clm-76deae4754d7f3f2
quantitative
Two steel doors, each 210 metres wide, lie in dry docks on the banks of the Nieuwe Waterweg at Hoek van Holland
⭐ Landmark
.jpg?width=1400)
Maeslant Barrier: Software Gives the Order to Close Rotterdam to the Sea
The storm surge barrier that guards Rotterdam was built so that no person gives the order to close: a computer reads the forecast and decides, because its designers judged a human decision the weaker link. Since 1997 it has closed at its real trigger once, during storm Pia in December 2023. In August 2026 a government review called the system that carries out the computer's order unacceptable, with almost 100 known defects. Rijkswaterstaat disagrees.
This overview was generated with AI from the public sources listed below and checked against them before publication. It has not had a complete human fact-check — treat it as a starting point and follow the sources.
88 sourced claims on this page, none individually verified yet — turn on “Sources in the text” to see each one.
How this atlas is made · What “last verified” means · What “source-checked” means · The full record behind this page
✎ Updated 6 Nov 2026 4 sources added. · 5 revisions in all What changed →
Marks every sourced claim in the text — click a mark to see the source behind it.
- What happened
- The Maeslant barrier was designed so that no person gives the order to close Rotterdam to the sea. A forecasting system called BOS reads the water levels and starts the closure itself once the predicted level reaches 3 metres above NAP at Rotterdam, because the engineers who built it judged a human decision to be the weakest link in a structure that had to be as reliable as a dike.
- What the evidence shows
- That threshold has been reached once since the barrier entered service in 1997: on 21 December 2023, during storm Pia. Two earlier storm closures, in 2007 and 2018, ran at a deliberately lowered trigger to test the systems, and every September the barrier closes once more as a rehearsal.
- What's still open
- The decision software, built with formal methods in the 1990s, is not where the trouble is. In August 2026 the government’s ICT review board called the system that carries out its commands — replaced in 2012 — unacceptable for a safety-critical structure. Rijkswaterstaat says the barrier still meets its legal requirement, and aims to replace that system before the 2030 storm season.
Outcome🔄 Ongoing
Evidence🔬 Peer-reviewed
what does this mean?
The strongest source behind this entry is an independent peer-reviewed or academic study. It grades who did the looking — not how well the project went. All four grades →Run byRijkswaterstaat
Scale🌍 National
CostNearly half a billion euros (Watersnoodmuseum); €450 million, about €738 million at 2023 prices (DutchNews)
Part of 1001 Smart Cities — 1,247 documented projects · 🏙️ 4 more in Rotterdam · 🌊 Flood resilience guide · 🌱 Environment projects
At a quarter past eight on the evening of 21 December 2023, with storm Pia pushing the North Sea into the mouth of the Nieuwe Waterweg, two steel arms began to move out of their dry docks on either bank. The barrier was being closed from 20:15 and was shut around 22:00, NOS reported. For the first time, the barrier's own criterion, an expected water level of 3.00 m at Rotterdam, had been reached, and the software that watches that number started the closure. All six of Rijkswaterstaat's storm surge barriers closed that night, the Maeslant barrier automatically for the first time. The Maeslant and Hartel barriers reopened at 04:45 the next morning. The national expertise network for flood protection, ENW, later estimated what the closure had done: with the barrier shut, the water at Rotterdam reached about NAP +2.4 m, against about NAP +3.0 m had it stayed open — and the quays on the Noordereiland in Rotterdam lie at NAP +2.4 m at their lowest point.
3.0 mabove NAP at Rotterdam (or 2.9 m at Dordrecht): the forecast level at which the software decides to close
1closure against a real storm at that level, on 21 December 2023
1 in 100the legal limit: the barrier may fail to close at most once per hundred storm closures
~100known defects in the control software, according to the ICT review board in August 2026
Why the order was taken away from people
The barrier exists because the Nieuwe Waterweg could not simply be dammed. The Maeslant barrier was not part of the original Delta Plan, which assumed that the shipping route to the port of Rotterdam would stay open; a storm surge barrier that stays out of the way until it is needed was the answer. Unlike the other Delta Works, it was not built by Rijkswaterstaat; a design competition was held, and the Bouwkombinatie Maeslantkering won it. Construction began in 1991, and six years later Queen Beatrix officially commissioned the barrier. Each of its two doors is 210 metres wide and 22 metres high, and Rijkswaterstaat says no water barrier in the world has larger moving parts.
The brief also set a ceiling. The barrier had to close at 3 metres above sea level, but no more than once or twice every ten years, because every closure stops the traffic to the port of Rotterdam. The developers of the control system put the dilemma plainly: an unnecessary closure costs millions of guilders in restricted shipping, while a closed barrier can also flood the city through the Rhine if its water cannot flow out to sea.
The step that makes the barrier unusual followed from a reliability calculation. The main requirement was that it be as reliable as a dike, and a careful failure analysis concluded that manual control would undermine that reliability. The reasoning was not about pressure from the port but about people in general: a normal human being has a failure probability of one in a thousand for a complex task like deciding when to close the barrier and then closing it. The software was given a far tighter target. Failing to close when needed was to be less likely than one in ten thousand, and failing to open when asked less likely than one in a hundred thousand — opening counted as the graver failure, because a barrier that stays shut can be destroyed by river water pressing from the land side. BOS was classified at the highest Safety Integrity Level under IEC 61508.
How the decision software was built
BOS — the Beslis- en Ondersteunend Systeem, or decision and support system — was developed by CMG Den Haag, commissioned by Rijkswaterstaat, with the hydrological knowledge and model-based water-level predictions supplied by the Waterloopkundig Laboratorium. It decides on the basis of weather forecasts, water-level measurements and the results of flood simulations; a trade-press visit in 2010 reported that the computer makes a calculation for the coming 24 hours every ten minutes.
Its developers used formal methods — mathematical specifications that can be checked by machine — at a time when that was rare in industry. Development took three years and about 25 person-years, producing 20,000 lines of formal specification and 450,000 lines of C++, of which 200,000 lines formed the operational system and 250,000 the simulators, test systems and supporting software. Model checking with Promela and Spin found significant errors and omissions in early designs. The authors were careful about what that meant: not a single line of program code was completely proved correct. BOS was completed in October 1998, on time and within budget.
BOS only decides. On BOS's command, a second system called BESW operates the barrier: the closure starts by flooding the dry docks in which the walls lie, so that they float, after which they are sailed into the waterway and sunk. That takes time on purpose. At the 2025 test, sailing out, closing and sinking the arms took just over two hours; an operations spokesman told DutchNews that just dropping the structure into the river would send big waves into Rotterdam.
Three storm closures, or one
How often the barrier has closed against the sea depends on whom you ask, and when. On 8 November 2007 a north-westerly storm pushed the water up along the coast, and Rijkswaterstaat's storm surge warning service reported that the Hartel and Maeslant barriers had closed during a storm surge for the first time. A water-sector magazine wrote that the closure on the evening of 8 November was the work of a computer. But the closing level had been changed for that season. On 3 January 2018 the barrier closed again, for a test, and would normally not have closed because the water was not high enough; as in 2007, the closing level had been lowered to 2.60 metres above NAP. A Rijkswaterstaat spokesperson said then that a water level of 3 metres above NAP had never occurred at Rotterdam during a storm. Storms in 2002, 2013 and 2014 nearly closed it, but the official closing level was just not reached.
Since storm Pia, Rijkswaterstaat counts differently. In 2007 and 2018 the barrier also closed during storms, but under a temporarily lowered closing level in order to test the systems, it wrote on the night of 21 December 2023. In a memo of September 2026 the count is explicit: since it was built, the barrier has closed because of a storm only once, in December 2023. The page you are reading follows that count, and keeps the older one beside it, because both come from the operator.
Rijkswaterstaat has since written the test into a rule. If seven years pass without a storm closure, Rijkswaterstaat lowers the official closing level once to 2.6 m at Rotterdam, instead of 3 m, to test the barrier for real. And every September the Hartel and Maeslant barriers make a test closure; the 28th, on 13 September 2025, went smoothly.
The part that was replaced
The barrier’s reliability has been in question for most of its life. In a 2006 study Rijkswaterstaat found that both the Maeslant and Hartel barriers failed their technical reliability requirement, which was then that the barriers fail to close when they should at most once in a thousand closures. The latest failure analysis at the time put the probability of not closing at up to 1 in 100 per closure demand, and an external review called that a realistic and achievable value. Today the legal requirement is a failure probability on closing of 1 in 100. None of the documents read for this page records when the requirement moved.
The original control system was renovated, and after the renovation, which started in 2009 and was delivered in 2012, it turned out in 2014 that its reliability could not be sufficiently demonstrated. In 2019 the minister told parliament that the barrier would have a control system of demonstrable reliability before the 2021/2022 storm season at the latest.
That did not happen. In August 2026 the Adviescollege ICT-toetsing, the government’s review board for large IT projects, published its advice on the plan to replace BESW. It found that mistakes were made and things were left undone in the 2012 replacement of BESW, which significantly raised the failure probability; that the software contains almost 100 known defects that can lead to serious failure; that three projects after 2012 to repair the faults and omissions in BESW all failed; and that BESW fails much more often in reality than Rijkswaterstaat's models predict. Its verdict: the current state is unacceptable as the control of a safety-critical object like the Maeslant barrier. The board added a pointed reminder: formal methods were already used thirty years ago to develop BOS, the system that commands BESW.
Rijkswaterstaat answered in a memo to the minister. The need for improvement does not mean the barrier is not working properly now, it wrote, and it concludes that the barrier works according to the legal safety requirements. It does not accept the board’s charge that its way of quantifying software reliability creates false certainty, but endorses working to the IEC 61508 standard and will adapt the project accordingly.
Who can still step in
The order to close belongs to the software; the barrier does not. When high water is expected, a team of Rijkswaterstaat experts is always present to watch the automatic process and intervene if necessary. In 2007 a technical specialist on that team put it simply: it happens automatically, but if needed the team can switch to manual operation. In an emergency the barrier can be operated locally without BOS or BESW.
The ICT review board’s count shows how often that option has been used: in 17 closures there was manual intervention in the control system at least four times. The minister wrote in 2019 that the annual September test closures had each been carried out successfully, including a planned manual closure in 2016; the record does not say that the software managed each closure on its own.
What comes next
The replacement of BESW is now the plan. The new BESW is to last until at least 2045, and Rijkswaterstaat will own the source code. The date is tight: Rijkswaterstaat prefers to finish before 2030, because support for the hardware then ends, and calls the chance of not succeeding real.
Some of the groundwork has been laid. In 2025 a team from Eindhoven University of Technology and Rijkswaterstaat produced a formal specification of BESW in which all behaviour, including manual and testing modes, is specified and all fault situations are taken into account, published at the FMICS 2025 conference. It is not a check of the code that runs today — the motivation was that the barrier's software control is up for replacement — and the precise formal model is confidential for reasons of national security.
The steel has a clock of its own. In a report for Rijkswaterstaat in December 2024, Deltares noted that the truss arms were originally designed on the assumption of 15 storm closures in total over the barrier's life, which runs to 2097. Without measures, the 15th closure would come in 2091, 2076 or 2065, depending on the KNMI'23 sea-level scenario. And on current knowledge the barrier reaches the end of its life at the earliest in 2040, because of too great a risk of buckling in the tube piles of the combi-walls along the abutments. In November 2026 the Delta Commissioner said that the barrier will be due for replacement around 2070, the first of the Dutch Delta Works.
Beyond 2030 the question changes from software to the sea. From 60 cm of sea-level rise the current storm surge barriers will close more often to protect the hinterland, and the ministry expects to replace the barrier between 2070 and 2100, a period that coincides with about 70 cm of sea-level rise. The barrier was designed for at most 50 centimetres of sea-level rise, and because its failure probability is defined per closure request, more closures also mean more failures. A barrier designed to close once or twice a decade will then be asked to close more often — with software that, by then, will have to have been rebuilt at least once.
📊 Impact
Rijkswaterstaat counts one closure against a real storm since the barrier was built: 21 December 2023, when the forecast reached 3.10 m above NAP and the barrier shut around 22:00; the national flood-protection expertise network ENW estimates that the water at Rotterdam peaked at about NAP +2.4 m instead of about +3.0 m. Storm closures in 2007 and 2018 ran at a closing level lowered to 2.60 m to test the systems, and every September the barrier makes a test closure, the 28th in 2025. Its reliability has been in question since a 2006 study found both Europoort barriers failing a requirement of at most one failure in a thousand closures; the legal requirement today is one failure in 100. In August 2026 the ICT review board counted almost 100 known defects in BESW, at least four manual interventions in 17 closures and three failed repair projects since 2012. Rijkswaterstaat replies that the barrier meets the legal requirement.
🎓 Lesson
Automation is possible where the trigger is a single forecast number and the decision is binary, and this barrier shows the bill that comes with it: once the decision is handed to software, the software becomes the safety-critical part and needs the upkeep of a dike. The decision layer, built with formal methods thirty years ago, is not where the 2026 review found the trouble; the execution layer replaced in 2012 is. Rijkswaterstaat aims to replace it before the 2030 storm season and calls the chance of missing that date real, while a human team, which has had to step in, stays on duty.
Sources
↗ Rijkswaterstaat — Deltawerk Maeslantkering archived copyThe operator's page on the barrier: built 1991-1997 at Hoek van Holland; two doors 210 m wide, 22 m high and 15 m deep; closing level 3 m above NAP at Rotterdam or 2.9 m at Dordrecht; closes fully automatically, with an expert team present to monitor and intervene; annual test closure every September; a verification closure at a lowered level after seven years without a storm closure.
↗ Rijkswaterstaat — Maeslantkering open again after the 28th test closure (14 September 2025) archived copyThe 28th test closure of the Maeslant and Hartel barriers on 13 September 2025 went smoothly; sailing out, closing and sinking the arms took just over two hours.
↗ Rijkswaterstaat — Look back at high water and storm Pia (21 December 2023)Updated 9 January 2024 archived copyLive blog of 21-22 December 2023: all six storm surge barriers closed, the Maeslant barrier automatically for the first time; the first time its criterion of an expected 3.00 m at Rotterdam was reached; the 2007 and 2018 storm closures ran at a temporarily lowered level to test the systems; reopening at 04:45.
↗ Rijkswaterstaat — Interview with the barrier manager after the December 2023 closure (22 December 2023)Updated 21 October 2024 archived copyInterview with the barrier manager: the team was alerted 24 hours before an expected 2.60 m, and the forecast then showed the water would reach 3.10 m above NAP. The article gives both 20:15 and 22:15 as times.
↗ Rijkswaterstaat storm surge warning service — Stormvloedflits 2007-09, 8 and 9 November 2007 archived copyRijkswaterstaat's storm surge report on the north-westerly storm of 8-9 November 2007: the Hartel and Maeslant barriers were closed during a storm surge for the first time.
Show 21 more sourcesShow fewer
↗ NOS — Maeslantkering automatisch gesloten, eerste keer door hoogwater (21 December 2023) archived copyThe barrier closed automatically because of high water for the first time; closing from 20:15, shut around 22:00.
↗ NOS — Westerstorm over hoogtepunt heen (3 January 2018) archived copyStorm of 3 January 2018: the barrier closed for a test and would normally not have closed; storms in 2002, 2013 and 2014 nearly closed it.
↗ Hart van Nederland — Primeur: alle vijf waterkeringen dicht (3 January 2018)All five big storm surge barriers closed on 3 January 2018; the Maeslant closing level had been lowered to 2.60 m, as in 2007; a Rijkswaterstaat spokesperson says 3 m had never occurred at Rotterdam during a storm.
↗ Minister of Infrastructure and Water Management — letter to parliament on replacing the barrier's control system, Kamerstuk 35 000 J, nr. 34 (15 August 2019) archived copyLetter to parliament: after the 2009-2012 renovation of the control system its reliability could not be demonstrated (2014); a redesign is to deliver a demonstrably reliable system before the 2021/2022 storm season; 3 January 2018 closure in storm conditions; annual test closures always successful, including a planned manual closure in 2016.
↗ Rijkswaterstaat Zuid-Holland — Achterlandstudie Maeslantkering, main report (15 October 2006)Hinterland study: both movable parts of the Europoortkering failed their technical reliability requirement of at most one failure to close in a thousand closures; the latest failure analysis put the probability of not closing at up to 1 in 100, which an external review called realistic and achievable.
↗ Adviescollege ICT-toetsing — Advies project Vervangen BESW (19 August 2026)Advice of the government's ICT review board on the project to replace BESW: the state of BESW has been unacceptable since the 2012 replacement; almost 100 known defects; at least four manual interventions in 17 closures; three failed repair projects; BESW fails more often than Rijkswaterstaat's models predict; one storm closure to date; legal requirement 1:100; replacement aimed for before the 2030 storm season.
↗ Rijkswaterstaat — memo to the minister on the ICT review board's BESW advice (15 September 2026)Rijkswaterstaat's memo to the minister on the board's advice: improvement is needed but the barrier works according to the legal safety requirements; it rejects the board's 'false certainty' characterisation but adopts IEC 61508; hardware support ends in 2030 and missing that date is a real risk.
↗ Minister of Infrastructure and Water Management — letter to parliament on the Sea Level Rise Knowledge Programme, Kamerstuk 36 800 J, nr. 28 (19 June 2026)Letter to parliament on the Sea Level Rise Knowledge Programme: replacement of the Maeslant and Oosterschelde barriers in 2070-2100, driven by end of service life; from 60 cm of sea-level rise the barriers will close more often.
↗ Watersnoodmuseum — Maeslant Storm Surge Barrier archived copyThe flood museum's account: not part of the original Delta Plan; a design competition won by Bouwkombinatie Maeslantkering; brief to close at 3 m but no more than once or twice every ten years; construction from 1991, commissioned six years later by Queen Beatrix; cost nearly half a billion euros.
↗ DutchNews — Rotterdam's massive storm surge barrier passes its annual test (17 September 2023) archived copyOn the 2023 test closure, quoting the operations spokesman: the structure is sunk slowly because dropping it would send big waves into Rotterdam; cost €450 million; the lowered level for 2007 and 2018 given as 2.65 m.
↗ Tretmans, Wijbrans and Chaudron — Software Engineering with Formal Methods: The Development of a Storm Surge Barrier Control System (author preprint, 7 July 2000)Author preprint of the journal article in Formal Methods in System Design (2001), by researchers from the University of Twente and CMG: why the decision was automated, the software failure-probability requirements, SIL 4, code size, completion in October 1998.
↗ Chaudron, Tretmans and Wijbrans — Lessons from the Application of Formal Methods to the Design of a Storm Surge Barrier Control System (FM'99, 1999)Published 1999 archived copyFM'99 conference paper by the developers: three years and about 25 man-years; 20,000 lines of formal specification and 450,000 lines of C++; Promela and Spin found significant errors in early designs; no line of code was completely proved correct.
↗ Goorden, van de Mortel-Fronczak, van Eldik, Fokkink and Rooda — Lessons learned in the application of formal methods to the design of a storm surge barrier control system (IFAC-PapersOnLine 55, 2022)Published 2022Paper co-written with Rijkswaterstaat staff on lessons from the formal methods used for BOS: BOS closes the barrier based on weather forecasts, water-level measurements and flood-simulation results; expertise in the original methods has declined.
↗ Beers, Booy, Groote, van den Bogaard and Bouwman — A Complete Formal Specification and Verification of the BESW software control system of the Maeslant Storm Surge Barrier (arXiv preprint, 11 April 2025) archived copyFormal specification of BESW in mCRL2 by researchers from Eindhoven University of Technology and Rijkswaterstaat: all behaviour including manual and testing modes and all fault situations; verification limited to a restricted set of water levels and not all pump and valve failure combinations; the model is confidential.
↗ Beers, Booy, Groote, van den Bogaard and Bouwman — the same work in the FMICS 2025 proceedings, LNCS 16040 (28 August 2025)The peer-reviewed version of the same work in the FMICS 2025 proceedings, Lecture Notes in Computer Science volume 16040.
↗ H2O — Eerste daadwerkelijke sluiting Maeslantkering goed verlopen (2007)Published 2007 archived copyWater-sector magazine interview with Rijkswaterstaat staff after the November 2007 closure: BOS calls the team at a forecast of 2.60 m and closes at 3 m; the closure was the work of a computer; the team can switch to manual operation.
↗ Computable — ICT is onmisbaar bij waterbeheer (27 May 2010) archived copyIT trade press visit to the barrier: every ten minutes the computer makes a calculation for the coming 24 hours.
↗ Deltares — Levensduur Maeslantkering, report for Rijkswaterstaat on the barrier's remaining life (17 December 2024) archived copyStudy commissioned by Rijkswaterstaat on the barrier's remaining life: design life 100 years, to 2097; the truss arms were designed for 15 storm closures in total, which would be reached in 2091, 2076 or 2065 under the KNMI'23 scenarios; earliest end of life 2040 because of buckling risk in the combi-wall tube piles along the abutments, otherwise 2065 from fatigue of the arms.
↗ ENW — Water tegen de dijk: the performance of flood defences during the 2023/2024 winter high water (10 September 2024) archived copyThe Expertise Network for Flood Protection's evaluation of the 2023/24 winter high water: the barrier closed automatically for the first time in its history; with the closure the water at Rotterdam reached about NAP +2.4 m, against about NAP +3.0 m had it stayed open; the lowest quays on the Noordereiland lie at NAP +2.4 m.
↗ ENW — Impact zeespiegelstijging op hoogwaterveiligheid, background report to advice 19-08 (November 2019)Published November 2019 archived copyBackground report to the ENW's 2019 advice on accelerated sea-level rise: the barrier was designed for at most 50 cm of sea-level rise; at one metre it would close on average three times a year, more than it is expected to bear structurally; because the failure probability is defined per closure request, more closures mean more failures.
↗ Waterforum — Deltacommissaris wil vroegtijdige afspraken over financiering grote waterwerken (5 November 2026)Trade press report of Delta Commissioner Verdaas in parliament: the Maeslant barrier is the first Delta Work due for replacement, around 2070, unless the Rhine-Meuse mouth is arranged differently.
📅 How old is the evidence?
Two clocks, kept apart: when this entry’s sources were published, and what has happened to its record in the atlas. Documented span: since 1997. 24 of 26 sources carry a publication date, from 1999 to 5 November 2026.
When the sources were published
- Springer · researchChaudron, Tretmans and Wijbrans — Lessons from the Application of Formal Methods to the Design of a Storm Surge Barrier Control System (FM'99, 1999)
- University of Twente · researchTretmans, Wijbrans and Chaudron — Software Engineering with Formal Methods: The Development of a Storm Surge Barrier Control System (author preprint, 7 July 2000)
- Rijkswaterstaat · national governmentRijkswaterstaat Zuid-Holland — Achterlandstudie Maeslantkering, main report (15 October 2006)
- Rijkswaterstaat · national governmentRijkswaterstaat storm surge warning service — Stormvloedflits 2007-09, 8 and 9 November 2007
- H2O (Koninklijk Nederlands Waternetwerk) · pressH2O — Eerste daadwerkelijke sluiting Maeslantkering goed verlopen (2007)
- Computable · pressComputable — ICT is onmisbaar bij waterbeheer (27 May 2010)
- NOS · pressNOS — Westerstorm over hoogtepunt heen (3 January 2018)
- Hart van Nederland · pressHart van Nederland — Primeur: alle vijf waterkeringen dicht (3 January 2018)
Show 16 more dated sourcesShow fewer
- Ministerie van Infrastructuur en Waterstaat · national governmentMinister of Infrastructure and Water Management — letter to parliament on replacing the barrier's control system, Kamerstuk 35 000 J, nr. 34 (15 August 2019)
- Expertise Netwerk Waterveiligheid (ENW) · national governmentENW — Impact zeespiegelstijging op hoogwaterveiligheid, background report to advice 19-08 (November 2019)
- Aalborg University · researchGoorden, van de Mortel-Fronczak, van Eldik, Fokkink and Rooda — Lessons learned in the application of formal methods to the design of a storm surge barrier control system (IFAC-PapersOnLine 55, 2022)
- DutchNews · pressDutchNews — Rotterdam's massive storm surge barrier passes its annual test (17 September 2023)
- Rijkswaterstaat · national governmentRijkswaterstaat — Look back at high water and storm Pia (21 December 2023) · updated 9 January 2024
- NOS · pressNOS — Maeslantkering automatisch gesloten, eerste keer door hoogwater (21 December 2023)
- Rijkswaterstaat · national governmentRijkswaterstaat — Interview with the barrier manager after the December 2023 closure (22 December 2023) · updated 21 October 2024
- Expertise Netwerk Waterveiligheid (ENW) · national governmentENW — Water tegen de dijk: the performance of flood defences during the 2023/2024 winter high water (10 September 2024)
- Deltares · researchDeltares — Levensduur Maeslantkering, report for Rijkswaterstaat on the barrier's remaining life (17 December 2024)
- arXiv (preprint repository) · researchBeers, Booy, Groote, van den Bogaard and Bouwman — A Complete Formal Specification and Verification of the BESW software control system of the Maeslant Storm Surge Barrier (arXiv preprint, 11 April 2025)
- Springer · researchBeers, Booy, Groote, van den Bogaard and Bouwman — the same work in the FMICS 2025 proceedings, LNCS 16040 (28 August 2025)
- Rijkswaterstaat · national governmentRijkswaterstaat — Maeslantkering open again after the 28th test closure (14 September 2025)
- Ministerie van Infrastructuur en Waterstaat · national governmentMinister of Infrastructure and Water Management — letter to parliament on the Sea Level Rise Knowledge Programme, Kamerstuk 36 800 J, nr. 28 (19 June 2026)
- Adviescollege ICT-toetsing · oversight bodyAdviescollege ICT-toetsing — Advies project Vervangen BESW (19 August 2026)
- Rijkswaterstaat · national governmentRijkswaterstaat — memo to the minister on the ICT review board's BESW advice (15 September 2026)
- Waterforum · pressWaterforum — Deltacommissaris wil vroegtijdige afspraken over financiering grote waterwerken (5 November 2026)
Show your work What this page rests on and what it can’t tell you · all 93 claims with their sources · the forensic record
What this page rests on — and what it can't tell you
The page rests on Rijkswaterstaat’s own pages, news items and memos, three letters from the minister to parliament, the developers’ papers on BOS (1999, 2000, 2008, 2022), the 2025 formal specification of BESW, Deltares’ 2024 study of the barrier’s remaining life, two ENW reports, and the August 2026 advice of the Adviescollege ICT-toetsing — the one outside review of the control system in the record. The engineering papers are written by the people who built or now maintain the system, and two of the five authors of the 2025 paper work for Rijkswaterstaat. Four things the record cannot answer: when the reliability requirement changed from one failure in a thousand closures to one in a hundred; the exact opening date in 1997 (no primary document read here gives it); what the barrier cost in its own currency, guilders — the euro figures from the Watersnoodmuseum and DutchNews differ; and whether the test closure of 12 September 2026 succeeded, because no result had been published when this page was written. Anyone who finds a primary source for any of these improves this page — the “Report an error” link at the foot of this page is how.
Evidence file · public beta 93 addressable claims, 26 source dossiers, one permanent baseline. 88 of them are marked in the text above; the other 5 belong to a passage this page does not print, so they can be read here but not clicked in the article. The file is unreviewed — an AI-assisted structural migration, not a human or expert endorsement. Every revision keeps a permanent copy under revision history.
Inspect the claims, one by one — verbatim text, sources and caveats for all 93
The text below is copied verbatim from the published record. Each claim names the source dossiers that carry it; caveats stay attached to the claim they qualify.
clm-d47a6969d47997b2
quantitative
a forecasting system called BOS decides to close when the predicted level threatens to reach 3 metres above NAP at Rotterdam or 2.90 metres at Dordrecht
Sources carrying this claim
clm-abae159afa4221ac
descriptive
because the designers' failure analysis concluded that manual control would undermine the barrier's reliability
Sources carrying this claim
clm-840c4d911ea4d635
descriptive
A team of Rijkswaterstaat experts stands by and can intervene.
Sources carrying this claim
clm-b0fab00436b966c9
quantitative
A second system, BESW, carries out BOS's commands; it was replaced in 2012, and in August 2026 the government's ICT review board called its state unacceptable for a safety-critical structure.
Sources carrying this claim
clm-0b1c7c2b69a03fbb
quantitative
Rijkswaterstaat counts one closure against a real storm since the barrier was built: 21 December 2023
Sources carrying this claim
clm-a6b291d68c604fd1
quantitative
when the forecast reached 3.10 m above NAP
Sources carrying this claim
clm-f31a28e397ab56eb
quantitative
the barrier shut around 22:00
Sources carrying this claim
clm-0af2f6c0f260c989
quantitative
the national flood-protection expertise network ENW estimates that the water at Rotterdam peaked at about NAP +2.4 m instead of about +3.0 m
Sources carrying this claim
clm-ce75c13bcccf7fe6
quantitative
Storm closures in 2007 and 2018 ran at a closing level lowered to 2.60 m to test the systems
Sources carrying this claim
clm-b7d6ae96ec094e4c
quantitative
every September the barrier makes a test closure, the 28th in 2025
Sources carrying this claim
clm-771994a647e7dc96
quantitative
a 2006 study found both Europoort barriers failing a requirement of at most one failure in a thousand closures
Sources carrying this claim
clm-631b9fdadd497c2f
quantitative
the legal requirement today is one failure in 100
Sources carrying this claim
clm-2b2f6aae6b607ebf
quantitative
In August 2026 the ICT review board counted almost 100 known defects in BESW, at least four manual interventions in 17 closures and three failed repair projects since 2012.
Sources carrying this claim
clm-84f64dc1e26fa5af
descriptive
Rijkswaterstaat replies that the barrier meets the legal requirement.
Sources carrying this claim
clm-e200e3aaadba25bf
quantitative
The decision layer, built with formal methods thirty years ago, is not where the 2026 review found the trouble; the execution layer replaced in 2012 is.
Sources carrying this claim
clm-19fbffc5b628f032
quantitative
Rijkswaterstaat aims to replace it before the 2030 storm season and calls the chance of missing that date real
Sources carrying this claim
clm-645e58f896e3591c
descriptive
a human team, which has had to step in, stays on duty
Sources carrying this claim
clm-fc1b0b0abb06fa59
quantitative
The barrier was being closed from 20:15 and was shut around 22:00
Sources carrying this claim
clm-336e4551bf47a74f
quantitative
For the first time, the barrier's own criterion, an expected water level of 3.00 m at Rotterdam, had been reached
Sources carrying this claim
clm-6ef16a0e85d3f2ae
descriptive
All six of Rijkswaterstaat's storm surge barriers closed that night, the Maeslant barrier automatically for the first time
Sources carrying this claim
clm-9de89c8ff72cfd51
quantitative
The Maeslant and Hartel barriers reopened at 04:45 the next morning
Sources carrying this claim
clm-b879008533d459ee
quantitative
with the barrier shut, the water at Rotterdam reached about NAP +2.4 m, against about NAP +3.0 m had it stayed open
Sources carrying this claim
clm-961042b8efe80af1
quantitative
the quays on the Noordereiland in Rotterdam lie at NAP +2.4 m at their lowest point
Sources carrying this claim
clm-55be3628dfa35d89
descriptive
The Maeslant barrier was not part of the original Delta Plan
Sources carrying this claim
clm-b147061792b9a96c
descriptive
Unlike the other Delta Works, it was not built by Rijkswaterstaat; a design competition was held, and the Bouwkombinatie Maeslantkering won it
Sources carrying this claim
clm-a195d00053807247
quantitative
Construction began in 1991, and six years later Queen Beatrix officially commissioned the barrier
Sources carrying this claim
clm-f238d5bfb7ad5913
quantitative
Each of its two doors is 210 metres wide and 22 metres high
Sources carrying this claim
clm-283593ba8d5cd919
descriptive
Rijkswaterstaat says no water barrier in the world has larger moving parts
Sources carrying this claim
clm-df00cf589404171c
quantitative
The barrier had to close at 3 metres above sea level, but no more than once or twice every ten years
Sources carrying this claim
clm-74058323ae3ebb06
descriptive
an unnecessary closure costs millions of guilders in restricted shipping, while a closed barrier can also flood the city through the Rhine if its water cannot flow out to sea
Sources carrying this claim
clm-2f0a13ec257ae3b0
descriptive
a careful failure analysis concluded that manual control would undermine that reliability
Sources carrying this claim
clm-a1544d8ec7759d97
quantitative
a normal human being has a failure probability of one in a thousand for a complex task like deciding when to close the barrier and then closing it
Sources carrying this claim
clm-750f8ef0efaa19cd
quantitative
Failing to close when needed was to be less likely than one in ten thousand, and failing to open when asked less likely than one in a hundred thousand
Sources carrying this claim
- Tretmans, Wijbrans and Chaudron — Software Engineering with Formal Methods: The Development of a Storm Surge Barrier Control System (author preprint, 7 July 2000)
- Chaudron, Tretmans and Wijbrans — Lessons from the Application of Formal Methods to the Design of a Storm Surge Barrier Control System (FM'99, 1999)
clm-78e84ee84a4d90f5
quantitative
BOS was classified at the highest Safety Integrity Level under IEC 61508
Sources carrying this claim
clm-dc2655d204b906a6
descriptive
was developed by CMG Den Haag, commissioned by Rijkswaterstaat
Sources carrying this claim
clm-6144f1c8a77392af
descriptive
the hydrological knowledge and model-based water-level predictions supplied by the Waterloopkundig Laboratorium
Sources carrying this claim
clm-2c1f9c4eac0f6c90
descriptive
weather forecasts, water-level measurements and the results of flood simulations
Sources carrying this claim
clm-471bbd1a9c9995bb
quantitative
the computer makes a calculation for the coming 24 hours every ten minutes
Sources carrying this claim
clm-c9f4876a24c96d11
quantitative
Development took three years and about 25 person-years, producing 20,000 lines of formal specification and 450,000 lines of C++
Sources carrying this claim
clm-28513f5d8e0d296c
quantitative
200,000 lines formed the operational system and 250,000 the simulators, test systems and supporting software
Sources carrying this claim
clm-a3024c689b4f4b0e
descriptive
Model checking with Promela and Spin found significant errors and omissions in early designs
Sources carrying this claim
clm-5692e71641c0c4cc
descriptive
not a single line of program code was completely proved correct
Sources carrying this claim
clm-eeeb348dcabdb5d7
quantitative
BOS was completed in October 1998, on time and within budget
Sources carrying this claim
clm-f650b3617bf9892b
descriptive
On BOS's command, a second system called BESW operates the barrier
Sources carrying this claim
clm-0502b6d13dd51b3a
descriptive
the closure starts by flooding the dry docks in which the walls lie, so that they float
Sources carrying this claim
clm-9e148957dd8d3684
quantitative
At the 2025 test, sailing out, closing and sinking the arms took just over two hours
Sources carrying this claim
clm-760a18dd9b75cf2a
descriptive
just dropping the structure into the river would send big waves into Rotterdam
Sources carrying this claim
clm-dde102264e63a9ab
descriptive
Rijkswaterstaat's storm surge warning service reported that the Hartel and Maeslant barriers had closed during a storm surge for the first time
Sources carrying this claim
clm-99dde53f52453dbd
quantitative
the closure on the evening of 8 November was the work of a computer
Sources carrying this claim
clm-71fb707638d87046
quantitative
On 3 January 2018 the barrier closed again, for a test, and would normally not have closed because the water was not high enough
Sources carrying this claim
clm-469424379792f82c
quantitative
as in 2007, the closing level had been lowered to 2.60 metres above NAP
Sources carrying this claim
clm-44dd132aecd54fdb
quantitative
a water level of 3 metres above NAP had never occurred at Rotterdam during a storm
Sources carrying this claim
clm-9e03d7280c0c49e8
quantitative
Storms in 2002, 2013 and 2014 nearly closed it, but the official closing level was just not reached
Sources carrying this claim
clm-52ea7ed2ef49316c
quantitative
In 2007 and 2018 the barrier also closed during storms, but under a temporarily lowered closing level in order to test the systems
Sources carrying this claim
clm-f53bc68dba304b75
quantitative
since it was built, the barrier has closed because of a storm only once, in December 2023
Sources carrying this claim
clm-cd2909767cecc3d0
quantitative
If seven years pass without a storm closure, Rijkswaterstaat lowers the official closing level once to 2.6 m at Rotterdam, instead of 3 m, to test the barrier for real
Sources carrying this claim
clm-7c38f5e87350349c
descriptive
every September the Hartel and Maeslant barriers make a test closure
Sources carrying this claim
clm-04bbc21c762f6516
quantitative
the 28th, on 13 September 2025, went smoothly
Sources carrying this claim
clm-9a37ae509cf8b447
quantitative
In a 2006 study Rijkswaterstaat found that both the Maeslant and Hartel barriers failed their technical reliability requirement
Sources carrying this claim
clm-cedb95055247f567
quantitative
the barriers fail to close when they should at most once in a thousand closures
Sources carrying this claim
clm-5f2f2c7cd6230a00
quantitative
the probability of not closing at up to 1 in 100 per closure demand
Sources carrying this claim
clm-abebcaf9c82a1cd1
descriptive
a realistic and achievable value
Sources carrying this claim
clm-340f2e7532c0c21e
quantitative
Today the legal requirement is a failure probability on closing of 1 in 100
Sources carrying this claim
clm-1e3d9e838062584a
quantitative
after the renovation, which started in 2009 and was delivered in 2012, it turned out in 2014 that its reliability could not be sufficiently demonstrated
Sources carrying this claim
clm-6c31d596a4487985
quantitative
the barrier would have a control system of demonstrable reliability before the 2021/2022 storm season at the latest
Sources carrying this claim
clm-6900b6720c6185c4
quantitative
mistakes were made and things were left undone in the 2012 replacement of BESW, which significantly raised the failure probability
Sources carrying this claim
clm-fb293284d13f0fcd
quantitative
the software contains almost 100 known defects that can lead to serious failure
Sources carrying this claim
clm-95632840db5f111c
quantitative
three projects after 2012 to repair the faults and omissions in BESW all failed
Sources carrying this claim
clm-1d9842771c6b174c
descriptive
BESW fails much more often in reality than Rijkswaterstaat's models predict
Sources carrying this claim
clm-4e2a04e7e5c04743
descriptive
the current state is unacceptable as the control of a safety-critical object like the Maeslant barrier
Sources carrying this claim
clm-5c90897f1258422f
descriptive
formal methods were already used thirty years ago to develop BOS, the system that commands BESW
Sources carrying this claim
clm-6d6491e92354160f
descriptive
The need for improvement does not mean the barrier is not working properly now
Sources carrying this claim
clm-1acc8bf6d58ebaaf
descriptive
concludes that the barrier works according to the legal safety requirements
Sources carrying this claim
clm-afdb6dd8fd60ba51
quantitative
endorses working to the IEC 61508 standard and will adapt the project accordingly
Sources carrying this claim
clm-657c5390d6577f68
descriptive
When high water is expected, a team of Rijkswaterstaat experts is always present to watch the automatic process and intervene if necessary
Sources carrying this claim
clm-a39f1cb9f20831bf
descriptive
it happens automatically, but if needed the team can switch to manual operation
Sources carrying this claim
clm-bd5fb1b80017a5f8
descriptive
In an emergency the barrier can be operated locally without BOS or BESW
Sources carrying this claim
clm-8efdea47983879ae
quantitative
in 17 closures there was manual intervention in the control system at least four times
Sources carrying this claim
clm-d83a45c18a9dfd04
quantitative
the annual September test closures had each been carried out successfully, including a planned manual closure in 2016
Sources carrying this claim
clm-301c8196584ea21a
quantitative
The new BESW is to last until at least 2045, and Rijkswaterstaat will own the source code
Sources carrying this claim
clm-5c72d87bd376e929
quantitative
before 2030, because support for the hardware then ends, and calls the chance of not succeeding real
Sources carrying this claim
clm-499bb92bea7c3516
descriptive
a formal specification of BESW in which all behaviour, including manual and testing modes, is specified and all fault situations are taken into account
Sources carrying this claim
- Beers, Booy, Groote, van den Bogaard and Bouwman — A Complete Formal Specification and Verification of the BESW software control system of the Maeslant Storm Surge Barrier (arXiv preprint, 11 April 2025)
- Beers, Booy, Groote, van den Bogaard and Bouwman — the same work in the FMICS 2025 proceedings, LNCS 16040 (28 August 2025)
clm-8dc759190f6fdb72
descriptive
the motivation was that the barrier's software control is up for replacement
Sources carrying this claim
clm-bee51fa091f217dd
descriptive
the precise formal model is confidential for reasons of national security
Sources carrying this claim
clm-499480813f155602
quantitative
the truss arms were originally designed on the assumption of 15 storm closures in total over the barrier's life, which runs to 2097
Sources carrying this claim
clm-9e259706f4dd59ff
quantitative
Without measures, the 15th closure would come in 2091, 2076 or 2065, depending on the KNMI'23 sea-level scenario
Sources carrying this claim
clm-020212c6259d1c16
quantitative
on current knowledge the barrier reaches the end of its life at the earliest in 2040, because of too great a risk of buckling in the tube piles of the combi-walls along the abutments
Sources carrying this claim
clm-e8542bb16e2666c8
quantitative
the barrier will be due for replacement around 2070, the first of the Dutch Delta Works
Sources carrying this claim
clm-be61351083531590
quantitative
From 60 cm of sea-level rise the current storm surge barriers will close more often to protect the hinterland
Sources carrying this claim
clm-0e693af841f40a86
quantitative
the ministry expects to replace the barrier between 2070 and 2100, a period that coincides with about 70 cm of sea-level rise
Sources carrying this claim
clm-a752b7f0922982ef
quantitative
The barrier was designed for at most 50 centimetres of sea-level rise
Sources carrying this claim
clm-128b718a322408c6
descriptive
because its failure probability is defined per closure request, more closures also mean more failures
Sources carrying this claim
Forensic record — source dossiers, gaps, hashes and the exact revision this page renders
This layer records what is known about each source, what is still missing, and the exact snapshot this page is rendering. A missing date, archive or hash stays visible as missing.
unreviewed
Revision 2026-11-06-deltares-enw-additions
effective 2026-11-06 · created 2026-11-06
Awaiting operator and domain-expert review; publication of this revision implies neither.
sha256:1c20e6286e3e35d1e31b4583702957b71bb501f506c08d984db56e63620fd5a7
- 93
- of 93 claims mapped
- 26
- source dossiers
- 19
- publication dates recorded
- 17
- archives linked
- 0
- exact locators
- 0
- content captures hashed
Governance facts carried by the record
- Operator
- Rijkswaterstaat
- Actor types
- national-government
- Funding model
- public
- Funding description
- Not recorded
- Cost
- Nearly half a billion euros (Watersnoodmuseum); €450 million, about €738 million at 2023 prices (DutchNews)
- Ownership
- Not recorded
- Decision rights
- Not recorded
- Exit conditions
- Not recorded
26 source dossiers
Rijkswaterstaat — Deltawerk Maeslantkering
- Stable source ID
src-65db1b142fce4e27- Publisher
- Name not classified · rijkswaterstaat.nl
- Type / language
- web-page · language not classified
- Published
- Not recorded
- Updated
- Not recorded
- Source last checked
- No source-level check date
- Record last verified
- 2026-11-06
- Dossier created
- 2026-11-06
- Retrieved copy
- No local capture recorded
- Archive
- Open archived copy ↗ · 2026-10-25
- Content hash
- No captured content hash
- Locator
- Descriptive only — not page/paragraph exact
Open the recorded source note
The operator's page on the barrier: built 1991-1997 at Hoek van Holland; two doors 210 m wide, 22 m high and 15 m deep; closing level 3 m above NAP at Rotterdam or 2.9 m at Dordrecht; closes fully automatically, with an expert team present to monitor and intervene; annual test closure every September; a verification closure at a lowered level after seven years without a storm closure.
Rijkswaterstaat — Maeslantkering open again after the 28th test closure (14 September 2025)
- Stable source ID
src-a742723df11b7b07- Publisher
- Name not classified · rijkswaterstaat.nl
- Type / language
- web-page · language not classified
- Published
- 2025-09-14
- Updated
- Not recorded
- Source last checked
- No source-level check date
- Record last verified
- 2026-11-06
- Dossier created
- 2026-11-06
- Retrieved copy
- No local capture recorded
- Archive
- Open archived copy ↗ · 2025-10-16
- Content hash
- No captured content hash
- Locator
- Descriptive only — not page/paragraph exact
Open the recorded source note
The 28th test closure of the Maeslant and Hartel barriers on 13 September 2025 went smoothly; sailing out, closing and sinking the arms took just over two hours.
Rijkswaterstaat — Look back at high water and storm Pia (21 December 2023)
- Stable source ID
src-5fc9008976a3624f- Publisher
- Name not classified · rijkswaterstaat.nl
- Type / language
- web-page · language not classified
- Published
- 2023-12-21
- Updated
- 2024-01-09
- Source last checked
- No source-level check date
- Record last verified
- 2026-11-06
- Dossier created
- 2026-11-06
- Retrieved copy
- No local capture recorded
- Archive
- Open archived copy ↗ · 2026-03-18
- Content hash
- No captured content hash
- Locator
- Descriptive only — not page/paragraph exact
Open the recorded source note
Live blog of 21-22 December 2023: all six storm surge barriers closed, the Maeslant barrier automatically for the first time; the first time its criterion of an expected 3.00 m at Rotterdam was reached; the 2007 and 2018 storm closures ran at a temporarily lowered level to test the systems; reopening at 04:45.
Rijkswaterstaat — Interview with the barrier manager after the December 2023 closure (22 December 2023)
- Stable source ID
src-55b089c8cc309f97- Publisher
- Name not classified · rijkswaterstaat.nl
- Type / language
- web-page · language not classified
- Published
- 2023-12-22
- Updated
- 2024-10-21
- Source last checked
- No source-level check date
- Record last verified
- 2026-11-06
- Dossier created
- 2026-11-06
- Retrieved copy
- No local capture recorded
- Archive
- Open archived copy ↗ · 2025-12-06
- Content hash
- No captured content hash
- Locator
- Descriptive only — not page/paragraph exact
Open the recorded source note
Interview with the barrier manager: the team was alerted 24 hours before an expected 2.60 m, and the forecast then showed the water would reach 3.10 m above NAP. The article gives both 20:15 and 22:15 as times.
- Claims linked
Rijkswaterstaat storm surge warning service — Stormvloedflits 2007-09, 8 and 9 November 2007
- Stable source ID
src-bd77893529b056aa- Publisher
- Name not classified · open.rws.nl
- Type / language
- pdf · language not classified
- Published
- Not recorded
- Updated
- Not recorded
- Source last checked
- No source-level check date
- Record last verified
- 2026-11-06
- Dossier created
- 2026-11-06
- Retrieved copy
- No local capture recorded
- Archive
- Open archived copy ↗ · 2023-07-22
- Content hash
- No captured content hash
- Locator
- Descriptive only — not page/paragraph exact
Open the recorded source note
Rijkswaterstaat's storm surge report on the north-westerly storm of 8-9 November 2007: the Hartel and Maeslant barriers were closed during a storm surge for the first time.
- Claims linked
NOS — Maeslantkering automatisch gesloten, eerste keer door hoogwater (21 December 2023)
- Stable source ID
src-558708a8fac3d548- Publisher
- Name not classified · nos.nl
- Type / language
- web-page · language not classified
- Published
- 2023-12-21
- Updated
- Not recorded
- Source last checked
- No source-level check date
- Record last verified
- 2026-11-06
- Dossier created
- 2026-11-06
- Retrieved copy
- No local capture recorded
- Archive
- Open archived copy ↗ · 2025-06-17
- Content hash
- No captured content hash
- Locator
- Descriptive only — not page/paragraph exact
Open the recorded source note
The barrier closed automatically because of high water for the first time; closing from 20:15, shut around 22:00.
- Claims linked
NOS — Westerstorm over hoogtepunt heen (3 January 2018)
- Stable source ID
src-11c825d021b903ed- Publisher
- Name not classified · nos.nl
- Type / language
- web-page · language not classified
- Published
- 2018-01-03
- Updated
- Not recorded
- Source last checked
- No source-level check date
- Record last verified
- 2026-11-06
- Dossier created
- 2026-11-06
- Retrieved copy
- No local capture recorded
- Archive
- Open archived copy ↗ · 2025-08-22
- Content hash
- No captured content hash
- Locator
- Descriptive only — not page/paragraph exact
Open the recorded source note
Storm of 3 January 2018: the barrier closed for a test and would normally not have closed; storms in 2002, 2013 and 2014 nearly closed it.
- Claims linked
Hart van Nederland — Primeur: alle vijf waterkeringen dicht (3 January 2018)
- Stable source ID
src-c3fa74ef7aa77a7d- Publisher
- Name not classified · hartvannederland.nl
- Type / language
- web-page · language not classified
- Published
- 2018-01-03
- Updated
- Not recorded
- Source last checked
- No source-level check date
- Record last verified
- 2026-11-06
- Dossier created
- 2026-11-06
- Retrieved copy
- No local capture recorded
- Archive
- No archived copy linked
- Content hash
- No captured content hash
- Locator
- Descriptive only — not page/paragraph exact
Open the recorded source note
All five big storm surge barriers closed on 3 January 2018; the Maeslant closing level had been lowered to 2.60 m, as in 2007; a Rijkswaterstaat spokesperson says 3 m had never occurred at Rotterdam during a storm.
Minister of Infrastructure and Water Management — letter to parliament on replacing the barrier's control system, Kamerstuk 35 000 J, nr. 34 (15 August 2019)
- Stable source ID
src-c10c1956d1834d30- Publisher
- Name not classified · zoek.officielebekendmakingen.nl
- Type / language
- pdf · language not classified
- Published
- 2019-08-15
- Updated
- Not recorded
- Source last checked
- No source-level check date
- Record last verified
- 2026-11-06
- Dossier created
- 2026-11-06
- Retrieved copy
- No local capture recorded
- Archive
- Open archived copy ↗ · 2023-04-12
- Content hash
- No captured content hash
- Locator
- Descriptive only — not page/paragraph exact
Open the recorded source note
Letter to parliament: after the 2009-2012 renovation of the control system its reliability could not be demonstrated (2014); a redesign is to deliver a demonstrably reliable system before the 2021/2022 storm season; 3 January 2018 closure in storm conditions; annual test closures always successful, including a planned manual closure in 2016.
Rijkswaterstaat Zuid-Holland — Achterlandstudie Maeslantkering, main report (15 October 2006)
- Stable source ID
src-ca6d3f24bccce7c2- Publisher
- Name not classified · zoek.officielebekendmakingen.nl
- Type / language
- pdf · language not classified
- Published
- 2006-10-15
- Updated
- Not recorded
- Source last checked
- No source-level check date
- Record last verified
- 2026-11-06
- Dossier created
- 2026-11-06
- Retrieved copy
- No local capture recorded
- Archive
- No archived copy linked
- Content hash
- No captured content hash
- Locator
- Descriptive only — not page/paragraph exact
Open the recorded source note
Hinterland study: both movable parts of the Europoortkering failed their technical reliability requirement of at most one failure to close in a thousand closures; the latest failure analysis put the probability of not closing at up to 1 in 100, which an external review called realistic and achievable.
Adviescollege ICT-toetsing — Advies project Vervangen BESW (19 August 2026)
- Stable source ID
src-947e470313bb369b- Publisher
- Name not classified · tweedekamer.nl
- Type / language
- web-page · language not classified
- Published
- 2026-08-19
- Updated
- Not recorded
- Source last checked
- No source-level check date
- Record last verified
- 2026-11-06
- Dossier created
- 2026-11-06
- Retrieved copy
- No local capture recorded
- Archive
- No archived copy linked
- Content hash
- No captured content hash
- Locator
- Descriptive only — not page/paragraph exact
Open the recorded source note
Advice of the government's ICT review board on the project to replace BESW: the state of BESW has been unacceptable since the 2012 replacement; almost 100 known defects; at least four manual interventions in 17 closures; three failed repair projects; BESW fails more often than Rijkswaterstaat's models predict; one storm closure to date; legal requirement 1:100; replacement aimed for before the 2030 storm season.
- Claims linked
clm-d47a6969d47997b2clm-b0fab00436b966c9clm-0b1c7c2b69a03fbbclm-631b9fdadd497c2fclm-2b2f6aae6b607ebfclm-e200e3aaadba25bfclm-19fbffc5b628f032clm-645e58f896e3591cclm-f650b3617bf9892bclm-0502b6d13dd51b3aclm-f53bc68dba304b75clm-340f2e7532c0c21eclm-6900b6720c6185c4clm-fb293284d13f0fcdclm-95632840db5f111cclm-1d9842771c6b174cclm-4e2a04e7e5c04743clm-5c90897f1258422fclm-bd5fb1b80017a5f8clm-8efdea47983879aeclm-301c8196584ea21a
Rijkswaterstaat — memo to the minister on the ICT review board's BESW advice (15 September 2026)
- Stable source ID
src-cbd2addc0dbf8fab- Publisher
- Name not classified · tweedekamer.nl
- Type / language
- web-page · language not classified
- Published
- 2026-09-15
- Updated
- Not recorded
- Source last checked
- No source-level check date
- Record last verified
- 2026-11-06
- Dossier created
- 2026-11-06
- Retrieved copy
- No local capture recorded
- Archive
- No archived copy linked
- Content hash
- No captured content hash
- Locator
- Descriptive only — not page/paragraph exact
Open the recorded source note
Rijkswaterstaat's memo to the minister on the board's advice: improvement is needed but the barrier works according to the legal safety requirements; it rejects the board's 'false certainty' characterisation but adopts IEC 61508; hardware support ends in 2030 and missing that date is a real risk.
Minister of Infrastructure and Water Management — letter to parliament on the Sea Level Rise Knowledge Programme, Kamerstuk 36 800 J, nr. 28 (19 June 2026)
- Stable source ID
src-869e582e10a3cc93- Publisher
- Name not classified · tweedekamer.nl
- Type / language
- web-page · language not classified
- Published
- 2026-06-19
- Updated
- Not recorded
- Source last checked
- No source-level check date
- Record last verified
- 2026-11-06
- Dossier created
- 2026-11-06
- Retrieved copy
- No local capture recorded
- Archive
- No archived copy linked
- Content hash
- No captured content hash
- Locator
- Descriptive only — not page/paragraph exact
Open the recorded source note
Letter to parliament on the Sea Level Rise Knowledge Programme: replacement of the Maeslant and Oosterschelde barriers in 2070-2100, driven by end of service life; from 60 cm of sea-level rise the barriers will close more often.
- Claims linked
Watersnoodmuseum — Maeslant Storm Surge Barrier
- Stable source ID
src-6108dd3774730e68- Publisher
- Name not classified · watersnoodmuseum.nl
- Type / language
- web-page · language not classified
- Published
- Not recorded
- Updated
- Not recorded
- Source last checked
- No source-level check date
- Record last verified
- 2026-11-06
- Dossier created
- 2026-11-06
- Retrieved copy
- No local capture recorded
- Archive
- Open archived copy ↗ · 2026-06-06
- Content hash
- No captured content hash
- Locator
- Descriptive only — not page/paragraph exact
Open the recorded source note
The flood museum's account: not part of the original Delta Plan; a design competition won by Bouwkombinatie Maeslantkering; brief to close at 3 m but no more than once or twice every ten years; construction from 1991, commissioned six years later by Queen Beatrix; cost nearly half a billion euros.
DutchNews — Rotterdam's massive storm surge barrier passes its annual test (17 September 2023)
- Stable source ID
src-65c8efcb099993ca- Publisher
- Name not classified · dutchnews.nl
- Type / language
- web-page · language not classified
- Published
- 2023-09-17
- Updated
- Not recorded
- Source last checked
- No source-level check date
- Record last verified
- 2026-11-06
- Dossier created
- 2026-11-06
- Retrieved copy
- No local capture recorded
- Archive
- Open archived copy ↗ · 2026-03-11
- Content hash
- No captured content hash
- Locator
- Descriptive only — not page/paragraph exact
Open the recorded source note
On the 2023 test closure, quoting the operations spokesman: the structure is sunk slowly because dropping it would send big waves into Rotterdam; cost €450 million; the lowered level for 2007 and 2018 given as 2.65 m.
- Claims linked
Tretmans, Wijbrans and Chaudron — Software Engineering with Formal Methods: The Development of a Storm Surge Barrier Control System (author preprint, 7 July 2000)
- Stable source ID
src-b89d0dd9cc87d31b- Publisher
- Name not classified · web.archive.org
- Type / language
- pdf · language not classified
- Published
- 2000-07-07
- Updated
- Not recorded
- Source last checked
- No source-level check date
- Record last verified
- 2026-11-06
- Dossier created
- 2026-11-06
- Retrieved copy
- No local capture recorded
- Archive
- No archived copy linked
- Content hash
- No captured content hash
- Locator
- Descriptive only — not page/paragraph exact
Open the recorded source note
Author preprint of the journal article in Formal Methods in System Design (2001), by researchers from the University of Twente and CMG: why the decision was automated, the software failure-probability requirements, SIL 4, code size, completion in October 1998.
Chaudron, Tretmans and Wijbrans — Lessons from the Application of Formal Methods to the Design of a Storm Surge Barrier Control System (FM'99, 1999)
- Stable source ID
src-d21665ba0120c0dc- Publisher
- Name not classified · link.springer.com
- Type / language
- pdf · language not classified
- Published
- Not recorded
- Updated
- Not recorded
- Source last checked
- No source-level check date
- Record last verified
- 2026-11-06
- Dossier created
- 2026-11-06
- Retrieved copy
- No local capture recorded
- Archive
- Open archived copy ↗ · 2018-07-26
- Content hash
- No captured content hash
- Locator
- Descriptive only — not page/paragraph exact
Open the recorded source note
FM'99 conference paper by the developers: three years and about 25 man-years; 20,000 lines of formal specification and 450,000 lines of C++; Promela and Spin found significant errors in early designs; no line of code was completely proved correct.
Goorden, van de Mortel-Fronczak, van Eldik, Fokkink and Rooda — Lessons learned in the application of formal methods to the design of a storm surge barrier control system (IFAC-PapersOnLine 55, 2022)
- Stable source ID
src-b37b333886a31dd2- Publisher
- Name not classified · homes.cs.aau.dk
- Type / language
- pdf · language not classified
- Published
- Not recorded
- Updated
- Not recorded
- Source last checked
- No source-level check date
- Record last verified
- 2026-11-06
- Dossier created
- 2026-11-06
- Retrieved copy
- No local capture recorded
- Archive
- No archived copy linked
- Content hash
- No captured content hash
- Locator
- Descriptive only — not page/paragraph exact
Open the recorded source note
Paper co-written with Rijkswaterstaat staff on lessons from the formal methods used for BOS: BOS closes the barrier based on weather forecasts, water-level measurements and flood-simulation results; expertise in the original methods has declined.
- Claims linked
Beers, Booy, Groote, van den Bogaard and Bouwman — A Complete Formal Specification and Verification of the BESW software control system of the Maeslant Storm Surge Barrier (arXiv preprint, 11 April 2025)
- Stable source ID
src-bc2221e4cf28c8c8- Publisher
- Name not classified · arxiv.org
- Type / language
- web-page · language not classified
- Published
- 2025-04-11
- Updated
- Not recorded
- Source last checked
- No source-level check date
- Record last verified
- 2026-11-06
- Dossier created
- 2026-11-06
- Retrieved copy
- No local capture recorded
- Archive
- Open archived copy ↗ · 2026-10-13
- Content hash
- No captured content hash
- Locator
- Descriptive only — not page/paragraph exact
Open the recorded source note
Formal specification of BESW in mCRL2 by researchers from Eindhoven University of Technology and Rijkswaterstaat: all behaviour including manual and testing modes and all fault situations; verification limited to a restricted set of water levels and not all pump and valve failure combinations; the model is confidential.
Beers, Booy, Groote, van den Bogaard and Bouwman — the same work in the FMICS 2025 proceedings, LNCS 16040 (28 August 2025)
- Stable source ID
src-4185f94afa6280f6- Publisher
- Name not classified · link.springer.com
- Type / language
- web-page · language not classified
- Published
- 2025-08-28
- Updated
- Not recorded
- Source last checked
- No source-level check date
- Record last verified
- 2026-11-06
- Dossier created
- 2026-11-06
- Retrieved copy
- No local capture recorded
- Archive
- No archived copy linked
- Content hash
- No captured content hash
- Locator
- Descriptive only — not page/paragraph exact
Open the recorded source note
The peer-reviewed version of the same work in the FMICS 2025 proceedings, Lecture Notes in Computer Science volume 16040.
- Claims linked
H2O — Eerste daadwerkelijke sluiting Maeslantkering goed verlopen (2007)
- Stable source ID
src-458a2eeaeb96b4ea- Publisher
- Name not classified · edepot.wur.nl
- Type / language
- web-page · language not classified
- Published
- Not recorded
- Updated
- Not recorded
- Source last checked
- No source-level check date
- Record last verified
- 2026-11-06
- Dossier created
- 2026-11-06
- Retrieved copy
- No local capture recorded
- Archive
- Open archived copy ↗ · 2024-07-27
- Content hash
- No captured content hash
- Locator
- Descriptive only — not page/paragraph exact
Open the recorded source note
Water-sector magazine interview with Rijkswaterstaat staff after the November 2007 closure: BOS calls the team at a forecast of 2.60 m and closes at 3 m; the closure was the work of a computer; the team can switch to manual operation.
- Claims linked
Computable — ICT is onmisbaar bij waterbeheer (27 May 2010)
- Stable source ID
src-66a51d9f8f0a9941- Publisher
- Name not classified · computable.nl
- Type / language
- web-page · language not classified
- Published
- 2010-05-27
- Updated
- Not recorded
- Source last checked
- No source-level check date
- Record last verified
- 2026-11-06
- Dossier created
- 2026-11-06
- Retrieved copy
- No local capture recorded
- Archive
- Open archived copy ↗ · 2025-05-25
- Content hash
- No captured content hash
- Locator
- Descriptive only — not page/paragraph exact
Open the recorded source note
IT trade press visit to the barrier: every ten minutes the computer makes a calculation for the coming 24 hours.
- Claims linked
Deltares — Levensduur Maeslantkering, report for Rijkswaterstaat on the barrier's remaining life (17 December 2024)
- Stable source ID
src-c33a5771670cadf5- Publisher
- Name not classified · deltaprogramma.nl
- Type / language
- pdf · language not classified
- Published
- 2024-12-17
- Updated
- Not recorded
- Source last checked
- No source-level check date
- Record last verified
- 2026-11-06
- Dossier created
- 2026-11-06
- Retrieved copy
- No local capture recorded
- Archive
- Open archived copy ↗ · 2026-06-10
- Content hash
- No captured content hash
- Locator
- Descriptive only — not page/paragraph exact
Open the recorded source note
Study commissioned by Rijkswaterstaat on the barrier's remaining life: design life 100 years, to 2097; the truss arms were designed for 15 storm closures in total, which would be reached in 2091, 2076 or 2065 under the KNMI'23 scenarios; earliest end of life 2040 because of buckling risk in the combi-wall tube piles along the abutments, otherwise 2065 from fatigue of the arms.
ENW — Water tegen de dijk: the performance of flood defences during the 2023/2024 winter high water (10 September 2024)
- Stable source ID
src-f7013fac9f6155ae- Publisher
- Name not classified · enwinfo.nl
- Type / language
- pdf · language not classified
- Published
- 2024-09-10
- Updated
- Not recorded
- Source last checked
- No source-level check date
- Record last verified
- 2026-11-06
- Dossier created
- 2026-11-06
- Retrieved copy
- No local capture recorded
- Archive
- Open archived copy ↗ · 2026-01-21
- Content hash
- No captured content hash
- Locator
- Descriptive only — not page/paragraph exact
Open the recorded source note
The Expertise Network for Flood Protection's evaluation of the 2023/24 winter high water: the barrier closed automatically for the first time in its history; with the closure the water at Rotterdam reached about NAP +2.4 m, against about NAP +3.0 m had it stayed open; the lowest quays on the Noordereiland lie at NAP +2.4 m.
ENW — Impact zeespiegelstijging op hoogwaterveiligheid, background report to advice 19-08 (November 2019)
- Stable source ID
src-a49278dcaebdd0ab- Publisher
- Name not classified · enwinfo.nl
- Type / language
- pdf · language not classified
- Published
- Not recorded
- Updated
- Not recorded
- Source last checked
- No source-level check date
- Record last verified
- 2026-11-06
- Dossier created
- 2026-11-06
- Retrieved copy
- No local capture recorded
- Archive
- Open archived copy ↗ · 2025-12-13
- Content hash
- No captured content hash
- Locator
- Descriptive only — not page/paragraph exact
Open the recorded source note
Background report to the ENW's 2019 advice on accelerated sea-level rise: the barrier was designed for at most 50 cm of sea-level rise; at one metre it would close on average three times a year, more than it is expected to bear structurally; because the failure probability is defined per closure request, more closures mean more failures.
- Claims linked
Waterforum — Deltacommissaris wil vroegtijdige afspraken over financiering grote waterwerken (5 November 2026)
- Stable source ID
src-8274511f3d89dd21- Publisher
- Name not classified · waterforum.net
- Type / language
- web-page · language not classified
- Published
- 2026-11-05
- Updated
- Not recorded
- Source last checked
- No source-level check date
- Record last verified
- 2026-11-06
- Dossier created
- 2026-11-06
- Retrieved copy
- No local capture recorded
- Archive
- No archived copy linked
- Content hash
- No captured content hash
- Locator
- Descriptive only — not page/paragraph exact
Open the recorded source note
Trade press report of Delta Commissioner Verdaas in parliament: the Maeslant barrier is the first Delta Work due for replacement, around 2070, unless the Rhine-Meuse mouth is arranged differently.
- Claims linked
Known limits of this file
- Publisher names and source languages have not yet been classified; domains are recorded without guessing.
- Existing source notes are descriptive locators, not page- or paragraph-exact citations.
- A missing archive, publication date or content hash is shown as null rather than inferred.
- The project-level evidence grade ranks the strongest source in the entry; it is not a truth score for every claim.
Continue exploring
Compare this project
🇯🇵 Tsunami-Alert Automatic Tide Gate Closure · Osaka
The closest peer: gates that shut on a national alert signal. Osaka closes on a tsunami warning, Rotterdam on its own surge forecast.
🇳🇱 Port of Rotterdam IoT & Hydro/Meteo Platform · Rotterdam
Same estuary, different job: the port authority measures water and weather continuously; the barrier acts on a forecast once a decade.
🇩🇰 Copenhagen's Cloudburst Management Plan · Copenhagen
Both answer flooding with built infrastructure, but Copenhagen's plan has no automatic trigger — the water arrives and the basins fill.
Explore the wider context
📎 Cite this project
1001 Smart Cities (2026). “Maeslant Barrier: Software Gives the Order to Close Rotterdam to the Sea” — Rotterdam, Netherlands. The Smart City Atlas. https://1001smartcities.org/projects/rotterdam-maeslantkering/ (last verified 2026-11-06). Data: CC BY 4.0.
The underlying data is free to reuse with attribution — see the open data page.