System reliability evaluation of long railway subgrade slopes considering discrete instability

This paper develops a dual-indicator discrete method (DDM) for evaluating the system reliability performance of long soil subgrade slopes. First, they are segmented into many slope sections using the random finite element method, to ensure each section statistically contains one potential local instability. Then, the k\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$k$$\end{document}-out-of-n\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$n$$\end{document} system model is used to describe the relationship between the total number of sections n\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$n$$\end{document}, the acceptable number of failure sections m\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$m$$\end{document}, the reliability of sections Rsec\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$R_{{{\text{sec}}}}$$\end{document}, and the system reliability Rsys\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$R_{{{\text{sys}}}}$$\end{document}. Finally, m\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$m$$\end{document} and Rsys\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$R_{{{\text{sys}}}}$$\end{document} are jointly used to assess the system reliability performance. For cases lacking spatial data of soil properties, a simplified DDM is provided in which long subgrade slopes are segmented by the empirical value of section length and Rsec\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$R_{{{\text{sec}}}}$$\end{document} is substituted by that of cross-sections taken from them. The results show that (1) DDM can provide the probability that the actual number of local instabilities does not exceed a desired threshold. (2) Rsys\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$R_{{{\text{sys}}}}$$\end{document} decreases with increasing n\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$n$$\end{document} or decreasing Rsec\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$R_{{{\text{sec}}}}$$\end{document}; that is, it is likely to encounter more local instabilities for longer or weaker subgrade slopes. n\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$n$$\end{document} is negatively related to the horizontal scale of fluctuation of soil properties and positively related to the total length of subgrade slopes L\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$L$$\end{document}. (3) When L\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$L$$\end{document} is sufficiently large, there is a considerable opportunity to meet local instabilities even if Rsec\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$R_{{{\text{sec}}}}$$\end{document} is large enough.


Introduction
Soil subgrade is widely used in railway engineering worldwide, such as in the South Coast rail line in Australia [1] and the Lanzhou-Xinjiang rail line in China [2]. The instability of subgrade slopes is one of the main risk sources of railway operations due to the potential for huge social and economic impacts and even passenger casualties. For example, the Ingenheim derailment accident in France caused by a landslide due to heavy precipitation (see Fig. 1) caused 21 injuries and serious damage to vehicles [3]. Rainfall is one of the most significant triggering factors for slope failures in many regions [4]. For long subgrade slopes composed of spatial variable soils, the resisting moment of the potential local failure surface at different locations varies significantly, and it is highly likely to encounter discretely distributed local instability events along the length direction [5]. Since any local slope instability event may cause traffic disruption, the reliability assessment of subgrade slopes should be treated as a system problem. For the system reliability evaluation of subgrade slopes, the key target is to estimate the probability that the actual number of local instability events does not exceed an acceptable threshold, such as 1.
Traditionally, deterministic plane strain analyses are adopted to assess the stability level of a set of cross-sections taken from long subgrade slope via the factor of safety ( F ) [6,7], in which characteristic values are used to represent spatially variable soil parameters. When F is no smaller than a predetermined value, such as 1.25, the entire subgrade slope is deemed sufficiently safe. More recently, probabilistic Abstract This paper develops a dual-indicator discrete method (DDM) for evaluating the system reliability performance of long soil subgrade slopes. First, they are segmented into many slope sections using the random finite element method, to ensure each section statistically contains one potential local instability. Then, the k-out-of-n system model is used to describe the relationship between the total number of sections n , the acceptable number of failure sections m , the reliability of sections R sec , and the system reliability R sys . Finally, m and R sys are jointly used to assess the system reliability performance. For cases lacking spatial data of soil properties, a simplified DDM is provided in which long subgrade slopes are segmented by the empirical value of section length and R sec is substituted by that of crosssections taken from them. The results show that (1) DDM can provide the probability that the actual number of local instabilities does not exceed a desired threshold. (2) R sys decreases with increasing n or decreasing R sec ; that is, it is likely to encounter more local instabilities for longer or weaker subgrade slopes. n is negatively related to the horizontal scale of fluctuation of soil properties and positively related to the total length of subgrade slopes L . (3) When L is sufficiently large, there is a considerable opportunity to meet local instabilities even if R sec is large enough. System reliability evaluation of long railway subgrade slopes considering discrete… plane strain analyses have been developed and widely used, e.g., the first-order reliability method [8][9][10] and the random finite element method (RFEM) [11]. The random variable or two-dimensional random field is used to describe the spatial variability of soil property, and the reliability level of crosssections is evaluated in terms of reliability ( R ), probability of failure ( P f ), or reliability index ( ) [12]. Nevertheless, an infinite rupture surface in the length direction is assumed in the above two-dimensional analysis methods, which is not in line with reality. As soil parameters are naturally variable in three-dimensional space, the reliability of a cross-section is not representative of that of long subgrade slopes, especially when there are large fluctuations in soil properties. Previous research has shown that the reliability of three-dimensional earth slopes can be largely lower than that of a cross-section taken from them when the length is large enough, which is known as the length effect [13][14][15]. Thus, when the crosssections taken from a long subgrade slope all have enough reliability, the reliability of this subgrade slope can still be very low. In other words, there may be a considerable possibility to encounter one or more local failure events. Parameters F or only provides engineers with rough confidence that no local sliding event will occur along subgrade slopes.
Over the past decades, three-dimensional probabilistic analysis techniques have been developed to assess the reliability of long subgrade slopes, in which a three-dimensional random field is used to model spatially variable soil properties. For long slope composed of statistically homogeneous soils, using the local averaging theory and first-crossing theory, Vanmarcke [14,15] proposed an analytical method to compute the system reliability ( R sys ) that no local failure event will occur. The sliding mass is assumed to be a cylinder bounded by two vertical planes in Vanmarcke method. Statistically, homogeneous soil properties mean that the scale of fluctuation (SOF) and the statistics such as mean and variance are constant in earth space [16]. The SOF is an indicator of the distance within which soil property values show a strong correlation, which is defined as the area under the autocorrelation function curve [16][17][18]. There are various methods to estimate the value of SOF using field testing data (e.g., cone penetration testing (CPT) data), such as the method of moment, maximum-likelihood estimation, and Bayesian analysis [19]. Based on three-dimensional RFEM, Hicks and Spencer [5] developed a numerical method to calculate the R sys that no local failure event will occur for long slopes consisting of statistically homogeneous soils. The RFEM is regarded as a versatile approach to predict the responses of large-scale subgrade slopes, mainly because no prior assumption concerning the location and shape of failure surfaces is required. However, it is not trivial to carry out a full three-dimensional probabilistic analysis for long earth slopes due to the immense computational expense. A VNK (Veiligheid Nederland in Kaart) method with less computational effort was proposed in the Netherlands when assessing the system reliability of dike rings [20][21][22]. A dike ring is divided into multiple adjacent segments within which soil properties can be regarded as statistically homogeneous, and the length of each segment ranges from 150 to 2000 m, with an average of 750 m [21 -23]. The reliabilities of all segments are combined to obtain the probability that no instability event occurs in any segment, i.e., system reliability, in which the series system model is adopted. A series system means failure of any segment triggers the loss of system function [24,25], which is applicable to flood defense since breaches in any location will cause flooding and vast losses. The abovementioned three-dimensional approaches can be classified into two categories: continuous and discrete methods. The former treats a long slope as an indivisible object, such as Vanmarcke and RFEM method. The latter treats a long slope as a discrete system composed of many components, such as VNK method. They both use one single indicator (i.e., R sys ) to describe the reliability level of long slopes, which provides engineers with confidence that no local instability event will occur. The occurrence probability that the number of local failure events does not surpass a tolerated quantity more than zero cannot be obtained.
To evaluate the system reliability of long continuous subgrade slopes considering multiple potential local instabilities, this work proposes a dual-indicator discrete method (DDM) easy to be employed in practice. The properties of soils are assumed to be statistically homogeneous. First, a long subgrade slope is equally divided into many adjacent sections based on the number of local instabilities predicted by RFEM. Each section statistically contains a potential instability. Then, the k-out-of-n system model is adopted to describe the relationship between the acceptable number of failure sections, the reliability of sections, and the reliability of the entire subgrade slope. Finally, two indicators named acceptable failure ratio acc and system failure probability

3
Rail. Eng. Science (2022) 30(4):482-493 P f,sys are used to describe the reliability level of subgrade slopes together. acc is the ratio of the acceptable number of local failures to the total number of sections, and P f,sys presents the possibility that the acceptable failure ratio is exceeded by actual failure ratios. Figure 2 presents the diagram of the process of DDM. It is noted that, for the system reliability design of new subgrade slopes, engineers usually want the probability of no local instability to be greater than a prescribed value, e.g., 95%. But for the system reliability evaluation of existing subgrade slopes, engineers need a more comprehensive understanding of the level of system safety, not just the probability of no instability, but the occurrence probability of multiple instabilities. Actually, it is not rare that multiple local failure events are encountered along a rail line in engineering practice.
The rest of this paper is organized as follows. In Sect. 2, the segmentation method of long subgrade slope is established. In Sect. 3, the k-out-of-n system is introduced to derive the expression of the system reliability of subgrade slopes. In Sect. 4, a case study is provided to illustrate the use of DDM in current engineering practice, where spatial data of soil properties is unavailable. In Sect. 5, some concluding remarks are listed.

Discrete instability modes of long subgrade slope
Using the three-dimensional RFEM, Hicks and Spencer [5] identified three modes of instability of long soil slopes composed of statistically homogeneous soils, as illustrated in Fig. 3. The analyzed long slope has an angle of 45°, a height of 5 m, and a length of 100 m. The investigation shows that the instability modes depend on the magnitude of the horizontal SOF h of soil strength parameters relative to slope length L and height h , and has little relationship with the vertical SOF v . In the study, h ranges from 1 to 1000 m, and v is fixed as 1 m. The following are general outlines of the three failure modes.
Mode 1: For h < h , as the h is too small to allow a rupture surface to develop through semi-continuous weaker zones, the failure occurs through weak and strong zones along its entire length. This mode is analogous to a twodimensional deterministic analysis based on mean values of soil properties.
Mode 2: For h ≤ h < L∕2 , the h becomes large enough and local failure mass propagates much possibly through horizontal semi-continuous weaker zones. The reliability of a slope decreases with increasing L due to the increased chance of encountering a zone weak enough to trigger a failure.
Mode 3: For L∕2 ≤ h , the soil presents a layered appearance and the failure extends along the length of a slope, resulting in a global failure. In this case, the failure surface develops along weak layers and appears analogous to that from a two-dimensional stochastic analysis.
According to Phoon and Kulhawy [18], El-Ramly et al. [17], and others [26,27], the horizontal SOF of soil properties typically ranges between 10 and 100 m for various soil types. In engineering practice, the subgrade slope height mostly varies from 3 to 20 m, whereas the length could extend from several to tens of kilometers. A prominent feature of subgrade slopes is the large value of L∕ h and L∕h . Therefore, the instability mode for long subgrade slopes will theoretically be mode 2, which is in line with practical observations.

Prediction of the number of local instabilities
For short soil slopes, it is less possible to encounter many failure events owing to the lower probability of more than one weak domain existing along the length direction [13]. But, the occurrence probability rises with increasing slope length. For example, multiple local instabilities can be found in long subgrade slopes along operating railway lines. The prediction of the number of potential local instabilities is important for the system reliability evaluation of subgrade slopes. A study by Hicks and Li [13] regarding mode 2 provides a possible way to determine the number of local instabilities for long subgrade slopes.
Using the three-dimensional RFEM, the discrete failure features of L = 500 m long slope composed of statistically homogeneous cohesive soils, with a height h = 5 m and an angle of 26.6°, were explored by Hicks and Li [13]. Four values of h were utilized, namely 12, 24, 50, and 100 m, respectively. The vertical SOF was taken as a constant of 1 m since it has little effect on the discrete failure feature of long slopes [5]. The safety factor based on mean property values was fixed as 1.30. For each case of h , 1000 Monte Carlo simulations for the random field of soil properties were carried out, and the number of discretely distributed local instabilities was counted. Hicks and Li [13] indicate that the number of local failures is significantly influenced by h . There can be many discrete failures within the length when h is small, and the number declines apparently with the increase of h . Based on the number of discrete failures of 1000 Monte Carlo realizations, as shown in Fig. 4, the 95% quantile of the failure number is around N 95 = 9 as h = 12 m, and N 95 decreases to 6, 4, 3 as the h grows up to 24, 50, and 100 m, respectively. Besides, basedon the failure feature of mode 3, the number of failure events will be 1 when h = L∕2 and L.
Theoretically, to get the number of potential local instabilities for subgrade slopes, the full-size RFEM model can be built and analyzed. However, it is extremely difficult to apply the RFEM to all subgrade slopes encountered in practice due to the formidable computational cost. A simple yet effective way is established herein to predict the number of discrete local instabilities for subgrade slopes with any length, based on the study of Hicks and Li [13]. As the slope with a length of 500 m is long enough to eliminate the influence of boundary conditions on the stability analysis results, the 95% quantiles in Fig. 4 could largely represent the upper bound of the number of potential local instabilities. Hence, these statistical results are seen as a benchmark to predict the number of potential failures for longer subgrade slopes. As listed in Table 1, the N 95 for 500 m long slope is extended as the number of potential local failures per kilometer ( N 1km ) by multiplying a factor of two. Then, the total number of potential discrete local instabilities is expressed by where the total length L of subgrade slopes is in kilometers.
For illustration, providing L = 100 km long subgrade slope with similar geometries and soil properties to those in Hicks and Li [13], if h = 24 m, the n will be 12 × 100 = 1200. It should be noted that the values shown in Table 1 are only applicable to situations that slope geometries and soil properties are similar to the model used in the literature [13], not necessarily suitable for more general circumstances. Further research is required to examine the effect of slope geometries as well as soil properties on the number of potential local instabilities.

Segmentation of long subgrade slope
Since soil properties are statistically homogeneous in three-dimensional space, a subgrade slope with n predicted potential local instabilities is equally divided into n adjacent sections. Each section statistically contains no more than one potential local instability event, with a confidence of 95%. The stability status of arbitrary two sections would be largely independent, and the failure probabilities of any two sections are assumed to be independent in this work. In reality, the stability status of two adjacent sections may be related, and strictly speaking, this dependency should be measured and considered when analyzing the system reliability of subgrade slopes. However, this relevance is hard to be determined. In addition, based on probability theory,  when the reliability of components is assumed to be independent, the results of system reliability analysis are on the conservative side. Based on the value of N 95 , the average lengths L sec of subgrade slope sections are computed and listed in Table 1. For instance, suppose the h = 24 m, then L sec = 500/6 = 83.3 m. Since n is obtained according to the 95% quantile of the RFEM simulation data, L sec represents a minimum length within which one potential failure event could occur in a statistical sense. Besides, the means and standard deviations of the length of sliding masses ( l sli ) are added in Table 1. L sec is approximately four folds of the mean of l sli . The ratio of L sec ∕ h is negatively related to h , decreasing from 4.5 to 3.5, 2.5, and 1.5 when h increases from 12 to 24, 50, and 100 m, respectively.

k-out-of-n model and system reliability formula
Based on the standard of ISO2394 [28], system reliability is defined as the ability of a structure with more than one structural member to fulfill specified requirements. That is, the system reliability analysis depends on the definition of a specified requirement. For a subgrade slope consisting of n sections, it is required that at least k ( 0 < k ≤ n ) sections are normal, and accordingly, the maximum tolerated failure section is m = n − k ( 0 ≤ m < n ). This can be modeled by the k-out-of-n system [25], as shown in Fig. 5. If m = 0 , the system is called the series system [24,25], which is a special case of k-out-of-n system. Letting the actual number of failure sections be m act , the actual failure ratio and acceptable failure ratio can be computed by act = m act ∕n and acc = m∕n , respectively, where act and acc are normalized variables ranging from 0 to 1. Then, the system normal state of subgrade slope can also be defined by act ≤ acc , and the system failure state means act > acc . The system reliability R sys stands for the probability that act ≤ acc , and the P f,sys presents the probability that act > acc . If all sections have the same failure probability P f,sec , the system failure probability is given by In engineering practice, failure probabilities of different subgrade slope sections are generally different. To compute the system failure probability P f,sys , all possible combinations of section statuses fulfilling the system failure state need to be considered. These combinations are referred to as system failure scenarios. The total number of system failure scenarios is given by sce contains all possible combinations of section statuses satisfying system failure state, with a size of n × Q . For any status vector S q ( q = 1, 2, … , Q ), the sets of subscripts of normal and failure sections are denoted by Nor q and Fai q , respectively. Take S 1 as an example, the Nor 1 will be {1, 2, … , n} and Fai 1 will be empty. Then, the occurrence probability of the q -th system failure scenario is expressed as Then, the system failure probability is the sum of P f,q : (4) sce = S 1 , S 2 , ⋯ , S Q n×Q . Equation (2) is a special case of Eq. (6) where all components have the same failure probability P f,sec .

Two indicators describing system reliability
The acceptable failure ratio acc and the system failure probability P f,sys should be used synergistically to describe the reliability level of long subgrade slopes. Among them, acc reflects the engineers' expectations and requirements for the reliability of subgrade slopes, and P f,sys quantifies the possibility that acc is exceeded by the actual failure ratio act . For instance, if a P f,sys = 0.6% (i.e., system reliability index sys = 2.5) is obtained when setting acc = 1%, one has a 99.4% confidence that act is no greater than 1%.
For subgrade slopes with different degrees of failure consequence, different values of acc should be adopted. The second generation of Eurocode 7, to be published in the early 2020s [29], classifies geotechnical structures into three geotechnical categories (GC) that combine the consequence class (CC) and the geotechnical complexity class (GCC). For GC1, GC2, and GC3, the values of 1.0%, 0.5%, and 0.1% are suggested for acc , as shown in Table 2. The acc = 1% means that only one component is allowed to fail in every 1000 components in a k-out-of-n system. For some special structures such as monumental structures or structures that will have unbearable consequences of failing, the series system model should be utilized, i.e., acc = 0.

Factors influencing system failure probability
This section investigates the influence of the number of sections n , section failure probability P f,sec , and the acceptable failure ratio acc on the system failure probability P f,sys , based on Eq. (2). Figure 6 shows the system failure probability P f,sys versus section failure probability P f,sec . A range of 3.17 × 10 −5 -1.59 × 10 −1 for P f,sec is considered, corresponding to a range of 4.0-1.0 of section reliability index sec . The total section number n = 1000 and the acceptable failure ratio acc = 0.010 are utilized for illustration ( m = n × acc = 1 ). In Fig. 6, P f,sys has an S-shaped curve and keeps rising with the increase of P f,sec , indicating that weak components always result in poor performance of the system. P f,sys grows up sharply in the middle interval of P f,sec , e.g., from 0.006 ( sec = 2.51 ) to 0.016 ( sec = 2.14 ). This interval of P f,sec is called sensitive interval (SI). However, when the value of P f,sec is very small ( 3.17 × 10 −5 -6.00 × 10 −3 ) or very large (0.016-0.159), the P f,sys increases slowly. These two intervals are called insensitive intervals (II). If the section failure probability P f,sec lies in the SI, a minor change of P f,sec can trigger a considerable mutation in system safety, i.e., P f,sys , suggesting that the section reliability evaluation requires higher precision than that when P f,sec is located out of SI. Figure 7 shows the influence of section number n on the system failure probability P f,sys , where the acc is fixed as 0.1% and n = 1000 , 2000 , 3000 are used for illustration. A larger n produces a steeper P f,sys curve in the middle range of P f,sec , which leads to a narrower sensitive interval and wider insensitive intervals. That is, for a system with more components, the P f,sys is more sensitive to P f,sec located in SI and less sensitive to P f,sec located in II. Besides, for a given value of P f,sec , the P f,sys with a larger n is not necessarily larger than that with a smaller n (see vertical dashed lines L1 and L2). Moreover, the same P f,sys may be observed even if different section numbers n are used (see the point of intersection), because of the different values of m that they have.  Figure 8 shows the influence of the acceptable failure ratio acc on a system failure probability P f,sys , where n is fixed at 1000. acc has a positive effect on the width of SI. That is, the larger the acc is, the less sensitive of P f,sys to P f ,sec becomes. In addition, the P f,sys sharply decreases with the increase of acc . Taking P f,sec = 0.002 for example, the P f ,sys decreases from 64.3% (point C) to 2.4% (point D) when acc increases from 0.001 ( m = 1 ) to 0.005 ( m = 5 ). In other words, one has the confidence of 35.8% that m act does not exceed 1, whereas one has the confidence of 97.6% that m act does not exceed 5. Figure 8 also provides useful information for guiding the design of long subgrade slopes. For instance, if one hopes a subgrade slope has system reliability of 95% ( sys = 1.65 ), the failure probability of each section is required to be less than 6.21 × 10 −3 ( sec = 2.50 ) when the acceptable failure ratio acc = 0.010 (point E). However, the P f,sec is required to be less than 2.64 × 10 −3 ( sec = 2.80 ) when the acc = 0.005 (point F). In other words, one can save lots of investment to improve the safety level of each section by slightly accepting more local instability events. When considering the economic criterion, the k-out-of-n system model provides an alternative approach to design the system reliability of subgrade slopes.

Case study
The spatial parameters of soil properties such as SOF are generally not required in the current design specifications of railway engineering, leading to a lack of such data in site investigation reports. Besides, subgrade slopes are not always continuous and soil properties are not always statistically homogeneous. To apply DDM at the current stage, the segmentation of long subgrade slopes and the calculation of sectional slope reliabilities need to be reasonably simplified. This section shows a possible way to apply DDM to a built high-speed railway project, in which only the point statistics of soil properties (i.e., mean and standard deviation) and slope geometries are accessible.

Problem description
The high-speed railway project to be assessed began in 2015 and was currently under construction at the time of writing this article. The total length of the railway line is 211 km with mileage from K5 + 000 to K216 + 000, of which the total length of subgrades is around 206 km, including 46.91 km of cuttings, 13.18 km of embankments, and 5.91 km to be constructed. The rail line is located in elevated portions of the temperate zone, with elevation ranging from 1200 to 2000 m. The region along the route has a semi-arid climate featuring dry and warm to hot summers and cold winters. Due to such topography and climate conditions, water infiltration and seepage rarely happen, and the likelihood of rainfall-induced slope instability events is extremely low.
In the site investigation report, three types of slopes were not considered since they have little effect on railway safety, including (1) a slope height less than 2 m, (2) a slope gradient less than 1:3, and (3) a distance larger than 3 m between the toe of cutting slopes and the ditch of the engineered structure.    of is rationally neglected. The site investigation was carried out between 2015 and 2018. For soil samples collected in embankments, direct shear tests were performed on these samples to obtain their strength properties. Dynamic cone penetration testing was used on-site to evaluate the mechanical properties of soil samples in cut sections [30], and the original data were converted to cohesion and friction angles [31] to facilitate the probabilistic analysis of soil slope stability. During the investigation, local instabilities of two distant cut slopes were reported.

Segmentation of long subgrade slope
There are two stages to divide the subgrade slope into multiple sections. In the first stage, the subgrade is divided into many segments in the following principles: (1) the boundary between subgrade slope and structure, such as bridge, (2) a change in the type of slope, i.e., cutting and embankment, (3) an apparent change of slope height, i.e., greater than 1 m, and (4) an apparent change in the statistics of strength parameters such that they can no longer be regarded as statistically homogeneous. In the second stage, continuous subgrade slope segments composed of statistically homogeneous soils, they are further divided into multiple sections as per Sect. 2. Nevertheless, the SOF of soil properties is not provided in the survey report, and the number of sections cannot be directly computed.
Based on the work of Hicks and Li [13], the h of soil properties typically ranges from 10 to 100 m, and L sec is around 3.5 to 1.5 folds of h as h increases from 12 to 100 m. That is, L sec varies from 35 to 150 m when h is unknown. For slopes with different parameters, these ratios may change. To divide continuous long subgrade slopes into multiple sections, a simplified yet practical DDM is proposed herein. The value of 100 m is adopted as the empirical value of L sec . For a segment, the residual length less than 100 m will be ignored. Discretely distributed subgrade segments shorter than 100 m are regarded as individual sections. In total, there are 997 slope sections. For comparison, L sec = 50 m is also analyzed. The corresponding total number of slope sections is 1980.

Computation of sectional slope reliability
For the reliability analysis of long soil slopes, Vanmarcke [15] proposed an analytical method using local average theory in which sliding mass is assumed to be a cylinder cut by two vertical planes. Zhang et al. [32] improved the Vanmarcke method by changing vertical planes to ellipsoidal surfaces which is more in line with reality. They can also be analyzed using RFEM [33]. However, all the above methods require the horizontal and vertical scale of fluctuations, which are not available in most current investigation reports. Based on slope geometries and the point statistics of soil properties, only the reliability analysis of cross-sectional slope can be carried out.
Whether or not considering the spatial variability of soil parameters, the reliability obtained by three-dimensional probabilistic analysis ( R sec ) is generally greater than that of cross-sectional analysis ( R cs ) due to end effect [15,32]. The end effect means that the resisting moment provided by two end parts of a three-dimensional sliding mass is larger than the driving moment provided by it. That is, using two-dimensional slope reliability analysis results instead of three-dimensional slope reliability analysis results is on the conservative side. In this case study, the reliability of slope sections will be substituted by that of cross-sections taken from them, i.e., letting R sec = R cs . The histograms of the reliability index ( sec ) of slope sections are shown in Fig. 9. In the two situations, the mean of sec is 4.49, and the mean and standard deviation (s.d.) of sec are almost the same; the slope with sec > 2 accounts for more than 99.5%, and the slope with sec > 3 accounts for more than 97.5%. The number of slopes with sec < 2 for the two situations is only 5 and 9, respectively. For most engineered slopes, = 2-3 is usually thought to be large enough to ensure stability, corresponding to a failure probability of 2.3%-0.13%.  Figure 10 shows the occurrence probability P versus the actual number of failure sections m act , which changes from 0 to 5. For the situation of L sec = 100 m, the probability P of the event that no local instability will occur is 63%, i.e., m act = 0, and P = 29% for the event that m act = 1. P decreases nonlinearly with increasing m act . When the actual number of failure sections reaches 4, the occurrence probability is only 8.5 × 10 −3 . That is, the most possible result is that the actual number of failure sections equals zero. The probability of the event that the total number of failure sections is no greater than 2 reaches up to 98.30%. Thus, if the acceptable number of failure sections m is 2, the system failure probability will be P f,sys = 1.70%. For the situation of L sec = 50 m, the decreasing law of P is also applicable. The probability of the event that the total number of failure sections is no greater than 2 reaches up to 97.00%. Figure 11 shows the curve of system failure probability P f,sys versus the acceptable number of failure sections m , where P f,sys decreases sharply with the increase of m from 0 to 5. In the Chinese code for risk management of railway construction engineering [34], the occurrence probability of an event is divided into five categories, corresponding to events with different frequencies, including frequently ( P ≥ 0.3), occasionally (0.03 ≤ P < 0.3), seldom (0.003 ≤ P < 0.03), rarely (0.0003 ≤ P < 0.003), and almost never ( P < 0.0003), as displayed in Fig. 11. For the situation of L sec = 100 m, the acceptable number of failure sections varying from 0 to 5 can be frequently, occasionally, seldom, rarely, and almost never exceeded by actual values m act . The system reliability level can be described as having a 36.6% confidence that the actual number of failure sections is greater than 0, or having a 0.90% confidence that the actual number of failure sections is greater than 2, etc. The full data is listed in Table 5. Based on Figs. 9 and 11, although most cross-sectional slope reliability indices are larger than 3, there is still a considerable probability to encounter several local instability events along the railway line. This corroborates the length effect in the system reliability analysis of long side slopes. For the situation of L sec = 50 m, the P f,sys is always larger than that of the situation of L sec = 100 m, because the number of components in the former system is twice the latter one.

Evaluation of system reliability
There are two aspects of simplifications when applying DDM to the real subgrade slope system lacking spatial data. One is the segmentation of subgrade slopes based on empirical L sec , and the other is using R cs to substitute R sec For the former simplification, the prediction of system reliability may be conservative ononconservative depending on the magnitude of L sec (e.g., 50 m) relative to the actual section length determined by rigorous approaches. Based on the case study, when making L sec = 50 and 100 m respectively, the difference between P f,sys rapidly increases with increasing m (see Fig. 10). That is, the determination of L sec has a  considerable impact on prediction results, and an unreasonable value of L sec may lead to wrong outcomes. The latter simplification is conservative since R sec is always greater than R cs . Based on Zhang et al. [32], the ratio R sec ∕R cs decreases with the increase of the length of sliding mass or the horizontal SOFs of shear strength parameters. For slopes with typical geometry and soil parameters, the ratio mostly ranges from 1 to 2. For subgrade slopes that lack essential spatial data, the computation of system reliability on the basis of empirical L sec and R cs provides decision-makers helpful additional information to get as comprehensive a picture of long subgrade slope systems as possible, although the two simplifying measures bring uncertainties to the prediction of system safety level. Actually, various methods have been developed to characterize this parameter from soil data, particularly CPT measurements [19]. Thus, to assess the system safety of long subgrade slopes using DDM, one of the greatest challenges lies in incorporating the survey of SOF into site investigation specifications. Another major challenge stems from the specificity of soil properties at different sites, which is a distinctive and fundamental feature of geotechnical engineering practice. To overcome this limitation, the establishment of a global database of SOFs will be a meaningful work direction [35].

Concluding remarks
This paper develops a DDM method to evaluate the system reliability performance of long subgrade slopes. DDM is an improvement of the VNK method in three aspects. First, long subgrade slopes are segmented into multiple adjacent sections based on the number of potential local instabilities predicted by the random finite element method. Second, two indicators are adopted to describe the system reliability performance, namely the acceptable number of failure sections m and the system reliability R sys . The former characterizes the designer's expectation of system safety, and the latter expresses the confidence that m will not be exceeded. Third, the k-out-of-n system model with redundancy features is introduced to establish the relationship between the tolerance threshold m and the system reliability R sys .
Parametric analyses are conducted to investigate the influence of impact factors on system reliability. The total number of slope sections n is negatively related to the horizontal SOF of soil properties and positively related to the length of subgrade slopes. R sys decreases with increasing n , decreasing m , or decreasing reliability of slope sections R sec . Subgrade slopes with larger length or weaker soil strength face a higher risk to encounter more local instabilities, and there may still be a considerable possibility to encounter local instabilities even if all sections have high reliability. When analyzing or designing the stability of subgrade slopes, system reliability should be given sufficient attention in addition to the traditional cross-sectional reliability.
A case study is provided to show the application of DDM when lacking spatial data of soil proprieties. The DDM is simplified in two aspects. First, subgrade slopes are segmented into many sections based on the empirical length of slope sections L sec . Second, the reliability of sections R sec is substituted by that of cross-sections R cs taken from them. The first simplifying measures may lead to conservative or unconservative results, and the second will make the system reliability analysis results conservative. Nevertheless, by cautiously estimating the lower and upper values of L sec , one can roughly evaluate the bounds of system reliability using the simplified DDM. It is highly recommended that the spatial data of soil properties be determined in future site investigations.
In many cases, subgrades, bridges, and tunnels together form the foundation of a railroad. In addition to subgrade slopes, there are usually a large number of natural slopes along the line, and their instability will also have a great impact on rigid structures as well as transition sections [36,37]. In a broad sense, all slopes along a rail line can be regarded as the k-out-of-n system. By analyzing the reliability of this system, the overall landslide risk of a line can be assessed.