Structural Safety 47 (2014) 13–23

Contents lists available at ScienceDirect

Structural Safety

journal homepage: www.elsevier .com/locate /s t rusafe

Updating piping reliability with field performance observations

http://dx.doi.org/10.1016/j.strusafe.2013.10.0020167-4730/� 2013 Elsevier Ltd. All rights reserved.

⇑ Corresponding author at: Deltares Unit Geo-engineering, P.O. Box 177, 2600 MHDelft, Netherlands. Tel.: +31 (0)883357236; fax: +31 (0)883357676.

E-mail address: timo.schweckendiek@deltares.nl (T. Schweckendiek).URL: https://www.deltares.nl/en

T. Schweckendiek a,b,⇑, A.C.W.M. Vrouwenvelder c,d, E.O.F. Calle a

a Deltares Unit Geo-engineering, P.O. Box 177, 2600 MH Delft, Netherlandsb Department of Hydraulic Engineering, Delft University of Technology, Delft, Netherlandsc TNO, Delft, Netherlandsd Department of Structural Engineering, Delft University of Technology, Delft, Netherlands

a r t i c l e i n f o

Article history:Received 16 July 2012Received in revised form 6 June 2013Accepted 9 October 2013Available online 14 November 2013

Keywords:Reliability updatingFlood defensesLeveesInternal erosionPipingSand boilsField observationsExtreme events

a b s t r a c t

Flood defenses are crucial elements in flood risk mitigation in developed countries, especially in deltaicareas. In the Netherlands, the VNK2 project is currently analyzing the reliability of all primary flood defensesas part of a nationwide flood risk analysis. In this project, as in most other reliability analyses of flooddefenses, prior probabilities of relevant parameters such as ground conditions use to be based on sparse siteinvestigation data and/or expert judgment. What is largely neglected is the observed performance duringextreme events such as excessive seepage or sand boils. Using this information and thereby reducing uncer-tainties contributes to identifying weak spots or to increasing reliability where positive signs of perfor-mance are observed. Ultimately, this contributes to focusing investments in flood defenses where theyare needed the most. This paper proposes a method based on Bayesian Inference for updating uncertaintiesand focuses on the failure mechanisms uplift and piping. Attention is paid to the system reliability effects inthis failure mode, too. The methodology is applied to a case study in the Netherlands, the prior probabilitiesstem from the VNK2 project. The results suggest that depending on the observation, the probability offailure can either increase or decrease by about a factor 10. The findings clearly contradict the commonperception, at least in the Netherlands, that if a structure survives an extreme (load) event its reliabilityalways increases. That is only true unless bad performance-related observations have been made.

� 2013 Elsevier Ltd. All rights reserved.

1. Introduction non-exceedance of one or several (failure) limit states conditional

Flood defense levees are crucial elements in flood risk mitiga-tion in developed countries, especially in riverine and deltaic areas.In the Netherlands, the VNK2 project [1] is analyzing the reliabilityof all primary flood defenses as part of a nationwide flood risk ana-lysis. In this project, as in most other reliability analyses of flooddefenses, prior probabilities of relevant parameters such as groundconditions use to be based on sparse site investigation data and/orexpert judgment. Observed performance during extreme events islargely neglected, probably due to the lack of appropriate methodsto incorporate such information. Since the incorporation of suchdata can change the reliability and the probabilities of the under-lying basic random variables significantly, the information is valu-able for safety assessment and upgrading analysis.

During extreme floods, we often make observations in the fieldthat are related to failure modes. The simplest type of observationis survival of the extreme load event; for levees this would mean

on the observed flood stage. In fact, such a survived loading hasstrong analogies with incomplete load tests such as pile bearingcapacity tests [2,3]. Calle [4,5], Schweckendiek [6,7] and Zhanget al. [8] have demonstrated how survival information can be in-corporated by means of Bayesian updating for slope stability andpiping (i.e., internal backward erosion). The result of such analysesis an updated (i.e., posterior) reliability, which in case of survivalinformation is always higher than the prior. Depending on themethod also updated distributions of the basic random variablescan be obtained.

Besides survival there are other field observations that can berelated to failure modes of levees and that can be used in a similarfashion. For example, sand boils indicate that piping-relatedprocesses (i.e., under-seepage or backward internal erosion) areongoing. The information provided by these observations regard-ing the ground conditions and, ultimately, reliability is largelyneglected. Only recently, rather pragmatic approaches have beendeveloped by the US Army Corps of Engineers [9] using so-calledlikelihood ratios in a Bayesian framework with a base failure rateas prior. This approach uses expert judgment to obtain both, theprior base rate (i.e., probability) of failure as well as the likelihoodratios, which modify the base rate based on observations of past

14 T. Schweckendiek et al. / Structural Safety 47 (2014) 13–23

performance such as seepage or fracturing. A more objective ap-proach consistent with the reliability analysis methods and the le-vel of detail as applied for reliability analysis of flood defensesystems in the Netherlands [1,10] is lacking.

This paper shows how survival and other field observationsrelated to the internal (backward) erosion mechanism, from nowon denoted as piping, can be used to update levee reliability. Themain original element in this paper is that not only failure orsurvival information are considered but also other field perfor-mance observations. These are related to the piping failure modeobservational limit states that have random variables in commonwith piping. Furthermore, attention will be paid to the systemreliability aspects involved whenever a blanket layer is presentand uplift is a necessary condition for piping to occur.

The general theory applied in this for reliability updating, in-cluding the definitions used throughout the paper, is outlined inSection 2. The section includes implementation details as well asa brief discussion on reducible vs. non-reducible uncertainty. Sec-tion 3 reviews the failure mode uplift and piping and the corre-sponding limit states. Thereby, it also provides the theoreticalbasis for defining the observational limit states in Section 4, inwhich field observations are related to physics-based limit statemodels. The case study from dike-ring 10 (Mastenbroek) in theNetherlands, discussed in Section 5, illustrates the effect of incor-porating the additional information.

2. Reliability updating with inequality information

This section provides the theory and definitions used through-out the paper for reliability analysis and updating.

2.1. Prior analysis

Let the failure event F be defined as the limit state function Z as-suming negative values. The probability of failure is then given by:

PðFÞ ¼ PðZðXÞ < 0Þ ¼Z

ZðXÞ<0

fXðxÞdx ð1Þ

where X is the vector of random variables and fX(x) its (prior) prob-ability density function (PDF). Some ground-related uncertainties, inparticular the stratification, are modeled as scenarios Ei. The jointPDF of the random variables can depend on the scenario. The totalprobability of failure over all (mutually exclusive) scenarios is givenby:

PðFÞ ¼X

i

PðFjEiÞPðEiÞ ð2Þ

where the set of scenarios is complete (i.e.P

iP(Ei) = 1).

2.2. Fragility curves

Fragility curves are representations of the aggregated resistanceR with respect to a dominant load variable S (i.e., R contains allvariables in X, except S), providing the conditional probability offailure with respect to S:

PðFjfS ¼ sgÞ ¼Z

ZðR;sÞ<0

fRðrÞdr ¼ FRðsÞ ð3Þ

For the geotechnical failure mechanisms of river dikes or levees, theriver water level is usually the dominant load parameter [11].

2.3. Posterior analysis

The two methods for Bayesian posterior analysis describedbelow are mathematically equivalent and differ only in terms of

implementation. Both are used with information of inequality type[12] where the observation e is described in terms of theexceedance of an observational limit state expressed in terms ofan observational limit state function h:

e � hðXÞ < 0 ð4ÞFor several simultaneous observations the evidence is given by theirintersection: e �

TkfhkðXÞ < 0g.

2.3.1. Indirect reliability updatingThe indirect method uses Bayes’ rule to update the PDFs of the

basic random variables:

fXjeðxÞ ¼PðejfX ¼ xgÞfXðxÞR

PðejfX ¼ xgÞfXðxÞ dxð5Þ

Consequently, the posterior probability of failure is obtained by:

PðFjeÞ ¼Z

ZðxÞ<0

fXjeðxÞ dx ð6Þ

The most obvious implementation for solving the problem with theindirect method would be discretization and numerical integration,which is very computationally expensive for high-dimensional pro-blems. A less expensive alternative is Markov Chain Monte Carlosimulation.

2.3.2. Direct reliability updatingDirect updating exploits the definition of the conditional prob-

ability, which the expression below shows to be equivalent withthe indirect method:

PðFjeÞ ¼ PðF \ eÞPðeÞ ð7Þ

¼ 1PðeÞ

ZZðxÞ<0

Pðe \ xÞfXðxÞdx ð8Þ

This method is simpler and easier to implement, but it does not giveany information on the updated basic random variables by goingstraight away to the updated probability of failure. However, it willbe shown how even such information can be extracted, if the meth-od is implemented using crude Monte Carlo simulation (MCS).

A more implementation-oriented way of expressing the poster-ior probability of failure is

PðFjeÞ ¼ PðZðXÞ < 0 \ hðXÞ < 0ÞPðhðXÞ < 0Þ ð9Þ

which implies we need to look for the probability that failure (in thefuture) and the observation (in the past) hold at the same time, di-vided by the probability of the observation (based on prior probabil-ities). As will be shown in Section 2.5, this expression leads to arather intuitive implementation with MCS.

2.3.3. Updating scenario probabilitiesDealing with (here: stratification) scenarios and scenario-de-

pendent probability distributions of resistance and/or load proper-ties (i.e., the random variables depend on scenario Ei), thelikelihood function of a scenario is the (prior) probability of theevidence/observation, given the scenario: L(Ei) = P(e|Ei). This is usedto update scenario probabilities with Bayes’ rule:

PðEijeÞ ¼PðejEiÞPðEiÞ

PðeÞ ð10Þ

2.4. Reducible versus non-reducible uncertaintyOne way to interpret uncertainty and reliability updating as de-

scribed above is that the parameter space for which the past obser-

T. Schweckendiek et al. / Structural Safety 47 (2014) 13–23 15

vations were likely obtains more weight (i.e., likelihood) in theprobability redistribution than parameter space for which the ob-servations were unlikely. If all uncertainties involved are fully re-ducible (i.e., epistemic), which is the case is all basic randomvariables are assumed time-invariant, a subset of the parameterspace can even attain zero probability density. That is the casefor the subset for which the observations were impossible (i.e.,P(e|{X = x}) = 0), given the model.

The ‘‘learning effect’’ is greatest with perfect auto-correlation intime, in this case of the resistance variables. On the other hand, insituations with predominantly intrinsic variability (in time), wehardly ‘‘learn’’ anything from an observation with respect to the fu-ture reliability.

In practical reality, most random variables will not belong toeither category – epistemic or intrinsic – in a puristic sense. How-ever, typically, load variables like the water level will predominantlybe intrinsic, whereas geotechnical properties such as the grain sizedistribution will be virtually time-invariant and thus of epistemicnature. Even though, in principle, the uncertainty could even be splitin epistemic and intrinsic parts for each random variable, in thispaper we chose a pragmatic approach to assume each random vari-able to belong to either of the categories. The following section de-scribes how this is dealt with in the implementation of the method.

2.5. Monte Carlo-based implementationBased on the discussion in the previous section, we consider two

sets of random variables, the ones representing the past (observed)event, Xp, and the ones that represent the future event (to be pre-dicted), Xf. Within these sets, some individual random variables willbe considered time-invariant and, hence, (fully) reducible, whilethe remaining random variables will be considered intrinsicallyvariable (in time) and, hence, not reducible (at all). The steps fol-lowed for a prior and subsequent posterior analysis are as follows:

1. Simulation of the event to be predicted: Generate n realiza-tions of the basic random variables according to their jointprobability distribution. The jth realization of the ith randomvariable is denoted as Xf

ij (Superscript f stands for the futureevent to be analyzed.) Consequently, the jth realization of thevector of basic random variables is denoted as Xf

j .2. Prior probability of failure:

P̂ðFÞ ¼ 1n

Xj

1½ZðXfj < 0Þ� ð11Þ

3. Simulation of the event observed: The realizations of all vari-ables with (fully) reducible uncertainty obtain the same valueas the event to be predicted (full correlation in time, time-invariance):

Xpij ¼ Xf

ij ð12Þ

The random variables assumed to be intrinsically variable obtainnew independent realizations (no auto-correlation in time)according to their (joint) probability distribution.

4. Posterior probability of failure: The updating is achieved byconditioning on the observation (in general forme = {h(X) < 0}) and evaluating the following term:

P̂ðFjeÞ ¼�j1 Z Xf

j\0� �n oh

\T

hk Xpj \0

� �n o�� i�j1

Thk Xp

j \0� �n oh i ð13Þ

Notice that similar procedures can be used for updating the dis-tributions of basic random variables and fragility curves.

3. Piping reliability

Since this paper focuses on applying the theory describedhitherto to the failure mode uplift and piping, below we briefly re-view our conceptual model for the phenomenon before providingoperational definitions of limit state functions and the correspond-ing input variables.

3.1. Uplift, heave and pipingThe conceptual model underlying the piping reliability model-

ing in Dutch practice is illustrated in Fig. 1. The typical situationaddressed here is a relatively lowly permeable levee with lowlypermeable blanket on the land-side and, not necessarily so, onthe river side. High flood stages generate high pore pressures inthe relatively highly permeable aquifer underneath (a). Whenand where the pressure exceeds the weight of the blanket, the lat-ter may rupture (b, uplift) causing accelerated upward groundwater flow through the created discontinuities. If the flow exceedsa critical rate (c, heave), sand particles are transported, too. Subse-quently, the internal erosion progresses in upstream direction (i.e.,towards the river) forming erosion channels – so-called ‘‘pipes’’ (d).If the piping process does not come to a halt, the erosion channelsprogress to the river, the erosion through the channels acceleratessignificantly and the levee can be ‘‘undermined’’ and collapse (e, f).Note that the same process is often also called under-seepage orbackward erosion in the literature. For sake of conciseness we willrefer to piping in some occasions, where actually the whole processis referred to.

3.2. Groundwater flow modelBefore describing the limit state models applied to analyze the

phenomena described above, this section introduces the ground-water flow model used in the analysis. Notice it may be substi-tuted by any groundwater flow model providing appropriateestimates of the hydraulic head in the aquifer (e.g., numericalmodels).

Before providing the actual performance or limit state func-tions, we introduce the groundwater flow model used for evaluat-ing uplift and heave in this study. For both mechanisms, we need toestimate the potential / [m] at the landside exit point. Notice thatin the following all surface and phreatic levels are denoted as h(with a subscript), whereas the / stand for hydraulic heads inthe aquifer. The most common situation in the Netherlands, whichwill also be addressed in the case study, is an aquifer underlying a(semi-pervious) blanket layer. A blanket may be present in the hin-terland as well as in the foreshore. Fig. 2 contains a schematic re-presentation of that situation and the associated groundwaterflow model.

The potential at the exit point may be described by the dampingfactor k defined as :

/exit ¼ hp þ kðh� hpÞ ð14Þ

where h [m] is the (river) water level, hp [m] is the hinterland phrea-tic level (both with respect to mean sea level). In general, k can beestimated using groundwater flow models, calibration based onmonitoring data or expert judgment. The so-called exit gradient i(i.e., the gradient in the blanket at the exit point) is defined in thiscase as

i ¼ ð/� hpÞ=d ¼ kðh� hpÞ=d ð15Þ

where d [m] is the thickness of the hinterland blanket.In the case study in Section 5 we will apply an analytical

groundwater flow model based on Dupuit flow (i.e., predominantlyhorizontal flow with vertical leakage) to estimate k, which, making

Fig. 1. Phases of the piping process.

Fig. 2. Groundwater flow model for an aquifer under an impermeable dike withlow-permeability blankets.

16 T. Schweckendiek et al. / Structural Safety 47 (2014) 13–23

a few assumptions about the extent and permeability of the leveeand the blankets, is given by:

k ¼ kh=ðLf þ Bþ khÞexpðB=2�xexitÞ=kh ð16Þ

where xexit [m] is the distance of the exit point from the center ofthe levee footprint, B [m] is the width (i.e. footprint) of the levee,Lf [m] is the length of the foreshore, k [m/s] is the hydraulic conduc-tivity of the aquifer, D [m] is the aquifer thickness, and kh [m] is theso-called ‘‘leakage length’’ for the hinterland section given bykh ¼

ffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffikDd=kh

p, where kh [m/s] is the hinterland blanket’s hydraulic

conductivity. For details on the assumptions and the derivation it isreferred to [13,14].

3.3. Limit statesThe limit states for uplift, heave and piping will be used for the

mathematical description of both, failure and the observation.

3.3.1. Uplift. The uplift model used in this thesis is the same as usedin safety assessments and design in the Netherlands [13] andelsewhere1 It is based on a comparison of pore pressures at the

1 This uplift model is applicable for blankets of homogeneous thickness. Forsituation with drainage ditches or other discontinuities in the thickness there areother models available for uplift (see e.g. [13]).

upper boundary of the aquifer with the weight of the blanket layer.This leads to the following limit state function in terms of gradients:

Zu ¼ guðxÞ ¼ muic;u �m/i ð17Þ

ic;u ¼ �/c;u=d ¼ csat � cw

cwð18Þ

where mu and m/ are model factors addressing the uncertainty inthe critical and actual gradients respectively (i.e., ic,u and i),D/c,u [m] is the critical head difference, d the blanket thickness atthe exit point, csat [kN/m3] the saturated volumetric weight of theblanket and cw [kN/m3] the saturated volumetric weight of water.The corresponding critical water level (e.g., ‘‘failure water level’’) is

hc;u ¼ hp þmudðcsat � cwÞ=cw

m/kð19Þ

which can be considered the cumulative resistance against the mainloading on river levees – the water level h. This implies that anequivalent limit state function would be gu(X) = hc,u � h and thatthe CDF of hc, u is the uplift fragility curve (see Section 2.2).

3.3.2. Heave. While uplift is concerned with the breaching of theimpervious blanket, heave concerns the start of erosion. The excee-dance of a critical heave gradient ic, h [–] is considered a necessary(not sufficient) condition for transport of eroded material from theaquifer to the surface:

Zh ¼ ghðXÞ ¼ ic;h � inffi; igg ð20Þ

where i is the same exit gradient as in the uplift performance func-tion and ig is the so-called limit gradient and inf is the infimum. Thebackground of the limit gradient is that the pressure at the bottomof the blanket cannot exceed the weight of the overlying blanket.Hence, for heads or gradients obtained by groundwater flow analy-sis which does not implicitly consider this physical phenomenon(i.e. the aspect is not already implied in the damping factor k), tak-ing the minimum of the two takes care of this aspect. The corre-sponding critical water level is given by

hc;h ¼(

hp þic;hdm/k if ic;h � ig

1 if ic;h > ig

ð21Þ

Fig. 3. Sand boils (left: active during flood; right: post-flood crater; source:Rijkswaterstaat).

T. Schweckendiek et al. / Structural Safety 47 (2014) 13–23 17

where the later case (ic,h > ig) reflects the fact that heave becomesimpossible, if the limit gradient is less than the critical heave gradi-ent. The limit gradient is usually equal to the critical uplift gradient(ig = ic,u). For typical values of ic,h it is referred to [15,16]. A word ofcaution seems appropriate regarding the applied heave model, themain limitation of which is that the heave limit state only dependson the (average) gradient over the blanket – an assumption whichmay not be universally applicable.

3.3.3. Piping. For piping we consider the average gradient-basedequilibrium model by Sellmeijer [17], which was revised recently[18]. The conceptual idea behind it is that pipe progression canstop, if the flow pattern in the aquifer changes such that the flowat the pipe front is insufficient to transport sand grains. It is impor-tant to notice that this critical (average) gradient does not refer tothe start of erosion but to pipe progression. The performance func-tion is given by:

Zp ¼ gpðXÞ ¼ mpHc � ðh� hp � 0:3dÞ ð22Þ

where mp is a model uncertainty factor, h [m+REF] is the river waterlevel (i.e., flood stage) and hp [m+REF] is the surface level at the po-tential exit point. The critical head difference Hc [m] is based on therevised Sellmeijer model [18]:

Hc;p ¼ F1F2F3L

F1 ¼ gcs

cw� 1

� �tan h

F2 ¼d70m

3ffiffiffiffiffimkLg

q d70

d70m

� �0:4

F3 ¼ 0:91ðD=LÞ0:28

ðD=LÞ2:8�1þ0:04 ð23Þ

where L = seepage length [m], cs = volumetric weight of sand grains(=26.5 kN/m3), h = bedding angle [deg], D = aquifer thickness [m],g = drag factor, d70 = 70% quantile of the grain size distribution[m], d70m = (calibrated) d70 reference value (2.08 � 10�4 m), g =gravitational constant (=9.81m2/s) and k = specific conductivity ofthe aquifer [m/s].

3.4. System reliabilityBackward internal erosion failure as in the conceptual model

presented in Section 3.1 can only occur if the uplift, heave and pip-ing limit states are all exceeded. In system reliability terms, thiscan be described by a parallel system, for which the failure set isthe intersection of the separate failure mechanisms:

F ¼ Fu \ Fh \ Fp ¼ ffguðxÞ < 0g \ fghðxÞ < 0g \ fgpðxÞ < 0gg ð24Þ

where Fi = {gi(x) < 0} represents the failure set for mechanism ormode i.

4. Field performance observations

During floods, when a levee experiences extreme loading byhigh water levels, visual inspection and / or instrumented monitor-ing may observe several piping-related phenomena which mayinfluence the piping reliability. This section relates these field ob-servations to the phenomena uplift, heave and piping (see Fig. 1)and to the respective limit states to enable quantitative analysis.

In the following, �h denotes the water level at which field obser-vations were made and Xp denotes the random variables at thetime of the observation (superscript p stands for ‘‘past’’), which isusually the maximum flood stage reached an extreme event. Thefollowing shorthand notations are introduced for exceedance ofthe uplift, heave and piping limit state respectively:

Fpuj�h � fguðXpjh ¼ �hÞ\0g ð25Þ

Fphj�h � fghðXpjh ¼ �hÞ\0g ð26Þ

Fppj�h � fgpðXpjh ¼ �hÞ\0g ð27Þ

Superscript p stands for the past observed event, meaning the ex-ceedance of the respective limit state with the realizations of therandom variables in the past. This distinction between past ob-served event and future event to be predicted is important iftime-variant (i.e., non-reducible) variables are involved. The com-plement (i.e., non-exceedance of the limit state or non-failure) isdenoted as �F

pi j�h.

4.1. No seepage (no uplift)If no excessive seepage is observed during extreme flood stages,

we may conclude that no uplift has occurred (i.e., the landsideblanket is still intact). In quantitative terms we may interpret thatas the uplift limit state not having been exceeded up to the ob-served river water level. Consequently, the evidence becomes:

e ¼ �Fpuj�h ð28Þ

Since without uplift neither heave nor piping can be observed, thisobservation cannot be related directly to their limit states.

For ground conditions without blanket layer, we suppose thatexcessive seepage should always be observed during extreme floodstages. And vice versa, if no seepage is observed there must be ablanket present.

4.2. Seepage and no erosion (uplift)When (significant) seepage is observed, we may conclude that

the pore pressures under the blanket layer have led to its rupturing(see Fig. 1, phase b). Hence, the conclusion is that the uplift limitstate has been exceeded (or that there was no intact blanket layer),leading to the evidence:

e ¼ fFpugj�h ð29Þ

Even though no erosion is observed at the same time, we cannotconclude that the heave limit state has not been exceeded, becauseheave is considered a necessary but not a sufficient criterion for ero-sion. The observation does not allow us to conclude anything aboutthe (non-)exceedance of the piping limit state either.

4.3. Sand boils (uplift & heave)Sand boils (see Fig. 1, phase c and Fig. 3) are characterized by

sand transport to the surface through the blanket layer. If we ob-serve excessive seepage and erosion, the conclusion is that the up-lift limit state has been exceeded and so has the heave limit state.The combined evidence is given by:

e ¼ fFpu \ Fp

hgj�h ð30Þ

It is conservative to not use the information that no piping has oc-curred (�F

pp) in the sense of collapse because it cannot be guaranteed

that piping would not occur in the future at the same water level.The reasons are that (a) the piping process takes time and a futureflood may last longer, while flood duration is not captured in the

Table 1Relations of observations with uplift, heave and piping limit states for situations withblanket layer (summary). For situations without blanket layer only the likelihood ofthe scenarios is affected, which becomes zero for ‘‘no seepage’’ and one for ‘‘seepageand no erosion’’ and ‘‘seepage and erosion’’.

Observation Uplift Heave Piping

No seepage no (�Fpuj�h) n/a n/a

Seepage & No erosion yes (Fpuj�h) n/a n/a

Seepage & Erosion (sand boils) yes (Fpuj�h) yes (Fp

h j�h) n/a

Fig. 4. Location of the application example: dike reach 03 from the VNK2-project inthe south-western part of dike-ring 10.

Table 2Input data application example for field observations, dikering 10 (Mastenbroek) –prior distributions of the scenario-independent random variables (based on VNK2data). The seepage length L, input to the piping limit state function, is defined as L = Lf

+ B + xexit.

Xi Unit Type Mean Std(Par1) (Par2)

D [m] Lognormal nom 0.2lk [m/s] Lognormal nom 1.0ld70 [m] Lognormal 2.1E � 4 0.15ld70m [m] Deterministic 2.08E � 4h [deg] Deterministic 37h [m+REF] Gumbel a = 1.36 b = 5.75hp [m+REF] Gaussian 0.3 0.1d [m] Lognormal nom 0.3lxexit [m] Lognormal 30.0 0.5Lf [m] Lognormal 10.0 2.4B [m] Deterministic 40.0Lh [m] Deterministic 1.0E + 4kh [m/s] Lognormal 1.0E � 6 1.0lcsat [kN/m3] Gaussian 23.0 3.5cw [kN/m3] Deterministic 10.0ic Logormal 0.7 0.10mu Logormal 1.0 0.10m/ Logormal 1.0 0.10mp Logormal 1.0 0.12nom = nominal value per scenario, see Table 3.

Table 3Input data application example for field observations, dikering 10 (Mastenbroek) –prior distributions of the scenario-dependent random variables (based on VNK2 data).

i P(Ei) l l l

18 T. Schweckendiek et al. / Structural Safety 47 (2014) 13–23

Sellmeijer model and (b) that it is yet unclear if piping exhibitsmemory or cumulative effects (i.e., formed pipes remain intact afterthe flood). For a more detailed discussion and sensitivity analysis itis referred to Schweckendiek and Rijneveld [19].

4.4. Flood fightingSand bags are a common mitigation measure, when water or

sand boils are observed by dike inspection during extreme events.Even though such measures influence the head difference over thestructure, such flood fighting measures are taken after detectingseepage and/or erosion. Hence, their effect on the head differencedoes not need to be accounted for uplift and heave-relatedinformation.2

4.5. SummaryTable 1 summarizes the types of observations and the informa-

tion they provide for situations. For situations where there is noblanket on the landside of the levee, the main information pro-vided is on the scenario likelihoods themselves. The probabilityof observing no seepage at extreme flood stages without a blanketis zero; the probability of observing seepage or sand boils is one.The reason for observing seepage but no erosion may be that thereis no concentrated outflow.

5. Application example

Piping, amongst other failure modes, was subject to a reliabilityanalysis in the VNK2-project [1]. The prior probabilities are basedon data from this project. For the sake of clarity, the input has beenreduced to the main contributing stratification scenarios. Further-more, the length-effect has been neglected in this study. Therefore,the resulting probabilities of failure cannot be compared directly.The example rather illustrates relative effects. The presented re-sults are a summary of the complete results from [14].

5.1. LocationThe dike reach is located in the Netherlands along the river

IJssel in the south-western part of dikering 10 (Mastenbroek, seeFig. 4).3 This location was chosen due to its relatively large contribu-tion to the probability of failure of the dike ring due to uplift andpiping.

5.2. Input dataTables 2 and 3 show the input parameters to the application ex-

ample. Notice that the location of the exit point (xexit) here wasbased on expert judgment. The random variables are assumed sta-tistically independent. Even though some dependence between(pairs of) random variables may be expected, we need to realizethat all variables represent physically characteristic parametersfor the limit state models used. For example, in the same sand

2 If one, however, used the evidence that no piping has occurred, any reduction inhead difference achieved by the respective measures would need to be taken intoaccount.

3 VNK2 ID: Vak 03 HM1,4 – HM2,8.

layer, the permeability k is usually negatively correlated with thegrain size d70. In the piping model used, however, d70 belongs tothe (often fine) substratum at the top of the aquifer right belowthe blanket, whereas the permeability k is the characteristic value(in physical, not statistical sense) for the whole aquifer. Similarrationale hold for other pairs of random variables, such thatcorrelations are expected to be weak.

d;Ei D;Ei k;Ei

1 17.6% 2.90 20.0 3.4E � 42 62.4% 2.90 96.0 1.8E � 43 4.4% 0.00 24.5 3.4E � 44 15.6% 0.00 100.5 1.8E � 4

Fig. 5. Application example for field observations, dike ring 10 (Mastenbroek) –prior fragility curves for uplift, heave, piping and failure and probability density ofthe water level (normalized).

Fig. 6. Application example for field observations, dikering 10 (Mastenbroek) –posterior fragility curves for ‘‘no seepage’’-observation, stratification scenario E1

and probability density of the water level (normalized).

T. Schweckendiek et al. / Structural Safety 47 (2014) 13–23 19

The scenario probabilities as presented in Table 3 in theVNK-project were determined by spatial statistical analysis of alarge number of shallow (classified) borelogs [20].

As pointed out in Section 2.4, the choice of how much of the un-certainty per random variable is actually reducible can be some-what arbitrary. The main aspect in posterior analysis based onfield observations is to consider if a variable is time-invariantand, if not, how much of its variance can be attributed to intrinsicvariability. For this example the pragmatic choice was to assumeall basic random variables as epistemic (i.e., reducible) except thefollowing: the hinterland water level (hp), the permeability of thehinterland blanket (kh) and all model uncertainty factors (m/, mu

and mp).

5.3. Prior reliabilityA summary of the prior reliability analysis results is presented

in Table 4. The scenarios without blanket (3 and 4) are the maincontributors to the (total) probability of failure of P(F) = 1.9E � 3[a�1]. Fig. 5 shows the fragility curves for uplift, heave and pipingand failure for scenario E1. It clearly demonstrates parallel systemeffect: (a) the system probability of failure is always smaller thanthe smallest probability of failure of the separate failure mechan-isms and (b) the system effect is largest where the mechanismprobabilities are about the same magnitude (i.e., the difference ofthe system probability and the mechanism probabilities is largest).

Notice that all fragility curves eventually approach one for in-creasing water levels; only the heave curve can remain at a lowerlevel, which is due to the effect of the limit potential or gradient.The heave curve has a horizontal asymptote at P(ig < ic,h), whereis this case the limit gradient is the critical uplift gradient (ig = ic,u).

5.4. Observed water levelThe river IJssel experienced relatively high flood stages in

mid-January 2011. The location is about 18 km downstream ofmeasurement station Wijhe and 12 km upstream of measurementstation Kampen. Interpolation between the maximum water levelsat those locations with 4.7 and 1.5 m respectively, the maximumwater level at the dike reach under consideration on January 18,2011 was: �h ¼ 2:8 m+REF, which is an event with a return periodof roughly 11 years.

5.5. Posterior analysisIn the following, the effect of updating using the different types

of observation will be demonstrated. Even though, at the studiedlocation only ‘‘no uplift’’ (i.e., no excessive seepage) was observedduring the analyzed flood, all types of observation are contem-plated to show what their occurrence would have implied. Per ob-servation, the results and illustrations for stratification scenario E1

are presented below as well as an overview of the most importantresults for all scenarios. For the detailed results it is referred to[19].

5.5.1. No seepage (no uplift)Observing no uplift at �h ¼ 2:8 m+REF water level shifts down

the fragility curves for uplift and piping (see Fig. 6). The effect is

Table 4Application example for field observations, dike ring 10 (Mastenbroek) – prior analysis re

Uplift Heavei P(Ei) P(Fu|Ei) P(Fh|Ei)

1 17.6% 1.8E � 2 1.0E � 12 62.4% 2.8E � 2 1.7E � 13 4.4% 1.0E � 0 1.0E � 04 15.6% 1.0E � 0 1.0E � 0Total 100.0%

most obvious for uplift. Note that because there is some intrinsic,non-reducible uncertainty involved, the probability of uplift below�h is not zero. Since the limit state functions for uplift, heave andpiping have common random variables, also the probabilities ofheave and piping are affected by the observation, as is the (system)probability of failure, though not significantly. Interestingly, thefragility curve for heave is shifted upwards slightly. The reason isthat a lower probability for uplift implies higher limit gradients(ig) at the exit point (see Eq. 20).

Fig. 7 shows the changes in probabilities for the stratificationscenarios. The likelihood of a scenario is the prior conditional prob-ability of the observation for that scenario. For uplift that meansthat E1 and E2 had a prior probability of about 90% of exhibitingno uplift at the observed water level. Notice that E3 and E4 are sce-narios without blanket layer. Since for these seepage should havebeen observed clearly, they obtain a likelihood zero (i.e., the obser-vation was impossible) and, hence their posterior probability be-comes zero, too.

Furthermore, Table 5 shows that the posterior probability offailure is approximately a factor 15 lower than the prior, whichcan be mainly attributed to the ‘‘exclusion’’ of the scenarios with-out blanket layer.

5.5.2. Seepage and no erosion (uplift)Observing seepage and no erosion implies primarily that the

probability of uplift increases significantly (see Fig. 8). A higherprobability of uplift also implies that the probability of reaching

sults summary.

Piping FailureP(Fp|Ei) P(F|Ei) P(Ei)P(F|Ei)

4.8E � 4 1.4E � 4 2.5E � 55.7E � 4 2.2E � 4 1.3E � 48.9E � 3 8.9E � 3 3.9E � 48.3E � 3 8.3E � 3 1.3E � 3

P(F) = 1.9E � 3

Fig. 7. Application example for field observations, dikering 10 (Mastenbroek) –prior and posterior scenario probabilities for ‘‘no seepage’’-observation.

Fig. 8. Application example for field observations, dikering 10 (Mastenbroek) –posterior fragility curves for ‘‘seepage and no erosion’’-observation, stratificationscenario E1 and probability density of the water level (normalized).

Fig. 9. Application example for field observations, dikering 10 (Mastenbroek) –prior and posterior scenario probabilities for ‘‘seepage and no erosion’’-observation.

20 T. Schweckendiek et al. / Structural Safety 47 (2014) 13–23

the limit potential increases, or equivalently, the probability distri-bution of the limit potential shifts towards lower values. The effectcan be observed in the heave fragility curve, which shifts upwardsfor low water levels but has an asymptote at a much lowerlevel than the prior distribution. The asymptote reflects the prob-ability that the critical heave gradient is lower than the limit gra-dient. Through the parallel system behavior, the fragility curvefor failure is at the same level. Notice that this occurs for only the-oretically possible water levels with very low probability ofexceedance.

Fig. 9 shows that the probability mass is significantly shifted tothe stratification scenarios without blanket layer (E3 and E4), forwhich the likelihood equals one. From Table 5 we may concludethat the increase of the probability of failure by approximately afactor 3.5 is due to both, changes in scenario probabilities andchanges in the conditional probabilities of failure per scenario.

5.5.3. Sand boils (uplift and heave)For observing sand boils (i.e. uplift and heave) Fig. 10 shows

that all posterior fragility curves are shifted upwards with respect

Table 5Application example for field observations, dikering 10 (Mastenbroek) - prior and posterio

Prior analysis

Uplift Heavei P(Ei) P(Fu|Ei) P(Fh|Ei)

1 17.6% 1.8E � 2 1.0E � 12 62.4% 2.8E � 2 1.7E � 13 4.4% 1.0E � 0 1.0E � 04 15.6% 1.0E � 0 1.0E � 0Total 100.0%

Posterior - No seepage

i P(Ei|e) P(Fu|Ei, e) P(Fh|Ei)1 22.4% 6.3E � 3 1.0E � 12 77.6% 8.7E � 3 1.7E � 13 0.0% 1.0E � 0 1.0E � 04 0.0% 1.0E � 0 1.0E � 0

Posterior - Seepage

i P(Ei|e) P(Fu|Ei, e) P(Fh|Ei)1 2.7% 3.3E � 1 1.1E � 12 15.2% 3.4E � 1 1.9E � 13 18.1% 1.0E � 0 1.0E � 04 64.0% 1.0E � 0 1.0E � 0

Posterior - Sand boils

i P(Ei|e) P(Fu|Ei, e) P(Fh|Ei)1 1.1% 1.2E � 1 3.1E � 12 7.7% 1.6E � 1 4.0E � 13 20.1% 1.0E � 0 1.0E � 04 71.2% 1.0E � 0 1.0E � 0

to their priors. In contrast to the previous case (seepage and no ero-sion) also the heave fragility curve increases without asymptotebelow one. As a consequence, the probability of failure is nowdominated by the piping fragility curve, which is by far the lowestprobability of the three mechanisms.

r analysis results summary.

P(F) = 1.9E � 3

Piping FailureP(Fp|Ei) P(F|Ei) P(Ei)P(F|Ei)

4.8E � 4 1.4E � 4 2.5E � 55.7E � 4 2.2E � 4 1.3E � 48.7E � 3 8.9E � 3 3.9E � 48.3E � 3 8.3E � 3 1.3E � 3

P(F) = 1.9E � 3

P(F) = 1.4E � 4

P(Fp|Ei, e) P(F|Ei, e) P(Ei|e)P(F|Ei, e)4.3E � 4 1.0E � 4 9.6E � 55.2E � 4 1.5E � 4 4.0E � 48.7E � 3 8.9E � 3 0.08.3E � 3 8.4E � 3 0.0

P(F) = 7.1E � 3

P(Fp|Ei, e) P(F|Ei, e) P(Ei|e)P(F|Ei, e)1.1E � 3 6.3E � 4 3.1E � 58.8E � 4 4.9E � 4 1.3E � 48.7E � 3 8.7E � 3 1.6E � 38.4E � 3 8.4E � 3 5.4E � 3

P(F) = 7.9E � 3

P(Fp|Ei, e) P(F|Ei, e) P(Ei|e)P(F|Ei, e)2.0E � 3 1.7E � 3 2.1E � 51.2E � 3 1.0E � 3 9.4E � 58.9E � 3 8.7E � 3 1.7E � 38.4E � 3 8.4E � 3 6.0E � 3

Fig. 11. Application example for field observations, dikering 10 (Mastenbroek) –prior and posterior scenario probabilities for ‘‘sand boils’’-observation.

Fig. 10. Application example for field observations, dikering 10 (Mastenbroek) –posterior fragility curves for ‘‘sand boils’’-observation, stratification scenario E1 andprobability density of the water level (normalized).

T. Schweckendiek et al. / Structural Safety 47 (2014) 13–23 21

As for seepage, Fig. 11 shows that the probability mass is signif-icantly shifted to the stratification scenarios without blanket layer(E3 and E4), for which the likelihood equals one. This effect is evenmore pronounced, because observing uplift and heave for scenariosE1 and E2 (with blanket) was even less likely based on the priorsthan observing uplift and no piping. Table 5 shows that the in-crease of the probability of failure is approximately by a factor 4.

5.6. Posterior distributions of the basic random variables

As for the fragility curves, the posterior distributions of the (re-ducible) basic random variables can be compared to the priors inorder to get an impression of the impact of the observation. In or-der to obtain the updated distributions, the Monte Carlo samples ofthe basic random variables are conditioned on the observation si-milar to the way the posterior probability of failure is computed(see Section 2.5). For the sake of conciseness, we only show the re-sults for the ‘‘sand boils’’-observation (see Sections 4.3 and 5.5.3),which exhibits the most significant changes.

Fig. 12 shows that the random variables which are importantfor the uplift and heave limit states are most affected, namelythe permeability of the aquifer k, which affects uplift pressure,and the blanket thickness d as well as the volumetric weightcsat and the critical heave gradient ic,h.

Notice that even though the the random variables were assumedindependent a-priori, correlation can be introduced by the Bayesianupdating. More often that not correlations change from the prior tothe posterior distribution, therefore, the joint probability densityshould be used in subsequent analyses. The marginal distributionspresented here are merely meant for interpretation of the results.

5.7. Results summary

There is a significant shift in stratification scenario probabilitiesfor each observation type towards the scenarios with blanket layer

for ‘‘no seepage’’ and towards the scenarios without blanket layerfor observations that do include uplift (and heave). This effectcan dominate the overall change in the (unconditional) probabilityof failure. The uplift-related observations do not only affect the up-lift fragility curve (and, hence, the conditional probability of uplift)but also the piping fragility curve through their correlation inducedby the random variables they have in common. Only observing es-sentially no signs of failure (no seepage) decreases the conditionalprobability of failure per scenario. Observing seepage but no ero-sion (uplift) increases it and observing sand boils (uplift and heave)results in an even higher increase.

5.8. Sensitivity to time-invariance assumptions

As pointed out in Section 5.2, all (resistance) random variableswere assumed time-invariant except the hinterland water level(hp), the permeability of the hinterland blanket (kh) and model un-certainty factors (m/, mu and mp). It is hard to determine to whatdegree these are correlated in time. The assumption made in theanalyses led to the minimum updating effect possible regardingthese variables. In order to explore how the updating effect wouldbe for the other extreme, namely assuming all variables time-in-variant and, hence, fully epistemic, the results of such an analysisare presented in Table 6. The results indicate that the updating ef-fect is indeed stronger for this assumption, but not considerably.The likely reason is that other uncertainties dominate the problemat hand.

6. Conclusions

This paper has demonstrated how field performance observa-tions during extreme loading events can be used to update theprobability distributions of the basic resistance random variablesand the probability of failure by means of Bayesian posterior ana-lysis. Different types of performance observations such as seepageor erosion (e.g., sand boils) have been related to the limit states ofuplift, heave and piping in order to use them as inequality type ofinformation in the posterior analysis. The proposed method wasapplied to a case study, which has led to the following observationsand conclusions:

1. Field performance observations during historical loadings arevaluable information for the reliability of a flood defense, infact for any kind of structure for which the probability of failureis dominated by large uncertainties in resistance properties.The presented method enables using field performanceobservations as long as these can be related to a limit statewhich is correlated to the failure limit state through commonrandom variables.

2. In posterior analysis, attention needs to be paid to distinguish-ing between reducible and non-reducible uncertainties. Sincedata are usually scarce, the decision on what (part of) uncer-tainty is reducible may need to be based on judgment. The moreuncertainty is reducible, the larger are the effects of updating.

3. If not all resistance uncertainty is reducible, there is no guaran-tee that a previously survived load level will be survived againin the future. The reason is that the parameters with intrinsic(i.e., non-reducible) uncertainties may be less favorable infuture events than during the observed event.

4. The application example essentially demonstrates (a) thatchanges in probability of failure of one order of magnitude(both ways) are not unthinkable, (b) that the change in scenarioprobabilities can be significant and dominate the posteriorprobabilities and (c) that observing signs of (partial) failure

Fig. 12. Application example for field observations, dikering 10 (Mastenbroek) – posterior distributions for ‘‘uplift & heave’’-observation, stratification scenario E1.

22 T. Schweckendiek et al. / Structural Safety 47 (2014) 13–23

can outweigh the effects of not having observed actual pipingfailure (i.e., information on partial failure can have greatereffects than information on overall survival).

5. The effect of updating on the fragility curves is greatestclose to the observed water level. The impact is, therefore,

probably significant in real-time reliability assessments forflood event management (e.g., coordination of flood fightingmeasures or evacuations), where future flood events to beassessed may be of similar magnitude as the historicallyobserved one(s).

Table 6Application example for field observations, dikering 10 (Mastenbroek) – prior andposterior analysis results summary for the assumption of all random variables beingtime-invariant (sensitivity analysis).

Prior analysis P(F) = 1.9E � 3Posterior - No uplift P(F) = 1.3E � 4Posterior - Uplift & No piping P(F) = 7.3E � 3Posterior - Uplift & Heave P(F) = 8.1E � 3

T. Schweckendiek et al. / Structural Safety 47 (2014) 13–23 23

Field performance observations should be taken intoaccount for decision-making in inspection and maintenance aswell as in rehab design. Neglecting the information may lead toeither over-investments in structures which are more reliablethan based on prior data only or it may lead to under-investmentsin structures that are less reliable than initially estimated.In both cases, incorporating the information leads to cost-savings either in terms of lower construction cost or in terms oflower risk.

References

[1] Jongejan R, Stefess H, Roode N, Horst WT, Maaskant B. The VNK2-project: afully probabilistic risk analysis for all major levee systems in the Netherlands.IAHS Publication From Risk to Opportunity (in preparation).

[2] Zhang L. Reliability verification using proof pile load tests. J Geotech EngGeoenviron Eng 2004;130(11):1203–13.

[3] Ching J, Lin H, Yen M. Calibrating resistance factors of single bored piles basedon incomplete load test results. ASCE J Eng Mech 2011;137(5):309–23.

[4] Calle EOF. Proven strength – comparison of deterministic and probabilisticapproach, GeoDelft (now Deltares), Report No. 385640/18; 1999.

[5] Calle EOF. Observed strength of dikes [in Dutch: Bewezen sterkte bij dijken].Geotechniek 2005(1).

[6] Schweckendiek T. Reassessing reliability based on survived loads. In: ICCE2012 (Int. Conf. of Coastal Engineering), Shanghai, China 2010.

[7] Schweckendiek T, Calle E, Vrouwenvelder A. Updating Levee reliability withperformance observations. In: 2nd European Conference on Flood RiskManagement (FLOODrisk 2012), Rotterdam, The Netherlands 2012.

[8] Zhang J, Zhang L, Tang W. Slope Reliability analysis considering site-specificperformance information. J Geotech Geoenviron Eng 2011;137(3):227–38.

[9] USACE. Risk characterization for levees (Levee Safety Program), White Paper;30 April 2011.

[10] Manen SV, Brinkhuis M. Quantitative food risk assessment for polders. ReliabEng Syst Saf 2005;90(2–3):229–37.

[11] Bachmann D, Huber N, Johann G, Schttrumpf H. Fragility curves in operationaldike reliability assessment. Georisk 2013;7(1):49–60.

[12] Ditlevsen O. Structural reliability methods, edition 2.3.7: Internet edition(June–September 2007) Edition, Chichester, UK; 1996.

[13] TAW, Technical report on sand boils (piping); 1999.[14] Schweckendiek T. On reducing piping uncertainties – a Bayesian decision

approach [Ph.D thesis]. Delft University of Technology; 2013.[15] Terzaghi K. Effect of minor geological details on the safety of dams. Bull Am

Inst Min Metall Eng (TP 125) 1929:31–44.[16] USACE. Investigation of underseepage and its control. United States Army

Corps of Engineers (USACE), Technical Memorandum TM 3-424; 1956.[17] Sellmeijer J. On the mechanism of piping under impervious structures [Ph.D.

thesis]. Delft University of Technology; 1988.[18] Sellmeijer J, Lopez De La Cruz J, Van Beek V, Knoeff J. Fine-tuning of the piping

model through small-scale, medium-scale and IJkdijk experiments. Eur JEnviron Civil Eng [Special Issue devoted to "Erosion in geomechanics" (to bepublished)].

[19] Schweckendiek T, Rijneveld B. DIS: Onzekerheden Ondergrondmodelering –Part 2: Reducing piping uncertainties with field observations. Flood Control2015, Report No. 2011.07.02.1; 2012.

[20] Wiersma A, Vonhoegen L, Kleine M, Hoogendoorn R, Gruijters S, Maljers D,Marges V. Rapportage bepaling ondergrondparameters piping VNK2 [in Dutch;Deltares Report No. 1203622-000-BGS-0004]; 2011.