Nour Chahrour
email: nour.chahrour@inrae.fr

Mohamad Nasr

Jean-Marc Tacnet

Christophe Bérenguer

Deterioration Modeling and Maintenance Assessment using Physics-Informed Stochastic Petri Nets: Application to Torrent Protection Structures

Keywords:

Mountain territories are remarkably exposed to natural phenomena such as torrential floods, arising due to climate and geophysical environmental changes. Protection structures deteriorate with time due to the harsh phenomena they are subjected to since their construction. If not regularly maintained, the level of protection offered by these structures will be reduced. The methodology presented in this paper integrates physics-based and dependability models for monitoring the state evolution of protection structures and improving maintenance decision-making processes. The modeling approach proposed is based on 1) physics-based modeling for identifying the probabilistic laws of the transition times between the defined states of the structure depending on its behavior over time and 2) a decision aiding method based on Petri nets, which helps in choosing the best maintenance strategy while considering budgetary constraints. This approach is applied on a check dam located within a series of check dams in the Manival torrent in Saint-Ismier, France.

Introduction

Natural Phenomena & Protection Systems in Torrents

Torrents are mountain streams with a narrow channel of short length and steep slope ( > 6%). Compared to classical river flows, torrential flows are characterized by violent and sudden floods in addition to a high geomorphic activity (erosion, deposition) due to sediment transport [START_REF] Fabre | Essai sur la théorie des torrens et des rivières[END_REF]. As a consequence, they induce severe damages to vulnerable issues exposed to them (e.g. people, houses, roads, infrastructures, etc.).

Torrential floods are particularly destructive. The particular steep slopes provide them with the capacity to erode and destabilize banks causing transport of sediment and deposit of materials on fans. This can possibly disrupt infrastructures (transport network), damage houses and industrial structures, and generate causalities [START_REF] Meunier | Eléments d'hydraulique torrentielle[END_REF].

In the context of torrential risks, structural protection measures (fig. 1, (a)) aim either to limit the causes (e.g. sediment production, erosion) or the consequences (e.g. deposition, overflowing) of the hazard [START_REF] Tacnet | De la conception à la sûrete des barrages de correction torrentielle[END_REF]. The present study focuses on check dams since (i) they exist in huge numbers in French torrents and (ii) they constitute a critical interdependent system with a recognized efficiency whose assessment remains however challenging.

Torrent Check Dams

Torrent check dams are transverse civil engineering structures built across stream beds in torrential watersheds. Generally, a series of check dams (fig. 1,(b)) is implemented in the flow channel in the upstream part of the torrential watershed. This interdependent system (check dams series) is intended to limit the departure of solid materials by stabilizing the longitudinal and transverse profiles, limiting the risk of lateral landslides [START_REF] Poncet | Restauration et conservation des terrains en montagne[END_REF][START_REF] Deymier | Conception et calcul de barrages de correction torrentielle[END_REF][START_REF] Piton | Why do we build check dams in Alpine streams? An historical perspective from the French experience[END_REF]. In other words, check dams act as kinds of retaining walls for materials (preventing from longitudinal erosion) but with hydraulic functions (centering flows and preventing lateral erosion). They are designed to resist and operate over time, and to protect socioeconomic issues located downstream in the catchment basin.

Check dams can be either constructed using earth material, concrete, masonry (gravity dams) or reinforced concrete (cantilever dams). Their structural analysis is generally processed for the different elements (central body, wings, wall, and foundation) represented in fig. 2. To be effective, they have to fulfill the functional requirements and also, as any civil engineering structure, have to be stable from a mechanical point of view considering external and internal stability equilibrium justifications. Indeed, cantilever check dams are usually designed based on two design criteria [START_REF] Tacnet | Principes de conception des ouvrages de protection contre les risque torrentiels[END_REF]:

1. Structural analysis is based on external and internal stability justifications in which (i) external stability justification requires verifying conditions regarding soil bearing capacity, sliding, and overturning of the structure and (ii) internal stability justification requires verifying the maximum allowed stresses (steel and concrete) in different sections of the dam. 2. Torrential hydraulics functional analysis that checks whether the structure has the efficiency to achieve its expected functions related to hydraulics and erosion control. The main functional elements of a check dam are the central hydraulic weir which controls the flow direction and the side wings that prevent the lateral bypass of the flow during extreme flood events.

Asset Management & Maintenance Decision-Making for Torrent Check Dams

In France, among thousands of civil engineering protection structures constructed in mountains, check dams (92 873 check dam recorded in 1964) are the most used (Messines du [START_REF] Messines Du Sourbier | Enquête sur la conservation et la restauration des terrains en montagne[END_REF]. Over time, check dams are influenced by the direct impact of the hazards they resist on one hand and by the indirect consequences resulting from the geomorphic activity that occurs after each hazardous event on the other hand. Consequently, over their lifetime, they may be subjected to different types of failure modes that can have local or distant effects on their efficacy and performance level. In addition, since they are located in series, check dams constitute a complex system interacting with lateral banks and slopes. The partial or total damage of a specific element of a check dam may trigger a total failure of the structure which in turn may trigger the failure of the consecutive upstream and downstream structures (domino effect) under different mechanisms such as regressive upstream erosion, excess downstream deposition and overloading. Check dams are therefore considered as critical structures due to the fact that their deterioration and failure over time could increase the risk level.

A stable structure may be no longer able to fulfill its functions (e.g. by-passed check dam due lateral erosion). On the other hand, a structure could still efficiently achieve its functions but with very bad structural properties (e.g. check dam which is about to collapse). The most common functional failure that check dams are subjected to, is the phenomenon of local scouring characterized by the removal of materials under the dam's foundation caused by the intense clear water flows (fig. 3). Scouring downstream a dam results from two different mechanisms. From a global point of view, the mean slope of the torrent is evolving according to water and solid inputs propagating along the global bed profile. From a local point of view, even if the bed profile is globally stable, local scouring will always occur due to waterfall energy dissipation. This type of failure is considered to be the most critical since it is one of the main causes that results in the total destruction of the structure [START_REF] Comiti | Local scouring at check-dams in mountain rivers[END_REF]. In that case, the external stability of check dams is highly influenced by the progression of the amount of local scouring downstream the dam. The removal of soil under the dam's foundation indeed reduces the length of compressed soil and increases constraints on the remaining part of the foundation triggering a structural failure due to loss in external stability of the dam.

To limit their degradation, check dams require inspection and costly maintenance [START_REF] Mazzorana | The susceptibility of consolidation check dams as a key factor for maintenance planning[END_REF]. 14 000 check dams, belonging to the French state, are regularly diagnosed and maintained through the National Forest Office, Mountain Terrain Restoration (ONF-RTM) in the Pyrenees and the Alps. Nonetheless, available budgets oblige risk managers and the owners of the structures to establish priorities between different maintenance strategies to be applied on structures that require maintenance. This highlights the importance of modeling check dams' degradation processes in addition to assessing and optimizing their maintenance decision-making.

Objectives and Main Scientific Contributions

Stochastic models are better adapted than other modeling techniques when dealing with degradation processes and predicting when the system fails. Approaches based on event-based stochastic models like stochastic Petri nets (SPNs) offer a flexible and efficient method to analyze the dynamic deterioration and maintenance processes of complex systems [START_REF] Aubry | Systems Dependability Assessment: Benefits of Petri Net Models[END_REF]. In the context of protection structures, such tool enables (i) representing the dynamic behavior of a system when subjected to events (deterioration, maintenance) based on probabilistic transitions between the states of the system and (ii) supporting maintenance decision-making by comparing and sorting maintenance strate-gies taking into consideration economic aspects and the availability time of the system in each state. Compared to other modeling tools, SPNs permit modeling event-driven dynamic systems while integrating jointly deterioration, inspection and maintenance processes. Undoubtedly, the use of other models (extensions of SPNs) such as stochastic activity networks (SANs, [START_REF] Sanders | Stochastic activity networks: Formal definitions and concepts[END_REF]) and colored stochastic Petri nets (CSPNs, [START_REF] Zimmermann | Stochastic Discrete Event Systems: Modeling, Evaluation, Applications[END_REF]) could have been also possible. However, this would have not affect the target behind this study, which is rather to reveal how this class of models can be connected with physics-based models than to show the performance of a given reliability and maintenance stochastic modeling approach.

Indeed SPN models implementing condition-based maintenance (CBM) decision policies [START_REF] Ahmad | An overview of time-based and condition-based maintenance in industrial application[END_REF][START_REF] Alaswad | A review on condition-based maintenance optimization models for stochastically deteriorating system[END_REF] have recently been used as a decision support tool for risk assessment especially in the domain of maintenance modeling for complex systems [START_REF] Zille | Modélisation et évaluation des stratégies de maintenance complexes sur des systémes multi-composants[END_REF][START_REF] Andrews | System design and maintenance modelling for safety in extended life operation[END_REF]. SPNs are based on defining both system's states and probabilistic transition laws between the states. This reveals that these stochastic transitions are crucial elements in representing the behavior of the system.

The application of Petri nets in most previous studies focus on industrial systems and/or mechanical components [START_REF] Lee | An integrated assessment of safety and efficiency of aircraft maintenance strategies using agent-based modelling and stochastic Petri nets[END_REF]. Their use for degradation, inspection and maintenance processes assessment of civil engineering infrastructures is a recent research field. Generally, stochastic processes involving specific statistical distributions are used to model the degradation process in order to estimate transition laws between different degradation levels of deteriorating systems or components [START_REF] Shafiee | Maintenance optimization and inspection planning of wind energy assets: Models, methods and strategies[END_REF]. For example, Weibull distributed state transition times (Le and Andrews, 2016a,b;[START_REF] Le | A Petri net model for railway bridge maintenance[END_REF][START_REF] Ferreira | Stochastic Petri-net models to predict the degradation of ceramic claddings[END_REF][START_REF] Ferreira | Stochastic maintenance models for ceramic claddings[END_REF], Gamma processes [START_REF] Tao | Optimum life-cycle maintenance strategies of deteriorating highway bridges subject to seismic hazard by a hybrid Markov decision process model[END_REF], Markov processes [START_REF] Bressi | Optimization of maintenance strategies for railway track-bed considering probabilistic degradation models and different reliability levels[END_REF], and compound Poisson processes [START_REF] Yang | Life-cycle management of deteriorating civil infrastructure considering resilience to lifetime hazards: A general approach based on renewal-reward processes[END_REF] have been adopted for modeling the time-dependent evolution of degradation indicators (e.g. scour, corrosion, etc.) of civil engineering infrastructures (e.g. building facades, railway networks, bridges, wind turbines, etc.). The choice of the degradation process model relies either on available failure data (e.g. recorded times-to-failure), degradation indicators classified or measured during periodic inspections, or on experts' judgments. Yet, a mathematical description of the physical mechanism underlying this process is often not available [START_REF] Biondini | Life-cycle performance of deteriorating structural systems under uncertainty: Review[END_REF]. Therefore, determining or justifying the choice of transition laws remains an issue while designing and implementing Petri nets models.

In the natural hazards domain and especially for protection works, few monitoring data are available. Therefore, one major potential difficulty in using SPNs is to figure out these transition laws in an effective and realistic way. Following the common classical approach, simple SPN models, with stochastic transitions following an exponential law, have been applied, as a starting point, on torrent check dams (Chahrour et al., 2019b,a). However, because of the criticality of these structures, it is essential to improve such introductory models by moving to something closer to reality.

From a dependability point of view concerning system safety and reliability, the modeling approach presented in this paper develops a contribution in order to cope with the poor knowledge about degradation transition laws. The proposed methodology aims to choose and justify probability laws for the transition times between the defined degraded states of a check dam structure, considering its real time-dependent deterioration mechanisms when being subjected to a time-series scenarios of torrential floods. As it is not possible to access extended and complete data sets, the principle is to explore the failure scenario through physics-based modeling. The information provided by these models are then used as an input to the SPN model which helps comparing the different maintenance strategies and choosing the best one in terms of cost and efficiency. In this study, the physics-based model is applied on a series of torrent check dams located in the Manival torrent in the French Alps and the SPN model is designed and applied to a single check dam in order to demonstrate its ability to support decision-making regarding maintenance strategies.

Concerning the failure mechanisms of civil infrastructures subjected to natural hazards, recent approaches focus on the phenomena of scouring under bridges' foundations due to flooding [START_REF] Tubaldi | A framework for probabilistic assessment of clear-water scour around bridge piers[END_REF][START_REF] Argyroudis | Fragility of transport assets exposed to multiple hazards: State-of-the-art review toward infrastructural resilience[END_REF]. However, available frameworks do not account for real time-dependent evolution of scouring, scour pit geometry, and the accumulation of damage due to scour (e.g. soil-structure interaction). The originality in the presented approach concerning the phenomena of scouring lies in (1) estimating the scour pit geometry considering the real behavior of the torrent's bed using physics-based modeling and (2) performing structural analysis in order to analyze the effect of scouring on the stability of check dams.

In the context of check dam's time-dependent deterioration modeling and maintenance decision-making, the direct contributions of the paper are the following:

1. Defining a new degradation indicator that synthesizes both functional and structural deterioration mechanisms of the dam taking into consideration the dynamic interactions between failure modes;

2. Proposing a physics-based deterioration model that analyzes the time-dependent evolution of the defined degradation indicator by moving from multi-scale physical and analytical hydraulic models to external stability analysis of the structure. 3. Providing a stochastic model of this evolution using petri nets tools and taking advantage of this model to assess the efficiency of preventive maintenance policies to be applied to the dam.

The structure of the paper is as follows: Section 2 presents the overall developed methodology for the timedependent deterioration and maintenance modeling of check dams. Section 3 provides (i) a description of a real case study related to the torrent to be analyzed and the check dam to be modeled and (ii) the results obtained after the execution of the model. Conclusion and perspectives are presented in section 4.

Modeling Methodology

This section covers the complete methodology used in this study. It provides a comprehensive methodology used to tackle the scientific obstacles, the research approach, the quality of collected data, the techniques used for the analysis, and the limitations of the adopted tools and methods. First, an overview of the global methodological framework is presented. After, a detailed description of each sub-step involved in the methodology is provided.

Global framework description

To assess the different maintenance strategies, the degraded states at which the check dams are likely to be found during their lifetime (roughly between 50 and 100 years), should be analyzed. The ideal situation consists in using real data related to natural events and to the behavior of the structure when exposed to these events. Unfortunately, these data are often missing or imperfect (incomplete, imprecise . . . ). Defining a modeling hypothesis requires to make assumptions and to combine several sources of information coming from past experiences, historical data but also expert assumptions and assessments. Coping with information imperfection in natural risk assessment process cannot be avoided. The principle of the approach is therefore to create a fictive series of floods occurring over the considered lifetime and to check the time-dependent stability level of the dam taking into account the effect of local scouring.

In practice, the modeling process follows the different steps below, detailed in the following subsections and illustrated in fig. 4.

(a) Torrential system features definition: defining the torrent's geometry, its characteristics, and its location and describing the protection system (series of check dams);

(b) Events series generation: assuming a series of flood events with defined dates and peak discharges over a specified period of time (use of existing time series if available);

(c) Events consequences and resulting functional and structural failures analysis: modeling the evolution of the torrent's bed, estimating the potential scouring under the dams depending on the global and local hydraulic conditions, and assessing the external stability of the dams after each flood event involved within the series of events.

(d) Stochastic deterioration and maintenance modeling: proposing a stability state indicator, defining degradation states at which the dams may reside, estimating empirical non-parametric probability laws corresponding to transition times between those states, and analyzing the behavior of the dam when subjected to deterioration mechanisms and to maintenance operations.

From torrential hydraulics numerical modeling to check dam's stability assessment 2.2.1. Understanding the physics and modeling the evolution of the global torrent's bed

For classical water floods, the only parameters of interest are linked to water (height, speed, extension area). In mountain rivers, sediment transport becomes indeed considerable and impacts the morphology of the torrent's bed and therefore the hydraulics of water which was the origin of this transport. Sediment transport assessment is indeed a key issue in torrential hydraulics characterized by steep slopes and relative shallow depths corresponding to a small ratio between water height and the grain size of bed [START_REF] Recking | Feedback between bed load transport and flow resistance in gravel and cobble bed rivers[END_REF]. Contrary to river plains characterized by a gentle slope and little deformable beds, hydraulics and sediment transport can hardly be dissociated in mountain rivers [START_REF] Recking | Hydraulique et transport solide[END_REF]. Physical laws of torrential hydraulics differ from classical hydraulics and require to use specific modeling tools able to simulate both water flows but and sediment transport. Spatialized analysis of both water hydraulics and sediment transport is needed since during the flood duration, some parts of the torrent will be eroded while some others will be filled by sediment deposition. Longitudinal and lateral erosion in the bed and banks can also generate destabilization of lateral slopes. In addition to the global bed's slope evolution, local scouring will be observed as soon as a water acceleration occurs such as in the case of check dam waterfalls. A scouring pit will be formed inducing a possible destabilization of the structures' foundations because of soil removal. Moreover, the large volume of transported sediments will be deposited somewhere raising the bed level and thus causing overflows.

Improving scientific knowledge of the phenomena linked to torrential hydraulics is still under progress. In addition, developing methods and tools, combining modeling and expert assessments, for this type of natural risk, is a paramount issue to manage those risks [START_REF] Meunier | Eléments d'hydraulique torrentielle[END_REF][START_REF] Rickenmann | Comparison of bed load transport in torrents and gravel bed streams[END_REF][START_REF] Recking | Theoretical development on the effects of changing flow hydraulics on incipient bed load motion[END_REF]. Softwares have been released to study those kinds of phenomena [START_REF] Iber | GEAMA, Flumen Institute and CIMNE[END_REF]. LOGICHAR [START_REF] Laigle | Logichar[END_REF] is a simplified (finite differences) numerical 1D model, developed by INRAE (ETNA team), in order to predetermine the evolution of the torrent's bed during torrential floods on the basis of hypotheses and scientific knowledge related to torrential hydraulics and existing sediment transport laws.

The geometry of the torrent is represented by a series of reaches with a given slope, grain size distribution and rectangular or trapezoidal sections. Water and sediment hydrographs are injected at the top of torrent. The hydraulics and sediment transport are coupled and calculated continuously in successive loops for any point of the simulated torrent's bed: water induces sediment transport, which changes the slope modifying the hydraulics.

The basic data required as inputs to LOGICHAR (fig. 5, (a)) concern the:

• Torrent's geometry: the longitudinal profile is defined by a series of nodes with an abscissa measured from downstream as well as the slope of the reach. Each node corresponds either to a border between two reaches with different characteristics or to the presence of a protection structure. Between two consecutive nodes, the cross section is defined by its shape (rectangular or trapezoidal), channel width, and the heights and slopes of the banks.

• Protection structures: a check dam can be added as a hydraulic singularity on the longitudinal profile characterized by the height observed under the weir of the dam.

• Torrent's bed characteristics: for each specified node, it is necessary to define the thickness of the erodible layer above the substratum. Then, for each reach, the grain size distribution ( 30 , 50 , 90 , and ) of the erodible layer should be defined. Note that the value reveals that % of solid materials have a diameter which is less than this value.

• Flood's water and solid hydrographs: For a simple (triangular) flood, the liquid and solid hydrographs are constructed based on the peak water and solid discharges respectively, duration of flood, and the time at which the peak discharges are reached.

• Simulation settings: these settings are related to the discretization of the longitudinal profile, the time step of calculation, and to the choice of sediment transport formulas (Rickenmann, Meunier, Lefort, or Recking).

Step 1: Geometry characterization, flood scenario definition, and randomness generation

A simplified geometry and sediment characteristics are considered in the model in which the torrent's longitudinal and transverse profiles, the implemented check dams' structural design, and the grain size of the torrent's materials are given (fig. 4,(a)). Regarding the flood scenario, the objective is to re-create a time series of realistic floods which will occur randomly during the check dams' lifetime. In this context, the evolution and the level of failures that check dams are subjected to, should be analyzed. This enables fitting probability laws for transition times between different check dam's states of degradation.

Consequently, scenarios must be generated by choosing random variables of , , . . . corresponding to uncertain parameters involved in the model. In this study, randomness is applied to create a scenario (series) of successive flood events, each of them being randomly characterized by the peak water and solid discharges and its date of occurrence . The choice of probability laws and their associated parameters used to create those specified random variables is based on available data and expert assumption. Using drawn realizations from these probability distributions (using Matlab, R, etc.), scenarios are generated noting that in each scenario, different numbers of flood events can probably occur during the specified lifetime period.

Step 2: Numerical modeling via LOGICHAR

The defined scenario makes it possible to launch a numerical simulation via LOGICHAR. Each event series scenario, defined over a specified period of time (e.g. 100 years), is modeled separately. However, a single water and solid hydrographs include the series of flood events considered within the same scenario as shown in fig. 4,(b). It is true that each flood event within the series of events has an associated date of occurrence. Yet, in LOGICHAR, there is no need of a time separation between two consecutive events due to the fact that the torrential system remains stable during this period of time. However, it is very important to specify the duration of each flood event and the time needed until reaching the peak discharge. Concerning the choice of sediment transport formula, it depends on the studied case and should be assessed by experts. After each simulation, the results of the corresponding scenario are obtained.

After inserting the inputs, one can choose scan points (spatial and temporal) at which the operator wants to see the outputs at. Once the simulation is executed, results appear in the form of graphs and tables. For each chosen temporal scan point, the outputs include the water height ( ), water velocity ( ∕ ), slope ( ∕ ), initial bed level ( ), actual bed level ( ), and solid discharge ( 3 ∕ ) along the whole torrent. Besides, for each chosen spatial scan point, the same previous mentioned outputs are also given over the whole flood duration.

As many other tools, this software has some limitations (fig. 5,(b)). Being a 1D model, LOGICHAR represents check dams as simple vertical walls, not taking into consideration the lateral dimensions of the hydraulic weir by which the flow is supposed to pass. In addition, check dams are considered as local hydraulic singularities and a cautious interpretation of the results close to the dams is needed. The model is able to represent the global bed evolution but very local effects may not be fully relevant especially in scan points that are too close from these singularities. Consequently, the results corresponding to abscissas that are very close to the dams show a local artefact due to the sudden variation in the slope caused by the presence of the dam (vertical slope). To get a realistic and usable outputs, spatial scan points should therefore be chosen far enough from the dam. Moreover, the bed level upstream the dam is fixed to the level of the dam's weir crest. Hence, deposition and erosion, do not occur at the level of the dam from the upstream unless the dam is totally buried by sediments. One last remark concerns the discretization settings, in which if not properly adjusted, the software diverges.

Step 3: Local scouring estimation

Local scouring corresponds to soil erosion downstream or under a structure's foundation, in which the soil is removed by the flow, creating a scour pit whose dimensions depend on the flow energy, solid transport, and bed grain size distribution. In fact, clear water condition leads to larger ultimate scouring depths than other flow conditions [START_REF] Prendergast | A review of bridge scour monitoring techniques[END_REF]. Different approaches exist to consider scouring in the design phase of check dams [START_REF] Deymier | Conception et calcul de barrages de correction torrentielle[END_REF]. The most secure approach (but possibly costly) is to set the foundation as least as deep as the maximum expected depth (vertical dimension) of the scour hole [START_REF] Comiti | Local scouring at check-dams in mountain rivers[END_REF]. Consequently, predicting the maximum scour depth is required to design adequate foundations of check dams. The scour pit develops itself with a slope which can lead to soil removal under the check dam's foundation, inducing a possible external stability failure.

Several approaches and tools based on complex relationships among hydraulic, geometric, and sediment variables have been developed in order to estimate the size of the scour pit. Two reliable methods, commonly used in torrent protection structures context, are those developed by VAWE and SOGREAH [START_REF] Couvert | Etude générale sur les seuils de correction torrentielle et les plages de dépôts[END_REF]. More recent tools, based on laboratory experiments and field measurements have been proposed by [START_REF] Comiti | Local scouring at check-dams in mountain rivers[END_REF]. The empirical equations and a simple description of each of these methods is presented below: VAWE method (1967 -1970): this bi-dimensional model calculates the depth and the length of the scour pit. With no sediment transport, the two dimensions are given in terms of the unit discharge , hydraulic drop ℎ , and the grain size of the bed 95 . In the presence of sediment transport, the depth of the scour depth ′ can be computed as a function of as represented by eq. 3.

= 0.88

√ ℎ 0.686 0.372 95 ( ) (1)
= 0.879

√ ℎ 0.914 0.828 95 ( ) (2)
′ = 0.69 + 0.79 95 ( ) (3)
SOGREAH method (1989): this three dimensional model calculates the depth ℎ , length ℎ , and the width ℎ of the scour pit. The tests were carried out on bed slopes between 2 and 10 %. An initial analysis of the results made it possible to validate the VAWE formula in the absence of sediment transport. However, the results diverge from those obtained by VAWE in the presence of sediment transport. Consequently, this approach starts from the VAWE formula with no sediment transport and incorporate correction coefficients ( , ′ , and ′′ ) in order to take into account the additional dimension and three-dimensional effects related to the flow contraction. The correction coefficients are extracted from an abacus [START_REF] Couvert | Etude générale sur les seuils de correction torrentielle et les plages de dépôts[END_REF] depending on a dimensionless contraction coefficient given by eq. 4.

= * ℎ 2 (4)
where is the hydraulic head, = + is the width of the weir at the level of the water, and is the width of the weir's base. Hence, the three dimensions of the scour pit can be obtained by the following equations:

ℎ = * ( ); = ( ) (5)
ℎ = * ′ ( ); ′ = ( ) (6) ℎ = * ′′ ( ); ′′ = ( ) (7)
Comiti method ( 2013): D'Agostino and Ferro proposed an equation that estimates the scour width calibrated on laboratory data on single structures with null bed slope downstream [START_REF] Ferro | Scour on alluvial bed downstream of grade-control structures[END_REF]. Comiti et al. developed further this equation by taking into consideration the case of a sloping bed. In contrary to VAWE and SOGREAH approaches, the scour pit depth is measured from the level of the bed and not from the level of water downstream the structure. The simplified equation of is given by eq. 8.

= 2. 0.59

2.34 Δ 90 -0.09 ( ) (8)
where is the drop height, is the channel width, 90 is the grain size for which 90% of the sediment in weight is finer, and Δ is the sediment relative submerged density (Δ = -).

Fig. 6 illustrates the scour pit geometry and the main parameters used for estimating its dimensions in SOGREAH and Comiti approaches. The plots are extracted from the work of Tacnet and Vecchio [START_REF] Tacnet | Prise en compte de l'incertitude dans l'expertise des risques naturels en montagne par analyse multicritères et fusion d'information[END_REF] and of Comiti et al. [START_REF] Comiti | Local scouring at check-dams in mountain rivers[END_REF]. However, simple modifications in the parameter's names used in each of the plots are performed in order to unify the names for the sake of simplicity.

In fact, SOGREAH method overestimates the scour pit depth when compared to Comiti aproach. Yet, only SO-GREAH permits calculating the three dimensions of the scour pit. In the present study, the dimensions of the scouring pit are estimated by combining both approaches of SOGREAH and Comiti et al. in which ℎ is updated by using instead of . Note that is the sum of the maximum depth of the scour pit estimated by Comiti et al. approach and the downstream water level ( = + ℎ ). The key parameters necessary for checking the stability of the dam are the depth (horizontal dimension) and the width of local scouring (material removed) under its foundation. is equal to ℎ which can be calculated using eq. 6. On the other hand, the estimation of highly depends on the depth and the observed (or assumed) upstream slope of the scour pit which can vary depending on the soil properties. SOGREAH assumes a trapezoidal scour pit with sides of slope 1∕1 as shown in fig. 6. With an upstream slope of 1∕1 and using the hydraulic formulas given by eq. 9, the calculation of is based on simple geometry calculation as follows:

⎧ ⎪ ⎪ ⎪ ⎨ ⎪ ⎪ ⎪ ⎩ = √ 4 3 ℎ + = ℎ + 2 2 ℎ = ( + ) - -ℎ (9)
where is the distance between the base of scour pit and the edge of the dam's wall, ℎ is the downstream water level, ℎ is the upstream water level, is the water velocity, is the height of the dam under the weir, = + is the bed level after event i, is the initial bed level, and is the drop between the bed levels. is then computed by the following set of equations:

= ℎ if ( - ) < ℎ - otherwise (10) = if ( - ) < ℎ + ℎ - otherwise (11) = if < 0 0 otherwise (12)
where is the water height in the scour pit at the level of the dam, and is the scour pit height under the dam's foundation at the edge of the dam's wall. Fig. 7. represents the scour pit geometry of the developed approach and it illustrates all the previously mentioned parameters required for the calculation of local scouring dimensions and .

Step 4: External stability verification

The generated scour pit reduces the length of soil supporting the foundation and induces an increase in constraints which can cause a structural failure of the dam. For the calculation of check dam's stability, the maximum scour pit depth attained during a flood event is considered. In other words, the values of the variables required in the computations are extracted at the time at which maximum scour pit depth occurs (scouring critical state). In addition, based on the the peak discharge of each flood event within a series of floods, the dimensions of local scouring attained after a specific event could be lower or higher than those attained in the previous event. In this study, it is also assumed that the torrent's bed is stable between events and that the refilling of materials in the scour pit caused by sediment transport does not have a positive influence on the stability of the structure. In other words, even if the scour pit looks as having been refilled, the refilled materials may be loosely compacted. Therefore, and are assumed to be monotonically increasing after each event meaning that the maximum values of and/or attained among all the past events are considered in stability calculation.

In this study, the internal stability of the dam is not analyzed. For studying the external stability of a check dam, the dam is classically considered as a fully rigid structure with no internal deformation of its body. Rules and parameters for stability justification depend on national or international standards such as Eurocode and may differ through the choice of security factors, weights of loads depending on considered combinations. In the present study, the calculation principles and the safety factors used are based on a French standard (Groupe de travail, 1993) and should be considered as a methodological example. The principle of justification is described as follows (fig. 8):

1. Collecting (or assuming) geotechnical data (e.g. soil bearing capacity, internal friction angle) and design data (e.g. structure's dimensions); 2. Defining loading situations and computing related actions for each of them; 3. Computing the stabilizing and overturning moments with respect to the point of application chosen at the downstream base of the foundation; 4. Computing the horizontal and vertical components of the resulting force , its eccentricity , and its vertical inclination angle ; 5. Evaluating the soil permissible stress and determining the diagram of normal stresses applied on the soil which results in the soil reference stress ′ .

After that, the three equilibriums below must be verified in order to justify the external stability of a torrent check dam [START_REF] Deymier | Conception et calcul de barrages de correction torrentielle[END_REF].

Soil bearing capacity: this stability corresponds to the ability of the soil below the foundation to withstand the stress caused by the vertical loads above it. To avoid soil rupture, the following condition should be verified:

> ′ (13)
For simplification, external stability is generally justified according to a 2D hypothesis. Stability is checked for cross sections chosen (e.g.) in the central part of the weir, at the edge of the weir or at the end of lateral wings.

For each of these sections, the calculation of ′ is based on a normal stress diagram depending on the vertical resultant force and its eccentricity , considering somewhere the soil as a beam submitted to simple bending with compression. However, in the case of local scouring, the 2D hypothesis is not valid since soil is removed in the central part of the foundation. Another method is proposed to calculate and redistribute the constraints on the part of the foundation remaining in contact with the soil. The stress is therefore redistributed on the non-scoured soil and is estimated using the moment of inertia of the reduced area of foundation as shown in fig. 9. The moment of inertia around the vertical axis depends on the abscissa of the center of gravity and the area ′ of the foundation which is still in contact with soil after scouring (eq. 14). Note that for each flood event, , ′ , and have different values depending on the variation of and .

⎧ ⎪ ⎪ ⎪ ⎨ ⎪ ⎪ ⎪ ⎩ = 1 3 [ 3 - + - 3 ] -′ . 2 ′ = - + - = 1 2 ′ [ 2 - + - 2 ] (14)
Having calculated , the maximum and minimum stresses can be estimated using eq. 15. If > 0, the soil under the foundation is totally compressed. On the other hand, if < 0, the soil under the foundation is partially compressed and is considered equals to zero since it is assumed that no tension exist in the soil. Finally, ′ is given by eq. 16.

⎧ ⎪ ⎨ ⎪ ⎩ = ′ + ( -) = ′ - . ( 15
)
where = . is the moment around the centroidal axis. Check dam overturning: Failure by overturning occurs when the overturning moment exceeds the stabilizing moment . To avoid overturning of a check dam, a factor of safety of at least 1.5 is considered and the following condition should be verified:

′ = 1 4 [3 + ] (16)
≥ 1.5 (17)
In case of local scouring, stability against overturning is affected only if the scouring width is equal to the total length of the foundation ( = ) which confirms that this justification is a bit theoretical. In such case, the axis of rotation is shifted inward as shown in fig. 9 reducing significantly the stabilizing moment. In practice, the reduction of compressed length will first induce a failure because the applied stress will exceed the permissible constraint.

Check dam sliding: Failure by sliding occurs when the horizontal force exceeds the maximum resisting friction force that opposes sliding , at the contact between foundation and soil. is estimated based on load combination as given in eq. 18.

= .

1 + . ′ 2 (18)
To avoid sliding of a check dam, the following condition should be verified:

≤ ( 19
)
where ′ is the compressed width of the foundation. is the soil cohesion. is the friction angle of the soilfoundation interface. is set equal to the friction angle of the soil for cast-in-place concrete foundations and maximally set to 2 3 for pre-cast foundations. 1 and 2 are ULS safety factors set to 1.2 and 1.5 respectively.

Step 5: States definition and transition laws

A check dam is evolving progressively from initial state to states with single or multiple failures. Knowing the condition of each failure, it is required to define a state indicator for each type of failure transforming continuous values (e.g. safety factor) into discrete states. The principle is therefore to link an interval of measured values with the different states. Moreover, the global indicator of the check dam should combine all possible causes of failure. For example, a check dam may fail by overturning while having no problem in soil bearing capacity. Consequently, all types of failure should be considered together while analyzing the stability of a check dam. To aggregate and consider all possible causes of failure, a global state indicator is proposed. It is based on normalizing the state indicators of all the failure mechanisms mentioned in section 2.2.5 as follows:

⎧ ⎪ ⎪ ⎪ ⎨ ⎪ ⎪ ⎪ ⎩ = -′ = - = - (20)
where is the bearing capacity stability ratio, is the overturning stability ratio, and is the sliding stability ratio. The normalization is performed so that all the state indicators fit in the same interval [0, 1] in which 0 corresponds to a failed state and 1 corresponds to a state with maximal stability level (initial new state). The global non-dimensional state indicator is assumed as:

= 3 √ . . ( 21
)
Eq. 21 reveals that the structure is in a failed state when at least one of the state indicators of the considered failure mechanisms reaches a failed state. In the present study, four different states are considered and described below. These intervals are resulting from an expert choice and could of course be discussed and modified:

• State 1: initial to good condition with 2 < ≤ 1

• State 2: poor condition with 3 < ≤ 2

• State 3: very poor condition with 4 < ≤ 3

• State 4: failed condition with = 4

where 1 = 1, 2 , 3 , and 4 = 0 are the global state indicator thresholds. The intermediate thresholds 2 and 3 are to be defined later.

Due to the fact that the scenarios are generated based on stochastic inputs of the floods, transitions between these states will therefore be stochastic. Therefore, the next step consists in modeling the evolution of the maintained system from one state to another through this stochastic process using stochastic Petri nets.

Deterioration and Maintenance Modeling: Stochastic Petri net (SPN) approach

In the present study, the end purpose of developed model is to support maintenance decision-making of protection systems. Strategies may differ depending on several aspects such as inspecting less often, waiting the degradation to be more severe and then repairing, or detecting and repairing at early stages. For infrastructures' managers, the issue is to choose the best economic solution, having in mind also that the longer is the default period, the higher is the risk on protected assets and people downstream. Maintenance decisions are mostly made on the basis of qualitative information provided by experts and feedback data based on the functional and dysfunctional analysis of the system. Petri nets (PNs) [START_REF] Signoret | Dependability & safety modeling and calculation: Petri nets[END_REF] incorporating condition-based maintenance (CBM) [START_REF] Alaswad | A review on condition-based maintenance optimization models for stochastically deteriorating system[END_REF] aim in representing how the system moves from a low to a high degraded state considering possible deterioration mechanisms and maintenance actions. Indeed, regular inspections are performed in order to detect the state of the system based on a specified degradation indicator (e.g. global stability indicator of the dam ) whose evolution can be modeled as a function of time (fig. 10). For such kind of indicator, experts can specify thresholds or critical values and associate them to intervals. Each interval corresponds to a degraded state of the system. Depending on the observed state, the decision may be either a preventive, or a corrective maintenance, or neither. This permits making choices based on quantitative criteria describing the performance of several maintenance strategies proposed.

PNs are capable of representing discrete states of the system and transitions between these states (fig. 11). A PN model mainly consists of four different elements:

Places: represented by circles. They correspond either to states that reflect specific conditions of the system conditions or to resources that need to be met or to be available before an action can be carried out. Tokens: symbolized by small solid (black) circles. Their presence in a given place means that the corresponding condition is fulfilled or that a resource is available.

Transitions: represented by rectangles. They correspond to events/actions that occur after a specified time. They are responsible for the movement of tokens from one place to another.

Arcs: symbolized by arrows. They link places to transitions and vice versa. Each arc in the model should be associated with a multiplicity (natural number). If the multiplicity is not shown above the arc, this means that it is by default equals to one.

Stochastic Petri nets (SPNs), are an extension of PNs that take into account stochastic variables, in which the transitions are associated to probabilistic distributed firing times. Generally, for SPNs, the principle of Monte-Carlo simulation is used. Once the SPN model is constructed and the lifetime period of the system (duration of simulation) is identified, Monte-Carlo simulation starts and the tokens keep on moving around the model until is reached. However, the movement of tokens is governed by a transition firing rule. In fact, a transition is enabled if all of its input places contain a number of tokens at least equals to the multiplicity of the arc connecting those places to . In addition, for a transition to be enabled, it should not be under the action of an inhibitor arc. Inhibitor arcs are special type of arcs usually represented by dashed arrows and can be only directed from a place to a transition. If the transition is connected to an inhibitor arc and the input place attached to this arc has a number of tokens equals to the multiplicity of the arc, the transition will be inhibited from being enabled. When the transition time is reached, the enabled transition fires and the tokens in its input places move to its output places. Applying this kind of simulation and repeating the draw of a random value several times, provide statistical estimates of specific quantities such as the mean residing time of tokens in each place and the average number of firing of each transition.

The SPN model developed for providing a stochastic deterioration and maintenance modeling of a check dam is represented in fig. 12. Its global framework involves degradation, inspection and maintenance processes.

Degradation process

The states describing the evolution of the system are represented by places 1 -4 as shown in fig. 12. These places correspond to the states defined in section 2.2.6 in which 1 , 2 , 3 , and 4 correspond respectively to a good, poor, very poor, and failed condition of the system. At = 0, the system is in its initial-new state. Hence, as a starting point, a token is added to 1 revealing that the system is initially in a good condition. The stochastic transitions -( 1-2 , 1-3 , 1-4 , 2-3 , 2-4 and 3-4 ) link between states i and j. The firing delay times corresponding to these transitions should be given as probability distributions. The probability laws of these transitions can be built, based on the dam's deterioration trajectories across its defined states, using non-parametric estimations [START_REF] Kaplan | Nonparametric estimation from incomplete observations[END_REF]. The physics-based model presented in section 2.2, provides observations of the dam's deterioration trajectories.

Inspection process

In order to detect the state of the system, inspection must be carried out periodically over a specified period of time.

is the firing delay time of transition 5 linked to places 5 and 6 which correspond to the inspection process. At = 0, a token is added to 5 . When is reached, 5 is fired and the token in 5 travels to 6 in which inspection takes place. Consequently, depending on the current state of the system, one of the immediate transitions 6 , 7 or 8 will immediately fire. Moreover, after the immediate firing of 6 , 7 or 8 , 4 fires immediately so that the token in 6 returns to 5 waiting for another inspection to take place after another years. For avoiding the conflict between the firing of 4 with 6 , 7 or 8 , priorities should be assigned to transitions. Hence, a lower priority is given to 4 in order to ensure the firing of 6 , 7 or 8 first.

Maintenance process

Depending on the state of the system, different maintenance operations can be performed in order to restore the system to its initial state. A condition-based maintenance policy is applied in this model in which each degraded state corresponds to a maintenance operation. Places 7 -9 represent the states revealed after inspection. If a token is present in 7 , 8 or in 9 , maintenance operation 1, 2 or 3 is required respectively. Following maintenance, transition 9 , 10 or 11 fires and returns the token back to 1 . The firing delay times associated to Transitions 9 -11 represent the time needed to schedule and carry out the work. Note that all maintenance operations presented in this model are considered to be perfect in which, after their application, the system is restored to the initial new state.

From state 1, the system can move either to state 2, 3 or 4 depending on which of the associated transitions ( 1-2 ,

1-3 and 1-4 ) fires first. While the system resides in state 1, no maintenance operation is required. If the system is in state 2, a token is present in 2 and three possible pathways exist. If transition 6 fires first, the token in 2 moves to 7 meaning that the system is inspected and maintenance operation 1 will be carried out. However, if transition 2-3 or 2-4 fires first, the token travels to 3 or to 4 respectively, meaning that the system has degraded to state 3 or to state 4 before being inspected. Similarly, if the system is in state 3, a token is present in 3 and may either move to 8 (maintenance operation 2 to be scheduled) if 7 fires first or to 4 (failed state) if 3-4 fires first. Finally, if the system is in state 4, a token is present in 4 and only 8 can be fired. The system waits for inspection to occur and maintenance operation 3 will be applied.

Decision-making support for choosing maintenance strategies

In order to make a decision and to choose between several proposed maintenance strategies, inhibitor arcs may be added to the model. One could for instance decide to compare strategies without intermediate maintenance operations, waiting for the system to be completely out of order to proceed to a corrective maintenance. The addition of places 10 and 11 , linked to inhibitor arcs, permits simulating different maintenance strategies. The presence of a token in 10 inhibits the firing of transition 6 . Consequently, maintenance operation 1 is not permitted and the system is allowed to degrade further to state 3 with no prior maintenance. Similarly, if a token is added to 11 , 7 is inhibited and maintenance operation 2 will not be allowed.

Based on Monte-Carlo simulations, the model provides for each maintenance strategy:

• the time spent by the system in each of the defined states;

• the number of maintenance operations performed for each type of maintenance.

Such outcomes can be adequate for making a decision regarding the most suitable maintenance strategy to be applied to a system depending on available resources. In fact, knowing the cost of each maintenance operation, the total cost of each maintenance strategy can be computed. Hence, the strategies can be sorted in terms of cost and maximum availability (total time spent in non-failed state).

Application: Development and Evaluation of a Complete Check Dam Model

In order to illustrate the abilities of the developed model and to achieve results with relevant order of magnitudes, it is essential to apply it on a real case study. The Manival torrent, located at 45°17'N, 5°49.75'E and close to the city of Grenoble in the Chartreuse Mountains of the Northern French Prealps, is chosen for this purpose.

Manival torrent description

The Manival flows intermittently into the Isère River in the Grésivaudan valley. It is a very active torrent characterized by a steep slope and high sediment potential, highly prone to bedload transport and to debris flows [START_REF] Theule | Sediment budget monitoring of debris-flow and bedload transport in the Manival Torrent, SE France[END_REF]ONF-RTM, 2016;[START_REF] Bel | Analysis of debris-flow occurrence in active catchments of the French Alps using monitoring stations[END_REF]. Frequent debris floods events (once every one year since 2008) flow throughout the main channel and deposit into the 25 000 3 sediment retention basin which was built in 1926 in order to protect the urbanized alluvial fan against debris flows. The solid materials related to bedload transport can be defined as gravel wedges with well sorted grain size distributions. The entire torrent extends to more than 7 and is fortified by an integrated protection system composed of approximately 180 check dams constructed since the 1890s, an open check dam constructed in the 1992 as a completion of the sediment retention basin, and several lateral earth or concrete dykes. All protection structures are monitored and managed by the French national forest office in charge of torrent control in the Isére department (ONF-RTM(38)). In the present study, the reach downstream the sediment retention basin is considered. It starts from the open check dam and extends about 1km downstream towards the alluvial fan as shown in fig. 13. It contains 39 transverse check dams having different dimensions and made up of built in place or prefabricated reinforced concrete. In addition, 2 lateral dykes, made up of reinforced concrete and earth materials are implemented directly downstream the sediment retention basin.

Numerical modeling inputs and data sources

The entire reach under study is modeled using LOGICHAR software. The data in table 1 are extracted from the ONF-RTM database that contains information regarding the longitudinal profile, channel section, and grain size distribution of the Manival (ONF-RTM, 2016). Moreover, the RTM GIS survey performed in 2009, allows to locate the 39 check dams along the longitudinal profile and to estimate the observed height of each dam. The erodible layer under each dam is assumed to be equals to 2m. However, local scouring can go beyond this value. Regarding sediment transport, Rickenmann equation is considered [START_REF] Rickenmann | Hyperconcentrated Flow and Sediment Transport at Steep Slopes[END_REF].

Besides, it has been found, based on the RTM study of 2009, that the average discharge in the studied reach corresponding to 10 return period is 10 = 5 3 ∕ . For choosing the scenario corresponding to a series of events, it is considered that the studied reach is subjected only to clear water floods. This is justified by the fact that the solid materials flowing from the upstream are trapped in the sediment retention basin while assuming that the open check dam is totally blocked by large sediments. Consequently, upstream sediment inputs in all flood events are neglected. The hydrographs are assumed to have a triangular shape with a peak discharge attained at half time of the flood event. Each flood event within the event series is assumed to last 1 ℎ . Over a period of 100 , only events of return period 10 are considered in the modeling. The dates of the events and the value of the peak discharge corresponding to each event are obtained by random draws using a Poisson law ( = 1 = 1 10 ) and Gamma law ( = 5, = 1, * = 10 ) respectively. The number of scenarios to be considered was chosen on the basis of (i) observing convergence in the estimated empirical distribution laws of the stochastic transitions and (ii) keeping a reasonable size of data. Indeed, the generation of 50 scenarios fulfills both mentioned conditions. Therefore, 50 different scenarios, corresponding to 50 different event series, are obtained. As an example, the data obtained by random draw, corresponding to the first scenario is given in table 2. In fact, the dates of the events are not necessary input to LOGICHAR since the variation in the torrent's bed only occurs during a flood event while it remains constant between two consecutive events. Hence, it is relevant to simulate a fictive series (events one after another) taking into consideration only the duration of the flood as shown in fig. 14. However, the dates of the events are still required in order to estimate the time spent by the dams in each of the defined states over the 100 lifetime period.

Table 2 Dates and peak water discharges of all flood events within an event series occurring over a period of 100 -Scenario 1. All the previously mentioned data are used as inputs into LOGICHAR in order to execute simulations. The results of the LOGICHAR modeling will be the input for scouring and stability calculations.

Concerning the calculation of local scouring under check dams, up to now, only the geometry of the scour pit downstream the wall of the dam is analyzed by researchers since it is not recommended to allow scouring under foundation while designing a check dam. The extension of scouring under the dam and its local effect does not exist in the literature. The objective in this study is somehow different since it deals with failure analysis requiring to propose specific assumptions for the scour pit geometry under the foundation. As shown in fig. 7, the slope of local scour under the dam is assumed to be 3∕1, considered to be steeper than the scour pit slope which is given and proved to be 1∕1 based on the non-dimensional scour pit profile resulting from the experimental work of [START_REF] Gaudio | Morphological effects of bed sills in degrading rivers[END_REF]. In addition, the maximum value, corresponding to the most intense flood event among all the defined scenarios, of the contraction coefficient (eq. 4) is computed and used in all scenarios. Hence, for simplicity, same values of , , ′ , and ′′ are used in the modeling.

In the studied reach, 3 large reinforced concrete check dams ( > 2.5 ) exist. All the other structures are considered as small check dams constructed close to each others in order to limit the incision of the torrent's bed. In this paper, the external stability of one of the large reinforced concrete check dams is analyzed (#54 in the Manival torrent). The dam under study is located about 70 downstream the open check dam. The analysis of stability is done on the entire check dam body. For more safety, the dam is assumed to be completely filled by sediments from the upstream, with no angle of inclination between the soil and the dam (fig. 15). In addition, the soil is assumed to be not saturated (drained condition). The dimensions of the dam and the soil properties are summarized in table 3.

Note that all the assumptions made regarding the missing data or for the sake of simplicity, are assessed by experts in the field.

SPN model and maintenance strategies

The SPN model is implemented and evaluated using GRIF-Workshop (GRIF, 2018) developed by TOTAL and SATODEV. The GRIF package, related to the Petri module, uses the MOCA-RP computation engine (Monte-Carlo and Petri nets).

The SPN model presented in fig. 12 has been used for representing the evolution of the check dam under study. Regarding the three maintenance operations 1, 2, and 3, described in section 2.3.3, which correspond to states 2, 3, and 4 respectively, the following types of operations are chosen:

• Maintenance operation 1: minor preventive maintenance in which the scoured area can be refilled by earth material (e.g. rock or concrete riprap);

• Maintenance operation 2: major preventive maintenance in which anchor ties (steel beams mortared at the end) can be installed. In addition, cantilever supports made of reinforced concrete can be constructed in the worst case (more expensive);

• Maintenance operation 3: corrective maintenance in which the system should be reconstructed.

In the current application, it is assumed that only three minor operations and two major operations can be performed prior to a corrective operation. In other words, after carrying out three minor operations and two major operations on the check dam, minor and major maintenance will be inhibited. However, as soon as a corrective maintenance is performed, minor and major operations will be allowed again. These constraints are incorporated into the SPN model presented in fig. 12 by the addition of 12 and 13 . As soon as three tokens are present in 12 , 6 will be inhibited from firing and thus no minor operation can take place. Similarly, if 13 already contains two tokens, 7 will be inhibited from firing and major operations are prevented. In addition, transition 11 also acts as a reset transition, in which upon its firing, the tokens in 12 and 13 are removed so that minor and major operations can again be performed after carrying out a corrective operation. Reconstruction of the dam is estimated to cost around 150, 000 €. Minor and major operations are estimated respectively as 5% and 50% from the cost of reconstruction. The deterministic transition times of fig. 12, corresponding to the inspection frequency ( 5 ) and the scheduling and work time of each maintenance operation ( 9 , 10 , and 11 ), are assessed and presented in table 4. In order to achieve the objective of supporting decision-making for check dam's maintenance, four different maintenance strategies are defined to be compared and sorted. The strategies are analyzed during a period of 100 .

1. Strategy 1: all maintenance operations are allowed. 2. Strategy 2: minor maintenance is inhibited.

3. Strategy 3: major maintenance is inhibited. 4. Strategy 4: only corrective maintenance is allowed.

Model Execution, Results, and Discussions

While modeling the evolution of the torrent's bed over 100 via LOGICHAR, the duration of simulation depends on the total duration of all flood events involved within the event series of each scenario. Hence, the duration of simulation varies from one scenario to another depending on the number of flood events in the scenario. However, the simulations are controlled by three parameters. The calculation time step is set up to 0.2 , the longitudinal profile is divided into 2000 cells, and 10 observations per hour are resulted as an output (result every 0.1h). These parameters are chosen in a way that limits the duration of simulation for each scenario but still provides sufficient temporal and spatial calculation steps.

The 50 generated scenarios, having 50 different series of flood events are simulated via LOGICHAR. Figures 16 and 17 are examples of the major outputs corresponding to scenario 1. Fig. 16 illustrates the variation in the torrent's bed level along the entire reach as a function of time after being subjected to 8 flood events. It can be noticed that between = 550 and = 830 , the torrent confronts less variation in bed level than in the other zones. This is due to the existence of 25 small check dams separated by short distances aiming to limit bed incision. Fig. 17 represents all the results obtained at a specific chosen abscissa. It shows the variation of the water level, water velocity, slope, bed level, evolution in bed level, and solid discharge over time occurring downstream of the check dam under study. Similar outcomes are obtained for the other simulated scenarios.

These outputs enable modeling the evolution of the degradation indicator corresponding to the amount of scouring downstream and under the dam and the dam's stability level against bearing capacity problem, overturning, and sliding (fig. 18). The maximum depth of the scour pit downstream of the dam varies depending on the peak discharge of each flood event and on the amount of sediment transported. In other words the evolution of as a function of time is not necessarily monotonic. On the other hand, the local scour depth and scour width are assumed to evolve monotonically for the reasons mentioned in section 2.2.5. The indicators corresponding to the external stability justification also shows non-monotonic evolution over time. This is interpreted by the fact that these indicators are not only dependent on the local scouring dimensions, but also on the intensity of the flood event (e.g. impact load) that varies from one event to another and its dynamic effect vanishes by the end of the event.

Combining the three indicators , , and using eq. 21 results in the non-dimensional global state indicator . Fig. 19, shows the time-dependent evolution of for all of the generated scenarios. The dispersion in fig. 19,(b) reveals that the behavior of the dam varies depending on the flood events involved in each scenario. This in turn proves the necessity of stochastic modeling in order to integrate possible behaviors of the dam in the analysis. The intermediate states' thresholds are chosen taking into consideration the results of all the scenarios. Based on the rapid and gradual variation of the as a function of time, the global states of the check dam under study are defined: state 1: 1 ≤ < 0.7; state 2: 0.7 ≤ < 0.5; state 3: 0.5 ≤ < 0; state 4: = 0. The estimation of the time spent in each of the defined states, for all the simulated scenarios, provides a data set for each of the stochastic transitions that links between the states of the dam. From the obtained results, it was revealed that transitions from state 1 to state 3 or from state 1 to state 4 occurred only in few scenarios. In fact, 1-3 attained six values and 1-4 attained only three values. Because of their short data sets, it is assumed that each of 1-3 and 1-4 follows a log-normal law with a defined log mean and log standard deviation ( 1-3 ∼ Log-normal ( = 3.11, 2 = 0.17); 1-3 ∼ Log-normal ( = 2.68, 2 = 0.15)). On the other hand, for transitions attaining high number of observations (data sets with more than 20 values), an empirical cumulative distribution function (CDF) is obtained for each. Indeed, the CDFs of transitions 1-2 , 2-3 , 2-4 and 3-4 are estimated using Kaplan-Meier estimator. The obtained distributions of all stochastic transitions involved in the degradation process are used as an input to the SPN model. Each of these transitions has a probability of firing based on its attained number of observations. Moreover, in some scenarios, the dam reaches a specific state and do not evolve to a more degraded state over the duration of simulation (100 years). In such cases, there exist no transition between states and but an information that the dam stopped evolving after reaching state is revealed. These censored information are taken into account while estimating the CDFs presented in fig. 20). In the cases where censored information exist, the probability of moving from state i to state j does not reach the value 1.

Since the model follows a stochastic process, the number of simulations to be held is considered to be sufficient when convergence in results occurs. In this study, convergence is reached after 200 simulations for all of the defined strategies. Tables 5 and6 summarize the results obtained for each maintenance strategy modeled over a period of 100 years. Table 5 reveals the influence of each maintenance strategy on the mean sojourn time in the four defined states of the check dam. In strategies 1 and 3, the dam resides in the initial state (state 1) for a longer period of time when compared to strategies 2 and 4. This is due to the fact that in strategies 1 and 3, maintenance is applied as soon as the dam is no more in a good condition using minor operations. On the other hand, for strategies 2 and 4, where minor maintenance is prevented, the check dam remains in a poor condition (state 2) for a longer time. In strategy 3, since major maintenance is inhibited, the dam resides in a very poor condition (state 3) for a long time in comparison to the strategies where major operations are allowed. Concerning strategy 4 in which only corrective operations are authorized, the dam spends more time in the degraded states 2 and 3 compared to other strategies. The reason behind this is that the dam continues to deteriorate without any reparation until it completely fails and then it is replaced by a The statistics on the number of applied maintenance operations, provided in table 6, allow computing the total expected cost of each maintenance strategy. Fig. 21,(a) represents the box plots depicting data sets of the total cost of each strategy, obtained after the 200 simulations of the SPN model, through their quartiles. Fig. 21,(b) makes it easy to sort, compare, and to choose the best maintenance strategy based on the average expected cost of each maintenance strategy. The results obtained reveals that for the check dam under study, strategy 3 is the cheapest. This can be interpreted by the fact that the system is not allowed to deteriorate to states where expensive maintenance operations are required and it is directly repaired by minor operations which are less expensive than major ones. Strategy 2 is the most expensive because maintenance is applied only when the system reaches critical states (states 3 and 4) where expensive operations are required.

Conclusion

Main findings

In this paper, a dependability analysis of critical torrential protection structures is presented. The objectives of the study are achieved throughout several stages:(1) characterizing the structural and functional efficacy of check dams in resisting torrential phenomena in mountains; (2) describing the physics behind torrential floods and sediment transport in steep slopes torrents; (3) explaining the phenomenon of local scouring, considered as a main common failure of check dams, and identifying its interactions with other types of failures related to loss in the dam's external stability; (4) analyzing the time-based evolution of the torrent's hydraulic characteristics while being subjected to a series of flood events having different intensities using LOGICHAR tool; (5) modeling the dynamic deterioration of a check dam by estimating the transition times between its defined structural states based on the evolution of a global stability state indicator; (6) constructing a SPN model that integrates the degradation process (transitions between the structural states of the dam), inspection process (periodic inspection that reveals the state of the system), and the maintenance process (condition-based maintenance); and (7) simulating several maintenance strategies and computing the total cost of each.

The model has been applied on a real dam involved within a series of check dams located in the Manival torrent in the French alps. The results permit to compare, sort, and choose the most convenient maintenance strategy to be applied on the check dam taking into account the availability time of the dam in non-critical states and the total cost of each strategy.

The outputs of this work can be analyzed according to two domains: (1) Protection structures engineering and (2) Safety and reliability analysis and preventive maintenance.

From a thematic point of view related to protection structures engineering, while classical and existing methods focus on static assessment of the state/ efficacy of protection structures, the presented approach proposes a new dynamic vision of these infrastructures management during their lifetime which is completely new in the domain. Very few developments have been done to couple multi-scale hydraulic analysis (from global bed evolution to local scouring analysis) and civil engineering approaches. Some recent works [START_REF] Carladous | Approche intégrée d'aide à la décision basée sur la propagation de l'imperfection de l'information-application à l'efficacité des mesures de protection torrentielle[END_REF] have addressed the issue of protection works' efficacy. In this study, a way to define and quantify the different stability levels of protection structure is proposed. This is also not so common since classical design methodologies aim to calculate structures in order to comply with regulations and standards requirements. Exploring the domain where structures are about to collapse is poorly done and this work proposes a new methodology.

Considering a safety, reliability analysis and preventive maintenance perspective, the main interest of the presented work is to prove the capabilities of the established methodology to integrate in a multidisciplinary approach numerical modeling (physics of torrential phenomena, sediment transport, and structural stability calculation) and reliabilitybased modeling (SPN, CBM, and Monte-Carlo evaluation) in order to support decision-making based on raw data and expert knowledge. The proposed combination of hydraulics, civil engineering, SPNs, CBM, and Monte-Carlo simulation has indeed proven to be adequate for dependability analysis and provision of new results and approach in comparison to traditional safety and reliability techniques and decision-making methods.

In particular, the proposed approach contributes in the domain of dependability analysis with an indirect physicsbased approach to determine transition laws of a SPN reliability and maintenance model. Starting with the context of missing data, a series of probabilistic events is injected in a chain of deterministic tools and models in order to assess the time spent in each state and also to justify the assumptions used in the Petri nets modeling approach.

Perspectives and future works

The current application does not completely reflect the state of the dam in real life. In order to limit the scope of the study, other failure modes (e.g. internal stability) and the aging aspects of the dam were not incorporated into the deterioration modeling. Besides, perfect preventive operations that return the dam back to an as-good-as new state were considered in the maintenance modeling. In addition, maintenance-decision-making was done on the basis of economic aspects and the duration spent by the dam in a good state, not taking into consideration the risk induced by the failed dam on other consecutive dams (cascade effect) and on the risk level imposed on vulnerable exposed issues located downstream the watershed. Furthermore, the reliability of results may be influenced by the information imperfection resulting from uncertain, imprecise or incomplete data used in the analysis.The propagation of information imperfection within the modeling and its effect on the final risk management decision was not assessed in the current study. Several methods and theories (e.g. probabilistic analysis, possibility theory, belief functions etc.) exist to cope with information imperfection traceability and the decision-making processes [START_REF] Tacnet | How to manage natural risks in mountain areas in a context of imperfect information? New frameworks and paradigms for expert assessments and decision-making[END_REF]. Such approaches can be useful in order to consider such imperfection throughout the analysis and to figure out the critical inputs that significantly influence the results.

Undoubtedly, such work can be developed further by:

• Developing the global state indicator by considering aging aspects and more types of failures and assigning a power coefficient for each failure depending on its power in affecting the overall structural state of the dam (e.g. = 3 √ . . ;

• Considering partial renewal maintenance actions instead of perfect ones;

• Performing sensitivity analysis on some uncertain parameters in order to analyze the effect of their variation on the final results;

• Analyzing the bi-directional interactions between check dams constructed in series (cascading failure) by studying the influence of the partial or complete failure of one dam on other consecutive dams.

Figure 1 :

 1 Figure 1: (a) Parts of torrential watershed and torrent protection structures; (b) Check dam series, Saint Antoine torrent, France, 2014, Source: © INRAE/ETNA .

Figure 2 :

 2 Figure 2: Classical components of a cantilever check dam.

Figure 3 :

 3 Figure 3: Scouring phenomenon downstream a check dam. Saint Antoine torrent, France, 2014. Source: © INRAE/ETNA.

Figure 4 :

 4 Figure 4: Key steps of the modeling process: (a) torrential system geometry; (b) events series scenario; (c) resulting failures analysis; and (d) stochastic deterioration and maintenance analysis.

Figure 5 :

 5 Figure 5: Princples of LOGICHAR: (a) main terms and data used; (b) software limitations.

Figure 6 :

 6 Figure 6: Main geometric parameters used for estimating the dimensions of a scour pit downstream a check dam in SOGREAH and Comiti et al. approaches.

Figure 7 :

 7 Figure 7: Local scouring dimensions under a check dam's foundation to be considered in the developed approach of a scour pit geometry.

Figure 8 :

 8 Figure 8: Data required for analyzing the external stability of a check dam.

Figure 9 :

 9 Figure 9: Moment of inertia variables resulting in the normal stress diagram under a check dam's foundation after scouring.

Figure 10 :

 10 Figure 10: CBM policy. An example on modeling the time-dependent evolution of a dam's global stability indicator.

Figure 11 :

 11 Figure 11: System degradation process represented by a simple PN.

Figure 12 :

 12 Figure 12: Developed SPN model involving the degradation, inspection, and maintenance processes. PROB: probabilistic; IM: immediate, PD: periodic; and DET: deterministic transition times.

Figure 13 :

 13 Figure 13: Manival torrent. Source: © IRMa/S. Gominey, http://www.irma-grenoble.com.

Figure 14 :

 14 Figure 14: Hydrograph required as an input to LOGICHAR -Scenario 1.

(Figure 15 :

 15 Figure 15: Principal dimensions of the check dam under study (check dam #54 in Manival).

Figure 16 :

 16 Figure16: Variation in bed level along the entire studied reach after each flood event involved within the event series -Scenario 1.

Figure 17 :

 17 Figure 17: Time-based variation of the six parameters resulting from LOGICHAR simulation downstream the studied check dam -Scenario 1. Blue: water level ( ); green: water velocity ( 2 ∕ ); grey: slope ( ∕ ); brown: bed level ( ); red: variation in bed level ( ); orange: solid discharge ( 3 ∕ ).

Figure 18 :

 18 Figure 18: Time-based evolution of indicators corresponding to the maximum depth of the scour pit , local scouring depth , local scouring width , bearing capacity stability ratio , overturning stability ratio , and sliding stability ratio -Scenario 1.

Figure 19 :

 19 Figure 19: Time-dependent evolution of the global state indicator of the dam under study obtained after modeling (a) scenario 1 and (b) the 50 generated scenarios. Blue curve: indicator evolution over time; red dashed lines: indicator thresholds ( 1 = 1, 2 = 0.7, 3 = 0.5, 4 = 0).

Figure 20 :

 20 Figure 20: Cumulative distribution functions of the stochastic transitions 1-2 , 2-3 , 2-4 and 3-4 involved in the degradation process of the SPN model.

Figure 21 :

 21 Figure 21: Expected total cost of the four maintenance strategies considered in this study: (a) box plots corresponding to the data sets (200 histories) of costs; (b) average cost, Green: minor maintenance: blue: major maintenance; red: corrective maintenance.

Table 1

 1 General features of the studied reach in the Manival torrent (ONF-RTM, 2016).

	Longitudinal profile	Slope (%)	11
	Channel cross section (trapezoidal)	Width (m) Slope (m/m) Height (m)	6 1/1 5.5
		30 (cm)	2.6
	Grain size distribution	50 (cm) 90 (cm)	3.7 9
		(cm)	4.6

Table 3

 3 Data required for external stability verification of a check dam.

	Data	Parameter	Value	reference
		(m)	3.3
		(m)	2.3
		(m)	4.4	ONF-RTM(38) database
	Check dam #54	(m) (m)	5 13.7
	dimensions	(m)	2
		(m)	0.3	Assumptions
		(m)	0.3
		(m) (m)	2 0.3	RTM 2009 GIS survey
	Geotechnical
	and soil
	properties

Table 4

 4 Deterministic transition times corresponding to the inspection and maintenance processes involved in the SPN model.

	Intervention	Transition	Constant
			firing time
			(years)
	Inspection	Inspection frequency	1
		5
		Immediate transitions	0
		4 6 7 8
		Minor 9	0.0138
	Maintenance	Major 10	0.083
		Corrective 11	0.333

Table 5

 5 Mean sojourn time (years) of the studied check dam in each of its defined states based on the maintenance strategy adopted.

	Strategy	State 1 State 2 State 3 State 4
	1	86.01	10.49	2.55	0.87
	2	56.62	37.27	4.20	1.77
	3	73.04	6.73	19.02	1.21
	4	44.43	25.89	27.45	2.23

Table 6

 6 Statistics

	Strategy	Minor		Major		Corrective
	1	3.85	1.40	1.13	0.97	1.04	0.85
	2	0.00	0.00	1.57	1.09	2.04	1.15
	3	3.49	1.35	0.00	0.00	1.48	1.03
	4	0.00	0.00	0.00	0.00	2.62	1.23

on the number of maintenance operations performed during the considered simulation period based on the maintenance strategy adopted. : average; : standard deviation.

Acknowledgements

This work is supported by the French National Research Agency in the framework of the Investissements d'Avenir program (ANR-15-IDEX-02) with a contribution of the French Ministry for Ecological and Solidary Transition (MTES/DGPR) in charge of risk prevention.