Design of DSS for Supporting Preparedness to and Management of Anomalous Situations in Complex Scenarios

Decision Support Systems (DSS) are complex technological tools, which enable an accurate and complete scenario awareness, by integrating data from both “ external ” (physical) situation and current behaviour and state of functioning of the technological systems. The aim is to produce a scenario analysis and to guess identify educated the most ef ﬁ cient strategies to cope with possible crises. In the domain of Critical Infrastructures (CI) Protection, DSS can be used to support strategy elaboration from CI operators, to improve emergency managers capabilities, to improve quality and ef ﬁ ciency of preparedness actions. For these reasons, the EU project CIPRNet, among others, has realised a new DSS designed to help operators to deal with the complex task of managing multi-sectorial CI crises, due to natural events, where many different CI might be involved, either directly or via cascading effects produced by (inter-)dependency mechanisms. This DSS, called CIPCast, is able to produce a real-time operational risk forecast of CI in a given area; other than usable in a real-time mode, CIPCast could also be used as scenario builder, by using event simulators enabling the simulation of synthetic events whose impacts on CI could be emulated. A major improvement of CIPCast is its capability of measuring societal consequences related to the unavailability of primary services such as those delivered by CI.


Introduction
The set of Critical Infrastructures (CI) constitutes nowadays an enabling pillar of societal life. They guarantee the supply of vital services (transport of energy products, telecommunication, drinkable water delivery, provide mobility functions) should end up with the identification and definition of preparedness and emergency strategies that, taking into account the different phases of the expected crisis (event, damage, impact and consequence) could be adopted to reduce the impact, speed-up mitigation and healing procedures, ease the recovery phase, thus reducing as much as possible the extent, the severity and the duration of the crisis.
Such new concept of DSS can also be used as effective simulation tools to perform comprehensive stress tests on areas where the impact deriving from CI crises could be large and relevant. This activity would produce educated contingency plans based on the analysis of many (synthetic) crisis scenarios instead of being built upon (a few, when available) records of historical events. This will enhance their quality and adapt them to the effective current scenario conditions (in terms of infrastructures, assets, available technical tools, current settings of the crisis or emergency management etc.).
The EU project CIPRNet 2 has thus devoted a considerable effort to realize an novel DSS enabling to tackle the entire workflow of risk forecast of CI, from event prediction to consequences analysis.
The DSS can be supported by a large database of information collected from public and private sources. Furthermore, the DSS collects many different real-time data from the field (meteorological stations, sensor networks, meteorological radars, etc.) and forecasts from several publicly available sources (Meteorological Office, Earthquake alerts systems, etc.) producing a comprehensive assessment of the physical state of the area (urban, district, regional up to a national scale).
The availability of the geographical position (in terms of geospatial data) of the CI elements and the networks would allow, through the correlation between the physical vulnerability to natural events and the strength of expected event manifestation, to formulate an educated guess of the probability that some of the CI elements could be physically damaged by a perturbation. This analysis would thus allow to produce a "damage scenario" containing location and probability of predicted faults.
Starting from the "damage scenario", the DSS will attempt, through the analysis of appropriate simulation tools, to emulate the outages on the affected networks and, through the CI dependency information, to reproduce the effects of the cascading events propagating faults from one network to the others. This task would result in the "impact scenario", i.e. the expected profile of services unavailability over time for all the considered infrastructures.
Such data would further allow to estimating the consequences that services unavailability might produce on the different societal sectors. This is the goal of the "consequence analysis" which is meant to transform the "impact scenario" into a prediction of the social severity of the crisis, by measuring, through appropriate metrics, the consequences associated to the population, the industrial activities, the primary services (Hospitals functionality, schools, public offices, public transportation) and the environment (in the case when a CI crisis is associated to some type of an environmental damage).
The last step of the DSS would be the elaboration of an optimal strategies for the systems recovery by analysing possible "recovery sequences" of the different elements: the sequence "score" is evaluated in order to reduce as much as possible the social costs of the crisis.
The project CIPRNet has introduced all these elements into the DSS which has been designed and realized as one of the major outcomes of its joint technological activities. The DSS was called CIPCast. We will refer to this name in the course of this work when considering the CIPRNet DSS.

Design Study
In order to cast all the expected DSS properties and functions, we tried to translate the expected functionalities into a number of prescriptions, of practical issues and of technological requests to the DSS for enabling the implementation of those functions. These are the major key-words which have been translated into related functionalities of the DSS.
(1) Prediction. The system should provide a reliable forecast of the predictable events (e.g., heavy rainfalls, floods, etc.) with a significant anticipation, in a way to enable operators and other emergency players to set in place preparedness actions. A better choice is the setup of an incremental prediction that should start "pre-alert" periods with a large anticipation and a subsequent progressive refinement of the quality and the quantity of the prediction as the event time approaches. (2) Multi-hazards. Natural and anthropic threats may damage CI. Although natural hazards (in their "intensified" strength due to climatic changes) are at forefront in public opinion, there is evidence of an increasing level of threat due to deliberate attacks, either to the physical and/or to the cyber integrity of the infrastructures. The DSS should thus be able either to analyse risks by predicting the occurrence (wherever possible) of natural threats and to provide support in the analysis of impacts due to deliberate attacks. (3) Dependency effects. It is clear, nowadays, that CI form an entangled set of networks, each providing services to the others. This leads the system's control a multi-dimensional problem with multiple feedback loops propagating perturbations from one set to the others. DSS predictions should thus necessarily consider perturbation spreading due to (inter-)dependency mechanisms. This issue reflects into the need of having available the (physical or functional) "connections" data enabling to link one CI to the others. (4) Space and time scales. Perturbations spread on large geographical scales.
Electrical systems, for instance, can propagate a perturbation on large geographical areas in very short times. Although for some CI perturbations, and perturbations spread, occur with a very short latency, for other infrastructures perturbation takes place on a longer time scale and, often, with a longer latency. The DSS should thus cope with multiple time scales and the geographical long-ranged perturbation spreading. (5) Consequences. CI perturbations produce damage in different sectors of societal life: from perturbing the well-being of citizens, depriving them of relevant services to causing economic losses to industrial sectors, from reducing operability of lifelines (e.g., Hospitals) to damaging the environment. The DSS should also estimate which are the consequences on societal life associated to its occurrence, to provide operators and emergency managers a realistic "score" of its impact. (6) Data. The realization of a system enabling a qualitative and quantitative assessment of a risk scenario does involve the availability of (often) confidential information. Geographical position of networks and CI elements, their functional data during operation times are considered confidential information by operators who restrain as much as possible their divulgation. The DSS should thus comply with these limitations and realise a trade-off for improving quality and reliability of predictions with the constraint of having access only to a restrained set of data from operators. (7) Support. The presence of a multitude of data and forecast, of real time data on the scenario can be used to infer possible strategies that could be followed to reduce the impact and the consequences of the expected damages. The DSS will also provide with specific "optimization" applications enabling the solution of management problems that are normally tackled during crisis scenarios (i.e., the definition of the optimal restoration sequence when multiple elements should be repaired).
The design of CIPCast has taken into account all the issues that have been previously listed. Figure 1 shows the main functional blocks B i of CIPCast and the relevant components i.e. the Database and the Graphic User Interface (GUI). In the Fig. 1 Block diagram showing the main functionalities and the relevant components of CIPCast following we will briefly describe the five functional blocks which will be better analysed in the further Sections.
Monitoring of Natural Phenomena (B1). In this block, the DSS acquires external data (real-time data, forecast) from many different sources: weather forecast and nowcasting data, seismic data, real time data coming from weather stations, hydrometer levels from water basins. These data are acquired to establish the current and predicted external conditions.
Prediction of Natural Events (B2). This block estimates the expected manifestation strength of all the predicted events. Predictions are made on different time scales: short time scale (up to 60 min from the current time), medium-long range time scale (within 48 h from the current time).
Prediction of Damage Scenarios (B3). In this block, the DSS correlates the strength of the expected manifestations with the vulnerability of the different CI elements present in the area where the events are predicted to occur, in order to estimate the probability that the manifestation could effectively damage (and, in the positive case, to what extent) the CI elements. At the end of B2 block, the DSS elaborates a "Damage Scenario" containing the information on which CI element (and to what extent) will be damaged in a specific time frame.
Prediction of Impact and Consequences (B4). This block converts the expected damages of CI elements into impact on the services the CI elements produce. This is the core of the prediction process as, in this block, the DSS transforms the expected punctual damages (to one or more CI) into a reduction (or loss) of services. To do that, CIPCast needs to deploy dependency data connecting the different CI in order to reproduce faults propagation. In addition, starting from the inoperability (or partial operability) of the different services, this block also estimates the consequences that the loss of services produces on citizens, public services, industrial activities and the environment. The consequences on each societal sector are estimated on the basis of specific metrics; a distinct "consequence score" on each societal life domain is presented separately (a unified score is not produced) in order to describe the severity of the expected crisis under many viewpoints. Support of efficient strategies (B5). This block contains a number of applications which, taking into account the expected critical scenario, made by damages, impacts on services and weighted by the consequences estimate, will attempt to support operators and emergency managers to design and validate mitigation and healing procedures. At the current state of implementation, these supporting actions relates to: -The identification of the optimal strategy for the restoration of the electrical distribution system after a fault, taking into account a multiple choices of optimization target functions; -The identification of the best path which technical crews should follow (taking into account traffic conditions) to reduce restoration times; -The optimal allocation of technical crews when the number of restoration points exceeds that of the available crews.
In the following, we will describe, in some more detail, each of the relevant elements of the DSS and the technical contents of the different blocks Bn i .

Database
The geospatial Database (DB) and the related modules (GIS Server and WebGIS application) has been implemented by adopting a client-server architecture, using Free/Open Source Software (FOSS) packages. Such architecture has been properly designed to allow the interchange of geospatial data and to provide to the CIPCast users a user-friendly application, characterised by accessibility and versatility. The DB is a PostgreSQL object-relational database with PostGIS spatial database extender. PostGIS adds support for geographic objects allowing location queries to be run in SQL. The DB can be used at various levels by exploiting the potential offered by GIS tools, starting with the effective support for the operational management in the frame of the risk assessment workflow.
The GIS Server represents the hardware/software environment that allows organizing information and making them accessible from the network. The GeoServer suite has been adopted, being a largely used open source application server, which plays a key role within the Spatial Data Infrastructure (SDI). It allows sharing and managing (by means of different access privileges) the information layers stored in the DB, according to the standards defined by the Open Geospatial Consortium (OGC), such as, for example, the Web Map Service (WMS). It also supports interoperability (e.g., reads and manages several formats of geospatial data) (Fig. 2).
The basic geospatial data and the results produced (i.e., scenarios) are stored and managed into the DB repository in order to be exploited in the different DSS blocks. To this end, the WebGIS application developed represents the natural geographical interface of CIPCast. Basic information, maps and scenarios can be visualized and queried via web, by means of standard Internet browsers and, consequently, the main results can be easily accessible to CIPCast users.

Dynamic Data
In order to predict the external scenario, CIPCast has been configured to acquire external information by collecting real time data from field sensors. In particular, it acquires field data from: (1) Seismic sensors and seismic report data; (2) Weather stations (reporting data on rain abundance, temperature, humidity, winds, pressure etc.) and other devices that could be used to assess the specific weather conditions in a given area; (3) Hydrometers to constantly update the level in the critical section of river basins.
Concerning seismic and earthquakes data, given as initial assumption that no real prediction can be achieved for these types of events, CIPCast receives data from the Agency committed to release this information (e.g., the National Institute of Geophysics and Volcanology INGV 3 in Italy). In the INGV official site, by accessing the Italian Seismological Instrumental and Parametric Database (ISIDE) portal, 4 information on the detected earthquakes are produced and released in real time. Upon a constant poll to the ISIDE portal, CIPCast receives the earthquakes data (within 1 min from the occurrence). Earthquake information consists of the GPS coordinates of the epicentre, its depth and the measured intensity (Richter scale). Figure 3 reports a typical snapshot of the ISIDe website.
Once earthquake data are issued, the CIPCast crawler picks them up and reports them into the synoptic chart of the DSS geographical interface (Fig. 4). The knowledge of the coordinates, the depth and the magnitude of the earthquake (basic earthquake's features) are not sufficient to estimate the "physical manifestations" associated to the natural event. Indeed, an earthquake creates distinct types of waves with different velocities; when reaching seismic sensors, their different travel times allow to locate the source of the hypocentre: • Primary waves (P-waves) are compressional waves that are longitudinal in nature and propagate faster than other waves through the earth to arrive at seismograph stations first (hence the name "Primary"); • Secondary waves (S-waves) are shear waves that are transverse in nature: following an earthquake event, S-waves reach seismograph stations after the faster-moving P-waves and displace the ground perpendicular to the direction of propagation.
In the case of local, or nearby, earthquakes, the difference in the arrival times of the P and S waves can be used to determine the distance of the event. Once ISIDe operators perform their validation procedures, data of the occurred earthquakes are immediately available: based on the basic earthquake's features, CIPCast is able to convert them into a Shake Map dataset which contains, for each spatial point of a given area (as large as that involved by the physical manifestations associated to the event), the Peak Ground Acceleration (PGA) distribution induced by the seismic event. Figure 5 shows an example of a shake map.
Other than being estimated, shake maps are usually measured by seismometers deployed all over the Italian national territory (data are first collected and then post processed by INGV) and then released by the INGV through the specific information websites. This process normally takes about 20-60 min. In order to have an earthquake shake map available in a shorter time (in order to use them for rapidly estimating expected damages), CIPCast, starting from the basic earthquake features, estimates the "predicted shake map" on the bases of empirical propagation models of shock waves in the ground and of the specific ground seismic properties (lithography and waves conductivity properties). Then, when measured shake maps are released, CIPCast perform a second damage estimate. Concerning weather predictions, CIPCast can deploy either medium-long term weather prediction (from 12 to 72 h) from Weather Forecasts official sources and nowcasting predictions (up to 60 min from the current times) provided by X-band radars. Regarding the nowcasting source, CIPCast receives (each 10 min) the current estimate of rain abundance and its prediction (estimated with a Local Area Model) for a time span of 60 min. The nowcasting data could be constituted either by the mosaic of several stations operating in specific points (at a national scale), mosaic which is then composed to obtain an unique picture or by a single station sweep that covers, in turn, a limited area (usually a single nowcasting station can cover an area of 20-30 Â 10 3 km 2 ).
In the current setting, nowcasting is produced by using data of a single station (a meteorological X-band radar station) at Mount Media (in the Apennine region, nearby the city of L'Aquila) whose data covering a large fraction of Centre Italy fully comprising the Lazio Region. Data are constantly acquired and treated to extract information. From the reflectivity signals, it is possible to estimate the rain amount. These data are then post-processed in order to obtain the rain abundance prediction in a grid of 1 km of spatial resolution, for the subsequent 60 min from the current time. The resulting data ( Fig. 6) are then integrated into the CIPCast DB and used to estimate the resulting damage of the CI elements.
Same data used for nowcasting prediction scan be used to provide lightning prediction. To this aim, CIPCast (every 15 min.) acquires lightning probability data related to the next 45 min and visualises them on the GIS interface. The data source computes the lightning probability using various indices of the Weather Research and Forecasting model. 5 In the current setting, the monitored area for lightning probability covers a large fraction of centre Italy fully comprising the Lazio Region. Figure 7 shows an example of a lightning probability map. Following the guidelines for lightning probability greater the 60% the CI operators should monitor their infrastructures and in particular those components that are vulnerable to lightning events.
To sum up, there are two events prediction based on: • Nowcasting and Lightning for the short-term where the accessed and achieved data are sufficient to estimate damage scenarios and no further data elaboration is made in CIPCast; • ECMWF data (Fig. 8) for the medium-long term weather prediction downscaled through a LAM to create a specific map reporting the spatial distribution (approximately, 5 km Â 5 km) of the precipitation rate of rainfall forecasts (mm/h). Forecasts are produced and available for a time span from 0 to 48 h (6-h intermediate steps), starting from 0:00 a.m.-UTC of each day. Such data are continuously and automatically retrieved from a specific web-service, in NetCDF 6 format, and directly stored into the CIPCast DB, in order to exploit them within the DSS application ( Fig. 9).
At the end, CIPCast produces a comprehensive description of the current (and forecast) scenario, by providing a map of all the physical manifestations related to the predicted (and/or the on-going) natural events with their magnitude (each expressed in a specific strength metrics).
These information are then transferred to the further building block, where event' manifestations strength are "transformed" into expected damages to the CI elements.

Damage Scenario Builder
Once a reliable awareness of field data is achieved, also supported by the results of the different forecast systems, CIPCast attempts to build a Damage Scenario consisting of the list of all the identified CI elements expecting to be damaged by the expected natural phenomena with the predicted strength.
The first action is to cast the external prediction into a Threat Strength Matrix, containing the strength of the predicted physical manifestations associated to the expected natural events. Each natural hazard, in fact, manifests in a different way (winds with physical pressure exerted on the structural elements, heat waves with temperature raise etc.). If we normalize the value (expressed in the appropriate unit of measure) of the strength of each perturbation manifestation in an arbitrary scale from 1 to 5, we could define, for each geographical position, a Threat Strength Matrix describing the intensity of the associated manifestations. Table 1 shows the Threat Strength Matrix S associated to a given geographical position (x, y). Each row contains the expected strength of the manifestation associated to the natural event.
Whereas geographical points will be characterized by the strength of the expected natural manifestation (cast into the Threat Strength Matrix), each CI element (located in some geographical position) will be characterized by a Vulnerability Matrix V, which identifies, for each perturbation manifestation, the limiting strength that the element could sustain before being damaged. The V Matrix will then have same entries of the Threat Strength Matrix; it provides, in turn, the limiting grade of the perturbation strength that the CI element can sustain before failure. If, thus, the V ij element of the matrix will be different to zero, all other elements V iðj þ kÞ will be not vanishing: if V ij strength perturbs (or damages) the CI elements, all larger strengths, a fortiori, will do. Table 2 shows the Vulnerability Matrix V associated to a specific CI element. Each row contains the perturbation extent that a manifestation of a specific grade is expected to produce on the element. In general terms, the extent of physical damage D produced by a threat manifestations S on the CI element having a vulnerability matrix V will be given by where operation indicated with Á is the ordinary product between the values s ij ; v ij 2 R of the two matrices. If D ¼ 0 the CI element will not be harmed by the perturbation(s), while if D 6 ¼ 0 it will be damaged up to a certain extent (0\D 1).

Fig. 9
Cloud cover and precipitation rate map views (Eumetsat/ECMWF) Figure 10 reports the WebGIS interface of CIPCast, containing various geospatial layers and the information on the expected Damage Scenario. CI elements are classified on the bases of the prediction time of their outage (red elements predicted to be failed in 15 min, darker-coloured elements at progressively longer times). Table 1 Threat strength matrix   Threat name  Threat grade  1  2  3  4  5 Associated physical manifestation  Earthquake In the example the CI element whose V matrix is displayed would be partially damaged by a grade 3 earthquake and totally destroyed by larger magnitude events, it would be destroyed by winds of magnitude ! 2, by lightning ! 4, by floodings ! 4

Impact Scenario
The Impact Scenario takes the Damage Scenario as an input from the B3 block. This contains, for a given time frame, the set of the CI elements that are predicted to fail.
CIPCast, at this stage, run an application called RecSIM (Reconfiguration actions SIMulation in power grids [1,2]) a simulator that, starting from the identification of the behaviour of the electrical-telecommunication system upon the outage of one (or more) of their components, spreads the perturbation also to other CI infrastructures. This approximation (that is similar to an adiabatic approximation while treating perturbations in quantum theory) is somehow legitimated by the fact that the response of the electro-telecom systems occurs with characteristic times much smaller than those of the other systems. In this respect, CIPCast first deals with fast degrees of freedom (electrical and telecommunication networks response) and then propagates the perturbation to other degrees of freedom (i.e. the other CI networks).

RecSIM
RecSIM is a discrete-time event-based Java simulator designed to emulate the network management procedures by an electrical distribution system operator and to estimate the evolution of the electric network. Although the implemented operations are related to a specific electrical operator, 7 these procedures should be thought as general; they are, in fact, adopted by other operators for the reasons that they take into account only the basic functioning mechanisms of a switched and controllable electrical network. RecSIM assumes an electrical distribution model where each electrical node (a primary or a secondary substation) may feed a telecommunication device, called Base Transceiver Station (BTS) that, in turn, ensures remote control capability to the electrical grid. Figure 11 sketches the main ingredients (i.e. the elements) needed to design an electro-telco grid used for the RecSIM modelling and simulation. In general, this configuration represents the optimal configuration for the electric operator and he/she usually will aim to manage the network in this configuration. Anyway, due to failures/maintenance this is not always possible. By closing the switches, it is possible to energize the SS belonging to one feeder through other PS belonging to other feeders thus changing the normal configuration.
In a real electrical distribution network, as soon as a failure occurs, some actions are performed by specific automatic control systems. For instance, the protection systems open some switches in order to avoid the propagation of the failure as well as the damage of electrical components (e.g., electrical feeders). Within a delay of the order of milliseconds, there is usually an automatic reaction of the network to a failure (of a component or along the lines). This automatic reaction is instantaneous, so if the failure happens at time t 0 all actions performed by the protection systems will be performed at t 0 . Soon after the perception of the fault, the electric operator will be notified alarms through the SCADA system and will try to isolate the failures as well as to reconfigure the electrical network to provide electrical power to those substations that might be involved in the blackout. The automatic reaction produces the blackout of an entire feeder containing electrical substations (from a few up to some tens, in the worst case). At this stage, the electric operator can usually perform one (or more) of the following actions: (1) To "remotely" perform failure isolation and reconfiguration actions of the network by sending commands to the remotely controlled substations; (2) To dispatch Emergency crews (usually deployed in the field) to "manually" perform failure isolation and reconfiguration actions of the network; (3) To "deliver" Power Generators (usually located in deposits) to feed isolated substations for the time being (from some hours to some days) required to repair the failure.
In order to make use of the remote control capability, the operator should first verify the reachability of the remotely controlled devices (e.g., Remote Terminal Units or Programmable Logic Controllers) deployed in the substations and required to perform the opening and closure of breakers. At this stage, dependency mechanisms can play a crucial role. Indeed, the faulted electrical feeders can inhibit the power supply to some BTS. Considering the strong interdependency among electrical SS and telecommunication BTS, damages occurring in one (or both) network can cause disruptions that hold in the short time scale (from a few minutes up to some hours) leaving people without power and/or mobile communication services.
As mentioned, if remote control is available, the electric operator will send commands to close switches to re-energize part of the network. These actions usually take some minutes to be completed (e.g., 3-5 min). In case the SCADA system is not working or the devices cannot be remotely controlled, the electric operator must dispatch an emergency crew to manually perform reconfiguration action. In this case, emergency crew actions may require about 1 h to be completed (depending on the state of urban traffic). However, there are cases where no actions are available to re-energize part of the network. In such cases, the only possible option is to send one (or more) Power Generator to supply the Low Voltage (LV) line(s) usually supplied by electrical substations. The action of displacing a Power Generator and re-supplying a single Medium Voltage (MV) line may require some hours to be completed.
RecSIM takes into account all these procedures and the number of emergency crews and power generators available to the electric operator to estimate the evolution of the networks.
In order to use RecSIM to reproduce a generic electric network the following information about the electric network topology are required: -The connecting feeders for each PS; -The ordered sequence of SS connected to the different feeders; -The position of the terminal switches that can enable any network reconfiguration; -The set of SS that can be connected (closing the switches) to each terminal SS to implement a contingency to reenergize some SS after some failures occur. RecSIM can, on the basis of the available resources, optimize the sequence of restoration operations to be followed in order to produce the least consequences to citizens and/or to minimize the overall outage time. RecSIM allows the operator to autonomously design a strategy given by an ordered sequence of operations to restore the networks. In the latter, no optimization procedures are involved.
Operators are committed to release their services with a predefined Quality Level expressed, for instance, by using the Service Continuity Indicator measured in terms of "kilo-minutes of outages (kmin)": where kmin is the sum of the products between the number of minutes of outages times T k for each k-th SS and u k is the number of electric customers fed by the k-th SS considered for the interval time of interest.
Other than the number of kmin expected before the crisis end, additional optimization functions could be used in the optimization strategy. CIPCast, in its Consequences Analysis module (see next section), can produce a more "societal-oriented" optimization function which takes into account the reduction of well-being of different societal sectors (Citizens, Economic Activities, Public Services etc.). RecSIM allows to choose among different optimisation functions before launching the optimisation strategy. Figure 12 shows the Impact Scenario for a limited area of the electrical grid of Rome where it is possible to observe the SS affected by an electric outage. Figure 13, in turn, indicates the best possible route to be followed by a technical crew to reach the site where a restoration operation should be executed. The path could also be determined as a function of the current or predicted state of urban traffic, by considering, in the shortest path algorithm, the different times needed to tread the different arcs of the city street graph. CIPCast is also connected to an application which, based on historical traffic data and the current real time data, can predict the state of traffic in the next 90 min. Traffic prediction can improve the quality of the identification of the shortest path (Fig. 13) to be suggested to the

Consequence Analysis
After having defined the damages produced by a natural event or by a man-made incident and recognised the impacts that those damages might produce on the functioning of CI, the CIPCast system attempts to estimate, as the final step, the consequences produced on society by the events striking a given area.
As the Service Continuity indicator (kmin) is one of the major KPI of an electrical Utility, CIPCast performs the estimate of such an indicator. The service standard requested to the operator by Public Authorities (expressed in terms of minutes of LT outages per year) takes in some way a social meaning as this value represents a socially acceptable duration of loss of a relevant service as electrical power and users are retained as equally important. Moreover, CIPCast attempts to estimate the possible consequences of a crisis scenario taking into account other metrics weighting losses that any outage might create to the different societal sectors.
It is worth noting that although we mostly refer to natural events, the same Consequence Analysis model could be usefully applied to any event (also of anthropic origin) on CI which produces an impact on their services.
In order to define the scope of the Consequence Analysis (CA hereafter) it is useful to point out that, in general, a natural event produces two types of consequences: • direct consequences encompassing all the effects due to the direct damages produced by the event (disruptions, contingencies etc.); • indirect consequences considering the loss of the well-being produced by the unavailability of Primary Services (PS) supplied by CI, which are electricity (provided by the electrical system, i.e. transmission and distribution grids) telecommunication (voice and data communication types) water (drinkable water) gas (and other energetic products) mobility (unavailability of public transports induced by other PS outages).
Taking an earthquake as a case study, for example, we will ascribe to the direct consequences the number of casualties (due to buildings collapse following the earthquake) and the economic cost needed to restore/retrofit (or rebuild) the damaged buildings. In turn, we attribute to indirect consequences the social and economic costs inflicted to the society by the unavailability (or partial availability) of the primary services (electricity, telecommunications, drinkable water, mobility etc.). Thus damages on CI elements produce impacts on their services which inflict consequences (of the class of indirect consequences) to societal life. Although CIPCast is able to consider both types of consequences, a major effort has been carried out to set up a model able to estimate the indirect consequences.
The first step of the Consequence Analysis has been the identification of the sectors of the societal life to be considered, in order to fully describe the indirect consequences inflicted by a crisis of CI services to those sectors and, for a given sector, to each sector's element as well as to identify-for each sector element-the "consequence metric" C i which better measures the extent of the consequences.
A thorough analysis has allowed to focus on the most vulnerable sectors prone to be damaged (in terms of well-being reduction, Wealth hereafter) by the unavailability (or a partial availability) of PS supplied by CI: -Sector 1 is about Citizens and the consequence metric C 1 provides a measure on the number of Citizens involved and the extent of the reduction of the well-being caused by the PS outage; -Sector 2 is about the economic activities and the consequence metric C 2 takes into account the amount of the GDP lost due to PS unavailability; -Sector 3 is about Public activities and services such as schools, hospitals, public offices. The consequence metric C 3 gives indication about the number of affected activities and/or their reduction of capabilities (PS outages or reduction could lead to a reduction in the number of healed patients per hour in a hospital, while partial blackouts could reduce the number of potential users of public transportations etc.) -Sector 4 is about the Environment and the consequence metric C 4 is expected to give clues about (long term and short term) environmental damages (dimension of polluted areas, expected costs for reclaiming etc.).
The CA model refers to the identification (and a quantitative estimate) of an expected Wealth for each Sector element and the way to estimate its reduction upon loss (or reduction) of the benefits associated to the PS availability.
We can define the Wealth W(t, t ij ) of a societal Sector element t ij as a function of the available Services Q k at time t as follows: Wealth of a societal Sector element where: • N k is the total number of the considered Services which contribute to Wealth (electricity, telecommunication, gas, water and mobility); • M ij is the Wealth metric (for example, number of people who can access and need to rely on the Services, or the expected/projected turnout in the economy sector j during the time period T). • r k (t ij ) is the relevance of the k-th Service for the achievement of the maximum level of the Wealth quantity M for a given element of Criteria.
• Q k is the availability level of Service k (if Q k = 0 the Service is fully unavailable). Q k depends explicitly on time and describes the pattern followed by the outage of the k-th Service during the time course of the Crisis. The function Q k (t) is the outcome of the Impact Analysis.
The elements r k (t ij ) are the measure of the relevance of the Service k for the Wealth achievement in a given Sector element. For this reason, they will be identified as Service Access Wealth (SAW) indices. They may be different from each other: a Sector element can be more vulnerable to the absence of a given PS and, thus, its Wealth most affected if that specific PS would fail. We then consider a closure relation, such as It is worth noticing that a more accurate analysis would imply the use of a residual term (r k (t ij ) with k = N k + 1). This further term would account for the fact that for many societal Sectors, the eventual loss of all services would not imply a total loss of well-being. In other words, the loss of all Services, as a whole, will reduce of a different amount the Wealth of the different societal Sectors. Thus we would rewrite the closure relation in Eq. 2 by adding a further term which we would call "well-being residue".
In a first approximation, r k (t ij ) are considered as time-independent, although their variation in time could be properly assumed (such as, e.g., the loss of a PS for an economic activity could be less detrimental during the night hours when production is stopped). The unitary closure constraint could be kept fixed even in the case of time variation of the SAW indices. For a discussion on the time-dependence of SAW indices see Appendix 1.
If Q k (t) are all unitary, Wealth W is as expected. If, in turn, some Q k (t) will be not unitary (or even vanishing) for some time during a period T, say, Wealth is expected to be reduced accordingly. Thus we can identify as Consequence C for a given Sector element in the time T of crisis duration the difference between the expected and the achieved Wealth It's worth pointing out that The residue term represents the part of the Wealth which could not be attributed to the deployment of the Primary Services; if it is non-vanishing, it inhibits the possibility that the Consequence C becomes as large as the total Wealth (see Eq. 5).
The CA model requires the identification of two sets of data: the Wealth metric M(t ij ) and the SAW indices r k (t ij ) for all the Sector elements t ij . The Primary Services (PS) availability functions Q k (t) are, in turn, the output of the Impact module of the system. Before considering the SAW indices estimate procedure, it is worth identifying the Sector elements that the model will consider for a complete assessment of societal consequences after a CI crisis (Table 3).

SAW Indices Estimate
The evaluation of the SAW indices for the different Sector elements may require the use of different approaches (and data sources). Information about Citizens are provided by the National Institutes of Statistics (in Italy, ISTAT 8 ) and could be refined by data provided by service Utilities. Information on economic sectors could be, in turn, obtained at the Chambers of Commerce or from trade category Associations or elicited by specific historical or ad hoc surveys.
To elicit the SAW indices for each Sector element, multiple data sources may be used, either alternatively or jointly.
It is clear that, being societal Sectors different from each other, the meaning of the term "relevance" (identifying the impact that the unavailability of a specific PS would have on each Sector) will be very different: we will span from discomfort to economic losses or to the threat of physical integrity. The chosen metrics M(t ij ) expressing the Wealth for a given Sector element will account for these issues. When M(t ij ) is an economic value (the production value for a given plant, for instance), the term "relevance" (and the associated SAW indices) will express the importance of a specific PS to allow the plant to achieve the planned production value. There could be, obviously, activities whose production is more related to the availability of electrical power (i.e. manufacturing), while in other cases it is more related to availability of telecommunications (i.e. digital commerce). This difference will reflect into the values of the corresponding SAW indices.
The following tables (Tables 4 and 5) report the relationships between the term "relevance" and the different Sector's elements through the indication of the related Wealth metrics M(t ij ).
In the following, we will describe the way to approach the SAW indices identification from available data for two different Sectors: Citizens and Economic Activities. In the first case, a complete assessment of the indices will be provided, where the attempt to estimate time-dependency of relations will also be done. Table 6 summarises the indices to be calculated for the Sector "Citizens" and its elements.  First of all, it is worth reporting one of our main findings which is that inferring the relevance of services for different Sector elements from the analysis of the family budget devoted (by each Sector element) to the access to a specific PS is not accurate enough because it is very difficult to take into account important factors such as family income, different technologies and different service pricing (we are interested in the usage and its relevance, not in the expenditure), although such analysis can give a rough initial clue about the relevance ratio among elements of the same Sector.

SAW Indices Estimate for the Citizens Sector
In fact, we found that a more accurate analysis takes into account service usage (time and criticality) and-as far as it concerns the Electricity usage from different customers-interesting hints can be found in the measurement campaigns [3][4][5].
More in details, in [5] the authors defined as relevant-for the Italian case-the following power-enabled "services" ordered by priority: lighting, refrigerator and freezer, oven, TV, microwave, washing machine, dish washer, drier, iron. They also included in their analysis cooking facilities as they included kitchen with induction as an electrical load: its priority is lower than the fridge and higher than the oven.
The rationale behind the sequence above is the following. Lighting is the first service in order of importance because of the personal safety which would be affected by its absence and the fact that no activity is possible in the absence of illumination. The refrigerator and the freezer were placed nearly at the same priority level as their continued operation is essential for the proper storage of food which, should remain at room temperature for too long without being consumed, lose their health and should be thrown away. Next primary service is the kitchen, less important just than a refrigerator and freezer also because its massive use is limited at mealtimes, when usually no other parallel activities are in place. As it has been said before, in Italy kitchen is usually gas powered but priority considerations are still valid.
Next appliances alias services in our priority list are electric oven and TV. This is because, based on the frequency of use and perceived importance of the service provided, they can be seen as equally important.
The microwave was placed behind the TV as it does not really offers an essential service: in Italy, it is actually a substitute for traditional stoves, typically used to heat the food in a short time and rarely to cook.
Other appliances like washing machine, dishwasher and dryer were considered less important than, for example, the microwave because of the duration of use. According to the authors of [5] in fact, considering that the microwave is usually Citizens 65+ t 11 r 1 (t 11 ) r 2 (t 11 ) r 3 (t 11 ) r 4 (t 11 ) r 5 (t 11 ) Citizens 0-5 t 12 r 1 (t 12 ) r 2 (t 12 ) r 3 (t 12 ) r 4 (t 12 ) r 5 (t 12 ) Citizens with disabilities t 13 r 1 (t 13 ) r 2 (t 13 ) r 3 (t 13 ) r 4 (t 13 ) r 5 (t 13 ) Citizens 18-64 t 14 r 1 (t 14 ) r 2 (t 14 ) r 3 (t 14 ) r 4 (t 14 ) r 5 (t 14 ) used for short periods, it makes more sense-with respect to the perception of comfort-to interrupt a wash cycle rather than having to wait maybe an hour or more to warm a cup of tea.
Behind them it has been placed the iron, since according to the logical order of use is the latest after the dryer but still less urgent than a cycle of the dishwasher.
Other appliances are not included because they offer services that are not necessities but are related mostly to individual needs. These include hair dryer, vacuum cleaner but also PC and videogames.
Taking into account the above suggestions and making hypothesis about usage for the different Sectors when they are at home, we calculated for the different groups different profiles (see Appendix) that are coherent with independent studies and measurement campaign, for example [3,4].
Backed up by the good matching with experimental results, we applied the same methodology to water and gas and, as we didn't find similar independent studies assessing the priority of different gas-an water-enabled services, we built our profiles based on the knowledge of the typical Italian household. More in details, we considered the stove, the water heating and the heater as gas-enabled services and drinking water, domestic water and waste water as water-enabled services.
Resulting profiles are shown in Appendix. About the SAW indices related to Telco services, we considered mobile, landline and Internet. As far as their usage in time is concerned, different customer profiles have been taken into account (for example, employed people will not stay at home between 8 a.m. and 5 p.m.; for them, a home telco outage would not have a significant impact). On the other hand, as far as the priority is concerned, ISTAT has gathered a "microdata" set reporting the answers to a specific survey with 760 questions of 20,000 households. Questions are on different subjects and 50 of them are related to the usage of the telco services and their relevance for different groups. Summing up the number of different services each group uses very often we found the required indices.
At the end, the SAW indices for the different Citizens Sector elements are reported in Table 7. To make the consequence calculation easier they are time-independent although the carried out analysis is definitely time-depended. The conversion has been done by summing up all the usages in all the timestamps and normalizing to the highest value. Please note that the analysis assumes a "normal" situation to assess the priorities but we are aware that priorities during an emergency could change. As an example, charging batteries for mobile phones-according to what happened in the 2002 Flooding in Germany-could be a separately profiled function and could be high in rank. Anyway, assessing the priorities during an emergency strongly depends on the type of crisis and on the specific scenario.

SAW Indices Estimate for the Economic Activities Sector
As far as it concerns the Economy Activities Sector, Table 8 summarizes the SAW indices to be calculated for the Economic Activities Sector elements (Primary, Secondary and Tertiary activity areas) for the PS.
As previously stated, in the Economic Activities Sector elements the relevance of each PS has been related to the effects that their unavailability would have in terms of economic losses, i.e. relevant is all that is needed to perform the related production (of goods or services).
Thus the Wealth metrics is the turnover produced (in a given amount of time) and the Consequences are measured in terms of turnover lost. For this reason, an accurate and reliable estimate of the value of M(t ij )-i.e. the expected turnover produced per time unit-is a relevant quantity to be determined beforehand.
For achieving these data, still keeping a statistical approach, we have used the input-output matrices [6]. These data are usually released by the National Institute of Statistics and acknowledged in the national accounts of many countries.
The input-output tables are n Â n matrices representing the mutual relations between the various economical activities, showing which and how goods and services produced (output) by each activity are used by others as inputs in their production processes. In Appendix 2, we elaborate on the specific case of the definition of SAW indices for the economic sectors.

Other Operation Modes and Future Work
Other than releasing "real time" prediction (i.e. in a 24/7 operational mode) by collecting external data from forecasts and field sensors, CIPCast can also be used in "off-line" mode. In this mode of operations, real external scenario could be Primary t 31 r 1 (t 31 ) r 2 (t 31 ) r 3 (t 31 ) r 4 (t 31 ) r 5 (t 31 ) Secondary t 32 r 1 (t 32 ) r 2 (t 32 ) r 3 (t 32 ) r 4 (t 32 ) r 5 (t 32 ) Tertiary t 33 r 1 (t 33 ) r 2 (t 33 ) r 3 (t 33 ) r 4 (t 33 ) r 5 (t 33 ) substituted by synthetic events whose main manifestations are somehow introduced in the B1 block as if they were real. In this respect CIPCast can simulate synthetic events (it can currently simulate synthetic earthquakes and abundant rainfalls in specific area). This operation mode is called "Event Simulator". This mode is meant to be used by operators and other Public Authorities for producing stress tests of their systems and/or to study contingency plans adapted to expected (or risky) events. This could enhance the ability of designing preparedness measures and contingency plans, other than revealing (upon quantitative analysis) infrastructural elements which could be able to trigger large faults if damaged. Figure 14 shows the disruption expected in the area of the city of Florence upon the production of synthetic earthquake in a nearby Apennines area. A further CIPCast operation mode allows to insert punctual damages by hand, by the operator. Some CI element failure (belonging to one or more infrastructures) could be inserted and the Impact Scenario (with its Consequence Analysis) estimated accordingly. This operation mode (Damage Simulator) could be used to estimate the impact on services produced by types of damages which could hardly be thought as produced by specific natural events but could be rather related to intentional attacks (i.e. a patchy distribution of damages). Also in this case, CIPCast can be used to produce stress-tests, for highlighting elements whose fault could trigger an high impact on service(s). This can be particularly relevant for operators and authorities for planning appropriate actions for security enhancement of their assets. CIPCast and its DB could act as a central system enabling to gather and to broadcast a number of relevant information, also through the use of innovative multi-media solutions. In the following we report the directions of a number of on-going project to support the usability of CIPCast contents and forecasts.
(a) CIPCast is going to integrate data on vehicle traffic status and predictions in a time span of 90 min. This information will be cast into the optimization system (RecSim) for the outage simulation in a way to drive the displacements of technical crew particularly in urban areas where traffic congestion avoidance could allow to save time and reduce the overall outage duration. (b) Data on the paths followed by the CI networks in complex urban areas will be let available through Augmented Reality applications. These will allow a field operator (technical crews, fire fighters etc.) to have on the screen of his mobile device (smartphone, tablet) the real view of a given area (taken by the device camera) on which is superimposed the real trace of the specific network. To this trace could be associated other information (technical, contact person etc.) which might highly help the emergency or technical crews to have, on site, the largest possible information data needed to solve the problem.

Conclusions
CI protection and the management of Emergency situation is a major concern of Public Authorities at all scales; from the national one, as severe blackout could produce extended and often uncontrolled perturbations, to the local (city) scales where lack of resilience (i.e. lack of preparedness actions) might result in frequent, albeit limited in space and time perturbations. These, however, could produce damages on citizen's well-being, with associated economical costs, and moreover undermine citizens confidence in the public administration. CIPCast belongs to a new class of DSS which attempts to act at three different levels: (a) the "operational" level, by producing an operational (24/7) state of risk of CI allowing operators and Public Authorities to undertake preparedness actions; (b) At the emergency level, CIPCast can be used as a coordination tools for sharing information at different; (c) At the level of elaboration of contingency plan, by stress testing the CI networks.
Being usable in different operational modes (either fed with 24/7 real time data or by synthetic events of with synthetic damages), CIPCast could be a mean for stress-testing, planning, design of new generation networks and design of coherent contingency plans which could be the result of ad hoc simulations where realistic conditions could be reproduced. Acknowledgement and Disclaimer This chapter was derived from the FP7 project CIPRNet, which has received funding from the European Union's Seventh Framework Programme for research, technological development and demonstration under grant agreement no. 312450.
The contents of this chapter do not necessarily reflect the official opinion of the European Union. Responsibility for the information and views expressed herein lies entirely with the author(s).

Appendix 1
The availability of a large amount of data has allowed, only for the Citizens Sectors, to define, for each service and for each Sector elements, the time variation of SAW indices along the course of the day. As the priority could not be constant, the objective is therefore to condense in a graph the possible variations of the priority and, thus, the subsequent variation of the SAW indices.
In order to provide a priority index to each "service" enabled by electricity, for each Sector element and with a granularity of 30 min we set the priority value to • 1: if the service is most likely needed. Example: lighting in the early morning or in the evening. • 0.5: if the service may not be needed but-should it be needed-would be critical. Example: lighting late at night, when most people is sleeping. • 0: if not needed or not a big issue if missing. Example: lighting at home whenever people is at work, or also lighting at noon. • 0.1: for loads and services which can generally be postponed. Example: dishwasher or washing machine.
In order to perform this exercise, we have profiled the users as follows: • Citizens 18-64: working or studying, they get up at 6 a.m., go sleeping at 11.30 p.m., leave home at 8.30 a.m. at the latest and return home at 4.30 p.m. at the earliest. Breakfast is usually between 6.00 a.m. and 7.30 a.m., dinner between 8.00 p.m. and 9.00 p.m. • Citizens 65+: retired from work, getting up at 6 a.m. and going to bed at 11.00 p.m., they could be at home at any time. Breakfast is usually between 6.00 a.m. and 7.30 a.m., lunch between 12.30 p.m. and 1.30 p.m., dinner between 7.30 p.m. and 8.30 p.m. • Citizens 0-5: getting up at 6.30 a.m. and going to bed at 9.30 p.m. on average, they usually are not at home between 8.30 a.m. and 4.30 p.m. if they are older than 3, while-if younger than 3-the younger the more likely that they are at home.
Using these profiles, we have determined the following global relevance index for electricity needs for the three Citizens Sector elements (age 18-64, age >65 and age <5) (Fig. 15).
Using a similar approach, we can identify the relevance of the other PS. The following graphs show the (not normalised) temporal profile of the relevance  emphasising the absolute value (Fig. 16) and the contribute (Fig. 17) of each CI to the well-being of the citizens. The following graphs (Fig. 18) show the relevance of each CI for different population segments. a branch-by-branch table indicating the amount of production of each branch used for the production in the others; a product table for the product, indicating the products needed for the production of each product.
Let us consider a basic example [6]. Table 9 (read by row) indicates that -Agriculture produces 30 quintals of wheat, 7.5 of them being consumed by itself (seeds), 6 from industry and 16.5 by the families (wheat, meat, fruit, etc.). -Industry produces 50 m of cloth, of which: 14 m are consumed by agriculture, 6 by the industry itself and 30 by families; -Households provide in total of 300 man-years (300 men engaged in the work the whole year), and the above table tell us also that 80 of them are employed in agriculture (farmers), 180 in industry (workers) and 40 are employed in house works.
On the other hand (reading the same table by columns): -Agriculture employs 7.5 quintals of wheat, 14 m of cloth to 80 man-years to produce 30 quintals of wheat; -Industry employs 6 tons of wheat, 6 m of fabric and 180 man-years to produce 50 meters of cloth; families spend their earned income to buy 16.5 tons of grain, 30 m of fabric and 40 years-working man to sustain life of 300 man-year.
The price system ensures the effective possibility of exchanging goods between different sectors; in the case of Table 10, prices are 20 euro for a quintal of wheat,   Agriculture  150  120  330  600  Industry  210  90  450  750  Household  240  540  120  900  Total  600  750  900  2250 15 euro for a meter of cloth, 3 euro for a year-working man. This results in the following table of values.
The first line shows that the agricultural sector uses 150 euro of its product (direct use or farmer exchange), it sells part of the industry for 120 euro and the rest to families for 330 euro, with a total revenue of 600 euro.
In the same way-with the assumption that all money spent by industry contributes to the production and, thus, to the turnout-we grouped all industries (with different NACE codes) in Primary, Secondary and Tertiary sectors and then we calculated, for each sector, the fraction of the whole budget they spent for the different CI related services. We found where relevance for Gas is not available as in the input-output matrices Electricity and Gas are considered in the same PS (Table 11). Open Access This chapter is licensed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license and indicate if changes were made. The images or other third party material in this chapter are included in the chapter's Creative Commons license, unless indicated otherwise in a credit line to the material. If material is not included in the chapter's Creative Commons license and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder.