholders concerned with land-use planning decisions. This is a good argument to recommend the bounds approach we have proposed instead of working on the basis of a single estimate that may be far from the true risk.

Then, a sensitivity study was conducted for the decisional procedure. Here also, sensitivity to the *ξ*
_{0} GPD shape parameter choice has been shown to be high whatever the considered interaction law. For instance, the higher *ξ*
_{0}, the higher the optimal height, and the higher the remaining residual risk after the dam construction. Furthermore, we highlighted that the sensitivity to *ξ*
_{0} measured by the decisional sensitivity indexes
${\delta _{{x_{\rm b}},\;h_{\rm d}^{\ast}}} $
(Eqn (21)) and
${\delta _{{x_{\rm b}},\;R(h_{\rm d}^{\ast} )}}$
(Eqn (22)) is also especially high (up to
$120\% $
) for buildings situated far down in the path, but still sometimes reached by avalanches. Regarding the sensitivity of the optimal design procedure to the interaction law choice, it was first shown that the volume catch interaction law has a less stable behaviour than the energy dissipation law, because of its higher number of parameters and more complex dependency on *h*
_{d}. Hence, the higher flexibility of the volume catch law and especially, its ability to better reflect the variability of the nature of the flowing snow, has a practical drawback: the optimal design procedure is more difficult to carry out, with different cases needing to be carefully accounted for.

Meanwhile, it was possible to show that the lower the deposit shape angle *ϕ*, the higher the optimal dam height, when it exists, but the higher the residual risk after the dam construction. This simply comes from the fact that the lower the deposit shape angle one considers, the less efficient the dam is in reducing the risk. Because of this effect, for nearly all possible *ϕ* values,
$h_{\rm d}^{\ast} $
is a strongly discontinuous function of *x*
_{b}. The position in the path beyond which an optimal height no longer exists increases with the deposit shape angle, until disappearing (on the range of reasonable building positions *x*
_{b} considered) for the maximal possible value *ϕ* = 9°. For the latter, the dam is the most efficient, making its construction nearly always rewarded by a cost reduction up to, for example, 4.18 m for ℓ_{d} = 100 m, the limit value that stops everything. It is the only deposit volume interaction law parametrisation for which a given dam height is more efficient in reducing the risk than with the energy dissipation law. For all other *ϕ* values tested, and whatever the position in the path, the optimal height (when it exists) and the remaining risk are higher with the volume catch law.

All in all, risk and optimal design sensitivity to hazard modelling assumptions regarding the behaviour of extreme runout and the perturbation of the flow by a permanent defense structures seem to be both very strong. Even if more case studies may be needed to be fully affirmative, this may well be true for a large variety of avalanche paths, and even for a range of defense structure and flow/structure interaction processes much wider than those considered in this study. It is a very important outcome for practice, which somewhat differs from what is observed regarding sensitivity to vulnerability/costs. Indeed, according to theoretical (Abraham and Cadre, Reference Abraham and Cadre2004) and practical (Favier and others, Reference Favier, Eckert, Bertrand and Naaim2014b) evidence, rough vulnerability/cost estimates may be sufficient to determine the defense structure that minimises the risk even if the true risk is then badly estimated. Here, in contrast, we have shown that both risk and optimal design evaluations will fail in producing sensible results if hazard modelling assumptions are even slightly fallacious.

### 4.3. Modelling variability and uncertainty in risk and optimal design procedures

The sensitivity/uncertainty analysis has been carried out through various methods. First, a classical uncertainty propagation approach has been implemented to derive confidence intervals for high-return levels from the Poisson-GPD point estimates and the related standard errors. We have adapted two approaches to our profile likelihood context and shown that, for it, the deviance-based approach may be the most robust. Second, we considered a reduced range of *ξ*
_{0} values and, conditional to these, plugged the point estimates for the other Poisson-GPD model parameters provided by the profile likelihood maximisation in the residual risk functions. At this stage, we ignored the data quantity related uncertainty (parameter standard errors), focusing on the sensitivity to *ξ*
_{0} in risk and optimal design approaches through the indexes *δ*
_{
R(x
b, h
d)},
${\delta _{{x_{\rm b}},\;h_{\rm d}^{\ast}}} $
and
${\delta _{R({x_{\rm b}},\;h_{\rm d}^{\ast} )}}$
.

Yet, such a two-step approach is somewhat contestable, since it is conceptually more satisfactory to take the parameter uncertainty in account into the sensitivity analysis. A possible way to achieve this would be to switch to a Bayesian approach, averaging the residual risk functions over the *posterior* distribution of model parameters and evaluating the optimal dam heights and sensitivity indexes accordingly. Conditionally upon *ξ*
_{0}, the approach could have been partly implemented analytically thanks to conjugation properties (Parent and Bernier, Reference Parent and Bernier2003a, Reference Parent and Bernierb). However, residual risk functions would then have been no longer fully explicit, which is the main reason we preferred working under the classical paradigm in this work. Furthermore, the limitation of working conditionally upon *ξ*
_{0} thus would have remained. As a consequence, the real added value of a further non-analytical Bayesian consideration of the problem is probably to work with informative priors on all GPD parameters, for instance *ξ*. To construct them, one could use the results reported in the literature regarding the tail behaviour of avalanche runouts in other areas/paths (with care since the result of a presumable Fréchet-type tail behaviour obtained for our case study contradicts the evidences of a Weibull type behaviour obtained on larger samples; Keylock (Reference Keylock2005); Ancey (Reference Ancey2012)). This extra-data information would be of great help in practice, avoiding the *ξ*
_{0} choice we had to make because of our limited dataset and, presumably reducing the width of high-return level confidence intervals. However, in that case, there would clearly be no full analytical solution of the problem, since no conjugate distribution exists for *ξ*.

Regarding the interaction law choice, we proceeded as for *ξ*
_{0} (sensitivity index *δ*′_{
R(x
b,
h
d
)
}), but things are a little bit different. Clearly, here, one deals not with uncertainty related to a limited data sample, but with a real modelling assumption regarding the type of dam/flow interaction and consecutive deposit shape angle. Hence, what should be done in practice with the high-sensitivity highlighted remains a difficult question: for example, to always choose the energy dissipation one, no matter what the rheological behaviour it hides, because it is the most stable numerically? Or to take a mean or a maximum value provided by each of the interaction laws so as to maximise the safety with the final decision? If some expert information about the most probable amount and type of snow and hence, deposit shape angle, is available, the volume catch interaction law is probably a good option. However, this is clearly not often the case. To help the engineer, Appendix pushes forward the comparison between the two interaction laws we used. Also, in practice, we clearly recommend testing both and interpret results in terms of sensitivity/bounds as introduced in this work.

Finally, we kept constant the (linear) cost model and the avalanche size parameters required for both interaction laws. This was done to reduce complexity, and focus on the interaction law and GPD shape influence. Simple/plausible forms/values were chosen, which should guarantee the overall robustness of our results. Yet, it cannot be excluded that for specific forms/values very different from ours, different outcomes in terms of residual risk and optimal design behaviour and sensitivity could be obtained. This remains to be investigated in further work.

### 4.4. Other outlooks for further work

Even if extreme value statistics are used, for example, in the different variations of the runout ratio approach, for example, McClung (Reference McClung2000, Reference McClung2001), our feeling is that, for snow avalanche problems, their use would probably be more intense than is currently the case. By replacing the exponential distribution with the much more general GPD one, our work may contribute to the diffusion of important extreme value concepts such as the tail behaviour in this specific community. However, much work on this question remains to be done, for instance, to more deeply analyse extreme runouts on data samples as large and clean as possible within this framework. In the extreme value community, optimal design approaches in which real efforts on costs and decision modelling are made remain, to our knowledge, seldom (e.g. Rietsch and others, Reference Rietsch, Naveau, Gilardi and Guillou2013), and our work may encourage further developments in this promising direction.

Second, the bridge needs to be made between similar risk and optimal design approaches involving an avalanche numerical propagation model (Barbolini and others, Reference Barbolini, Cappabianca and Savi2004a; Cappabianca and others, Reference Cappabianca, Barbolini and Natale2008; Eckert and others, Reference Eckert, Parent, Faug and Naaim2009; Favier and others, Reference Favier, Eckert, Bertrand and Naaim2014b). Since with these, the expected damage can easily be computed according to existing vulnerability curves and the multivariate avalanche model outputs, they have the advantage of avoiding the assumptions we have made regarding a constant loss, whatever the avalanche impact on a considered element at risk. Also, they are able to deal with the most complex path topographies on which runout extrapolation beyond the furthest recorded value will fail, even with a GPD tail. On the other hand, whether such statistical-numerical approaches have desirable extreme value properties (tail behaviour, etc.), which could be crucial for well evaluating the most damageable events, remains a critical and open question. Also, clearly, their inherent computational cost will remain an obstacle to their use in engineering practice, which justifies the development of simpler alternatives such as ours.

Finally, avalanches/defense structure interaction remains a research field of high practical relevance, very active, but also in which much work remains to be done to better understand the complex physics it involves. However, it will be clearly useful to expand our work to other types of defence structures and avalanche flow interaction laws already available. For instance, it must be remembered that the two we considered correspond to idealised cases only (typical but limited Froude number ranges). Hence, first ideal candidates to enlarge the applicability of our approach are interaction laws combining runout shortening by energy dissipation and volume catch. Such laws account for both the storage effects and the local dissipation of kinetic energy and are therefore able to work at intermediate Froude numbers (Faug, Reference Faug2004). Potentially, they could be implemented within the same framework, making the results of the risk and optimal design computations less specific to one type of flow/obstacle interaction (and/or to one given snow type), which would in turn facilitate the engineer's choice. However, if the convenience of having analytical risk equations at hand remains, it is still worth investigation.

## ACKNOWLEDGEMENTS

We thank the ANR research program MOPERA (Modélisation probabiliste pour l'Étude du Risque d'Avalanche – http://www.avalanches.fr/mopera-projet/) and the MAP3 Alcotra Interreg program for financially supporting this work. Thierry Faug and Mohamed Naaim are grateful to the financial support by the People Programme (Marie Curie Actions) of the European Unions Seventh Framework Programme under REA grant agreement No. 622899 (FP7-PEOPLE-2013-IOF, GRAINPACT).

## APPENDIX

## EXISTENCE OF OPTIMAL HEIGHTS WITH THE VOLUME CATCH INTERACTION LAW

For the general GPD case, when *ξ* ≠ 0, the derivative of Eqn (19) with regard to the dam height is:

This expression allows better understanding of the different cases likely to occur. Figures 13a, b shows the no optimum case, where the risk derivative is positive all over the range of possible *h*
_{d} values and, hence, the residual risk is a strictly increasing function of *h*
_{d}. This is typically observed for buildings situated at large abscissas in the path and/or for low values of the deposit shape angle *ϕ*. According to the volume catch interaction law, the dam has then a very small protective effect, so that the loss reduction with increasing *h*
_{d} values is always lower than the concomitant construction cost increase.

Figures 13c, d shows the case of a pseudo-optimum due to the positivity constraint in Eqn (11). The risk derivative is always negative over the range of possible *h*
_{d} values, so that the minimum risk obtained corresponds to the maximal investigated *h*
_{d} value. This is typically observed for buildings situated just beyond the dam abscissa in the path and/or for high values of the deposit shape angle *ϕ*. The dam has then a very high-protective efficiency, making the additional construction effort rewarded all over the possible *h*
_{d} range. Noteworthy, the maximal investigated height is, in this case, *h*
_{d} = (*V* × 2tan (*α*
_{s})/ℓ_{d})^{1/2}, the limit value just sufficient to stop all avalanches before the considered element at risk. From a practical point of view, this height can be considered an optimal choice.

Finally, Figures 13e, f shows the case of a real optimum occurring on the investigated *h*
_{d} range. In fact, the residual risk derivative has even two zeros in this case, but only the one corresponding to the local minimum of the residual risk function is of interest. It highlights the dam height above which the additional protective effect no longer compensates the additional construction costs (in this case to the limit height stopping all avalanches below the element at risk). This is typically observed for reasonable building positions/deposit shape angles, intermediate between the two extreme cases previously discussed.

## CONFIDENCE INTERVALS FOR RETURN LEVELS WITH PROFILE LIKELIHOOD GPD ESTIMATES

##### With the delta method

According to Eqn (4), the *σ*, *ξ* and *λ* derivatives of the return level *x*
_{
T
} (the indices ‘stop’ and ‘0’ are dropped in the return level, for simplicity, and so is the *x*
_{
T
} >*x*
_{d} condition) are, respectively:

In our profile-likelihood approach, we set the *ξ*
_{0} value, and determine
$\hat \sigma ({\xi _0})$
, which yields:

The delta method considers ${\hat x_T}$ to be asymptotically normally distributed (theorem 2.4 of Coles, Reference Coles2001). In our case, this writes:

where
${V_{{x_T}}}({\xi _0}) = \nabla x_T^T ({\xi _0}){V_{\sigma ({\xi _0}),\lambda}} \nabla {x_T}({\xi _0})$
. *V*
_{
σ(ξ
0), λ
} is the approximate variance-covariance matrix of the profile likelihood estimates and

is evaluated at
$(\hat \sigma ({\xi _0}),\hat \lambda )$
. It follows that an approximate (1 − *α*) confidence interval for *x*
_{
T
}(*ξ*
_{0}) is:

where *z*
_{
α/2} is the (1 − (*α*/2)) quantile of the standard normal distribution.

##### On the basis of the deviance statistics

The deviance statistics defined in Section 2 in the context of the GPD – exponential model choice, allows us to obtain another confidence interval for high-return levels. In our case, one needs to evaluate the profile deviance at the *ξ*
_{0} value. To do so, according to Eqn (4), for *ξ*
_{0} ≠ 0, we can write *σ*(*ξ*
_{0}) = *ξ*
_{0}(*x*
_{
T
}(*ξ*
_{0}) − *x*
_{
d
})/(*λT*)^{(ξ
0
}
^{)} − 1. Replacing all occurrences of *σ* in the log-likelihood function by this expression leads to the searched profile deviance as a function of *ξ*
_{0}, *λ* and *x*
_{
T
}(*ξ*
_{0}). According to theorem 2.5 of Coles, Reference Coles2001, its asymptotic distribution is again, the one degree of freedom *χ*
^{2} distribution, which provides the search for (1 − *α*) confidence interval for the true value of *x*
_{
T
}(*ξ*
_{0}), with *α* the considered significance level.

Figure 14 applies this result to the evaluation of the 95% confidence interval for the centennial runout. The best guess ${\hat x_{100}}$ is at the minimum of the profile log-likelihood. The cut-off straight line corresponds to $(1/2)\chi _1^2 (0.05) = 1.921$ . Its intersections with the profile log–likelihood corresponds to the bounds of the searched 95% confidence interval. Note that these are nonsymmetric around the best guess ${\hat x_{100}}$ , an important difference from the delta method, where the asymptotic normality assumption imposes symmetry of confidence intervals on return levels.

## IS IT POSSIBLE TO FURTHER COMPARE THE TWO FLOW/DAM INTERACTION LAWS?

It is tempting to push forward the direct comparison between the two flow/dam interaction laws used in the present paper. By considering *n* = 1/2 (confined zone upstream of the dam) and by making use of Taylor expansion, the volume's catch interaction (Eqn (10)) law yields:

The avalanche volume and the volume stored upstream of the dam can be expressed respectively as:
$V = {h_0}{L_0}{l_{\rm f}}z = {k_0}h_0^2 {\ell _{\rm d}}$
and *V*
_{obs} = *k*
_{s}
*L*ℓ_{d}
*h*
_{d}, under the assumption of a rough proportionality for the avalanche length *L*
_{0} = *k*
_{0}
*h*
_{0}, with *L* the deposit length and *k*
_{s} a coefficient representing the deposit shape. This leads to

By making use of *k*
_{s} = 1 and *L* = *h*
_{d}/(2tan(*α*
_{s})) (triangular-shaped deposit upstream of the dam), we have:

This equation is equivalent to the linear model (Eqn (9)) only if:

For this latter equation to be true, either the right-hand side term must be kept constant or *α* must be a function of *h*
_{d}/*h*
_{0}. The first option leads to a somewhat non-physical result: the length of the deposit and the volume stored upstream of the dam are constant whatever the dam height. The second option can give more physical results, but only with small values of *α*, 10 times smaller than the typical value of 0.14 that was used in this study. This factor 10 explains why the volume's catch law generally evaluates a residual risk higher than that obtained with the energy dissipation law, as discussed in the present paper.

More generally, this second option also shows that the two interaction laws are definitely different models, difficult to directly compare. For instance, the run-out shortening derived from the Taylor's expansion of the volume's catch law is no longer a linear function of *h*
_{d}/*h*
_{0}. However, better understanding the similarities and differences between the two interaction laws we considered may make it possible in the future to better describe flows characterised by intermediate Froude numbers, in links with the more general formulations previously advocated that combines the two shortening processes (Faug, Reference Faug2004). This may be important since the 1–5 Froude range, to which neither of our two interaction laws is perfectly adapted, is typical for snow avalanche flows in many paths.