Baseline Risk Assessment for Herbert Hoover Dike

Transcription

1 Baseline Risk Assessment for Herbert Hoover Dike David S. Bowles Managing Principal, RAC Engineers & Economists, Providence, Utah, USA and Professor Emeritus, Utah State University, Logan, Utah, USA; ph: ; Sanjay S. Chauhan Principal, RAC Engineers & Economists, Providence, Utah, USA; Loren R. Anderson Principal, RAC Engineers & Economists, Providence, Utah, USA, and Professor Emeritus, Utah State University, Logan, Utah, USA; Ryan C. Grove Hydrologic Engineer, U.S. Army Corps of Engineers, Risk Management Center, Denver, Colorado, USA; A risk assessment (RA) was conducted for 27 miles of Herbert Hoover Dike to better understand and estimate the Baseline failure risk. Unique aspects of this risk assessment included the following: high stillwater levels persisting for almost a year; highly dynamic and spatially variable wind loading; shortduration wind setup that reduces likelihood of piping; dike length that increases probability of failure; and multiple breaches with overlapping inundation areas that affect failure probability and consequences and the risk evaluations. A wide range of stillwater and wind loading combinations were considered. Following a potential failure modes analysis (PFMA), failure modes included were: piping through foundation, embankment piping, piping along conduits, piping along structures through embankment, embankment and flood wall instability, and overwash and overtopping. System response probabilities (SRPs) were estimated using toolboxes, analyses and expert judgment. Life-loss consequences were estimated using LIFESim. RA calculations were performed using DAMRAE-HHD, which includes length effects. Estimated risks were evaluated against the US Army Corps of Engineers (USACE) tolerable risk guidelines (TRG). Uncertainties were explored using sensitivity analyses. 1.0 Introduction The risk assessment for Reaches 2 and 3 of the Herbert Hoover Dike (HHD) was conducted for the USACE Jacksonville District (SAJ) to better understand and estimate the risk of failure for these reaches of the HHD in its existing (Baseline) condition. It was also used to evaluate the justification for various alternative risk management plans, including structural and non-structural risk management measures, but these evaluations are not addressed in this paper. HHD is a 25 to 30-foot high earthen embankment around the nation s second largest lake, Lake Okeechobee in south Florida. HHD was constructed by hydraulic dredge and fill methods by private and public entities between the early 1900 s and the late 1960 s, initially to provide agricultural water supply. Following major hurricane disasters in 1926 and 1928, Congress authorised USACE to construct elevated embankments at the north and south of the Lake to provide flood protection. In the 1960 s, the Lake was completely encircled with approximately 143 miles of dike and tie-back levees. USACE now classifies this project as a dam. The dam was constructed on highly-variable interbedded layers of sand, peat and limestone. During the initial construction, upstream and downstream toe, cutoff trenches were excavated and filled with inorganic materials to create a fire barrier to protect the dam against a peat fire. The excavated peat was used in the construction of the dam. The dam was constructed using hydraulic dredge material. This did not allow for adequate compaction or grading of fill material and resulted in sand, limestone rocks, silt, clay and other material being deposited randomly throughout the length and height of the dam. Unique aspects of this risk assessment included the following: high stillwater levels persisting for almost a year; highly dynamic and spatially variable wind loading; short-duration wind setup that reduces likelihood of piping; dike length that increases probability of failure; and multiple breaches with overlapping inundation areas that affect failure probability and consequences and risk evaluations. Section 2 summarises the overall approach to risk modelling for the HHD System, including the significant potential failure modes, the subdivision of the HHD system, the overall approach to rolling up risk estimates to account for length effects and to obtain system risk estimates for Reaches 2 and 3, exposure and consequences considerations, the USACE tolerable risk guidelines, and the implementation of risk modelling. Section 3 contains details of the risk model, including loading and system response aspects and the event tree risk model. Section 4 contains a summary of estimated risk profiles along the length of Reaches 2 and 3 and Section 5 contains a summary of total risk estimates for the entire system of Reaches 2 and 3. Section 6 contains a Summary and Conclusions. 1 ANCOLD Proceedings of Technical Groups

2 Three other papers or presentations address in more detail the following aspects of this risk assessment: the stillwater and wind loading (Hadley et al 2011), the PFMA and the system response probability estimation (Davis et al 2011), and the consequences estimation (Needham et al 2011). 2.0 Overall approach to risk modelling 2.1 Potential failure modes The risk assessment began with an identification of the potential failure modes (Davis et al 2011). The following significant and credible failure modes were identified for the embankment with references to the piping failure mode identifiers from the Internal Erosion Toolbox (USACE 2009) in parentheses: Overwash failure Overtopping failure Piping through embankment failure (IM13) Piping through foundation failure (IM22) Embankment slope stability failure The following significant failure modes were identified for conduits and flood walls, which are referred to as point features in the HHD system: Piping along conduit failure (IM17) Piping into conduit failure (IM18) Piping along wall failure (IM19) Flood wall instability failure 2.2 Subdivisions of the HHD System The hierarchal relationships between subdivisions of the HHD system are shown schematically in Figure 1. The entire HHD system has been divided into eight reaches by SAJ based on a preliminary understanding of factors that were expected to influence the probability and consequences of failure in each HHD Reach. The general approach developed for Reaches 2 and 3 to estimate the dike failure risk can be applied to all eight reaches of the HHD system. Reaches 2 and 3 were divided into seven consequences subreaches in which breach flows would be expected to threaten different populations at risk. As detailed in Section 2.4, Reaches 2 and 3 were further divided into 97 computational subreaches (CSRs) to account for length effects in estimating the probability of failure for subdivisions above the CSR level. 2.3 System risk estimation Two types of roll-up were considered: 1) Probability of failure to account for the increased likelihood of a failure occurring over longer lengths of the embankment; and 2) Combinations of life-loss and economic consequences resulting from failure in different consequences subreaches due to the following reasons: a) To avoid double counting of consequences in overlapping inundation areas resulting from failure in different consequences subreaches only a consideration for economic consequences as detailed below in this section. b) To account for the accumulation of consequences in the event of failures in multiple subreaches resulting from the same loading combination (e.g. life loss of 20 in one consequences subreach and 50 in another would lead to a total life loss of 70) as described in Section 2.5. The approach to rolling up the probabilities of failure for a system of n CSRs, was to apply DeMorgan s rule to the estimates of probability of failure, p k, for each of the n CSRs under the assumption that the failure of the CSRs are mutually independent (perfectly uncorrelated 1 ) events, as follows: P(System failure) = 1 - k=1,n (1-p k ) = 1 - (1-p 1 )*(1-p 2 )* *(1-p n )...Equation 1 This is the estimated probability of failure of one or more CSRs in the system of n CSRs. The assumption of mutually independent (perfectly uncorrelated) failure modes was judged to be a reasonable approximation for the correlation between all failure modes included in this risk assessment, except for piping through the foundation. If the probabilities of failure for a system of n CSRs were perfectly statistically dependent (correlated), the estimates of probability of failure, p k, for each of the n CSRs could have been rolled up, as follows: P(System failure) = Max k=1,n (p k ) Equation 2 This is the estimated probability of failure of all CSRs in a system of n CSRs under the assumption of perfect correlation of the failure events for all n CSRs. However, the assumption of perfect correlation was not considered to be valid for any failure modes for the HHD, and therefore this approach was not applied. 1 The notion of correlation here refers to an expected tendency for the failure of more than one adjacent CSR to occur during the same loading event combination. There is some evidence to believe that this may occur for piping through the foundation based on the tendency for adjacent CSRs to experience sand boils (as evidence of potential failure initiation) during the same historical wind event. Perfect correlation would imply that if one CSR failed during a loading event, then with certainty an adjacent CSR would fail during the same loading event. The notion of the failure of adjacent CSRs being uncorrelated is that there is no expected tendency for failure of adjacent CSRs to occur during the same loading event combination; although the failure of two adjacent CSRs could occur during the same loading event purely by chance. As described here, correlation applies to the failure mode system response to loading and not to the induced effects on failure mode system response from spatial correlation of loading characteristics: such as setup, along the length of the embankment during each loading event combination. This type of spatial correlation may induce a correlation in the occurrence of failure of adjacent CSRs, but this does not imply a correlation between the failure mode system response events per se. Dams and Water for the Future 2

3 Figure 1. Subdivision of HHD system Since some correlation is judged to exist for the piping through the foundation failure mode (IM22) within consequences subreaches, the probabilities of failure for this failure mode for a system of n CSRs in each consequences subreach were computed by taking the average of the perfectly uncorrelated (Equation 1) and perfectly correlated (Equation 2) estimates, as follows: P(System failure) = {Max k=1,n (p k ) + [1 - k=1,n (1-p k )]}/2..Equation 3 For rolling up the probabilities of failure for the piping through the foundation failure mode from consequences subreaches to Reaches 2 and 3, the assumption of mutual independence was judged to be appropriate, and hence DeMorgan s Rule (Equation 1) was used. 2.4 Computational subreaches For estimating the probability of failure of a long dam, it is necessary to divide it into shorter computational subreaches (CSRs), which have reasonably homogeneous geometry, geology, geotechnical properties and other conditions that affect embankment- and foundationrelated failure modes, including their SRP estimates. Figure 1 shows the locations of the 97 CSRs that were defined for this risk assessment. To account for the increased likelihood of a failure over longer lengths of the embankment, the probabilities of failure for each CSR were rolled up to obtain an estimate of the system probability of failure for multiple CSRs, as summarised in Section 2.3. According to the Internal Erosion Toolbox (USACE 2009), the SRPs estimated for the piping through the embankment (IM13) failure mode are considered to apply to subreaches up to about 1,600 feet in length. For IM13, this length was assumed to define the length of CSRs that would behave independently of other CSRs. This is sometimes referred to as a correlation distance. While most of the 97 CSRs were defined to be 1,600 feet long, some were shorter to represent changes in properties that affected the SRP estimates, the locations of flood walls, or to match the end points of the consequences subreaches. The same SRP estimates were assigned to groups of CSRs that are judged to have no significant differences in properties that influence SRP estimates. The 1,600-foot length CSRs were used for all failure modes based on the reasoning summarised below. i) Piping through the embankment (IM13): 1) The 1,600-foot length applies generally to probabilities estimated from the toolbox for this failure mode in the sense that these probabilities were anchored to a database of dam failures for which this is a representative dam length (one could think of these probabilities as already being rolled up to 1,600 feet); and 2) the approach taken by the toolbox developers whereby they used their professional judgment to extend the estimates for this failure mode from the types of dams that are well represented in the database to include hydraulic fill dams, which may not be well represented in the historical database (in other words we have assumed that there is a general consistency or 3 ANCOLD Proceedings of Technical Groups

4 comparability in the estimates for hydraulic fill dams with the estimates for other types of dams). Furthermore, the HHD team considered the hydraulic fill nature of the dam and made additional adjustments in obtaining toolbox SRP estimates with the goal of maintaining the general consistency of estimates for the range of cases addressed in the toolbox. ii) Piping in the foundation (IM22): Note (7) in the IE toolbox guidance for IM22 states that the dam foundation should be partitioned "so that geotechnical conditions are essentially the same within a section." However, this wording does not clearly characterise the length effects issue, which is one of the spatial correlation in geotechnical conditions/soils properties, and not whether or not the properties are "the same," or more practically "similar." Hence, even if the entire length of the HHD was considered to have similar soils properties the issue for length effects is the degree of spatial correlation in these properties rather than that the soils are classified to be the same or to have similar properties. Spatial correlation refers to the tendency for high values of a soil property to be located close to other high values or low values to be located close to low values. When changes in the soil characterisation or distinct differences in the values of properties other than a homogeneous (stationary in a statistical sense) type of variability within a classification are present, then that provided a basis for defining a different CSR separate from the need to account for length effects (See Figure 2 from IPET Volume VIII Appendix 10). Our reasoning for using 1,600 feet as the length to associate with the IM22 estimates of the probability of failure was similar to our reasoning for IM13: that is, the toolbox developers provided guidance that was generally consistent with other estimates for this failure mode even though their estimates incorporated information from analytical methods derived from laboratory testing and field observations for the probability of initiation of erosion and by expert elicitation. Furthermore, the HHD team considered the geological characteristics of the HHD foundation, presence of peat layer and fire trench, construction consequences subreach 4. Vanmarcke (1977) showed that the factors, and observations and locations of sand boils and made additional adjustments in obtaining toolbox estimates, again within the framework of estimates being generally consistent or comparable and also in defining CSRs. The range of uncertainty in initiation of this failure mode at higher pool elevations than have so far been experienced was explored in sensitivity studies of confidence bounds on SRP estimates for IM22. iii) Embankment slope instability failure mode: This failure mode is considered at culvert sections and along other parts of the embankment: a) Culvert sections: the steeper slopes at the three of the six culverts lead to much higher estimated probabilities of failure by slope instability than along the rest of the embankment about 60% of the total probability of failure by slope instability for all CSRs. Slope instability failures at the culvert locations were considered to be uncorrelated events and rolled up using DeMorgan s rule (Equation 1). b) Embankment: almost all of the remaining contributions to the total probability of failure by slope instability for all CSRs are estimated to be from a group of about twenty CSRs mainly in probability of slope instability for a long embankment is approximately related to the probability of failure at a single section in a linear manner as a function of B by the following formula: (B-b)*rb, where rb is the rate of decay of reliability/unit length of slope, B is the CSR length, and b is the length of the failure surface accounting for end effects. This supports the use of DeMorgan s rule for rolling up the probabilities of failure by slope instability for each CSR since for small probabilities DeMorgan s rule is approximately equivalent to summing the probabilities. iv) Culvert and flood wall failure modes: While length effects do not apply to piping along conduit failure (IM17), piping into conduit failure (IM18) and piping along wall failure (IM19), there is a need to roll up the probabilities of failure from these failure modes. It was judged that the occurrence of these failure modes at the different locations of the conduits and walls is uncorrelated (independent), and that therefore DeMorgan s rule (Equation 1) should be used to roll up their probabilities of failure. In this case the basis for applying DeMorgan's rule had nothing to do with length Dams and Water for the Future 4

5 effects - it was based on the uncorrelated nature of the failure modes. Therefore the selection of the CSR length has little effect on the rollup of these failure modes - the only effect being the consideration of the common cause 2 aspect of a breach in a CSR resulting from a failure by a point (piping associated with conduits or walls) failure or a distributed failure (IM13, IM22, slope instability, overwash or overtopping) within the same CSR and thus leading to a breach in the same CSR. v) Overwash and overtopping failure modes: The SRPs for these failure modes are controlled by the lowest crest elevation within each CSR and hence they are applicable to the specific length of each CSR. 2.5 Exposure and consequences Life loss As a simplification, it was decided that a breach at any location in a consequences subreach would be assumed to lead to the same life-loss consequences for a given lake water level or life-loss controlling elevation as defined below. Life-loss estimates were obtained for five pool elevations [14, 17, 20, 25 and 30 feet (NAVD88)] based on 2-D dam break - inundation runs for twenty hours after failure using LIFESim (see Needham et al 2011). LIFESim was developed for USACE at Utah State University (Aboelata and Bowles 2005). Estimates were made for breaches in a single location for each of the seven consequences subreaches and for twelve two-hour times of the day to account for diurnal variations in population at risk, warning system effectiveness and warning issuance times relative to the time of initiation of the breach. Two estimates were obtained at pool elevation 20 feet (NAVD88) for the Baseline case since this pool elevation is the dividing elevation between when a pre-evacuation would occur for higher lake elevations and no preevacuation for lower elevations. It was not necessary to estimate no-failure life loss since spillway releases are controlled to be less than life-threatening flow rates. Therefore, only failure life loss was estimated and incremental life loss was not calculated. No significant overlaps occurred between census blocks in which life loss was estimated to occur as the result of failures in different consequences subreaches. Therefore, the life-loss events resulting from one or more breaches in any of the seven consequences subreaches can be considered to be mutually exclusive with no significant chance of life loss for people in the same location occurring as a result of breaches in more than one consequences subreach. The pool elevation for each loading combination, which was used as the basis for interpolating between life-loss estimates and for extrapolation to lower and higher elevations in the risk model, was assumed to be the pool elevation that was used to determine the SRP for each 2 To properly estimate the overall probability of failure and associated consequences, a common cause adjustment (Bowles et al 2001) was applied to the SRPs for these three failure modes in Level 6 using DeMorgan s rule (Ang and Tang 1984) based on an assumption that their occurrence is uncorrelated. failure mode. These pool elevations are referred to as the life-loss controlling elevations and are defined in Section 3.3 and further discussed in Section 3.5. Since no significant overlaps occurred between census blocks in which life loss was estimated to occur, there was no need to account for overlapping areas associated with multiple failures in different consequences subreaches to avoid double (and higher order) counting for the same loading combination. However, the probabilities of lifeloss occurring in non-overlapping areas as the result of failure for any combination of failures in the seven consequences subreaches had to be considered so that the total estimated life loss could be estimated as the addition of life loss in the combinations of consequences subreaches that fail (see example in 2b in Section 2.3). There are a total of 127 possible combinations of the failure of seven consequences subreaches varying from single consequences reaches to all possible combinations of two through seven consequences subreaches for the same loading event for each of the twelve 2-hour exposure times Economic losses Economic consequences include embankment and point feature repair costs, direct damages, (estimated using HEC- FIA), other direct damages, agricultural damages as the result of inundation and other lost benefits during the period of time that it would take to repair the breached dike. The property and agricultural damages were estimated based on 1-D inundation model runs for five pool elevations [14, 17, 20, 25 and 30 feet (NAVD88)] for breaches located in each of the seven consequences subreaches. Since economic losses are determined by the equilibrium elevation reached after a breach, the stillwater elevation associated with each loading combination was used as the basis for interpolating between these estimates and for extrapolation to lower and higher elevations in the risk model. It was not necessary to estimate no-failure economic consequences since spillway releases are controlled to be less than damaging flow rates. Hence only failure economic consequences were estimated and incremental economic consequences were not calculated. It was found that economic consequences are expected to be essentially the same for a breach located anywhere in Reach 2 or for a breach located anywhere in Reach 3. Therefore, to avoid double counting of economic consequences for cases in which there was a probability of multiple breaches occurring for the same loading combination, these consequences were input to the risk model for the following mutually exclusive breach events: 1) One or more CSRs failing in Reach 2 not Reach 3 2) One or more CSRs failing in Reach 3 not Reach 2 3) One or more CSRs failing in Reaches 2 and 3 The probabilities of occurrence for each of these combinations were obtained by assuming mutual independence between failures in each of these HHD Reach failure combinations, which is consistent with the assumption of mutual independence for all failure modes at the consequences subreach level. 5 ANCOLD Proceedings of Technical Groups

6 2.6 USACE tolerable risk guidelines developed to run all 97 CSRs separately and to store the The USACE tolerable risk guidelines (USACE 2010) were resulting probabilities of failure for all (approximately applied to assess the significance of the estimated risks. 200,000) event tree branches in the database. Failure These guidelines include a two-part evaluation process. In modes associated with point features (i.e. conduits and the first part the total estimated risk for all failure modes is flood walls) were included in the CSR in which these compared against the following USACE tolerable risk features are located, and thus they contribute to the limit values : estimated probability of failure for that CSR. A postprocessing capability was developed using Excel 1) An Annual Probability of Failure (APF) limit value of workbooks to roll-up risk estimates to the various system 1 in 10,000 /year as a measure of the performance of the levels, to develop graphical displays, for the evaluation dam (see the horizontal limit line at 1 in 10,000 /year on against USACE tolerable risk guidelines and additionally to Figure 3) - the total APF was rolled up for all 97 CSRs make comparisons for sensitivity runs and later for in Reaches 2 and 3. alternative risk management plans. 2) An Individual Risk (IR) limit value 1 in 10,000 /year as a measure of life-safety risk expressed as the probability of life loss for the identifiable person(s) f-n Chart most at risk (see the point at 1 in 10,000 /year on Figure 1.E-02 4a) - the maximum value of the IR across all CSRs 1 life/yr estimated by multiplying the total probability of failure 1.E-03 totalled over all failure modes for each consequence 0.1 lives/yr subreach by the highest fatality rate applicable in the 1 in 1.E-04 10,000/year consequences subreach ) A Societal Risk (SR) limit value expressed as a limit of lives/yr 1.E-05 tolerability on a cumulative probability distribution (F N chart) of exceeding various magnitudes of life loss as lives/year 1.E-06 a measure of life-safety risk to non-identifiable or random persons (see the sloping and vertical limit lines on Figure 4b) - estimated by combining the life loss 1.E-07 probability pairs for all loading combinations for all consequence subreaches into an F-N chart (see Figure 1.E ,000 4b). Average Life Loss Estimate, N 4) An Annualised Life Loss (ALL) of lives/year as the average magnitude of life loss from the probability Figure 3. f-n chart showing USACE (2010) APF and distribution of life loss in 3) as an average measure of ALL tolerable risk limit guidelines 3 societal life-safety risk (see the sloping limit line at lives/year on Figure 3) - estimated by summing the products of all life loss probability pairs for all Risks are unacceptable, 1.E-03 loading combinations for all consequences subreaches. except in 1.E-03 exceptional circumstances. Societal Tolerable Risk Limit In the second part of the USACE tolerable risk evaluation, Individual a determination is made of whether risks have been reduced 1.E-04 Tolerable 1.E-04 Risks are unacceptable, Risk Limit except in exceptional to be as low as reasonably practicable (ALARP) [(USACE circumstances. (2010) and Munger et al (2010)]. This evaluation applies only to alterative risk management plans and so it is not described in this paper. 1.E-05 1.E-05 Risks are tolerable The USACE TRG applies to an entire reservoir system and 1.E-06 Risks are 1.E-06 only if they satisfy tolerable only if the ALARP so they are being assumed to apply to the entire HHD they satisfy the requirements. ALARP system and not just to Reaches 2 and 3. This implies that requirements. the risk evaluation against USACE TRG conducted in this risk assessment for Reaches 2 and 3 will not be a complete evaluation until the risk for all eight reaches of the HHD 1.E-07 1.E-07 1.E-08 1.E-08 has been evaluated N, number of potential fatalities due to dam failure 2.7 Implementation of risk modelling The event tree risk model calculations were accomplished using DAMRAE, which has been developed for USACE by (a) (b) RAC Engineers & Economists and Utah State University Figure 4. a) USACE (2010) individual risk limit guideline. (IDSRM 2009). The database version of DAMRAE was b) F-N chart with USACE (2010) societal risk limit adapted so that the inputs for all 97 CSRs can be read from guideline. an Excel spreadsheet in which they can be efficiently entered and checked. A batch processing capability was N = weighted average annual life loss estimated as ALL/APF. Probability of Life Loss for the Individual Most At Risk (Per Year) Annual Failure Probability, f (/year) F, probability per year of potential loss of life N Dams and Water for the Future 6

7 3.0 Risk model for each CSR 5) Multiple breaches with overlapping inundation areas affect rolled-up failure probability and consequences and risk evaluation. The event tree risk model for any dam typically has four major parts: loading, system response for the significant failure modes, exposure and consequences. For the HHD, the event tree risk model is applied to each CSR separately; but the same loading cases must be applied to all 97 CSRs such that the simultaneous effects of each loading case are considered for all 97 CSRs and hence the potential for multiple failures can be accounted for appropriately. Since the probability that failure consequences will occur is a function of the probability of failure in multiple CSRs, the exposure and consequences aspects cannot be included in the event tree models for the individual CSRs. Therefore, they are accounted for in the post processing stage at which the probabilities of failure for all CSRs are available to roll up to estimate the probability that consequences will occur, including consideration of exposure varying over twelve two-hour time periods. 3.2 Approach to system response probability estimation For each significant failure mode, the relevant and significant attributes of the wind and lake water level loading were identified. USACE toolboxes, various supporting analyses, and expert judgment were used to estimate the system response probabilities (SRPs). SRP relationships are conditional probabilities of failure, where the conditioning of these probability estimates are functions of various loading attributes, referred to as loading variables and described in Section 3.3. For more detail on each failure mode and SRP estimation see Davis et al (2011). 3.1 Overview The HHD system is a complex one on which to perform a dam safety risk assessment, and far more complex than the typical dam and reservoir system located on a river. The 3.3 Loading variables complexity is due to many factors, including the following: 1) High stillwater levels persisting for almost a year 2) Highly dynamic and spatially variable wind loading 3) Short-duration wind setup reduces likelihood of piping 4) Embankment length increases probability of failure The loading is represented in the risk model by the various loading attributes that result from the wind acting on the stillwater level and which are needed to estimate the SRPs for each failure mode. These loading attributes are estimated such that the important simultaneous spatial interrelationships between them are approximately represented throughout the HHD system. The primary loading variables in this risk analysis are stillwater elevation (E) and annual maximum wind speed perpendicular to the dike (Sn). Table 1 lists the six loading attributes (two primary and four secondary) that were used in the risk model to calculate the SRPs for each failure mode and the source of each loading variable estimate. 3.4 Representation of probability of loading Some important considerations for establishing the form of the loading event probability relationships are as follows: 1) Combinations of annual peak wind events and continuous stillwater elevation events were assumed to be uncorrelated events. 2) Hydrographs based on simulations performed by SAJ showed that for high stillwater peak levels the recession can continue into the following summer due to limited release capacity of Lake Okeechobee, which is further constrained to avoid downstream damages [see Hadley et al (2011)]. The prolonged nature of high stillwater levels was considered by representing their probability of occurrence using a stage-duration relationship that incorporates the entire range of stillwater elevations up through and exceeding the PMF. Since the HHD is exposed to wind events that can occur over a prolonged period, the types of wind events that could threaten the HHD over the entire year were considered. This was achieved by dividing the year into two wind seasons for which the annual maximum wind speed probability Table 1. Loading variables used to estimate system response probabilities for failure modes a Failure Mode Loading Variables Source Overwash (1) Average overwash discharge rate Interpolated from STWAVE and ACES results tabulated for E and Sn Overtopping (2) Peak overtopping discharge rate Calculated using the broad crested weir formula with C = 2.62 for peak annual setup elevation interpolated from STWAVE and ACES results tabulated for E and Sn (3) 50% peak setup elevation Peak setup elevation interpolated from STWAVE and ACES results tabulated for E and Sn Embankment slope instability Flood wall instability (4) E and (5) Sn Interpolated from STWAVE and ACES results tabulated for E and Sn. Stability analyses performed for values of maximum significant wave height and wave period from STWAVE and ACES corresponding to E and Sn All piping failure modes (6) Maximum setup elevation meeting the minimum duration for piping failure criterion Based on four setups representing the range of historical variation in setup for 3-, 6-, 12-, 24- and 48-hour durations (see Section 3.5) a. (4) E = stillwater elevation (feet) (NAVD88) and (5) Sn = annual maximum wind speed perpendicular to the dike (feet/sec) 7 ANCOLD Proceedings of Technical Groups

8 distributions in each of eight compass directions were found to be reasonably homogenous. These seasons were August - October for the season in which large hurricanes occur and November - July for the nonhurricane wind season. 3) The wind speed probabilities are expressed as annual exceedance probabilities (AEPs) and thus they provide the annualisation of the probability of loading and the resulting probabilities of failure obtained from the risk model. These probability distributions are based on analysis of historical winds and extended to lower frequency 1 in 500 AEP events using point design storm wind events from the ASCE (2003) Manual on Wind Load Conditions (ASCE 07-02). 4) To properly estimate the probability of failure at system levels above an individual CSR (see Figure 1), it was necessary to characterise the loading as sets of simultaneous values of the six loading variables listed in Table 1, for all 97 CSRs in Reaches 2 and 3. The term simultaneous here refers to the most severe values of the loading variables that occur during the same loading event. The four secondary loading variables were estimated using the numerical wave transformation model STWAVE (Steady-state spectral WAVE) and wave run-up and overwash rates were calculated using elements from the USACE Automated Coastal Engineering System (ACES). Results were obtained for all combinations of eight stillwater elevations (E) and twelve peak annual maximum wind speeds (Sn). These were tabulated such that the secondary variables of average overwash discharge rate and peak setup elevation can be interpolated in DAMRAE for any combination of stillwater elevation and wind speed perpendicular to the dike. In addition, flood wall stability analyses were performed for values of maximum significant wave height and wave period obtained from STWAVE and ACES for all combinations of the values of E and Sn. Details of this modelling are described in Hadley et al (2011). 3.5 Event tree risk model The DAMRAE event tree risk model calculates probabilities of failure for the embankment and point feature failure modes for a single CSR for a wide range of stillwater and hurricane and non-hurricane wind loading event combinations. The complete event tree for a single CSR contains 29 levels of branches. It is somewhat complicated because of the need to represent sets of simultaneous values of the six loading variables and to satisfy various computational requirements that are internal to DAMRAE. A simplified version of the event tree with 15 levels of branches is presented in two parts in Figures 5 and 6 with various levels of branches needed to implement detailed internal calculations removed. The part shown in Figure 6 follows on from the part shown in Figure 5. Figure 5 includes subfigures showing the various stillwater and wind loading relationships. Figure 6 includes subfigures showing the various SRP relationships and equations that are applied in some state function event tree branches. Each event tree branch represents the event that is labelled below the branches in the event tree schematics, and each branch has an associated probability of that event occurring. Levels 1 13 of the simplified event tree contain the loading part of the event tree and Level 14 contains the failure modes. Level 15 contains the lifeloss controlling lake elevation for use in estimating life loss. The first three levels in the complete event tree contain the following CSR attributes in state function branches, which are not shown in the simplified event tree: midpoint station (STN) (feet); minimum crest elevation ( C) (feet) (NAVD88); and orientation (θ) (degrees from North). The two types of wind events have different physical characteristics and a different probability distribution of annual maximum wind speeds. These annual maximum wind speed events in each wind season are independent events, and therefore separate event trees are used for each wind season. The probabilities of failure estimated using each event tree summed to obtain a total probability of failure for both wind seasons. Purely for reasons of computational efficiency, the same result is achieved in DAMRAE by assigning a probability weight of 1.0 to both wind season branches thus combining the two event trees that begin at Level 1 in Figure 5. In addition to wind direction, several transects along which the wind acts were considered on a 10-mile grid, as illustrated for a SW wind direction by the green lines in Figure 5 Level 3 subfigure. In Level 8, the transect intersection station at which the wind direction transect intersects the dike (STNt) is obtained as illustrated in Figure 5 - Level 8 subfigure. In Level 9 the transect location adjusted Peak Setup ( Ut) is calculated as illustrated in Figure 5 Level 9 subfigure. The sloping chart in this subfigure shows the peak setup as a percentage of the maximum setup at the intersection of the wind direction transect and the dike at the point labelled zero, with percent setup decreasing linearly between 5 and 30 miles on both sides of the point of intersection, based on historic Lake Okeechobee setup patterns. For example, if a CSR is centred twenty miles away from the intersection station, the peak setup at the centre station of that CSR for a particular E and Sn loading combination would be reduced using the percentage interpolated from the sloping plot in the Figure 5 Level 9 subfigure, which is 40% for the example shown. The event tree divides at several levels into groups of branches that represent a range of values that the represented event can take on. DAMRAE represents two types of groups of branches: a continuous branch group and a discrete branch group; although even continuous branch groups are actually a group of discrete branches for computational purposes. Continuous branch groups are used to represent the stillwater-stage duration and annual maximum wind speed probability distribution relationships at Levels 2 and 4, respectively. Continuous branch groups are shown in the event tree schematics using fan shaped symbols, which are a concise way of Dams and Water for the Future 8

9 Elevatio n (feet NAVD88) 35 Adjusted Peak Setup El =Peak Setup El * % Setup...Equation % % % % % % % Percent Non - exceedance Hurricane Season: Aug - Oct Non - hurricane Season: Nov - Jul Stillwater Partition Mid - Level 2: Stage-Duration for Wind Seasons Level 3: Wind Direction (γ) Probability Weights green transect lengths relative to red and green transect lengths within ± 30 miles of Reaches 2 and 3 (Example for SW direction) Level 8: Transect Intersection Station (STNt) Level 9: Transect location adjusted Peak Setup ( Ut) Sn = S * cosine [(θ + /2 rads) - γ]..equation 5 Peak Overtopping Discharge = 2.62*(Adjusted Peak Setup El - MinCrestEl) 3/2..Equation 6 Level 5: Wind speed perpendicular to dike orientation Wind Speed (mph) Annual Exceedance Probability N: AUG-OCT NE E SE S SW W NW N: NOV-JUL NE E SE S SW W NW Wind Speed Partition Mid Points Level 4: One-hour annual maximum wind speed (S) probability distribution by wind season and direction CSR 1 E1 E2 E3 E4 E5 E6 E7 E SP SP SP SP SP SP SP SP SP SP SP SP Level 6: Peak Setup Elevation for wind speed perpendicular to dike (U) CSR1 example of table for interpolation Figure 5. Simplified event tree for a single computational subreach with loading relationships Level 11: Peak Overtopping Discharge Rate CSR 1 E1 E2 E3 E4 E5 E6 E7 E SP SP SP SP SP SP SP SP SP SP SP SP Level 10: Orientation-adjusted Average Overwash Discharge CSR1 example of table for interpolation Level 7: Transect Location Weights - solid green transect length relative to all green transect lengths within ± 30 miles of Reaches 2 and 3

10 Setup Elevation (feet NAVD88) Stillwater Elevation Minimum Setup Duration for Piping Failure Peak Setup Elevation Setup Duration (hours) Minimum Setup Duration for Piping Failure Probability Bands: Level 13: Maximum Setup Elevation for Critical Duration of Setup for Piping Failure Example for Stillwater Elevation 15 feet (NAVD88) with 10 feet Peak Setup System Response Probablity Average Unit Discharge (cfs/ft) Overwash Failure Overtopping Failure Level 14: Overtopping and Overwash SRPs System Response Probability 1.E+00 1.E-01 1.E-02 1.E-03 1.E-04 1.E-05 1.E-06 1.E-07 1.E-08 1.E-09 1.E-10 1.E-11 1.E Max Set-up El for Critical Duration for Piping (feet NAVD88) Weighted All CSRs Case 1 All CSRs Case 2 All CSRs System Response Probability % Peak Set-up El (feet NAVD88) CSRs - Group A CSRs - Group B CSRs - Group C CSRs - Group D CSRs - Group E CSRs - Group F CSRs - Group G CSRs - Group H CSRs - Group A 86-90, CSRs - Group B 47-54, CSRs - Group C 11, 37, 55 CSRs - Group D 79, 91 CSRs - Group E CSRs - Group F 1-10 CSRs - Group G CSRs - Group H 25-36, Level 14: Piping through Embankment (IM13) SRPs Level 14: Embankment Slope Instability Failure SRPs System Response Probability System Response Probability 1.E-01 1.E-02 1.E-03 1.E-04 1.E-05 1.E-06 1.E-07 1.E-08 1.E-09 1.E-10 System Response Probability Max Set-up El for Critical Duration for Piping (feet NAVD88) CSRs - Group A BE CSRs - Group B BE CSRs - Group C BE CSRs - Group A LB CSRs - Group B LB CSRs - Group C LB CSRs - Group A UB CSRs - Group B UB CSRs - Group C UB Max Set-up El for Critical Duration for Piping (feet NAVD88) IM17 CSRs 11, 37, 55, 79 & 91 IM17 CSR 50 IM18 CSRs 11 & Stillwater El (feet NAVD88) CSRs - Group A CSRs - Group B 6-11, 20, CSRs - Group C 1-5, 12-19, 21, 22 Level 14: Piping through Foundation (IM22) SRPs IM18 CSRs 55, 79 & 91 IM18 CSR50 (zero) IM19 CSRs 01, 24, 53, 65 & 97 Level 14: Structures Piping SRPs Sn=65.7-CSR01 Sn=65.7-CSR24 Sn=70.4-CSR01 Sn=70.4-CSR24 Sn=75.2-CSR01 Sn=75.2-CSR24 Sn=81.3-CSR01 Sn=81.3-CSR24 Level 14: Flood Wall Instability SRPs Figure 6. Simplified event tree for a single computational subreach with system response relationships Dams and Water for the Future 10

11 representing a large group of branches covering the entire range of values for the represented loading event, and therefore avoiding a much larger and denser event tree diagram that is difficult to understand. Discrete branches are shown at Levels 1, 3, 7, 12 and 14, to represent the wind season, wind direction, transect location weights, setup duration probability bands, and failure modes, respectively. With the exception of wind season, which is explained above, the probabilities or weights assigned to all branches in a single discrete branch group sum to 1.0, indicating that each combination of branches represent all possible values that the event can take on, such that each group of branches satisfy the requirements of being collectively exhaustive (i.e. their probabilities sum to 1.0) and mutually exclusive events (i.e. they are defined such that there is a zero probability that any combination of branches can occur simultaneously). Another DAMRAE convention for avoiding a more complex and bushy event tree schematic is by not completing the sequences of branches on the lower branches of discrete branch groups in the event tree schematic with the understanding that these branch sequences have the same schematic form as those in the branch above. Thus, the structure for the top branches in the event tree diagram should be visualised as being repeated at all lower levels that are not completed in the event tree diagram. However, the entire event tree structure is completed in the DAMRAE software and all branches are computed. In the loading part of the event tree in Levels 1 13, there are six groups of nested branches that represent a total of 18,420 loading combinations that are considered in the risk analysis. These are as follows: Level 1: Two discrete wind season branches. Level 2: A continuous branch group for the stillwater elevation-duration relationships for each wind season divided into ten elevation intervals or branches. Level 3: Nine discrete wind direction branches for eight compass direction branches (N, NE, E, SE, S, SW, W and NW) with transect intersection stations located within a sector of 30 miles from the beginning station of Reach 3 and ending 30 miles from the ending station of Reach 2 plus a ninth branch representing all transects with transect intersection stations outside this sector. This approach is based on setup having historically attenuated to approximately stillwater elevation over a distance of about 30 miles on both sides of the point of maximum setup. Level 4: A continuous branch group for one-hour annual maximum wind speed probability distributions for each wind season and wind direction divided into ten speed intervals or branches Level 7: Transect locations with the (discrete) number of locations varying from one to four for each wind direction to account for all transects in the same direction with intersections within ± 30 miles using the ratio of the transect length to the sum of all transect lengths with intersections within ± 30 miles for the same direction as shown in Figure 5 Level 9 subfigure. Level 12: Four discrete setup duration probability bands for the critical duration of setup for a piping failure to occur. In the event tree calculations, it is the annual probability distribution of the primary loading variable of annual maximum wind speed in Level 4, adjusted to obtain a wind speed perpendicular to the dike in Level 5, that provides the basis for the annualisation of the estimates of the probability of failure of the dike. The variation in the other primary loading variable of stillwater elevation is represented using the stage-duration relationships in each wind season in Level 2, which provide estimates of the conditional probabilities of the stillwater pool elevations that can exist coincident with a given annual maximum wind speed. The four additional secondary loading variables (peak setup elevation at Level 6, average overwash discharge rate at Level 10, peak overtopping discharge rate in Level 11 and maximum setup elevation meeting the minimum duration of setup for piping failure criterion at Level 13) are calculated in the event tree based on the values of the two primary variables that are assigned in the event tree at Levels 2 and 4. The maximum setup elevation for critical duration of setup for piping failure is calculated for a particular combination of stillwater elevation and peak setup resulting from a particular wind speed, direction and transect location based on the ranges of historical variation in setup for 3-, 6-, 12-, 24- and 48-hour durations. These variations are approximated for four 25% probability bands (0-25%, 25-50%, 50-75% and %) as shown by the coloured lines in the Figure 5 Level 13 subfigure. This subfigure shows the minimum duration of setup for piping failure criterion and an example of the setup for the four 25% probability bands for a stillwater elevation of 15 feet (NAVD88) and a wind speed that results in a peak setup of 10 feet. The minimum duration of setup criterion is met in a probability band for setups that exceed the criterion line. The largest (maximum) setup elevation for which the critical duration of setup criterion is met is the elevation that determines the piping SRP values that are used for this particular loading combination of stillwater elevation and wind speed. In this example, these elevations are about 25 feet and 22 feet (NAVD88) for the 50-75% and % probability bands, respectively; but for the other two probability bands there are no intersections of the criterion line and so stillwater elevation would be used to determine the piping SRPs for these probability bands. Level 14 contains the embankment and point feature failure modes in a discrete branch that is referred to as a failure branch. The Level 14 subfigures in Figure 6 contain the SRP relationships for each failure mode. The parallel arrangement of these failure modes in the event tree schematic denotes the potentially simultaneous manner in which these failure modes can occur as a result of the common cause of the loading combination from wind speed and stillwater elevation and their secondary effects. Whether or not a particular failure mode is actively considered for a particular loading combination 11 ANCOLD Proceedings of Technical Groups