The risk analysis of levee systems: a comparison of international best practices

. A risk analysis of a levee system estimates the overall level of flood risk associated with the levee system, according to a series of loading conditions, the levee performance and the vulnerability to flooding of assets in the protected area. This process, which requires the identification and examination of all the components that determine the risk of flooding in a system, includes different steps. Among these steps, (cid:2) levee system failure analysis (cid:3) , (cid:2) flood consequences analysis (cid:3) and (cid:2) risk attribution (cid:3) have benefitted from the most important advances of recent research projects. This paper presents a critical analysis of the latest methods to conduct levee system failure analysis, flood consequences analysis and risk attribution. It shows how these methods can contribute to improving the efficiency of the risk analysis process and therefore the design and management of levee systems.


Introduction
A variety of analysis techniques and decision support tools are now available to support levee system managers in their decision-making. Often different by country and even organization, they are all based on general risk analysis principles and adapted to the high complexity and structural variability of levee systems [1][2]. These tools and techniques provide support to the development of optimal investment strategies, an improved understanding of the role that an individual levee plays within a larger levee system, a better understanding of the impact of uncertainty within the estimated risk, and the ability to progressively refine the analysis.
Risk analysis of a levee system estimates the overall level of risk associated with the levee system, according to a series of loading conditions (source), the levee performance (pathways) and the vulnerability to flooding of assets in the protected area (receptors). It requires the identification and examination of all the components that determine the risk of flooding in a leveed area. This recently defined process [1] includes different steps (figure 1): -risk identification: identification of the driving factors affecting levee failure flood risk; -event probability estimation: estimation of the probability of the possible loading conditions; -analysis of levee failure: identification of the possible levee failure scenarios and estimation of their probability; -inundation modelling: identification and characterization of inundation routes and flood spreading (water depths, flow velocities, timing of inundation); -consequence estimation: analysis and estimation of inundation potential impacts on assets; -effectiveness of existing controls: evaluation of the existing control measures which aim to limit the possibility of the occurrence of an inundation, or to limit its consequences; -estimation of level of risk: estimation of the probability and the potential consequences of the levee failure flood scenarios (for each scenario or for an integration of different scenario) studied in the previous steps; -assessing remaining gaps in knowledge: identification of gaps in the data or in the methods used in risk analysis, to estimate imprecision in the results and improvement needed to reduce uncertainty in the outputs of the risk analysis; -risk attribution: attribution, in the leveed area to individual levee segments, of the residual risk of flooding associated to the levee system; -risk evaluation: determination of the significance of the flood risk to society to enable decision-makers to determine whether or not to proceed further with risk reduction measures. (This is not strictly a step of risk analysis but it a necessary output of the process to feed into the first step in decision-making.) The process of risk analysis for levee systems may be completed in a multi-phased approach. Each step in the process may use a variety of data, assessment tools and methodologies. Among the different steps, µevent probability estimation ¶ and µinundation modelling ¶ are classic engineering and research topics with updated tools and methodologies, related mainly to hydrology and hydraulic disciplines. The "Estimation of the level of risk" is purely a technical step in the process of risk analysis. The method is well known and not specific to study of levee systems, but since risk analysis of levee systems is a relatively newly defined activity and µlevee system failure analysis ¶, µflood consequence analysis ¶ and µrisk attribution ¶ are important aspects of this process, these steps present important challenges in terms of the design of credible and reliable methodologies. As methods are needed for these three steps, risk analysis of levee systems has become an important research and decision making topic, and recent research projects have demonstrated significant advances in the development of such methods.
This paper presents (based on the general framework presented in the International Levee Handbook [1]) a critical analysis of the latest risk analysis methods, in France, Netherlands and UK to conduct µlevee system failure analysis ¶, µflood consequences analysis ¶ and µrisk attribution ¶. It aims to identify the benefits and limitations of each method and shows how they can contribute to improvements in the design of a coherent and practical process of risk analysis and management of levee systems.
2 Levee system failure analysis

Principles and methods
Failure is the inability for a system to achieve a defined performance threshold for a given function [1][2][3]. The main function of a levee system is flood protection. Levee system failure analysis is a process of treating and combining data to estimate how, where and with what probability a levee system might fail and thus no longer protect against flood.
Failure can concern a whole protection system, one or some levee segments inside this protection system, or one or some of the components of levee segments and their associated function(s). Thus, failure analysis can focus on different resolutions of analysis according to levee systems issues.
The failure of flood protection function for a levee system can be defined as the unintentional inundation of its leveed area. This can happen either by inflow of water before the planned protection level 1 is reached, or, by a breach in a levee segment. As formalized in the ILH project [1], the fiUVW FDVH FDQ EH UHIHUUHG WR DV µhydraulic failure ¶ and the VHFRQG RQH DV WKH UHVXOW RI D µstructural failure ¶ scenario (figure 2). These two different cases are not necessarily unrelated as either can happen alone or lead to the other.  [1][2][3][4] As levee systems are rarely uniform in materials, methods of construction, geometry or reliability, the process of failure analysis usually starts with a functions analysis. This first step identifies the components of the levee system, the functions of these FRPSRQHQWV ¶ (hydraulic or structural), and the functionally homogenous lengths of the levee [1].
The process then continues with the analysis of potential function failures. This second step aims to identify levee systems failure scenarios to facilitate the analysis of levee system safety and inundation propagation [1].
Finally, an assessment of the levee system estimates the probability of these failure scenarios occurring for one or more different loading events in order to evaluate performance. Based on a combination of data, this third step is conducted through quantitative methods using expert judgment, index based methods, or mathematical models based on physical or empirical equations [1].

A French methodology for levee system failure analysis and performance assessment
The French Research Institute Irstea has developed methods for functions analysis and failure modes analysis of levee systems [4][5], both based on the structural/hydraulic failure model described in the ILH (2013) [ can be used to analyze, identify and represent failure scenarios, in order to select those that are most representative to study further, and to conduct efficient and well-structured levee performance assessments and levee systems flood risk analyses. Irstea also developed a quantitative index based method to estimate structural failure probability of levees. This method produces function models to define performance indicators for levee segments [6; 7; 8].

Function analysis method
Irstea ¶V method for functions analysis of levee systems is undertaken at three different scales of analysis [5].
At Scale 1 the levee system is studied and analyzed as a whole, to determine and characterize its main functions (e.g. to protect against floods), and its functions constrained by its environment (e.g. to resist to hydraulic loading, to be maintained, to observe State regulations). The main functions define the main objectives of the levee system, and the constrained functions define the constraints the system has to deal with in order to realize its main functions. Main functions and constrained functions of the levee system define the framework in which further analyses must be undertaken in scales 2 and 3 to determine technical functions.
At Scale 2 the subsystems that form the levee system (e.g. levees, spillways, water storage area), are studied and analyzed to determine and characterize their hydraulic technical functions (e.g. to prevent water entrance in leveed area, to control water entrance in leveed area, to store water).
At Scale 3 the structural components of subsystems and cross sections (e.g. erosion protection, levee bodies, filters, drains) that form structurally homogeneous sections of levees, are studied and analyzed to determine and characterize their structural and technical functions (e.g. to protect against erosion, to stabilize, to filter, to drain, etc.).

Failure modes analysis method
The Irstea method for failure analysis of levee systems is based on the principle of µ)DLOXUH 0RGHV DQG (ffects Analysis ¶ (FMEA) which is well adapted to study hydraulic works [9][10]. It helps to identify the failure modes of system functions, their causes and their effects. This method also allows the identification of failure scenarios through the investigation of function failures that lead to other function failures.
As described in [5], this method is based on the results of the function analysis method presented above. The analysis is conducted both at Scale 2 (hydraulic functions failures) and Scale 3 (structural functions failures), which leads to the identification of: -hydraulic failure scenarios: successions of events and hydraulic function failures that lead to unwanted or unplanned inundation of the leveed area -and end when no more hydraulic failure occurs and the levee system returns to a new stabilized state (figure 3);

Levee assessment method
The method developed by Irstea to estimate structural failure probability of levees defines 3 groups of variables to model structural failure scenarios of levees (figure 5) [8]: -basic indicators: these are fundamentals that detail the information to be considered for determining each function criterion. They are interpreted or inferred from data such as measurements, observations, computations or material state: visual data, historical data, geotechnical tests, modelling etc; -function criteria: these are decision-making items used to assess levee component performance. They help to determine how well the levee component functions are performed. A number of basic indicators must be reviewed before a criterion can be determined; -performance indicators: these determine levee performance against levee failure scenarios by combining several function criteria. Based on these variables, the function model provides a representation of structural failure scenarios as sequences of successive failures of functions according to function criteria and their related basic indicators [6; 7; 8]. Taking data uncertainty into account, the method estimates the performance of levees by using a probabilistic approach which produces probabilistic distributions for levee performance indicators [8].

The MDSF2 and RELIABLE UK approaches for levee assessment
The approach implemented within the Environment $JHQF\ ¶V IORRG ULVN PRGHOOLQJ GHFLVLRQ VXSSRUW V\VWHP (MDSF2), follows the same concepts and principles as French methodology, there are however, variations in the implementation. The method considers systems of flood defence. Within a system, levee lengths (or segments) are defined based upon their geometry, and condition. For each levee length a probability distribution, conditional on the hydraulic loading (i.e.) a fragility curve is defined. Fragility curves were first used in this context by the USACE (1996) [11]. Within England, fragility curves have been defined for a generic set of flood defence structures, including earth and rock armoured embankments, vertical walls and shingle beaches. Each defence structure comprises a set of five different condition grades with different curves for each condition grade.
Whilst these generic curves are available for national analysis, on regional or site specific analyses it is beneficial to undertake more focused reliability analysis as major regional studies (Thames and Humber Estuaries, for example). For these purposes more detailed defence specific reliability analysis has been undertaken using a software system created on the FLOODsite project, RELIABLE. RELIABLE requires a fault tree an as an input, and probability distributions to define the defence properties (geometry, soil properties etc.). A Level III Monte-Carlo approach is then used to integrate these probability distributions over the Limit State Equations associated with the failure mechanisms of each structure. This integration is undertaken at a range of hydraulic loads and a fragility curve is derived.

A Dutch method for safety assessment of flood defences
The approach implemented by the Research institute Deltares and the governmental institute Rijkswaterstaat for the safety assessment of Dutch flood defences also follows the same principles as the French approach, and again the implementation differs. Dutch flood defences are periodically tested against statutory safety standards. New flood risk standards have been derived and they are expected to be made mandatory by law in 2017. Supporting tools and guidelines are currently undergoing a major update [12]. The updated standards are expressed as a maximum allowed flood probability for the protected area. A set of tools and software will be put in place (expected delivery September 2016) to support the assessment of flood defence systems. Where the existing assessment tools generate information such as ³DSSURYHG´ ³GLVDSSURYHG´ DQG ³QR MXGJHPHQW´ WKH QHZ probabilistic assessment tools will generate a failure probability, which could be used in the process of prioritization and planning of flood defence works. Tools and guidelines for design will be developed based on the same principles as the assessment.
Similar to the French approach, fault trees can be drawn up for Dutch levees. For each (combination of) failure mechanisms it is considered that failure occurs when the hydraulic load is larger than the strength of the particular levee length for the considered failure mechanism. Limit state functions are used to model this [13]: Where Pf is the probability of failure, S stands for hydraulic load and R for the strength of the flood defence.
A full probabilistic approach requires specialist knowledge and experience, and requires a long computation time. Since it is imperative that flood defence managers can assess their flood defences themselves, the tools offer both a faster semi-probabilistic approach as well as a full probabilistic approach. The fast and more easily applicable semi-probabilistic approach is based on conservative assumptions where a failure mechanism model is fed with unique, sufficiently safe values (i.e. design values). If the semi-probabilistic approach is unsatisfactory, a full probabilistic assessment is still an option. Safety assessments will be performed at different levels to enable an effective workflow, focusing the effort on flood defences that require accurate assessments. The various levels of safety assessment are set up in such a way that a flood defence that meets the safety requirement at a certain level, will never be rejected in subsequent levels. The initial levels of assessment are therefore more conservative and strict, whereas the subsequent levels are more accurate and generally more time consuming.
The following levels have been proposed: 1 Relevance assessment and/or simple assessment per length of levee. The assessment is based on geometric decision rules or simple rules or models. 2 Detailed assessment: a1 Semi-probabilistic assessment per length of levee.
Assessment is based on detailed models for failure mechanisms with safety factors based on a full probabilistic approach; a2 Probabilistic assessment per length of levee.
Assessment is based on probabilistic calculation of failure probabilities, using the same detailed models for failure mechanisms as in assessment level 2a1. b Full probabilistic assessment per levee segment.
Assessment is based on similar probabilistic calculations as assessment level 2a2. Additionally, results of different failure mechanisms and levee lengths are combined to derive a failure probability of the complete levee segment; 3 Advanced assessment per length of levee. This assessment will be carried out for lengths WKDW GRQ ¶W meet the standards according to levels 1 and 2, while at the same time it is expected that a more sophisticated tailor-made approach will lead to an improved assessment result. This advanced assessment increases the technical quality of assessment for these lengths, for example by carrying out additional measurements, or by using more advanced or more accurate models.

Analysis and discussion
In principal, function analysis and failure modes analysis methods permits analytical and systematic identification of all structural failure scenarios of levee segments and all inundation scenarios associated to levee systems. It is however, of note that simulation of different return period events and multiple levee failure scenarios can lead to impractical computation times. Whilst efforts to overcome these challenges have been made, further research is required in this area. Function analysis and failure modes analysis methods do however, enable the identification and selection of the most relevant failure scenarios to consider for risk estimation. They also facilitate the estimation of failure probability of flood protection systems.
Due to the complexity of levee systems and of associated structural mechanisms and hydraulic events, the failure analysis process can produce a very large number of scenarios. To facilitate their identification and analysis, an interesting prospect would be the development of a data processing tool, based on function analysis and failure analysis principles, able to generate and classify failure scenarios, and thus help experts to identify which failure scenarios to evaluate in terms of probability.
Furthermore, due to the complexity and diversity of failure mechanisms involved in levee structural failure scenarios, engineers don't always have the physically based numerical models for assessing them. Empirical models are often the only solution (i.e. regressive erosion) and sometimes engineers can only rely on expert based judgments. A method that could combine all type of models is probably more adaptable to different assessment contexts. The semi-quantitative approach, mixing expert opinion, simple calculation and more complex assessments (which is used for the French index based method and the Dutch approach described above), is well adapted to construct such a combined method.
More research is required in geomechanics (but this is not the purpose of this paper which is dealing with complex issues at the system and levee scale) Levee assessment methods can improve levee performance estimation and related uncertainties. Thus, they can assist levee managers in estimating flood risk and in the prioritization of actions on levee segments. These actions can include further investigations (research and monitoring) required to further reduce uncertainties.
The methods presented above lead to a better knowledge and thus a better management of flood risk by failure of flood protection systems. However, these methods, which are based on the same principles, but have been developed independently, could probably be analyzed in greater detail, and compared and combined in order to build a "meta-method" incorporating the strengths of all of them [14].

Principles and methods
Flood consequences result when vulnerable persons or properties are actually exposed to a flood and suffer some actual harm. Consequences may be a direct result of flooding (e.g. damaged buildings and/or contents) or indirect (e.g. loss of business earnings due to recovery time) [15; 16; 17; 18].
The estimation of the consequences of inundation in a leveed area results from a combination of the results of hydraulic modelling of the inundation and the estimated vulnerability (a function characterising damage according to hydraulic characteristics of inundation) of the different assets located in the leveed area. A leveed area can contain many different types of assets, including: people, buildings, natural/undeveloped areas, agriculture, business, transport, utility, communications networks, etc.
The vulnerability of these different types of assets can be approached in different ways, for example: casualties or life loss [19], social, economic and environmental consequences [20], and patrimonial consequences. Some difficulties lie in the fact that the vulnerability of a type of asset can often be studied in several ways, and also at different scales. For example the consequences of an inundation for a flooded factory can be approached in terms of economic losses, but also in terms of social issues for employees or even in terms of effects on the environment, at the scale of the owner and workers alone, or at the scale of the whole regional economy.

French current practice
Currently, French regulatory risk analysis of levee systems only requires consequence estimation for human casualties: estimation of the number of people flooded and/or at risk due to possible inundations. The characteristics of inundation usually used to perform this estimation are mainly water depth and flow velocities (horizontal and vertical), however flood propagation time and flood duration can also be taken into account. Inundation scenarios and their associated consequences are thus well detailed. Cost benefit analyses have to be produced in order to justify public funding and the development of new flood protection systems. In the future, multi criteria analyses (MCA) will be required to produce more detailed analysis of consequences and integrate the different types of flood consequences (human life, economic losses, environmental consequences, etc.). However no such tool is in common use and further developments in MCA methods and tools are needed.
The current French approach to consequences analysis is to calculate the consequences for a few different inundation scenarios (between 4 and 10 scenarios on average), whose risk level is estimated during the risk analysis process, for comparison during risk evaluation (figure 1). This approach though does not permit spatial integration of the annual risk as a result of the risk analysis which is a useful consideration in the assessment of levee systems.

The MDSF2 UK model
7KH (QYLURQPHQW $JHQF\ ¶V 0'6) PRGHO ZRUNV with systems of flood defences. Within a flood defence system, the performance of each levee section is assumed to be independent from one another (i.e. if one levee fails WKH\ GRQ ¶W DOO IDLO Extreme value distributions define the hydraulic loads and these are assumed to be fully dependent within a flood defence system. Hence, for any hydraulic loading event within a system, there are multiple combinations of possible defence failures. For risk analysis it is, in principal, necessary to simulate the flood propagation and associated consequences with every possible combination. In practice however, this is not computationally tractable and hence a Monte-Carlo sampling procedure is used with a volume based rapid flood spreading model. The risk simulation therefore involves a range of return period events and multiple sampled defence system failure states associated with each return period. The volume spreading simulation enables flood depths and hence economic damages to be established for each simulated event. These results are then aggregated to determine the spatial distribution of risk (Expected Annual Damage) across the floodplain. For the purposes of identifying priorities for intervention (capital and maintenance works) the risk on the floodplain is attributed back to each levee section. This is made possible through the flood inundation model. For each flood event simulation, the volume of water discharged through or over each levee is recorded. This is then stored and tracked through each flood cell as the water propagates across the floodplain. At the end of the flood simulation the volume of water within each cell is known and critically the proportion of water associated with each levee section that has contributed to flooding the cell. The damage in each cell is then attributed back to each levee taking appropriate account of the relative contribution that each makes to the damages. These results are then aggregated to enable the risk associated with each levee to be determined. Decisions relating to where investment can be most beneficial, in terms of risk reduction, can then be made with supporting evidence.

The Dutch approach
In the Netherlands, where 60% of the area of the country is protected by a flood defence system, the area is divided into flood defence systems, called levee segments. The same approach as in the UK is appliedwith extreme events as the driver of levee failure. A levee breach model then determines the extent of flooding of the hinterland and calculation of economic damages and casualties then follows. [21].
For each segment a set of flood scenarios can be calculated. The Sobek 1D-2D software has been used to this end. The hinterland was modelled based on a digital terrain model, with including elements that have specific importance to flooding patterns such as ditches, hydraulic structures and barriers (e.g. roads) added manually. A variety of hydraulic boundary conditions with different return periods led to a set of different flood scenarios. Ample use was made of the flood scenarios that were developed for the VNK project [22]. Out of more than 1000 available flood scenarios, approximately 300 were used in this analysis.
For each flood scenario, economic damages and fatalities were calculated. The methods used are well described in [23]. In short, the economic risk is calculated by a confrontation of flood characteristics (water depth is the most important factor in the Netherlands, but flood duration and flow velocity can be of influence as well) and structural/asset characteristics (strength of structures and buildings, reflected in damage functions, and maximum damage possible to the assets). The result is a value of economic damage, which is multiplied with the flood probability or scenario probability. Finally, the contribution of all flood scenarios is added to obtain the total economic risk of the protected area behind a levee segment.
The calculation of fatalities is more complex. The method applied led to the calculated probability of death at a certain location due to a flood assuming no evacuation, but also taking into account the possibility of evacuation when a flood is imminent. The fatality risk was calculated taking into account flood characteristics, area characteristics, evacuation fraction, fleeing/shHOWHULQJ IUDFWLRQ DQG SHRSOH ¶V EHKDYLRXU The local individual risk of a certain location was then calculated by multiplying the scenario probability with the fraction of the number of inhabitants present in the flooded area and the flood mortality rate of those people for each flood scenario -followed by a calculation of the total value over all scenarios [23][24]. To give an insight into societal risk and social disruption a Monte Carlo framework was set up to account for multiple breaches [25].

Analysis and discussion
The various approaches to flood consequence analysis described above are quite different in terms of methods, objectives and results.
Firstly, the French approach is focused on human casualties while the UK approach studies only economic damages. The Dutch approach analyses both casualties and economic damages. Furthermore, the flood characteristics used to perform an analysis of consequences can be simple, involving only water level in the UK method, or more complex, involving combinations of several factors (such as water level, flow velocities, flood propagation time and flood duration) as described in the French and Dutch approaches.
These differences in objectives involve specific methods to evaluate each sort of asset damage and produce specific damage functions (especially in terms of flood characteristics, area characteristics, evacuation IUDFWLRQ IOHHLQJVKHOWHULQJ IUDFWLRQ DQG SHRSOH ¶V behaviour, strength of structures and buildings, etc.).The complexity of these specific methods grows with the number of factors used in the definition of flood characteristics.
Another difference between the methods presented lies in the way in which inundation scenarios are integrated in order to calculate consequences, and in the type of results which are produced. The French approach evaluates consequences for a few but well detailed number of inundation scenarios with which to compare their associated risk levels at the end of risk analysis. The Dutch method evaluates consequences for numerous different inundation scenarios in order to calculate a total consequence value over several inundation scenarios for a leveed area. The UK method integrates consequences of all (but less detailed) inundation scenarios for each cell of leveed area and leads to a spatial integration of the annual risk.
We can see that, even though the need for such assessment is recognized in many countries, no common method currently exists to analyse flood consequences and that the existing methods have their own advantages and disadvantages (the more detailed they are, the less they are globally applicable). However, due to their differences in approaches and in objectives, it seems difficult to use the strengths of these different methods to develop a common MCA method. It may be more practical to use and combine the different types of methods in coherence with the complexity of the consequence analysis. In fact, whether or not it is appropriate to use a method to calculate flood consequences depends on the nature of the physical conditions (river, lake, tidal river area or coastline), on the topography (hilly region or delta flats) and on the hydraulic drivers(precipitation, river discharges, storm surge, etc.). Furthermore, a proper hazard analysis requires good engineering knowledge.

Principles and methods
Levees work together in a system to reduce the risk of flooding. However levees do not all contribute the same level of risk reduction to the whole. Risk analysis methods can assist in the prioritisation of maintenance activities by identifying those levees that are contributing most to the residual risk. Figure 6 shows the output from WKH (QYLURQPHQW $JHQF\ ¶V 0'6) V\VWHP ZKHUHE\ WKH floodplain risk to properties has been attributed to each of the levees within the flood defence system. A concept sometimes knowQ DV ³ULVN EX\-GRZQ´ FDQ WKHQ EH implemented whereby maintenance investment decisions can be targeted at those weakest or lowest levee sections that are protecting most property. Or, in other words, maintenance strategies can be optimised in terms of the economic benefit of risk reduction when compared with the costs of undertaking the maintenance. More recent research has explored the application of automated optimisation algorithms coupled to the risk analysis models to help support these types of decisions, [26]. Some levees are more or less reliable than others, some may have more variable crest levels for example, or may be weaker structurally than others. Failure of different parts of the levee system may lead to different inundation of the leveed area (in terms of flooded area, water levels, time, speeds V and H etc).
Risk attribution, which is based on the results of risk estimation, aims to attribute the residual risk in the protected floodplain to individual levee segments and inform the prioritisation of intervention measures to further reduce the risk. In fact, it is not possible to protect against all flood events and all flood defence systems therefore leave a residual risk of flooding.
Risk attribution can be done [27] for each inundation scenario (for each part of the levee length) and lead to their relative classification according to the risk attributable to each. It can also be integrated at the whole levee area scale, and lead to the estimation of the global inundation risk attributed to the entire levee system.

UK approach
The methodology for attributing residual risk to defence sections involves establishing a relationship between the quantity of water discharged through each individual levee and the economic consequence of flood events. The vector comprising the defence system states can be subdivided into subsets of levee groups. The levee sections in any group all discharge flood water into the same adjacent flood cell.
Flood depths in any flood simulation scenario are a function of the defence system and also a function of flood volumes discharged through each of the levees. On each hydraulic flood simulation the proportion of flood volume contributed by each levee to each adjacent flood cell is obtained. Then, as the flood water propagates across the floodplain, the source adjacent flood cell is recorded and the quantity of water supplied to each destination flood cell is monitored. The flood event economic damage associated with each non-adjacent flood cell is then allocated to each of the adjacent flood cells according to the volume of water supplied. The total adjacent flood cell event damage is then apportioned according to the relative proportion of volume contributed by each levee. This process is repeated on all flood event simulations and thus the residual risk can be attributed to each levee section. As knowledge of the defence system state is retained for each flooding scenario, it is possible to disaggregate this information further into risk arising from overtopping and breached flood events respectively.

Dutch approach
The safety assessment of flood defences in The Netherlands follows a two-step procedure: (1) quantification of optimal safety standards and (2) assessment on which flood defences do (not) suffice according to these safety standards.
Step (1) is based on a risk approach in which flood probabilities and consequences (damages and casualties) are taken into account.
Step (2) is essentially a hazard analysis, in which only the probability of flooding is considered and compared to the established safety standards.
There is an additional major difference between the UK and the Dutch approach: in the Dutch analysis the risk is not attributed to levee lengths by tracking the source after the calculations have taken place. Instead the Dutch system takes a scenario approach, in which the effects of a breached levee are representative of a levee length. For this purpose, the system of flood defences is subdivided into several lengths, based on the criterion that flood consequences are approximately the same for breaches at any location within a single length. In the Delta program [28], responsible for establishing safety standards, the following risk indicators were calculated: local individual risk, societal risk and economic damage.
The calculated risks were fed into a political discussion on acceptability of risk. It was decided from a perspective of equity that local individual risk should not exceed a value of 10 -5 per year anywhere. In cases where the risk of social disruption is high (quantified by the societal risk calculation and improved by a qualitative analysis of failing critical infrastructure such as the national power supply), or where improving the flood defence system is economically efficient [29], the flood defence standards were increased. Figures 7, 8 and 9 show some results (Courtesy Delta program).

Analysis and discussion
Risk attribution studies can be used to provide a range of useful information. For example, within the UK the Environment Agency are increasingly adopting this type of risk-based information within the decision making process. There are however, challenges to overcome with regards to communication of the information and the methods used to derive it.
In terms of the methods themselves, there are two primary limitations. These include the lack of widespread availability of the geotechnical information required to undertake the reliability analysis for each levee section. In addition, due to the number of potential failure scenarios that requires modelling. Computational restrictions mean it is currently challenging to simulate the full physical process within the inundation simulations -hence reduced complexity models are often applied instead. These necessarily include simplifications. However, the approach could be adapted to combine complex and simplified models to treat issues of high complexity.

Conclusions
Current methods for flood risk analysis, incorporating levee failure analysis, consequences analysis and risk attribution are capable of providing a range of information to help support decisions. Within the UK these methods have been applied on the National Flood Risk Assessment as well as major regional studies relating to the Humber and Thames Estuaries. In the Netherlands, they were applied regionally and used in the National Flood Risk Assessment to set new flood risk standards. In France, they are now often applied to perform the regulatory risk analysis of levee systems.
The methods have shown to be capable of providing a range of information that can help support flood risk management decisions, including those relating to maintenance and refurbishment of activities.
Current challenges and aspects requiring further development include those relating to the communication of the model results and the technical aspects of the methodologies; levee data sufficient to support the reliability analysis; and also to simplifications inherent within methods of flood inundation modelling that are applied in practice.
Furthermore, even if some principles of current methods are the same, they present differences which may be advantageous or disadvantageous, depending on levee systems complexity, to fully resolving risk analysis objectives. These different methods could probably be analyzed in more detail, compared and combined, in order to build a cross-country inspirational µmeta-method ¶ defining the general framework for levee system failure analysis, flood consequences analysis and risk attribution. Such a framework could then be adapted to combine complex but more specific methods and more simplified but global methods, using the strengths of all of them to treat specific issues of high complexity.