A cascading risk model for the failure of the concrete spillway of the Toddbrook dam, England during the August 2019 flooding

Dam break is considered as a major catastrophe with significant negative economic, social, and environmental consequences, and thus must be prevented at any cost. Here, we report and analyze a near-miss dam break incident in Toddbrook dam, England during the August 2019 flooding, where the spillway of the dam failed putting the entire dam at the risk of failure. A combination of field surveys, desk studies and numerical modelling is applied to analyze the incident and to develop a cascading risk model for the first time. Our hydraulic modelling showed that the spillway was under fast-flowing water having a speed of up to 15.0 m/s. Such a high- speed flow played a major role in the failure of the spillway through facilitating water injection beneath the spillway slabs. The spillway suffered from poor maintenance and was densely vegetated, which most likely undermined the foundation. The spillway was poorly designed as the concrete slabs were relatively thin and unreinforced, the profile of the spillway was not fit for purpose, and the spillway lacked a stilling basin. Due to rapid drawdown, a landslide was generated on the upstream slope of the dam, which was reconstructed through our geotechnical modelling, indicating that a slower pace must have been taken during the process of emptying the reservoir. We developed a cascading risk model which begins with three primary causes of insufficient maintenance, design shortcomings, and the torrential rainfall leading to flooding. Our risk model, which is among the first of its type, would help preventing future dam failures


Introduction
Dams are among the oldest structures that have been built since thousands of years ago for different purposes such as supplying water for domestic and non-domestic uses, controlling floods, hydropower generation, supplying water for navigation through waterways, and recreation. These mega infrastructures, that hold back millions to billions of meter-cubed of water in their reservoirs, require continuous monitoring and maintenance to prevent them from potential failures and consequent catastrophes (e.g., Refs. [1,2]). A dam break can be both highly costly and deadly as the large and fast-moving currents, generated by the release of the reservoir water, can wash away communities at the downstream. For instance, the Malpasset Dam Break (France) in 1959, which was a concrete dam with a height of 66.5 m and a reservoir volume of 55 million m 3 , caused flooding with wave heights of up to 40 m and killed 421 people [3]. An example of the failure of an earth dam is the Machchu-2 dam break in India in 1979 whose death toll was reported to be as high as 25,000 [4,5].
Dam failures can occur due to several reasons including overtopping from excessive flooding, technical problems in different dam elements (such as spillways, foundation, slopes), poor management, and natural disasters such as earthquakes (e.g., Refs. [6][7][8][9][10][11][12][13]). By analyzing data from historical dam failures, it is established that majority of dam failure incidents belong to earth-fill dams (e.g., Refs. [9,13]). Among various factors contributing to dam failures, an important reason has been the failure of spillways, which can occur due to several reasons including insufficient spillway capacity, blockage of spillways by flood debris, and technical failures of spillway structure such as water injection below the spillway slabs and consequent erosion and scouring (e.g., Refs. [6,14,15]). The Toddbrook earth-fill dam, England, Fig. 1, was on the brink of failure in 1-3 August 2019 following the failure of the dam's auxiliary spillway (spillway-2 in Fig. 1a, b, d) while the reservoir was at the maximum water level due to torrential rainfall and flooding in the area. As seen in Fig. 1b,d, part of the left side of the concrete spillway was washed away by the water flow. The dam eventually survived, and the overtopping of the embankment was prevented through rapidly decreasing the reservoir water level by hiring multiple powerful pumps. Fig. 1d shows that tens of aggregate bags were employed during the incident and were placed on the damaged part of the spillway in order to prevent progressive erosion of the dam body. The aggregate bags were placed on the spillway Fig. 1. Location of the Toddbrook dam in the UK and its dam body and two spillways. The damaged part of the spillway is shown in panels "b" and "d". The yellow aggregate bags, shown in panel "d", were placed at the damaged part of the spillway to stop the spread of the damage as a temporary measure. Photos in "b", "c" and "d" are taken during our field survey in August 2019 while panel "a" is from Google-Earth (https://earth.google.com). The pink box in panel "b" is enlarged in panel "d".
using a helicopter [16,17]. Several authors have studied the incident including Heidarzadeh [18]; Balmforth [16]; Hughes [17]; Mason [19]; Mehta et al. [20]; Allman et al. [21]; and Lewis et al. [22]. This incident was a wake-up call for the safety of dam and reservoir infrastructure in the UK, which highlighted the urgency for reassessment of the structural integrity of these aged infrastructures [18].
Aiming at developing a risk model for the failure of the Toddbrook dam spillway and to prevent future incidents, here we analyze the failure of the spillway through a combination of field surveys, desk studies, and numerical modelling. A one-day field survey was conducted in the dam and reservoir area 10 days after the incident (on August 12, 2019) to observe the situation and to record the impacts of the incident. Here, we report the results of the field survey along with our hydraulic and geotechnical modelling as well as analysis of satellite images to explain the primary causes of this incident. A novel risk model is proposed for the failure of the Toddbrook dam's spillway by benefiting from the concept of cascading risks [23][24][25][26][27][28]. Such a risk model would be an important tool for planning maintenance works for dam and reservoir infrastructure and preventing potential similar incidents in the future.

The Toddbrook dam structure, and its spillways
The Toddbrook dam is a zoned earth-fill dam with a clay core acting as its water sealing element (Fig. 2). The height of the dam is approximately 24 m, its crest length is 310 m, the reservoir capacity is 1.29 million m 3 , and the slope of the upper part of its embankment is 2 (horizontal):1 (vertical) [16]. The dam construction was completed in 1840 and its purpose was to supply water to a nearby navigation canal [17]. The dam was originally equipped with a side channel as its spillway, which is called spillway-1 throughout this report (Fig. 3). These types of spillways usually have limited discharge capacities and are susceptible to blockage by flood debris as they are located at a side of the dam and are usually narrow. Therefore, it was concluded that the original spillway does not have enough capacity and a new spillway, called as spillway-2 hereafter (Fig. 3), was built in 1970. The new spillway is of chute type with an entrance width of 76 m that extends from the dam crest to the downstream channel connected to spillway-1 (Fig. 3) and with 15-cm thick concrete slabs [17]. The crest elevation of spillway-2 is 1.4 m below the dam crest elevation. With the combined discharge capacities from the two spillways, it is expected that the dam has been provided with sufficient protection during severe flooding in the area.

Discharge capacity of the spillway-2 and the flow velocity distribution
The main risk factor for the safety of spillways is the high flow velocity developed on their surfaces as spillways release large water volumes during floods. High water velocities could lead to damage to the concrete surface of spillways through injection of water into the cracks or construction control joints (CCJ) and by cavitation forces due to objects and obstacles along flow paths. Normally, the concrete surfaces of spillways are maintained very well through ensuring that they are crack free, obstacle free, and the CCJs are filled with appropriate elastic materials. These efforts would help to prevent water injection into the joints and cracks and to protect the structure against damaging forces from cavitation.
The first step towards protection and maintenance of a spillway is to calculate the discharge rate and flow velocities on the spillway surface under various flow scenarios. The flow discharge over a spillway depends on the reservoir water level and the height of water above the crest level of the spillway (H in Fig. 4) and the discharge coefficient of the spillway (C d ). Here, we apply the following equation for calculating the discharge rate [29]: where, Q is discharge in m 3 /s, C d is discharge coefficient, which is assumed to be in the range of 0.5-0.7 in this study, g (= 9.81 m/s 2 ) is This section is produced based on a sketch published by Balmforth [16]. "Elev." is the abbreviated form of elevation. "masl" stands for meters above sea level.
gravitational acceleration, b is spillway width (b = 76 m), and H is water elevation difference between water surface in the reservoir and the crest elevation of the spillway (Fig. 4). The result of discharge calculations is shown in Fig. 4 [17]. We note that Eq. (1) results in a discharge rate of 177.0 m 3 /s for H = 1.2 m; therefore, we assume a PMF of Q PMF = 177.0 m 3 /s in this study, which is slightly higher than the PMF reported by Hughes [17]. We calculate the distribution of flow velocity over the spillway-2 for the case of PMF (Q PMF = 177.0 m 3 /s) and another discharge

The causes of the failure of the spillway
The causes of the failure of spillway-2 were previously discussed by Heidarzadeh [18]; Balmforth [16]; and Hughes [17]. In this study, our analysis shows that three factors played roles in the failure of the Toddbrook dam's spillway-2, which are: insufficient maintenance, design shortcomings and the torrential rainfall. We call these three factors as primary causes. Each of these primary causes cascaded to a series of secondary causes, which are discussed in the following sections. A combination of these primary and secondary causes resulted in the failure of spillway-2. It is known that the cascading mechanisms of hazards and their interactions play important roles in creating catastrophic events [23][24][25]31,32]. Therefore, such cascading mechanisms and hazard interactions are needed to be discovered. In the following, each of the contributing factors to the Toddbrook dam incident and their cascading effects are discussed in detail.

Insufficient maintenance
The basic and essential design consideration for chute-type spillways (such as spillway-2 of the Toddbrook dam) is that the concrete surface must be smooth, crack free and obstacle free in order to prevent potential damage due to cavitation or water injection beneath the slabs. Sometimes large concrete blocks, known as chute or baffle blocks, are placed on the surface of spillways or at the downstream part of spillways within the stilling basins to reduce the speed of the flow and to help decreasing the length of the stilling basins [33]. However, installation of chute and baffle blocks is subject to special design procedures regarding their dimensions, weights, and spacings. The baffle blocks are usually very large, of the height and width of at least a meter or larger [33,34].
Analysis of photos and videos from the Toddbrook dam incident reveals that the concrete surface of the spillway-2 was in a poor condition at the time of the incident. Dense vegetation including a few trees were present on the surface of spillway-2 when high-speed flow was passing over it during the incident (Fig. 6a). It is noted that at least three trees, one of them approximately 1.7 m tall, are seen at the damaged part of the spillway during the incident. A review of satellite images of spillway-2 over the period of 1999-2020 (Fig. 7) reveals that the spillway surface was cleaned up of vegetations and trees from time to time. For example, the surface appears to be in a good condition in December 1999 (Fig. 7f) and December 2005 (Fig. 7b), but it is covered with vegetation and trees in other times (Fig. 7b,c,e). It is most likely that the foundation of spillway-2 has been seriously undermined due to the extensive growth of vegetation and trees over years; therefore, the concrete slabs were not resting on a solid foundation. As a result, any water injection beneath the slabs could lead to erosion of the foundation and settlements of the slabs (Fig. 8). In addition, the concrete surface of spillway-2 is embedded with numerous rock pieces (Fig. 6b) at certain intervals whose dimensions are approximately 22 cm (length) × 22 cm (width) × 22 cm (height) [16][17][18] and some of them were removed before or during the incident. It is not clear as why such rock pieces are placed on the spillway surface, but certainly they cannot yield the hydraulic performance of chute blocks due to their small sizes and poor connection to the main slabs. Rather, these small rock pieces could cause cavitation and damaging forces on the main slabs during the passage of high-velocity flows. In addition, removal of some of these rock pieces could lead to increased water injections beneath he slabs [16][17][18].

Dam design shortcomings
The design and construction of spillway-2 occurred more than half a century ago (in 1970), when the existing standards and guidelines were not as established as they are today. Our analysis reveals that the design of spillway-2 is associated with some shortcomings. Modern spillways are made of thick concrete slabs (a thickness of up to a meter or more) as they are subject to high water velocities (up to 40 m/s for large dams) and negative pressures and forces from cavitation. To minimize the risks of destructive cavitation forces, the profile of spillways is generally made of a multi-slope shape starting with an ogee profile, followed by a combination of mild and steep slopes depending on the specific circumstances of each project. Furthermore, modern spillways are usually equipped with a stilling basin at the foot of the spillway [33]. It is noted that there is no typical design for spillways, and it may change from one project to another depending on the specifications of each project. The shape of a spillway profile is subject to various design procedures, which includes numerical and physical modelling, to ensure that the structure can discharge the flood water safely without sustaining damage.
For the case of the Toddbrook dam, our modelling revealed that spillway-2 experiences a maximum flow velocity of approximately 15.0 m/s at the PMF (Fig. 5). The spillway-2 is made of 15-cm thick concrete slabs, which are not reinforced with rebars. Such relatively thin slabs appear to be insufficient; in particular, as they are not reinforced as well. Another potential shortcoming is the profile of the spillway itself. It appears that the profile of the spillway follows that of the downstream slope of the embankment rather than being specifically designed for water flow with large volumetric rates and high speeds. On top of these shortcomings, the spillway lacks any stilling basin (Fig. 7b); as a result, severe scouring was observed at the toe of the spillway during the August 2019 incident. We acknowledge that the design and construction of spillway-2 was limited by the slope and shape of the dam body, but this does not justify the design of a spillway that is not fit for purpose. It is because of such restrictions that most of the spillways are moved to dam abutments, which offer adequate space for the construction of a properly-designed structure.

Torrential rainfall
It is clear that the previous two factors (i.e., insufficient maintenance and design shortcomings) would not come to light given there was no torrential rainfall and flooding in the area. The flooding resulted in the filling of the reservoir to its maximum capacity and consequently in discharge of the excessive water through spillway-1 and later through spillway-2. Although such discharge of flood water through spillway-2 must have been a regular and routine process, it led to the failure of spillway-2 due to its insufficient maintenance and design shortcomings.

A cascading risk model for the causes of the damage
We note that any water injection beneath the spillway slabs may not necessarily lead to scouring and slab settlements because such water injections appear to be inevitable, at least at part of spillways during high-speed flows. In fact, the damage or failure of spillways occurs when water injection is combined with an undermined foundation as well as under-designed concrete slabs.
In summary, we attribute the failure of the Toddbrook dam spillway to a combination of three primary factors comprising insufficient maintenance, design shortcomings and the torrential rainfall (Fig. 9). Each of these factors interacted with each other and cascaded to other causes to produce the failure of the spillway (Fig. 9). The construction joints and cracks, generated by vegetation and tree growth, largely facilitated water injection beneath the spillway slabs. In addition, the foundation was significantly undermined  over years by extensive vegetation and the concrete slabs were relatively thin and under-designed (only 15 cm thick and unreinforced). It is hard to exactly determine the contribution of each factor in creating the failure, but it is very likely that the failure was the outcome of a combination and cascade of different factors (Fig. 9).

Rapid drawdown and landslides
As a response to the failure of spillway-2, a rapid drawdown of the Toddbrook reservoir was conducted during the August 2019 incident as authorities rushed to empty the reservoir by employing multiple powerful pumps (Table 1, Fig. 10b). According to Table 1, the reservoir water level was dropped more than 9.0 m, and the reservoir water volume was decreased to 17% of its maximum volume in six days. As a result of such a rapid drawdown, several minor landslides occurred; the most critical landslide occurred on the upstream slope of the embankment, which has a height of approximately 7.0 m (Fig. 10a). Other landslides occurred on the reservoir banks (Fig. 10b). These landslides are evidence that the process of decreasing reservoir water level occurred at a high speed, which posed a risk for the safety of the dam. Although the landslides are minor and they did not create major risks, larger movements of the landslide on the downstream slope of the dam could result in a major damage. In addition, large landslides on the banks of the reservoir can generate large waves in the reservoir, which could overtop the dam.
However, it is hard to criticize the dam authorities for this rapid drawdown as otherwise the entire dam could fail due to the pressure of a full reservoir, which itself could flood the entire downstream town (i.e., Whaley Bridge) with potential large deaths and loss of properties. Apparently, it was a difficult choice between accepting the risks of a rapid drawdown and saving the lives and properties of downstream people. At least, it can be said that the process of emptying the reservoir could be done in a safer pace, and through following the existing industry best practices including monitoring the dam and reservoir banks during the process. As per industry best practices, before starting the drawdown, normally the rapid drawdown process is modeled at different paces and a safe pace with an acceptable factor of safety is implemented using which the risks of failure or damage are minimised. Apparently dam authorities did not have enough time to conduct such analyses.
To develop a better understanding of risk posed by rapid drawdown, here we model the situation using a modelling package called PLAXIS (Plane strain and axial symmetry; [35], which is widely used in Geotechnical Engineering (https://www.bentley.com/en). PLAXIS is based on Finite Element Method with an implicit numerical scheme. For our modelling, we use a 2D section of the dam body with fine meshing having approximately 44,000 nodes (Fig. 11). In order to find an optimum mesh size for modelling the dam, a few sensitivity analyses were carried out prior to the main analyses. Such sensitivity analyses resulted in a computational mesh with varying grid sizes at different parts of the dam. The mesh sizes are in the range of 0.2-5.0 m with an average element size of 1.7 m (Fig. 11). Soil properties for different layers of the dam (Fig. 2) are presented in Table 2. It is noted that the material properties in Table 2 are based on our geotechnical engineering judgments as there are no available documents for the dam's soil properties. The water is modeled at the level 186.0 masl based on the observations of the dam's water level before the incident. Fig. 12 shows the results of dam stability analysis under the raid drawdown situation. In case of rapid drawdown from water level of 186.0 masl to a water level of 176.0 masl, the failure mechanics is observed at the upstream side of the dam and many local failures and holes are generated resulting in a safety factor of marginally below 1.0 (Fig. 12). At the water level of 176.0 masl, however the factor of safety of the entire dam is above 1.0 indicating that the failure of the entire dam is not likely, but parts of the upstream slope of the dam are damaged (Fig. 12). This means that the dam operator will need to introduce measures to repair the damaged surfaces. The results of our PLAXIS modelling of the rapid drawdown are consistent with field observations of the dam site following the incident, which identified a landslide on the upstream side of the dam (Fig. 10a).

General stability of the embankment
A major concern during the August 2019 incident was the stability of the dam itself. As the reservoir was near the maximum water level and considering that the dam was approximately 180 years old at the time of the incident, there were concerns about the overall safety of the embankment. Here, we use the PLAXIS modelling package to study the safety factor of the dam under a full reservoir (water level of 186.0 masl). Fig. 13 shows the results of the overall dam stability when the water level is at 186.0 masl. Results indicate that, at such a high water level (i.e., 186 masl), the water pressure makes the upstream slope of the dam more stable; therefore, the probability of occurring a failure at the upstream side of dam is low as long as overtopping of the embankment does not occur. It is needless to say that, in case of overtopping, the entire dam could be washed away in a few hours as soil embankments are very vulnerable to flowing water. Analysis shows that the factor of safety at this water level (i.e., 186.0 masl) is marginally above 1.0 and the main failure surface occurs at the downstream side of the dam (Fig. 13).

Conclusions
We analyzed the failure of the auxiliary spillway (named as spillway-2 in this study) of the Toddbrook dam during the August 2019 flooding and developed a novel cascading risk model, which explains this failure. Our study was based on a combination of field surveys, desk studies and numerical modelling. Main findings are:    • We calculated a maximum flow velocity of approximately 15.0 m/s over the surface of spillway-2. Such a high-velocity flow played a major role in the failure of spillway-2 through facilitating water injection beneath the spillway slabs and cavitation forces. • Our analysis showed that spillway-2 was in a poor condition at the time of the incident as dense vegetation and tree growth were present on the spillway surface during the incident. These extensive vegetation and tree growth over years have most likely undermined the foundation of the spillway. • We observed design shortcomings for spillway-2: the concrete slabs were relatively thin and were not reinforced, the profile of the spillway was not fit for purpose, and the spillway lacks a stilling basin. • We identified the primary causes of spillway-2 failure as: insufficient maintenance, design shortcomings and the torrential rainfall.
These primary causes cascaded to other causes and resulted in the failure of the spillway through their interactions and combinations. • As the three primary causes of the failure are interconnected, it is not possible to state whether the failure could be prevented given the spillway had a better maintenance because the spillway was also under-designed. However, we may conclude that dam spillways must be designed properly and be maintained adequately and regularly to ensure such failures are prevented. • We observed a landslide on the upstream slope of the dam as a result of the rapid drawdown, which was reconstructed through our geotechnical modelling. This implies that a slower pace must have been taken during the process of emptying the reservoir.

Declaration of competing interest
The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper.

Data availability
Data will be made available on request.