The influence of deviating conditions on levee failure rates

This study introduces a method for assessing the annual failure rate of levees based on information from historical floods, while also considering the return period of these past events. Also, an approach has been developed to quantify the influence of deviating conditions on failure rates. The presence of deviating conditions at failed and survived levee sections is analyzed based on satellite observations. Bayesian techniques and likelihood ratios are used to update the failure rate as a function of the presence of deviations. The river system of Sachsen‐Anhalt, Germany, is used as a case study. It experienced severe floods with many levee failures in the years 2002 and 2013. It is found that the presence of geological deviations had a significant influence on the observed failure rate and that failure rate increases with the magnitude of the hydraulic loading. It is also discussed how the expected number of failures in a system during a flood event with a certain magnitude can be estimated. The results of this study can be used to further optimize soil investigations, calibrate the results of more advanced reliability analyses and complement risk assessments, particularly in data‐poor environments.


| INTRODUCTION
In many parts of the world, levees play a vital role in flood risk management. A levee system is generally designed to have a certain minimum safety level threshold (Apel et al., 2004;Jonkman et al., 2017). In several countries, methods for the reliability analysis of flood defenses have been developed, for example, in the Netherlands (Jongejan & Maaskant, 2015), the UK (Hall et al., 2003), the USA (IPET, 2009), and China (Jiabi et al., 2013).
The reliability of a levee system is generally decomposed into levee sections and every section is assessed on different failure mechanisms. For every failure mechanism, both the load and strength terms and model uncertainties are incorporated in the evaluation of the limit states using probabilistic methods (Jongejan & Maaskant, 2015;Schweckendiek et al., 2014;Steenbergen et al., 2004;Vrijling & van Gelder, 2002;Vrouwenvelder, 2006;Vrouwenvelder & Steenbergen, 1999;Zhang et al., 2011). Stochastic distributions are used to characterize loads and strength properties, as well as model uncertainties. When the load exceeds the strength, the limit state is exceeded and failure occurs-often leading to breaching and consequential damages.
However, the resulting failure probabilities from such reliability analysis could significantly deviate from actual (observed) failure rates of levees (see definition below), despite both methods targeting the same phenomenon. Sometimes there can be good reasons for the differences between both approaches, such as levee upgrades or the occurrence of multiple high water level events within a short period. However, in other cases, the difference between calculated and observed levee failure probabilities (per unit time) is more difficult to explain. As an illustration, in recent reliability analyses of levee systems in the Netherlands (using advanced methods and input data), relatively high failure probabilities were found for multiple levee systems in the order of 1 /4 to 1/10 per year (HKV, 2020). Results were considered less credible as no failures have been observed for many decades in the Netherlands and levees are generally designed for very low probabilities of failure. In the context of levee reliability analysis and flood risk management, historical information on past failure and failure rates could provide important additional information. Therefore, a more "frequentist" approach is developed and implemented in this article, which is based on observed failure rates of levees within a system.
In this article, the failure rate is used to describe as a first estimate the probability of failure within an interval of time (Finkelstein, 2008). In the past, failure rates have been used to estimate the annual probability of failure of pipelines (Dawotola et al., 2011), power plants (Hutchison et al., 2009), or embankments dams in the United States (Baecher et al., 1980;DeNeale et al., 2019;Hatem, 1985;Major, 2019;Von Thun, 1985). There have only been few studies on observed failure frequencies of levees (Foster et al., 2000;Major, 2019;Rikkert & Kok, 2019), but these did not consider the effect of the return periods of loads and local deviating conditions that may affect strength and reliability.
This study presents a method to quantitatively assess the failure rates of levees based on historical information of failure and the return period of the considered events, as well as the influence of deviating conditions on these failure rates. The following general approach is used: failure rates are derived based on observations for past flood events, identifying which sections failed or survived flood events with certain return periods. Also, the expected amount of failures at a system level is considered.
The occurrence of failures is expected to be related to local load and strength characteristics. During a single flood event groups of levees in a system are often loaded by a similar load level. Particularly differences in strength properties will affect whether a local failure occurs or not. Examples are (1) changes in the geometry of the cross-section of the levee, (2) bushes or trees near the levee, (3) permanent surface water directly next to the levee, (4) the presence of old geological features, such as old river meanders, or (5) animal burrows (Sharp et al., 2013). Such circumstances are referred to as "deviating conditions" in the context of this study, where it is noted that Conditions (1)-(4) have been included in the analysis. Satellite images are used for the identification of these four types of deviating conditions. Bayesian techniques are used to determine the effects of deviating conditions on the failure rate of an individual levee section. The river system in the state of Sachsen-Anhalt, Germany is used as a case study. This system experienced severe flooding in 2002 and 2013 and relatively good information is available on the levee failures (Heyer & Stamm, 2013;Ozer et al., 2020).
The article is structured as follows. Section 2 introduces the method adopted in this article in more detail. Section 3 introduces the general information about the Sachsen-Anhalt case study. Section 4 presents the results in terms of failure rates at the levee section level, the effect of deviating conditions, and the expected number of failures for a flood event. The article is finalized with a discussion (Section 5), and conclusions and recommendations (Section 6).

| General approach
This section introduces the method for assessing the observed levee failure rate of a levee section, the influence of the deviating conditions on observed levee failures rates, and the number of expected failures during a single event. To illustrate the approach, a simplified example is presented. A schematic view of the analyzed levee system is shown in Figure 1, which shows similarities to the case described in Section 3. A continuous levee system ensures the hinterland's safety, by separating the hinterland from the floodplain. Historical data show that the levee system failed on two occasions when it was exposed to high water levels (h T ) with different return periods (T). This information can be used to determine the conditional failure rate for a certain load level, and the weighted annual failure rate (see details below). There are various deviations in the system that could influence the failure rate of specific sections. In this article, Bayesian inference is used to assess likelihood ratios (LRs) that show the increase or decrease of the levee failure rate due to such deviating conditions. We assume that the groups of sections that are characterized by similar loading and certain deviating conditions (e.g., vegetation) are statistically homogeneous. This is substantiated by the observation that all levees have been designed according to safety standards, implying relatively homogeneous strength. An important cause of inhomogeneity would be the load, this is included by differentiating between loading levels. We consider the failure rate of levee sections that were exposed to water levels of different return periods. We also distinguish so-called deviating conditions (e.g., vegetation-see Figure 1) to account for potential differences in resistance. We thus assume that levees in a certain group of similar load and resistance conditions can be considered as a statistically homogenous group to derive typical failure rates.
Following this concept, a stepwise method is introduced below to calculate the failure rates and the influence of deviating conditions. The steps of the method are further elaborated in the following sections: 1. Divide the levee system into statistically independent levee sections (N exp ), 2. Determine the conditional failure rate P Fjh T ð Þ for all known events, 3. Estimate the annual failure rate of a section, 4. Analyze the failed levee sections for deviating conditions, 5. Analyze the survived levee sections for deviating conditions, 6. Determine the LR of deviating conditions, 7. Calculate the annual failure rate (P F ð ÞÞ given deviating conditions (D) and no deviating conditions (D) and compare them, 8. As an optional step: estimate the expected amount of levee sections failures.
The method can roughly be divided into three parts: analyzing failure rates based on historical events (steps 1-3), the influence of deviating conditions on observed levee failure rates (steps 4-7), and the expected amount of failures for flood events (step 8). The various steps are further described in the following sections. The following output is the results of the steps: • An annual failure rate that shows the annual probability of failure of a random levee section without further information about for example, local subsoil conditions (step 3) F I G U R E 1 Schematic example of the performance of a part of the levee system during two high water events. The system is divided into seven sections, with trees present at most of the locations. Lower left panel: during event 1, the system is exposed to a high water event (h T1 ) with a return period T1, which results in one breach. Lower right panel, during event 2: the system is exposed to a high water event (h T2 ) that exceeds the return period of T 2 , which results in two breaches • LRs that show how much the annual failure probability changes due to deviating levee conditions for example, subsoil conditions (step 6.) • A posterior failure rate that shows the annual failure probability given deviating conditions (step 7) • An estimate of the expected amount of levee failures in a system (step 8).

|
Step 1: Division of levee system into independent levee sections In the first step, the levee system is broken down into statistically independent levee sections. This implies that the system can be schematized as a series system of uncorrelated elements, under the assumption that all sections are equally strong and exposed to the same load. Hence, we are looking at how many independent levee sections (N exp ) there are as a function of the levee system's length (L), using Equation (1). And thus, we are looking for how long the sections (ΔLÞ should be for the sections to be independent (Vrouwenvelder & Vrijlling, 1982).
In this article, when referring to an independent section we refer to their strengths being independent since the loads are typically highly correlated between levee sections. This is illustrated in Figure 2, where the probability distribution and a realization of strength (resistance) and load are shown. The strength and load (and their underlying variables) usually exhibit spatial dependence which can be expressed by an (auto-) correlation function with correlation lengths θ R and θ S (see e.g., Vanmarcke, 1977). As the load typically has much higher correlation lengths than the strength, and we are looking for failure rates conditional to a certain water level, we are thus looking for the length of ΔL for the strengths to be independent. In other words, ΔL has to be large enough for the correlation between sections to be negligible.
We do not have detailed information of spatial variability of strength parameters available and it is, therefore, difficult to determine exact correlation lengths. It is also noted that different failure mechanisms have different typical correlations lengths, that is, 50 m for stability and 300 m for piping for conditions in the Netherlands (Jonkman et al., 2017). However, Vrouwenvelder (2006) suggests that a connection between the correlation parameters and observable quantities like the length of a failure mechanism are possible. A section length of 100 m corresponds roughly to the observed failure widths as well as the lengths of the deviating conditions, and is therefore chosen as a value for ΔL.
It should be noted that Figure 2 and the text above assumes that R can be modeled with a continuous probability distribution. This is not always the case as there can be discontinuous, deviating anomalies such as old gullies. The width of these deviating conditions should thus also be considered in determining ΔL .

|
Step 2: Determination of the conditional failure rate In this article, we determine an observed failure rate, further referred to as annual failure rate, which empirically shows the annual probability of failure of a section or F I G U R E 2 Statistical representation of the distribution of strength and load intensity. The system consists of sections 100 m in length. The strength and load are only known at the locations of the measurements but are uncertain in the other locations. The measurements can be used to derive the probability distribution of strength f R (r) and load f S (s) throughout the levee system system, without assessing the underlying base variables. This is a different approach than the computation of the annual failure probability by evaluating the limit state function, which takes into account the underlying distributions of load and strength variables (see e.g., Jongejan & Maaskant, 2015). To find the annual failure rate, we have to determine the conditional failure rate for various extreme water levels (h T ) with return level T. Conditioning the failure rate by the return level T reinforces the assumption that the different sections are equal in strength and load. Hence the system is discretized in sections that were equally loaded and are statistically sufficiently homogeneous. A section's conditional failure rate is expressed as the ratio between the sections that failed (N fail,h T ) and the total amount of sections that were exposed (N exp,h T ), both to the same water level with a specific return period (h T ): This information can be used to determine an empirical fragility curve and the annual failure rate.

| Step 3: Estimation of the annual failure rate using an empirical fragility curve
If there is information on multiple loading events it is also possible to construct an empirical fragility curve, which shows the conditional failure rate P Fjh T ð Þ ð Þas a function of the occurred load (water level, h T ), as shown in Figure 3. In this empirical fragility curve, the load can be expressed as a water level or return period (T). Furthermore, the probability density function (PDF) of the water level should be constructed (f S h T ð Þ). This PDF is shown in the lower part of Figure 3. In the case of this article, this PDF is implicitly used, as the observed return periods are directly used to determine the probability mass contributions of the water level.
This empirical fragility curve in combination with the PDF of the water level can be used to compute the annual failure rate by defining intervals. The number and size of intervals are dependent on the resolution of input data and the events that occurred. The red dots are representative points of the probability mass. In reality, the distribution is not that angular as shown in Figure 3. Therefore, the points between the boundaries represent the mass that is used in the integration. The annual failure rate is computed by integrating the points on the fragility curve P Fjh T ð Þ with the probability of occurrence of the water level P h T ð Þ as defined by the probability mass: The P h T ð Þ is derived from the exceedance frequency of the events. Figure 3 shows an example of three intervals: • Water levels lower than h T1 , with P Fjh T ð Þ¼0 and P h T ð Þ equal to all the probability mass left of h T1 • Water levels between h T1 and h T2 , based on the fragility curve and the P h T ð Þ equal to the probability mass between h T1 and h T2 .
• Water levels higher than h T2 . P h T ð Þ based on the fragility curve and the P h T ð Þ equal to all the probability mass right of h T2 Hence, the method assumes that the conditional failure rate for intervals of water levels is known, as well as the return periods corresponding to these intervals.
When Equation (3), is applied to the example of two events in Figure 1, the annual failure rate P F ð Þ follows by: F I G U R E 3 Upper: in blue, the empirical fragility curve that relates the conditional failure rate (P(Fjh T )) and water levels (h T1 , h T2 ) as shown in the adopted example from Figure 1. The blue line is the average conditional failure rate considering all water levels in the zone: (1.) smaller then h T1 , (2.) between h T1 and h T2 , and (3.) larger than h T2 . Lower: probability density function (PDF) of the water levels. The probability of exceedance of water level derives from the cumulative distribution function of the water levels and the return periods of the water level For this schematic case P F 0 jh T 0 < h < h T 1 ð Þ is considered negligible and therefore this term, from Equation (4), will not be considered separately.
As an alternative metric, a generic (annual) failure rate is provided by Major (2019) to give a first estimate of the failure rate of a section. It can be estimated by dividing the numbers of failures by the number of sectionsyears or system-years of operation: Where λ is the failure rate, N fail is the amount of registered failures over a time t (in years) and N exp is the amount of sections or systems that are evaluated in time t.
2.5 | Steps 4-7: Determination of the LR and update the annual failure rate As a next step, the failed and survived levee sections are screened for the presence of deviation conditions (steps 4 and 5) and the gathered information is merged in LRs (steps 5 and 6). The effects of deviating conditions on the annual failure rate of an individual levee section are incorporated using two separate Bayesian techniques, the LR and Bayesian inference.
The strength of evidence contained in the observations of deviating conditions (D) given failure (F) and survival (F) can be expressed by the LR, which is determined in step 6: A classification of the strength of the evidence is given by Jeffreys (1998) (Table 1). In steps 4 and 5, satellite imagery of both the considered failed and survived sections are analyzed for the presence of deviating conditions. The obtained information is used to compute P D j F ð ) and P DjF À Á which enables the calculation of the LR. This LR provides a measure of the strength of the evidence.
Bayesian inference is subsequently used (step 7) to update the annual failure rate of a section (P(F)) into a posterior failure rate that uses information about the failure and survival of the sections with and without deviating conditions. Thereby, we can compare the annual failure rate of a section, for which the same information is used as for the LR (Equation (6)) that has deviating conditions to the annual failure rate of a section that has no deviating conditions. This is done by using the following equation based on Bayesian inference: Here, P(FjD) is the annual failure rate given that a deviating condition (D) is observed, P(F) is the annual failure rate before an analysis is done on deviating conditions, see Equation (4); and P(DjF) is how probable observing deviating conditions is given the failure of a section. The normalizing constant for this equation is the probability of observing (D) overall sections, regardless of (F).

|
Step 8: Expectation of the amount of failures in a levee system Once the failure rate of individual sections is known, it is still an open question of what the expected number of failures given a certain loading event will be. The expected amount of failures depends on the correlation between the section failures and the corresponding probability distribution. We consider a levee system that consists of independent sections in terms of strength, that are all exposed to the same deterministic load (h T ), as introduced in Section 2.2 (step 1). In such a situation it is possible to describe the probabilistic properties of this number of failures in a system using a Binomial distribution (Jonkman, 2007) to estimate the expected amount of failures and its standard deviation.
The probabilistic properties using a Binomial distribution, that is, the probability mass function in Equation (8), the expected amount of failures in Equation (9) and the standard deviation in Equation (10), follow from: T A B L E 1 Likelihood ratios and strength of evidence according to (Jeffreys, 1998) where N exp,h T is the number of sections exposed to the high water (h T ); n is the number of section failures; F h T is the conditional failure rate P Fjh T ð Þ ð Þof Equation (2).

| CASE STUDY: THE SACHSEN-ANHALT FLOODS IN 2002 AND 2013
The case study adopted in this article concerns the major river system in the state of Sachsen-Anhalt in Germany, that is, the Elbe river system and its tributaries Saale, Mulde, Schwarze Elster, and Weisse Elster, as shown in Figure 4. High discharges originate from the precipitation that falls in these catchments. The studied river system covers a length of about 581 km with a levee system adjacent that currently covers a total length of 673.2 km (Weichel, 2020). The focus of this analysis will be on the two major high water events in the year 2002 and 2013, which have caused the flood defenses along the river system to fail at many locations (Schwandt & Hubner, 2019) with resulting damages in the range of 11.6 billion euro in 2002 and 6 to 8 billion euros in 2013 (Thieken et al., 2016). Over a period of 23 years (from 1995 to 2018), the major river system of interest was confronted with high water events with levee failures on several occasions, that is, in the years , 2003, 2010(Schwandt & Hubner, 2019. The 2003 and 2010 high water events concerned individual failures and floods were associated with lower return periods which are not taken into account in the analysis here: The levee failure in 2003 concerned a summer levee parallel to the Elbe, with no real damage as a result. The levee failure in 2010 concerned a levee that needed rebuilding (DLR, 2010;Siebert, 2020).
The two flood events, in the years 2002 and 2013, have resulted in the failure (i.e., not necessarily breaching) of 41 levee sections. The failures are split into 3 categories, the levees that failed due to either "internal erosion or instability," due to "overflow" and "other causes" ( Table 2). Levees fail due to overflow when water levels exceed the height of the levee, leading to consequent erosion. Levees fail due to internal erosion or instability simply because they could not retain the water and often fail before water levels overflow the crest. This analysis only considers the total amount of levee failures (Table 2). It is noted that two levee failures upstream of the Schwarze Elster have not been included in the analysis ( Figure 5). These were not directly the result of extremely high water, but because of construction activities that were not secured before the water had reached the 10-year event water level (Siebert, 2020). An overview of the locations of all failures, within the borders of Sachsen-Anhalt, is presented in Figure 4 (Google, 2020c) and further details are presented in Ozer et al. (2020). Both full failures (i.e., breaches) and partial failures (occurrence of the failure mechanism, without full breaching, for example, a partial slide of the levee body) are included in this analysis.
Originally, the design heights of the levees along the Elbe focused on a flood event from the early 1980s and the water levels that occurred during that event were used as absolute "values" plus freeboard (Weichel, 2021). This design height originates from the time that Sachsen-Anhalt was part of the former GDR. In the run-up to the first high water event in 2002, the local government had the intention of designing the entire levee system for a water level with a return period of 100 years plus freeboard. However, at the time of the first high water wave in 2002, approximately 5% of the levee system of Sachsen-Anhalt was rehabilitated conform that intention. In the aftermath of the 2002 flood event, Gocht (2004) investigated the design elevation of prominent locations in the levee system that were exposed to high water in 2002. The design height of these investigated levee sections corresponded to a 100-year high water level event and an additional 1 m freeboard. Approximately an additional 45% of the levees were rehabilitated within Sachsen-Anhalt between the period 2002 and 2012, before the 2013 flood event (Weichel, 2021).  (red)). The white "W" marks Wittenberg and the white "H" marks Hemsendorf (Google, 2020c) The hydraulic loads and the associated return periods for both events (2002 and 2013) are estimated, per river section (Schroter et al., 2015). The gauge data were made available by the Federal Institute for Hydrology and environmental state offices of the federal states. These give insight into the return period of flood peak discharges and associated water levels using an interval of return periods (upper and lower bound) per river section. The results are found using extreme value statistics and based on a 50-year reference period (Schroter et al., 2015), which are shown in Figure 5. For several locations, more detailed information was needed to connect the local hydraulic loads and the associated return periods to the levee failures, for example, at the Schwarze Elster near Hemsendorf, and the Elbe near Wittenberg ( Figure 5) (Gocht, 2004;IKSE, 2004;LHW, 2014;Siebert, 2020). This information has been for analyzing failure rates and influence of deviating conditions.

| RESULTS: FAILURE RATES AND THE INFLUENCE OF DEVIATING CONDITIONS
Based on the method introduced in Section 2, this section presents the results of the analyses. First, the failure rates are presented (section 4.1), subsequently the influence of deviating conditions (section 4.2) and finally the expected number of failures per event (section 4.3).

| Step 1: Schematization of the Sachsen-Anhalt levee system
The continuous levee system of Sachsen-Anhalt is divided into statistically independent sections to approach the levee system as a series system. The length of the section (ΔL) influences the number of sections within the system and is, therefore, an important choice in the assessment of the failure rate of a section.
Dutch procedures suggest independent equivalent lengths of 50 m in the evaluation of slope instability and 300 m in the evaluation of piping/internal erosion (helpdesk, 2015). For the sake of simplicity and uniformity, we adopt a section length of 100 m (ΔL) for all failure mechanisms in this study. A section length of 100 m corresponds roughly to the observed failure widths as well as the lengths of the deviating conditions that are the object of this study (Figure 6; Google, 2020b). This results in 6732 sections within the system.

| Step 2: Derivation of conditional failure rates
Historical high-water information shows the high water levels varied between the stretches of the rivers during the flood events of 2002 and 2013. Therefore, as explained in Section 2.4, the failure rates are assessed conditional to the return periods of the high water level events. It has been determined how many sections were exposed to a water level corresponding to a certain return period (N exp,h T ) per high water event or over a certain period. This enables building a fragility curve. The exact water levels are unknown and are expressed in terms of ranges of return periods (T) in previous studies. Three categories of water levels were distinguished (see Table 3): • Lower than a 50-year event (h T0 < h T < h T50 ), • Between a 50-year event (h T50 ) and 100-year event (h T50 < h T < h T100 ), • Higher than a 100-year event (h T100 < h T ).
The numbers of failures have been assessed for the individual high water events (2002 and 2013) and the summed number of failures over both events (see Table 3). Most of the failures occurred in 2002 due to water levels exceeding the 100 years return period, but also a substantial number of failures occurred for lower water levels. In 2013, almost all sections failed due to exposure to high-water levels associated with a 100-year return period or higher (h T100 < h T ). The conditional failure rates have been calculated using Equation (2) and are presented in Table 4. These present the conditional failure rate per high water event (2002 and 2013) and the total failure rate of a levee section exposed to a water level with a certain load level. The total failure rates are found by taking the total number of sections that were exposed and failed over both the high water events (2002 and 2013) and using these as input for Equation (2). These are used for further analysis. 4.1.3 | Step 3: Construction of the empirical fragility curve and estimation of the annual failure rate Based on the data of Table 4, a fragility curve can be compiled to relate the conditional failure rates (P(Fjh T )) to the return period of the water level (h T ). Figure 7 shows the results. For both events, the conditional failure rate increases with the load level. This is as expected, as higher loads will likely lead to overloading and failure of more sections. Also, the conditional failure rates of 2002 were higher than in 2013. A likely cause could be the reinforcements that took place after the 2002 event (Gocht, 2004).
As a next step, the annual probability of failure for a section is computed for the combination of the two events according to Formulas (3) and (4): þ 6:03 We have compared the results with the often-used generic failure rate using the method as suggested by (Major, 2019). It is defined as the predicted number of times an item will fail in a specified period. Since the F I G U R E 6 Overview of the breach, no. 121013 (ILPD) in the aftermath of the flood in the year 2013 (Google, 2020b). It occurred along the river called Schwarze Elster near Hemsendorf (located at the yellow marker), the figure shows the width of the breach (white arrow) initiated by internal erosion as well as bushes or trees next to the levee (marked with a red circle), and observable geological deviation in the subsurface (marked with orange shadings) for example, old river belts number of levee failures between the years 1995 and 2018 is known, we have calculated this generic failure rate as well. The earlier presented information shows that of the 6732 sections in total, 41 sections failed over a period between 1995 and 2018, during two events of overloading (in the years 2002 and 2013). The failure rate of a random section over 23 years: It is noted that this generic failure rate is higher than the annual failure rate computed in Equation (11). The latter takes into account that two rare events have occurred within a relatively short period. The observed probability of system failure per unit time of the levee system is found by dividing the two events with failure (in 2002 and 2013) over 23 years of operation: λ system ¼ number of system failures years ¼ 2 23 T A B L E 3 The number of failed and exposed sections as a function of the return periods of high water levels that these were exposed to for the high-water events of 2002 and 2013 Return periods of high-water levels (h T , T in years)

Number of sections that failed (N fail,hT ) per event and in total
Number of sections that were exposed to h (N exp,hT ) per event and in total T A B L E 4 The conditional failure rates based on the information of Table 3 Return periods of high-water levels (h T , T in years) Conditional failure rate P Fjh T ð Þ

2013
Total over both events 4.00 * 10 À3 3.56 * 10 À4 2.31 * 10 À3 (h T100 < h T ) 2.40 * 10 À2 2.89 * 10 À3 6.03 * 10 À3 F I G U R E 7 The fragility curve shows the relation between conditional failure rates of a section and the exposure of water levels while only the water levels that have a return period of 50 and 100 years are known 4.2 | The influence of deviating condition on the annual failure rate (steps 4-7) Based on satellite imagery processing we have analyzed the statistical influence of a deviating condition on the annual failure rate of a levee section. Satellite imagery of the river system enables analysis of both the failed levee sections and survived sections for the presence of deviating conditions over a section of 100 m in length (steps 4 and 5) using imagery from (Google, 2020a). The obtained information enables the calculation of the LR of Jeffreys (1998) to classify the influence of the deviating condition (step 6). Bayes' rule is used to determine the annual failure rate (posterior) of a section given that there is a certain deviation present in the section and these results are used to determine the influence of a deviating condition (step 7, Equation (7)).
The following types of deviating conditions have been considered, as illustrated in Figure 8: 1. Bushes or trees next to the levee, 2. Permanent water directly next to the levee, 3. Geometric changes of the cross-section of the levee, 4. Geological deviations in the subsurface are observable from images.
In total, all 41 failed sections and a sample of 164 survived sections, of the total of 6732 sections, have been analyzed.
To choose the location of the samples of surviving sections, markers were chosen-distributed evenly with a constant distance between them and manually over the entire system in the center of the river (yellow line in Figure 9). This ensures a certain degree of randomness in the collected samples. Subsequently, the samples were placed alternately and perpendicular to the river in a north-easterly direction (label-E) or in a south-western direction (label-W) of the initial sample, as illustrated in Figure 9 (with the red arrow). There are two options where the mark can be placed: 1. Levees that parallel to the rivers as marked by the chart of Sachsen-Anhalt (LVermGeo, 2019), which resulted in 164 samples 2. Other sections, where no levee parallel to the river was present, for example, because the height of the landscape ensures that no flood defenses are needed to protect the hinterland. These marks were excluded for further analysis.
F I G U R E 8 Illustration of deviating conditions (samples were taken from the Sachsen-Anhalt river system (Google, 2020a), 1: bushes or trees next to the levee, 2: permanent water directly next to the levee, 3: geometric changes of the cross-section of the levee (the road in orange on the levee in red branches off with several turns toward the river), 4: geological deviation observable in the subsurface, for example, old river belts The resulting LRs and conditional failure rates are summarized in Table 5. The results in Table 5 show that only the geological deviations have a significant influence and a substantial amount of evidence of influencing the levee failure rate with a value of the likelihood ratio of LR = 3.3. The analysis of satellite images showed that geological deviations were present for 70% of the failures, but only for 21% of the survived sections. This is in line with previous research (Buijs et al., 2013;Kool et al., 2019;Kool et al., 2020;Zwanenburg et al., 2018) that pointed out that local geological deviation in the subsoil could be important triggers of levee failure. A section has an annual failure rate of P(F i jD gd ) = 2.79 * 10 À4 [À] in case of the presence of geological deviations, which is about 14 times higher than a section that has no deviation ( Table 5). Other deviations have a very limited influence on the annual failure rate. For example, bushes or trees are located at 84% of the failed sections, but also for 64% of the sections that survived the high loading.
The previously calculated prior annual failure rate is 8.34 * 10 À5 [À]. Here it appeared that sections with no deviation have an annual failure rate of P (F i jD non ) = 1.91 * 10 À5 [À] (the posterior), which is about four times smaller. Hence, the information that there are no deviations observable influences the annual failure rate.

| The expected amount of levee failures (step 8)
Once the conditional failure rates of individual sections are known, the expected number of failures given a certain loading event can be determined following the method introduced in Section 2. The binomial F I G U R E 9 Left: satellite imagery showing the markers that were chosen-distributed evenly with a constant distance between them and manually over the whole river system. Lower right panel: close up Satelite imagery (dated from 1-6-2001) of samples 37_E, 38_W, 39_E, and 40_W (E: north-easterly side, W: southwestern side), the red arrows demonstrate how the samples are placed, perpendicular from the center of the river alternately in north-easterly (label-E) or south-western direction (label-W), top right panel: close up of sample 37_E: there is no presence of bushes or trees and geometric changes. Permanent water is present next to the slope and there are observable geological deviations (Google, 2020a) distribution is used, using the conditional failure rate (F h T ¼ P Fjh T ð Þ) given the high-water levels (h T ) and the number of sections that were exposed (N exp,h T ), as inputs. These specific inputs were obtained for the combined 2002 and 2013 events from Tables 2 and 3, respectively, distinguishing the amount of failures and exposed sections that were exposed to water levels in the 50-100 year return period range, and those with a 100 year return period or higher. Table 4 and Figure 7 show the results for the analysis of the total dataset of the 2002 and 2013 events. As expected, the number of observed failures is reproduced, and-as an additional parameter-the standard deviation of the Binomial distribution is determined ( Figure 10 and Table 6).
To show the potential application of the method to estimate the number of failures for other and future flood events, two hypothetical floods are assumed. One moderate flood during which all levee sections are exposed to flood levels with return periods between 50 and 100 years, and one more extreme flood with water levels that exceed the 100 year return period. It is assumed that the future levees in the system have the same properties as those in the past, so the earlier derived failure rates and assumptions are adopted. Failure rates have been derived from Table 4. This leads to the expected number of failures and the standard deviation as shown in the last two columns of Table 6, clearly indicating that the expected number of failures increases with increasing loads. This illustrates how the failure rates can be used in flood risk assessments at a system level.

| DISCUSSION
The presented analysis for the levee system of Sachsen-Anhalt focuses on the high-water events of 2002 and 2013 and the data collected for these events. The presented results for these events can be obtained under the assumption of homogeneity and stationarity. However, within the considered period of analysis, there could be Annual failure rate given a deviating condition P(F i jD i ) 1.91 * 10 À5 1.09 * 10 À4 1.03 * 10 À4 8.51 * 10 À5 2.79 * 10 À4 F I G U R E 1 0 Probability mass distribution of the number of failures: Left: for the 6063 sections (see Table 3) exposed to a water level with return periods between once in 50 and 100 years (h T50 < h T < h T100 ). Right: for the 4476 sections exposed to water levels with return periods 100 years or higher (h T100 < h T ) changes to the levee system over time, such as degradation processes or reinforcements of levee sections orover a longer period-possible changes in trends in discharges and the associated frequencies (Faulkner et al., 2018;Hall et al., 2014;Merz et al., 2018). These changing conditions make it less likely that the results based on past observations can be used to characterize the future performance of the levee system directly. However, there are many levee systems with limited data availability, for example, lack of soil investigations. For such situations, an estimate of the failure rate of a levee section can still be made using simplified methods based on observed historical failure rates, as proposed by Foster et al. (2000), Major (2019) and Rikkert and Kok (2019). However, these latter methods do not take into account specific characterizations of strength and return periods of water levels, which are factors that have been included in the present article. Information on observed failure rates could also be used as a calibration for reliability estimates from more detailed studies. The failure rates could also be coupled with (simplified) risk assessments and optimization, for example, as proposed by Hui et al. (2016). In this approach, the levee fragility is parameterized with levee height, crown width and condition, based on synthetic levee performance curves. Several improvements in specific elements of the proposed method could also be made. The calculated conditional failure rate (step 2) is based on the information on frequencies of high water levels for the 2002 and 2013 events, expressed using intervals of return periods. The current article utilizes a relatively coarse discretization in three intervals of load return periods, as this is the data that is available in terms of hydraulic loads (Schroter et al., 2015). In future work, we suggest differentiating more loads classes based on more detailed hydraulic loading data for future cases. Also, it would be good to validate the assumption of statistical homogeneity if there is more detailed subsoil data available to check the homogeneity of the resistance properties or further divide the system into more subgroups. It is noted that particularly geotechnical failures are unlikely to occur exactly at the moment that the highest water level is reached (Hui et al., 2016), and variables such as load duration could be included as an additional parameter. Furthermore, a section of a length of 100 m has been used. It would be useful to assess whether this 100 m could be validated or differentiated to failure mode and used in other systems, for example, using a sensitivity analysis under various section lengths.
Moreover, other high-water events occurred in the system, such as in the years 2006, 2010 and 2011, although they did not lead to substantial failures. Including these data will provide a more accurate estimation of a section's failure rate. Also, the analysis focused on the sections that failed in general but focused less on the individual failure mechanisms. Although this generalization supports the demonstration of the method, it ignores the specific characteristics related to different failure mechanisms and spatial uncertainties, for example, the load duration, soil properties and levee geometry. In future work, more specific information related to failure mechanisms could be included in the analysis, and it could even be considered to vary the length of the sections depending on which failure mechanisms would be assessed. Return periods of high water levels (h T50 < h T < h T100 ) Return periods of high water levels above 100 years (h T > h T100 ) All sections exposed to (h T50 < h T < h T100) All sections exposed to (h T > h T100 ) The observed number of failures (Table 3) 14 27 --Binomial distribution The occurrence of deviations was assessed in this article through a visual analysis of a limited amount of manually selected samples of satellite imagery. This was a labor-intensive process. In future work, more advanced methods and other data sources could be utilized to include more samples and more information in the assessment (Aanstoos et al., 2012;Ozer et al., 2020). This will increase the robustness of the results and may also help to identify additional factors that could influence the reliability of a levee section. Further coupling with soil datasets is also a promising direction to get better insights into local weaknesses.
Vegetation (bushes or trees) was found to be a frequently present deviating condition: for the case study in 84% of the sections that failed and for 64% of the sections that survived the high water events. This implies that bushes or trees are frequently present, but does not have a major influence on the failures. Geological deviations were observed for 70% of the sections that failed and in 21% of the sections that survived, therefore they are more likely to be a marker of failures. This article does not elaborate on how the (geological) deviations physically affect the strength and reliability of a levee section. However, previous work has shown that such deviations (e.g., old river meanders and old levee failures) could have a major influence on levee safety (Buijs et al., 2013;Kool et al., 2019;Kool et al., 2020;Zwanenburg et al., 2018). Further soil investigation and modeling of the effects of such conditions on the factor of safety and failure probability of typical levees in the river system is recommended.
Failure scenarios with multiple breaches get limited attention in risk assessments, although real events show that multiple breaches can be expected when extreme high water levels occur (Jonkman et al., 2008). Even more, Apel et al. (2004) suggest that the occurrence of upstream levee failures can significantly reduce failure probabilities of downstream levees. Note, some approaches for deriving statistics of hydraulic loads already include upstream events and interactions, such as dam and reservoir operation, for example, Ciullo et al. (2019). In estimating the expected number of levee failures (step 8 in the framework) independence between sections has been adopted, assuming that uncertainties in strength are greater than those in loads. In the future, further formal verification, also of the role of spatial variability in hydraulic loads including interactions, and analysis of correlation would be useful.

| CONCLUSION AND RECOMMENDATIONS
This study introduces a method for assessing the annual failure rate of levees based on information from historical floods, while also considering the return period of past events. Also, an approach has been developed to quantify the influence of deviating conditions on these failure rates. Satellite images have been processed to assess the presence of deviating conditions for failed and survived sections. Bayesian techniques are used to update the failure rate as a function of the presence of deviations.
The river system of Sachsen-Anhalt, Germany (2002 and 2013) was used as a case study. It experienced severe floods with many levee failures in the years 2002 and 2013. In assessing the failure rate an empirical fragility curve was constructed and it was used to calculate an annual failure rate, which is 8.34 * 10 À5 [À] per year per section for the case study. This differs from the base failure frequency of 1.30*10 À1 [À] per year per section that would be found according to the method of Major (2019) which does not take into account the likelihood of the experienced flood events. Both analyses are based on historical data and satellite imagery processing of sections that failed or survived high water events. But the failure rate determined in the proposed approach in this article takes into account that two rare flood events have occurred within a relatively short period.
The results show that the occurrence of a visually identifiable geological deviation in the subsurface has a significant influence on the calculated failure rate of a levee section. The updated failure rate of a section is about 3.3 times higher than the initially calculated failure rate and about 14 times higher than when there is no visually identifiable deviation. The fact that no deviations are observed results in a LR of 0.3; hence a much lower annual failure probability. The presence of other deviations, such as bushes or trees, or permanent water near the levee has a more limited influence on the failure rate. Nevertheless, results show that levee sections that have either bushes or trees, or permanent water near the levee have a somewhat higher failure rate (20-30% higher) than the calculated annual failure rate.
Also, the results for the Sachsen-Anhalt river system, show that rare events of high water levels are expected to result in multiple levee failures. It has been shown how the conditional failure rates and information on the return periods of loading conditions can be used to estimate the distribution of the number of failures. The inclusion of more detailed data on loads and resistance properties could lead to more detailed assessments of vulnerable groups of levees and corresponding failure rates.
Based on this study, we recommend that the strength of levee sections with either geological deviations that are visually observable on the surface, bushes or trees, or permanent water near the levee are investigated more closely. We recommend using satellite imagery processing to analyze the subsurface near the levee for geological deviations, such as old river bends. Based on this, further soil data acquisition could be optimized and targeted to inform the assessment of strength and reliability. This could contribute to a more targeted assessment and more robust flood defenses. For future study, we also recommend assessing other deviating conditions as a possible marker for failure and included data of other levee systems to identify general features of interest. It is also recommended to investigate how observed failure rates can be used to calibrate and improve reliability assessments. It is also expected that the presented methodology could play a role in risk and reliability assessments in data-poor environments. In such circumstances, there is often limited insights in soil data and levee profiles, but some information on historical failures is generally available, thus allowing quantification of failure rates.
Also, we recommend that future risk assessments consider failure scenarios with multiple breaches in case of high water events. Further formal verification and analysis of the correlation between failures would be useful. Overall, it is expected that the approaches that are introduced in this article can complement and improve levee management and future flood risk assessments.