Development of dike fragility curves for piping and micro-instability breach mechanisms

The paper analyses the prevailing breach mechanisms of fluvial dikes. Piping in the dike foundation and slope failure as a consequence of seepage flow through a dike core (micro-instability) were identified as two of the dominant breach mechanisms for historically-grown dikes along with overtopping and slope macro-instability. For the former two mechanisms the physically-based and empirical process descriptions were reviewed and led to the formulation of the reliability functions. Evaluation of these functions in the Monte Carlo framework for the time dependent load led to the development of fragility functions. These functions indicate the probability of failure of a dike section upon loading and can be computed for each spatially discretised dike section. The probability of breaching is conditioned by the uncertainty in geometrical and geotechnical dike parameters. This uncertainty is explicitly taken into account during computation of the fragility functions in a Monte Carlo simulation. Sensitivity analysis was carried out in order to identify the sensitive geotechnical parameters influencing the distribution of failure probability. The identification of sensitive parameters indicates the priorities in geotechnical measurement campaigns aimed at the assessment of dike stability. The newly developed fragility functions can be applied in flood hazard and risk assessment studies for modelling of dike failures in a probabilistic framework.


Introduction
In flood hazard and risk research the failure of flood protection structures is often not appropriately considered in the modelling approaches.However, a number of studies ac-Correspondence to: S. Vorogushyn (vorogus@gfz-potsdam.de) knowledged a considerable impact of flood protection dikes and their failures on flood hazard and risk statements.Dikes (or levees) are defined as a type of dam running along the river banks and confining the flood flow up to a certain magnitude.Typically, the studies considering dike failures rely on predefined breach location(s) and breach width(s), either based on historical information (Han et al., 1998;Hesselink et al., 2003;Alkema and Middelkoop, 2005) or hypothetical assumptions (Aureli and Mignosa, 2004;Niemeyer et al., 2005) in form of scenarios.Thus, derived inundation characteristics are not associated with the probability of occurrence and have limited value for hazard and risk assessment.The failure probability assessment of flood protection structures based on fragility functions was introduced by USACE (1996) and USACE (1999).Fragility curve or function indicates the probability of structure failure conditional upon loading.Traditionally applied in system reliability research, particularly in earthquake research to describe the failure probability of engineering structures as a function of peak ground acceleration (e.g.Shinozuka et al., 2000;Bhargava et al., 2002;Kim and Shinozuka, 2004), fragility functions of flood protection structures recently gained their relevance in flood hazard and risk assessment studies.
Recently, Sayers et al. (2002) proposed the fragility curve concept for a steady large scale risk assessment in order to describe the performance of dikes based on their classification and expert judgements about their failure probability.Hall et al. (2003Hall et al. ( , 2005) ) subdivided flood defence structures into discrete sections characterised by fragility functions.Assuming the probability of hydraulic load corresponding to a certain return period, the authors computed the probability of any system state (failed/not failed) conditional upon loading.Originally developed for overtopping, breaching without overtopping and breaching as a consequence of overtopping (Hall et al., 2003), the fragility concept was further extended to wall instability and piping mechanism S. Vorogushyn et al.: Development of dike fragility curves for piping and micro-instability breach mechanisms for fluvial structures based on simple empirical reliability functions (Dawson et al., 2005) and shingle beach erosion, rockarmour damage and dune erosion for maritime structures (Dawson and Hall, 2006).However, the applied empirical relationships did not explicitly considered various failure modes (pathways) leading to the final dike collapse.The presented paper intends to fill this gap.Apel et al. (2004Apel et al. ( , 2006) ) and Merz (2006) developed more sophisticated fragility functions for dike overtopping conditional upon two load variables: overtopping height and duration.Hence, the function takes gradually varying load by incorporating the time-dependent component such as load duration.The authors used the developed functions to assess the failure of Rhine dikes and associated inundation, whereas the load was dynamically simulated by the unsteady hydraulic model.The authors could show a wide range of uncertainty in flood risk statements attributed to dike breaching processes.Merz (2006) argues that solely consideration of overtopping may be justifiable for modern well-kept fluvial dikes, which are less likely to breach due to other mechanisms.But for older historically-grown dikes without drainage the consideration of other breach mechanisms is required.Otherwise hazards may be underestimated.Also USACE (1999) suggests to consider failure mechanisms caused by landward or inner slope instability, piping, seepage through the dike core and surface erosion of the riverside or outer slope further reviewed in Sect.2.
The presented paper reviews dike breach mechanisms focusing on the processes leading to breaching.Based on the empirical and physically-based process formalisations reported in the literature, the reliability functions are formulated for selected failure mechanisms and the constituting failure modes (pathways).Implementing these functions in a Monte Carlo framework leads to the development of the fragility curves.Contrary to the previously implemented fragility models for fluvial dikes, the presented approach is based on process descriptions rather than on expert judgements and uses advanced reliability models partly based on two load variables, water height and load duration.Moreover, an implemented numerical scheme accounts for a timedependent gradually varying load thus waiving an assumption of sudden and constant dike impoundment.Furthermore, the approach explicitly acknowledges the fact that a final dike failure is a consequence of a series of dependent events, so that the fragility curves for breaching processes can be combined to derive the final dike failure probability subject to a given load.

Overview of dike failure mechanisms
Dikes may fail as a consequence of various breach mechanisms and their combinations.Kortenhaus and Oumeraci (2002) and Allsop et al. (2007) provide a detailed description of about twenty breach triggering processes.Distinction be-tween these processes is often difficult in practice.Modelling of many breach mechanisms may easily end up in a computationally intractable problem with high number of uncertain parameters.Therefore, a clustering of breach mechanisms is required.Armbruster-Veneti (1999) distinguishes, for instance, between the following groups of failure mechanisms: -Hydraulic failure Under hydraulic failure, collapse of dikes as a result of overtopping and wave scour is understood.Overtopping occurs as a consequence of water level exceeding the crest height or wave swashing.The surface erosion of the landward slope can then be initiated if the shear stress induced by the overtopping flow exceeds the critical shear stress of the dike material.The progressive erosion may lead to a breach development and total dike collapse.The wave scouring induces erosion of the dike material on river side that may result in an outer slope failure.
-Geohydraulic failure Seepage flow through a dike core or dike foundation may initiate erosion processes and transport of material.
Progressing material relocation from the slope leads to the inner slope failure.CUR/TAW (1990) and Vrijling (2001) denote the geohydraulic failure of inner slope as micro-instability.In the dike foundation, the erosion processes result in a formation of pipes that lead to a sagging of the dike core with subsequent overtopping, slope failure and collapse.This particular failure mode is referred as piping (CUR/ TAW, 1990;Vrijling, 2001).Finally, inner erosion of the dike core may occur as a result of material transport via preferential flow paths such as root and animal holes towards the riverside dike slope leading to the slope and core failure.
-Global static failure In this case, dike collapse is triggered by the pressure forces of water and ice, wind and waves as well as own weight that exceed dike resistance.The static slope failure as a consequence of gravity and pressure forces occurring in the form of core sliding, slope failure (inner or outer) following a slip circle with or without foundation sagging is denoted as macro-instability (CUR/ TAW, 1990;Vrijling, 2001).
The hydraulic, geohydraulic and static failure mechanisms are presented in a simplified fault tree and further discussed in Sect.2.2.
There is a number of further possible failure mechanisms such as human-induced failure (e.g.deliberate destruction or sabotage, inadvertent damaging during monitoring campaigns), destruction of a dike by debris flow, failure at dike crossing hydraulic structures (structure failure), e.g.gated sluices, culverts etc.These failure mechanisms occur seldom as indicated by the breach statistics in Sect.2.1 and are briefly discussed in the fault tree analysis in Sect.(Horlacher et al., 2005).

Dike breach statistics
Records of extreme events such as dike breaches are very rare.Nevertheless, the analysis of 117 historical dike breaches in the period 1954-2004 in Hungary was carried out in the EU-IMPACT Project (Nagy and Tóth, 2005).Overtopping, piping and loss of dike slope stability (micro-instability and macro-instability) breach mechanisms are responsible for 98% of all identified breaches in Hungary in the last 50 years (Fig. 1a).The results of the analysis of Hungarian dikes are further supported by recent observations in the Elbe catchment.The analysis of responsible breach mechanisms in Saxony during the August 2002 flood by Horlacher et al. (2005) is based on 84 identified dike failures and indicates that the dike overtopping, piping as well as slope stability are the primary failure mechanisms (Fig. 1b).Additionally, inner erosion may attribute somewhat above 3% of dike breaches.Gui et al. (1998) also indicate that overtopping and piping are major failure mechanisms based on the study of Cheng (1993), which summarises dam failure statistics.In some parts of the Netherlands piping mechanism appears to be dominant for the majority of the dikes (Van et al., 2005).The pathways of dike failure due to these mechanisms are further elucidated in a fault tree analysis (Sect.2.2).

Fault tree
Dike failure can be a result of various triggering mechanisms, which are presented in Fig. 2 as a fault tree based on the definitions of breach mechanisms according to Armbruster-Veneti (1999) and CUR/TAW (1990).The fault tree is aimed at representing the utmost comprehensive set of pathways (failure modes) leading to a failure.However, for assessment of dike stability by modelling approaches it is required to keep balance between the degree of process description and efficient model handling (Merz, 2006).
Based on the dike breach statistics (Sect.2.1), overtopping seems to be the most prevalent failure mechanism.The derivation of fragility functions for overtopping was already provided by Apel et al. (2004Apel et al. ( , 2006) ) and Merz (2006).
According to the presented failure statistics, it seems that in the fluvial environment the wave spillover is not that significant as at the sea coast and thus is not further considered in this study.
Rupture of a low-permeability layer induces a continuous water flux through a sandy dike foundation resulting in piping described in details in Sect.3.1.Piping is responsible for a considerable portion of dike failures in Germany and Hungary (Fig. 1).As shown in the fault tree (Fig. 2), the erosion of dike foundation results in sagging of the dike core.Yet, this does not necessarily imply immediate dike collapse.The core sagging can further lead to the overtopping or global static failure.These complex interactions, however, are poorly understood and lack sufficient observational and experimental evidence.Nevertheless, recent research attempted to formalise such interactions in a complex model proposed by Van et al. (2005) to describe the global static slope failure induced by rupture.In case of dike sagging, one can assume, for example, a complete freeboard loss of 1 m.This freeboard is prescribed by legislation for river dikes in Germany.However, the reviewed literature provided no experimental evidence or theoretical derivation for the depth range of pipes and resulting subsidence.Therefore a rather conservative approach adopted here assumes a complete dike failure in case the piping has progressed to a critical length (Sect.3.1).This approach neglects the core subsidence and seems to be appropriate in the absence of sufficient reliable information.It has been used by Kortenhaus and Oumeraci  (2002) and Dawson and Hall (2006) for assessment of the stability of sea dikes as well as implemented in the PC-Ring Software (Steenbergen and Vrouwenvelder, 2003;Lassing and Vrouwenvelder, 2003) developed for the reliability assessment of river dikes in the Netherlands.Inner slope failure can occur either due to micro-instability or macro-instability.Both mechanisms together may be responsible for about 10−17% of all dike breaches (Fig. 1b).The presence of seepage flow on the landward slope can, for instance, be used as possible indicator in favour of microinstability, although without any assurance.Whereas the seepage flow can be efficiently controlled by drains or isolation materials in modern dikes, for historically-grown dikes it remains an issue.Thus micro-instability was considered for the derivation of fragility functions despite the fact that this is a much more local phenomenon compared to macroinstability.
Failure mechanisms listed in the fourth category "Other failure mechanisms" are partly difficult to formalise.The assignment of a probability of occurrence may also be complicated because of a small number of evidences.Moreover, evidence statistics (Sect.2.1) indicate that these mechanisms are very seldom observed and therefore are not further discussed here.
This paper focuses on the development of fragility functions for geohydraulic failure mechanisms -piping and slope micro-instability -taking into account gradual dike impoundment.

Probabilistic dike failure assessment
Fragility functions can generally be n-dimensional depending on the number of load variables.They are defined on the interval [0; 1] indicating failure probability upon loading.For development of fragility functions, each load variable can be discretised within a range of feasible values.Each tuple of load variables represents a point in the n-dimensional space, for which the probability of structure failure can be computed in a Monte Carlo simulation with the so-called limit state or reliability function.This function should be formulated for each particular failure mode.It represents a critical relation between the load and resistance variables and can be expressed in a general form as where R -resistance and L -load.For a combination of R i and L i yielding Z i >0 no failure occurs.Failure is considered for Z i ≤0.Uncertain dike state variables r 1 , r 2 , ...r n , representing geometrical and geotechnical properties that contribute to dike resistance are randomised in the Monte Carlo simulation.Generated random values follow the selected distribution with defined statistical moments.The resulting probability of failure is defined at each point of the load space as a ratio between the number of negative limit state function outcomes and total number of Monte Carlo runs: The result of the Monte Carlo simulation is a fragility function defined at every discretised point of the load space.For each particular failure mode, a separate fragility function should be developed.For complex failure mechanisms, such as piping and micro-instability, which are comprised of several failure modes, the separate fragility functions can be combined in a probabilistic framework describing dependent events.
Failure probability indicated by the fragility functions rather describes the resistance capability of a dike section or proneness to failure subject to a certain load magnitude.The high fragility values for a certain load, e.g.0.8−1, indicate lower dike resistance compared to the dikes with low fragility values, e.g.0.1−0.2, for the same load magnitude.However, lower resistance capability does not necessarily mean the high probability of the dike section failure and vice versa.The fragility is the failure probability upon loading and should always be related to the probability distribution of hydraulic load in order to draw the conclusions about the ultimate system performance.In other words, if the probability of critical load is small, the fragile dike section would perform well over time.Analogously, if the high loads are frequent, even the robust dikes with low fragility values would collapse with higher probability.
In the presented work, fragility functions for piping and slope micro-instability were developed for a typical dike section of about 500 m length on the Elbe River for which the geometrical characteristics were available with 50 m spatial resolution.Mean, standard deviation and variation range of dike geometry characteristics were determined for the dike section and summarised in Table 2.While surveyed dike geometry data is often available, information on the geotechnical properties of dike core and foundation material is scarce.Therefore, respective model parameters had to be adopted from literature review and derived from scarce indications available for the site or from comparable dikes (Table 2).
The reliability functions with the parametrisation presented in Table 2 are denoted as reference model versions.The range of parameter variation can be restricted to the physically possible interval derived from the literature, whereas the mean value is uncertain for the dike under  Bligh (1912) and Lane (1935).3.1 Dike failure due to rupture and piping

Process of rupture and piping
During a flood, the seepage of a high permeability sandy layer in the dike foundation, typically confined between low permeability clayey layers (Fig. 3), progresses with increasing hydraulic gradient towards the landside dike toe.In case the seepage pressure of the water percolating upwards exceeds the effective weight of the soil, rupture of the clayey layer occurs.This process is also referred as heave (Terzaghi et al., 1996) or uplifting (van Noortwijk et al., 1999;Van et al., 2005).Rupture enhances the seepage flow through the dike foundation, which may initiate material transport towards the landside dike toe if the critical shear stress in the sand material is exceeded.This results in the formation of  a sandboil behind the dike core -a typical indicator of progressive erosion.
As a consequence of the retrogressive erosion, initiated at the landside dike toe, the channels or tunnels (also called pipes) develop in the sandy dike foundation.The pipes progress towards the outer dike toe until an equilibrium is attained expressed in the halted erosion.Evidences prove that after increase of the water level at the dike to a certain level a new equilibrium state is reached (Sellmeijer, 1989;Hanses et al., 1985).The development of erosion pipes progresses until the critical pressure difference H crit is reached.H crit is defined as the difference between the water levels at outer and inner dike slopes.Further increase in pressure difference beyond H crit results in progressive erosion, for which no equilibrium state is possible (Sellmeijer, 1989).This leads to the development of extended pipes under the dike core, which progress to the riverside dike toe causing a subsequent dike collapse.
In clayey foundations under high dispersed clay soil particle concentrations, plugging of pipes may occur, ceasing erosion processes.Khilar et al. (1985) developed a piping model for clay soils, which predicts particle detachment based on critical shear stress criterion and particle migration through a porous medium.A boundary between piping and plugging is delineated based on critical dispersed particle concentration.However, it remains unclear, how decisive the plugging process is.

Failure probability due to piping
The probabilistic description of dike failure due to piping can be given by a combination of four fragility functions.We assume a dike failure if the following conditions are fulfilled (Fig. 2): -The seepage front has progressed through a sandy dike foundation all the way to the landside dike toe.
-The rupture of an upper clay layer occurred in the hinterland.The rupture is assumed to happen directly behind the dike toe, so the seepage length equals the dike foot length.
-The critical head difference is achieved resulting in a progressive erosion towards the riverside dike toe.
-Finally, the pipes have developed to a critical length at which core subsidence and dike collapse takes place.
Each of the above listed failure modes can be described by a reliability function.The final dike failure probability P pfailure can be expressed as a probability for dependent events according to the multiplication rule of probability theory: P (piping) = P (rs) • P (H crit|rs) ( 4) where P (pfailure) -probability of dike failure when the critical pipe length is reached, P (cl|piping) -probability of pipes reaching the critical length after erosion progressed beyond the critical state, P (piping) -probability of progressive piping and rupture, P (H crit|rs) -probability of reaching the critical state for piping after rupture has occurred, P (rs)probability of rupture and seepage, P (seepage) -probability of foundation seepage, P (r|seepage) -probability of rupture given the seepage.

Seepage probability
The probability of seepage through a dike foundation can be computed based on the reliability function relating the seepage length and foundation width (Fig. 4): For the time-dependent hydraulic load, such as the water level at the dike, the seepage length can be determined using 2-D models of flow in porous media (Fenton and Griffiths, 1996;Scheuermann, 2005).Such codes are, however, prohibitive in terms of CPU time requirements and thus can only be used on a local scale, for instance, for the design of a particular dike or dam.For reliability assessment of a large number of dike sections on the reach scale, a simpler approach for seepage length calculation has to be developed.
Scheuermann (2005) provides a comprehensive overview of analytical methods for unsteady seepage length computation inside a dike core.Some of these methods were developed for the case of sudden dike impoundment.The flood wave or impoundment water level exhibits, however, an unsteady behaviour.In such a case the proposed methods have to be adopted for gradual water level fluctuations.
We employ the method of Brauns (1999), originally developed for a rectangular soil sample, for computing the seepage length for gradual impoundment.It is based on the assumption of mainly horizontal seepage flow along an impervious floor.Hence, it can be applied to seepage calculation in a confined dike foundation.With hydraulic gradient expressed as where h p (t)=h(t)+d+D s /2 according to Fig. 3, with dthickness of clay layer [m], D s -thickness of sandy layer [m] and x(t) -seepage length [m] (Fig. 4), the pore water velocity (v p ) can be computed according to Eq. ( 8): where The velocity of the seepage front (Fig. 4) can be expressed as: Equating the pore water velocity to the velocity of the seepage front, i.e. combining Eq. ( 8) with Eqs. ( 9) and ( 7), yields: Scheuermann ( 2005) provides an integration of Eq. ( 10) considering a sudden impoundment, i.e. h p is independent of time.Here the hydraulic potential resulting from a gradual impoundment is taken into account.This leads to Eq. ( 11) for the time dependent seepage length along a rectangular dike foundation (Fig. 4): with T -total impoundment duration [s].Equation ( 11) is developed assuming the gravity as the only driving force of seepage flow.Additionally one can include the matric potential as the driving force of the phreatic line: where ψ -specific matric potential [m].However, the influence of the matric potential on the phreatic line is regarded to be negligible compared to the effect of the gravitational force and therefore not further considered here.
The integral T 0 h p (t)dt in Eq. ( 11) is solved numerically by the trapezium rule for the continuous function h p (t).
For this purpose, the dike crest  height h 0 is discretised into three equidistant intervals ((0−1/3h 0 ), (1/3h 0 −2/3h 0 ), (2/3h 0 −h 0 )), as demonstrated in Fig. 4. Water levels within these intervals is approximated by the average stages (1/6h 0 , 1/2h 0 , 5/6h 0 ), respectively.Thus, the fragility function, resulting from Monte Carlo randomisation of Eq. ( 6), can be represented by the probability volume in a 3D-space: , where D(h) is the duration of load for a given water level interval.A more detailed discretisation of the water level would necessarily result in a higher dimensionality fragility functions.In the Monte Carlo simulation impoundment duration for each load level was ranged between 0 and 10 days in 1 day steps.The projections of the resulting probability volume into the (D(0−1/3h 0 ), D(1/3h 0 −2/3h 0 ), P ) space represent the probability surfaces for D(2/3h 0 −h 0 )=0 days and D(2/3h 0 −h 0 )=9 days (Fig. 5).The distributions of the stochastic parameters, as well as the selected mean, standard deviation and variation range used in the Monte Carlo simulation are summarised in Table 2.The sensitivity of fragility function to the changes in the mean hydraulic conductivity and mean air-filled porosity was explored by applying a multiplicator m to the mean values of K f and n a in the reference model version.The standard deviations were kept constant as given by the literature values based on exploration of dike materials (Table 2).
The range of variation for hydraulic conductivity values spans over several orders of magnitude.The composition of the foundation sand may exhibit a strong variability with K f values from about 10 −8 m s −1 for silty sands to 10 −3 m s −1 for coarse sands (Berry and Reid, 1987;Bollrich, 2000).However, within a single dike section such a strong variability might be unlikely.Therefore the range of variation for the K f values of one order of magnitude around the mean was adopted, as also implemented by Pohl (1999).K f was assumed to follow the log-normal distribution.Fenton and Griffiths (1996) provide a literature review supporting this assumption, which was also adopted by Pohl (1999).The parameters of the log-normal distribution (mean and standard deviation of ln x) were derived from mean and standard deviation values using Eqs.( 13) and ( 14).
The mean value was then varied between 3•10 −7 m s −1 and 3•10 −4 m s −1 keeping the variation range of one order of magnitude around the mean.The resulting percentage change of seepage probability is indicated over the complete load space (in this case 1000 load combinations) in form of box-whisker plots as a function of parameter multiplicator (Fig. 6).
The probability surface was found to be rather sensitive to the selected mean value of hydraulic conductivity.This becomes apparent from the comparison of Figs. 5 and 7, where the mean K f value was decreased by an order of magnitude.The change of mean hydraulic conductivity by one order of magnitude with respect to the reference value may result in up to 100% change in probability for some loading conditions (Fig. 6a).The median values range between approx.−100% for decreased and 40% for increased mean hydraulic conductivity.The reduction of the variability of probability change for multiplicator 0.01 is stipulated by the nature of the probability quantity, which is constrained in the [0; 1] interval.For this reduction of K f , zero seepage probability is expected for the majority of loading conditions.On the other side, the almost constant variability of probability change for increased mean K f indicates that for the majority of loading conditions the maximum seepage probability of 1 is expected.
Relating the sensitivity to the range of K f values encourages special attention to measuring and selecting the hydraulic conductivity value for fragility curve development.Although the seepage probability exhibits a high sensitivity to the selected mean antecedent air-filled porosity (Fig. 6b), the range of variation of n a is well-restricted by observations.So, the overall variation of probability change (−20; +30%) is smaller compared to the variation due to uncertainty of K f .

Probability of rupture
Fragility function for rupture can be derived by randomising the reliability function in Eq. ( 15), which is based on the definition given in Sect.3.1.1.After the seepage front has reached the landside dike toe, rupture may occur.Assuming zero water depth in the hinterland leads to zero buoyancy acting on clayey layer particles.Thus the reliability function can be expressed in a simplified form (Vrijling and van Gelder, 2000;Steenbergen and Vrouwenvelder, 2003) as: The rupture model was parametrised based on the data provided by Vrijling and van Gelder (2000); Gocht (2002); Kortenhaus and Oumeraci (2002) as summarised in Table 2.The mean weight per volume of clay soil was adopted at µ(γ k )=19 kN m −3 and standard deviation σ (γ k )=0.05µ(γ k ).The range of variation was restricted to γ k ∈ [17; 21].No information was available about the mean clay layer depth for the study reach.Therefore the range of variation d ∈ [0; 3] was assumed based on indications of Gocht (2002) for the Elbe dikes and assumptions of Vrijling and van Gelder (2000).The mean depth of a clay layer was taken in the reference model version at µ(d)=1 m with σ (d)=0.3µ(d) (Vrijling and van Gelder, 2000).10 5 Monte Carlo runs were performed for each of the 100 load steps given by the impoundment water level.The subsequent sensitivity analysis (Fig. 8) indicates the impact of the selected mean values of d and γ k on the rupture probability for an exemplary dike section.clay soil, which is rigorously constrained in a narrow interval.The high sensitivity indicates a necessity for surveying the clay layer thickness along the fluvial dikes thoroughly.

Probability of piping
The reliability function for piping given in Eq. ( 16) represents a limit state of progressive erosion, beyond which no equilibrium is possible (Sect.3.1.1).It is represented by the difference in actual water head and critical head that is a function of dike foundation properties.
Following, we provide a review of the approaches available for the determination of the critical head.Empirical reliability functions for piping were traditionally based on the approaches of Bligh (1912) and Lane (1935) and are still being extensively used in practice as design criteria (Weijers and Sellmeijer, 1993;Calle and Weijers, 1995).In the approach of Bligh, the critical pressure head is calculated according to the following equation: with The approach of Lane extends the formulation of Bligh by incorporating the vertical component of the seepage length.The critical pressure head is given in Eq. ( 18): The empirically derived values for C B,creep and C L,creep depend on soil characteristics and are given in Table 1.The characteristics of soils for the corresponding creep coefficients are rather of descriptive nature, which complicates the selection of proper values in practical analysis.
Consideration of the vertical seepage length component in the Lane formula makes this approach attractive for application to hydraulic structures.Along hydraulic structures the flow can induce erosion of soil material, resulting in failure of flood protection.The simplicity of the Lane formula makes it practical and fast for applications to the analysis of dike stability and piping along hydraulic structures, where detailed information about soil properties is not available.For instance, it has been used by Dawson et al. (2005) and Dawson and Hall (2006) to derive fragility functions for piping in case of fluvial and maritime flood defences.However, the necessity to account for the influence of various soil parameters led to the development of a more complicated physically based approach.
The approach of Sellmeijer (1989) represents a physically based treatment of three main processes leading to progressive piping.These processes include: -groundwater flow through the sand layer beneath the dike core -flow through the erosion channels developing in the sand layer -limit state stability of the sand grains in the erosion channels The solution of the system of differential equations describing these processes delivers an expression for the critical water height difference, for which sand grains are in equilibrium state.Originally developed by Sellmeijer (1989); Sellmeijer and Koenders (1991) and Koenders and Sellmeijer (1992), the equation for critical water height difference did not consider thickness of the sand layer (D s ): κ is calculated according to Eq. ( 21): Further, the formula presented in Eq. ( 19) was refined based on the experiments of Weijers and Sellmeijer (1993) and incorporated the influence of the sand layer thickness (D s ) on the critical head difference: where The α term explicitly considers the thickness of a water conducting layer and β is defined according to Eq. ( 24).
Comparison of the proposed model with experimental results revealed a good agreement for very fine sands and river sands over a range of porosity values from ca. 34% till 40%.Poor predictions of the critical head difference for coarse sands is probably due to the assumption of laminar flow through the sand core, whereas in case of coarse sands flow becomes turbulent (Weijers and Sellmeijer, 1993).At turbulent flow conditions through a slit, a lower critical head is required for progressing piping, compared to that derived analytically.
The hydraulic load in terms of impoundment water level determines the progress of piping in a sandy dike foundation.The fragility functions for piping were computed based on reliability function for piping employing the model of Weijers and Sellmeijer (1993) (Eqs. 22-24).They indicate the probability of reaching the critical state of pipe development, beyond which no equilibrium is possible, resulting in continuous retrogressive erosion.10 6 Monte Carlo runs were carried out to assess the failure probability at every discretised load point.The seepage path L was assumed to be the length of the dike foundation b f .This conservatively implies a rupture directly behind the landside dike toe.The reference critical head model was parametrised based on measured indicative values and literature data (Table 2).
Figure 9a demonstrates the sensitivity of piping probability to the thickness of the sand layer.Interestingly, the increase of thickness does not result in an increase of probability at the same rate.The model reflects the process of piping correctly: although the thicker aquifer can conduct more water, the upward flow path length becomes larger, which reduces the probability of piping.The range of probability variation due to changes in the sand layer thickness is comparably smaller than due to changes in thickness of the clay layer and hydraulic conductivity within the range of feasible values.The mean selected K f value shows a very pronounced impact on the piping probability, similarly to the effect on seepage fragility functions.
The piping probability exhibits a relatively high sensitivity to the change in mean weight per volume of foundation material (Fig. 10b).It appears to be stronger than the sensitivity to the mean friction angle θ altered by comparable parameter multiplicator values (Fig. 10a  the mean particle diameter d 70 may also considerably influence the piping probability (Fig. 11).Comparing the fragility curves for m=0.5, 1 and 1.5 reveals that for lower loads, piping is stronger favoured for material with finer 70%-weight fraction, whereas the coarser mean d 70 does not decrease the piping probability at the same rate.However, opposite holds at high water levels, where the fragility function for m=0.5 reaches its maximum of 1.

Probability of critical pipe development
The probability of critical pipe development is computed based on the reliability function in Eq. ( 25).As soon as the erosion pipes reach the riverside dike toe, direct water flow between the riverside and landside ends takes place, which generally leads to a dike collapse (Hanses et al., 1985;Terzaghi et al., 1996).Therefore the critical length is assumed to be equal to the dike foundation width.
where pipe length L p is calculated in Eq. ( 26) according to the experiments of Weijers and Sellmeijer (1993).
Unfortunately, very few experiments of piping dynamics are reported in the literature.This hinders the derivation of the variability range for the pipe development velocity, which was kept constant.It was abstained here from the unfounded assumptions about the statistical moments and distribution of the velocity rate.The impact of the parameter uncertainty on the final failure probability is, however, explored in the subsequent sensitivity analysis.The velocity rate represents an average velocity of pipe development recorded in the experiment.Although, strictly saying, development of pipes is a 3dimensional process with pipes forming a net in sandy foundation.The pipes develop towards pathways of the weakest erosion resistance.Weijers and Sellmeijer (1993) argue, however, that a pipe can be represented by a one-dimensional slit without invalidating modelling results.
The presented relationship (Eq.26) is purely empirical and does not take into account the characteristics of dike foundation.It can be expected that geotechnical properties of the foundation material influence the transport velocity of particles.Further experimental investigation of slit formation velocity and studies on the effect of material properties would refine the model and allow the uncertainty investigation.Furthermore, the presented pipe development rate was derived from an experiment with the stationary dike impoundment.The variation of the pipe growth rate can be expected to depend on the impoundment water level fluctuations.The effect of variable impoundment height on a slit progress was not sufficiently investigated and reported in the reviewed literature.
The reliability function for pipe development (Eq.25) was evaluated in 10 4 Monte Carlo realisation at each time discretisation point between 0−200 h for each dike section.The resulting fragility curve indicates the probability of a slit reaching a critical length.The stochastisity of the exceedance of critical length results from the variable dike geometrical parameters, such as inner and outer slopes, crest width and core height.These parameters finally determine the width of a dike foot.The supplementary sensitivity analysis explored the response of the fragility curve for an exemplary dike section to the pipe development rate (Fig. 12).The changes in velocity by a factor of two revealed a dramatic variation in fragility for pipe development.It is currently unclear how strong the piping velocity may vary.The scarcity of experimental evidences and high sensitivity of fragility curves demand further investigations aimed on quantification of pipe development rates for different material types.A variation range of development rate could then be used as a stochastic parameter in development of fragility functions.

Dike failure due to seepage and micro-instability
For micro-instability to occur, the phreatic surface, an imaginary line or surface that bounds a saturated zone from above, has to reach the inner slope and seepage flow has to develop.The exit point of the phreatic line determines the height at which the slope failure starts if the effective weight and force exerted by the flow exceed the resisting shear stress.If the failure profile, i.e. point A (Fig. 13) is high enough to damage the dike crest, it is assumed that a substantial material relocation leads to the dike failure.Micro-instability is more likely to occur in materials with low cohesion, although it can also happen in cohesive soils (CUR/TAW, 1990).
The probability of dike failure can be expressed in terms of the probability of two dependent processes: seepage and slope failure as given in Eq. 27.P (mifailure) = P(seepage) • P(mi|seepage) (27) where P (mifailure) -probability of dike failure due to micro-instability, P (seepage) -probability of seepage through the dike core, P (mi|seepage) -probability of slope failure affecting the dike crest after seepage flow has developed.These probabilities can be computed for a range of possible loads based on the reliability functions discussed in the following sections.

Probability of seepage
The probability of seepage flow development can be derived from the reliability function (Eq.28), which relates the foot width to the seepage length along the dike foot.The method presented in Sect.3.1.2is taken as a basis for seepage calculation in a dike core.However, it does not consider the inclination of a dike slope that may result in an underestimation of the seepage length.The flatter the slope is, the greater the percolation area becomes, the more water can penetrate into the dike core yielding a larger seepage length in a given time.
In order to account for the slope effect, Brauns (1999) proposed to use the average seepage length x * in Eq. 11 instead of x, where x * can be derived from the geometrical relations shown in Fig. 14 for the steady impoundment: For the case of gradual impoundment, we substitute the water height h T with 1 T T 0 h(t)dt.Hence, combining Eqs. ( 11) and ( 29) considering gradual impoundment yields the horizontal projection of the average seepage length: Equation ( 30) is applied to unsteady seepage flow calculation for gradual impoundment.The resulting horizontal projection of a seepage length is used in the reliability function (Eq. 28).Analogously to the seepage through a dike foundation (Sect.3.1.2),the integral over impoundment time at a dike core is computed by discretising the crest height into three intervals (Fig. 15).
The fragility functions for seepage through a dike core were computed in a Monte Carlo simulation applying the limit state function given in Eq. ( 28).Besides the dike geometry parameters, hydraulic conductivity and air-filled  Vrouwenvelder and Wubs (1985) for the special case of a dike without ditch.porosity of the dike core material were treated probabilistically.Saturated hydraulic conductivity of the dike material can vary over several orders of magnitude.For the dikes on Elbe and Mulde breached during the August 2002 flood, Gocht (2002) provides indications of K f values ranging from 3•10 −4 to 10 −8 m s −1 .Since detailed spatial information about the material properties was not available, an appropriate assumption had to be made in this study.The Elbe dikes were built over the past eight hundred years (IKSE, 2003).However, due to continuous change of the river course and settlement patterns, dikes were successively relocated and partially rebuilt.Present dikes were erected over the past 150 years and possess a historical core (BfG, 2002).Historical dikes are typically built from the locally available materials and exhibit, therefore, large inhomogeneity of material properties (Pohl, 2000).Whereas the material properties of newer dikes are documented, the older dikes remain largely unexplored.Assuming a homogeneous dike structure within a single section, and adopting the hydraulic conductivities in historical dikes given by Pohl (1999), a mean value of µ(K f )=10 −5 m s −1 was assumed in the reference model version.σ (K f )=25 µ(K f ) was taken based on USACE (1999).The range of variation was assumed to one order of magnitude around the mean value with K f ∈ [10 −6 ; 10 −4 ].This range is comparable to that of the Oder River dikes with historical dike cores (Pohl, 1999).Airfilled porosity values were adopted from the measurements of Kanowski (1977) for the Elbe dikes and summarised in Table 2.
The sensitivity analysis of seepage probability to the selected mean hydraulic conductivity indicates a considerable variation of the change in probability between −100 and 500% (Fig. 17a).Box-whisker plots for K f and n a indicate the percentage change in seepage probability over the complete load space as a function of parameter multiplicator (in this case 3375 load combinations).Small variation of probability change at low values of mean K f (parameter multiplicators equal 0.1 and 0.01) reflects the constrained nature of probability defined between [0; 1].For low mean K f , the seepage probability tends to 0 even for larger load values.An increase of the mean hydraulic conductivity compared to the reference model (m=5 and 10) results in a sharp response of the fragility function towards higher seepage probability values.The seepage probability reacts stronger to changes in mean air-filled porosity compared to hydraulic conductivity.However, the absolute variation of change in probability is smaller due to the relatively narrow n a parameter range (Table 2).Nevertheless, a change of the average antecedent moisture content of a dike core directly related to the airfilled porosity may have a considerable impact on seepage probability.The performed sensitivity analysis suggests that further efforts should, first of all, concentrate on reducing the uncertainty in hydraulic conductivity values, either by con-ducting field measurements or exploring available documentary records on dike construction materials.

Probability of slope micro-instability
Under action of seepage flow the slope failure profile develops as shown in Fig. 13 for a schematised case.Implying no material compression, the volume of the slipped material equals the volume of the relocated material.Thus, the height of slide (h a ) can be derived from the geometrical representation given in Fig. 13, where S ABC =S CDE with S denoting the area of respective triangle.A failure is assumed for h a >h 0 , yielding a reliability function for slope micro-instability: The inner slope is assumed to fail up to a state when it equals the friction angle of the dike material ( ABA =θ), whereas the relocated material forms θ/2 angle with the ground ( BCB =θ/2) (Vrouwenvelder and Wubs, 1985;CUR/TAW, 1990) Fig. 18.Sensitivity of probability for slope micro-instability to the selected mean value of friction angle (θ ) of the dike material for the exemplary dike section.
For the case of a non-submerged slope, which is further assumed here, the material transport occurs for slopes with (CUR/TAW, 1990): Adopting the analysis of Vrouwenvelder and Wubs (1985) for a dike without ditch, h a can be computed according to Eq. ( 33): where In this case h a becomes: A detailed derivation of Eq. ( 33) as well as of h 2 is given in Appendix A1 and A2.
The failure probability due to micro-instability was computed as a function of water level height at the dike outer slope (Eq.31).2•10 4 Monte Carlo realisations at each discretisation point of the load axis were found sufficient to obtain a smooth fragility curve.
An example of a resulting fragility curve and its sensitivity to the changes in mean value of the friction angle is shown for a selected dike section in Fig. 18.The fragility curve for micro-instability reacts strongly to changes in θ.At lower mean values of friction angle (m=0.8 and 0.9), the non-zero probability of slope failure is observed even for low impoundment water levels.The frequency of the randomly sampled slope and friction angle pairs, which do not fulfil the static stability criterion given in Eq. ( 32), is increased in the Monte Carlo simulation with lower mean friction angle.However, an increase of the mean θ by the same rate (m=1.1 and 1.2) does not lead to drastic reduction of failure probability.Firstly, it may be the constraining effect of the upper boundary set by the range of friction slope variation (Table 2).Despite the increased mean parameter value, the randomly sampled friction angle values do not exceed the upper parameter bound and restrain probability reduction.Secondly, with increased mean the randomly generated pairs of friction angle and inner slope meet the static stability criterion (Eq.32) more often.Thus, the impact of the friction angle on the slide height (h a ) becomes more pronounced (Eq.33).This influence on the reduction of slope failure probability appears to be weak.

Conclusions
The presented paper reviews the dike breach mechanisms for fluvial dikes and analyses the dominant failure modes.The revisited failure statistics suggests that overtopping, piping and inner slope instability are primary dike failure mechanisms.Whereas overtopping has already been considered in flood hazard assessment studies by developing and applying fragility curves, piping and slope micro-instability were not properly taken into account.
The fragility functions for piping and slope microinstability were developed in this paper.They are grounded on physically-based and empirical process formalisation, contrary to those based solely on expert judgements or simple empirical relationships.Whereas overtopping is determined by only one critical process and can be described by one reliability function (Apel et al., 2004(Apel et al., , 2006)), piping and micro-instability are characterised by a sequence of dependent events leading to the dike collapse.Therefore, fragility functions were separately computed for the constituting failure modes.In order to determine the final failure probability, the fragility functions for each of the determinative failure modes should be combined in a probabilistic framework as required by the probability theory of dependent events.Solely based on the fragility functions, no statement cannot be made about the final time-dependent failure probability of a dike section (e.g.failure return period).Fragility curves describe the resistance of a section upon loading without considering the probability of the certain load.Thus, in order to compute the final failure probability, the developed fragility functions should be combined with the stochastic models for hydraulic load.An application of fragility functions in a probabilistic modelling framework for an exemplary river reach will be presented in a separate study.
Contrary to the previously developed fragility functions for fluvial dikes, the presented approach explicitly takes into account the gradual load change for computing seepage probability.The load space combines water level and dike impoundment duration in the determination of fragility functions.Hence, the computation of dike failure probability under the unsteady flood wave load becomes more realistic contrary to the assumption of sudden and steady impoundment often applied in previous studies.
In the fragility functions, the uncertainty of parameters that influence the breaching process is accounted for by treating them as random variables in a Monte Carlo framework.The sensitivity analysis for piping and micro-instability identified a particularly strong dependence of the seepage fragility functions and fragility function for critical pipe development to the mean hydraulic conductivity for dike core and foundation materials.Due to the extremely wide range of possible hydraulic conductivity values, the impact on failure probability can be dramatic.Therefore, the variation range should be constrained by obtaining further survey data of materials and composition of core and foundation.The mean thickness of the covering clay layer was shown to be the crucial determinant of the fragility curve for rupture.

Appendix A A1 Derivation of a slide height for micro-instability
Based on Vrouwenvelder and Wubs (1985), the slide height h a can be derived from the geometrical relationships shown in Fig. 13.
Related to the dike foot, h a is given by:

Fig. 1 .
Fig. 1.(a) Distribution of failure mechanisms for dike breaches in Hungary in the period 1954-2004 (Nagy and Tóth, 2005).(b) Distribution of identified failure mechanisms for dike breaches in Saxony during the August 2002 flood event in the Elbe catchment(Horlacher et al., 2005).
a sensitivity analysis was carried out and aimed at investigating the impact of mean location within the variation range onto the failure probability.The local sensitivity analysis was performed based on the approach ofGüntner and Bronstert (2004), who applied a multiplicator to the parameter values and explored the model response to these changes.Here we apply a multiplicator m to the mean values of the parameters in the reference model versions.The multiplicator m is selected for each parameter separately in order to cover the feasible parameter range.The resulting different fragility functions indicate the uncertainty range of the failure probability due to the variation of the mean parameter value.The sensitivity analysis should highlight for each breach mechanism the sensitive geotechnical parameters, which require a special attention during measurement campaigns and fragility model setup.For the development of the fragility functions the estimates of the statistical moments of parameters should be preferably based on the local dike surveys or construction plans.
) where b f -foundation width [m] and x(t) -time-dependent seepage length through dike foundation [m].

Fig. 4 .
Fig. 4. Solution for the seepage length through a dike foundation for gradual impoundment.

Fig. 6 .Fig. 7 .
Fig. 6.Sensitivity analysis of seepage probability to the mean (a) hydraulic conductivity (K f ) and (b) air-filled porosity (n a ) of the dike foundation material for the exemplary dike section.Boxes indicate the interquartile range, red line corresponds to the median and whiskers to the 10 th and 90 th percentiles.

Figure 8 Fig. 8 .
Figure 8 a, b indicate a much greater fragility curve sensitivity to the location of the mean clay layer thickness within the variation range compared to the weight per volume of

Fig. 9 .
Fig. 9. Sensitivity of piping probability to the mean value of (a) sand layer thickness (D s ) and (b) hydraulic conductivity of the sand layer (K f ) for the exemplary dike section.

Fig. 10 .
Fig. 10.Sensitivity of piping probability to the mean value of (a) weight per volume of the sandy material (γ p ) and (b) friction angle (θ ) for the exemplary dike section.

Fig. 11 .
Fig. 11.Sensitivity of piping probability to the mean value of particle diameter corresponding to 70%-weight fraction of foundation material (d 70 ) for the exemplary dike section.

Fig. 12 .
Fig. 12. Sensitivity of fragility curve for pipe development to changes in pipe development rate for the exemplary dike section.
) where b f -dike foot width [m], x(t) -seepage length along a dike foot as function of time and hydraulic load [m].

Fig. 13 .
Fig.13.Schematic representation of slope failure due to micro-instability.Adopted fromVrouwenvelder and Wubs (1985) for the special case of a dike without ditch.

Fig. 15 .
Fig. 15.Solution for the seepage length in a dike for gradual impoundment.

Table 1 .
Creep coefficients for piping reliability functions according to

Table 2 .
Summary of random variables used to derive fragility curves: mean, standard deviation, range of variation, probability distribution functions (norm -normal distribution, logn -log-normal distribution) and constant value (const).Selection of the distribution functions and parameter values is based on the provided literature sources or field surveys.