A multi-hazard risk model with cascading failure pathways for the Dawlish (UK) railway using historical and contemporary data

The failure of the vital economic railway link between London and the southwest of the United Kingdom in the 2014 storm chain incurred up to £1.2bn of economic losses. This incident highlighted the urgent need to understand the cascading nature of multi hazards involved in storm damage. This study focuses on the Dawlish railway where a seawall breach caused two months of railway closure in 2014. We used historical and contemporary data of severe weather damage and used failure analysis to develop a multi-hazard risk model for the railway. Twenty-nine damage events caused significant line closure in the period 1846–2014. For each event, hazards were identified, the sequence of failures were deconstructed, and a flowchart for each event was formulated showing the interrelationship of multiple hazards and their potential to cascade. The most frequent damage mechanisms were identified: (I) landslide, (II) direct ballast washout, and (III) masonry damage. We developed a risk model for the railway which has five layers in the top-down order of: (a) root cause (storm); (b) force generation (debris impact, wave impact, overtopping, excess pore pressure, wind impacts); (c) common cause failure (slope instability, rail flooding, coping and parapet damage, foundation failure and masonry damage); (d) cascading failure (landslide, ballast washout, upper masonry seawall failure, loss of infill material), and (e) network failure forcing service suspension. We identified five separate failure pathways and damage mechanisms by analysing these 29 major events.


Introduction
The United Kingdom has nearly 16,000 km of open rail routes [1] with a significant proportion of coastal alignment. Most of these are strategically important as they often are the only regional rail connection, or they provide logistical support to critical national infrastructure. For instance, the Cumbrian line in the lake district in north-west England ( Fig. 1c and d), is a vital link providing public transport as well as freight capacity to the nuclear reprocessing plant at Sellafield. The area is a UNESCO world heritage site and a major tourist destination [2]. In Wales, the south and west coastal railways (Fig. 1d) were instrumental in providing infrastructure to support the coal mining and shipping businesses of the nineteenth century [3]. Where coastal railways are subject to direct wave action, they are particularly vulnerable to climate change effects including sea level rise (SLR) and increases in storminess and rainfall [4]. Recent studies have indicated that there is a 20% increase in the number and intensity of storms [5,6] while Castelle et al. [7] showed that the winter-mean wave height has increased in recent years. The latest marine climate projections for the UK [8] predict mean sea level rise between 0.39 m and 0.70 m by 2100 dependant on emission scenarios. Network Rail, the infrastructure owner in the UK, has acknowledged weather resilience and climate change as a major risk to future operations, and in response has produced a series of adaptation plans. The latest is the "Second Climate Change Adaptation Report" [9], with a third due in 2021 [10]; the organisation has also contributed to the "Tomorrow's Railway and Climate Change Adaptation"research programme [11].
The section of railway between Exeter and Newton Abbott, UK (Fig. 1a) is particularly vulnerable to climate change effects. In 1845, a vertical seawall was built along the coastal margin to support the railway alignment in Dawlish [12]. Soft red sandstone cliffs were blasted along the coastline, with the unconsolidated material used to backfill the area between the cliff face and the frontage of the masonry seawall. Following the second report by Beeching [13], this section of railway became part of the Great Western mainline strategically connecting London to the south west of England. This sole vital economic link was broken during the February 2014 storm when successive deep extra-tropical cyclonic storms caused strong winds and violent waves [14] to cause structural failure on the seawall (Figs. 1b, 4 and 7d) and precipitated a route closure that lasted two months [15]. The cost of reinstatement was £50 m with associated economic losses estimated at up to £1.2bn for the South West region [16].
In this research, we study historical and contemporary data on the failure of the Dawlish railway by storm induced forces to establish a multi-hazard risk model with cascading failure pathways (FPW) which could be used with an exposure database to evaluate risk to the structural assets. We use primary historical accounts and identify damage mechanisms (DM) and FPW that cascade between separate DM. The innovation in this study is the identification of storm initiated multihazards and the development of cascading structural vulnerabilities of rail network infrastructure in the UK. To our knowledge, this is one of the pioneering multi-hazard risk models with cascading FPW for rail networks in coastal settings. The combination of historical damage data with contemporary engineering understanding of cascading risk is a particular strength of this research. A multi-hazard risk model such as this would be beneficial for improving the resilience of the railway network to severe weather events by providing a tool that predicts possible FPW to inform future engineering interventions.

Literature review
Differences of language used in Disaster Risk Management studies by diverse disciplines has led to an effort for harmonisation in terminology as identified by Kappes et al. [17] and more recently Monte et al. [18]. For clarity we define the terms used in this paper in Table 1.
Risk (R) is defined by the Intergovernmental Panel for Climate Change [19] as the product of hazard (H) and consequence (C): Civil and Structural Engineers often define risk by expanding the definition of consequence as the product of structural vulnerability (V) and exposure (E) [20]: In this study we have developed a model which combines the hazard and vulnerability of the engineering assets, respecting the intrinsic link between hazardous force generation and propensity for damage as represented by structural vulnerability. The benefit of this approach is that the exposure has been decoupled from the structural vulnerability. This allows multiple stakeholders to interrogate the model using their own exposure metrics to provide tailored evaluations of overall risk (e.g. insurance providers for loss quantification, Network Rail for maintenance and capital expenditure and local authorities for disaster risk planning). This infers the risk model proposed is specific to similar hazard events (i.e. extratropical cyclonic storms temporally coincident with high spring tides and strong onshore winds) for infrastructure with common characteristics (coastal railways with vertical masonry seawalls subject to direct wave action).
The challenges of analysing multi-hazards have been comprehensively reviewed and discussed by Kappes et al. [17] who make the relation between multi-hazard analysis and the objective of risk reduction. In the first multi-hazard approach, the authors argue that the idea of relevance is of prime importance in a defined area (the all-hazards-at-a-place approach) [21] (Table 1). The present study meets this criterion with the qualification that this is a study of critical civil engineering transport infrastructure and more specifically that of a coastal railway in the south west of England. In their second "thematically defined" approach Kappes et al. [17] introduce the idea of multi-hazard as "one hazard that triggers a second process" and go on to argue that one event may cause multiple threatshere too the present study meets this criterion. Our root cause initiating hazard is shown to generate five separate forces, each given their own damage mechanism (DM) in the proposed risk model.
Holistic treatment of multi-hazard risk (Table 1) is important, not least because "hazards are related and influence each other" [17], hence the idea of hazard chains or cascades [22][23][24]. The idea of hazard events having a cascading effect on interlinked systems has recently been developed and reviewed by Pescaroli et al. [25] and Pescaroli [26] in the area of emergency risk management while Huggins et al. [27] has recently reviewed the cascading effects due to rain-related incidents. Climate change has been linked to increased severity of hazard events. For a transportation system such as a coastal railway, which is subject to multi-hazard risk scenarios, the potential for cascading effects is amplified -especially when the network is critical infrastructure. This study identifies and proposes the elements of failure which may cascade across DM and have the effect of increasing the severity of the disaster event.
In terms of civil engineering infrastructure, Gardoni and LaFave [28] assert that mitigation of risk must account for the impact of combined natural and anthropogenic hazards, and that remedial strategies should account for infrastructure life cycles taking into account aging and deterioration. This idea of a dynamic vulnerability, as the hazard evolves and the assets age, is developed by Gill and Malamud [29] who define cascades as interaction networks of hazard and detail the need to include these interactions in any multi-hazard risk framework. The authors have incorporated this approach by developing separate force generating mechanisms from one initiating event in the proposed model. A generalised multi-hazard risk model for coastal infrastructure damage was proposed by Heidarzadeh et al. [30] for Dominica in the aftermath of Hurricane Maria and Japan following the 2016 Typhoon Lionrock [31]. Although the work included seawall and subsequent road damage, it did not deal with a complex interconnected and dense transport infrastructure like the UK rail network or detail the specific structural components of the infrastructure concerned. Similarly, Mase et al. [32] analysed the climate change effects on earthen dyke reliability and proposed a generalised model of FPW, however these were exclusively based on wave overtopping rates as a surrogate of total force generation and detailed only linear FPW. This approach may prove simplistic for a complex rail network built on an historic masonry structure. For a cascading series of events, using only wave overtopping to describe force transfer means failure mechanisms not associated with wave energy maybe missed. Gill and Malamud [33] discuss the spatial overlap and temporal likelihood of natural hazard interactions. These considerations have been incorporated into our study where we detail a DM that includes landslideoften these events are temporally offset by days or weeks compared to the more immediate DM associated with masonry failure or undermining of foundations. Inherent in the approach of Pescaroli and Alexander [34] is the acceptance that cascading events may involve damage to many disparate naturally occurring and man-made networks so increasing their overall effect. Van Eeten et al. [35] discuss the multi-hazard nature of cascading failures across critical infrastructure and contend that their occurrence is much more common than originally thought. Zscheischler et al. [36] recently introduced the idea of compound events defined as a combination of multiple drivers Table 1 Nomenclature used in this paper where not explicitly defined elsewhere in the text.

Terminology Definition Reference
Risk Risk can be defined as a function between hazard and vulnerability, which can provide answers regarding the preparation (or not) of an individual, community, or system.
Monte et al. [18] Multi-hazard risk The term multi-hazard risk refers to the risk arising from multiple hazards. By contrast, the term multi-risk would relate to multiple risks such as economic, ecological, social, etc.
Kappes et al. [17] Cascading "… one type of phenomena can clearly be distinguished: the triggering of one hazard by another, eventually leading to subsequent hazard events. This is referred to as cascade, domino effect, follow-on event, knock-on effect, or triggering effect." Kappes et al. [17] Delmonaco et al. [37] Carpignano et al. [38] Vulnerability Vulnerability can be defined as the state of community fragility and the system in which it lives based on its physical, social, cultural, economic, technological, and political aspects, thereby diminishing all capacities. Whereas the vulnerability of transport systems is commonly assessed in terms of physical vulnerability of its components depending on the physical characteristics of the infrastructure assets, e.g. age, material, structural types, and functional vulnerability depending on the functional characteristics of the network, e.g. capacity and speed.
Monte et al. [18] Birkmann et al. [39] Resilience The ability of a system and its component parts to anticipate, absorb, accommodate, or recover from the effects of a hazardous event in a timely and efficient manner, including through ensuring the preservation, restoration, or improvement of its essential basic structures and functions.
UNIPCC [19] Damage Mechanism (DM) Each force generated by the root cause or initiating hazard scenario gives rise to a damage mechanism, which links the force to the structural vulnerability (represented as a common cause failure and a cascading failure). Each damage mechanism consists of one or more failure pathways. Failure Pathway (FPW) The path force is transmitted through the structural elements giving rise to failure which has the potential to cascade between separate damage mechanisms.

Exposure
The presence (location) of people, livelihoods, environmental services and resources, infrastructure, or economic, social, or cultural assets in places that could be adversely affected by physical events and which, thereby, are subject to potential future harm, loss, or damage.
Monte et al. [18] UNIPCC [19] Disaster A disaster of natural origin can be considered the "materialization" of risk or the product of interactions between natural phenomena and individuals, communities, or systems in a given area and time that causes a rupture in social well-being and requires external assistance.
Monte et al. [18] and hazards which are responsible for many of the most severe weather and climate related impacts.

Methods and data
Archival research of historical damage data and interpretation of damage information was used in combination for this study. This approach has been widely applied in the past for natural hazard analysis, for example by Soloviev [40], Ambraseys and Melvill [41] and Heidarzadeh et al. [42]. We establish DM associated with each event, detail the multi-hazards triggered (e.g. wave overtopping, wave impacts or excess soil pore pressure) and identify the cascading nature of the hazards. Research was undertaken to investigate the frequency of occurrence and nature of the damage suffered by the seawall in Dawlish from the date of work commencing in 1845 until the February 2014 storms.
The British Newspaper Archive at the British Library 1 facilitated a comprehensive review of damage reports with some details of prevailing weather and sea conditions that led to failure (Fig. 2a). The historical records were cross referenced for accuracy with additional resources provided by Brunel University London (BUL) Special Collections, 2 The National Archives at Kew (TNA), 3 University of Bristol Brunel Collection, 4 the UK Institution of Civil Engineers 5 and Network Rail. 6 The historical record up to the late 1980's was comprehensively detailed in Kay's work on the history of the Exeter to Newton Abbott line which benefitted from personal interviews with the dedicated "seawall gang" of technicians and masons based at Dawlish station, whose job was to constantly survey and maintain the fabric of the seawall [43]. The railway damage information is compiled into Table 2. From a large list of numerous damage incidents, we study significant failure events. A significant event is defined as one which led to either the complete closure of the line for at least 12 h or required one of the lines to be closed for at least one day (single line closure; Table 2, Column 5). In total, 29 separate incidents of significant failure were discovered in the 169-year history of the line to 2014 and are listed in Table 2. A more comprehensive list of events affecting the railway line was also compiled by Dawson et al. [44] although their interest was focussed on human geography and anticipated sea level rise. We limited our entries in Table 2 to events which demonstrated major failure mechanisms of the engineered assets using the criteria above since our objective is to establish a multi-hazard risk model. The result is that we do not include minor incidents which may, for instance, result in speed restrictions or delay on the line or those which are regularly corrected by the dedicated team of maintenance linesmen based at Dawlish station. By adopting this approach, we have satisfied the criterion of "cut-off" [21] where the severity of an event is defined by its spatial scale and relevancein effect we have defined the exposure by quantifying the extent of the network failure. This allows stakeholders to use the model to determine the scale of loss for an individual event and to understand the probable FPW which contribute to loss of service.
In this research we applied a multi-hazard risk assessment methodology, considering cascading failure paths to analyse historical failure events, previous work was undertaken by Marzocchi et al. [23] and Egli [45] with event tree analysis which provides a basis for our approach. In the present study we modified a top-down Fault Tree Analysis (FTA) [46] and bottom-up Failure Mode and Effect Analysis (FMEA) [47] to fit the known observed damage events ( Table 2). We then applied engineering judgement to infer any intermediate failure paths which led to a known network failure condition while being consistent with the historical record. For the most recent events, where detailed records are available, the FMEA route was chosen. Where the severity of the hazard data was postulated from contemporary newspaper reporting, the FTA was used. We justify the judgements made through temporal alignment of the failure events over successive decades. For each incident we produced a diagram detailing the specific elements of common cause failure (a FPW within a DM) and cascading failure (a FPW linking different DM) leading to network failure (an exposure) stemming from an initiating root cause hazard, in this case a storm.
We then aggregated these into a model following the structure of Lee [48] and developed it by adding an intermediate force generating step in the DM between the root cause and common cause failure lanes. The root cause encapsulates the initiating hazard which in our model is a storm which leads to service suspension. In reality, the hazard is a complex combination of extra-tropical cyclonic weather systems, sometimes appearing as series of discrete events, temporally aligned with high spring tidal cycles, prolonged rainfall and easterly or south-easterly prevailing winds. In combination, they generate large and violent waves which can impart destructive energy onto the railway infrastructure. The forces that are generated because of this hazard sequence are divided broadly into wind dominated, hydrodynamic (or wave) and geotechnical effects which in turn initiate a primary common cause failure. We define a common cause failure here as a series of simultaneous multiple failures that result from a single event [49,50], which can subsequently cascade across DM, increasing the severity of the disaster and precipitating a service suspension.

Historical records of railway damage
Despite Victorian (1837-1901 AD) engineering determination that man could curtail the action of the seas, "Mr Brunel [the chief engineer] is confident that he can keep out the sea from the line" (Fig. 2a), damage to the railway's seawall and associated engineering assets were a feature of constructing and operating the railway in Dawlish from the beginning in 1845. Initial damage was to the wall structure since it was constantly  (1) bombarded by energetic coastal waves whilst being built. Early recognition that stronger materials were needed is reported in the press: "coping and seawall, formed of massive blocks of sandstone, are destroyed", while the engineers searched for a local supply of stronger stone: "… massive wall of Babbicome limestone, with a back filling of layers of fagot and sandstone.". The cost of the remedial works to decrease the vulnerability of the seawall were estimated: "in vain to shrink even from £100,000" [51], which in present-day value is equivalent to £6 m [53]. However, it was only a few years later that a second hazard was to be identified. The soft sandstone cliffs that were blasted and used to build the seawall, and subsequently used to backfill the stronger sections, gave way in the winter of 1852 on two occasions and a few months later in 1853 [43]. In the historical records of significant damage events (Fig. 3), 29% of occurrences involved slope instability or cliff face failure above the railway line, while 62% involved seawall failure (masonry, coping and toe scour). Successive newspaper reports and technical records show that damage was sustained in a similar manner throughout the life of the railway on average every decade or so (Table 2). In the few occurrences where seawall failure or geotechnical considerations are not explicitly mentioned, the force of water due to excessive overtopping has been responsible for flooding of the rails (3%) while wave debris damage accounted for 3% and direct wind damage a further 3%. Fig. 4 presents some images of major historical damage of a few of the incidents listed in Table 2.
In all cases of significant damage, weather considerations were implicitly implicated. The easterly facing embayed nature of the Dawlish coastline makes it vulnerable to high spring tides, supplemented by storm surge when accompanied by deep cyclonic storms blowing southeasterlies landwards. Heaps [54] points out that along the southern coastlines of the UK, the tidal conditions at the time of a storm surge are often the most important factorhigh spring tides coupled with hydrodynamic forcing can result in high water levels risking flooding as well as large waves which impart strong forces on coastal infrastructure. Fig. 2b shows the line of high-water ordinary tides as being at or above the wall footings. To the east of the site of the 2014 damage at Rockstone, high-water ordinary tide is shown as being beyond the track bed and seawall. In these circumstances it is not surprising that 11 separate incidents from a total of 29 (≈38%) can be attributed to the Sea Lawn and Rockstone areas ( Table 2). Dawlish's soft red sandstone geology and the weathering of the cliffs in this bay has historically provided material for beach nourishment. The historical and contemporary accounts are consistent; during extended periods of stormy weather such as encountered during winter months (November to March), beach levels can be significantly eroded leading to the toe sections of the wall being uncovered. The lower beach levels lead to higher significant wave heights which in turn exert higher impact forces on the structure and in turn increased toe scour.

Risk model for the Dawlish railway
Based on the data in Table 2 and the damage descriptions in historical and contemporary accounts, we established the multiple hazards contributing to railway failure, their cascading order, DM and FPW. For each of these we developed a separate flowchart. In terms of railway resilience to storms and weather incidents, such flowcharts are helpful towards identifying the weak links in the infrastructure system and to the strengthening of those elements to reduce vulnerability.
We combined the separate flowcharts to form our proposed risk model consisting of five layers of precedence (Fig. 5): a) A root cause event which contributes to the hazard element of the risk equation (in our case a storm). The initiating hazard is temporally coincident with strong easterly to south easterly winds, sustained rainfall and high spring tides. The combined effect is to significantly increase energy delivery to the coastline. b) Hazard force differentiation where discrete energy transfer processes encompassing wind, wave and excess soil pore pressure are generated. Each of these represent a DM which consequently initiates: c) A series of common cause failures (FPW) which can occur simultaneously, are related to structural vulnerability and lead to: d) cascading failures which can link separate DM and has the effect of increasing the severity of the event, and ultimately: e) Network failure and resulting railway service suspensionexposure.
The three most common damage mechanisms (DM I to DM III) develop five separate failure pathways (FPW 1 to 5) each one associated with a common cause failure in the third layer of the risk model.  Table 2.

Analysis of damage mechanisms
The risk model identifies five damage mechanisms, each with their own generating force, these are: DM I: Excess pore pressure (U e ) in the shear faced cliff soils generated by prolonged rainfall leading to slope instability and landslide (Fig. 6b).
DM II: Overtopping forces (W OV ) generated by wave heights incident on the front face of the seawall energetic enough to propel water above  the top surface of the seawall and onto the back side of the structure, initiating direct ballast washout due to rails flooding or damage to the coping stones and parapet wall separating the railway from the seawall frontage (Fig. 7).
DM III: Hydraulic impact forces (W I ) which involve the transfer of energy from the incoming waves (whether breaking or not) onto the vertical surface of the seawall, causing failure of main seawall elements due to masonry damage usually affecting the upper sections of the wall or due to loss of infill material after foundation failure initiated by toe scour (Fig. 10c).
DM IV: Wave debris impact (W D ) which involves the transport of material in the water column and subsequent impact of that on network infrastructure requiring service suspension.
DM V: A wind-dominated impact force (G I ) which can damage and destroy elements of the network due to the speed and gusting of the prevailing winds and precipitate a service suspension.
The first three DM represent 94% of all recorded significant events (Fig. 3). These three main DM are discussed in more detail following. Cascading failure between DM II and III result in indirect ballast washout and ultimate service suspension. We observed that more than one mechanism can be activated in an event.

DM I: landslide due to slope instability (L S , S I , U e )
Excess pore pressure builds in the soil and leads to slope instability in the shear faced cliffs, which then activates a landslidethis is a linear DM which can, of itself, result in network failure. The soft red sandstone rock-faces in south Devon have provided beach material for the coastline through natural erosion for centuries. When the seawall was erected 170 years ago, a vital supply of material was isolated from the foreshore; in addition, the blasting of the cliffs to provide even alignment and backfill, exposed shear faces and steep inclines to weathering by precipitation. The sandstone is widely folded and faulted along the coast (Fig. 6a), and this makes it particularly unstable when there is a period of extended rainfall. The steep gradients result in frequent landslides during the winter storm season caused by slope instability as excess pore pressure is released. Although landslides (Fig. 6b) may accompany wave damage of the seawall, they are seldom reported separately in the historical reports.

DM II: ballast washout due to wave overtopping (B W , F R , D CPW , W OV )
Ballast washout is the terminal cascading failure which causes service suspension in all cases of masonry damage from wave overtopping. Despite the engineers' assertion that they could "keep out the sea from the line" (Fig. 2a), at times of normal high tide, the water surface is barely 0.5 m from the top of the coping stones of the seawall near the site of the 2014 collapse (Fig. 7a) and this often leads to preventative line closures when high tide and weather risks coincide [56]. With easterly wind direction and large waves incident on the seawall [57], the railway has often suffered from wave overtopping forces which, when significant, can flood the tracks and wash the ballast away (Fig. 7c), leaving the railway inoperable. This FPW 2 occurs often and is generally Fig. 7. a) Ordinary high tide close to coping stone level, 2018. b) Wave overtopping damage to coping stones [58]. c) Ballast protection using gabion wire mesh baskets. d) Washout due to overtopping accompanied by parapet wall masonry damage in 2014 [59]. e) Ballast covers on the line closest to the sea as mitigation for wash-out, 2018. accompanied by masonry damage or undermining of foundations of the seawall (Fig. 7d).
Wave overtopping often results in enough force transfer to activate FPW 3 causing coping stones at the top of the seawall to be removed or broken (Fig. 7b). These large stones, typically granite, are then propelled against the adjacent 1-m-high parapet wall that separates the track bed with the promenade (Fig. 7e). The damaged parapet then fails with successive wave overtopping and blocks the rail line. This can occur over a significant distance along the coastal railway and is usually repaired by the dedicated line gang based at Dawlish railway station.

DM III: toe scour and masonry damage due to wave impact (I L , D FU , D M , F US , W I )
FPW 4 involves wave impact forces causing damage to the foundations of the seawall due to toe scour and loss of infill material. This is a bottom-up mechanism, where sections of the wall will often be affected by lower masonry being removed following destruction of the toe protection (Fig. 8). Here the backfill material behind the upper sections of the wall are not removed so protecting them from collapse; however, backfill is removed near the toe by suction from successive waves and eventually the lower masonry sections yield. This is the most common and significant failure mechanism among the damage incidents studied in this research accounting for 55% of all events (masonry damage 23% and toe scour 22%) (Fig. 3). Wave impact removes large amounts of sand cover during storms, thereby exposing the footings of the foundations of the main seawall. Toe scour due to successive wave trains leads to accelerated erosion at the interface of the soft red sandstone foundation and the more durable rock forming the frontage of the railway seawall. Waves wear away the foundation and then backfill material is sucked out of the cavity behind the frontage. In the absence of infill material, masonry damage to the wall fascia is sustained either at low or high level by wave impact force. This can lead to the rail tracks being left suspended in mid-air (Figs. 1b, 4 and 10c). Whereas toe scour is initiated through a bottom-up mechanism, masonry damage is a top-down wave impact failure, initiated in the seawall by removal of upper courses of masonry. Although this FPW 5 is not the most common it has the potential to be the most expensive and disruptive, it often accompanies the top sections of coping and parapet walls failing due to overtopping of waves (FPW 3). Subsequently flooding of the rail bed occurs and ballast is washed away exposing backfill material. Wave impact forces then remove the upper courses of masonry allowing washback of overtopped water and infill material to the sea. Repeated actions over a high tide then accentuates the mechanism and causes further masonry to be removed. The cascading nature of the failure of the upper courses of masonry and ballast washout significantly increases the severity of the event.

Model application
Two applications of the multi-hazard risk model are presented as case studies for the Dawlish railway below.

The 1986 incident
Evidence was collated for an incident that occurred on February 26, 1986 following a violent storm. Dawson et al. [44] used information gathered from Rogers [60] to detail the remedial works required following a failure to the seawall (Fig. 9a). We cross referenced this material with Network Rail [15] and Kay [43] to detail the specific failure paths that were activated. We identified the involvement of DM II and III (as described in Section 4) through three FPW as shown in Fig. 9. The storm generated wave impact and overtopping forces on a previously undamaged section of the original seawall between Dawlish and Teignmouth. Impact damage caused toe protection to be stripped away (Fig. 9a) and led to a common cause failure of the foundations due to undermining. A cascading failure of loss of infill material behind the wall and ballast washout followed (Fig. 9b). At the same time, wave overtopping forces caused flooding of rails and damage to the coping stones and parapet walls cascading to a ballast washout (Fig. 9c). Service was suspended for six days and for a further seven days of single line closure ( Table 2).

The February 2014 incident
During February 2014, a series of storms coincided with high tides to cause severe damage to the rail network in the South West of England. The events were extensively reported in the press and were the subject of academic articles [14,44,57] as well as technical and impact assessments by the network operator [9,10,15] and local community and business groups [16]. We collated this information into a database of articles, pictures and videos to obtain a clear view of the timeline of the events and their sequencing specifically in terms of damage to the engineering assets of the railway. A field survey was conducted in September 2018 to examine the site of the damage and to evaluate the restoration works undertaken. The local museum in Dawlish 7 provided extensive information on the disaster, augmented by interviews with residents, engineers and emergency workers involved in the first response and subsequent rebuilding.
The seawall was reported to have failed during storms on the February 4, 2014, although we have studied reports and interviews with witnesses which prove the damage was initiated on the 3rd of February. Evidence suggests that three FPW were activated which led to the twomonth suspension of service as shown in Fig. 10. Referring to Section 5, we identified the involvement of DM I, II and III with the following FPW for the 2014 event: FPW-1: Long periods of high rainfall were sustained in the area prior and subsequent to the February damage to the seawall; this had the effect of causing a large landslide on 21st March due to slope instability brought on by excess pore pressure in the shear faces of the sandstone cliffs above the railway line (Fig. 10a). This increased the severity of the disaster and represented a multi-hazard aspect to the event, lengthening the period of reconstruction and significantly impacting on the costs of recovery.
FPW-2: Wave overtopping and flooding of the rails led to significant amounts of direct ballast washout (Fig. 10b); this flooding has the effect of displacing the ballast which supports the rails and uncovers the backfill material underneath. When overtopping and wave impact forces combine, further waves incident on the structure cause the infill to fluidise and become more mobilehence material is washed out to sea and additional damage to the masonry structure is sustained. The result is a V-shaped damage to the wall and hanging rails over a void space (Figs. 1b, 4 and 10c).
FPW-5: The storm generated wave impact forces which initiated a common cause failure, damaging masonry elements in the wall structure cascading to failure of the upper sections of wall and ballast washout (Fig. 10c).

Discussion
The resilience of coastal railways to natural hazards such as storms and surges is an important aspect of disaster risk mitigation in those countries with vulnerable transport infrastructure. The present risk model (Fig. 5) is spatially specific to the Southwest England rail mainline through Dawlish but has application in other coastal railway Fig. 9. Event flowchart for the 1986 seawall failure. a) Railway engineers inspecting the foundation failure due to toe scour after wave impact damage [43]. b) The result of overtopping is shown here: removal of coping and parapet walls [43]. c) Recent example of damage after rail flooding and ballast washout due to wave overtopping [61]. Where: S T : storm; W I : wave impact force; D FU : foundations undermined due to toe scour; I L : loss of infill material; W OV : wave overtopping force; F R : flooding of rails; B W : ballast washout; D CPW : damage to coping stones and parapet walls; S S : service suspension; FPW: failure pathway. alignments throughout the UK, such as in Cumbria, west and south Wales (Fig. 1) where similar hazards are encountered and the engineering assets were constructed during the same era and using similar design methods. Adaptation of the hazard elements to include local meteorological and wave environments would allow direct usage of the model in those regions. An example application would be for the analysis of damage events such as the January 3, 2014 incident in Cumbria [64,65]. High spring tides, storms and landward winds caused extensive damage to the embankments, ballast and track and forced a weeklong suspension of service near Flimby (Fig. 1c). Reports of this event would suggest our DM II and III were activated with FPW 2,3 and 5 being involved in the cascading failure evident as shown in Fig. 11. This type of model may also be applicable to other countries. Koks et al. [66] in their global risk analysis report that approximately 27% of all road and rail assets are exposed to at least one hazard worldwide. In Italy, coastal infrastructure has been reported to be vulnerable to wave action and severe erosion [67] and specifically railway infrastructure along the Battipaglia-Reggio Calabria coastline [68]. For sea level rise and increased storminess, Dawson et al. [44] report potentially vulnerable coastal transport infrastructure in several major international cities. A key facet of the proposed model is the adaptive nature of its elements. Kamaza and Noda [69] discuss the effects of the Japan 2011 earthquake and subsequent tsunami event, reporting widespread rail network disruption in over 1700 locations. AIR international [70] in their modelling report of the 2011 great earthquake and tsunami also point out that water induced damages can outweigh the costs of earthquake and liquefaction in transport systems over a large spatial scale. Although our risk model has been developed for extra-tropical storms with hydrodynamic forcing, it has common DM and FPW that could be used for evaluation of risk following tsunami events. An example of this is for the Japan 2011 event where DM II -wave overtopping, FPW 2 and 3 are activated leading to flooding of rails and ballast washout [71]. These pathways were positively identified along with DM I leading to landslide, DM III leading to toe scour and loss of infill material behind earth retaining walls [72,73] and DM IVwave debris force, which is a rare occurrence for UK rail networks but a much more important, costly and common DM in tsunami induced failures [74].
One of the major strengths of this study and conversely challenges in implementing this approach to other settings is its reliance on long term records of damage incidents. The Victorian rail network in the UK and the coastal alignments are some of the oldest in the world and represent the first attempts at coastal engineering. The historical record stretches for 170 years with significant contributions in newspaper articles, books and company records. Our research suggests that significant failure occurs on average every 8 years. Despite this comprehensive and longterm record there remains some epistemic uncertainty in the exact  [55]. b) Failure path with significant wave overtopping flooding rails and leading to ballast washout [62]. c) Failure path of the upper sections of the seawall due to wave impact forces [63]. Where: S T : storm; U e : excess pore pressure in the soil; S I : slope instability; L s : landslide; W OV : wave overtopping force; F R : flooding of rails; B W : ballast washout; W I : wave impact force; D M : damage to masonry elements; F US : failure of upper sections of wall; S S : service suspension; FPW: failure pathway. nature of the damage and sequence of events, increasing with older recordsthis is considered a limitation of the study. The amalgamation of the separate rail companies into GWR and then British Rail in the 1950's and the rationalisation of records means some details of engineering interventions have been lost, and newspaper articles by their nature are non-technical so accentuating the uncertainty. The model is based on the hazard-vulnerability of the Dawlish railway, characterised by a vertical masonry seawall elevating the rail alignment above normal high tide level. The line is built along a coast characterised by soft sandstone deposits which readily weather and have historically provided nourishment for the beach. The age of the asset will affect its vulnerability and the application of the model to other Victorian coastal railways will be dependent on these criteria. However, the methodology and systematic identification of separate force mechanisms from a single initiating event provides a valuable tool for infrastructure stakeholders to tailor the model for diverse application as demonstrated briefly by reference to the Cumbrian mainline in north-west England and potential application to tsunami related damage following the 2011 event in Japan.

Conclusions
We developed a multi-hazard risk model with cascading FPW for the Dawlish railway through retrieving and analysing major damage incidents in the period 1846-2014 with the aim of risk reduction. This approach allowed us to: • Identify 29 damage events of significant engineering impact (i.e. line closure more than 12 h) on the Dawlish railway in the period 1846-2014 through archival research of historical and contemporary data. • Based on the railway damage data, the three most frequent DM were identified which are: (I) landslide, (II) direct ballast washout due to wave overtopping, (III) failure of the upper sections of the wall and loss of infill material after foundation failure due to wave impact force which cascade to indirect ballast washout. • For each of the 29 failure events, we have identified the common hazard involved, deconstructed the sequence of civil engineering failures and formulated a flowchart for each event, showing the interrelationship of multiple hazards and their potential to cascade. • For the February 2014 railway damage incident in Dawlish, three FPW were identified: 1) the storm generated wave impact forces which damaged masonry elements in the wall structure cascading to failure of the upper sections of wall and ballast washout; 2) Washout exacerbated by additional wave overtopping leading to flooding of the rails; displacing the ballast and uncovering the backfill material underneath; 3) Intensive rainfall caused a large landslide due to slope instability brought on by excess pore pressure in the shear faces of the sandstone cliffs above the railway line. • We were then able to develop a risk model for the civil engineering assets associated with the railway network in Dawlish with the potential to provide stakeholders with a probability-based method of risk evaluation following further development. Our proposed model has five cascading layers in the top-down order of: (a) root cause (storm); (b) force generation (debris impact, wave impact, overtopping, excess pore pressure, wind impacts); (c) common cause failure (foundation scour, masonry damage, rail flooding, slope instability); (d) cascading failure (landslide, ballast washout, upper masonry seawall failure, loss of infill material), and (e) network failure forcing service suspension.

Declaration of competing interest
The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper.