Risk dynamics modeling of reservoir dam break for safety control in the emergency response process

Reservoirs are water conservation projects that retain water, block floods, and regulate water flow in the flood season. Reservoirs can play an important role in flood control, irrigation, water supply, power generation, water source protection, etc., and their sizes vary greatly (Li et al. 2008). In China, artificial reservoirs are usually formed by constructing barrage dams at the narrow mouths of ravines or rivers. China is the country with the largest number of reservoirs in the world. There are 98,000 reservoirs of various types, with a total storage capacity of more than 930 billion m³, accounting for nearly 35% of the country's total surface runoff. Facilities are also an important part of the flood prevention and disaster reduction heavy engineering system (Wayne 2009).

Since the beginning of the new century, with the advancement of engineering technology in China's reservoir dams, flooding, seepage, and structural instability caused by high water levels during the flood season have led to a significant decline in the proportion of dam breaches (Zhou et al. 2007; Chang & Zhang 2010; Shen et al. 2020). The proportion of dam breaches triggered by human factors in non flood seasons has risen relatively. Under the influence of uncertainties such as congenital deficiency, aging of the project, silt in the reservoir area, management misconduct, human error, along with geological and meteorological disasters, the evolution of the dam breach risk has characteristics of social technology systems. Once a dam breach event occurs, it will cause huge losses and catastrophic damage to socio-economic factors (Brown & Grahma 1988; Dekay & McClelland 2006). According to statistics, from 1990 to 2010, China experienced an average of 20 dam breaks per year, and from 2010 to 2018, an average of four dam breaks per year, among which there were many examples of serious human losses, such as Dalugou, Sichuan (26 people) in 2001, and Jilin Dahe (32 people) in 2010. At the same time, there are also cases of successful reservoir dam break transfer without causing casualties in China, such as Zhujiagou Reservoir of Shandong in 2013 in which nearly 4,000 people were transferred safely, but property losses were severe (Zhang et al. 2013a; Peng et al. 2015; Sheng et al. 2018).

At present, with engineering technology development, China has entered the rank of countries with low dam failure rates. However, reservoir dam emergencies behave in a manner of a social-technical system. The law of dam break risk causation is more complex, and it heavily affects the dam break emergency response. In this case, traditional qualitative analysis of dam break accidents and derived regulatory revisions have made it difficult to accurately assess and prevent the impact of socio-technical system factor risks on dam safety (Sheng et al. 2018). Reservoir dam break accident is a dynamic operation process of a social-technical system with multiple information flows such as water regime, disaster situation, material transfer, and information interaction (Zhang et al. 2013a, 2013b). Its risk dynamics transmission process covers organizations, personnel, and dam hydraulic systems. The interaction of risk factors forms a high-order dynamic feedback loop. To model the evolution process to cover its time-serial dimension of the emergency decision-making process, it is significant for constructing a quantitative risk assessment tool on dam break prevention and crisis handling.

This paper is organized as follows: System Dynamics Approach Based Risk Dynamics Modeling introduces the system dynamics method used in this study. Data Sources and Analysis Methods identifies the data source and risk causation with a view of socio-technical system which is involved in the emergency response of the reservoir dam break and the process of population transfer. Reservoir Dam Operating Risk Causation Models propose a risk dynamics model for characterizing the multiple risk interaction among organizations, human factors and technical systems. In Risk Evolution Simulation in Reservoir Dam Break, the system dynamics simulation model is constructed and its validity is also tested. And the risk evolution process of the dam failure accident of the Gouhou reservoir in Qinghai Province is represented and the risk mechanism is explained in terms of dynamic feedbacks based on the system dynamics approach. In Model Application for Intelligent Emergency Decision-Making, with verified simulation model three emergency decision-making scenarios based on the case of the Jinniu Mountain reservoir dam in Nanjing are implemented and critical considerations in dam break emergency decision-making are raised. Importantly, a software tool call Dam Emergency Response Aids (DERA) is constructed to further improve the efficiency of the emergency response and monitor real-time safety status of reservoir dam of China. Finally, Conclusion concludes the whole work and discusses limits of this study.

System dynamics is grounded on the theory of nonlinear dynamics and feedback control but also draws on cognitive and social psychology, organization theory, economics, and other social sciences to analyze complex system behavior (Sterman 2000). It helps to recognize and solve the system problems by analyzing the information feedback, dealing with the dynamic structure and feedback mechanism between the factors of the complex system, to obtain the overall cognition and problem solving of the system. In the field of system safety, system dynamics has been used as an important supplement to analyze organizational accidents and proposed safety policy in the field of aviation, astronautics, and chemical industries (Bouloiz et al. 2013; Shin et al. 2014; Yu et al. 2018; Lu et al. 2019a, 2019b). Especially in view of the social–technical system, organizational accidents are increasingly being studied by using a system dynamics approach. This approach helps to model the risk interactions of organization safety with conceptual description, causation analysis, and time-domain simulation tools.

The risk archetypes are constructed from three basic building blocks: the reinforcing loop, the balancing loop, and the delay.

The reinforcing loop refers to a particular behavior that encourages similar behavior in the future, and it corresponds to a positive feedback loop in the control theory. As Figure 1(a) shows, an increase in State 1 causes a positive consequence in State 2, as indicated by ‘ + ’, which then causes an increase in State 1. For an example of positive consequences, improvement of the monitoring system can increase the warning time by a few hours. The reinforcing loop can also be applied to negative consequences.

The balancing loop exists when a particular behavior attempts to move from a current state to seek balance. It corresponds to a negative feedback loop in the control theory, as Figure 1(b) shows. The driving force in the loop is the size of the gap between the goal and the current value. For example, the reservoir managing organization made evacuation decisions to reduce the population gap between the people being safe. Within the causal links forming feedback loops, the delay is used to model the time needed by the actions to take effect and it may result in unstable system behavior. It is indicated by a double line on the causal link (see Figure 1(b)). Caused by the delays, actions often fail to achieve expected results. For example, because people at risk need time to evacuate, flood headquarters always obtain delayed situation control. Delays can occur within both balancing and reinforcing loops.

In this study, the critical risk factors embedded roots in reservoir dam routine and emergency operating processes. The data supporting risk analysis include:

• engineering assumptions grounded in organizational experience and accident investigation related to reservoir dam operating processes flaws;

• behavior modes and safety features proposed in literature reviews, such as accident and risk models;

• accessible safety data, such as system flaws and human error identified in accident investigation reports.

For the feedback causation-based dam operating risk dynamics modeling, the Causal Loop Diagrams (CLDs) are developed to draw the critical risk interactions underneath. The reinforcing and balancing feedback loop structure-based conceptual model can be proposed to describe the dynamic influences of organization, human, and technical system factors on the dam break accident. In the field of public security and safety control, some research on dynamic process modeling has been implemented, such as in the fields of earthquake resistance, fire, and cluster activity. For example, Sajjad Ahmad applied system dynamics for the risk factor analysis of disaster emergency evacuation and distinguished its initial, social, external, and psychological factors (Ahmad & Simonovic 2001). Ahmad applied system dynamics to the study of reservoir flood control and analyzed the mechanism modeling and sensitivity analysis of reservoir water flow I/O (Ahmad & Simonovic 2000). Moreover, Peng (2012) used the Wenchuan earthquake area as an example to carry out system dynamics analysis and simulation research on the earthquake area environment, early warning, resource allocation, and other factors.

In the reservoir dam break emergency decision-making system, based on the risk evolution process of the social-technical system related to the dam break accident, the dynamic factors especially the risk mechanism affecting the whole process are identified based on accident investigation and data analysis. The proposed risk dynamics model should be established to represent the accident process and risk interactions. It provides a base for model structure test and variable definitions in the further simulation model. The proposed model also supports the generation of safety control suggestions, which may improve the efficiency of emergency work and improve the timeliness in crisis response. Using the Gouhou reservoir dam break in 1993 as an example, this dam is located 13 km from Qabqa Town and upstream of Qabqa River, Gonghe County, Hainan Tibetan Autonomous Prefecture of Qinghai Province in China. The dam height is 71 m, and the normal storage level is designed at 3,278 m, with a normal water storage capacity of 3.3 million m³. It is a reinforced concrete sand gravel dam with a 265 m roof length. The construction of the Gouhou reservoir project was officially started in August 1985 and was put into storage in September 1989 and completed in October 1990. In August 1993, the dam collapsed due to high water level operation and improper operation management. According to local measurement in this dam break accident, the maximum flood flow was 2,780 m³/s, the maximum flood flow to Qabqa Town was 1,290 m³/s, and the discharged water was 2.86 million m³. This mishap caused serious loss of life and downstream property (Chen 1994; Sheng 1996).

Based on the system theories, the critical risk factor and risk interactions should be identified with a view to the socio-technical system (Leveson 2004; Hollnagel 2012). It is involved in the emergency response of the reservoir dam break and the process of population transfer. The key elements of the emergency decision system for the reservoir can be divided into organizational, human, and technical system levels. The cause of risk factors leading to the reservoir dam failure is that the above levels in the dam construction and operation loop violated the corresponding safety requirements, and then jointly acted on the emergency level that characterizes the safety of the reservoir (i.e., catastrophic consequences leading to casualties and property losses). The inherent interactions of the above risk factors are shown in Figure 2 below.

Taking the risk interaction of human factors and dam system level as an example, reservoir maintenance personnel carry out daily operation and ensures that the reservoir monitoring and communication system running correctly. At the same time, the design reliability of the reservoir structure system and the load conditions affect the choice of personnel operation strategies and may induce operation errors. Before and after the occurrence of a reservoir dam break, organizational decisions such as the implementation of emergency response directly determine the structural load of the reservoir at dam break risk (such as flood discharge and blockage decisions) and sufficiency of the early warning time for personnel evacuation. The combined effects of these causal factors determine the risk level of the downstream population affected by reservoir dam break that may lead to catastrophic losses.

The system dynamics method is used to analyze the risk causation of the emergency decision system for reservoir dams in the form of the causal loop diagram. The causal loop diagram is a basic method to model the feedback structure of the risk dynamics. It captures the process of information transmission and feedback, that is, the process of a risk variation in the social–technical system, which affects the variable itself in turn through a series of causal relationships.

From the view of safety performance level (SPL), a reservoir dam break is an emergency event under adverse environmental impacts such as rainstorm or earthquake. The impact of early organizational decision-making behavior on later ones presents a characteristic of path dependence. The safety performance of the whole system mainly reflects the evacuation process of a risky population to a safe settlement, the process of death, and the effect of population evacuation rates on the total population transferred (Zhang et al. 2013b). The risk dynamics model in this level is shown in Figure 3. In the process of an emergency evacuation, the number of people at risk drives the entire evacuation process. As the number of people at risk increases, more people choose to evacuate. The increase in the number of people under evacuation will lead to a decrease in the number of people at risk, and an increase in the number of people who are safe, see the balancing loop B1. At the same time, an increase in the number of safe people will result in a decrease in the number of people who are evacuating, see the balancing loop B2. The people in the downstream area must also ensure their understanding of new settlement and the potential evacuation route, and the lack of the above knowledge may lead them to lose the evacuation time (Zhang et al. 2013a).

The organizational management level (OML) describes the social–technical structure of the reservoir dam emergency response system with a hierarchical mechanism of linkage response. As shown in Figure 4, some organizational characteristics are modeled, such as the perception of emergency symptoms, the release of early-warning information, and the series of decision-making processes to reduce the consequences of a dam break. As professional modular interfaces for further quantitative modeling, the monitoring system reliability and early warning mechanism are considered in this causal loop diagram. The safety effects of the monitoring system on risk are the accuracy of dam load and flaw monitoring, which directly affects the subsequent transmission of early warning information and evacuation decision to downstream risk areas (Alexander 2005; Xu et al. 2008). The early warning mechanism includes variables such as organization risk awareness, organizational decision-making behavior, early warning information diffusion rate, and resident risk awareness. These variables follow the time-domain process of emergency response and construct the balancing loop B3.

For the human factor level (HFL), the behaviors of the resident at risk in the downstream area are modeled. It describes the process of receiving the early warning information issued by the crisis headquarter. The decision-making behaviors of the people will be affected by their social hierarchy, such as the age, children scale, distribution of residence and psychological factors et al. (Liu et al. 2012; Mesmer & Bloebaum 2014). The whole evacuation decision-making process is divided into four stages of attention, risk awareness, acceptance, and evacuation. A balancing loop B4 models this risk evaluation process, shown as Figure 5. The variables of this model involve both sociological and demographic aspects. People living in flood-prone areas always have a certain degree of alertness and specific living patterns.

Understanding and alertness to the consequences of floods constitute a set of initial conditions for the emergency response of the residents in the event of a reservoir dam break, named as the proportion of residents' concern for evacuation. Even if the disaster does not constitute a current threat, such concerns still remain. Social factors such as the distribution of residence, age, and family (children), combined with external factors (such as awareness of heavy rain and flood warning), cause risk perception. Once the level of perceived risk before the evacuation reaches a certain threshold in mind, the influence of experience factors and community cohesion will prompt the people at risk to make evacuation decisions. However, the residents often responded differently to external factors. For example, as revealed by some accident investigation reports, some people did not evacuate immediately after receiving early warning evacuation information, while some people evacuated even before the early warning information was released (Ahmad & Simonovic 2000; Sheng et al. 2018). Even worse, some people returned to the danger area after they thought the risk had been eliminated. In order to reflect these different behaviors in the model, a variable called acceptance of evacuation is introduced to measure the extent to which the people at risk recognize the danger. Meanwhile, the actions of other people may affect the individual's acceptance of the warning information significantly, and then stimulate him or her to evacuation soon.

As shown in Figure 6, the dam system level (DSL) is an inherent physical attribute of the reservoir and dam systems, such as civil structure. The dam failure induces its break emergencies and drives the emergency response of the whole social-technical system. The dam break risk can divide the main variables into penetration risk, piping erosion risk, landslide risk, and overtopping risk according to common dam break modes (Chang & Zhang 2010; Shen et al. 2020). These single-chain variables reflect the evolving mechanism of dam break risk; that is, once one of the causal chains is triggered, it means that the dam will fail. From the perspective of the dam structure, construction quality, and adequate maintenance measures can be performed to control such risk. This is because the dam break is a sequential process. Control measures mean that when the dam is in danger, if the hidden danger can be detected in time, certain emergency measures can be taken to artificially intervene in the failure risk (including preventing the dam break or delaying the time of the dam break). In addition, penetration risks will be affected by the construction quality, which means that if the dam is of good quality, it will be beneficial to the timely detection and treatment of hidden hazards, thereby controlling risks. The increasing of these variables may lead to an increase in the dam break risk and vice versa.

The completed causality model of reservoir dam break risk dynamics described from a socio-technical perspective is shown in Figure 7 below. This model is mainly composed of four balancing feedback loops and only shows the critical variable nodes in this model for readability. In this model, relevant mechanisms such as flood evolution, early warning process, and monitoring process all use the corresponding professional model data of the actual reservoir system as the input.

This model shows that for emergency response organizations, the purpose of full decision-making and implementation is to make the residents' risk awareness and the organization's awareness the same. In this case, the people at risk can accurately and timely implement the evacuation instructions after receiving the early warning. Higher consistency of risk perception can increase the possibility of survival during the reservoir dam break.

For potential time-domain simulation of risk evolution in dam break emergency decision-making, the causation models proposed above should be transferred as a stock-flow model and the variable definition process must be implemented in semi-quantitative way. The main variables in the simulation model include the initial values and constants (C), auxiliary variables (A), stock variables (S), flow rate variables (F), and table functions (LOOKUP). In this paper, in order to simplify the causalities, the variables that do not change significantly over time were regarded as constants. The complex mechanisms such as flood evolution, early warning process, and monitoring process were integrated into the model in the form of table functions, which helped to deal with their nonlinear characteristics over time effectively. For more method details of stock-flow simulation, the interested reader is referred to the extensive literature, for example Lu et al. (2019b). After the modeling iteration, the variable definitions to establish a proposed risk evolution simulation model for model structure test are shown in Table 1.

Based on the theory of system dynamics, each typical behavior of system must be determined by a certain characteristic structure of the system (Sterman 2000). For example, most of the negative feedback loops with delays will cause oscillations, and the general negative feedback loops will behave with a manner of target-seeking. As an example, the time-domain characteristics of the variable people under evacuation in the balance loop B2 are shown in Figure 8. It can be seen that the number of people under evacuation shows a peak corresponding to relevant orders, and gradually approaches zero over time (that is, the characteristic of target-seeking). This represents that the residents have arrived at their safe refuges, which is consistent with the conceptual expectation and historical experience.

After the parameter sensitivity test and variable validity check, the historical dam break event of the Gouhou reservoir in Qinghai Province described previously was chosen as a case to verify the model structure and variable definitions by represent the risk evolution in this accident. Based on the model as proposed in Table 1 and after the corresponding adjustment of the model parameters, the simulated behavior of critical variable people under evacuation is selected for result display partially, as shown in Figure 9.

According to the Gouhou dam break accident report and the on-site investigation, it was found that before the evacuation order was issued by the reservoir operating organization, the people evacuated in advance according to their perceived risk. The first peak of evacuation occurred around 180 minutes (21:50) after the sign of the dam break was found, which also showed that some people did not evacuate ahead of others because of limited risk awareness or insufficient understanding of the consequences of the flooding. They did not start to evacuate until the visible flood arrived (before 22:45, as shown in Figure 10) (see, Chen 1994). The simulation represented the whole risk dynamics process of this social-technical system in this accident.

Figure 11 shows that the simulated number 280 of fatalities in this accident is close to the historical record of 288 with an error of 2.1%. In addition, the simulated moment of life beginning to loss lags behind the moment when the flood reached the core zone, which reflects the delayed behavior of life loss in the real accident process. In summary, the validity of model structure established in this paper has been verified and it owns a potential model interface for being developed as a decision-making tool to support reservoir dam emergency management and real-time response.

With verified simulation mode, three emergency decision-making scenarios were proposed based on the case of the Jinniu Mountain reservoir dam in Nanjing, Jiangsu Province. The scenario Intelligent organization focuses the effective organization management behavior in the whole process. The scenario Vigilant residents emphasizes the sufficient risk awareness and capacity of downstream residents when encountering dam break. The scenario Comprehensive status proposes an ideal hypothesis in which most factors in both organization management and human factor levels behave positively and actively. The parameter settings of critical variables in the above scenario are listed in Table 2 and the simulation results using the variable number of fatalities as an example is shown in Figure 12.

As Figure 12 shows, the parameters reflecting organization decision-making, resident risk awareness and warning mechanism can be adjusted according to the scenario Intelligent organization, which will defer the dam break process and gain more time for evacuation. As a result, 99.41% of the people downstream can be saved in this scenario. Adjusting the parameters of community cohesion, individual alertness, and understanding the consequences of the flooding will enhance the resident risk awareness, as well as improve the efficiency of evacuation and the scenario Vigilant residents may save 98.69% of the people in downstream. The scenario Comprehensive status considers the adjustment of parameters in the above two scenarios at the same time, which can save 99.99% of the residents. Under the semi-quantitative support of above decision-making evaluation in medium- to long-term vision, the emergency response should cover these strategies as follows.

In the aspect of decision-making for issuing early warning evacuation order, the safety guard on the reservoir dam should maintain the required frequency of inspections and reporting threshold matching rainfall and reservoir water storage. At the same time, the staff should ensure that the emergency communication equipment is unobstructed to minimize the time for reporting. When the evacuation decision is made by headquarters, the responsible organization should immediately gather the water conservancy, transportation, civil affairs, public security, firefighting and other resources to jointly formulate the evacuation and transfer plan, and adopt multiple techniques such as broadcasting, telephone, and community notice to deliver early warning to residents living in downstream areas.

In addition, in the aspect of technical resistance, professional emergency rescue teams and materials should be allocated to subordinate units according to condition priority. The emergency responses should include repairing the gate system, opening the floodgate according to the scheduling plan, filling sandbags behind the anti-wave wall to reinforce the water barrier, and laying anti-seepage facilities on top of the dam, etc. Even if dam break cannot be avoided, these measures can also help to extend the escape time for residents.

Finally, in order to increase the risk awareness and understand the consequences of floods, sufficient training to improve individual ability on evacuation is needed and public education to enhance community cohesion is also important to help spread the disaster information and ensure the efficiency of the transfer process.

In order to further improve the efficiency of the emergency response and monitor real-time safety status, a software tool call Dam Emergency Response Aids (DERA) was constructed. Using the Jinniu Mountain reservoir dam in Nanjing, Jiangsu Province as an example, the mobile APP interface of DERA is shown in Figure 13.

Intelligent decision-making supporting software needs to fully consider information sources, processing and visual presentation of results (Liu et al. 2014; Chen et al. 2019; Jeffrey & Leandro 2019). The DERA APP integrates real-time rainfall monitoring, high-precision satellite maps as well as dam water level and on-site reporting information, which can dynamically calculate downstream risk level and potential disaster consequences, evaluate the safety benefits of organizational emergency decisions, and overcome the static defects of traditional emergency plans. That is to say, with the results of APP operation as semi-quantitative technical support, emergency organizations can make rapid and more scientific decisions, transmit instructions to people, and continuously receive the feedbacks from personnel's execution process, which can help them to assess the risk impact of decision-making over time and thereby effectively improve emergency response efficiency and quality. With the supporting from the DERA, if the level I emergency response is triggered, the following emergency plans can be proposed hierarchically:

• 1.

  When noticing signs of dam failure, safety inspectors shall report to the responsible department and notify subordinate units within 0.1 hour. The on-site commander presides over an emergency meeting, which shall be controlled within 0.5 h, generating rescue plans and deploy related works.

• 2.

  The emergency command division shall monitor the real-time situation, issue a red alert and deliver real-time information to the public through reliable channels. In addition, it shall issue evacuation instructions to downstream people who may be potentially affected, determine the responsible person to ensure the prescribed transfer routes, and shall provide traffic guarantees, protect important infrastructure and maintain public order.

• 3.

  The emergency response branch is responsible for allocating rescue equipment and life support materials as needed, establishing an emergency shelter, and ensuring it is ready for use at any time.

• 4.

  The reservoir management branch should closely monitor the changes of dam storage, rainfall condition and rescue construction progress (especially encountering unforeseen circumstances such as cracks, leakage, pit collapse and gate failure) and report to the emergency command division in time. It should cooperate with relevant departments to adjust the flood discharge plan according to the order from headquarters.

With the support of the DERA system, the Jinniu Mountain reservoir dam has maintained an excellent safety operation record so far. It can be seen that DERA-based intelligent emergency decision-making can improve the safety benefits of the operating organization response systematically. The dynamic feedback vision-based organization strategies can help to meet the real-time requirement for emergency responses.

For an effective prevention and emergency response of reservoir dam break that may cause significant casualties and property damage, this paper reveals the dam operating risk dynamic mechanism and it models the general risk evolution process pervading in a social–technical system vision. A quantitative system dynamics simulation model and a real-time software tool for intelligent emergency decision-making called DERA for dam break risk prevention and control are also developed. The main contributions of this research results are summarized as followings:

This paper provides a dynamic and systematic way to overcome the flaws of linear accident model and partial probability calculation techniques that have shown obvious limits in handling such public disaster. It covers multi-level risk factors composed of organizations, human factors and dam system systematically. The causal relationship model for the risk dynamics of reservoir dam break is focused on the organizational decision-making process, influence of social factors of residents and emergency evacuation and transfer process. Importantly, professional module data including dam hydrology and rainfall status, early warning mechanism and flood evolution process are integrated into the simulation model. The validity of the model was verified by representing the historical process of Gouhou reservoir dam break in Qinghai Province. The error between the simulated results and historical data is 2.1%. The non linear feedback mechanism for the risk dynamics can be explained from the time series dimension quantitatively.

Based on the safety control scenario simulation, this research helps to remind the safety responsible organizations to focus their investments on publicizing and downstream resident training, which will increase their awareness of risks, enhance public understanding of the evacuation process and risk pre-judgment criteria, and maintain trust in organization decision-making and community cohesion.

The proposed intelligent emergency decision-making supporting tool called DERA integrates comprehensive real-time disaster information and provides the responsible organization with dynamic strategy supporting tools for evaluating safety control measures. However, because of the scope and depth of the identified dam operating risk spectrum, this research mainly modeled the critical factors failure number and simplified some risk interactions especially in the early warning process. More detailed and broad information at the organization level needs to be involved in our further research, especially the considerations of how to improve the model reality of the physical processes of warning information dissemination and flooding evolution to promote the further application of the DERA software over China not only in Nanjing.

This research was sponsored by national key research and development projects (2016YFC0401603, 2018YFC0407100, 2018YFC0407106), National Natural Science Foundation of China (41671504, 51979176), Youth Fund Project of National Natural Science Foundation of China (61803263), and the Startup Fund for Youngman Research at SJTU of China (SFYR at SJTU).

The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper.

All relevant data are included in the paper or its Supplementary Information.