Theoretical model for cascading effects analyses

a country or a macro-region [municipality], while at local scale, where greater detail is required, it can be taken as a partition of municipal area, for example, by a mesh having cells of 500× 500m or even smaller, up to 250×250m, according to the reliability of the input data available. In case of risk analyses for in- frastructures, the most appropriate MRU may be the segment of the network between two intersections or nodes (link), in order to evaluate the section where occurs the damage on the functionality of the grid. The spatial distribution of each hazard (in the chain) and of each element exposed regulates the type of damage induced by cascading effects. The possible cases are the following two (Fig. 6): 1. the single element exposed (people, buildings, infrastructures, economy, etc.) is affected by one hazard. In this case, the damage induced is function only of the vulnerability of the element under Fig. 4. Typical vulnerability curves referred to a certain class of vulnerability and to a specific hazard. Table 3 Damage measure for different elements exposed. Element exposed Meausure of damage PEOPLE n° of people damaged in MRU BUILDINGS n° of buildings damaged in MRU INFRASTRUCTURES n° of links interrupted in MRU ECONOMY monetary damages for economic sector in MRU ENVIROMENT effects / consequences to different environmental components* in MRU * Atmosphere and aquatic environment, soil and subsoil, vegetation flora, fauna, ecosystems, landscape and health, etc. Fig. 5. Flow chart of model to assess the impact induced by a timeline of cascading events (hazard chain C0n) on the territory. G. Zuccaro et al. International Journal of Disaster Risk Reduction 30 (2018) 199–215 204 effect of the single hazard. 2. the single element exposed is affected by two or more consecutive hazards. In this case, the sequence of events induces a cumulative damage, that is function of progressive increase of the vulnerability of the element exposed, depending on the evolution of the damaging process. 3.2. Time Time factor is a variable of crucial importance in cascading effects modelling, since the final impact of a crisis can depend on the process of amplification of damage over time and by the presence of subsidiary disasters [28]. In terms of damage evaluation, the time factor affects the cumula- tive damage on specific elements at risk, only when the timeframe needed to restore the functionality of such element is shorter than the total time of the analysis for the cascading effects scenario identified. As an example, if we consider an earthquake followed by a landslide damaging a house, given that the time needed to repair the house (and thus restore its functionality) even from a slight damage is considerably higher, then the timeframe envisaged for the triggering of the cascading effect 'landslide', the cumulative damage assessment can neglect the time variable as influencing parameter. On the contrary, time is a crucial factor in critical infrastructure, grids and service networks damage evaluation, since the time required to restore the functionality of such systems, within certain damage thresholds, can be shorter than the scenario analysis timeframe taken into account and could be the cause of following disruption and nega- tive effects on population and other element at risk considered. Time is considered as an important factor also in relation to short- term preparedness actions aimed at reducing the exposure and vulnerability of people, e.g. evacuation processes initiated when a po- tential cascading effects is forecasted, whose success depends on the timing of the action to be completed before the cascading effect occurs. In such kind of analysis, the relation between time factor and human behaviour has to be considered too. From a modelling point of view, the focus of the research in terms of scenario analyses and assessments entails the need of defining a specific timeline for each scenario to be simulated, clearly identifying the transitions where the time factor affects the final impact evaluation. Fig. 7 shows how the time factor is taken into account in the defi- nition of the theoretical model for cascading effects simulations, in which both the sequence of hazard events and decision points corre- sponding to human actions are included in the timeline subject to scenario analysis. The timeline definition represents a preliminary op- eration needed to perform hazard/impact scenario simulations. This should be defined depending on decision makers and stakeholders needs, also based on the understating of human behaviour aspects that could become as trigger or aggravating factor in cascading effect sce- narios. The time distribution of the hazards chain strongly influences the choice of analyses’ time steps. If each hazard has an instantaneous duration (i.e. earthquake), the analysis time steps coincide with the time occurrence of events (Fig. 8a). If one or more hazards are char- acterized by a finite time range (i.e. volcanic ash fall, grids interruption, etc.), the start times (t0) and the end times (tn) must be included among the analysis time steps (Fig. 8b). This last case considers also time in- tervals overlap among two or more hazards (Fig. 8c). The simulation model takes into account the influence of time in cascading effect scenarios, both in terms of 'cascades triggering poten- tial' and in terms of 'impact aggravating potential' of the subsequent hazard in the events’ chain. Since not always hazard chains and po- tential impacts are influenced by the time factor, the timeline re- presentation connected to each event tree object of simulation will in- clude information about time intervals only if the time factor is likely to produce variation in terms of hazard/impact scenario variation. In the framework of time histories development, a main distinction is made with respect to 'predictable / forecastable' and 'unpredictable / unforecastable' triggering events (Table 4), since the first category im- plies the extension of the timeline before the T0 (representing the timestamp of the triggering event), with consequent potential variation on exposure and vulnerability of different elements at risk due to the implementation of preparedness actions. Under specific circumstances, even unpredictable hazards can imply the need for simulating time intervals preceding the triggering event, such as e.g. a big earthquake anticipated by a long-lasting seismic swarm as in the case of L′Aquila 2009 [33]. Events such as landslides and avalanches, whose occurrence can indeed be forecasted in presence of a triggering event such as a Fig. 6. Space factor in cumulative damage. Fig. 7. Representation of time-dependent variables within the SNOWBALL theoretical model for cascading effects simulations. G. Zuccaro et al. International Journal of Disaster Risk Reduction 30 (2018) 199–215 205 storm or a prolonged heat wave, have to be classified as unpredictable when considering them as triggering hazards (originating, e.g. from slow onset phenomena such as rock cracking or underground water infiltration). Predictable events can be in turn subdivided into 'short' (6–72 h.) and 'long' (> 72 h) forecasting alert, thus implying different types of preparedness actions to be potentially put in place. 4. Dependencies between elements The proposed approach for the theoretical model requires to provide a 'generic' modelling framework based on the definition of a common logic to model the dependencies between the different hazards and the relevant parameters for the 'elementary bricks' as defined in Section 2 (space, time, hazard, exposure, vulnerability, dynamic vulnerability, damage, human behaviour). Subsequently, the approach needs to apply specific models and simulations for the respective use cases, in line with end-users needs and compatible with eventually existing legacy simu- lation tools, understood as the best approach to provide a decision support tool useful in the context of preparedness to real crises invol- ving cascading effects. This step will in fact provide the needed spe- cialization and customisation of the theoretical level in the context of the different use-cases through the support of experts, also involving local responsible for civil protection and modelling experts. From a methodological point of view, a very limited number of researches and scientific publications specifically focus on the topic of dependencies between different hazards, either in a multi-risk or cas- cading effects framework. Most of methodological approaches found in literature are based on the adoption of Event Tree model, which allows the identification of a transition probability between hazards (see, among others, [21,25,26]; [27,13]), possible interactions representing multiple hierarchies of information and situations where secondary hazards trigger tertiary hazards, and so on. A proper structuring and visualisation of such dependencies is a fundamental step to integrate cascading event chains within a model- ling logic and workflow, supported by probabilistic analyses on tran- sition between hazards and their consequences in terms of impact on elements at risk. Indeed, to provide actionable information and reliable input for simulation tools, the probabilistic assessment of hazards transition re- quires a level of understanding of cascading effects scenarios at local (national to regional) level, thus allowing a 'specialization' of the event tree(s) based on the needs and requirements of the end users. Nevertheless, the aim of the research is to provide a general framework to perform the definition of cascading effects scenarios at local level, developing a methodology to support decision makers and end users in the 'construction' of customized cascading event timeline based on Event Trees for the simulation of hazard/impact scenarios. As a preliminary step for the implementation of the timeline, the identification of possible dependencies/interactions between hazards has to be carried out to properly define transition probabilities. To this aim, some methods can be retrieved from literature and adapted within the scope of the research: 1. identify general compatibility and dependencies through analysis of past events disaster databases (main reference: EM-DAT database, 2. identify general compatibility and dependencies through scientific literature review (main references: [6,13,14,15]; [16,25,26]; [27]); 3. identify local compatibility and dependencies through the analysis of specific (local) studies or databases (if existing), complemented with an expert elicitation process ([13,14,6,26]; [25,22]; [27]) to compensate the lacking of probabilistic information for hazards characterisation at local level. Such focus can be based on a re- finement of the general compatibility/dependencies identified, but given the more detailed understanding of local risk conditions, can in theory also introduce new dependencies not taken into account in literature or never occurred in the past. As noted by Gill and Malamud [16], a matrix (e.g., [32,12,19]) is a Fig. 8. Time factor in hazards chain: a) instantaneous hazards; b) hazards are characterized by a finite time range; c) time intervals overlap among two or more hazards. Table 4 Classification of different hazard types according to time factor. Unpredictable triggering events Predictable triggering events (long-term forecast) Predictable triggering events (short-term forecast) Natural Hazards Earthquake Volcanic Eruption Heat Waves Landslide/Lahar Ash Fall Cold Waves Avalanche Pyroclastic Flow Extreme precipitation (Storm) Wildfire Volcanic Ballistics Flood (Flash Flood / River Flood) Lightning Lava Flow Drought Lightning Volcanic Gas Emission Hail Storm Ground Collapse / sinkhole Hurricane / Tornado Snow Storm Ground Heave Impact Events (asteroid) Regional Subsidence Soil [Local) Subsidence Technological Hazards Fire Dam/dyke Failure Gas leak (blds./infrast. collapse) Water contamination Toxic plume/Chemical spill (from Nuclear accident) Soil contamination Toxic plume/Chemical spill (from Mining damage) Air contamination Toxic plume/Chemical spill (from Other industrial accident) Electricity network failure Oil spill (from Other industrial accident) Water / wastewater network failure Release of solid / liquid substances G. Zuccaro et al. International Journal of Disaster Risk Reduction 30 (2018) 199–215 206 simple way of representing information about multiple different ha- zards, with either symbols or text used to outline the existence of in- teraction relationships. A general compatibility/transition matrix is developed, based on the above points 1 and 2. The application of Bayesian approaches or expert elicitation process allows a further refinement of possible cascading event trees by restricting hazard and exposure conditions in accordance to territorial and spatial scales. The research assumes EM-DAT database main source of information to identify hazard dependencies, since it is the only available disaster database that contains relevant information on past events in terms of cascading effects from the main triggering hazard and on multi-sectoral impacts (e.g. on people, built environment, infrastructure, economy). From the original database, only past events describing cascading paths have been selected, thus identifying the most relevant/recurring triggering hazards and cascading paths. Table 5 shows an excerpt of the Hazard section of the EM-DAT database, after refinement processes. In addition to this, the dependencies identified through a compre- hensive literature review are included in the analysis. Prior to the re- view, given the specific focus on cascading effects more than on multi- risk, interactions with a low temporal likelihood of occurrence have been deliberately excluded from the assessment. Hazard dependencies resulting from the EM-DAT analysis and the literature review can be visualised in form of a compatibility/transition matrix (Table 6), showing the potential of each hazard to trigger an- other one. Hazards interactions identified from the various sources have been combined to define all potential dependencies between hazards, highlighting the source of information of each interaction identified (see abbreviation). Starting from any given triggering hazard, a possible 'cascade' can be selected that in turn, switching back to the 'triggers' column, may be considered as a triggering hazard for the next event in the chain. A cascading effect example from the Table 6 could then be the following: Earthquake (EQ)> Landslide (LS)> Tsunami (TS)> Flood (FL)> Electricity Network Failure (EF)> The compatibility/transition matrix is the first essential tool of the theoretical model for cascading effects. It represents the generic mod- elling framework to be used as starting point for the development of cascading effects scenarios at local level, to be further modelled through a probabilistic approach identifying hazards transition prob- abilities. The matrix is then processed through probabilistic methods and/or expert judgement to evaluate the level of agreement on the de- pendencies identified, thus determining a first qualitative probabilistic assessment (low-medium-high), useful to select the cascading events paths object of the simulation. Nevertheless, a qualitative assessment performed independently from specific local risk conditions (even based on spatial-temporal and global risk models overlapping as in [16]) gives only a general view of the chain of events that are most likely to occur. From a simulation modelling point of view, only detailed probabilistic analyses and/or experts’ elicitation processes with a focus on specific territorial contexts can provide reliable information on transition probabilities between hazards in a cascading effects framework. In order to assess the cascading failure of critical infrastructures and service networks from a sequence of cascading events and/or the cu- mulative damage on the different categories of elements at risk iden- tified in the context of the research, the first step is to determine if two or more hazards from a given chain of events produce an impact on the same exposed element. To this aim, each hazard considered has been classified in relation to the expected potential impacts on the following categories of elements at risk (Table 7): • People (deaths, injured, homeless) • Buildings (damage, losses) • Infrastructure (electrical power grid damage, mobile phone network damage, water supply grid damage, gas supply grid damage, transport network interruption) • Economy (property, commercial activities / warehouses, business interruption, crops / agriculture) • Environment (water, soil, air) The correlation matrix between hazards and elements at risk is the second essential tool of the theoretical model for cascading effects. It represents the generic modelling framework to be used as starting point for the development of dynamic vulnerability functions for the elements at risk of interest in the impact simulation. Table 5 Sample from the EM-DAT database, filtered to include only cascading events. Year Country Group Type Subtype Associated Associated disaster 1 disaster 2 1906 United States Natural Earthquake Ground movement Fire – 1988 Uganda Natural Earthquake Ground movement Flood – 1990 United States Natural Storm Convective storm Flood Broken Dam 1991 Soviet Union Natural Earthquake Ground movement Flood Landslide 1991 United States Natural Storm Convective storm Hail Flood 1992 Lebanon Natural Storm Convective storm Avalanche Cold wave 1992 Philippines Natural Flood – Landslide – 1992 India Natural Storm Convective storm Flood Landslide 1993 Japan Natural Earthquake Tsunami Fire Tsunami 2002 Zaire/Congo Natural Volcanic activity Ash fall Earthquake Explosion 2002 Brazil Natural Landslide Landslide Flood – 2003 Japan Natural Earthquake Ground movement Fire Tsunami 2003 Cameroon Natural Landslide Landslide Flood – 2004 Indonesia Natural Earthquake Ground movement Fire – 2004 Japan Natural Earthquake Ground movement Fire Landslide 2005 India Technological Miscellaneous accident Other Broken Dam – 2005 Russia Technological Industrial accident Explosion Chemical spill – 2005 India Natural Earthquake Ground movement Fire – 2007 Tajikistan Natural Earthquake Ground movement Flood Landslide 2010 Iceland Natural Volcanic activity Ash fall Flood – 2010 Italy Natural Storm Convective Flood Landslide 2011 Japan Natural Earthquake Tsunami Fire Industrial accidents 2014 Colombia Technological Transport accident Road Explosion Fire 2014 Turkey Technological Industrial accident Explosion Fire – G. Zuccaro et al. International Journal of Disaster Risk Reduction 30 (2018) 199–215 207 5. Cascading events timelines The hazard compatibility matrix (Table 6) theoretically allows to build all the possible chains of events starting from a given triggering hazard. However, such kind of analysis may determine a range of complex and overly broad dependencies (Fig. 9), often not resulting in reliable cascading effects scenarios at local level and thus not providing adequate information to decision makers in terms of hazard/impact simulation needs. Moreover, the probabilities of transition between hazards are generally not available in the scientific literature with such a high level of generalisation, thus making extremely complex the issue of treating cascading effects modelling through an 'all encompassing' Table 6 General hazard compatibility/transition matrix showing the source of information from the literature review. G. Zuccaro et al. International Journal of Disaster Risk Reduction 30 (2018) 199–215 208 Ta bl e 7 M at ri x of co rr el at io ns be tw ee n ha za rd s an d el em en ts at ri sk . IM PA C TS Pe op le B ui ld in gs In fr as tr uc tu re Ec on om y En vi ro nm en t D ea th s In ju re d H om el es s Bu ild in g da m ag e Bu ild in g lo ss es Po w er gr id da m ag e M ob ile ph on e gr id W at er su pp ly ne tw or k G as su pp ly ne tw or k Tr an sp or t ne tw or k in te rr up ti on Pr op er ty C om m er ci al ac ti vi ti es / w ar eh ou se s Bu si ne ss in te rr up ti on C ro ps / A gr ic ul tu re W at er So il A ir N at ur al H az ar ds EQ x x x x x x x x x x x x x LS x x x x x x x x x x x x x x A V x x x x x x x x x x x x TS x x x x x x x x x x x x x x V E A F x x x x x x x x x x x x x PF x x x x x x x x x x x x x x V B x x LF x x x x x x x x x x x V G x H W x x x x C W x x x x x x ST x x x x x x x x x x x FL x x x x x x x x x x x x D R x x x H S x x x SS x x x x x x x x x x x H T x x x x x x x x x x x x FI x x x x x x x x x x x x R S x x x x x x x x x x x G C x x x x x x x x x x x x x x SU x x x x x x x x x x x x G H x x x x x x x x x x x x LI x x x x IE x x x x x x x x x x x x x x Te ch no lo gi ca l H az ar ds D F x x x x x x x x x x x x x FR x x x x x x x x x x x x EF x x x x x x x W F x x x G L x x x x x x x x x x x x x TN x x x x x x x TM x x x x x x x TO x x x x x x x O S x x x x x x x SL x x x x W C x x x x x x SC x x x A C x x x w id e an d co m pl ex as sh ow n in th e fi gu re . G. Zuccaro et al. International Journal of Disaster Risk Reduction 30 (2018) 199–215 209 full probabilistic approach to the hazards transitions within cascading effects crises. Furthermore, the probability occurrence of a given chain of events does not depend only on the possibility of a hazard triggering another, but also on their expected magnitude and the potential of occurrence in a given time and space window. Thus, in order to obtain a reliable event tree and perform probabilistic assessments useful to support decision making, it is necessary to refine the compatibility matrix with more detailed information related to the territorial area object of the as- sessment. The resulting interaction/compatibility matrix, refined for a given territorial area, can be then used to define all the possible event trees starting from a given triggering hazard. Table 8 shows an example concerning the cascading effects induced by a volcanic eruption in Santorini Island (Greece). In Fig. 10, a possible event tree is developed. Possible cascading natural or technological hazards are evaluated through an analysis of actual risk conditions (available local risk maps) and exposure of elements at risk (inventory data of exposed assets and potential sources of technological hazards. From the general interaction/compatibility matrix, only the hazards potentially triggered by a volcanic eruption are taken into account, included in turn as potential sources of further cascading hazards. The inventory analysis allows identifying the actual sources of technological hazards (e.g. no nuclear plants, dams or mines exist in the island). The expected magnitude of the volcanic eruption and the potentially trig- gered hazards also allows determining if their potential magnitude is likely to trigger more cascading hazards or not. Probabilistic methods and/or experts’ elicitation (see Section 5) allow attaching qualitative probabilities of transition between hazards in the chain (Table 8), de- termining the likelihood of occurrence for each cascading effects path. This allows decision makers to select one or more specific cascading effects paths from the main event tree (Fig. 11) to perform hazard/ impact scenario simulations. It is important to note that the probability of transition is an information available to decision maker, but it does not imply automatically the choice of the paths to be simulated (e.g. only paths with medium/high probability of occurrence). On the con- trary, a common decision making attitude is to acquire information especially on cascading effects crises with a low probability of occur- rence and a potential high impact on elements at risk. In this sense, the event tree represents a valid tool for exchange of information between decision makers, as end-users of the SNOWBALL platform, and the ex- perts in charge of the simulation services. In any case, through such an approach, even a deterministic decision of the path object of hazard/ impact simulation implies a probabilistic evaluation of the expected impacts, based on exposure and vulnerability analysis. The event tree represents a dynamic tool available to the decision-makers to identify interdependencies between cascading natural hazards and cascades due to the potential failure of interconnected critical infrastructures (e.g. service networks). Each branch represents a single possible scenario of cascading effects, but the complete event tree visualisation allows a dynamic reading of all paths considered as relevant by the decision- maker, which can be all analysed through the simulation service and compared in terms of output (i.e. the impact on considered elements at risk). From a modelling point of view, the relevance of time factor can affect the following elementary bricks of the cascading effect scenario (see Section 3): • Hazard: some hazard categories are time-dependent → Hazard characterisation and impact assessment are function of the duration in time (e.g. volcanic ash fall; oil spill; release of solid/liquid sub- stances; power outage; communication grid outage). In this case the Fig. 9. Diagram showing all potential dependencies between hazards, based on the hazard compatibility matrix. The graph can be obtained from the matrix using widely available commercial software such as yWORKS-yED. G. Zuccaro et al. International Journal of Disaster Risk Reduction 30 (2018) 199–215 210 variation of impact due to the time factor should be one of the input in the hazard models, allowing for different scenario realizations depending on different timeframes (e.g. after 30mins; 1 h.; 6 h.; 12 h; etc.). This aspect can also affect the transition between ha- zards, when the probability of occurrence of the following hazard in the chain depends on the duration of the previous one (e.g. Table 8 Hazard interaction/compatibility matrix related to Santorini area, showing probabilistic assessment from experts’ judgement. (RED=High probability> 50%, YELLOW=medium probability 10–60%, GREEN=low probability of occurrence< 20%). Methods to derive quantities from qualitative judgement have been derived by [17]. Fig. 10. Timeline for a volcanic eruption in Santorini. Fig. 11. Timeline for a volcanic eruption in Santorini showing selected cas- cading effects paths object of the simulation. Red arrows show paths with high probability of occurrence; blue arrows show paths with medium probability of oc- currence. Paths with low probability of occurrence have been deliberately excluded from the event tree for a better readability. G. Zuccaro et al. International Journal of Disaster Risk Reduction 30 (2018) 199–215 211 communication grid failure following a power outage that exceeds the backup time capacity of the communication grid components affected); • Exposure: some elements at risk categories are time-dependent in case of preparedness measures implementation (only short-term mitigation measures, e.g. people evacuation, are taken into account, since other mitigation actions, e.g. building retrofitting, are not compatible with the scenario timeline) → In the context of cas- cading effects, preparedness measures can take place in each of the time intervals of the event tree timeline (decision points); exposure variation on a given timestamp along the timeline should become an input of the impact model used for the following hazard in the chain. The exposure variation can in turn result as output of specific models (e.g. evacuation model) or as manual input (if allowed in the impact model). Fig. 12 represents the timeline for a hypothetical cascading effects scenario following the reactivation of Nea Kameni Volcano in Santorini (Greece), reference test case of SNOWBALL project. In the timeline, decision points have been identified through 'sce- nario building' workshops with key representatives from local autho- rities, civil protection responsibles and critical infrastructures managers in Santorini. A large number of timelines can be connected to the specific scenario event tree, obtained without altering the sequence of cascading effects, but only modifying aspects related to the 'time' and/ or 'human behaviour' factors. The 'decision points' represent relevant Fig. 12. Timeline for the pilot application in Santorini, defined through workshops and interviews with local authorities, decision makers and service providers. G. Zuccaro et al. International Journal of Disaster Risk Reduction 30 (2018) 199–215 212 timestamps in the cascading effects evolution, where such variables are likely to modify the final scenario. In the cascading effects scenario identified in Figure 15, the time factor represents an important variable in the following timeline in- tervals: • t-1,1 → t0 → t1: variation in population exposure due to self-pre- paredness measure (evacuation) – source: evacuation model/manual input • t0,3→ t1: variation in population exposure due to voluntary eva- cuation – source: evacuation model/manual input • t1,2→ t2: variation in population exposure due to mandatory eva- cuation – source: evacuation model/manual input • t3→ t4: hazard transition from power grid failure to communica- tion grid failure – source: power grid failure model • t3,1→ t5: variation in population exposure due to mandatory eva- cuation – source: evacuation model/manual input • t5 → t6,2: variation in ash fall impact – source: ash fall hazard/ impact model 6. Uncertainties Uncertainties evaluation in risk analyses are commonly evaluated by probabilistic convolution (in time and space) of the factors involved in the risk analysis (hazard, exposure, vulnerability), according to dif- ferent approaches. The probabilistic assessment of cascading effects in terms of events transition represents a complex problem that – in order to produce actionable information to decision makers in terms of preparedness – needs to be treated according to specific local conditions, following the refinement process from the generic modelling framework to the un- derstanding of the cascading effects hazard scenarios on a given terri- torial area. Computational problems in cascading effect analyses, so as for risk evaluations, are often characterized by three issues: (1) the empirical data are not always available for all variables; (2) subjective informa- tion from the analyst's judgment or expert opinion may be necessary; (3) uncertainty about the mathematical model used in the assessment may be substantial. These aspects complicate the evaluations and they can call into question any conclusions or inferences drawn from them. In case of cascading effects, it is crucial to assess the probability of occurrence of each event in the time history generated by a single triggering event (TE). The originator phenomenon TE can induce one or more independent event able to induce sequences of events connected by a 'cause/effect' relationship, which can be represented by event trees diagrams (Fig. 4). The combinations of possible chains included in each event tree (see blue paths in Fig. 4) caused by independent events constitute the nu- merous cascading events timelines which can be induced by the TE. In the methodology, two methods for the evaluation of the un- certainties connected to the cascading events timelines are adopted: Bayesian methods and Elicitation techniques. 6.1. Bayesian analysis Statistics consists of two main competing schools of thought: the frequentist or classical approach to statistical inference (which includes hypothesis testing and confidence intervals), and the Bayesian ap- proach. The underlying difference between the Bayesian and frequentist approaches to statistical inference is in the definition of probability. In practice, a frequentist uses probability to express the frequency of certain types of data to occur over repeated trials, a Bayesian uses probability to express belief in a statement about unknown quantities (Glickman and van Dyk [36]). A typical Bayesian analysis can be outlined in the following steps (Glickman and van Dyk [36]): 1. Formulate a probability model for the data (for example, Bernoulli distribution, Normal curve, etc.). 2. Decide on a prior distribution, which quantifies the uncertainty in the values of the unknown model parameters before the data are observed. The prior distribution is based on the theoretical beliefs on models. If we do not have any a priori or theoretical information, we have to assume complete ignorance of the probability distribu- tion at the considered node. This is accomplished by using a uniform distribution P(θ)= 1 (the probability is included in the range 0–1). 3. Observe the data, and construct the likelihood function based on the data and the probability model formulated in step 1. The likelihood is then combined with the prior distribution from step 2 to de- termine the posterior distribution, which quantifies the uncertainty in the values of the unknown model parameters after the data are observed. 4. Summarize important features of the posterior distribution, or cal- culate quantities of interest based on the posterior distribution. These quantities constitute statistical outputs, such as point esti- mates and intervals. The main goal of a typical Bayesian statistical analysis is to obtain the posterior distribution of model parameters. The posterior distribu- tion can best be understood as a weighted average between knowledge about the parameters before data is observed (which is represented by the prior distribution) and the information about the parameters con- tained in the observed data (which is represented by the likelihood function). From a Bayesian perspective, just about any inferential question can be answered through an appropriate analysis of the pos- terior distribution. Once the posterior distribution has been obtained, one can compute point and interval estimates of parameters, prediction inference for future data, and probabilistic evaluation of hypotheses. Marzocchi et al. [23,24] adopt the Bayesian analysis to the develop a method (implemented in the tool BET_EF), based on the event tree schema, to estimate the probability of all the relevant possible out- comes of a volcanic crisis and, in general, to quantify volcanic hazard and risk. The objective of this study is to estimate the posterior prob- ability density function (pdf) at the nodes, through the Bayes rule, which is used to update the a priori belief about the probability at each node of the event tree [23,5] by including available past data. The evaluation of the long-term volcanic hazard is based on these posterior distributions. As an example, the Bayesian long-term volcanic hazard for an eruption can be seen as the weighted average of the probability of an eruption with the posterior distributions of the probabilities of the risky events. The dispersion of the prior distributions at each node furnishes our ‘degree of knowledge’ for that stage of the volcanic process, and therefore it may guide future research with the aim of reducing epis- temic uncertainties [24]. 6.2. Elicitation method Expert judgment is sought when substantial scientific uncertainty impacts on a decision process. Because there is uncertainty, the experts themselves are not certain and hence will typically not agree. Informally soliciting expert advice is not new. Structured expert judg- ment refers to an attempt to subject this process to transparent meth- odological rules, with the goal of treating expert judgments as scientific data in a formal decision process. The process by which experts come to agree is the scientific method itself [10]. A valid goal of structured elicitation is to quantify uncertainty, not remove it from the decision process. The elicitation technique adopted within SNOWBALL is the 'clas- sical model' formulated by Cooke [9]. It is a structured procedure for G. Zuccaro et al. International Journal of Disaster Risk Reduction 30 (2018) 199–215 213 obtaining uncertainty judgments from experts, measuring their in- dividual judgment capabilities with a performance-based metric, and then applying mathematical scoring rules to combine these individual judgments into a ‘rational consensus’ that can inform the deliberations of policy-makers. The Classical Model method relies on the use of proper scoring rules for weighting and combining expert judgments through statistical ac- curacy and information scores, measured on calibration variables (see [9]), and operationalizes principles for rational consensus via a per- formance-based linear pooling or weighted averaging model. The weights are derived from experts' calibration and information scores, as measured on seed item calibration variables. Calibration variables serve a threefold purpose [4]: 1. to quantify experts’ performance as subjective probability assessors; 2. to enable performance-optimised combinations of expert distribu- tions; 3. to evaluate and hopefully validate the combination of expert judg- ments. The Cooke's Classical Model has been adopted for the hazard as- sessment for volcanic eruption of Monteserrat [2] and Vesuvius [27]. 7. Conclusions This paper describes a theoretical model for the cascading effects scenario analysis, whose general methodology and operational proce- dures are applicable to all the hazards and elements at risk categories identified. The inspiration of past EU project, such as MATRIX, NARAS, EXPLORIS and CRISMA, which consider only a limited number of ha- zards and elements at risk, was crucial to identify time-dependent variables and approaches to evaluate interdependence among hazards, critical infrastructure and service networks as potential sources of technological hazards, as well as the assessment of cumulative damage from a chain of cascading effects on the elements at risk exposed. Triggering hazards (either natural or technological) can generate different chains of events causing damage on different element exposed. The two fundamental pieces of information required to assess the ef- fects of possible cascading effects are identified the compatibility/ transition matrix and the elements at risk matrix. For each cascading effects scenario, the chains of events can be defined by a series of event- tree sequences, identifying the dependencies between the different hazards and depicting the complete 'time-history' of the sequence of events. Each branch of each of the event trees included in a cascading effects scenario 'time-history' representation is quantified by a prob- abilistic analysis depending on the sequence of events to be carried out following different complementary approaches (Bayesian methods, expert elicitation). The evaluation of damage can be then performed through the application of specific single hazard/impact simulation models interconnected in terms of input-output as outlined by the 'elementary bricks' approach methodology, both when the aim is to analyse all the possible cascading effects on a given area starting from a selected triggering hazard, both when only a single chain of cascading effects is taken into account for a scenario analysis. The theoretical model provides methods and procedures to integrate the 'time' and 'human behaviour' factor into single hazard/impact si- mulation models to be compliant with the methodology. It considers as a necessary step the customization of the general theoretical model to specific use cases, in order to produce reliable hazard/impact scenarios, useful to support decision-making through simulations and scenario assessment methods. The research aims at developing a theoretical model where simulation of cascading effects scenarios can be carried out with different level of detail, depending on the availability of in- ventory/exposure data for the different categories of elements at risk and hazard/impact models for the various hazard sources. The archi- tecture of the simulation model can be conceived as a flexible structure of different building blocks, compliant with the theoretical model, and developed within SNOWBALL in relation to the Santorini pilot case. Therefore, the theoretical model here proposed has to be considered exhaustive in its methodological definition, while its application always require further data collection, analysis and modelling, customized on specific use cases and end-users needs. Acknowledgements The authors acknowledge the European Project SNOWBALL 'Lower the impact of aggravating factors in crisis situations thanks to adaptive foresight and decision-support tools' (FP7/2007-2013, Grant Agreement no. 606742), which has promoted and inspired the research activity. More information on the project is available at www.snowball- project.eu. References [1] D.E. Alexander, Confronting Catastrophe: New Perspectives on Natural Disasters, Oxford University Press, 2000. [2] W.P. Aspinall, Structured Elicitation of Expert Judgment for Probabilistic Hazard and Risk Assessment in Volcanic Eruptions. Statistics in Volcanology. H.m. Mader, S.G. Coles, C.B. Connor and L.J. Connor, The Geological Society for IAVCEI, London, IACEV N.1., 2006, pp. 15–30. [3] W. Aspinall, R.M. Cooke, Expert judgment and the Montserrat Volcano eruption. in: Proceedings of the 4th International Conference Probabilistic Safety Assessment and Management (eds Mosleh, A. & Bari, R. A.) 3, 2113–2118. Springer, 1998. [4] W.P. Aspinall, R.M. Cooke, Quantifying scientific uncertainty from expert judge- ment elicitation, in: Jonathan Rougier, Steve Sparks, Lisa Hill (Eds.), Risk and Uncertainty Assessment for Natural Hazards, 2013 Published by Cambridge University Press. © Cambridge University Press, 2013. [5] W.P. Aspinall, G. Woo, Santorini unrest 2011 – 2012: an immediate Bayesian belief network analysis of eruption scenario probabilities for urgent decision support under uncertainty, J. Appl. Volcanol. 3 (12) (2014) (2014). [6] C. Aubrecht, M. Almeida, M. Polese, V. Reva, K. Steinnocher, G. Zuccaro, Temporal aspects in the development of a cascading-event crisis scenario: a pilot demon- stration of the CRISMA project. in: Geophysical Research Abstracts. vol. 15, Vienna (Austria), 7-12 April 2013, 2013. [7] C. Barrett, K. Channakeshava, F. Huang, J. Kim, A. Marathe, M.V. Marathe, Vullikanti, S. Anil Kumar, Human initiated cascading failures in societal infra- structures, PLoS One 7 (10) (2012) e45406, pone.0045406. [8] G.M. Calvi, R. Pinho, G. Magenes, J.J. Bommer, L.F. Restrepo-Vélez, H. Crowley, Development of seismic vulnerability assessment methodologies over the past 30 years, ISET J. Earthq. Technol. 43 (3) (2006) 75–104 (September 2006), Pap. No. 472. [9] R.M. Cooke, Experts in Uncertainty: opinion and Subjective Probability in Science, Oxford Univ. Press, 1991. [10] R.M. Cooke, L.L.H.J. Goossens, TU delft expert judgment data base, Reliab. Eng. Syst. Saf. 93 (5) (2008) 657–674. [11] R.M. Cooke, S. El Saadany, X. Huang, On the performance of social network and likelihood-based expert weighting schemes, Reliab. Eng. Syst. Safe 93 (2008) 745–756. [12] T. De Pippo, C. Donadio, M. Pennetta, C. Petrosino, F. Terlizzi, A. Valente, Coastal hazard assessment and mapping in northern Campania, Italy, Geomorphology 97 (3) (2008) 451–466. [13] P. Gasparini, A. Garcia-Aristizabal, Seismic risk assessment, cascading effects, in: M. Beer, E. Patelli, I. Kougioumtzoglou, I. Au (Eds.), Encyclopedia of Earthquake Engineering, Springer Reference, Springer-Verlag, Berlin Heidelberg, 2014, pp. 1–20, , [14] A. Garcia-Aristizabal, M. Almeida, C. Aubrecht, M. Polese, L. Mário, D. Viegas, G. Zuccaro, Assessment and Management of Cascading Effects Triggering Forest Fires. in: Forest Fire Research. Coimbra (Portugal), 17-20 November 2014, 2014. [15] A. Garcia-Aristizabal, M. Polese, G. Zuccaro, M. Almeida, C. Aubrecht, Improving emergency preparedness with simulation of cascading events scenarios. in: Proceedings of the ISCRAM 2015 Conference. Kristiansand (Norway), 24–27 May 2015, 2015. [16] J.C. Gill, B.D. Malamud, Reviewing and visualizing the interactions of natural ha- zards, Rev. Geophys. 52 (4) (2014) 680–722. [17] G. Grunthal, European Macroseismic scale. centre Européen de Géodynamique et de Séismologie, Luxembourg 15 (1998) (1998). [18] F. Kadri, B. Birregah, E. Châtelet, The impact of natural disasters on critical infra- structures: a domino effect-based study, Homel. Secur. Emerg. Manag. 11 (2) (2014) 217–241 (2014). [19] M.S. Kappes, M. Keiler, K. von Elverfeldt, T. Glade, Challenges of analyzing multi- hazard risk: a review, Nat. Hazards 64 (2) (2012) 1925–1958. [20] N. Komendantova, R. Mrzyglocki, A. Mignan, B. Khazai, F. Wenzel, A. Patt, K. Fleming, Multi-hazard and multi-risk decision-support tools as a part of parti- cipatory risk governance: feedback from civil protection stakeholders, Int. J. Disaster Risk Reduct. 8 (2014) (2014) 50–67. G. Zuccaro et al. International Journal of Disaster Risk Reduction 30 (2018) 199–215 214 [21] H.M. Mader, S.G. Coles, C.B. Connor, L.J. Connor (Eds.), Statistics in Volcanology. Special Publications of IAVCEI, 1 Geological Society, London, 2006, pp. 31–37 (1750-8207/06/$15.00 # IAVCEI 2006). [22] W. Marzocchi, G. Woo, Principles of volcanic risk metrics: theory and the case study of mount Vesuvius and Campi Flegrei, Italy, J. Geophys. Res. 114 (2009) B03213, (2009). [23] W. Marzocchi, L. Sandri, P. Gasparini, C. Newhall, E. Boschi, Quantifying prob- abilities of volcanic events: the example of volcanic hazard at Mt. Vesuvius, J. Geophys. Res. 109 (2004) B11201, [24] W. Marzocchi, L. Sandri, C. Furlan, A quantitative model for volcanic hazard as- sessment, in: H.M. Mader, S.G. Coles, C.B. Connor, L.J. Connor (Eds.), Statistics in Volcanology. Special Publications of IAVCEI, 1, Geological Society, London, 2006, pp. 31–38. [25] W. Marzocchi, M.L. Mastellone, A. Di Ruocco, P. Novelli, E. Romeo, P. Gasparini, Principles of Multi-risk Assessment. Interaction Amongst Natural and Man-induced Risks, European Commission Directorate-General for Research Communication Unit, Brussels, 2009. [26] W. Marzocchi, A. Garcia-Aristizabal, P. Gasparini, M.L. Mastellone, A. Di Ruocco, Basic principles of multi-risk assessment: a case study in Italy, Nat. Hazards 62 (2) (2012) 551–573. [27] Neri, A. Aspinall, W.P. Cioni, R. Bertagnini, A. Baxter, P.J. Zuccaro, G. Andronico, D. Barsotti, S. Cole, P.D. Esposti Ongaro, T. Hincks, T.K. Macedonio, G. Papale, P. Rosi, M. Santacroce, R. Woo G, Developing an event tree for probabilistic hazard and risk assessment at Vesuvius, J. Volcanol. Geotherm. Res. (2008), org/10.1016/ j.jvolgeores.2008.05.014 (2008). [28] G. Pescaroli, D. Alexander, A definition of cascading disasters and cascading effects: Going beyond the 'toppling dominos' metaphor, Global Risk Forum, GRF Davos Planet@Risk, Volume 3, Number 1, Special Issue on the 5th IDRC Davos 2014, March 2015, 2015. [29] D. Provitolo, E. Dubos-Paillard, J.P. Müller. Emergent human behaviour during a disaster: thematic versus complex systems approaches. Retrieved from 〈 univ-lehavre.fr/~bertelle/epnacs2011/epnacs2011-proceedings/inp- provitolo4epnacs2011.pdf〉. [30] J. Reason, Understanding adverse events: human factors, Qual. Health Care 4 (1995) 80–89 〈 qualhc00016-0008.pdf〉. [31] S. Schmidt, E. Galea (Eds.), Behaviour - Security - Culture (BeSeCu): Human be- haviour in emergencies and disasters: a cross-cultural investigation, Pabst Science Publishers, Lengerich, Berlin, Bremen, Viernheim, Wien [u.a.], 2013. [32] T. Tarvainen, J. Jarva, S. Greiving, Spatial pattern of hazards and hazard interac- tions in Europe, in: P. Schmidt-Thome (Ed.), Natural and Technological Hazards and Risks Affecting the Spatial Development of European Regions, 42 Geol. Surv. of Finland, Espoo, Finland, 2006, pp. 83–91. [33] G. Zuccaro, M.F. Leone, Seismic and energy retrofitting of residential buildings: a simulation-based approach, Upl. - J. Urban Plan. Landsc. Environ. Des. 1 (1) (2016) 11–25. [34] G. Zuccaro, D. De Gregorio, Time and space dependency in impact damage eva- luation of a sub-Plinian eruption at mount Vesuvius, Nat. Hazards 68 (2013) 1399–1423, [35] G. Zuccaro, F. Cacace, R.J.S. Spence, P.J. Baxter, Impact of explosive eruption scenarios at Vesuvius, J. Volcanol. Geotherm. Res. 178 (3) (2008) 416–453. [36] M.E. Glickman, D.A. van Dyk, Basic Bayesian Methods. Methods in Molecular Biology, in: W.T. Ambrosius (Ed.), Topics in Biostatistics, 404 Humana Press Inc., Totowa, NJ, 2007. G. Zuccaro et al. International Journal of Disaster Risk Reduction 30 (2018) 199–215 215