Managing accidents and failures of hydraulic structures

While the prior objective of hydraulic structures is to remain in service, engineers must also be capable to adequately handle their failures. This paper gives guidance on this issue based on the European (mainly Dutch) and American practice. The discussion begins with terminology agreements on “accident” and “calamity”, followed by the notes on risk analysis and life safety risks in particular. Identifying and reducing such risks is an issue of much broader scope than structural analysis. Once an accident happens, proper investigations, handling the losses and planning the repair become major goals. The paper discusses the choice between repair and replacement of a gate, illustrated by examples from the USA and the Netherlands The discussion has an engineering rather than statistical character. The authors believe that accidents are events of infrequent nature and very diverse consequences, difficult to capture in databases. The dominant criterion in the design of movable hydraulic structures, such as gates of navigation locks, river weirs, closures of shipyard docks and hydroelectric plant reservoirs, is their strength and shape stability under hydraulic loads. This is correctly the designers’ main concern, but it should not result in losing sight of other reasons for which structures can fail. Neither it should result in engineers’ helplessness when failures actually occur. Structures, the operation of which involves motion, like hydraulic gates, cranes or movable bridges, are particularly exposed to many failure scenarios. This paper focuses on handling the failures of hydraulic gates. 1 Context and categories of failures While this paper is primarily concerned with technology, it is good to keep in mind that handling accidents and calamities comprises more than only technical repair of the failed hydraulic structure. As noted in [1], other urgent actions include globally: − Preventing failures and damages of related other structures, − Rescuing endangered individuals and property, − Informing stakeholders and parties involved (e.g. navigation), − Restoring (as far as possible) control of water flows, * Corresponding author: r.a.daniel@xs4all.nl , 0 (2019) https://doi.org/10.1051/matecconf /201928 MATEC Web of Conferences 284 4 ICSF 2019 08003 0 80 3 © The Authors, published by EDP Sciences. This is an open access article distributed under the terms of the Creative Commons Attribution License 4.0 (http://creativecommons.org/licenses/by/4.0/). − Documenting the event, collecting all relevant evidence, − Investigations, choice of repair method, planning etc., − Temporary measures and regulations prior to actual repair. More details about these actions, along with many examples of handling accidents and calamities on hydraulic structures, can be found in the recent book [2] by the authors of this paper. Significant for the current discussion is that the engineering actions in response to large structural failures are carried out under very different conditions and in different time schedules than those in “regular” projects. In order to introduce some systematic approach to these actions, one should differentiate between accidents and calamities. Both terms refer to undesirable, so-called “upset events”, but not every accident involving hydraulic structure is a calamity. Merriam Webster defines a calamity as a disastrous event marked by great loss and lasting distress and suffering. In this view, e.g., any accident or failure that involves life safety issues should be categorized as a calamity. On the other hand, the differentiation between both terms also depends on the perspective. A lock gate failure that takes the lock out of service for a few hours is normally not considered a calamity. A ship running into a lock gate and causing damage that disables the navigation for weeks or months may, to the contrary, be classified as a calamity. This is, anyway, the perspective of a waterway administration. The perspective of a shipping company may be different. The IJmuiden Lock accident of 2004 shown in Fig. 1 did not cause much damage to the lock or its gates, but the loss for the barge owner was significant. The lock was also shut down for navigation for a long time in order to investigate the damage, remove the wreck and clean the chamber [3]. Fig. 1. Accident with a sunk vessel in IJmuiden Locks, the Netherlands, photo Rijkswaterstaat. Obviously, the categorizing of accidents is relevant not only for communication clarity or statistics. Identifying an upset event as “routine” accident or calamity triggers different procedures, investigations, contracting rules and financing of the repair. In the Netherlands, for example, accidents are handled and fully resolved within annual maintenance budgets of Rijkswaterstaat Regions, the local waterway administrations. Calamities, however, entitle those administrations to claim repair funds from the country’s national budget. In the United States, the rules are similar with, additionally, the differentiation for the financing from state budgets or the federal budget. The difference between the damage categorized as a calamity and the one categorized as “routine” accident is illustrated in Fig. 2. To eliminate the correction for perspective, both , 0 (2019) https://doi.org/10.1051/matecconf /201928 MATEC Web of Conferences 284 4 ICSF 2019 08003 0 80 3

− Documenting the event, collecting all relevant evidence, − Investigations, choice of repair method, planning etc., − Temporary measures and regulations prior to actual repair. More details about these actions, along with many examples of handling accidents and calamities on hydraulic structures, can be found in the recent book [2] by the authors of this paper. Significant for the current discussion is that the engineering actions in response to large structural failures are carried out under very different conditions and in different time schedules than those in "regular" projects.
In order to introduce some systematic approach to these actions, one should differentiate between accidents and calamities. Both terms refer to undesirable, so-called "upset events", but not every accident involving hydraulic structure is a calamity. Merriam Webster defines a calamity as a disastrous event marked by great loss and lasting distress and suffering. In this view, e.g., any accident or failure that involves life safety issues should be categorized as a calamity. On the other hand, the differentiation between both terms also depends on the perspective. A lock gate failure that takes the lock out of service for a few hours is normally not considered a calamity. A ship running into a lock gate and causing damage that disables the navigation for weeks or months may, to the contrary, be classified as a calamity. This is, anyway, the perspective of a waterway administration.
The perspective of a shipping company may be different. The IJmuiden Lock accident of 2004 shown in Fig. 1 did not cause much damage to the lock or its gates, but the loss for the barge owner was significant. The lock was also shut down for navigation for a long time in order to investigate the damage, remove the wreck and clean the chamber [3]. Obviously, the categorizing of accidents is relevant not only for communication clarity or statistics. Identifying an upset event as "routine" accident or calamity triggers different procedures, investigations, contracting rules and financing of the repair. In the Netherlands, for example, accidents are handled and fully resolved within annual maintenance budgets of Rijkswaterstaat Regions, the local waterway administrations. Calamities, however, entitle those administrations to claim repair funds from the country's national budget. In the United States, the rules are similar with, additionally, the differentiation for the financing from state budgets or the federal budget.
The difference between the damage categorized as a calamity and the one categorized as "routine" accident is illustrated in Fig. 2 cases refer to lock and dam sites in the USA. Below is a short description of the events that caused these damages [1]. The barges in photo (a) broke free and jammed the gates of the Maxwell Dam on the Monongahela River, USA, on Nov. 5 th , 1985. The accident happened during a flood event, halting the shipping for six weeks needed to remove the barges and repair the dam [4]. Businesses were losing $500,000 each day, because no coal could be shipped on a river dotted with coke plants, steel mills and coal-burning power plants. 5 coal mines were shut and 1,500 miners laid off. This upset event can undoubtedly be classified as a calamity. In was also handled as such by the USACE and US Government, making part of an official hearing by the Congress Committee of Public Works and Transportation [5].
The miter gate leaf in photo (b) was removed from Lock 5a on the Mississippi River, about 100 km south-east of Minneapolis. On May 16 th , 2013, under high flows, a push-tow barge impacted that gate while in recess. The collision caused damage to the gate but the pool was not lost. There is no second lock chamber at this site, so an extended shutdown would have halted the navigation on the entire Upper Mississippi River. Fortunately, a spare gate was available and could quickly be installed. In a week, the waterway reopened to navigation. The event was considered an accident, requiring no investigation board.
The U.S. Army Corps of Engineers (USACE), steward of the waterborne infrastructure in the USA, distinguishes the four following classes of accidents [2], [6]: − Class A Accident: An accident in which the resulting total cost of USACE property damage is $2,000,000 or more; an injury that results in a fatality or permanent total disability to USACE civilian personnel or contractor personnel. Class A accidents are recordable and require a preliminary accident notification, a report of serious accident, an accident investigation report, and a Board of Investigation, − Class B Accident: An accident in which the resulting total cost of USACE property damage is $500,000 or more, but less than $2,000,000; an injury that results in permanent partial disability to USACE civilian personnel or contractor personnel, or when three or more personnel are hospitalized as inpatients as the result of a single occurrence. Class B accidents are recordable and require a preliminary accident notification, a report of serious accident, an accident investigation report, and a Board of Investigation, − Class C Accident: An accident in which the resulting total cost of property damage is $50,000 or more, but less than $500,000; a nonfatal injury that causes one or more days away from work or training beyond the day or shift on which it occurred. Class C accidents are recordable and require a preliminary accident notification and an accident investigation report, − Class D Accident: An accident in which the resulting total cost of property damage is $2,000 or more, but less than $50,000; Class D accidents are recordable and require a preliminary accident notification and an accident investigation report.

Investigations of accidents
It needs no argument that all accidents to hydraulic structures should be investigated and evaluated. Such investigations are initiated and performed at different levels, depending on the severity of an accident. The classification above mentions in this context investigation reports and Boards of Investigation. The first are required for accidents of all classes; the latter for accidents of Class A or B. The USACE Boards of Investigation (BOIs) perform indepth inquiries and analyses of the events before, during, and directly after an accident, determining its causes and contributing factors. BOIs are not supposed to assign blame or determine punitive actions. As follows from the classification above, BOIs are convened when one of the following occurs: − fatal injury (loss of life) to a person, − permanent total disability, − permanent partial disability, − hospitalization of three or more people, − USACE property damage of $500,000 or more. Below are some key instructions to follow for the USACE personnel, members of either internal investigation teams or Boards of Investigation [2], [6]: − Investigation needs to be initiated in a timely manner, preferably within 1 or 2 days after accident. The longer this takes, the more likely it is that details will be forgotten and the evidence material removed, − Investigation needs to be impartial, − Ensure that only knowledgeable and experienced personnel conduct the investigation and are members of investigation team, − Ensure that all reports are completed in a timely manner, preferably within 30 days after accident, − Determine who caused the accident, what caused the accident, why did the accident happen, where did it happen and how it could have been prevented, − Describe all circumstances in detail in regard to the accident or failure. Was there high water? What time of day was it? What time of year was it? What was the temperature? Was it raining, storming etc.? − Provide details, lessons learned and steps to prevent similar accidents or failures from happening again. In the Netherlands, investigations of serious accidents or failures of hydraulic gates are initiated and coordinated by regional crisis teams, following Regional Crisis Plans (RCPs). The members of crisis teams represent diverse organizations responsible for regional safety, with Rijkswaterstaat as the main actor. Rijkswaterstaat also has an internal network of crisis teams. However, since the dismantlement of in-house expertise in the first decade of the 21 st century, this is basically a network of managers. All in-depth investigations need to be carried out by third parties. This model can partly be justified by the strong tradition of dialogue in the Netherlands, but it also raises many concerns.
An example is the tanker collision to the Grave Weir on the Meuse, discussed in more detail further in this paper. This accident was initially seen by Rijkswaterstaat as an internal management problem, as if confirming the Maslow's rule "If the only tool you have is a hammer, every problem looks like a nail". The problem that this tanker carried 2,000 tons of highly inflammable benzene was not immediately addressed. Also the consequences of the dropping water level on the Meuse River and its lateral canals were not soon enough clear for the crisis team. The most evident consequence, loss of the upper pool, is depicted in Fig.  3. Both the assessment and the management of the accident proved to be inadequate. The details are presented in the report by the national Investigation Council for Safety [7] along with the lessons learned and recommendations.

Identifying and reducing the risks of accidents
Accidents of all categories, also with the loss of life, happen not only at large lock and dam sites but also at small river weirs and other structures with hydraulic gates. The risks of accidents may even be higher at such structures because there is normally no operation personnel there. Therefore, it is important that all possible measures are taken to discourage swimming, boating, fishing and other activities that may generate risks, without changing the site into a fortress. Hydraulic structures attract public attention and they should continue doing so. After all welcoming the viewers pays back in local understanding, acceptance and care. What must be discouraged, however, is the risk generating behavior of people. The simplest way to do this is to place the signs that clearly prohibit it. Fig. 4 presents two examples of this from small river weirs in the Netherlands.
Signs alone may not be enough. Other measures include providing appropriate rescue conditions and equipment, like safety nets, lifebuoys, grapples and rescue poles. Designers and site owners should not play down such precautions. Public safety of hydraulic closures is an issue of growing importance. The most evident reasons for this are: − growing social and legal pressure in favor of safe and healthy structures, − remote control policies that reduce the presence of personnel in field. Waterway authorities often issue guidance documents for providing safety and health conditions of hydraulic sites, like the USACE manuals [6] and [8], and the Rijkswaterstaat report [9]. The latter also includes examples of good practices in providing security of lock and dam complexes, particularly in view of remote control policies. It is true, however, that all these documents are primarily focused on the safety and security of own personnel and equipment. The safety risks of users, passersby and visitors, whether or not behaving as desired, are often underestimated by waterway administrations. Hydraulic gate designers and owners should be aware of diverse safety issues, although many of these issues are handled by other disciplines, like spatial planning, hydrology and hydraulics. Some of them are listed below after [2]. This list is not exhaustive. Its intention is to bring the subject under attention rather than to fully discuss it.
• The risk of a vessel going through a dam rather than through lock is inherent to every lock and dam complex. After all, the dam is where the flow goes through; and that flow induces forces on vessels. It is the task of site planners and managers to provide safety conditions that reduce this risk to an acceptable level. This also applies to the conditions of extreme (e.g. flood) water flows, intensive navigation, difficult weather conditions etc. Yet, gate engineers should be aware that there is always a probability of such events happening; and should strive to minimize the consequences. • Dam gates usually let water through either by overtopping or as undertow. Both cases involve the risk mentioned above, although the forces induced and the consequences of potential accidents differ depending on the type and size of vessel, local situation and other factors. This is also a consideration for hydraulic gate engineers. • The basic scenarios to consider in overtopping and undertow flow are when a vessel: • hits the dam gate causing some damage and remains in place; • goes over or under the dam gate with little damage to it; • goes over or under the dam gate causing major damage. • Both overtopping and undertow flows introduce life risks to swimmers and crews of small vessels. The difference is, basically, as follows: • Overtopping flows usually generate horizontal currents on the upstream side and vertical currents on the downstream side. They also aerate the downstream water (see Fig. 4a) decreasing its specific gravity and increasing the risk of drowning. • Undertow flows generate both horizontal and vertical currents on the upstream side, normally without aeration. Main drowning risk is that of being sucked to the bottom and clamped between the gate and its sill or a dam crest. • Various gate types may introduce very specific life risks. It goes too far to discuss all those risks in a single article. An example is the so-called "hydraulic roller" that can occur at some types of gates. A swimmer, animal, boat or another object trapped in a "hydraulic roller" may remain there for weeks before being flushed down the river. Gate engineers should be aware of such phenomena.

Handling life safety risks at large dams
The discussion in this paper focuses on technology as the means to handle and resolve structural failures. It is, however, impossible to correctly assess and select such means without a risk analysis. Any significant upset event related to the operation of a hydraulic gate provides new data and should be followed by an evaluation and implementation of lessons learned. Risk analysis is the guiding tool in this procedure. The most prominent place in risk analyses should normally be given to life safety risk. This is also how waterway administrations in most countries, including the Rijkswaterstaat and USACE, approach this matter. Yet, the analysis of life safety risks is often limited to those gated closures, of which the failures directly expose the population of downstream areas to drowning. These are mainly the closures of high head dams, flood barriers and storm surge barriers. In the USACE risk analysis on dams, the life safety risks are plotted, analyzed and evaluated on risk matrices. In the Netherlands, risk analysis -life risk in particular -was a base for dividing the country into so-called "embankment circles", with legal limits to the probabilities of exceedance for inundation [10]. The Dutch methodology to estimate the loss of life in flood risk management has, e.g., been discussed in [11].
However, the existing legislation and risk analysis methods do not usually capture the life safety risks of accidents such as a push-tow getting stuck under a dam gate, a pleasure vessel going over or through such the gate, gate maintenance crews losing control of their equipment, and the like. In all these cases, life safety risks concern the users or crews of hydraulic sites rather than the population of downstream areas. The designer's challenge is to identify such risks and to minimize them by providing appropriate measures. choices vessel crews can be exposed to. The 2,200 horsepower towboat was pushing a sixbarge unit, fully-loaded with coal, when it got caught by the outdraft current while exiting the lock. The current was very heavy due to high water on the Ohio River. To correct the course and save the barges and their cargo, the towboat moved further from the bank to relocate its pushing force. This did not help. The river took the convoy downstream, three barges smashed against the piers and blocked the dam bays; and the other three barges including the towboat went through the dam gates and sunk on their downstream side. According to the Pittsburgh Post-Gazette, "Screams for help echoed from the towboat Elizabeth M as it sank into the swirling, frigid Ohio River" [12]. Other towboats could only rescue three Elizabeth M crewmen from drowning.
Happily, it does not always end that tragic, An accident with different consequences was the motor barge collision with the gates of the Dutch Grave Weir on the Meuse on December 29, 2016. This weir is of a so-called "bridge-weir" type, of which only two exist in the world. The second (historically first) is the Poland's Rędzin Weir on the Oder River near Wrocław. Schematic side views of both structures are presented in Fig. 6, redrawn from [13]. Hydraulic loads are carried here by liftable water retaining panels, supported by vertical beams that, in turn, are hinged to bridge spans above the weir bays. During floods, the beams are hoisted out of water to the horizontal position under the bridge decks. On December 29, 2016, a German downbound tanker Maria Valentine, carrying 2000 tons of benzene, went through one of the Grave Weir spans at full speed. This happened in the morning in a very dense fog. The ship damaged several vertical beams that hang from the bridge to support the water retaining panels. Then she dove down about 3 m passing the weir under the free ends of those beams. The fact that this did not cause any injuries or fatalities on board, was generally considered a wonder. Despite the damage on deck, the crew managed to anchor the vessel downstream of the weir. No benzene leaked into the river. Nevertheless, the water retaining structure was severely damaged (Fig. 7). This in combination with too late closing of weirs in the lateral canals caused the loss of navigation and substantial other damage in a wide area. The Grave Weir accident resulted in the total navigation shutdown of about two weeks, immobilizing the vessels already present in the area; with another two weeks of various navigation restrictions. Not all cost of repairs and financial claims by various parties have yet been settled, but they will likely run into many millions of euros. However, no loss of life is also symptomatic. A tentative conclusion can be that life safety risk by ship collision is relatively low for this type or weir, although more investigation is required to support it. One can take this into account when considering the future of the Oder Rędzin Weir.
Both discussed cases refer to life safety risks when a ship goes through a gate of river dam or weir. These are, obviously, not the only life safety risks at such structures. Yet, even these two examples already show that there are many factors co-determining such risks on large river dams and weirs. In the most general terms, one can distinguish some groups of these factors, like: • factors inherent to the dam layout and local hydrological conditions; • time-related factors like weather, intensity of navigation, seasonal extremes etc.; • factors depending on applied technologies, including types of dam and weir gates, types of their drives, controls, presence of personnel, safety systems etc.; • factors related to technical condition of both hydraulic structures and vessels; • human factors, including competence, experience, fitness, alertness and resistance to stress of all individuals involved. The detailed discussion of these factors goes beyond the scope of this paper. It is good, however to be aware of them, to draw and follow legally required safety and health plans, and -above all -to keep the mind open for all possible accident scenarios.

Recovering from the damage
The examples and practices discussed above allow to distinguish some stages in handling accidents and calamities. Specialists in process management tend to visualize complex processes in graphical models, like circles, spirals, pyramids etc. In this paper and in book [2], we have chosen a fish model. After all, this discussion concerns hydraulic gates, i.e. structures that, by definition, operate in water. An additional goal is to slightly parody this graphical mania which tends to simplify the nature of processes. The fish-graph in Fig. 8 schematically shows some typical stages in handling accidents and calamities involving hydraulic gates. It also globally indicates the relative urgency of these stages and the usual demand for personnel, material and other resources. The general regularities, relations and tendencies indicated in the graph in Fig. 8 have shortly been commented below [2]. • The urgency to act is typically the highest immediately after (if possible during!) the accident or calamity. The emerging situation is then out of control. The priority is to regain that control, preventing or at least limiting any further damage. • Despite high urgency, the available resources (human, material, equipment, etc.) to meet the emerging needs are in the first instance the lowest directly after the accident.
Organizations may and should exercise freeing these resources as soon as possible, but it will always take time to fully mobilize them. • Once the control is restored, the next step is to inventory the damage, investigate its causes, and choose the necessary repairs. The urgency has decreased a little at this stage but is still high. The engaged resources are already substantial but the main bulk of work still has to be done. It should begin quickly and efficiently. • The work can be done either by the in-house forces or by contractors or by a joined effort of both. USACE will largely rely on the in-house forces. Rijkswaterstaat has outsourced such forces and will need to contract all works. The result should be a repaired or replaced hydraulic gate that can operate for many years to come. • Once the repaired or replaced gate has been delivered, installed, and all accompanying damage has properly been fixed, the system will undergo a series of routine tests. Then it will usually be commissioned and handed over for operation and maintenance by the owner's crews. At this point, the handling of an accident begins to resemble a regular project, although the urgencies are often higher. • The last stage is the so-called after-care phase when various "teething problems" may occur. They should be solved in accordance with contract or other agreements. This is also the time to perform the evaluation of crisis handling. The evaluating team should include all main actors, but it should keep some distance from the issues of the day. This is indicated by a split in the fish's tail in Fig. 8. A serious accident often brings up the question whether the damaged gate should be repaired or entirely replaced by a new structure. This question is basically economical. An answer to it follows from the known financial formulas for comparing the capitalized costs of maintenance and delayed replacement on the one hand to the costs of new construction on the other hand. It is important, however, that this comparison is objective and takes all relevant factors into account. Objective, well-balanced judgments are not that easy in the emotional periods after accidents or calamities.
The Mississippi River Melvin Price Lock gate failure on October 3 rd 2004 was resolved by entire repair of the damage, without new construction works. A comparable accident in the Netherlands, the Meuse River Lith Weir flap gate failure, required the construction of a new flap, while the remaining structures could be preserved. Both cases are discussed in [1] and [2], while the Lith Weir accident has also been presented in [14] and [15]. Photos in, respectively, Fig. 9 and 10 show various stages of repair works. Readers are encouraged to consult the indicated references for more detailed descriptions.

Concluding notes
There are many reasons for misjudgments in the emotional days after an accident. First is that the individuals involved do not like to be blamed for the accident. A way to counter the blame is to put it on the technology. Investigators and designers will often hear that the gate, its drive machinery or control system did not function properly, was "impossible" to maintain or difficult to operate. The challenge is to objectively verify these claims rather than to simply echo them in investigation reports and final decisions.
Other disturbances of decision-making may come from organizations or persons who have particular interests in the nature of final decisions. These can be diverse stakeholders, lobbies, and even individuals within the waterway administration. After the damage of the Lith Weir flap gate (see the paragraph above), the investigators and crisis team were under pressure from some high-ranking managers to trigger a large new construction project for the entire weir instead of to simply repair the damage. Engineers are encouraged to read the Naomi Klein's book The Shock Doctrine [16] for a study on such pressures.
It is important in this view not to misuse the exceptional powers that are assigned to crisis teams to speed up solutions to accidents and calamities. The regulations of this kind include shortened communication and decision lines, expedited or bypassed bidding, short contracting procedures, bypassing regulatory permits, introducing restrictions of various nature, and even sizing other party's property. Justifiable as they are, such powers should in no case be extended beyond the stage of regaining control of the situation.