The wrong worst case: Beyond the Design Basis
Fukushima’s tsunami, Winter Storm Uri, the New Orleans levees and Banqiao failed on the same seam — a correlated, once-warned hazard that arrived past an envelope no one had widened. The worst case was not unimaginable. It had been imagined, priced, and filed away.
Every piece of infrastructure carries a hidden number: the design basis — the worst case it is built to survive. A 1-in-1,000-year flood, a Category 3 hurricane, a 5.7-metre wave, a winter it never gets that cold. The design basis is not a fact about the world. It is a decision about how much of the tail you are willing to pay to insure. This cluster is what happens when that decision is made too small, in full knowledge of the risk.
The tempting story is that these were failures of imagination — nobody could have foreseen it. The records say the opposite. In every case here, the larger hazard had been calculated, written down, and excluded from the design basis as too costly or too unlikely to fund. The failure was not that the worst case was unknown. It was that someone drew the line beneath it, and the world drew its line above.
A design basis is an insurance decision wearing an engineer’s clothing. These four failed because the tail was correlated (one cause took out the hazard and the defence at once), once-warned (the larger case was on the record), and declined (widening the envelope cost money no one would spend). The reform that follows is always the same: move the line, and make someone maintain it.
The wave they had already calculated
Fukushima Daiichi appears twice in this series. In Fault Lines 01 it is an information failure — a control room blinded by station blackout. Here it is the other seam: the reason the water got in at all. The plant’s tsunami design basis was about 5.7 metres. When TEPCO chose the site in 1967 it cut the natural coastal cliff down from roughly 35 metres to 10, to make seawater pumping cheaper — lowering the very ground the reactors stood on.
The decisive fact is that TEPCO had already calculated the real number. In 2008, running its own trial calculations against a 2002 government tsunami evaluation and the historical 869 Jōgan tsunami, the company’s engineers estimated a possible run-up of about 15.7 metres at the site — almost exactly the ~15-metre wave that arrived in 2011. According to later testimony, executives approved tsunami countermeasures in March 2008 and then shelved them in July, reasoning that acting would be hard to justify to regulators and residents and might invite calls to shut the plant. The 15.7-metre figure was formally reported to the regulator on 7 March 2011 — four days before the sea proved it right.
Moving the generators just ten metres higher, engineers later noted, would likely have prevented the meltdowns. This is the design-basis flaw in its purest form: not ignorance, but a known number excluded from the plan because the plan was cheaper without it.
The cold they decided wouldn’t come
In February 2021 Winter Storm Uri drove a deep freeze across Texas. Gas wells and pipelines froze, uninsulated power plants failed to start, and the grid operator ERCOT ordered around 20,000 MW of rolling blackouts — the largest manually controlled load-shed in U.S. history — coming, by its own account, minutes from uncontrolled collapse. Roughly 87% of the outages traced to the natural-gas supply freezing. The official Texas death toll is 246; excess-death analysis puts the likely figure near 700 (a 426–978 range); property damage ran to at least $26.5 billion.
The design-basis failure is documented to the year. A near-identical freeze in February 2011 had already frozen Texas gas and tripped its plants; a 357-page FERC/NERC report that year recommended winterisation — “economically reasonable” measures routine in colder climates. Those recommendations were left voluntary, and a decade later most had not been made. As FERC’s chairman put it after Uri, the 2011 recommendations “were not acted on.” The hazard was also correlated in exactly the way a design basis must not assume away: the same cold that spiked heating demand simultaneously froze the gas supply, the thermal plants and the wind turbines — supply and demand failing from one shared cause. ERCOT’s very design, an island grid with minimal ties to its neighbours, removed the obvious backstop of importing power.
A worst case is only a worst case until it is the second time.
Texas had run this exact failure in 2011 and chosen not to widen the envelope, because widening it meant paying for winterisation that would sit idle in most years. The reform — Senate Bills 2 and 3 (2021) and new mandatory NERC cold-weather standards — is simply the 2011 report, finally made compulsory a decade and several hundred deaths later.
A standard frozen in the 1960s
When Hurricane Katrina’s surge overwhelmed New Orleans on 29 August 2005, about 80% of the city flooded and roughly 1,392 people died (a toll revised down over the years from ~1,833); it remains the costliest U.S. natural disaster, at about $125 billion in 2005 dollars. The proximate killer was not the wind but the water — and the water got in because the flood defences were built to a design basis set decades earlier and never widened.
That basis was the “Standard Project Hurricane,” a 1960s-vintage template roughly equivalent to a fast-moving Category 3. It became, in the words of the post-Katrina investigation, “enshrined within the Corps”; even when the successor to the Weather Bureau recommended strengthening the model, the Corps did not change its plans. The Interagency Performance Evaluation Task Force (IPET) then found the crucial thing: New Orleans flooded not only from overtopping but from breaching — floodwalls at the 17th Street and London Avenue canals failed below their design loads. That makes Katrina a design-and-construction failure, not merely an act of God. And it had been rehearsed: in July 2004, thirteen months before, FEMA’s “Hurricane Pam” exercise had simulated almost precisely this scenario — a slow major hurricane overtopping the levees and drowning the city.
The reform is the strongest “reform that held” candidate in this cluster, with an asterisk. Congress put more than $14 billion into the new Hurricane & Storm Damage Risk Reduction System (HSDRRS), rebuilt on an accelerated design-build basis to a 100-year standard, with major works done by 2012 and completed by 2018. It has performed: New Orleans took a direct hit from Hurricane Ida in 2021 and the barriers and pumps held. The asterisk is that an independent panel warned even the 100-year standard is inadequate for a major city (earthquake-zone practice would be 500- to 1,000-year), the system is now locally maintained, underfunded and slowly sinking, and a milder storm passing is never proof that the envelope is finally wide enough. When the Levees Broke and Treme keep the memory alive; the IPET volumes keep the facts.
The dam designed for half the flood
In August 1975, Typhoon Nina stalled over Henan, China and dropped a year’s rain in a day. The Banqiao Dam had been built to withstand a 1-in-1,000-year flood; what arrived was, by later reckoning, roughly twice that — a 1-in-2,000-year event. Its sluice gates, too few and partly silted, could not pass the water; communications were severed so operators could not coordinate a release; and when Banqiao overtopped and failed it triggered a cascade of 62 dams. The death toll is one of the most contested in this series: roughly 26,000 killed in the immediate flood wave, and up to about 240,000 once ensuing famine and disease are counted.
The warning here is the oldest of the four. During the dam-building programme of the 1950s, the hydrologist Chen Xing had criticised the designs as having too few sluice gates and too little spillway capacity; his warnings were dismissed. After 1975, China undertook a nationwide review of its reservoirs and, over the following decades, rebuilt Banqiao and others to widened standards. Half a century on, the same flaw recurs wherever a dam sized to a 20th-century flood record meets a 21st-century one — the near-failure of California’s Oroville spillway in 2017 is the same story in a country that could afford to evacuate in time.
Correlated, once-warned, declined
The tying conclusion earns itself across four very different assets. In each, three things were true at once. The hazard was correlated — a single cause defeated both the threat and the defence: the quake that made the tsunami also killed the backup power; the cold that spiked demand also froze the supply; the storm that raised the surge also failed the walls; the rain that filled the reservoir also cut the communications to release it. Design bases built on the comforting assumption that failures are independent are exactly the ones a correlated tail destroys. The hazard was once-warned — the larger case sat in a report, an exercise, a shelved calculation, a dismissed hydrologist. And the wider envelope was declined, because resilience you never use looks, on a spreadsheet, like waste — right up until the year it isn’t.
For the analyst, the design basis is the single most important number in an infrastructure asset and the one most quietly optimised downward. It is where the tail risk is priced, and where it is hidden. The reforms that follow always do the same two things: they move the line (a higher wall, a mandatory winterisation, a 100-year levee, a widened spillway), and they try to make someone responsible for keeping it there. The second half is the hard half — because the next generation, having never seen the wave, will be tempted to call the maintenance a waste all over again.
Recommended → codified → corrective → still live?
| Case | Recommended | Codified (done) | Corrective action | Still a live concern? |
|---|---|---|---|---|
| Fukushima tsunami 2011 |
Re-base tsunami/seismic design on worst credible case; protect backup power; independent regulator. | Japan’s NRA (2012) and 2013 standards re-based tsunami and seismic assumptions; filtered vents, hardened/relocated backup power, watertight rooms; global post-Fukushima stress tests. | Sea walls raised, generators relocated and bunkered across fleets; many reactors closed or slow to restart. | Yes — every coastal facility’s design basis is now a moving target under sea-level rise; and the regulator-independence question (Fault Lines 01) is unresolved. |
| Winter Storm Uri 2021 |
Mandatory winterisation of generation and gas supply; grid-tie / import capacity; ERCOT governance reform. | Texas SB2 & SB3 (2021); FERC-approved mandatory NERC cold-weather reliability standards — the 2011 recommendations, finally compulsory. | Weatherisation retrofits; critical-infrastructure designation for gas facilities; reserve and reliability changes. | Yes — enforcement and gas-side coverage remain partial; the island-grid isolation persists; cold extremes keep testing it (Elliott 2022). |
| New Orleans levees 2005 |
Rebuild to a real urban standard; treat overtopping-and-breach as an engineering failure; restore coastal buffer. | >$14bn HSDRRS to a 100-year standard (design-build, 70+ projects); coastal restoration; Post-Katrina Emergency Management Reform Act (2006). | Barriers, floodwalls and pumps rebuilt; held through Isaac (2012) and Ida (2021). | Yes — 100-year standard judged inadequate for a major city; system sinking, locally maintained, underfunded. “Held so far” is not “wide enough.” |
| Banqiao 1975 |
Widen spillway/sluice capacity; nationwide reservoir safety review; heed the ignored hydrology. | Countrywide reservoir re-evaluation; Banqiao and others rebuilt to widened standards (Banqiao 1993). | Increased discharge capacity; dam-safety programmes across China’s inventory. | Yes — ageing dams worldwide sized to 20th-century floods now face 21st-century extremes (echoed at Oroville, 2017). |
Flashpoint — the moving envelope Pre-failure
The most important thing that has changed since these four is that the design basis itself is now unstable. Stationarity — the assumption that the future’s extremes look like the past’s — is effectively dead for climate-driven hazards, which means every levee sized to a historical flood, every grid rated for a historical temperature envelope, and every coastal asset set to a historical sea level is now quietly under-specified. That is the pre-failure mode this series tracks in Flashpoints: ageing dams against wetter storms, and coastal infrastructure against a rising baseline that no longer sits still to be planned against.
Fukushima’s other seam — the blinded control room — is The Machine Couldn’t Tell the Truth. Banqiao’s 62-dam chain reaction is a bridge to The Cascade. The New Orleans rebuild is a leading candidate for The Reform That Held — carried there with the “held so far is not proof” caveat intact. The shifting-hazard mechanism connects to the ENSO & monsoon dashboard. Framework and method: the Fault Lines primer.
What this cluster permanently re-priced is the design basis itself — the recognition that the worst-case number is not an engineering constant but a financeable choice, routinely optimised downward until an event re-sets it upward at appalling cost. The durable lesson for anyone underwriting, financing or operating long-lived infrastructure is to treat the stated design basis as a claim to be interrogated, not a fact to be trusted: ask what larger case was calculated and excluded, whether the tail is correlated, and who is paid to keep the envelope where the last disaster put it. Under a moving climate, the honest answer is that most design bases in the ground today are already too small — and the reform, once again, will arrive one wave late.
Leave a Reply