The added value of system robustness analysis for flood risk management illustrated by a case on the IJssel River

Decision makers in fluvial flood risk management increasingly acknowledge that they have to prepare for extreme events. Flood risk is the most common basis on which to compare flood risk-reducing strategies. To take uncertainties into account the criteria of robustness and flexibility are advocated as well. This paper discusses the added value of robustness as an additional decision criterion compared to single-value flood risk only. We do so by quantifying flood risk and system robustness for alternative system configurations of the IJssel River valley in the Netherlands. We found that robustness analysis has added value in three respects: (1) it does not require assumptions on current and future flood probabilities, since flood consequences are shown as a function of discharge; (2) it shows the sensitivity of the system to varying discharges; and (3) it supports a discussion on the acceptability of flood damage. We conclude that robustness analysis is a valuable addition to flood risk analysis in support of long-term decision-making on flood risk management.


Introduction
Flood disasters continue to show that flood protection cannot provide a 100 % safety.The Japan tsunami flood levels, following the 8.9 magnitude earthquake in March 2011, far exceeded the design heights of the flood walls.Other examples include the flooding of Queensland, Australia in January 2011, and the flooding of Bangkok, Thailand in October 2011.These disasters emphasize the inherent variability of hazards, and the often devastating impact of beyonddesign events.The question is how decision-makers and planners should deal with this natural variability in the management of their system.
The traditional way to deal with climate variability is riskbased decision-making.Also in flood risk management, flood risk is the key criterion for decision-making, which is often balanced with the investment cost of the strategy.However, there are two reasons why flood risk may not suffice.
The first reason is that flood risk does not shed light on the acceptability of flood consequences.Flood risk is usually expressed as a single number, for example as the expected annual damage, which does not distinguish between high-probability/low-consequence and low-probability/highconsequence risks (Merz et al., 2009).This implies that potential consequences may grow unlimitedly, as long as the flood probability is reduced.Whether the consequences of low-probability events are acceptable is seldom questioned.Already 30 years ago, Kaplan and Garrick (1981) stated that a single number is not enough to communicate the idea of risk.Instead, they suggested using the full risk curve, which shows flood consequences as a function of the probability of exceedance, thereby putting emphasis on the tail of the distribution.
A different way to emphasize the low-probability/highconsequence part of flood risk is to add a risk aversion factor.Risk aversion refers to the fact that an accident with hundred fatalities is judged worse than a hundred accidents with one fatality each (Slovic et al., 1977).Different ways have been proposed to include risk aversion in risk analysis (see Jonkman et al., 2003), all resulting in higher single-value risk values.Although including this factor may increase the benefit of consequence-reducing measures, it does not provide a basis for discussing damage acceptability.
The second reason why risk may not suffice as decisioncriterion is that it is uncertain how it will change over time following socio-economic developments and climate change.This paper is limited to the effects of climate change.The difficulty is in deciding upon the most cost-effective strategy, for which future flood risk needs to be quantified, while it is unknown how the climate will develop and how this affects river discharge variability.A range of equally plausible climate scenarios can be used to explore the future (Bouwer, 2013;De Bruijn et al., 2008), but applying only one scenario may imply either spending too much if the future climate change is slower, or spending too little if the climate change is faster than the scenario suggests.Attempts to solve this issue are numerous, for example robust decision making (Lempert et al., 2003), tipping points analysis (Kwadijk et al., 2010) and adaptation pathways (Haasnoot et al., 2012).Although these methods can support decisions about when to implement a strategy in time, they do not solve the issue of how well a system can deal with extreme events.
An alternative way to a broader analysis of flood risk is to consider a system's robustness to a full range of river discharges.The idea is that a system that can deal better with natural variability is also better prepared for climate change.As Brown et al. (2012) note, often climate-related risks are dominated by the present climate variability, and much can be done to reduce the vulnerability for extreme weather events.We have already proposed robustness analysis as a way to incorporate uncertainty about system disturbances (Mens et al., 2011).System robustness refers to how well a system can cope with disturbances such as high river discharges, given uncertainty about the occurrence of these discharges.A robust system may have the same flood risk as its less-robust counterpart, but unexpected events are less likely to unfold in an unmanageable situation.For example, in a robust system the failure of one of the flood defences will cause minor flooding instead of major flooding that will take years to recover from.
Robustness analysis involves presenting the consequences of flooding as a function of discharge by means of a response curve.The response curve can be considered a risk curve, where probabilities are replaced by the discharge at the boundary of the system.The response curve forms the basis to quantify four robustness criteria: resistance threshold, response severity, response proportionality, and point of no recovery.The resistance threshold refers to the smallest discharge that will cause flood damage.Severity is the impact of the flood, for example economic damage.Proportionality is the relative change in damage when the disturbance magnitude increases.The fourth criterion, point of no recovery, indicates the event from which recovery will be virtually impossible and/or the system will change significantly.
The aim of this paper is to discuss the added value of system robustness analysis, by applying it on several alternative flood risk system configurations, and compare the results with an analysis of flood risk.For this we performed a case study of the IJssel River valley in the Netherlands.The IJssel River is a branch of the Rhine River.

Case introduction
The flood risk system under study is the IJssel River valley in the Netherlands, a natural river valley with embankments on both sides of the river.The flood-prone area is divided into 6 dike-ring areas, which are areas surrounded by a closed ring of flood defences and higher grounds (Fig. 1).The defences are designed to withstand river flood levels that occur on average once in 1250 years.As a consequence of climate change, the future Rhine design discharge may be raised from 16 000 to 18 000 m 3 s −1 .This practically means that embankments must be raised in the future to withstand higher water levels, unless measures are taken to lower extreme flood water levels by giving more room for the river.Moreover, flood risk will increase due to socio-economic developments such as population growth, economic growth and land use changes. 1 This was recently investigated for the Netherlands in Klijn et al. (2012).The Delta Programme (Deltaprogramme, 2011) currently explores how to deal with the increased future flood risk.
In this paper, we quantify flood risk and robustness of different system configurations.We define a system configuration as a combination of physical and socio-economic characteristics of the flood risk system, including assumptions about the stage-discharge function near the breach locations,

CE Conventional embankments
Embankments are raised with a location-dependent water level difference, which corresponds to a change in discharge from T = 1250 to T = 5000 years.
Compared to the reference, we thus adapted the fragility curves.

RR
Making room for the river The floodplains are lowered so that the current design water level is reached at a higher discharge.The Q is about 260 m 3 s −1 .This value is chosen such that the flood probability of the entire system equals that of CE.
UE1 "unbreachable" embankments All embankments are strengthened (not raised) so that version 1 they become "unbreachable".Water may flow over the flood defence and result in flood damage.
UE2 "unbreachable" embankments As UE1, but embankments near cities are raised with version 2 an additional 0.5 m.
embankment height and strength (quantified by a fragility curve), and land use.Each system configuration is a potential "reality", in which measures such as raising embankments are implemented compared to the current (reference) situation.For each alternative configuration we calculated flood risk and robustness.The system configurations are explained in Table 1.
3 Flood risk analysis

Flood risk analysis approach
We calculated the flood risk of the entire IJssel flood risk system based on flood simulations of eight different breach locations with corresponding probabilities and consequences.We simulated flooding using the two-dimensional hydrodynamic model Delft-FLS (WL|Delft Hydraulics, 2001).The resulting flood depth maps were input for the DamageScanner, developed by De Bruijn (Klijn et al., 2007), to calculate economic damage.The damage corresponding to one breach location is considered representative for an embankment stretch.This means that any breach along this stretch will result in a similar flood pattern.For each stretch we assumed a probability of failure that depends on the river water level.We divided large dike-ring areas into two sub-areas, with one breach location each.We modelled embankment breaches with a breach growth function at a predefined location.This function relates the breach width and water level difference with the inflowing discharge.The breach width increases to 220 m in 72 h.For flood waves that exceed the local embankment, breaches start as soon as the water level exceeds the crest level.For smaller flood waves, the breach starts at the peak of the flood wave.These breaches are assumed to be initiated by structural failure of the embankment, for example by the piping mechanism.
To estimate the flood risk for the entire IJssel system, we followed four steps (Fig. 2): 1. calculate water level probability distribution per breach location; 2. define fragility curve at each breach location; 3. calculate potential damage for each breach location and combinations of breaches; 4. calculate flood probability and risk for the entire system.
The combination of the first two steps provides the embankment failure probability (equivalent to flood probability) per breach location.In the reference situation this should equal the current design standard of 1/1250 per year.

Step 1: water level probability distribution per location
In this step we derived the IJssel discharge frequency curve from the Rhine discharge frequency curve, and then converted it to a water level exceedance curve at each breach location.The IJssel frequency curve was derived from Eq. ( 1) (Van Velzen et al., 2007).Because it is uncertain how much water diverts into the IJssel River, we used three diversion fractions: 0.15, 0.16 and 0.18.A fraction of 0.15 means that 15 % of the Rhine River discharge diverts into the IJssel River.In all studies for the Dutch government, it is presently assumed that 15.4 % of the Rhine discharge diverts to the IJssel.The parameters a and b in Eq. ( 1) are multiplied with the diversion fractions. where To obtain a water level frequency curve, the discharge in the above equation was replaced by the corresponding water level at each breach location, based on the stage-discharge relation.Next, the water level return period at location k (T k ) was converted to a water level exceedance probability, according to: where 1 − F k (h) is the water level exceedance probability, T k (h) is the water level return period (year) and k is the location index.

Step 2: fragility curve for each location
The embankment fragility curve gives the relation between the river water level and the probability of embankment failure given that water level.Although different curves should be constructed for each failure mechanism ( Van der Meer et al., 2008), we assumed one encompassing fragility curve representing all mechanisms.We approached the curve with a standard normal distribution function with σ = 0.2 and µ depending on the embankment height (Fig. 3).Integrating the water level probability density function with the fragility curve gives the flood probability at a location as in Eq. (3).
where P k is the flood probability of location k, f k (h) is the water level probability density function and PC k (h) is the conditional probability of embankment breaching: For the reference situation, we chose the µ such that the flood probability per location equalled 1/1250 per year (i.e. the protection standard in the reference situation).We used the water level probability based on a diversion fraction c of 0.154.This reflects the current practice for deriving water levels for embankment design.Equation (3) was thus solved for each breach location, with P k = 0.0008, and c = 0.154.In the alternative system configurations we adapted the fragility curves to represent embankment reinforcements, by increasing the µ.

Step 3: potential damage at each breach location
Potential flood damage was calculated for the eight breach locations, using the maximum flood depth maps as input for the damage model.Although the damage will increase with increasing discharge, we only used the damage figures corresponding to a flood with design discharge in the risk calculation.This will slightly underestimate the risk.However, higher damages also have a lower probability, thus contributing less to the risk.

Step 4: flood risk of the entire system
The flood risk calculation of the IJssel valley combines flood probabilities and consequences of eight breach locations.Because these potential flood events are correlated, we applied a Monte Carlo approach.To this end, we sampled 10 000 events from the local independent flood probabilities at each breach location.We defined the flood probability at each location with a so called limit-state function Z, where P (Z < 0) means failure (thus: flooding).Z has a normal distribution and follows from u, which has a standard normal distribution.The relation between Z and the standard normal variable is required to be able to include correlations between different Z functions.
The Z function at the first breach location is described as: where u is standard normal stochastic variable belonging to Z 1 and β 1 are the reliability index of location 1.
The Z functions of the other seven locations are correlated with the first location as follows (Vrouwenvelder and Steenbergen, 2003): where ρ is the correlation coefficient (0 = no correlation, 1 = full correlation), w k is the standard normal distributed variable for location k and β k is the reliability index of location k.
The reliability index is chosen such that P (Z < 0) equals the design flood probability (1/1250 per year in the reference situation).The Monte Carlo approach generates 10 000 combinations of Z values, by drawing from u and w.The correlation coefficient represents both correlation in water levels and correlation in embankment strength.The former equals 1, since all breach locations are situated along the same river and all locations have the same protection standard.A combined correlation of 1 would imply that if one embankment fails, the other embankments will also fail.This is very unlikely, because the strength is much more variable.Therefore, the correlation coefficient is assumed to be 0.8.The flood probability of the entire system equals the number of failure scenarios (i.e.where one or more Z values are smaller than 0) divided by the total number of scenarios.
To calculate the flood risk, the set of failure scenarios is first combined with the potential damage of the location that fails.If more than one location fails, the damages are added up.This approach thus does not take into account positive hydraulic system behaviour (Van Mierlo et al., 2007): the effect that downstream water levels will drop when breaches occur upstream.The result is a set of 10 000 scenarios of flood damage, from which a risk curve or loss-exceedance curve can be constructed.Flood risk is defined as the area under this curve: where D is flood damage [EUR], F (D) is the probability density of the damage, P (D) is the probability of one damage scenario and E(D) is the expected value of the damage [EUR yr −1 ].
For "unbreachable" embankments we used a slightly different approach.Since we assumed that such embankments are strong enough to withstand extreme water levels, even those that exceed the crest level, fragility curves do not apply in the calculation of risk.Whether and where the embankments are overtopped is completely determined by the flood simulation itself (i.e.we did not define overtopping locations beforehand).In practice, this means that upstream embankments will overtop first, if all flood defences have the same design standard.For the alternative systems with "unbreachable" embankments, additional flood simulations were carried out to obtain damage figures for a range of discharge waves.The risk curve is now obtained by combining the IJssel discharge frequency curve with the response curve (damage as a function of discharge).The flood risk then equals the area under this curve.

Flood risk analysis results
The estimated flood probability and flood risk are given in Figs. 4 and 5.The uncertainty band reflects the different possible discharge diversion fractions.For comparison, the diamond shows the flood risk for this area according to a recent policy study ("WV21"; Kind, 2014).
The reference system has the largest flood risk.From the alternative systems, "unbreachable" embankments reduce the risk most.The system with raised embankments (CE) has a lower risk than the reference system, because the flood probability is reduced.The room for the river alternative (RR) also has a lower flood probability, but in this case because the measures affect the stage-discharge relationships and, as a consequence, the water level frequency.Therefore, higher discharges are required to cause critical water levels.Additionally, CE increases the flood damage, because critical water levels are higher, causing a higher volume of flood water flowing through the breach.This is not the case for RR.The "unbreachable" embankment alternatives (UE1 and UE2) reduce the flood risk, because the prob- ability of breaching is reduced to practically zero, and once the water overtops the defences, less water flows into the area compared to when the embankments would breach.

System robustness analysis approach
Robustness analysis involves presenting the consequences of flooding as a function of discharge by means of a response curve, and using this curve to obtain scores on four robustness criteria: resistance threshold, response severity, response proportionality and recovery threshold (Mens et al., 2011).In this paper, we suggest combining response severity and recovery threshold into one measure of manageability: to what degree will the consequences of flooding still be manageable?Response severity refers to the absolute consequences of flooding, and can be indicated for instance by the economic damage.The recovery threshold refers to the maximum consequences (economic damage, affected persons or casualties) from which a society can still recover.We suggest that response severity becomes a more meaningful criterion when it is compared to a recovery threshold.When presented as an absolute value, the response severity (or the flood damage) is not an adequate indicator for whether the system can remain functioning, since the degree of disruption depends on how this damage is spread over the area and over the functions, and how it relates to what the area can deal with.Instead, manageability better reflects whether the flood damage, if it occurs, exceeds the recovery threshold.
For the analysis of robustness we used the same models and data as for the risk analysis, but we performed additional flood simulations for discharge waves that are be- low and above the design discharge for the following reasons.Firstly, the fraction of the discharge that diverts from the Rhine River to its IJssel branch is uncertain and may be higher than expected; a fraction of 18 % would cause a design discharge of 2880 m 3 s −1 for the IJssel, compared to the current 2560 m 3 s −1 .Secondly, the projected climate change could lead to higher design discharges (Bruggeman et al., 2011), although it is found difficult to discover a trend in discharge data for the Rhine, even if climate change has an effect (Diermanse et al., 2010).Also, it is expected that the Rhine discharge entering the Netherlands reaches its physical maximum at 18 000 m 3 s −1 (Pelt and Swart, 2011).Assuming that the Rhine design discharge will increase to 18 000 m 3 s −1 in 2100, the IJssel design discharge could increase to (0.18 × 18 000 =) 3240 m 3 s −1 .We rounded this off to 3300 m 3 s −1 , as the maximum discharge to prepare for.Finally, the reason to also perform flood simulations for flood waves with lower peaks than the design level is that conventional embankments may fail before the design water level is reached, due to failure mechanisms related to insufficient strength (e.g.piping and macro-stability).
By applying the Monte Carlo approach, as explained in Sect.3, we obtained a probability distribution of damage for each discharge wave.The median of this distribution is used for the response curve.Whereas we used one damage estimate per breach location for the calculation of risk, we used the full relation between discharge and damage for the robustness analysis.

Resistance threshold
The resistance threshold (i.e. the discharge where damage is first to be expected) was quantified in two ways.The first one is based on the design discharge.The reference system has a design discharge of 2560 m 3 s −1 (T = 1250 years), just as UE1 and UE2.The configurations CE and RR have a higher design discharge of 2560 + 260 m 3 s −1 (T = 5000 years).However, because the embankment strength is uncertain in three of five alternative systems, embankments may breach before the design discharge is reached.This means that the lowest discharge that may cause damage may be significantly lower than the design discharge.Therefore, the second indicator for the resistance threshold is the discharge at which the probability of flooding is > 10 % in at least one of the breach locations.For each breach location we first selected the water level corresponding to the 10 % conditional breach probability from the fragility curve.Next, the lowest discharge for all breach locations was selected.This is visualized in Fig. 6 for the reference situation.The diamond indicates the resistance threshold according to the first approach.
For UE1 and UE2, the resistance threshold only depends on the height of the embankments, because it was assumed that the embankments cannot breach.The effect is that both indicators coincide.

Proportionality
We measure the proportionality by the maximum slope of the response curve.The resulting value represents the additional damage that is caused by increasing the discharge peak by a standard volume increase (1 m 3 s −1 ).To obtain a score between 0 and 1, this value is divided by the largest damage of all configurations.In formula: where Smax i is the maximum slope of response curve of configuration i and max(D i ) is the maximum damage over all configurations.

Manageability
As a measure of manageability, we distinguish three zones of recovery: easy recovery, difficult recovery and no recovery/regime shift.Two thresholds indicate the transition from one zone to the other, expressed in terms of flood damage.
Defining the thresholds requires a discussion on when a flood event is considered an unmanageable situation or disaster.
As noted by Barredo (2007), it is difficult to find a quantified threshold for classifying an event as major natural disaster or catastrophe.The IPCC (2012) considers a flood "devastating" if the number of fatalities exceeds 500 and/or the overall loss exceeds USD 650 million (in 2010 values).Reinsurance company Munich RE uses a relative thresh- old to classify a flood event's impact as "great catastrophe" (for developed countries): overall losses > GDP per capita × 5 % × 10 6 (Bouwer et al., 2007).We consider this a better indicator for the no-recovery threshold, since it relates the losses to a country's economic capacity.It is unknown to the authors how this threshold is underpinned.We interpret it as 5 % of the regional GDP, assuming the number of inhabitants in the flooded region equals 10 6 .We could turn this around and calculate the number of people that are needed to finance the flood recovery, assuming that they all contribute 5 % of per capita GDP.Comparing this number with the number of inhabitants shows whether a flood impact exceeds regional or national administrative boundaries.This gives an indication of the severity and the manageability of the flood event.
Based on the above, we assume that when flood damage exceeds 5 % of the regional GDP, this region is unable to recover without financial aid from other regions (national scale for small countries).Likewise, if the damage exceeds 5 % of the national GDP, international aid is needed.The first recovery threshold equals the regional 5 % level, and the second recovery threshold the national 5 % level.Figure 7 shows the economic damage of some recent flood events as a percentage of the regional and national GDP, where the regional GDP is calculated as per capita GDP × 10 6 .All flood events exceed the first threshold, but do not exceed the second one, indicating that it has not been easy to recover from the floods, but international assistance was not needed.
Applying these thresholds to the IJssel case, with reference year 2000, results in the following two thresholds:

System robustness analysis results
Figure 8 shows the response curves of the reference situation and the alternative system configurations.These curves already reveal that all alternatives increase the ability to remain functioning, compared to the reference situation.The alternative with "unbreachable" embankments (version 2) increases the robustness most, because it takes a discharge of 3200 m 3 s −1 before the system reaches the zone of "difficult recovery".This is the highest of all systems.Table 2 summarizes the scores on the robustness criteria, which will be further explained next.
The reference system has the lowest resistance threshold: a discharge of 2500 m 3 −1 .This means that when this discharge occurs there is at least a 10 % probability that an embankment will fail.This threshold level arises from the uncertainty in embankment strength.By raising the embankments in a conventional manner (CE), the resistance threshold rises.Making room for the river (RR) also raises the resistance threshold, but in this case because the stage-discharge  0.5 0.5 0.5 0.7 1 a Discharge where conditional flood probability > 0.1, relative to maximum discharge [3300 m 3 s −1 = 1].b Largest change in damage for discharge increase of 1 m 3 s −1 , relative to maximum damage.c Recovery zone (no recovery = 0, difficult recovery = 0.5, easy recovery = 1).relation is adapted.This means that in both alternatives a higher discharge is needed to reach a critical water level.In the alternatives with "unbreachable" embankments (UE1 and UE2), the uncertainty about strength is assumed to be virtually eliminated, and the threshold equals the current design discharge of 2560 m 3 s −1 .
The proportionality decreases when embankments are being raised, because the maximum change in damage is increased.Making room for the river does not change the proportionality, whereas "unbreachable" embankments significantly reduce it.Because in the second version of "unbreachable" embankments the crest levels are varied, the increase in damage is smaller than in the first version.
The manageability scores best in the second version of "unbreachable" embankments, and second best in the first version of "unbreachable" embankments.In UE2 the zone of difficult recovery is reached at a discharge of about 3200 m 3 s −1 , whereas in UE1 this zone is reached earlier at a discharge of about 2800 m 3 s −1 .The other configurations reach the difficult recovery zone immediately as soon as the resistance threshold is exceeded.The zone of no recovery is never reached in either of the configurations.

Discussion of system robustness criteria
The main purpose of this paper was to explore the added value of robustness criteria compared to single-value flood risk, when evaluating alternative flood risk system configurations.We consider it added value when different insights are obtained with a robustness analysis in comparison to those obtained from a flood risk analysis.Added value could also be assessed by comparing the ranking of alternative strategies based on a cost-benefit analysis with a ranking based on system robustness.Such a comparison was done by Klijn et al. (2014), who show that robustness analysis may indeed lead to a changed priority setting of alternative flood risk management strategies.Here, we limit ourselves to a comparison of risk with robustness of the reference and alter-native configurations.In general, we found that flood risk is reduced in all configurations, but robustness is only enhanced in the configurations with "unbreachable" embankments.This means that if the risk reduction would have been equal in all configurations, a strategy with "unbreachable" embankments would have been preferred from a robustness perspective.This, however, does not take into account the costs of implementing unbreachable embankments.Each robustness criterion is discussed next and compared with flood probability or flood risk.

Resistance threshold
Obviously, the higher the flood defence the higher the resistance threshold and the lower the flood probability.However, the resistance threshold is expressed in terms of discharge, a physical parameter, whereas the flood probability is "likelihood".The flood probability needs assumptions on discharge variability and discharge diversion and will thus change when new information becomes available and when the climate changes.In contrast, the resistance threshold remains unchanged when assumptions about the natural discharge variability are adapted.Only when embankments are raised or strengthened, or when knowledge about the failure mechanisms increases, are both resistance threshold and flood probability affected.Thus, the resistance threshold depends less on assumptions about discharge variability and climate change.This is considered of additional value to flood risk.

Response proportionality
The second robustness criterion, response proportionality, is another additional element compared to flood risk.It values a low sensitivity of damage to a change in discharge.A proportional response curve means that a slightly higher or lower discharge than expected would not result in substantially different damage.Thus, in systems with "unbreachable" embankments (like UE1 and UE2), which score high on proportionality, an accurate prediction of the discharge is less critical; if the discharge is slightly higher than anticipated, the effect on flood damage will be minimal.

Manageability
The third robustness criterion, manageability, has additional value to flood risk by introducing a reflection on the flood consequences compared to what is considered acceptable.In contrast, the risk approach implies that as long as the probability is small enough, the absolute damage is irrelevant.In this paper, we proposed three recovery zones as indication of manageability.In practice, these thresholds would be the result of a societal discussion among decision makers and other stakeholders.
This paper discussed the added value of robustness analysis for flood risk management by comparing five alternative configurations of the IJssel flood risk system.The system with "unbreachable" embankments that differ in height has the lowest flood risk.If the implementation cost would be known, the most cost-effective measure could be chosen.However, the flood risk and thus the cost-effectiveness depend on uncertain flood probabilities and discharge diversion fractions.Because of these uncertainties it is considered important to obtain insight into how well the system can deal with extremely high discharges.The robustness criteria show that the systems with "unbreachable" embankments are best able to cope with extreme events.This is because the damage increases proportionally with an increase in discharge.When "unbreachable" embankments are built with different heights, the ability to cope with extreme events increases even more, because the absolute damage is smaller.
To summarize, the robustness analysis gave us the following insights: -Whereas the flood probability reduction differs between all system configurations, the resistance threshold hardly distinguishes between the systems.This means that although the flood probability is reduced, the resistance threshold (i.e. the discharge where a flood event has a likelihood of at least 10 %) is similar in all configurations.Because quantifying the resistance threshold does not require assumptions about current and future discharge return periods, the score does not change with climate change.
-The proportionality criterion is a valuable addition to flood risk, because it shows how flood consequences vary with the river discharge.This indicates how sensitive the system is for uncertainties about, or changes in, the design discharge.
-Scoring on manageability adds to flood risk, because it allows an explicit discussion of damage acceptability.
In contrast, the risk approach implies that as long as the probability is small enough, the absolute damage is irrelevant.
More in general, drawing a full response curve is considered to provide more insight into system functioning, compared to single-value flood risk only, because: -It makes explicit how a measure influences different constituents of flood risk.Some measures reduce the flood-probability by changing the stage-discharge relationship and others by affecting the fragility curve of the defence.Some also reduce the inflow volume or the maximum flood depths and hence the flood consequences.The response curve shows these differences.
-It supports a discussion on flood damage acceptability, by triggering questions like: "what if the design standard is exceeded?"The risk may be considered acceptable, but the potential flood damage may not.
-It moves the discussion away from uncertain design standards and uncertain flood probabilities, towards how the system functions and what can be done to manage the entire flood risk system under a range of plausible discharges.It poses the question: which discharge range do we want to be prepared for and how?
A robustness perspective challenges the idea of economically optimal protection standards for individual subsystems (or dike-ring areas) within a river valley.Flood risk can be better managed when the entire river valley is viewed as one system.For example, intentional flooding upstream can be used to protect downstream cities when extremely high discharges occur.Thus, the flood risk of the entire river valley can be reduced to an acceptable level while at the same time the proportionality is high.This calls for an analysis of a range of low-probability discharges, and questioning what can be done to limit the flood consequences.It is possible to both reduce the risk and enhance the robustness by differentiation of protection standards within the river valley.After all, flood risk management is not only about meeting the legal protection standards, but also about manageability of events when these standards are exceeded.

Figure 1 .
Figure 1.Case study area: IJssel River valley with delineation of dike-ring areas.

Figure 2 .
Figure 2. Steps in the flood risk analysis.

Figure 4 .
Figure 4. Flood probability of reference system and alternative configurations with uncertainty bounds reflecting the different diversion fractions.

Figure 5 .
Figure 5. Flood risk of reference system and alternative configurations with uncertainty bounds reflecting the different diversion fractions.The diamond "WV21" refers to the outcome of a recent policy study(Kind, 2014).

Figure 6 .
Figure 6.Determination of the resistance threshold for the reference situation, based on the fragility curves of eight breach locations (0.1, 0.5 and 0.9 values).Vertical dashed line indicates the system resistance threshold as the lowest 10 % value of all locations.The diamond indicates the resistance threshold when it would be assumed equal to the design discharge.

Figure 8 .
Figure 8. Response curves for reference system and alternative configurations.

Table 1 .
Overview of alternative system configurations.