Flood risk reduction by parallel flood defences – Case-study of a coastal multifunctional flood protection zone

In this paper the safety of a double-dike system (or twin dikes) is assessed. Such a system consist of two parallel lines of flood defences. During storms the combined strength of the parallel flood defences must prevent flooding of the hinterland. A culvert can be implemented for the tidal exchange of sea water to enable new land-uses in the area between the dikes such as aquaculture, saline agriculture, salt marsh restoration and clay extraction. We develop a general framework for assessing the safety of such double dike systems and apply a simplified version to the Double Dike between Eemshaven and Delfzijl (The Netherlands) to test this method. In doing so, we aim to quantify the flood protection benefits of parallel flood defenses and enable their use in multifunctional flood protection strategies. Within the framework the transmission of hydraulic loads by the seaward dike to the landward dike in the case-study was described by overtopping, overflow and erosion of the outer slope, alongside discharge through the culvert in the event of a non-closure. For the subset of coastal double dike systems with a tall seaward dike (as in the case-study), the results show only a negligible improvement in flood protection compared to a single dike system. With the addition of a culvert in the first dike, flood risk will only be reduced by the second landward dike if its height is sufficient to retain water in the event of a non-closure during common storm events. These double dike systems are implemented for potential uses of the inter-dike zone, e.g. for nature restoration, rather than as a measure to primarily improve flood protection.


Implementation of double dike systems
The majority of the world's population lives near rivers and coastlines where millions of people are exposed to the threat of flooding.With a growing global population and the influence of climate change, flood risk is expected to increase further unless new flood risk management strategies are implemented, including the introduction of innovative flood protection infrastructure (Winsemius et al., 2016;Vousdoukas et al., 2018;Hinkel et al., 2014).One method to reduce the exposure to floods is the continued heightening and strengthening of existing levees, seawalls and other structures.However, such interventions may not address, or could even aggravate, other pressing problems (Elliott et al., 2019;Jeuken et al., 2014), like loss of marsh and fish habitat (Schuerch et al., 2018;Munsch et al., 2017), coastal erosion (Williams et al., 2018), limited space for urban expansion (Barbier, 2015), and a deteriorating water quality (Kiedrzyńska et al., 2015).Therefore, integrated solutions are being investigated to reduce flood risk, while at the same time integrating, improving or restoring other uses within the flood protection system (van Loon-Steensma et al., 2014;Temmerman et al., 2013;Stalenberg et al., 2013).A system of multiple parallel dikes (also called double dikes or twin dikes) is one alternative being explored in this context.
Double dike systems are already implemented in many different forms to improve flood protection.A system of multiple dikes has been described in literature in a variety of contexts, using different names to refer to the double dike system and its components.For example, a second dike behind the primary dike can be referred to as a sleeper dike, a ring dike if it encircles an area of interest, a compartment dike designed to limit the flood extent after a breach, or as a regional dike.To aid in the discussion of these systems, we first classify different double dike types based on the probability of a flood (P f ) for each dike in the absence of the other (see Table 1).The first dike is always located closest to the sea/river while the second dike is closest to the hinterland regardless of function, size or age (see Box 1).In a type I system the strongest dike is located near the source of water.In a type II system both dikes are about equally strong.In a type III system the strongest dike is located closest to the hinterland.For completeness two additional types are included where the first dike does not offer protection from floods, but may still interact with flows and waves on the foreshore.This is the case for small embankments on the foreshore (type IV) or after a breach is created (type V), e.g. as a part of managed realignment.
Secondary dikes can simply be remnants of defences along former polders, rivers or coastlines and no longer serve a purpose in flood protection.When a second defence is built to support an existing defence its function differs between riverine and coastal environments.Generally, along coastlines an additional dike aims to reduce or mitigate flooding by high (storm) waves.This may be accomplished by making the first dike act as a breakwater in a type III system (Mai et al., 1999).
Alternatively, overtopping water can be contained in the interdike area and prevent damage in the hinterland in a type I or II system (Pasche et al., 2008).Along rivers, a sufficiently high second dike aims to reduce the (peak) river discharge and the associated flood water levels by providing additional space (Room for the River) in a type I, II or III system (Bornschein and Pohl, 2018).The interdike area is flooded (directly or through a structure) during the peak of the discharge, thereby reducing the peak discharge and water level downstream (Smolders et al., 2020;Lammersen et al., 2002).Smaller "summer" dikes found along rivers only aim to retain water within the river's main channel for navigation and agriculture in summer, rather than contributing to mitigating flood risk during extreme events, and are classified as a type IV system.
Systems with multiple dikes have often emerged from repeated land reclamation for agriculture or urban expansion.More recently, small polders have also been restored to wetlands across many countries to preserve and create ecosystem services (Esteves and Esteves, 2014).In many of these coastal examples, the tide was reintroduced via one or Table 1 A classification for different double dike configurations based on the probability of a flood (P f ) for each dike in the absence of the other.

Type
Image Criterium Marijnissen et al. several in-/outlet structures in the first dike and a second ring dike was built around the restoration site, thus creating a type I, II or III double dike system (e.g.Kruibeke (BE), Breebaart (NL), Luneplate (GE), Bremerhaven (GE), Beltringharder Koog (GE), Sebástopol (FR)) (Hofstede, 2019;Reise, 2017;Peletier et al., 2004;Goeldner-Gianella, 2007;Maris et al., 2007).In other cases double dikes have been implemented for retaining water and managing floods for agriculture (Ghazavi et al., 2010;Toan et al., 2014) or to anticipate the loss of primary flood defences by ongoing coastal erosion (Vinh et al., 1996).While two dikes remain present to retain floods, usually only one dike is assigned the function of flood defence during critical conditions.Finally, systems where the first dike is already breached before a storm are classified as a type V system.While the first dike can no longer prevent flooding by itself, it can still aid in reducing water levels at the second dike, as was studied for the Freiston Shore Managed Realigment site (UK) (Kiesel et al., 2020).

Research gap
Double dikes have garnered interest for their potential to integrate coastal functions (e.g.urban development, nature conservation and development, recreation, aquaculture, saline agriculture, etc.) with flood protection.However, without an extensive local or regional assessment it is not yet clear how an additional dike affects flood protection assessments of such a system.So far, safety assessments of systems with multiple flood defences have computed the probability of failure of each flood defence individually from the failure mechanisms (Jongejan et al., 2020) and later combine the probabilities into a system reliability.This is achieved by schematising the failures of flood defence components into a system of serial and parallel correlated failures, from which the combined failure probability is assessed with a fault tree analysis (Roscoe et al., 2015;Steenbergen et al., 2004).The applied failure mechanisms to compute these individual failure probabilities are usually defined by critical thresholds rather than by a physical description of dike erosion or deformation.While such thresholds for failure are useful indicators, they give no information regarding the subsequent flows over/through the dike into the interdike area during failure.Therefore this approach is ill-suited for incorporating the dynamic loads on a second flood defence during and after "failure" of the first dike.Generally, a component like the first dike is simply assumed to have one "failed" state in which a breach has developed.This assumption overestimates the failure probability of a double dike system when the residual strength of the first dike remains sufficient to reduce or even prevent loads on the second dike.
The development of a breach and the subsequent flows after failure of the first dike are usually modelled separately as part of the safety assessment of regional compartment dikes (dikes designed to limit the extent of a flood after a breach).These simulations are carried out for pre-defined breach locations, during pre-defined design storm scenarios, under the assumption that breach formation is initiated upon reaching the design water level of the primary defence during the simulated event (Oost and Hoekstra, 2009;Geerse et al., 2007).As a result, this method substantially simplifies the events initiating failure and relies on the judgement of the engineer to select the proper scenarios.
In this study we aim to quantify the flood protection benefits of parallel flood defences in order to enable their use in multifunctional flood protection strategies.In the current practise the system reliability is assessed by simple failure scenarios for each individual flood defence.In this study a more sophisticated approach is explored where the first dike of the system is treated similar to a foreshore.Recent studies have demonstrated how complex additional elements on the foreshore like vegetation or sand from dunes can be implemented in probabilistic flood risk assessments (Oosterlo et al., 2018a;Vuik et al., 2018) and affect flooding once a breach has developed (Zhu et al., 2020).Adopting a similar approach for double dikes allows for greater optimisation in the design of these systems.This paper proposes a general method for assessing the safety of double dike systems and applies a simplified version to the Double Dike between Eemshaven and Delfzijl (The Netherlands) to demonstrate its applicability.

Outline of the paper
First the methodology to assess the safety of a double dike system is presented in section 2, starting with the existing framework for single dikes (2.1) and expanding this to a new framework for two dikes (2.2).The method (section 3) is applied to the case of the double dike between Eemshaven and Delfzijl (3.1).Here the framework is simplified to fit the

Box 1
Definitions used for the components of a double dike system The following definitions are used throughout this paper: • Double dike system: A flood defence system where two parallel dikes, including the area between the dikes, protect the hinterland from flooding.
• Foreshore: The land in front of the first dike which is not permanently inundated with water.
• Culvert (optional): If present, this structure allows the interdike area to be controllably flooded and drained.
• Interdike area: The land in between two dikes.Flooding of this area may be managed.
• Hinterland: The land protected by the flood protection system.
• First/second dike: Dikes are numbered from the foreshore towards the hinterland, regardless of size, age or function.
study area (3.2) and the concepts of hydraulic loads (3.3), and transmission functions with the probability estimation methods (3.4) are described for the case-study.Results of the safety assessment calculations are presented in section 4: first for the safety assessment of the first dike (4.1), then integrated with a culvert (4.2), and finally with a second dike (4.3).In section 5 the results are discussed: first the reliability of the models (5.1), secondly the applicability of the double dike framework (5.2), thirdly the applicability of the results of the case-study for other types of double dike systems (5.3) and finally other drives for implementing a double dike system beside flood protection (5.4).Finally the conclusions are presented in section 6.

Existing approach for flood risk assessments
In general, assessing the safety of dike systems consists of identifying the failure mechanisms of the system, assessing with various models when these failures are expected to occur, and finally determining if the probability of such an event is acceptably low.The failure mechanisms of dikes, levees and other common flood protection structures are well known and can be found in most engineering manuals, guides, and standards.e.g.(Kok et al., 2017;Army Corps of Engineer, 2002;Allsop, 2007).For failure mechanisms "failure" is usually defined as an amount of critical damage of the flood defence or a critical condition in which damage is expected.Examples of such criteria include overflow, a critical overtopping discharge limit (van der Meer et al., 2016), a critical pore pressure gradient for piping (Sellmeijer et al., 2011), or a critical force balance for slope instability (Van, 2001).The probability of failure in these cases is defined as: where S is the applied load condition on the dike and R is the critical load condition for the flood defence.Solving when the limit state (R = S) has been reached does not indicate how much water will flood the hinterland.Therefore, in Dutch law a different criterion is used.According to the definition of Kok et al. (2017) a flood defence has only failed if it results in at least 0.2 m of water depth in a postcode area in the hinterland.In practice the limit state approach is still used for assessing flood defences.However, exceeding the limit state for a failure mechanism is allowed within safety assessments as long as the flood depth criterion is not exceeded.

A framework for double dikes
In case of a single dike, the probability of failure is defined as the moment where the applied hydraulic loads on the system (S) are greater than the resistance of the system (R).In a double dike system, failure of the first dike may not result in a flood as long as the second defence prevents flooding of the hinterland by its height, or when the "failed" first dike sufficiently reduces the hydraulic loads at the second dike.The first dike can be conceived as transmitting (T) a portion of the hydraulic loads from the sea/river (S) to the second dike.Under critical conditions dikes can transmit water and waves, similar to a breakwater.A breakwater transmits loads to the other side depending on the properties of the breakwater and its location within the system (d'Angremond et al., 1996).Dikes will only transmit water and waves by overtopping, overflow, seepage, or after a breach rather than through water pressures in the structure.The second dike needs to resist (R) the loads transmitted by the first dike (T(S)).This resistance (R) of the second dike is not affected by the fact that the dike is part of a double dike system.The probability of failure of the system is thus the probability of the transmitted hydraulic loads being greater than the resistance of the second dike.In mathematical terms: Comparing Eq. (2) to Eq. ( 1) used for single dike systems, the only difference is the addition of a transmission function (T).Here T is a sequence of models describing for any storm event in S the corresponding hydraulic loads behind the dike.The idea of properties (S), like water levels and waves, being transmitted through a system (T) and comparing it with some critical criteria (R) to decide on the probability of an event (P f ) is not uncommon in other fields.In fact, this procedure lies at the core of many machine learning applications where information is transmitted through a network of (simple) models to inform about probabilities of an event.
To follow this procedure, we present in Fig. 1 a new framework which consists of 5 steps: 1. Retrieve or compute the necessary statistics of hydraulic boundary conditions of the defence (S).These include the water level, the tide, the frequency of (storm) waves, the duration of storms, etc. 2. Identify the relevant failure mechanisms (T) of the first dike.In the framework there are three categories of failure mechanisms: the transmission mechanisms which transfer water from one side of a dike to the other (e.g.overtopping and overflow), the erosion Fig. 1.A general framework for assessing the probability of failure for a double dike system.The shaded boxes represent the mechanisms that were considered in the assessment of the case-study between Eemshaven-Delfzijl.
mechanisms which damage the flood defence such that transmission mechanisms are enhanced or a breach develops (e.g.soil instability or damage by waves), and the failures of embedded structures which can either allow water to flow through the dike (e.g. a culvert) or can damage the flood defence (e.g. an uprooted tree).Each erosion mechanism is expressed by a model calculating changes in the profile over time, and each transmission mechanism is expressed by a model calculating the flow over, through, or beneath the (eroding) dike.
Possible failures posed by embedded structures can vary depending on the structure but should be expressed as flows or erosion over time.Finally, if according to one of the failure definitions erosion is too large a breach is assumed.Once the dike is assumed breached, failure mechanisms are no longer calculated and instead hydraulic loads are transmitted unimpeded to the interdike area.3. Link the models identified in step 2 such that for all combinations of boundary conditions transmitted hydraulic loads into the interdike area are calculated T(S). 4. Determine the resistance of the second dike (R) to the relevant failure mechanisms.This procedure is identical to descriptions of failure in a situation with a single dike. 5. Select and execute a suitable algorithm to compute the probability of failure.Examples of such algorithms are the first order reliability method (FORM) (Ditlevsen and Madsen, 2007), numerical integration, or different sampling methods (e.g.Monte Carlo, directional sampling, importance sampling, etc).
To understand how the framework can be employed in practice, a simplified subset of mechanisms (the shaded blocks in Fig. 1) are evaluated for the case of the double-dike between Eemshaven and Delfzijl (section 3).

Case study
Like many coasts in the world, the Wadden-sea region will need to prepare for accelerating sea-level rise.The Delta Program, National High Water Protection program, and local water boards are investigating options to prepare the Dutch Wadden-sea coast for 2100 (Delta Pro-grammeDelta Programme, 2015).At the dike section between Eemshaven and Delfzijl the application of a double dike system is investigated to maintain the strict flood protection level under future sea-level rise and subsidence, and explore how additional functions (saline agriculture, aquaculture, nature development, clay mining) can be integrated in this system (Kwakernaak et al., 2015).
The Double Dike project Eemshaven-Delfzijl is located in the northeast of the Netherlands inside the Ems estuary, in the southern part of the Wadden Sea (see Fig. 2).The parallel dikes (see Box 1 for the definitions of a first and second dike) enclose about 39 ha of land where new uses are explored.The first dike has been reinforced many times and the original clay dike can still be found inside the current dike (Fig. 3).Recently the first dike was reinforced by the construction of the inner berm.A second dike was built behind the dike to a height of approximately 4 m + NAP to create the double dike system (Figure in Box 1).
The area between the two dikes is split into three sections (see Fig. 2).The southernmost section (A) will be connected directly to the Ems through a culvert.In this area clay mining and nature development are planned as additional land-uses within the flood protection system.While an intertidal habitat develops, at yet to be determined locations accumulated clay will be extracted at regular intervals for use in dike construction.Section B will be connected to section A through a smaller culvert and is reserved for aquaculture.Section C is elevated and will feature saline agriculture.At the time of writing the second dike has been constructed, but the culverts in the first dike and between the dike sections, and the functions within the interdike area are not yet implemented.

Framework applied to the case-study
The first dike of the double dike system has already been reinforced to prevent breaching from failure mechanisms like piping and geotechnical instabilities up to the required Dutch safety standard for a single dike.For the mechanisms of wave impact and overtopping sufficient safety ought to be provided by the addition of the second dike.The usual overtopping and wave impact criteria assume the flood protection system has failed once the outer grass and roots, asphalt, or stone layer is damaged.Provided no breach develops, damage to the first dike is acceptable since the second dike would prevent water from reaching the hinterland.While this approach suits the specific circumstances of the case-study where an existing primary dike has already been reinforced up to standard, it does not generalise well for designing double dike systems from scratch.Therefore, the integrated framework in section 2 is applied to this context.
For the case-study the framework in Fig. 1 is substantially simplified to estimate failure of the Double Dike Eemshaven-Delfzijl.In practice all failure mechanisms need to be included for a thorough assessment, but for this study only the shaded parts of the framework in Fig. 1 are evaluated.First, we consider only erosion of the outer slope by waves as the erosion mechanism of the first dike.The considered transmission mechanisms as defined in section 2.2 are overtopping and overflow.Secondly, we consider failure of the structure (i.e. the culvert in the first dike) to only result from non-closure, and assume it will be constructed with a negligibly low probability of structural failure.The second culvert between sections A and B (see Fig. 2) is not considered as it will remain open to fill the interdike area evenly.Therefore, we only consider the flow of water between the sea and interdike area through the culvert in the first dike from here on.
Thirdly, the first dike used to be the primary defence and consequently was designed to prevent overtopping during most storm events.As a result, little wave action can be expected within the interdike area from overtopping of the first dike.A water level increase inside the interdike area is therefore the only transmitted hydraulic load considered at the second dike.To transform the combined hydraulic load probabilities at the first dike into the water level distribution of the interdike area, a multitude of different storm events were simulated in a probabilistic procedure (see section 3.4.3and Appendix B).
To arrive at the failure probability of the double dike system, the remaining hydraulic load distributions need to be evaluated at the second dike.For simplicity, this study only looks at overflow as a failure mechanism for the second dike, as this mechanism dictates the required height of the second dike.Hence the probability of failure for this particular simplified case reduces to: Fig. 4 visualizes the mechanisms that were used to assess the casestudy.

Hydraulic loads
For many locations along the Dutch coast annual water level and wind statistics derived from over 60 years of measurements are available from gauges and stations.Additionally, the expected wave conditions during different combinations of water levels, wind speeds, and wind directions have been simulated with standardised models of the Dutch coast and are stored in databases for designing and assessing flood protection measures (den Heijer et al., 2008).The most recent version of this hydraulic databases of the studied section of the Wadden Sea coast was used (Rijkswaterstaat, 2017).Hydra-NL is a software-package made available by the Dutch water authorities that combines station statistics and the hydraulic database of simulations to estimate the annual probability of hydraulic load conditions at flood defences (Duits and Kuijper, 2018;Gautier and Groeneweg, 2012).The probabilistic methods employed in Hydra-NL are described by Diermanse and Geerse (2012) and in Hydra-NL's background report (Gautier and Groeneweg, 2012).To simplify computations, probability density functions (PDFs) and correlations were fitted to the water level, wave height and wave period statistics at the case-study site computed by Hydra-NL.Due to the orientation of the case-study site inside the estuary the conditions were simplified further by only considering one wave direction: from the Wadden Sea towards the study-site (see section 3.1).The fitted distributions for storm conditions are summarised in Table 1.
The conditions in Table 1 represent the simplified correlated joint probability distribution of annual maximum hydraulic loads at the first dike.This was defined as the collection of hydraulic loads (S) in section 2.2.

Overtopping and erosion
For assessing overtopping flows and erosion of the outer revetment simultaneously, a prototype dike erosion model was utilised (Rongen et al., 2018).It is based on the extensive research performed on grass dikes during the development of new dike assessment tools in the Netherlands (WTI-2017) (Kaste and Klein Breteler, 2015;Klein Breteler, 2015;Kaste and Klein Breteler, 2014;de Waal and van Hoven, 2015a;de Waal and van Hoven, 2015b;Mourik, 2015;Klein Breteler et al., 2012a).The formulas were empirically derived from large-scale wave flume experiments (Wolters et al., 2011;Klein Breteler et al., 2012b).The integration of the different components into a single model was first presented by Kaste et al. (2015) and programmed by Rongen et al. (2018).While all individual model components are already in use for advanced dike assessments in the Netherlands as part of the WTI-2017 tools, the integrated model is still under development at the time of writing.Minor adjustments were made to the prototype to allow the dike erosion model to run within a probabilistic routine (see 3.4.3).
The general steps performed by the model are described here.For the details and formulas see Appendix D. First the dike profile needs to be specified in terms of geometry and the different materials (grass cover, clay, sand) like in Fig. 3.Each of these materials has a resistance to being eroded when exposed to wave impacts and wave run-up loads.Secondly, the annual maximum storm loads were converted into a storm event with a time-series of a water-level, wave height and wave period using the 45 hour storm schematization for the region from Chab (2015) (see Appendix B for details).At each time step, the model calculates which part of the dike is exposed to the wave loads, determines whether the critical load has been exceeded for the exposed material and, if true, calculates the volume of dike material being eroded at that time step (see Appendix D).After the erosion processes are evaluated, the overtopping discharge by waves over the possibly eroded dike profile is calculated.The result is a time series of the wave-overtopping discharge (see Fig. 5).The total volume of overtopping during the simulated storm event is divided by the area of the interdike area to determine the rise in water level during the event.

Flow through the culvert
The formulas of Borgerhout implemented in Delft-3D (Deltares, 2020) (p. 301-303), based on the flow regimes in French (French et al., 1985) (p.368), were used to calculate the flow of water through the culvert in the event of a non-closure (see Appendix C for details).A wide range of 45-h events, ranging from a regular tide without storm surge to a 1 in 1,000,000 year storm surge, were simulated in the event of a non-closure (see section 3.4.3and Appendix B).The highest water level reached during the event is the maximum hydraulic load of the event.
At the time of writing, no final design is made yet for the culverts in the case study, but some dimensions have been proposed.The bottom of the culvert is being set at the bottom level of the inter-dike area (around − 0.5 m + NAP), and the height is set at 2 m.Different widths for the culvert in the outer dike are being considered: 3.5 m, 6 m and 12 m.Since the culvert has not been designed yet, the parameters needed to calculate the flow contraction (c D , α and n) are set at default values.
These parameters can be determined once a culvert is designed.A nonclosure probability for the culvert in the case-study area of 1.67 × 10 − 4 per event was estimated using a score-table of aspects such as preparation, mobilization, and closure-mechanisms within the guidelines set out by the Dutch national water authority Rijkswaterstaat (Casteleijn and Van Bree, 2017).Since the culvert will be part of a primary flood defence, it is assumed it will be designed and maintained to the strictest safety policies.For comparison, the famous, Maeslandt barrier in Rotterdam, the Netherlands, is only assumed to have a probability of non-closure of 1/100 per event (Bijl, 2006), primarily because it is more Fig. 5. Overtopping of the dike as a result of loads (water level + waves) over time.Once a critical load is realized on a dike section, the dike starts eroding.As the dike is lowered by erosion, more waves overtop the dike as a result and the water level behind the dike rises.Based on Rongen et al. (Rongen et al., 2018).difficult to close a large barrier in case of a malfunction.A summary of the dimensions and parameters of the culvert are given in Table 3.

Coupling the models in a probabilistic routine
The probability distribution of the transformed hydraulic loads, in this case only the water level distribution of the interdike area, was evaluated in discrete water depths between 0.2 m and 7 m inside the interdike area.Both the combined erosion-overtopping dike model (section 3.4.1)and the culvert model (section 3.4.2) only accept discrete storm parameters as inputs, and produce the highest water level in the interdike zone for that event as output (see Fig. 6).The probabilistic routines below iterate hydraulic conditions over these models and converge to the conditions with the highest probability of exceeding a discrete water depth.Because the probability of conditions with both significant overtopping and an open culvert were insignificantly small (in the order of 10 − 9 ) and the erosion-overtopping model is computationally expensive, the interdike water level probability for each mechanism was calculated separately, opting to calculate more steps with the culvert model.The total probability of reaching a water level by each mechanism is calculated by adding the probabilities of exceedance of both mechanisms.
For each discrete water depth in the interdike area, first the probability of exceedance and the associated hydraulic conditions at the first dike were estimated with the first order reliability method (FORM) (Ditlevsen and Madsen, 2007).The FORM method starts from an initial design point and reduces the complex set of correlated probability distributions into approximately equivalent standard normal distributions (n) around this design point, e.g. with a Rosenblatt transformation.In the transformed n-space, the distance from the origin represents the likelihood of the conditions.To solve for the likeliest storm (i.e.conditions nearest to the origin in n-space) almost exceeding the limit state definition (h interdike = h i ), the Constrained Optimisation BY Linear Approximations solver (Cobyla) was used (Powell et al., 1994), which uses successive linear approximations of the limit state to iterate towards the design point.Mathematically, FORM iteratively solves the optimisation problem: Constrained by the limit state: T(S) − h interdike,i = 0 Where:h i = Water level in the area between dikes for which the exceedance probability is being evaluated (m + NAP).
h interdike = Water level in the area between dikes (m + NAP).T = The water transfer model across the first dike, i.e. the overtopping and culvert flow.Fig. 6.The flow of information between the model inputs, the hydraulic loads (section 3.3), the creation of a synthetic storm event (Appendix B), the transmission functions for the culvert and first dike (section 3.4.1 and 3.4.2) and evaluation of the probability by a computational algorithm like FORM or importance sampling.The interdike water level probability for each mechanism was calculated separately as the joint probability of both significant overtopping and a nonclosure was low, in the order of 10 − 9 .S = The set of correlated hydraulic load parameters.n = Set of independent standard normal distributions of equivalent probability around the design point in S. Φ = Cumulative standard normal distribution.
While FORM generally converges quickly to a solution, it cannot converge well around the sudden increase in overtopping when waves erode the crest of the first dike.A more accurate exceedance probability was obtained through importance sampling (IS) (Robert et al., 1999) around the conditions returned by the FORM routine.The IS-routine sampled up to 3 000 random storm events within one standard deviation of the design point in standard normal space to compute the probability of a storm causing a failure of the system.Both methods were performed with the open-source toolkit OpenTURNS (Baudin et al., 2015) in the Python programming language.Interpolating between the computed exceedance probabilities of the water depth behind the first dike gives the full cumulative probability distribution of water depths inside the inter dike area.This water level distribution (h interdike ) is the distribution of hydraulic loads transformed by the dike (T(S)) as defined in section 2.2.

Overtopping of the first dike
The water level exceedance frequency in the interdike area due to overtopping and erosion of the first dike was obtained by the FORM-IS procedure (see section 3.4.3).The results are compared to calculations of the conventionally accepted overtopping limits for a single dike during the peak of a storm (0.1, 1, and 10 lm − 1 s − 1 ) as well as the water level increase for a model where no erosion of the outer profile is included (see Fig. 7).The conventional overtopping limits are conservative as they assume failure of the first dike immediately when the inner grass experiences this discharge, ignoring the time required for the dike to erode and form a breach.
For conditions with overtopping discharges up to 10 lm − 1 s − 1 coupling erosion of the seaward slope with overtopping does not affect the expected water level in the interdike area as little erosion is expected from wave impact (see Fig. 7).Following the Dutch design code the dikes in the region have a 1/3 000 acceptable annual probability of flooding.Considering the length effect, which requires this dike segment to be split into 3 individual sections for overtopping, and a suggested 24% failure budget for overtopping and overflow, the dike cross-section of the case-study should be designed against an annual failure probability greater than 1/37,500 for overtopping and overflow (Rijkswaterstaat, 2016).The probability of exceeding a moderate overtopping limit of 1 lm − 1 s − 1 under present conditions was calculated at 1/66,200 per year, around the safety criterion as expected.
The storm resulting in a water level rising in the interdike area over 0.2 m by overtopping has a return period of 120,000 years, a storm surge of 6.8 m + NAP and a significant wave height up to 2.1 m.As storms grow further in intensity, the outer layer of clay and sand above the old clay core are eroded, resulting in a sudden increase in overtopping and overflow in the interdike area.Conditions where overtopping is enhanced by wave impact erosion can be expected roughly once in a 1,000,000 years.As a result, coupling wave impact erosion with overtopping increased the probability of interdike water levels of 3 and 4 m + NAP (Fig. 7).Under conditions with an expected interdike water level above 5 m + NAP, overtopping appears very sensitive to tiny changes in storm conditions, such that even without erosion an increase in storm intensity is capable of filling up the interdike area to sea-level.The calculated probabilities for interdike water levels of 6 m + NAP and 7 m + NAP suggest the flooding probabilities for the coupled model remain generally higher than the model without wave impact erosion, although as the result at 5 m + NAP, shows, variance in the results of the FORM-IS procedure is too large to draw this conclusion.For a storm with an expected return period of approximately 2,300,000 years with a storm surge of 7.3 m + NAP and significant wave height of 2.5 m the dike can be assumed breached as the water level in the interdike area rises to sea Fig. 7.The probability of water levels in the interdike area due to overtopping alone (red) and the integrated erosion-overtopping model (green) with 95% confidence bands.The horizontal lines are drawn at the calculated exceedance probabilities for conventional overtopping limits of a single dike system of 0.1, 1, and 10 lm − 1 s − 1 .(For interpretation of the references to colour in this figure legend, the reader is referred to the Web version of this article.)

Table 4
The variation in water level when the culvert remains open during different events.LW = low water, HW = high water, HHW = highest high water during a storm event.As conditions with significant overtopping are likely to erode the dike crest in this case-study, flood protection is only marginally improved by the ability of the second dike to retain water up to its crest level.It can be argued that no safety is gained as the amount of stored overtopping water in these cases would not be sufficient to cause a water level rise of 20 cm in the hinterland of Groningen anyway.

Effect of the culvert
The water level behind the first dike with an open culvert under a variety of conditions is presented in Table 4.There is a trade-off between introducing a tide in the interdike area and exposing the second dike to high water levels during a storm due to the risk of failure of the culvert.With the smallest culvert (3.5 m wide) there is only 30 cm of tide during regular tides with a polder level at − 0.5 m + NAP.During an extreme storm, the small size of the culvert prevents a fast increase in water level of the interdike area in case of a non-closure.The water level in the interdike area will be a substantially reduced (approximately 0.8 m less) compared to the outside water level (the extreme sea level).With the widest culvert (12 m) there is substantially more exchange of the tide, but only about 5 cm of reduction in the water level in the event of a nonclosure.When accounting for the probability of non-closure, the water level exceedance probabilities are obtained as shown in Fig. 8.

Required height second dike
Without the second dike the failure probability would follow from the overtopping criteria used (see Fig. 7).With a second dike and no culvert, the probability of overflow of the second dike is the new failure criterion and it follows from the amount of water overtopped by the first dike.An additional 1 m high second dike decreases the overtopping failure of the system to 5.5E-6.However, further heightening yields diminishing returns as can be seen by the steep green curve from the overtopping failure in Figs.7 and 9. Heightening the second dike to 2 m + NAP, 4 m + NAP and 6 m + NAP yields only 1.51 × 10 − 6 , 9.22 × 10 − 7 , and 5.1 × 10 − 7 as the system failure probability respectively.Storm events causing overtopping are rare (Fig. 7) and are drawn from the very tails of the probability distributions (Table 2) making more severe storms become exponentially less likely.Thus, heightening of the first dike several decimeters in a double dike system with a tall first dike (type I) is far more effective in reducing the probability of a flood than heightening of the second dike.Still as mentioned in section 4.1, it can be argued that the stored volumes of overtopping would not yet constitute a flood for the hinterland according to the 0.2 m water depth criterion and thus no actual flood was prevented.
The frequency of water levels inside the interdike area from a dike or culvert failure are presented in Fig. 9.Because the probability of large overtopping volumes is already low, it is more likely the interdike area will be flooded due to a non-closure of the culvert.To meet the regional safety norm the dike section of the case-study cannot have an annual failure probability greater than 1/37,500 for overtopping and overflow.As a consequence the second dike should be higher than 3.12 m + NAP with a 3.5 m culvert, 3.5 m + NAP with a 6 m wide culvert, and 3.84 m + NAP with a 12 m wide culvert.

Reliability of the results
The application of the framework for the case-study required coupling different models of interactions between hydraulic loads and dike failures.The hydraulic loads were simplified from the distributions returned by Hydra-NL, the official tool used to determine hydraulic boundaries for Dutch flood defences.According to Oosterlo et al. (2018b) the SWAN wave model that is used to compute the wave heights in the hydraulic databases for Hydra-NL, predicts unusually high on-shore directed waves for the Ems-Dollard estuary and therefore requires validation of the complicated nature of wave refraction, wind-wave and wave-wave interactions in the estuary by measurements.Safety assessments are highly sensitive to the hydraulic boundary conditions (Vuik et al., 2018) and thus updating wave predictions can greatly affect the assessed safety.In the case-study of this paper, the risk from overtopping of the first dike could be smaller if the wave heights stored in the hydraulic database are overpredicted.
Next in the modelling chain are the interactions between the hydraulic loads and the dike itself.The applied models describing the process of wave erosion are empirical, and tuned with results from a limited number of flume experiments performed over a few decades (Klein Breteler et al., 2012b).Calibration of the formulas is limited by the tested experimental conditions, e.g.wave conditions, slope angle, and condition of the clay (Wolters et al., 2011;Klein Breteler et al., 2012b).While the formulas represent the most up-to date knowledge to describe the erosion process, they will be updated as more experiments are conducted.The EurOtop wave overtopping formulae have been derived similarly and have become standard models in the field as the number of experiments for callibration and verification has increased over the years (van der Meer et al., 2016).Within the context of this study, however, the uncertainty in erosion parameters did not influence the expected failure of the double dike system due to the dominant effect of the culvert.
The probability of non-closure of the culvert proved to be the most influential parameter in our case-study.This probability followed from guideline based estimations of the probabilities of subfailures by Dutch experts (e.g.failing to predict a storm in time, failure to initiate a closure, failure to mobilize a mechanic, etc.) (Casteleijn and Van Bree, 2017).Assuming strict policies on preparation, detection, and mobilization for a culvert with multiple closure-mechanisms in a rural area, the probability of non-closure per event was estimated to be 1.67 × 10 − 4 .The actual probability will of course be determined by the design of the culvert and its operation scheme.Still, considering strict policies on the prediction of closure-events, mobilization, and operation were already presumed, designing a system with a non-closure probability within the same order of magnitude as dike overtopping (10 − 5 -10 − 6 ) will pose an engineering challenge.

Applicability of the framework
The proposed framework in section 2.1 to assess double dike systems was applied to the system between Eemshaven and Delfzijl.The framework itself is based on the probabilistic dike assessment methods already described in literature and applied in practice (Bischiniotis et al., 2018;Schweckendiek et al., 2012;Slomp et al., 2016;CUR/TAW, 1990;Vorogushyn et al., 2010).As a result, the same data, probabilistic techniques, and failure criteria could be employed as in a regular dike assessment.However, the perspective of a dike transmitting hydraulic loads to another flood defence proved novel.
In the framework introduced in this study, a combination of dike erosion and water transmission models are needed to compute loads on the second dike.The coupling of wave erosion and overtopping by Kaste et al. (2015) is one of few methods in which erosion processes on the seaward side of the dike and flows over the dike are combined.More methods are being developed that combine other erosion processes with overtopping flows on the inner slope (van Bergeijk et al., 2019;Aguilar-López et al., 2018), but these are still limited to the upper grass and soil layer.Advances in geotechnical models will allow models to quantify the probability of a breach forming, rather than an initial sliding failure (Remmerswaal et al., 2018).Ideally, erosion of the dike by all failure mechanisms is calculated such that subsequent flows and waves can be evaluated.While such models are not yet available for most failure mechanisms, an integrated model of wave impact erosion combined with overtopping flows is already possible and this setup may serve as an example to integrate other failure mechanisms.

Comparison with other double dike systems
A direct comparison of the results from this case-study with other double dike systems is difficult, as flood risk and exposure varies greatly in different contexts.The case-study Eemshaven-Delfzijl represents only a small subset of possible double dike systems which 1) are adjacent to the coast, 2) have a higher first dike and lower second dike (type I in the classification of section 1.1), and 3) feature a culvert to accommodate a wetland, agriculture, and clay-mining simultaneously.The interpretation of the results from this study for general double dike systems is discussed below.
Studies so far have found only limited local flood protection benefits from inundating coastal interdike areas compared to benefits of such retention areas along rivers and within estuaries.Huguet et al. (2018) found for a case study in La Faute-sur-mer, France, that water-level reductions are achieved for areas further inside the estuary rather than along the coast.As noted by Hofstede (2019) based on managed realignment in Schleswig-Holstein, Germany, the opened coastal polders have no significance as flood retention areas and thus do not contribute to improving flood protection.If the total length of defences increases, flood protection is even diminished.In contrast, double dike systems along rivers and inside estuaries (in this context called Flood Retention Areas (FRAs), or buffer zones in other studies) remove water from a confined system and thus reduce the water level at the site as well as downstream, thereby reducing flood risk.Combined with the benefits of wetland restoration, such estuarine retention areas can be implemented as an eco-system based flood protection (Temmerman et al., 2013).Interventions from the Sigmaplan in Belgium, and Room for the River in the Netherlands for example, achieve flood risk reduction mainly from this principle.Additionally, coastal flood protection is subject to higher wave loads than in river settings.Consequently, wave-related failures were considered in this study while for river dikes other failure mechanisms related to a prolonged high water level and water pressure are more likely to be dominant (e.g.piping or macrostability).Flooding of the interdike area can reduce the water level in rivers and estuaries and thus reduce the probability of such failures for both defences in the double dike system.Wave action at the outer defence remains unaffected by flooding of the interdike area in a coastal setting, hence the risks of wave related failures is only reduced for the landward defence of the system.Thus, protection benefits of a double dike system are expected to be higher along rivers and within estuaries compared to the results of the case from study.
The first dike in the double dike of Eemshaven-Delfzijl is taller than the second dike and is an example of a type I system within the classification of double dike systems in section 1.1.The safety assessment changes with a low first dike and tall second dike (types II and III).For these types, flooding of the interdike area due to overflow of the low first dike will not risk overflowing the tall second dike.However, wave loads propagating over the low first dike towards the second dike when the interdike area is flooded can no longer be ignored.Within a type III system (a low first dike and high second dike) the first dike acts as a lowcrested breakwater, reducing the wave load on the second dike when the interdike area is flooded.The behaviour of these types of structures has already been extensively studied and can realize substantial wave height reductions (Mai et al., 1999;d'Angremond et al., 1997;Panizzo and Briganti, 2007).Because wave action inside the interdike area was insignificant for a type I system, the results do not generalise to type III systems.In river areas where wave loads are insignificant similar results for interdike loads as presented in Fig. 9 can still be expected from a type III system.In type IV and V systems (low embankment and breached first dike) the first dike cannot prevent a flood.Water is not retained by the first dike and only wave and water level attenuation effects can be expected in these systems.Rather than an erosion-overtopping model used in this study, a hydrodynamic wave and flow model is needed to assess the loads propagating towards the second dike in these systems (Kiesel et al., 2020).These examples show that the selection of models needed in the transmission step of the framework greatly depends on the type of system and its context.
The different uses of the interdike area may require a regulated exchange of water through the first dike and pose limits to the acceptable frequency of flooding in the interdike area.As the results show, the probability of flooding of the interdike area by storms in the case in Eemshaven-Delfzijl is small and therefore multifunctional-use criteria are hardly relevant.However, there is a trade-off between functions through the configuration of the culvert as designing the culvert for a greater tidal exchange to support multifunctional-use of the interdike zone will result in larger water levels (and thus flood risk) in case of a non-closure.Across different documented double dike projects, balancing uses proved to be a design challenge.At the nature restoration site polder Breebaart nearby our case-study, a tide of 27 cm was introduced in the polder through a small culvert in the first dike (Peletier et al., 2004).While a new marsh successfully developped, due to the high turbidity of the Ems-estuary, an average of 30 cm of sediment was deposited annually prompting an unexpectedly rapid succession of vegetation types and habitats (Peletier et al., 2004).As a result, 70,000 m 3 of sediment was eventually dredged in 2019 to restore the diversity of habitats within the marsh (H2O, 2019).Another double dike system where flood protection is combined with functions requiring a tidal exchange is in the dunes of Waterdunen, the Netherlands.The in-and outflow of the tide has to be regulated to allow enough tidal variation for nature development, recreation, and experimental saline agriculture, while preventing overflow of the inner ring dike (Stark et al., 2006).At the time of writing the project is exploring options for a sufficiently safe operation scheme of the culverts each tidal cycle, while meeting the new strict Dutch flood protection standards.The Controlled Reduced Tide (CRT) areas of the Belgian Sigmaplan in Kruibeke, Lippenbroek, and Bergenmeersen Belgium, are another example.The combination of several culverts preserves the dynamic tidal variation needed to support a marsh habitat similar to natural marshes outside the dike, while minimising sedimentation that reduces the water storage capacity of the area over time (Cox et al., 2006;Oosterlee et al., 2019).Nevertheless, the ability to reduce water levels in the Scheldt River by flooding the interdike area during a high-water event was a crucial factor in the design of the in/outlet structures (Smolders et al., 2020;Cox et al., 2006).Given the importance of culverts for both flood protection and multifunctional use, the limitations and synergies between functions imposed on a culvert design should be explored further in detail.

Values beside flood protection
As can be seen in the results of our case-study, double dikes are not necessarily safer than a single dike.Still, the long-term benefits and value generated by its multifunctionality are a strong driver to choose a double dike system over a simple reinforcement.As long as the additional costs of a second dike over a simple reinforcement are outweighed by the costs saved on reinforcing the first dike and the value generated over time in the interdike area, a double dike system is even economically preferable.Economic benefits include specialised saline agriculture, or clay extraction (Kwakernaak et al., 2015).Benefits in a double dike system do not have to be strictly monetary to be viable however.Nature restoration can be another driver for the implementation of such a system, as is the case for many managed realignment projects (Esteves and Esteves, 2014).Ecosystem service benefits like carbon sequestration, water purification, sediment accretion, as well as natural values, may outweigh the costs of realignment, or in this case a double dike system, after several decades (Turner et al., 2007;Luisetti et al., 2011).To summarise, double dike systems in the coastal zone are primarily implemented for the potential use of the inter-dike zone, e.g. for nature restoration, rather than as a pure flood protection measure.

Conclusions
Double dike systems have been constructed to manage and control water for different uses as well as providing flood protection for the hinterland.Despite the benefits of combining flood protection with other uses in a double dike system, it was still uncertain how much flood protection is provided by a second dike in the system.The double dike between Eemshaven and Delfzijl was analysed as a case-study to demonstrate a general method for assessing the safety of double dike systems.The probability of failure was assessed using an advanced dike erosion model of the seaward slope (Rongen et al., 2018) coupled with overtopping for 3 000 simulated storm events for the area.
The novel general framework for assessing double dike systems developed in this study is based on the same safety principles for flood protection assessment as current practises.However, the distinction and integration needed within the framework between dike failures describing erosion of the dike, and those describing the transfer of water over the dike proved novel and is not present in most failure criteria for dike assessments.This part could only be achieved by a specialised erosion-overtopping model that is still being developed at the time of writing.For the framework to be implemented for other types of failures, integrated models describing both erosion of the dike and the transfer of water during the process of dike failure are needed.
According to the model results, the taller front dike in the case-study area is already unlikely to be overtopped by large volumes of water.Wave conditions during high overtopping events are also likely to erode the dike and rapidly fill the interdike area.Because of its low crest height, the second dike overflows in this scenario and does not reduce the probability of flooding, although it may delay the onset of flooding of the hinterland.Instead of overtopping or breaching of the front dike, water depths up to about 4 m between the dikes are far more likely to be reached from a non-closure of the culvert that connects the inner area with the sea.Thus, the second dike is required to reduce the risks related to the culvert rather than any dike failure.No (significant) reduction in flood risk can be expected from coastal double dike systems in general when the first seaward dike is taller than the second landward dike.The flood risk reduction in other types of double dike systems depends on potential water-level reductions in estuarine or riverine settings as well as the different dominant failure mechanisms.Further research into the safety of double dikes in these environments is needed to further validate the framework developed in this study.
An interesting trade-off between flood protection and tide within the interdike area was found.As the culvert width increases, a greater tidal variation can be realized between the dikes to support a functioning tidal ecosystem and clay-mining.However, in the event of a non-closure more water will flood the area between the dikes, thus requiring a higher second dike to prevent flooding.Similar trade-offs between functions through the design of the culverts were found inother double dike projects.
Results of this study show there is not necessarily a substantial flood risk reduction by implementing a double dike system over a single dike system.The value of these systems lies mostly in the integration of other functions, e.g.saline agriculture or nature restoration, rather than as the simplest improvement for flood protection.The framework of this study gives engineers and designers a tool to expand the number of uses around flood protection in a double dike system, while ensuring flood protection safety norms are met.3s  The general formula for the discharge can be written as: For the full discharge formulas with the calculation of the flow contraction coefficient see Deltares (2020) (p. 301 to 303).

Appendix D. Wave erosion and overtopping formulas
This section only describes the main components of the prototype dike erosion model that was used for the study.The full documentation of the model and the integration between failures is described by Kaste and Klein Breteler (Kaste and Klein Breteler, 2015) and Rongen et al. (2018).The values of all parameters used within this study are presented in the supplement.

D.1. Erosion of the grass revetment
The grass can fail by wave-run and wave impacts in the impact zone.The run-up part is calculated with the method by de Waal and van Hoven (de Waal and van Hoven, 2015b).For the duration of the storm, the expected number of waves with a run-up velocity greater than the resistance of the grass (U max > U c ) is calculated across the slope of the dike weighted into a damage number (D).When the critical amount of damage (D c ) is computed the grass layer is considered failed and the layer beneath it is subjected to wave loads.This process is described by the equations: where α M and α S are calibration constants for discontinuities on the dike slope (assumed to be 1 for the case-study), z 2% is the 2% wave run-up, c u is a constant (1.1), and p is the probability of a wave.Failure of the grass is assumed when D > D c , at7000 m 2 s -2 (de Waal and van Hoven, 2015b).The failure from wave impact is calculated with the method of de Waal and van Hoven (de Waal and van Hoven, 2015a).Failure of the grass by wave impact is calculated with wave impact resistance curves described by the equation: When during a storm the critical duration for wave loads (t damage ) at a section of the revetment is exceeded, that grass section is considered damaged and the root zone beneath can erode.Erosion of the root zone below is calculated in a similar way: To combine damage by run-up and impact after time step j with a duration t, the failure fractions for both mechanisms per vertical dike segment are added and failure is defined as:

D.2 Erosion of clay
The erosion rate of the clay layers inside the dike when subjected to waves is calculated with the formula by Mourik (2015): When clay is eroded from the profile, a cliff (slope 1:1) is formed around the water level and a terrace (slope 1:8) is formed below the water line.

D.3 Erosion of sand
The erosion of sand is computed with the model by Klein Breteler et al. (Klein Breteler et al., 2012b): ∂V e ∂t ) 2 ) ) D.8 here, B t is the terrace width of the eroded profile.The erosion profile again consists of a steep cliff (slope 1:1) and a shallow terrace (slope 1:8) around the water line.
A small change was made to the model to better represent the erosion around the sand and clay around clay core of the dike in the case-study of this paper.Originally, the equation of the weakest material in the wave impact zone was used to calculate the erosion volume per time step (Rongen et al., 2018;Kaste and Klein Breteler, 2015).This caused an unrealistically high erosion rate of the clay core when the top of the wave impact zone happened to extend just above the core into the sand above.An additional requirement was implemented that equation D.8 is used only if at least 25% of the material in the impact zone is sand.

D.4 Erosion of other materials
The erosion of other materials like stone is not implemented yet.Instead, it is simply assumed these sections will not fail when exposed to wave impacts.The revetment will still fail, however, by erosion propagating from a section directly above or below the revetment as the revetment is literally being undermined.

D.5 Overtopping
After erosion of the dike profile has been accounted for, overtopping is calculated with the EurOtop formulas (van der Meer et al., 2016):

Fig. 2 .
Fig. 2. The location of the Double Dike between Eemshaven and Delfzijl within the Ems estuary.Sections A, B, C are the different zones planned for different functions, each connected by culverts to the sea.Base map adapted from OpenStreetMaps

Fig. 3 .
Fig. 3.A cross-section of the front dike between Eemshaven and Delfzijl.

Table 2
Simplified distributions of maximum annual hydraulic conditions at the case-study site.*Note: NAP is the local vertical datum.** Note: the probabilities of extreme values presented belong to the marginal distribution of the variable.

Table 3
Parameters for calculating flow through the culvert.

Table C .1
The different flow regimes through a culvert with associated conditions