Theoretical model for cascading effects analyses

In case of exceptional events of natural or anthropogenic type, the elements at risk (people, buildings, infrastructures, economy, etc.) are often hit by sequences of ‘cascading events’, function of time and space, caused by the triggering event (earthquake, landslide, volcanic eruption, fire, electric failure, etc.). Generally, sequences of events can involve the same element at risk, and the combined effects of cascading phenomena can strongly amplify the impact caused by single events in terms of extension of the affected area and damage level. The final impact on the territory can be significant and require to be carefully assessed in terms of emergency planning and management. This paper discusses from a theoretical point of view the modelling needs and the main issues to be taken into account in the development of simulation tools aiming to include cascading effects analyses to effectively support decision-makers in their preparedness and disaster mitigation strategies in the framework of emergency planning at local, national and international level. The model aims at developing cascading effects scenarios at different level of detail, depending on the availability of inventory/exposure data for the different categories of elements at risk and hazard/impact models for the various hazard sources. It has been developed within EU-FP7 SNOWBALL project (Lower the impact of aggravating factors in crisis situations thanks to adaptive foresight and decision-support tools, 2015-2017).


Introduction
Recent significant disasters, such as Hurricane Katrina (2005), Haiti earthquake (2010) Ejafjällajökull Volcano eruption (2010) and Fukushima Daiichi nuclear disaster (2011), have highlighted that natural or anthropogenic events can generates cascading events/effects, leading to a significant increase of fatalities and damages (Alexander, 2000;Kadri et al., 2014), because of the existence of interdependencies among the different sectors of the territorial and infrastructure system. The assessment of the aggravation of systemic failure due to cascading effects, in terms of direct and indirect damage, assumes an essential role in the framework of disaster preparedness and management. The decision-makers are faced with the challenge of not only mitigating against the single hazards and related risks, but also against chain of events, which must include the consideration of the systemic interrelations. Since the cascading effects concept is a relatively new area of investigation in the field of natural risks' governance, specific methodologies and field experience are so far limited (Aubrecht et al., 2013;Gasparini and Garcia-Aristizabal , 2014;Gill and Malamud, 2014;Marzocchi and Woo, 2009;Marzocchi et al., , 2012Komendantova et al., 2104;. The influence of events' chains evaluation requires suitable approaches able to assess the probability of occurrence of different possible paths triggered by a specific event (earthquake, landslide, volcanic eruption, fire, electric failure, etc.) and the cumulative damage of different  Marzocchi et al. (2012) address cascading effects in a multi-hazard assessment as a fundamental element in multi-risk problems. The risk evaluation cannot be performed considering single risk indexes related to independent events, since the overall risk index from a sequence of hazards may be higher than the simple aggregation of single risk indexes due to each hazard occurring. For this reason, the multi-risk assessment should be carried out taking into account all the possible interactions of risks due to cascading effects, thus heavily increasing the complexity of the analysis. This paper discusses, from a theoretical point of view, the modelling needs and main issues to be taken into account in the development of simulation tools aiming to include cascading effects analyses to effectively support decision-makers in their preparedness and Disaster Risk Reduction strategies, in the framework of emergency planning at local, national and international level. The theoretical model has been developed within EU-FP7 SNOWBALL project (Lower the impact of aggravating factors in crisis situations thanks to adaptive foresight and decision-support tools, 2015-2017). The following sections describe a methodology for assessing the impact of cascading effects on the affected area and the implementation of a Decision Support System to improve decision makers' preparedness to such type of crises.

Methodological approach: the Elementary bricks model
The proposed approach frames the problem as a typical 'scenario analysis', through the assessment of damage induced on element exposed by a single timeline of events (called 'cascading effects time history'), chosen on the base of ad hoc criteria (i.e. probability of occurrence of the time history, impact on specific elements at risk, etc.). In the following sections, the peculiar aspects necessary to identify the cascading effects time histories (time and space influence, dependencies between elements, uncertainties) are treated. The methodology proposed assumes the following definitions:  'Cascading events' are a timeline of consecutive events characterized by: cause / effect relationship (i.e. an earthquake that induces a landslide that causes a building collapse that induces casualties), or time interaction among different phenomena independently generated by the same triggering event (i.e. a flood can cause electric failure and interruption roads independently, that can both influence the operation on the same hospital). The events in the time line can be hazards of natural (earthquakes, landslides, tsunami, volcanic eruptions, floods, etc.) or anthropogenic (technological hazards, fires, terroristic attacks, etc.) type; or the damages on exposure at risk.  'Cascading effects' is the overall hazard/impact scenario timeline, including the chain of events (cascading events) and damage caused by cascading events on elements at risk assumed in the evaluation (i.e. people, buildings, infrastructures, economy, etc.).
In general terms, a 'cascade of events' is represented by a timeline constituted by: a single chain of events (path), in case of triggering event inducing a single event trees ( Figure 2a); or a sequences of more chains in parallel, in case of triggering event inducing more event trees in parallel ( Figure  2b). In this case, the timeline is constituted by a sequence of events not necessarily with a cause/ effect relationship. For example, this concerns the cascading events triggered by volcanic eruptions, able to generate a series of parallel phenomena (earthquake, ash fall, pyroclastic flows, tsunami, lahar, etc.) triggering different independent event trees.
The main aspects of the methodology are described in Table 1 (right column). They are inspired by the procedure defined by Marzocchi et al. (2012). The defined steps emphasize how cascading effects, independently from the magnitude of the triggering hazard and the potential cross-border impacts, mostly depend on local (i.e. national to regional) hazard proneness and vulnerability conditions (e.g. Fukushima), so the only way to produce reliable and effective hazard/impact scenarios through probabilistic-based simulation tools is to perform at the local level the following analyses:  hazards characterisation according to the proneness of the area or the preferences of decision makers/end-users (including probabilistic assessment);  exposure and vulnerability analysis, according to the elements at risk identified and to specific decision-makers/end-users requirements;  identification of probabilities of transition among different hazards, supported by existing literature/studies complemented with Bayesian approach and/ or experts' elicitation procedures (Cooke, 1991;Aspinall and Cooke, 1998;, when such information is not available from previous studies. 'Scenario' assessment consists in the measure of the damage D induced (in space s and time t) by a single event (hazard) or single chain of hazards of intensity and probability assigned on the element hit (exposure) in function of the sensibility of the element under effect of the hazard (vulnerability). It is valuable as the convolution of three probability functions: hazard, vulnerability and exposure, according to the relation (1).
The hazard H is the time-space distribution of the intensity of a given event (earthquake, landslides, power outage, gas leakage, etc.) of assigned occurrence probability in a given time and a given geographical area.
The exposure E is the distribution of the probability that a given element (people, buildings, infrastructures, economy, environment, etc.) of assigned characteristics (of qualitative and quantitative type) occupies in a given time a given geographical area.
The vulnerability V is the distribution of the probability that a given exposed element of assigned characteristics is damaged by a given hazard intensity.
The methodology able to assess the cascading effect is articulated assuming as units of analysis, defined elementary bricks, the eight following elements (  4. Probabilistic assessment of each cascading effect scenario, assuming the occurrence of a triggering hazard with a given magnitude. 5. Vulnerability and exposure assessment for each scenario, taking into account the vulnerability of the exposed elements to the combined hazards. 5. Vulnerability and exposure assessment for each scenario, taking into account the dynamic vulnerability of the exposed elements to the chain of hazards (including the influence of 'time' and 'human behaviour' factors).
6. Loss estimation and multi-risk assessment. 6. Loss estimation and impact assessment, including the cumulative damage following the sequence of events and the cascading failure of critical Space and Time constitute the reference frame of other bricks. Hazards, Exposure and Vulnerability identify the input data of the 'cascading effect problem' at initial time (in peace time). Dynamic vulnerability identifies the routine that update the behaviour (vulnerability) of a specific element exposed induced by sequence of two or more hazards. The human behaviour is able to influence the chain hazards, the exposure, the vulnerability and the damage induced. Its effect has been considered through an opportune influence factor (α). Damage on element exposed (in time and space) constituted the output data of the methodology. The eight bricks are synthetically described in the following. 1. SPACE. The analysis of impacts induced on the territory by cascading events require the choice of a geographical Minimum Reference Unit (MRU), which coincides with the minimum space unit of analysis of input and output elements of the model. 2. TIME. In the cascading effect assessment, time reference frame is essential. In the proposed model, the time scale adopted is of discrete type. It is constituted by the single instants t 0 , t 1 , ..., t n which characterize each hazard in the 'cascading scenario time history', that occur from the triggering events (TE = H 0 ) at start time t 0 . In addition, the time can schematize the preparedness actions, the media event and the human behaviour which can influences the cascading effects. 3. HAZARD. In case of cascading events, the hazard is constituted by a single timeline of events (called cascading scenario time history) choices on the base of ad hoc criteria (i.e. probability of occurrence of time history, impact on specific element at risk, stakeholder interests, etc.  5. VULNERABILITY. The vulnerability of each 'vulnerability class' can be assessed through typical 'vulnerability curves'. They express the probability that a given 'vulnerability class' exceeds a certain level of damage D i (Table 2), given a level of hazard magnitude. For each element exposed e under effect of each single hazard Hk in the chain, the vulnerability functions must be defined: V [P(D≥D i │E e ∩H k )]. In Figure 4, typical vulnerability curves, inspired by the ones used in seismic risk assessment (Calvi et al., 2006), are illustrated with reference to a given 'vulnerability class' and the five level of damage proposed by European Macroseismic scale (Gruntal, 1998). Vulnerability curves can be obtained through three different approaches, as function of the information available: Empirical methods (they evaluate the 'observed vulnerability curves' through the statistical correlations of the damage caused by past events on samples of elements exposed of specific typology under the action of a given intensity); Mechanical methods (they evaluate the 'calculated vulnerability curves' through statistical processing of the results obtained by analytical approaches conducted on a random sample of models representing the elements exposed in examination -subject to a representative set of events -hazards-); Hybrid methods (they evaluate the curves combining analytical approaches and observations of damage caused by events occurring). Spatial distribution at start time t 0 of Vulnerability Classes VC j of each element exposed e (people, buildings, ...) under effect of single Hazard Hk.

E (t k ) = f [D(t k-1 )]
Time update at t k of the exposure in function of the damage occurred at time t k-1.

D e [(MRU)] t
Time and spatial distribution of damage induced on each element exposed e by cascading events.

Vulnerability
Functions of each element exposed e under effect of each single Hazard Hk.

OUTPUT INPUT
Times (t 0 , t 1 , ..., t k , ..., t n ) that characterize each hazard of the chain of events.   6. DYNAMIC VULNERABILITY. The sequence of cascading events causes a progressive increase of the vulnerability of the element exposed, depending on the evolution of the damaging process. The theoretical approach for the implementation of the dynamic vulnerability model is based on background researches developed by LUPT-PLINIVS in the framework of the EU-FP6 EXPLORIS project Zuccaro and De Gregorio, 2013) and subsequently adopted in the model of EU-FP7 CRISMA project (Aubrecht et al., 2013;. The approach updates exposure and vulnerability, step by step, through a routine that estimates the increase of vulnerability due to the previous events. It assigns a virtual vulnerability class, proportionally to the damage level, that will address the choice of the damage probability curve to be used when the following event occurs. 7. DAMAGE. 'Damage' elementary brick constitutes the output of the methodology. It furnishes the distribution of damage occurred on different elements exposed caused by cascading events. A possible measure of damage for different element exposed is indicated in Table 3. The damage scenario is assessed by the convolution (3). It is the time (t)-space (MRU) distribution of damage occurred on the different elements exposed e caused by cascading events: The result of the model is the damage scenario for the examined chain, on the basis of the approach described in Figure 5. Damage is calculated by equation (1), for each element exposed (people, buildings, infrastructures, economy, etc.) with reference to:  geographical distribution of the damage level for each element exposed (i.e., number of deaths, number of building collapsed, hour outage of power line, reduction of GDP) in the Minimum Reference Unit (MRU);  time distribution of the damage level for each element exposed in all time steps of analysis. The impact is calculated like a single damage if the element exposed is affected by one hazard, while it is calculated by cumulative damage if the element exposed is affected by two or more hazards. 8. HUMAN BEHAVIOUR INFLUENCE. The space-time distribution of damage D(s,t) must take into account the human behaviour as factor able to strongly influence the cascading effects both in terms of final impact and as a variable influencing the effective implementation of preparedness actions, such as evacuation (Barret et al., 2012;Provitolo et al., 2011;Reason 1995;Schmidt and Galea, 2013). The theoretical model proposed aims to define a methodological framework to address hazard/impact assessments of cascading effect scenarios based on the understanding of dependencies and interactions between different hazards and the influence of exposure and vulnerability of the elements at risk, on the base of the cumulative damage due to the sequence of events and the damage propagation across service networks and critical infrastructures. In this way, the architecture of the simulation model can be conceived as a flexible structure of different elementary bricks, initially fed -only for a limited number of hazard types -with general data and models from public repositories, that can be further detailed by using regional/local datasets and customized hazard/impact models. Indeed, only this kind of refinement can ensure a higher reliability of output scenarios and data, required to effectively support decision making process in the field of emergency management. Table 3. Damage measure for different elements exposed.

Space
In the methodology, the elementary bricks dependent by 'space' factor are: hazards chain, exposure and damage. They are function of their geographical distribution on the territory. It is possible to distinguish three levels of 'space': local, national and international. They concern cascading effects characterized, respectively, by chains of hazards (triggering and cascades), elements exposed (people, buildings, infrastructures, economy, etc.) and damage affecting geographical areas at regional, national and international level. As an example, heavy rains which cause local landslides, floods and/or power outages affecting local exposure constitute cascading effects at local level. Explosive eruptions, able to cause ash fall at long distance can induce interruption of air transport and consequent macro-economic damage (Eyjafjallajökull eruption, 2010) are cascading effects at national and international level. According to the 'space' level, different Minimum Reference Units (MRU) must be adopted. Generally, for evaluations at international [national] scale, MRU is a country or a macro-region [municipality], while at local scale, where greater detail is required, it can be taken as a partition of municipal area, for example, by a mesh having cells of 500x500m or even smaller, up to 250x250m, according to the reliability of the input data available. In case of risk analyses for infrastructures, the most appropriate MRU may be the segment of the network between two intersections or nodes (link), in order to evaluate the section where occurs the damage on the functionality of the grid. The spatial distribution of each hazard (in the chain) and of each element exposed regulates the type of damage induced by cascading effects. The possible cases are the following two ( Figure 6): 1. the single element exposed (people, buildings, infrastructures, economy, etc.) is affected by one hazard. In this case, the damage induced is function only of the vulnerability of the element under effect of the single hazard. 2. the single element exposed is affected by two or more consecutive hazards. In this case, the sequence of events induces a cumulative damage, that is function of progressive increase of the vulnerability of the element exposed, depending on the evolution of the damaging process.

Time
Time factor is a variable of crucial importance in cascading effects modelling, since the final impact of a crisis can depend on the process of amplification of damage over time and by the presence of subsidiary disasters (Pescaroli and Alexander, 2015). In terms of damage evaluation, the time factor affects the cumulative damage on specific elements at risk, only when the timeframe needed to restore the functionality of such element is shorter than the total time of the analysis for the cascading effects scenario identified.
As an example, if we consider an earthquake followed by a landslide damaging a house, given that the time needed to repair the house (and thus restore its functionality) even from a slight damage is considerably higher, then the timeframe envisaged for the triggering of the cascading effect 'landslide', the cumulative damage assessment can neglect the time variable as influencing parameter.
On the contrary, time is a crucial factor in critical infrastructure, grids and service networks damage evaluation, since the time required to restore the functionality of such systems, within certain damage thresholds, can be shorter than the scenario analysis timeframe taken into account and could be the cause of following disruption and negative effects on population and other element at risk considered. Time is considered as an important factor also in relation to short-term preparedness actions aimed at reducing the exposure and vulnerability of people, e.g. evacuation processes initiated when a potential cascading effects is forecasted, whose success depends on the timing of the action to be completed before the cascading effect occurs. In such kind of analysis, the relation between time factor and human behaviour has to be considered too. From a modelling point of view, the focus of the research in terms of scenario analyses and assessments entails the need of defining a specific timeline for each scenario to be simulated, clearly identifying the transitions where the time factor affects the final impact evaluation. Figure 7 shows how the time factor is taken into account in the definition of the theoretical model for cascading effects simulations, in which both the sequence of hazard events and decision points corresponding to human actions are included in the timeline subject to scenario analysis. The timeline definition represents a preliminary operation needed to perform hazard/impact scenario simulations. This should be defined depending on decision makers and stakeholders needs, also based on the understating of human behaviour aspects that could become as trigger or aggravating factor in cascading effect scenarios. The time distribution of the hazards chain strongly influences the choice of analyses' time steps. If each hazard has an instantaneous duration (i.e. earthquake), the analysis time steps coincide with the time occurrence of events ( Figure 8a). If one or more hazards are characterized by a finite time range (i.e. volcanic ash fall, grids interruption, etc.), the start times (t 0 ) and the end times (t n ) must be included among the analysis time steps (Figure 8b). This last case considers also time intervals overlap among two or more hazards (Figure 8c). The simulation model takes into account the influence of time in cascading effect scenarios, both in terms of 'cascades triggering potential' and in terms of 'impact aggravating potential' of the subsequent hazard in the events' chain. Since not always hazard chains and potential impacts are influenced by the time factor, the timeline representation connected to each event tree object of simulation will include information about time intervals only if the time factor is likely to produce variation in terms of hazard/impact scenario variation.
In the framework of time histories development, a main distinction is made with respect to 'predictable / forecastable' and 'unpredictable / unforecastable' triggering events (Table 4), since the first category implies the extension of the timeline before the T 0 (representing the timestamp of the triggering event), with consequent potential variation on exposure and vulnerability of different elements at risk due to the implementation of preparedness actions. Under specific circumstances, even unpredictable hazards can imply the need for simulating time intervals preceding the triggering event, such as e.g. a big earthquake anticipated by a long-lasting seismic swarm as in the case of L'Aquila 2009 (Zuccaro and Leone, 2016). Events such as landslides and avalanches, whose occurrence can indeed be forecasted in presence of a triggering event such as a storm or a prolonged heat wave, have to be classified as unpredictable when considering them as triggering hazards (originating, e.g. from slow onset phenomena such as rock cracking or underground water infiltration). Predictable events can be in turn subdivided into 'short' (6-72 hrs.) and 'long' (>72 hrs) forecasting alert, thus implying different types of preparedness actions to be potentially put in place.

Dependencies between elements
The proposed approach for the theoretical model requires to provide a 'generic' modelling framework based on the definition of a common logic to model the dependencies between the different hazards and the relevant parameters for the 'elementary bricks' as defined in Section 2 (space, time, hazard, exposure, vulnerability, dynamic vulnerability, damage, human behaviour). Subsequently, the approach needs to apply specific models and simulations for the respective use cases, in line with end-users needs and compatible with eventually existing legacy simulation tools, understood as the best approach to provide a decision support tool useful in the context of preparedness to real crises involving cascading effects. This step will in fact provide the needed specialization and customisation of the theoretical level in the context of the different use-cases through the support of experts, also involving local responsible for civil protection and modelling experts. From a methodological point of view, a very limited number of researches and scientific publications specifically focus on the topic of dependencies between different hazards, either in a multi-risk or cascading effects framework. Most of methodological approaches found in literature are based on the adoption of Event Tree model, which allows the identification of a transition probability between hazards (see, among others, Mader et al., 2006;Neri et al., 2008;Gasparini and Garcia-Aristizabal, 2014), possible interactions representing multiple hierarchies of information and situations where secondary hazards trigger tertiary hazards, and so on. A proper structuring and visualisation of such dependencies is a fundamental step to integrate cascading event chains within a modelling logic and workflow, supported by probabilistic analyses on transition between hazards and their consequences in terms of impact on elements at risk. Indeed, to provide actionable information and reliable input for simulation tools, the probabilistic assessment of hazards transition requires a level of understanding of cascading effects scenarios at local (national to regional) level, thus allowing a 'specialization' of the event tree(s) based on the needs and requirements of the end users. Nevertheless, the aim of the research is to provide a general framework to perform the definition of cascading effects scenarios at local level, developing a methodology to support decision makers and end users in the 'construction' of customized cascading event timeline based on Event Trees for the simulation of hazard/impact scenarios.
As a preliminary step for the implementation of the timeline, the identification of possible dependencies/interactions between hazards has to be carried out to properly define transition probabilities. To this aim, some methods can be retrieved from literature and adapted within the scope of the research: 1. identify general compatibility and dependencies through analysis of past events disaster databases (main reference: EM-DAT database, http://www.emdat.be); 2. identify general compatibility and dependencies through scientific literature review (main references: Aubrecht et al., 2013;Gasparini and Garcia-Aristizabal , 2014;Gill and Malamud, 2014;Neri et al., 2008); 3. identify local compatibility and dependencies through the analysis of specific (local) studies or databases (if existing), complemented with an expert elicitation process (Aubrecht et al., 2013;Gasparini and Garcia-Aristizabal, 2014;Neri et al., 2008) to compensate the lacking of probabilistic information for hazards characterization at local level. Such focus can be based on a refinement of the general compatibility/dependencies identified, but given the more detailed understanding of local risk conditions, can in theory also introduce new dependencies not taken into account in literature or never occurred in the past.
As noted by Gill and Malamud (2014), a matrix (e.g., Tarvainen et al., 2006;De Pippo et al., 2008;Kappes et al., 2012) is a simple way of representing information about multiple different hazards, with either symbols or text used to outline the existence of interaction relationships. A general compatibility/transition matrix is developed, based on the above points 1 and 2. The application of Bayesian approaches or expert elicitation process allows a further refinement of possible cascading event trees by restricting hazard and exposure conditions in accordance to territorial and spatial scales. The research assumes EM-DAT database main source of information to identify hazard dependencies, since it is the only available disaster database that contains relevant information on past events in terms of cascading effects from the main triggering hazard and on multi-sectoral impacts (e.g. on people, built environment, infrastructure, economy). From the original database, only past events describing cascading paths have been selected, thus identifying the most relevant/recurring triggering hazards and cascading paths. Table 5 shows an excerpt of the Hazard section of the EM-DAT database, after refinement processes. In addition to this, the dependencies identified through a comprehensive literature review are included in the analysis. Prior to the review, given the specific focus on cascading effects more than on multi-risk, interactions with a low temporal likelihood of occurrence have been deliberately excluded from the assessment. Hazard dependencies resulting from the EM-DAT analysis and the literature review can be visualized in form of a compatibility/transition matrix (Table 6), showing the potential of each hazard to trigger another one. Hazards interactions identified from the various sources have been combined to define all potential dependencies between hazards, highlighting the source of information of each interaction identified (see abbreviation). Starting from any given triggering hazard, a possible 'cascade' can be selected that in turn, switching back to the 'triggers' column, may be considered as a triggering hazard for the next event in the chain. A cascading effect example from the Table 6 could then be the following: Earthquake (EQ) > Landslide (LS) > Tsunami (TS) > Flood (FL) > Electricity Network Failure (EF) > ... The compatibility/transition matrix is the first essential tool of the theoretical model for cascading effects. It represents the generic modelling framework to be used as starting point for the development of cascading effects scenarios at local level, to be further modelled through a probabilistic approach identifying hazards transition probabilities. The matrix is then processed through probabilistic methods and/or expert judgement to evaluate the level of agreement on the dependencies identified, thus determining a first qualitative probabilistic assessment (low-medium-high), useful to select the cascading events paths object of the simulation. Nevertheless, a qualitative assessment performed independently from specific local risk conditions (even based on spatial-temporal and global risk models overlapping as in Gill and Malamud 2014) gives only a general view of the chain of events that are most likely to occur. From a simulation modelling point of view, only detailed probabilistic analyses and/or experts' elicitation processes with a focus on specific territorial contexts can provide reliable information on transition probabilities between hazards in a cascading effects framework. In order to assess the cascading failure of critical infrastructures and service networks from a sequence of cascading events and/or the cumulative damage on the different categories of elements at risk identified in the context of the research, the first step is to determine if two or more hazards from a given chain of events produce an impact on the same exposed element. To this aim, each hazard considered has been classified in relation to the expected potential impacts on the following categories of elements at risk (Table 7):  People (deaths, injured, homeless)  Buildings (damage, losses)  Infrastructure (electrical power grid damage, mobile phone network damage, water supply grid damage, gas supply grid damage, transport network interruption)  Economy (property, commercial activities / warehouses, business interruption, crops / agriculture)  Environment (water, soil, air) The correlation matrix between hazards and elements at risk is the second essential tool of the theoretical model for cascading effects. It represents the generic modelling framework to be used as starting point for the development of dynamic vulnerability functions for the elements at risk of interest in the impact simulation.
EM-DAT Database G Gill andMalamud, 2014 (Gill, J. C., andMalamud B. D., 2014 wide and complex as shown in the figure

Cascading events timelines
The hazard compatibility matrix (Table 6) theoretically allows to build all the possible chains of events starting from a given triggering hazard. However, such kind of analysis may determine a range of complex and overly broad dependencies (Figure 9), often not resulting in reliable cascading effects scenarios at local level and thus not providing adequate information to decision makers in terms of hazard/impact simulation needs. Moreover, the probabilities of transition between hazards are generally not available in the scientific literature with such a high level of generalisation, thus making extremely complex the issue of treating cascading effects modelling through an 'all encompassing' full probabilistic approach to the hazards transitions within cascading effects crises. Furthermore, the probability occurrence of a given chain of events does not depend only on the possibility of a hazard triggering another, but also on their expected magnitude and the potential of occurrence in a given time and space window. Thus, in order to obtain a reliable event tree and perform probabilistic assessments useful to support decision making, it is necessary to refine the compatibility matrix with more detailed information related to the territorial area object of the assessment. The resulting interaction/compatibility matrix, refined for a given territorial area, can be then used to define all the possible event trees starting from a given triggering hazard. Table 8 shows an example concerning the cascading effects induced by a volcanic eruption in Santorini Island (Greece). In Figure 10, a possible event tree is developed. Possible cascading natural or technological hazards are evaluated through an analysis of actual risk conditions (available local risk maps) and exposure of elements at risk (inventory data of exposed assets and potential sources of technological hazards. From the general interaction/compatibility matrix, only the hazards potentially triggered by a volcanic eruption are taken into account, included in turn as potential sources of further cascading hazards. The inventory analysis allows identifying the actual sources of technological hazards (e.g. no nuclear plants, dams or mines exist in the island). The expected magnitude of the volcanic eruption and the potentially triggered hazards also allows determining if their potential magnitude is likely to trigger more cascading hazards or not. Probabilistic methods and/or experts' elicitation (see Section 5) allow attaching qualitative probabilities of transition between hazards in the chain (Table 8), determining the likelihood of occurrence for each cascading effects path. This allows decision makers to select one or more specific cascading effects paths from the main event tree ( Figure 11) to perform hazard/impact scenario simulations. It is important to note that the probability of transition is an information available to decision maker, but it does not imply automatically the choice of the paths to be simulated (e.g. only paths with medium/high probability of occurrence). On the contrary, a common decision making attitude is to acquire information especially on cascading effects crises with a low probability of occurrence and a potential high impact on elements at risk. In this sense, the event tree represents a valid tool for exchange of information between decision makers, as end-users of the SNOWBALL platform, and the experts in charge of the simulation services. In any case, through such an approach, even a deterministic decision of the path object of hazard/impact simulation implies a probabilistic evaluation of the expected impacts, based on exposure and vulnerability analysis. The event tree represents a dynamic tool available to the decision-makers to identify interdependencies between cascading natural hazards and cascades due to the potential failure of interconnected critical infrastructures (e.g. service networks). Each branch represents a single possible scenario of cascading effects, but the complete event tree visualisation allows a dynamic reading of all paths considered as relevant by the decision-maker, which can be all analysed through the simulation service and compared in terms of output (i.e. the impact on considered elements at risk). (RED=High probability >50%, YELLOW=medium probability 10-60%, GREEN=low probability of occurrence <20%). Methods to derive quantities from qualitative judgement have been derived by Grunthal, 1998.

Figure 11. Timeline for a volcanic eruption in Santorini showing selected cascading effects paths object of the simulation.
Red arrows show paths with high probability of occurrence; blue arrows show paths with medium probability of occurrence. Paths with low probability of occurrence have been deliberately excluded from the event tree for a better readability.
From a modelling point of view, the relevance of time factor can affect the following elementary bricks of the cascading effect scenario (see Section 3):  Hazard: some hazard categories are time-dependent  Hazard characterisation and impact assessment are function of the duration in time (e.g. volcanic ash fall; oil spill; release of solid/liquid substances; power outage; communication grid outage). In this case the variation of impact due to the time factor should be one of the input in the hazard models, allowing for different scenario realizations depending on different timeframes (e.g. after 30mins; 1hr.; 6hrs.; 12hrs.; etc.). This aspect can also affect the transition between hazards, when the probability of occurrence of the following hazard in the chain depends on the duration of the previous one (e.g. communication grid failure following a power outage that exceeds the backup time capacity of the communication grid components affected);  Exposure: some elements at risk categories are time-dependant in case of preparedness measures implementation (only short-term mitigation measures, e.g. people evacuation, are taken into account, since other mitigation actions, e.g. building retrofitting, are not compatible with the scenario timeline)  In the context of cascading effects, preparedness measures can take place in each of the time intervals of the event tree timeline (decision points); exposure variation on a given timestamp along the timeline should become an input of the impact model used for the following hazard in the chain. The exposure variation can in turn result as output of specific models (e.g. evacuation model) or as manual input (if allowed in the impact model). Figure 12 represents the timeline for a hypothetical cascading effects scenario following the reactivation of Nea Kameni Volcano in Santorini (Greece), reference test case of SNOWBALL project. In the timeline, decision points have been identified through 'scenario building' workshops with key representatives from local authorities, civil protection responsibles and critical infrastructures managers in Santorini. A large number of timelines can be connected to the specific scenario event tree, obtained without altering the sequence of cascading effects, but only modifying aspects related to the 'time' and/or 'human behaviour' factors. The 'decision points' represent relevant timestamps in the cascading effects evolution, where such variables are likely to modify the final scenario. In the cascading effects scenario identified in Figure 15, the time factor represents an important variable in the following timeline intervals:  t -1,1  t 0  t 1 : variation in population exposure due to self-preparedness measure (evacuation) -source: evacuation model/manual input  t 0,3  t 1 : variation in population exposure due to voluntary evacuation -source: evacuation model/manual input  t 1,2  t 2 : variation in population exposure due to mandatory evacuation -source: evacuation model/manual input  t 3  t 4 : hazard transition from power grid failure to communication grid failure -source: power grid failure model  t 3,1  t 5 : variation in population exposure due to mandatory evacuation -source: evacuation model/manual input  t 5  t 6,2 : variation in ash fall impact -source: ash fall hazard/impact model Figure 12. Timeline for the pilot application in Santorini, defined through workshops and interviews with local authorities, decision makers and service providers.

Uncertainties
Uncertainties evaluation in risk analyses are commonly evaluated by probabilistic convolution (in time and space) of the factors involved in the risk analysis (hazard, exposure, vulnerability), according to different approaches.

EVACUATE POPULATION (PREVENTIVE)
Crisis manager informs the population living in landslide prone areas that a provisional camp has been set for voluntary evacuation The probabilistic assessment of cascading effects in terms of events transition represents a complex problem that -in order to produce actionable information to decision makers in terms of preparedness -needs to be treated according to specific local conditions, following the refinement process from the generic modelling framework to the understanding of the cascading effects hazard scenarios on a given territorial area.
Computational problems in cascading effect analyses, so as for risk evaluations, are often characterized by three issues: (1) the empirical data are not always available for all variables; (2) subjective information from the analyst's judgment or expert opinion may be necessary; (3) uncertainty about the mathematical model used in the assessment may be substantial. These aspects complicate the evaluations and they can call into question any conclusions or inferences drawn from them. In case of cascading effects, it is crucial to assess the probability of occurrence of each event in the time history generated by a single triggering event (TE). The originator phenomenon TE can induce one or more independent event able to induce sequences of events connected by a 'cause/effect' relationship, which can be represented by event trees diagrams ( Figure 4). The combinations of possible chains included in each event tree (see blue paths in Figure 4) caused by independent events constitute the numerous cascading events timelines which can be induced by the TE.
In the methodology, two methods for the evaluation of the uncertainties connected to the cascading events timelines are adopted: Bayesian methods and Elicitation techniques.
Bayesian analysis. Statistics consists of two main competing schools of thought: the frequentist or classical approach to statistical inference (which includes hypothesis testing and confidence intervals), and the Bayesian approach. The underlying difference between the Bayesian and frequentist approaches to statistical inference is in the definition of probability. In practice, a frequentist uses probability to express the frequency of certain types of data to occur over repeated trials, a Bayesian uses probability to express belief in a statement about unknown quantities (Glickman and van Dyk, 2007). A typical Bayesian analysis can be outlined in the following steps (Glickman and van Dyk, 2007): 1. Formulate a probability model for the data (for example, Bernoulli distribution, Normal curve, etc.). 2. Decide on a prior distribution, which quantifies the uncertainty in the values of the unknown model parameters before the data are observed. The prior distribution is based on the theoretical beliefs on models. If we do not have any a priori or theoretical information, we have to assume complete ignorance of the probability distribution at the considered node. This is accomplished by using a uniform distribution P(θ)=1 (the probability is included in the range 0-1). 3. Observe the data, and construct the likelihood function based on the data and the probability model formulated in step 1. The likelihood is then combined with the prior distribution from step 2 to determine the posterior distribution, which quantifies the uncertainty in the values of the unknown model parameters after the data are observed. 4. Summarize important features of the posterior distribution, or calculate quantities of interest based on the posterior distribution. These quantities constitute statistical outputs, such as point estimates and intervals. The main goal of a typical Bayesian statistical analysis is to obtain the posterior distribution of model parameters. The posterior distribution can best be understood as a weighted average between knowledge about the parameters before data is observed (which is represented by the prior distribution) and the information about the parameters contained in the observed data (which is represented by the likelihood function). From a Bayesian perspective, just about any inferential question can be answered through an appropriate analysis of the posterior distribution. Once the posterior distribution has been obtained, one can compute point and interval estimates of parameters, prediction inference for future data, and probabilistic evaluation of hypotheses. Marzocchi et al. (2004;2006) adopt the Bayesian analysis to the develop a method (implemented in the tool BET_EF), based on the event tree schema, to estimate the probability of all the relevant possible outcomes of a volcanic crisis and, in general, to quantify volcanic hazard and risk. The objective of this study is to estimate the posterior probability density function (pdf) at the nodes, through the Bayes rule, which is used to update the a priori belief about the probability at each node of the event tree (Marzocchi et al., 2004;Aspinall and Woo, 2014) by including available past data. The evaluation of the long-term volcanic hazard is based on these posterior distributions.
As an example, the Bayesian long-term volcanic hazard for an eruption can be seen as the weighted average of the probability of an eruption with the posterior distributions of the probabilities of the risky events. The dispersion of the prior distributions at each node furnishes our 'degree of knowledge' for that stage of the volcanic process, and therefore it may guide future research with the aim of reducing epistemic uncertainties (Marzocchi et al., 2006).

Elicitation method.
Expert judgment is sought when substantial scientific uncertainty impacts on a decision process. Because there is uncertainty, the experts themselves are not certain and hence will typically not agree. Informally soliciting expert advice is not new. Structured expert judgment refers to an attempt to subject this process to transparent methodological rules, with the goal of treating expert judgments as scientific data in a formal decision process. The process by which experts come to agree is the scientific method itself (Cooke and Goossens, 2008). A valid goal of structured elicitation is to quantify uncertainty, not remove it from the decision process. The elicitation technique adopted within SNOWBALL is the 'classical model' formulated by Cooke (1991). It is a structured procedure for obtaining uncertainty judgments from experts, measuring their individual judgment capabilities with a performance-based metric, and then applying mathematical scoring rules to combine these individual judgments into a 'rational consensus' that can inform the deliberations of policy-makers. The Classical Model method relies on the use of proper scoring rules for weighting and combining expert judgments through statistical accuracy and information scores, measured on calibration variables (see Cooke, 1991), and operationalizes principles for rational consensus via a performance-based linear pooling or weighted averaging model. The weights are derived from experts' calibration and information scores, as measured on seed item calibration variables. Calibration variables serve a threefold purpose (Aspinall and Cooke, 2013): 1. to quantify experts' performance as subjective probability assessors; 2. to enable performance-optimised combinations of expert distributions; 3. to evaluate and hopefully validate the combination of expert judgments. The Cooke's Classical Model has been adopted for the hazard assessment for volcanic eruption of Monteserrat (Aspinall, 2006) and Vesuvius (Neri et al., 2008).

Conclusions
This paper describes a theoretical model for the cascading effects scenario analysis, whose general methodology and operational procedures are applicable to all the hazards and elements at risk categories identified. The inspiration of past EU project, such as MATRIX, NARAS, EXPLORIS and CRISMA, which consider only a limited number of hazards and elements at risk, was crucial to identify time-dependent variables and approaches to evaluate interdependence among hazards, critical infrastructure and service networks as potential sources of technological hazards, as well as the assessment of cumulative damage from a chain of cascading effects on the elements at risk exposed. Triggering hazards (either natural or technological) can generate different chains of events causing damage on different element exposed. The two fundamental pieces of information required to assess the effects of possible cascading effects are identified the compatibility/transition matrix and the elements at risk matrix. For each cascading effects scenario, the chains of events can be defined by a series of event-tree sequences, identifying the dependencies between the different hazards and depicting the complete 'time-history' of the sequence of events. Each branch of each of the event trees included in a cascading effects scenario 'time-history' representation is quantified by a probabilistic analysis depending on the sequence of events to be carried out following different complementary approaches (Bayesian methods, expert elicitation). The evaluation of damage can be then performed through the application of specific single hazard/impact simulation models interconnected in terms of input-output as outlined by the 'elementary bricks' approach methodology, both when the aim is to analyse all the possible cascading effects on a given area starting from a selected triggering hazard, both when only a single chain of cascading effects is taken into account for a scenario analysis. The theoretical model provides methods and procedures to integrate the 'time' and 'human behaviour' factor into single hazard/impact simulation models to be compliant with the methodology. It considers as a necessary step the customization of the general theoretical model to specific use cases, in order to produce reliable hazard/impact scenarios, useful to support decision-making through simulations and scenario assessment methods. The research aims at developing a theoretical model where simulation of cascading effects scenarios can be carried out with different level of detail, depending on the availability of inventory/exposure data for the different categories of elements at risk and hazard/impact models for the various hazard sources. The architecture of the simulation model can be conceived as a flexible structure of different building blocks, compliant with the theoretical model, and developed within SNOWBALL in relation to the Santorini pilot case. Therefore, the theoretical model here proposed has to be considered exhaustive in its methodological definition, while its application always require further data collection, analysis and modelling, customized on specific use cases and end-users needs.

Acknowledgements
The authors acknowledge the European Project SNOWBALL 'Lower the impact of aggravating factors in crisis situations thanks to adaptive foresight and decision-support tools' (FP7/2007-2013, Grant Agreement n° 606742), which has promoted and inspired the research activity. More information on the project is available at www.snowball-project.eu.