A Risk-Based Model for Real-Time Flood Control Operation of a Cascade Reservoir System under Emergency Conditions

Real-time flood control operations of a cascade reservoir system under emergency conditions can reduce the social and economic loss caused by natural disasters. This paper proposes a risk-based model for real-time flood control operation of reservoirs under emergency conditions and uncertainties. The proposed model consists of three modules: emergency scenarios establishing, Monte Carlo simulations, and risk analysis. The emergency scenarios considered are earthquakes, extreme floods and failure of the spillways of a reservoir. The uncertainty factor considered is the forecast error of reservoir inflows, arising from model structural uncertainty and parameter estimating. The Monte Carlo simulations conduct the real-time flood control operation of reservoirs considering the proposed emergency events and uncertainties. The module of risk analysis performs the assessment of the operation schedules and calculates the risk of dam overtopping, based on the results from Monte Carlo simulations. The proposed model is applied to a cascade reservoir system in the upper reaches of Daduhe river basin in China. The results show that the maximum initial water level of the Shuangjiangkou reservoir is 2447 m a.s.l. (meters above sea level) using the release capacity model and is 2444.5 m a.s.l. using the command model under the scenario of upstream dam break. The integrated risk of the reservoir increases with the initial water level and the uncertainty degree of the reservoir inflows. The decision-makers can choose the operation models according to the actual initial water level of the reservoir under different emergency scenarios.


Introduction
With the social and economic development of China, many river basins have built flood control systems that consist of cascade reservoirs.The joint operation of these cascade reservoirs can greatly improve the efficiency of water utilization, the stability of hydropower generation and the benefits of flood control projects.The cascade reservoirs not only bring these benefits, but also add complexity to the real-time flood control operation under emergency conditions.Emergency events can include earthquakes, extreme floods, upstream reservoir overtopping, failure of several spillways of a reservoir, terrorist events, etc.The emergency conditions may cause the subsequent dam breaks of the cascade reservoirs and result in enormous life loss and economic loss [1].For example, the dam overtopping of the Foziling and Mozitan reservoirs in 1969 in Anhui province of China was caused by the delayed opening of the spillways and the power outage during the opening of the spillways during the extreme flood.The dam breaks of the Banqiao and Shimantan reservoirs in 1975 in Henan province of China resulted from the poor joint operation of the cascade reservoirs and the upstream dam break of the Yuanmen reservoir.The subsequent dam breaks of the cascade reservoirs caused 26,000 deaths, 17,000,000 acres of flooded farmlands and a 50-day interruption of the railways between Beijing and Guangzhou [2,3].In light of this, it is important to research flood control operation plans of the cascade reservoirs under emergency conditions.It is required in the United States, Canada, Europe, Australia, and other developed countries that the management department of a reservoir propose practical emergency plans for potential emergency conditions and include them in the dam safety management [4,5].The Chinese government also pays attention to the safety management of reservoirs and conducts the research on the emergency plans for potential emergency conditions and the assessment of economic and life loss result from dam breaks.The flood control operation of reservoirs under emergency conditions is one of the most important parts of the emergency plans for potential emergency conditions, and many researchers have done research on emergency events and corresponding responses.Wang and Feng proposed flood control operation rules and a risk assessment method for cascade reservoirs under the emergency condition of potential dam failures [6].The results show that the flood control operation of the cascade reservoirs under emergency conditions is an efficient non-engineering measure to reduce economic and life loss.Zhou et al. presented a response of constructing a division channel to event of the barrier lake created by an earthquake in 2014 in Niulan River of Yunnan Province, which is located in Southwest China [7].Armada et al. proposed a dam-break flood emergency management system to model the flood wave induced by a dam break and, eventually, to manage the response to flood-induced catastrophes [8].
However, many uncertainties are associated with the real-time flood control operation of reservoirs under emergency conditions [9][10][11].The uncertainties include the magnitude and time of occurrence of the disasters, the communication of information between different management departments, and the response uncertainty of the evacuated people, and so on.These uncertainties make the operation results random and bring risks to flood control decisions [12,13].The traditional deterministic flood control operations for the reservoirs cannot provide the risks arising from the uncertainties.Many scholars have conducted research on risk analysis for flood control operations of reservoirs and other flood control structures [14][15][16].Tosun et al. calculated the risk of the seismic hazards of thirty-two large reservoirs in the Euphrates basin, based on seismic activities and physical properties [17].Wu et al. formulated a risk analysis model to calculate the overtopping probability of a levee system using the advanced first-order and second-moment (AFOSM) method [18].Yan et al. proposed a method to assess the impact of inflow forecasting errors on reservoir flood control operations, based on stochastic differential equations and the forward Euler method [19].The authors also performed some work on risk analysis of reservoir operations.We proposed a risk analysis method for real-time flood control operation of a reservoir by solving a stochastic differential equation of reservoir flood routing [20].We developed a model for supporting optimal flood control decision-making under uncertainty and evaluates the risk propagation process [21].However, the above published papers are about the risk analysis and decision making for flood control operation of reservoirs under normal conditions.The literature on specific emergency measures for the real-time flood control operation of cascade reservoirs under the combination of emergency events and uncertainties is limited, especially for the impact of the uncertainties on the emergency operations of reservoirs.Therefore, the main purpose of this study is to propose a risk-based model for real-time flood control operation of reservoirs under the combination of emergency events and uncertainties.The proposed model is to have a reliability assessment of the real-time flood control operation process of reservoirs under the combination of emergency events and uncertainties, from its observation to its operation.It also provides the integrated risk of the whole emergency event, while most of the published papers calculate the risk of the whole event by the maximum risk during the period.The developed method also evaluates the impact of the uncertainty degree on the integrated risk of the whole emergency event and provides some characteristic values for the decision makers to carry out emergency responses according to the emergency scenarios.The following three major modules are included: (1) emergency scenarios establishing, which considers earthquakes, extreme floods, and failure of several spillways of a reservoir; (2) the Monte Carlo simulations, which carry out the real-time flood control operation of reservoirs considering the proposed emergency events and uncertainties; (3) risk analysis model, which performs the assessment of the operation schedules and calculates the risk of reservoir overtopping, based on the results from Monte Carlo simulations.
The rest of this paper is organized as follows: Section 2 proposes the methodology including emergency scenarios establishing, Monte Carlo simulations, and risk analysis; Section 3 presents the case study; Section 4 shows the results of the proposed model; Section 5 presents the discussions of the results; and, finally, we provide the conclusions of this work in Section 6.The rest of this paper is organized as follows: Section 2 proposes the methodology including emergency scenarios establishing, Monte Carlo simulations, and risk analysis; Section 3 presents the case study; Section 4 shows the results of the proposed model; Section 5 presents the discussions of the results; and, finally, we provide the conclusions of this work in Section 6.

Emergency Scenarios Establishing
There are many possible emergency events during the real-time flood control operation of cascade reservoirs, causing serious consequences in social security and economic loss.The paper considers three kinds of emergency events: an earthquake, extreme floods, and failure of spillways of a reservoir.According to these three kinds of emergency events, we have established three following emergency scenarios:

Emergency Scenarios Establishing
There are many possible emergency events during the real-time flood control operation of cascade reservoirs, causing serious consequences in social security and economic loss.The paper considers three kinds of emergency events: an earthquake, extreme floods, and failure of spillways of a reservoir.According to these three kinds of emergency events, we have established three following emergency scenarios: Water 2018, 10, 167 4 of 18 (1) An earthquake triggers the upstream dam break.The upstream dam break causes a dam break flood for the downstream reservoir.The dam break flood is calculated using the Dam Breach Analysis model (DB-IWHR) proposed by Chen et al. [22].The DB-IWHR can produce reservoir outflow hydrograph by conducting dam breach analysis.DB-IWHR improves the traditional dam breach model in the aspects of broad-crested weir flow analysis, incipient velocity, and shear stress of erosion, soil erosion and breach lateral enlargement model.Chen et al. also developed a transparent spreadsheet (DB-IWHR 2014) for the model, which is coded in Microsoft Excel and VBA (Visual Basic for Applications) programming.The spreadsheet and the user manual for detailed information can be downloaded from the website [23].(2) Extreme floods include 100-year return period design flood, 1000-year return period design flood and 10,000-year return period design flood.(3) Some spillways of a dam do not work.As a consequence, the release capacity of the reservoir is reduced.
The mathematical description of the emergency scenarios is expressed as: where C ij represents an emergency scenario of the reservoir i, N is the number of reservoirs in the cascade system (N = 2 in this paper), j is the index of an emergency scenario, and M 1 is the number of considered emergency scenarios (M 1 = 3 in this paper).

Uncertainties
The uncertainties considered in this paper are the forecast errors of reservoir inflows, which arise from the model structure and parameter estimation of hydrological forecast models.The stochastic reservoir inflow is expressed as: where Q i (t) is the stochastic inflow of reservoir i at time t, Q i (t) is the mean of the stochastic inflow of reservoir i at time t, and ξ i (t) is the forecast error of reservoir i at time t.

Reservoir Flood Control Operation Models under Emergency Scenarios
The emergency scenarios proposed in Section 2.1 have the characteristics of happening quickly and unexpectedly, causing serious hazards and a high degree of uncertainty.Therefore, we have to establish fast and easy emergency operations to minimize the hazards caused by the emergency events.
The emergency operations should meet the following three principles: (1) They should ensure the safety of the dam: The reservoir water level cannot exceed the dam crest elevation in the real-time flood control operation of the cascade reservoirs; the emergency responses should maximize the safety of the reservoirs and reduce the risk of sequent dam failures in cascade reservoirs.(2) The emergency responses should ensure the safety of the downstream city.The maximum flood discharge should not exceed the safety discharge at the downstream control point.If this requirement cannot be guaranteed, then the time duration that the flood discharge exceeds the safety discharge should be minimized in order to reduce the social and economic loss of the downstream city.(3) If the sequent failures of the dams in the cascade system are inevitable, then the main purpose of the emergency response should be postponing the time that the reservoir overtopping occur as much as possible.In doing so, the decision-makers and the government can have more time to evacuate people and property to reduce the social and economic loss.
Water 2018, 10, 167 5 of 18 According to the above principles, we have proposed the following four operation models, which are fast and easy to implement: (1) Release capacity model The reservoir releases water as much as possible using its discharge capacity.This operation model can reduce the risk of the dam overtopping in a very fast and easy way.
(2) Safety discharge model The maximum release of the reservoir does not exceed the safe discharge of the downstream control point.This operation model is usually used in the situation that the safety of the reservoir is guaranteed.The reservoir can ensure the safety of the downstream city and reduce the social and economic loss of the cascade system and it is not at the expense of the dam safety.
(3) Zero release model The reservoir does not release any water.This operation model is usually used by the upstream reservoir in the situation that the downstream reservoir has a high risk of dam overtopping.Thus, the upstream reservoir does not release any water to help the downstream reservoir mitigate the emergency situation.
(4) Command model The reservoir releases water according to the command of the government or experts.This operation model is usually used in the situation that the government issues some discharge limits.
The mathematical description of the emergency operation models is expressed as: where O ij represents an emergency operation model of the reservoir i, k is the index of an emergency operation model, and M 2 is the number of considered emergency operation models (M 2 = 4 in this paper).According to the above emergency operation models, we calculate the reservoir water levels and releases through reservoir flood routing.The main constraints used in the reservoir flood routing are as follows: (1) Water balance equation: where Q i (t) is the inflow of reservoir i at time t, V i (t) is the storage of reservoir i at time t, q i (t) is the release of reservoir i at time t, and ∆t is the time interval.
(2) Reservoir water level limits: where H i (t) is the water level of reservoir i at time t, H i,min is the lower bound of reservoir i, and H i,max is the upper bound of reservoir i.
(3) Reservoir discharge limits: where q i,min is the minimum release of reservoir i, and q i,max is the maximum release of reservoir i.
(4) Reservoir release variation constraint: Water 2018, 10, 167 where ∆q i,max is the acceptable maximum variation in two consecutive time periods of reservoir i.
(5) Reservoir release capacity constraint: where qz i,max (H i (t)) is the release capacity of reservoir i.

Monte Carlo Simulation Considering the Combination of Emergency Scenarios and Uncertainties
The Monte Carlo simulations calculate specific emergency operation schedules for the reservoirs under the combination of emergency events and uncertainties.The steps are as follows: (1) Obtain the forecasted inflows (Q i (t), t = 1 to T) of the reservoirs under the proposed emergency scenarios; (2) Obtain the probability distributions of the forecast errors (ξ i (t), t = 1 to T); (3) Generate the random samples of the forecast errors (ξ i (t), t = 1 to T) using the Latin Hypercube Sampling method; (4) Calculate the random samples of the stochastic reservoir inflows (Q i (t), t = 1 to T), according to Equation (2); and (5) Calculate the random samples of the reservoir water levels, storages and discharges through reservoir flood routing.The reservoir flood routing is conducted using the proposed emergency operation models.
The flowchart of the Monte Carlo simulations is shown in Figure 2.
(4) Reservoir release variation constraint: where is the acceptable maximum variation in two consecutive time periods of reservoir i.
(5) Reservoir release capacity constraint: where , ( ( )) i max i qz H t is the release capacity of reservoir i.

Monte Carlo Simulation Considering the Combination of Emergency Scenarios and Uncertainties
The Monte Carlo simulations calculate specific emergency operation schedules for the reservoirs under the combination of emergency events and uncertainties.The steps are as follows: (1) Obtain the forecasted inflows ( ) of the reservoirs under the proposed emergency scenarios; (2) Obtain the probability distributions of the forecast errors ( ( ) ); (3) Generate the random samples of the forecast errors ( ( ) ) using the Latin Hypercube Sampling method; (4) Calculate the random samples of the stochastic reservoir inflows ( ( ), 1

Risk Analysis
The risk of the reservoir is defined as the overtopping probability, which is the probability that the loading L exceeds the resistance R, i.e., the probability of failure [24].In this paper, the loading of a reservoir is considered as the reservoir water level.The resistance is the selected safe water level, such as the reservoir dam crest height.The risk of reservoir i at time t is defined as: where P i t,R is the risk of reservoir i at time t, H i,R is the selected safe water level of reservoir i, H j i (t) refers to the random samples (j = 1 to N 3 ) of the water levels of reservoir i, N 2 is the number counted as As the stochastic reservoir water level during each time period can exceed the selected safe water level, the integrated risk of the whole emergency event is defined as the sum of the individual risk events during the flood event, expressed as: where P i R is the integrated risk of reservoir i, T is the time duration of the emergency event, A i t refers to the individual risk event of H i (t) > H i,R at time t.
Therefore, we can calculate the risk of the reservoirs at time period and the integrated risk of the whole emergency event according to Equations ( 9) and (10), with the results from Monte Carlo simulations.

Study Area
We perform a case study in the Daduhe River Basin, which is an important part of Yangtze River Basin of China, as shown in Figure 3.The upper reaches of the Daduhe River Basin are characterized by a plateau climate while the middle and lower reaches are characterized by a subtropical humid climate.The average annual precipitation in the upper reaches of the basin is around 600-700 mm.We concentrate on the cascade system that consists of two reservoirs: Xiaerga reservoir and Shuangjiangkou reservoir, as shown in Figure 3.The Xiaerga reservoir is a large scale hydropower station, which is located in the lower reaches of the Ake River and the Maerqu River.It is an earth and rockfill dam.The permanent structures of the Xiaerga reservoir include a dam, power generation buildings, a fixed-crest spillway and gated spillway tunnels.There are strong geological tectonic movements in the bank area of Xiaerga reservoir, which might cause landslide, collapse, and debris flow.The Shuangjiangkou reservoir is also a large scale hydropower station, which is located in the Daduhe River.The controlled river basin area of the Shuangjiangkou reservoir is 39,330 km 2 , accounting for 50.8% of the entire area of Daduhe River Basin.The permanent structures of the Shuangjiangkou reservoir include an earth and rockfill dam, power generation buildings, gated cave spillways and spillway tunnels.
The main characteristics of the cascade reservoirs are shown in Table 1.The Xiaerga reservoir is assumed to have a breach lateral enlargement due to the collapse of the channel wall.The dam break flood of the Xiaerga reservoir is calculated using the DB-IWHR 2014 spreadsheet [22].In this paper, the forecast errors (ξ i (t)) of the reservoir inflows are assumed to follow normal distributions, recommended by the Ministry of Water Resources (MWR) of China in 2000 [9,25,26].If sufficient historical flood data are available, the distribution parameters of the inflow forecast errors can be calculated through goodness-of-fit tests [19].Due to the lack of sufficient historical data, we express the uncertainty of inflow forecast error as ξ i (m) ∼ N(0, 0.10 2 ).The term m is the time at which the forecasted flood peak of the inflows occurs.The distributions of inflow forecast errors at other moments are calculated through Equation (11), assuming that the relative errors of the forecasted inflows increase linearly with time [20]: where σ ξ (t) is the standard deviation of the relative errors of the forecasted inflows of the Shuangjiangkou reservoir at time t, m (m = 13) is the time at which the forecasted flood peak of the inflows occurs, and T (T = 24) is the time duration.
According to the DB-IWHR 2014 spreadsheet and Equation (11), the inflows and their distribution parameters of the Shuangjiangkou reservoir are obtained as shown in Figure 4.The flood peak discharge is 40,800 m 3 /s and the time interval is 1 h.
As Figure 4 shows, the forecast precision is higher and the variance of the inflow forecast errors is larger as the forecast lead time moves forward.Thus, the stochastic inflows change in a much larger range around their average.According to the DB-IWHR 2014 spreadsheet and Equation (11), the inflows and their distribution parameters of the Shuangjiangkou reservoir are obtained as shown in Figure 4.The flood peak discharge is 40,800 m 3 /s and the time interval is 1 h.
As Figure 4 shows, the forecast precision is higher and the variance of the inflow forecast errors is larger as the forecast lead time moves forward.Thus, the stochastic inflows change in a much larger range around their average.We selected two operation models for the Shuangjiangkou reservoir: the release capacity model and the command model.We compared the flood control operation results and risk analysis results of the two models.The initial water levels are both 2440 m a.s.l. for the two models.The description of the command model is as follows: if the water levels are below 2504 m a.s.l., then the reservoir releases are equal to 7000 m 3 /s in order to protect the downstream city; if the water levels are above 2504 m a.s.l., then the reservoir releases water using its discharge capacity.

Data and Parameters for the Scenario of Extreme Flooding
The extreme flooding scenarios considered in this paper are 100-year return period design flood, 1000-year return period design flood and 10,000-year return period design flood.It is noted that the above design floods are obtained from the typical flood hydrograph of the reservoir according to an improved homogeneous frequency enlargement method [27].The forecasted error distributions of the floods at each moment are also obtained through Equation (11).The initial water levels for the three extreme floods are all 2480 m a.s.l.

Data and Parameters for the Scenario of Spillway Failure
The scenario of spillway failure includes the reduction by 50% of the reservoir release capacity, the reduction by 25% of the reservoir release capacity, compared with the scenario of no spillway failure.The adjusted release capacity curves of the Shuangjiangkou reservoir are shown in Figure 5.The 100-year return period design flood is used as the inflows of the Shuangjiangkou reservoir under the scenario of spillway failure, and the initial water level is 2480 m a.s.l.We selected two operation models for the Shuangjiangkou reservoir: the release capacity model and the command model.We compared the flood control operation results and risk analysis results of the two models.The initial water levels are both 2440 m a.s.l. for the two models.The description of the command model is as follows: if the water levels are below 2504 m a.s.l., then the reservoir releases are equal to 7000 m 3 /s in order to protect the downstream city; if the water levels are above 2504 m a.s.l., then the reservoir releases water using its discharge capacity.

Data and Parameters for the Scenario of Extreme Flooding
The extreme flooding scenarios considered in this paper are 100-year return period design flood, 1000-year return period design flood and 10,000-year return period design flood.It is noted that the above design floods are obtained from the typical flood hydrograph of the reservoir according to an improved homogeneous frequency enlargement method [27].The forecasted error distributions of the floods at each moment are also obtained through Equation (11).The initial water levels for the three extreme floods are all 2480 m a.s.l.

Data and Parameters for the Scenario of Spillway Failure
The scenario of spillway failure includes the reduction by 50% of the reservoir release capacity, the reduction by 25% of the reservoir release capacity, compared with the scenario of no spillway failure.The adjusted release capacity curves of the Shuangjiangkou reservoir are shown in Figure 5.The 100-year return period design flood is used as the inflows of the Shuangjiangkou reservoir under the scenario of spillway failure, and the initial water level is 2480 m a.s.l.We selected two operation models for the Shuangjiangkou reservoir: the release capacity model the command model.We compared the flood control operation results and risk analysis results e two models.The initial water levels are both 2440 m a.s.l. for the two models.The description e command model is as follows: if the water levels are below 2504 m a.s.l., then the reservoir ses are equal to 7000 m 3 /s in order to protect the downstream city; if the water levels are above m a.s.l., then the reservoir releases water using its discharge capacity.

. Data and Parameters for the Scenario of Extreme Flooding
The extreme flooding scenarios considered in this paper are 100-year return period design flood, -year return period design flood and 10,000-year return period design flood.It is noted that the e design floods are obtained from the typical flood hydrograph of the reservoir according to an oved homogeneous frequency enlargement method [27].The forecasted error distributions of loods at each moment are also obtained through Equation (11).The initial water levels for the extreme floods are all 2480 m a.s.l.

. Data and Parameters for the Scenario of Spillway Failure
The scenario of spillway failure includes the reduction by 50% of the reservoir release capacity, eduction by 25% of the reservoir release capacity, compared with the scenario of no spillway re.The adjusted release capacity curves of the Shuangjiangkou reservoir are shown in Figure 5. 100-year return period design flood is used as the inflows of the Shuangjiangkou reservoir under cenario of spillway failure, and the initial water level is 2480 m a.s.l.8000

The Results Using the Release Capacity Model
According to the data and parameters in Section 3.2.1 and the Monte Carlo Simulation steps in Figure 2, the reservoir flood routing of the Shuangjiangkou reservoir is carried out using the release capacity model.The random samples of the forecast errors are generated using the Latin Hypercube Sampling method whose accuracy has been demonstrated by many scholars [28,29].The number of the random samples is 10,000 which is selected by converge of the risk values.
Figure 6 shows the mean processes of reservoir releases and water levels.
Water 2018, 10, x FOR PEER REVIEW 10 of 17 According to the data and parameters in Section 3.2.1 and the Monte Carlo Simulation steps in Figure 2, the reservoir flood routing of the Shuangjiangkou reservoir is carried out using the release capacity model.The random samples of the forecast errors are generated using the Latin Hypercube Sampling method whose accuracy has been demonstrated by many scholars [28,29].The number of the random samples is 10,000 which is selected by converge of the risk values.
Figure 6 shows the mean processes of reservoir releases and water levels.The distribution parameters of the stochastic water levels of Shuangjiangkou reservoir are also calculated according to the method proposed, as shown in Table 2.The distribution parameters of the stochastic water levels of Shuangjiangkou reservoir are also calculated according to the method proposed, as shown in Table 2.As Table 2 shows, the mean of the reservoir water level at the time (t = 13) of flood peak discharge is 2478.95m a.s.l., and the mean of the maximum reservoir water level is 2503.44 m a.s.l. with the time index of t = 23.
The reservoir water level errors are assumed to follow normal distributions, and then the K-S test is carried out for the goodness-of-fit.The reservoir water level errors follow normal distributions at the significance level of 0.05.We set different safe water levels for the reservoir and calculate the corresponding risks according to Equations ( 9) and (10).The relationship curve between the integrated risk of the entire flood and the selected safe water levels is drawn in Figure 7.As Figure 7 shows, the integrated risk of the Shuangjiangkou reservoir decreases when the selected safe water level increases.This means that the probability that the stochastic reservoir water levels exceed the selected safe water level decreases when the selected safe water level increases.
In order to evaluate the impacts of the reservoir initial water levels on the integrated risk of reservoir overtopping, we set four initial water levels (2440, 2444.5, 2442, and 2443 m a.s.l.) for the Shuangjiangkou reservoir.Then the relationship curves between the integrated risks of the entire flood and the selected safe water levels are calculated and drawn with the four initial water levels, as shown in Figure 7.By trial-and-error, the maximum initial water level of the Shuangjiangkou reservoir is 2447 m a.s.l.using the release capacity model.This means that using the release capacity model, if the initial water level of the Shuangjiangkou reservoir exceeds 2447 m a.s.l. then it will have a risk of reservoir overtopping under the emergency condition that an earthquake triggers the dam break of the Xiaerga reservoir.
In order to assess the impacts of the uncertainties on the integrated risk of reservoir overtopping, we set five standard deviations of the relative errors of the forecasted inflows (0.08, 0.09, 0.10, 0.11, and 0.12) for the Shuangjiangkou reservoir.Then the relationship curves between the integrated risks of the entire flood and the selected safe water levels are calculated and drawn with the five standard deviations, as shown in Figure 8.As Figure 7 shows, the integrated risk of the Shuangjiangkou reservoir decreases when the selected safe water level increases.This means that the probability that the stochastic reservoir water levels exceed the selected safe water level decreases when the selected safe water level increases.
In order to evaluate the impacts of the reservoir initial water levels on the integrated risk of reservoir overtopping, we set four initial water levels (2440, 2444.5, 2442, and 2443 m a.s.l.) for the Shuangjiangkou reservoir.Then the relationship curves between the integrated risks of the entire flood and the selected safe water levels are calculated and drawn with the four initial water levels, as shown in Figure 7.By trial-and-error, the maximum initial water level of the Shuangjiangkou reservoir is 2447 m a.s.l.using the release capacity model.This means that using the release capacity model, if the initial water level of the Shuangjiangkou reservoir exceeds 2447 m a.s.l. then it will have a risk of reservoir overtopping under the emergency condition that an earthquake triggers the dam break of the Xiaerga reservoir.
In order to assess the impacts of the uncertainties on the integrated risk of reservoir overtopping, we set five standard deviations of the relative errors of the forecasted inflows (0.08, 0.09, 0.10, 0.11, and 0.12) for the Shuangjiangkou reservoir.Then the relationship curves between the integrated risks of the entire flood and the selected safe water levels are calculated and drawn with the five standard deviations, as shown in Figure 8.

The Results Using the Command Option
The flood control operation results using the command model are shown in Figure 9.

The Results Using the Command Option
The flood control operation results using the command model are shown in Figure 9.The flood control operation results using the command model are shown in Figure 9.The distribution parameters of the stochastic water levels of Shuangjiangkou reservoir are also calculated according to the method proposed, as shown in Table 3.As Table 3 shows, the mean of the reservoir water level at the time (t = 13) of flood peak discharge is 2478.95m a.s.l., and the mean of the maximum reservoir water level is 2503.62 m a.s.l. with the time index of t = 23.
We set different safe water levels for the reservoir and calculate the corresponding risks according to Equations ( 9) and (10).The relationship curves between the integrated risk of the entire flood and the selected safe water levels is drawn in Figure 10.We set different safe water levels for the reservoir and calculate the corresponding risks according to Equations ( 9) and (10).The relationship curves between the integrated risk of the entire flood and the selected safe water levels is drawn in Figure 10.In order to evaluate the impacts of the reservoir initial water levels on the integrated risk of reservoir overtopping, we also set four initial water levels (2440, 2444.5, 2442, and 2443 m a.s.l.) for the Shuangjiangkou reservoir using the command model.Then the relationship curve between the integrated risk of the entire flood and the selected safe water levels are drawn with the four initial water levels, as shown in Figure 10.By trial-and-error, the maximum initial water level of the In order to evaluate the impacts of the reservoir initial water levels on the integrated risk of reservoir overtopping, we also set four initial water levels (2440, 2444.5, 2442, and 2443 m a.s.l.) for the Shuangjiangkou reservoir using the command model.Then the relationship curve between the integrated risk of the entire flood and the selected safe water levels are drawn with the four initial water levels, as shown in Figure 10.By trial-and-error, the maximum initial water level of the Shuangjiangkou reservoir is and is 2444.5 m a.s.l.using the command model.This means that using the command model, if the initial water level of the Shuangjiangkou reservoir exceeds 2444.5 m a.s.l. then it will have a risk of reservoir overtopping under the emergency condition that an earthquake triggers the dam break of the Xiaerga reservoir.

The Results for the Scenario of Extreme Flooding
According to the data and parameters in Section 3.2.2 and the Monte Carlo Simulation steps in Figure 2, the reservoir flood routing of the Shuangjiangkou reservoir is carried out using the release capacity model.Figure 11 shows the mean processes of reservoir releases and water levels of the designed floods.
In order to evaluate the impacts of the reservoir initial water levels on the integrated risk of reservoir overtopping, we also set four initial water levels (2440, 2444.5, 2442, and 2443 m a.s.l.) for the Shuangjiangkou reservoir using the command model.Then the relationship curve between the integrated risk of the entire flood and the selected safe water levels are drawn with the four initial water levels, as shown in Figure 10.By trial-and-error, the maximum initial water level of the Shuangjiangkou reservoir is and is 2444.5 m a.s.l.using the command model.This means that using the command model, if the initial water level of the Shuangjiangkou reservoir exceeds 2444.5 m a.s.l. then it will have a risk of reservoir overtopping under the emergency condition that an earthquake triggers the dam break of the Xiaerga reservoir.

The Results for the Scenario of Extreme Flooding
According to the data and parameters in Section 3.2.2 and the Monte Carlo Simulation steps in Figure 2, the reservoir flood routing of the Shuangjiangkou reservoir is carried out using the release capacity model.Figure 11 shows the mean processes of reservoir releases and water levels of the designed floods.
The distribution parameters of the stochastic water levels of Shuangjiangkou reservoir are also calculated according to the method proposed, and then we set different safe water levels for the reservoir and calculate the corresponding risks according to Equations ( 9) and (10).The relationship curves between the integrated risk of the entire flood and the selected safe water levels under the scenario of extreme flooding are drawn in Figure 12.The distribution parameters of the stochastic water levels of Shuangjiangkou reservoir are also calculated according to the method proposed, and then we set different safe water levels for the reservoir and calculate the corresponding risks according to Equations ( 9) and (10).The relationship curves between the integrated risk of the entire flood and the selected safe water levels under the scenario of extreme flooding are drawn in Figure 12.

The Results for the Scenario of Spillway Failure
According to the data and parameters in Section 3.2.3 and the Monte Carlo Simulation steps in Figure 2, the reservoir flood routing of the Shuangjiangkou reservoir is carried out using the release capacity model.Figure 13 shows the mean processes of reservoir releases and water levels under the  According to the data and parameters in Section 3.2.3 and the Monte Carlo Simulation steps in Figure 2, the reservoir flood routing of the Shuangjiangkou reservoir is carried out using the release capacity model.Figure 13 shows the mean processes of reservoir releases and water levels under the scenarios of reductions by 25% and 50% of the reservoir release capacity.

The Results for the Scenario of Spillway Failure
According to the data and parameters in Section 3.2.3 and the Monte Carlo Simulation steps in Figure 2, the reservoir flood routing of the Shuangjiangkou reservoir is carried out using the release capacity model.Figure 13 shows the mean processes of reservoir releases and water levels under the scenarios of reductions by 25% and 50% of the reservoir release capacity.The distribution parameters of the stochastic water levels of Shuangjiangkou reservoir are also calculated according to the method proposed, and then we set different safe water levels for the reservoir and calculate the corresponding risks according to Equations ( 9) and (10).The relationship curves between the integrated risk of the entire flood and the selected safe water levels under the scenario of spillway failure are drawn in Figure 14.The distribution parameters of the stochastic water levels of Shuangjiangkou reservoir are also calculated according to the method proposed, and then we set different safe water levels for the reservoir and calculate the corresponding risks according to Equations ( 9) and (10).The relationship curves between the integrated risk of the entire flood and the selected safe water levels under the scenario of spillway failure are drawn in Figure 14.

The Results for the Scenario of Spillway Failure
According to the data and parameters in Section 3.2.3 and the Monte Carlo Simulation steps in Figure 2, the reservoir flood routing of the Shuangjiangkou reservoir is carried out using the release capacity model.Figure 13 shows the mean processes of reservoir releases and water levels under the scenarios of reductions by 25% and 50% of the reservoir release capacity.The distribution parameters of the stochastic water levels of Shuangjiangkou reservoir are also calculated according to the method proposed, and then we set different safe water levels for the reservoir and calculate the corresponding risks according to Equations ( 9) and (10).The relationship curves between the integrated risk of the entire flood and the selected safe water levels under the scenario of spillway failure are drawn in Figure 14.

Discussion
We draw some important conclusions from the results: As Figure 8 shows, the integrated risk of the reservoir increases when the standard deviation of the relative errors of the forecasted inflows increases.It means that the risk of reservoir overtopping increases with the uncertainty degree of the reservoir inflows.The decision-makers can reduce the risk of reservoir overtopping by improving the accuracy of the forecasted reservoir inflows.
As Figure 12 shows, the integrated risk of the reservoir increases with the return period of the extreme floods.As Figure 14 shows, the integrated risk of the reservoir increases with the reduced percentage of the reservoir release capacity.
The proposed risk-based model for the real-time flood control operation of reservoirs under emergency conditions can provide important information about risks to decision-makers for conducting emergency operations.The potential applications are as follows: (1) Application 1 can calculate the risk that the stochastic water levels of the reservoir exceed the safe reservoir water level under the emergency scenarios.
For example, the probability that the stochastic water levels of Shuangjiangkou reservoir exceed 2504.42 m a.s.l. is 23.39% using the release capacity model under the emergency scenario that an earthquake triggers the dam break of the upstream reservoir, as shown in point B of Figure 7.This means that, using the release capacity model, the risk that the stochastic water levels of Shuangjiangkou reservoir exceed the design flood water level is 23.99%.This is due to the uncertainty factors and the upstream dam break.
The probability that the stochastic water levels of the Shuangjiangkou reservoir exceed 2504.42 m a.s.l. is 37.77% using the command model under the emergency scenario that an earthquake triggers the dam break of the upstream reservoir, as shown in point A of Figure 10.This means that, using the command model, the risk that the stochastic water levels of the Shuangjiangkou reservoir exceed the design flood water level is 37.77% due to the uncertainty factors and the upstream dam break.Thus, the risk using the command model is 14.38% more than the risk using the release capacity model.
(2) Application 2 can provide the risk of reservoir overtopping of the reservoir under the emergency condition that an earthquake triggers the dam break of the upstream reservoir.
For example, the probability that the stochastic water levels of Shuangjiangkou reservoir exceed the dam crest elevation (2510 m a.s.l.) is 0 using the release capacity model, as shown in Figure 7.This means that the Shuangjiangkou reservoir does not have a risk of reservoir overtopping if it uses the release capacity model under the emergency condition that an earthquake triggers the dam break of the Xiaerga reservoir.
The probability that the stochastic water levels of Shuangjiangkou reservoir exceed the dam crest height (2510 m a.s.l.) is also 0 using the command model, as shown in Figure 10.Therefore, using the command model does not increase the risk of reservoir overtopping of the Shuangjiangkou reservoir.However, the command model can mitigate the emergency flood control situation for the downstream city simultaneously when guaranteeing the safety of the dam.This is because the maximum release of the Shuangjiangkou reservoir using the command model is smaller than that using the release capacity model as shown in Figures 6 and 9.
(3) Application 3 can calculate the maximum initial water level of the reservoir under the emergency conditions in order to avoid the risk of reservoir overtopping.
The maximum initial water level of the Shuangjiangkou reservoir is 2447 m a.s.l.using the release capacity model and is 2444.5 m a.s.l.using the command model under the scenario of upstream dam break.Therefore, the decision-makers can choose the best operation model according to the actual initial water level of the reservoir.It should be noted that the flood control level is over the maximum initial water levels we proposed.This is because that the maximum initial water levels proposed in this paper are calculated using the release capacity operation model and the command operation model, which are special for emergency events, while the flood control level is calculated according to the normal operation rules and design floods of the reservoir.
There are some limitations to the methodology used, and further research could focus on them.For instance, the initial reservoir level could have been probabilistically assessed from observed reservoir levels' time series [30,31] or from regular operation simulation [32].The spillway reliability can be assessed through different methodologies as a fault tree analysis combined with an expert judgment [31,32].Regarding to the flood control operation models and the assessment of the overtopping risk associated, stochastic parametric procedures [33,34] or probabilistic-multiobjective procedures [35,36] could have been accounted for.The proposed model is mainly used for the cascade reservoirs during flood season and its suitability in other situations could be evaluated.Finally, there is uncertainty in the determination of extreme floods [37] that could be studied in order to be incorporated within the proposed methodology in further studies.

Conclusions
In this paper, the research on the real-time flood control operation of reservoirs under the combination of the emergency conditions and uncertainties is carried out.The main points and conclusions are summarized as follows: (1) We considered the emergency events including the upstream dam break triggered by an earthquake, extreme floods and failure of some spillways of a reservoir and the uncertainty of reservoir inflows.(2) We developed a risk-based model for real-time flood control operation of reservoirs under the combination of these emergency conditions and uncertainties.(3) We calculated the risk of reservoir overtopping of a reservoir under the combination of an emergency condition and uncertainties.We suggested the maximum initial water levels of a reservoir for each operation model in order to avoid the risk of reservoir overtopping.(4) We applied the proposed model to the cascade reservoir system in the upper reaches of Daduhe river basin in China.The results show that the integrated risk of the reservoir increases with the initial reservoir water level, increases with the uncertainty degree of the reservoir inflows, increases with the return period of the extreme floods, and also increases with the reduced percentage of the reservoir release capacity.The maximum initial water level of the Shuangjiangkou reservoir is 2447 m a.s.l.using the release capacity model and is 2444.5 m a.s.l.using the command model under the scenario of upstream dam break.The decision-makers can choose the best operation model according to the actual initial water level of the reservoir.

Figure 1
Figure 1 shows the framework of the proposed risk-based model for real-time flood control operation of reservoirs under emergency conditions.As presented in Figure 1, the proposed methodology includes three components: emergency scenarios establishing, Monte Carlo simulations, and risk analysis.The emergency scenarios include earthquakes, extreme floods and failure of spillways of a reservoir.Based on emergency scenarios, the Monte Carlo simulations conduct the real-time flood control operation of reservoirs, considering the uncertainty of reservoir inflows.Then the risk analysis of the operation schedules is carried out and the risk of dam overtopping is calculated.The details of the proposed modules are shown in the following sections.

Figure 1
Figure 1 shows the framework of the proposed risk-based model for real-time flood control operation of reservoirs under emergency conditions.As presented in Figure 1, the proposed methodology includes three components: emergency scenarios establishing, Monte Carlo simulations, and risk analysis.The emergency scenarios include earthquakes, extreme floods and failure of spillways of a reservoir.Based on emergency scenarios, the Monte Carlo simulations conduct the real-time flood control operation of reservoirs, considering the uncertainty of reservoir inflows.Then the risk analysis of the operation schedules is carried out and the risk of dam overtopping is calculated.The details of the proposed modules are shown in the following sections.

Figure 1 .
Figure 1.The framework of the risk-based model for real-time flood control operation of reservoirs under emergency conditions.

Figure 1 .
Figure 1.The framework of the risk-based model for real-time flood control operation of reservoirs under emergency conditions.
i Q t t to T = ), according to Equation (2); and (5) Calculate the random samples of the reservoir water levels, storages and discharges through reservoir flood routing.The reservoir flood routing is conducted using the proposed emergency operation models.The flowchart of the Monte Carlo simulations is shown in Figure 2.

Figure 2 .
Figure 2. The flowchart of the Monte Carlo simulations.Figure 2. The flowchart of the Monte Carlo simulations.

Figure 2 .
Figure 2. The flowchart of the Monte Carlo simulations.Figure 2. The flowchart of the Monte Carlo simulations.

18 Figure 3 .
Figure 3.The sketch map of the upper reaches of Daduhe River Basin in China.

Figure 4 .
Figure 4.The inflows and their distribution parameters of the Shuangjiangkou reservoir.

Figure 4 .
Figure 4.The inflows and their distribution parameters of the Shuangjiangkou reservoir.

Figure 4 .
Figure 4.The inflows and their distribution parameters of the Shuangjiangkou reservoir.

Figure 5 .
Figure 5.The spillway failure scenarios of the Shuangjiangkou reservoir.

Figure 5 .
Figure 5.The spillway failure scenarios of the Shuangjiangkou reservoir.

Figure 6 .
Figure 6.The flood control operation results of the Shuangjiangkou reservoir using the release capacity model.

Figure 6 .
Figure 6.The flood control operation results of the Shuangjiangkou reservoir using the release capacity model.

Figure 7 .
Figure 7.The integrated risk of Shuangjiangkou reservoir using the release capacity model.

Water 2018 ,
10, x FOR PEER REVIEW 12 of 18

Figure 8 .
Figure 8.The integrated risk of Shuangjiangkou reservoir using the release capacity model under different uncertainties.

Figure 8 .
Figure 8.The integrated risk of Shuangjiangkou reservoir using the release capacity model under different uncertainties.

Figure 8 .
Figure 8.The integrated risk of Shuangjiangkou reservoir using the release capacity model under different uncertainties.

Figure 9 .
Figure 9.The flood control operation results of Shuangjiangkou reservoir using the command model.

Water 2018 ,
10, x FOR PEER REVIEW 13 of 18

Figure 10 .
Figure 10.The integrated risk of the Shuangjiangkou reservoir using the command model.

Figure 10 .
Figure 10.The integrated risk of the Shuangjiangkou reservoir using the command model.

Figure 11 .
Figure 11.The operation results of Shuangjiangkou reservoir for the design floods.Figure 11.The operation results of Shuangjiangkou reservoir for the design floods.

Figure 11 .
Figure 11.The operation results of Shuangjiangkou reservoir for the design floods.Figure 11.The operation results of Shuangjiangkou reservoir for the design floods.

Water 2018 , 18 Figure 12 .
Figure 12.The integrated risk of Shuangjiangkou reservoir for the scenario of extreme flooding.

Figure 12 .
Figure 12.The integrated risk of Shuangjiangkou reservoir for the scenario of extreme flooding.

3 .
The Results for the Scenario of Spillway Failure

Figure 12 .
Figure 12.The integrated risk of Shuangjiangkou reservoir for the scenario of extreme flooding.

Figure 13 .
Figure 13.The operation results of Shuangjiangkou reservoir under the scenario of a decrease of 25% and 50% of the reservoir release capacity.

Figure 14 .
Figure 14.The integrated risk of Shuangjiangkou reservoir under the scenario of spillway failure.

Figure 13 .
Figure 13.The operation results of Shuangjiangkou reservoir under the scenario of a decrease of 25% and 50% of the reservoir release capacity.

Figure 12 .
Figure 12.The integrated risk of Shuangjiangkou reservoir for the scenario of extreme flooding.

Figure 13 .
Figure 13.The operation results of Shuangjiangkou reservoir under the scenario of a decrease of 25% and 50% of the reservoir release capacity.

Figure 14 .
Figure 14.The integrated risk of Shuangjiangkou reservoir under the scenario of spillway failure.Figure 14.The integrated risk of Shuangjiangkou reservoir under the scenario of spillway failure.

Figure 14 .
Figure 14.The integrated risk of Shuangjiangkou reservoir under the scenario of spillway failure.Figure 14.The integrated risk of Shuangjiangkou reservoir under the scenario of spillway failure.

Table 1 .
The main characteristics of the cascade reservoirs.

Table 1 .
The main characteristics of the cascade reservoirs.
3.2.Data and Parameters3.2.1.Data and Parameters for the Scenario of Upstream Dam Break

Table 2 .
The distribution parameters of the stochastic water levels of Shuangjiangkou reservoir using the release capacity model.

Time Mean (m a.s.l.) Standard Deviation (m) Time Mean (m a.s.l.) Standard Deviation (m)
As Table2shows, the mean of the reservoir water level at the time ( 13 t = ) of flood peak discharge is 2478.95ma.s.l., and the mean of the maximum reservoir water level is 2503.44 m a.s.l. with the time index of23 t =.

Table 2 .
The distribution parameters of the stochastic water levels of Shuangjiangkou reservoir using the release capacity model.

Time Mean (m a.s.l.) Standard Deviation (m) Time Mean (m a.s.l.) Standard Deviation (m)
The integrated risk of Shuangjiangkou reservoir using the release capacity model.

Table 3 .
The distribution parameters of the stochastic water levels of Shuangjiangkou reservoir using the command model.