Identification and quantification of link vulnerability in multi-level public transport networks: a passenger perspective

Robust public transport networks are important, since disruptions decrease the public transport accessibility of areas. Despite this importance, the full passenger impacts of public transport network vulnerability have not yet been considered in science and practice. We have developed a methodology to identify the most vulnerable links in the total, multi-level public transport network and to quantify the societal costs of link vulnerability for these identified links. Contrary to traditional single-level network approaches, we consider the integrated, total multi-level PT network in the identification and quantification of link vulnerability, including PT services on other network levels which remain available once a disturbance occurs. We also incorporate both exposure to large, non-recurrent disturbances and the impacts of these disturbances explicitly when identifying and quantifying link vulnerability. This results in complete and realistic insights into the negative accessibility impacts of disturbances. Our methodology is applied to a case study in the Netherlands, using a dataset containing 2.5 years of disturbance information. Our results show that especially crowded links of the light rail/metro network are vulnerable, due to the combination of relatively high disruption exposure and relatively high passenger flows. The proposed methodology allows quantification of robustness benefits of measures, in addition to the costs of these measures. Showing the value of robustness, our work can support and rationalize the decision-making process of public transport operators and authorities regarding the implementation of robustness measures.


Introduction
The operation of public transport services without disturbances is considered a key quality aspect of public transport (PT) by passengers (Golob et al. 1972;Van Oort 2016). Disturbances can result in longer travel times, more transfers and more crowded vehicles, and thus increase both the nominal and perceived passenger travel costs. This means that during PT disturbances fewer locations and activities can be reached by public transport within a certain travel time, resulting in a decreased accessibility. This relation between network vulnerability and accessibility is among others addressed by Chen et al. (2007), Liao and Van Wee (2017) and Taylor (2017). Therefore, reducing the passenger impact of disturbances is important in order to limit the negative accessibility effects. To gain more insight in these negative accessibility effects of disturbances, it is important to get insight in the frequency with which disturbances occur in public transport, and the impact these disturbances have on passengers. This topic is generally addressed using the concepts of reliability and vulnerability. In scientific literature, different definitions are used to distinguish between these concepts (for example Ziha 2000;Holmgren 2007;Van Nes et al. 2007;Tahmassby 2009;Korteweg and Rienstra 2010;Savelberg and Bakker 2010;Snelder 2010;Immers et al. 2011;Parbo et al. 2013;Dewilde et al. 2014). An extensive review of definitions and indicators for reliability and vulnerability can be found in Nicholson et al. (2003) and more recently in Oliveira et al. (2016). We apply the distinction between reliability and vulnerability as used by Oliveira et al. (2016). Reliability is hereby related to the network performance in relation to recurrent, daily, stochastic fluctuations in supply and demand. Vulnerability, on the other hand, focuses on the network performance related to non-recurrent, infrequent, large events, leading to a partial or full unavailability of one or multiple links of the network. Robustness is inversely related to vulnerability: a network with 0% vulnerability yields 100% robustness, and the other way around (Tahmassby 2009;Snelder 2010).
Despite the importance attributed by passengers to robust public transport, the full passenger impact of public transport network vulnerability is not considered in science and practice yet. Reliability is extensively considered for single-level PT networks: networks on one functional level (e.g. the regional, agglomeration or urban level) usually operated by a single PT operator. Research on improvements of reliability of single-level PT networks is among others conducted by Hollander (2006) and Van Oort and Van Nes (2009) (see Fig. 1 upper left quadrant). Examples of measures to improve reliability of single-level Fig. 1 Relevance of study focusing on robustness of multi-level public transport networks, including examples of references in other quadrants PT networks on a strategic, tactical and operational level can be found in Vromans et al. (2006), Delgado et al. (2009), Furth and Muller (2009), Corman et al. (2010), ,  and Xuan et al. (2011). Besides considering reliability of single-level PT networks, research is also conducted to reliability of multilevel PT networks where interactions between different network levels are considered (for example Rietveld et al. 2001;Lee et al. 2014) (see Fig. 1 upper right quadrant). For example, such multi-level approach of reliability allows the incorporation of the consequences of a delay on the train network for transfers to a lower-level tram connection. Besides, studies can be found related to vulnerability and robustness of road networks (e.g. Jenelius et al. 2006) and public transport networks (e.g. Derrible and Kennedy 2010;Jenelius 2014, 2015). There are several examples of studies to robustness of single-level PT networks, for example Goverde (2005), Kroon et al. (2008), Tahmasseby et al. (2008), Cicerone et al. (2009), Fischetti et al. (2009, Schöbel and Kratz (2009) and Corman et al. (2014) (see Fig. 1 lower left quadrant). These studies analyse robustness separately for each PT network on a certain functional network level (single-level perspective), or for a PT network operated by a specific operator (single-operator perspective). However, the interaction between different PT network levels in case of non-recurrent disturbances is not explicitly considered in these vulnerability studies.
This entails that it is not considered how a certain network level, or PT network operated by operator X 1 , can function as backup in case a disturbance occurs on another network level operated by operator X 2 . However, when aiming to quantify the full passenger impacts of non-recurrent disturbances, it is important to consider the integrated multi-level PT network, with PT services on other network levels which remain available for passengers. This means that the PT networks on all functional network levels, operated by different operators, should be considered in an integrated approach. In their total door-to-door trip, passengers often use PT services on different network levels, often operated by different PT operators as well. For example, in the period 2006-2009 on average 89.8% of the trips having train as main mode in the Netherlands can be considered multimodal . In case each PT operator only optimizes the part of the network it operates, it is likely that different optimized subnetworks lead to a suboptimal total network from a passenger perspective, since interactions between network levels are ignored. In case of large disturbances, this leads to suboptimal rescheduling for passenger because network levels of other operators, which might offer potential to function as backup, are not considered. Possible powerful measures on network level X 1 , which can reduce the passenger impact of a large disturbance occurring on network level X 2 , might not be considered either. This means there is no full and no realistic quantification of passenger impacts of non-recurrent disturbances, since passengers are able to consider the total available multi-level PT network in case of disturbances. We therefore conclude that currently not the full passenger impacts are incorporated in the analysis and quantification of PT network vulnerability.
Our study explicitly considers public transport network vulnerability from a multi-level perspective ( Fig. 1 lower right quadrant). We define a multi-level PT network as an integrated PT network where different network levels-(inter)regional (train) level, agglomeration (metro/light rail) level and urban (tram) level-are considered simultaneously. Contrary to studies with a multi-modal perspective, by adopting a multi-level public transport perspective we solely consider the public transport network and no other networks such as car and bicycle. We develop a methodology to identify the most vulnerable links in such multi-level public transport network. Based on this method we are able to quantify link vulnerability for these identified links given the total multi-level PT network available. This allows for the quantification of societal costs of link vulnerability for passengers in 1 3 a more realistic way, since passengers also consider the multi-level network when looking for route alternatives in case of a disturbance. We adopt a passenger perspective, by aiming to incorporate the full and realistic passenger impact of disturbances when identifying and quantifying link vulnerability. This methodology is applied to a case study in the Randstad Zuidvleugel area in the Netherlands. In this case study we compare link vulnerability between different network levels. We use the integrated multi-level PT network to quantify link vulnerability and to quantify the robustness benefits of proposed measures.
The added value of this study is the development of a methodology to identify the most vulnerable links in multi-level public transport networks, thereby incorporating both exposure to disturbances and the impact of disturbances, and to quantify link vulnerability for these identified links. The structure of this paper is as follows. Section 2 discusses the methodology developed to identify and quantify link vulnerability in multi-level PT networks. In Sect. 3 we show the results after applying this methodology to a case study. We finish the paper in Sect. 4 by formulating conclusions and recommendations for further research.

Link vulnerability
We assume a multi-level PT network represented by a digraph G(V n , E n ) with nodes v n ∈ V n and directed links e n ∈ E n on PT network level n. Let S represent the total set of public transport stops s ∈ S ⊆ V. The number of stops and number of links are denoted by |S| and |E| respectively. The set of public transport lines is denoted by L. Each public transport line l ∈ L is defined as ordered sequence of stops S l = (s l,1 , s l,2 , … , s l,|l| ). The total node set V consists of all stops S and all junctions (intersections, switches etc.) in the network.
Traditionally, link vulnerability c e n for public transport networks is only assessed based on the impact a non-recurrent disturbance δ has on the network performance. This impact is often expressed as the difference in societal welfare ΔW δ between the undisturbed scenario W 0 and the scenario with non-recurrent disturbance W δ occurring on link e n ∈ E n . This means that exposure to disturbances is not considered explicitly when determining link vulnerability. This can be explained by the limited historic data available regarding the frequency with which different disturbance types n occur on each PT network level n and their related duration n . Instead, a conditional vulnerability is applied which calculates the impact of a disturbances given the fact that a certain disturbance has occurred, as expressed by formula (1).
When applying formula (1), links where disturbances have the most negative impact ΔW δ on passengers' travel time, costs and comfort are listed most vulnerable, even if the frequency with which these disturbances occur would be very low. However, from a passenger perspective link vulnerability depends on both the extent to which link e n is exposed to non-recurrent disturbances δ, and the impact of these disturbances on passengers given the total PT network N available. This is especially relevant when considering multi-level PT networks, where different modes and vehicle types are operating on the different network levels. The frequency and duration of disturbances can differ intrinsically on links of different network levels. These differences can be attributed to different vehicle types (e.g. train versus tram), different infrastructure (e.g. different types of switches, use of signalling (1) c e n = ΔW n , | n systems), different interactions with other traffic (dedicated infrastructure vs. mixed traffic) and different exposure to external events (e.g. operation in tunnels or at grade level). This means that neglecting differences in exposure to disturbances in link vulnerability analysis can bias the identification of the most vulnerable links in the multi-level PT network based on impact only, when exposure differs between network levels. Therefore we propose the incorporation of exposure to disturbances explicitly in link vulnerability identification and quantification: links where the product of exposure to disturbances and the impact of these disturbances is highest are identified as most vulnerable, as expressed by formula (2).
The exposure of a link e n to large disturbances is the product of the frequency f e, n with which different disturbance types occur on that link and the duration e, n of each disturbance. Both the frequency with which disturbance types occur and the duration of each disturbance are probabilistic variables, which are independent from each other for each disturbance type . This results in the multiplication of the expected number of disturbances E f e, n occurring within a certain time window and the expected duration of each disturbance E e, n , with both f e, n and e, n being random variables. ΔW e, n , represents the difference in total monetized societal costs for all passengers travelling over all OD-pairs affected by that specific disturbance δ n between the specific disruption scenario and the undisturbed situation.
To be able to incorporate exposure to disturbances explicitly, we used a unique dataset in this study which contains realization data about the frequency and duration of different types of disturbances δ n on different PT network levels n (national/interregional/regional/ agglomeration/urban level) and for different PT modes (train/metro/light rail/tram), operated by different PT operators in the Netherlands. Historic log-data for train network disturbances is gathered from the train operator Dutch Railways (NS) for the full period of 2.5 years between January 2011 and August 2013. For the urban and agglomeration network level (metro, light rail and tram), realization data is used from a period of 18 weeks between June and October 2013 from different PT operators. This enables the incorporation of exposure to disturbances on each PT network level explicitly when considering vulnerability. For both the frequency and duration of each disturbance type δ n , it is statistically tested whether the empirical data fits a theoretical probability density function. By distribution fitting, parameter values f n and n are estimated for the probability density functions for each disturbance δ n . Since particularly the frequency f n with which some disturbances occur can be influenced by the weather, we tested whether significant seasonal differences exist in average frequency of each disturbance δ n . In that case separate parameters were estimated for different seasons. In Cats et al. (2016) an extensive description of this data analysis can be found, including the distribution of different disturbance types on different network levels.
All disturbances δ n are categorized in two classes based on the impact a disturbance has on infrastructure availability. Some disturbances usually lead to a partial unavailability of a link (like a train breakdown leading to link blockage in one direction), whereas other disturbances lead to a link being completely unavailable (like a train-car collision on a level crossing). In the Netherlands, PT operators apply different rescheduling measures depending whether there is a partial or full link blockage. This also means that the passenger impact ΔW e, n , are different in these two scenarios, depending whether PT services on a certain link are partial or completely cancelled. Therefore, it is necessary to distinguish (2) c e n = ∑ n E f e, n * E e, n * ΔW e, n , different disruption scenarios S for disturbances leading to partial versus full link unavailability, for which the link vulnerability c S e n can be calculated.

Identification of link vulnerability
When aiming to improve PT network robustness, it is important to identify which links are most vulnerable in the multi-level PT network. In scientific literature two different approaches are applied to identify the most vulnerable network links (Knoop et al. 2012). The first approach uses full computation methods. In these methods, disturbances are simulated on each link e ∈ E of the network separately to evaluate its vulnerability relative to other links. These methods have a clear advantage in terms of their completeness, since vulnerability of the complete link set E can be assessed and compared. The largest disadvantage is that these approaches can be very time consuming. In the second approach criteria are specified to pre-select a smaller number of vulnerable links in a network. Disturbances are only simulated on these selected links in a second step. This approach overcomes the disadvantage of very long computation times of full-computation methods. However, since pre-selection criteria are used to identify a short-list of vulnerable links, there is no guarantee that the most vulnerable links are remaining after the pre-selection phase.
Since real-world, complex multi-level PT networks as we consider in this study are usually represented by a large number of links, computation times become unacceptable long when all relevant disruption scenarios would be simulated on each link separately. Therefore, it is necessary to apply a method to pre-select most vulnerable links. In scientific literature various criteria can be found to pre-select the most vulnerable links of road networks. However, there is limited literature where pre-selection criteria for public transport networks are specified. Only some examples can be found, e.g. Cats and Jenelius (2014) using a dynamic vulnerability analysis, and Bell (2003) and Zhang et al. (2010) using game theory. All these methods do not address exposure to disturbances explicitly, which makes them not suitable to apply for multi-level PT networks. Thus, we developed a new methodology to identify most vulnerable links in multi-level PT networks, which explicitly incorporates exposure to disturbances as well. Input for our new developed methodology is derived from existing methodologies developed to identify vulnerable links for road networks (Jenelius et al. 2006;Li 2008;Tampère et al. 2008;Immers et al. 2011;Knoop et al. 2012) and is adjusted based on multi-level PT network characteristics.
When analysing the suitability of road network pre-selection criteria for identification of vulnerable links in multi-level PT networks, we can identify four intrinsic differences. First, criteria which consider the probability on disturbances on road networks calculate this probability for each link e ∈ E. For PT networks we propose to calculate exposure to disturbances per link segment Y. PT operators usually apply standard rescheduling procedures in case of disturbances: for each location in the network a disruption scenario specifies how PT services are adjusted in case of partial or complete track unavailability. Because rescheduling possibilities for PT services depend on the availability of switches, turning loops, station capacity etc., these procedures are exactly equal for adjacent links with no switches or other rescheduling possibilities in between them. Such procedures are therefore designed per link segment-a set of adjacent links Y = {e 1 , …, e m } taken together by the PT operator for which one standard disruption scenario applies-instead of per link.
Second, pre-selection criteria for road networks are usually a proxy for disturbance impact, whereas the probability on a disturbance is not or only implicitly or roughly considered. Criteria which only consider the incident impact, implicitly assume an equal probability on disturbances on each link. When incident probabilities are considered for road networks, often one generic predictor (e.g. link length) is used to distinguish incident probabilities for different links. However, Yap (2014) and Yap et al. (2015) show that for identified disturbances δ n on a multi-level PT network, different predictors (such as link segment length, vehicle-kilometres per link segment) should be used to distinguish between incident probabilities for different link segments. Also, it is clear that probabilities on a certain disturbance type δ are different on different PT network levels, given the different characteristics of these network levels. This shows it is not sufficient to assume an equal probability on disturbances for all links in a multi-level PT network, or to use one generic predictor. Pre-selection criteria for multi-level PT networks should therefore be a proxy for both the probability on disturbances (using different predictors for different disturbance types δ and different parameter values f n for different network levels) and the impact of a disturbance on passengers explicitly.
Third, in road networks some ratio between traffic volume and capacity (like the Incident Impact Factor or V/C ratio) is often used as proxy for the impact of a disturbance. Since the real incident impact on travel time, costs and comfort ΔW e, n , can usually only be quantified after simulation of disturbances, a proxy for this impact has to be used in the identification phase. In PT networks the relation between volume and capacity is less relevant when approximating the impact of a disturbance, since on PT networks limited congestion occurs between PT vehicles-even in case of disturbances-compared to congestion between vehicles on road networks. The impact of a disturbance in PT networks is mainly related to the absolute number of passengers affected, instead of the V/C ratio of PT vehicles on a certain link. For example, a single-track local train line can have a very high V/C ratio if there are limited possibilities for trains to pass each other, whereas a very busy four-track train line might have a lower V/C ratio. In such case, the passenger flow on affected links is a better proxy to represent the impact of an incident than the V/C ratio. This in fact equals the passenger betweenness centrality measures as proposed by Cats and Jenelius (2014).
Fourth, some pre-selection criteria for road networks only focus on the impact of a disturbance on the considered link e i itself, whereas other criteria also consider spillback effects to adjacent links e j≠i . For road networks it is clear that disturbances can have spillback effects to other links. However, in PT networks spillback effects of disturbances also occur, though differently compared to road networks. Given the limited congestion between PT vehicles, there are no or only limited direct spillback effects to PT vehicles on adjacent link segments in case of disturbances. However, PT services on other link segments y j≠i in the network can certainly be affected by a disturbance on link segment y i . As explained, PT operators apply standard disruption procedures. In these procedures PT lines can be divided into two parts, shortened, rerouted over an alternative track or cancelled. For example, assume a PT line l s l1 , … , s l5 which is cancelled between s l3 and s l5 after the occurrence of a disturbance on link segment y s 3 −s 4 , because there is insufficient capacity for short-turning near s l4 . This means that not only passengers on link segment y s 3 −s 4 are affected, but also passengers only travelling over link segment y s 4 −s 5 . This illustrates that PT services on a certain link segment y i can be affected because of a first-order effect-a disturbance occurring on that link segment y i itself-and because of a second-order effect. This second-order effect is relevant in case a disturbance occurs on another link segment y j≠i , leading to disruption measures taken by the PT operator or infrastructure manager which also affect PT services on the considered link segment y i . Except during the transition phase between regular PT operations and the disruption scenario, this spillback effect on PT networks can be considered more static compared to the dynamic spillback effects occurring on road networks.
Based on the differences between PT and road network characteristics, we develop an adjusted methodology to identify the most vulnerable links in multi-level PT networks (Fig. 2). In this methodology, pre-selection criteria I 1 to I 4 are specified. I 1 y i n (formula 3) reflects the first-order exposure: the expected time that a certain link segment y i n is exposed to reduced/ no PT services because of non-recurrent disturbances occurring on that link segment y i n itself. This equals the product of the average frequency f * n ,pr,w with which disturbance type δ n occurs per time period on network level n in season w and the average duration * n ,pr,w of each disturbance δ n in season w ∈ W. For each δ n a predictor pr ∈ PR is determined which enables the transformation of the average frequency with which δ n occurs per time period on the whole considered network level n (which is known from the database with disturbances we used) to the average frequency per link segment y i n . This transformation is based on the ratio between the value of this predictor x pr,y i n on link segment y i and the value x pr,Y n summed over all link segments of the total network level. For this criterion only the average frequency f* and average duration τ* are used. This prevents the need for Monte Carlo simulation to draw values from the identified distribution functions, resulting in reduced computation times and reduced complexity in this link vulnerability identification phase. I 2 y i n (formula 4) reflects the second-order exposure effect: the expected time that a certain link segment y i n is exposed to reduced/no PT services because of non-recurrent disturbances occurring on any other link segment y j n ≠i n , resulting in measures taken by PT operators which also affect PT operations on the considered link segment y i n . In this study we used the rescheduling procedures as taken by PT operators in the Netherlands in reality in case of disturbances and assumed these procedures as a given, in order to determine which other link segments y j n ≠i n affect PT services on link segment y i n in case of disturbances. I 3 y i n sums the first-order and second-order effects, thus expressing the total expected time a link segment is exposed to nonrecurrent disturbances (formula 5).
(3) I 1 can be plotted against each other.
Links with the highest value for I 3 |I 4 , or the other way around, appear on the Pareto frontier in this plot. By selecting all links which are plotted on or nearby the Pareto frontier, the most vulnerable links can be identified based on these pre-selection criteria. Adjacent links in the network which all appear on the Pareto frontier can be taken together as one link segment. If one would prefer to prioritize these identified most vulnerable links further, an assessment of the number of available alternative routes in the multi-level PT network could be performed for each of these links based on an expert judgment. Links for which few or no route alternatives are available can then be prioritized.

Quantification of link vulnerability
When the most vulnerable links of the multi-level PT network are identified, vulnerability of these links can be quantified. Quantification of link vulnerability from a passenger perspective can be done using formula (2), which explicitly considers both exposure to disturbances and the impact of these disturbances given the total multi-level PT network N available. As explained in Sect. 2.1, different disruption scenarios S can be distinguished for each link based on the impact of a disturbance δ n on partial or full infrastructure unavailability. Given a chosen time horizon for which link vulnerability is quantified, Monte Carlo simulation is used to generate disturbances δ n with a certain duration n for each distinguished disruption scenario. Based on the estimated parameters for frequency and duration of δ n,w , values are drawn from the identified theoretical distribution functions. In a public transport assignment model the PT network and PT services are adjusted according to each disruption scenario S, based on which a new passenger assignment can be performed. The total monetized societal costs ΔW e, n , for all passengers travelling over all OD-pairs can then be compared between the undisturbed situation and the specific disruption scenario S. Formula (7) expresses the calculation of the perceived, monetized travel time effects C t given a network modelled with n origins O and n destinations D. The different travel time components-access time from origin to a PT stop t a , waiting time t w before boarding each (5) I 3 PT service (the number of waiting moments x equals the number of transfers n t + 1), invehicle time t in for each PT service (the number of used PT services y equals the number of transfers n t + 1), the number of transfers n t , transfer walking time t t for each transfer walk z, and the egress time from the PT stop to final destination t e -are all multiplied by their corresponding weight α as perceived by passengers and monetized using the Value of Time (VoT). The parameter values we used for the different travel time weights and VoT are derived from Bovy and Hoogendoorn-Lanser (2005) and Warffemius (2013). In these studies, the parameter values are derived by discrete choice model estimation based on individual passenger preferences, resulting in aggregated, average parameter values suitable for the Dutch situation. Here we used a fixed VoT, independent from the amount of delay on a certain OD-pair. Besides travel time effects, the effects of disturbances on travel costs C c are also evaluated. Incorporating C c is especially important when considering disturbances in the context of multi-level PT networks. In case of disturbances passengers sometimes have to use longer PT services of another PT operator, potentially increasing travel costs. Another component when quantifying link vulnerability is the societal costs due to reduced travel comfort for seated passengers C comf,seat and standing passengers C comf,stand , respectively. This is of relevance, since particularly during disturbances the crowding level on remaining alternative routes in the PT network can increase substantially, thereby reducing the comfort level and increasing passengers' perceived in-vehicle time. These additional societal costs are quantified based on the relation between crowding and perceived in-vehicle time, expressed as in-vehicle time multipliers with the parameter value of this crowding multiplier being in line with values found by Wardman and Whelan (2011). The societal costs of non-facilitated demand C non-f are also quantified, given the possibility that during a disturbance passenger volume on a link of a certain alternative route can exceed the total supplied link capacity (seated plus standing capacity), and passengers have to wait an additional headway due to denied boarding. At last, by applying the rule of half to the generalized travel costs for each affected OD-pair, cancellation costs C cancel are quantified for the part of the travelers which have cancel their PT trip following a disturbance (reflecting a change in either mode choice or trip frequency choice). For a more detailed explanation of the quantification of C c , C comf,seat , C comf,stand , C non-f and C cancel we refer to Yap (2014).
Formula (8) shows all the components based on which the total monetized societal costs ΔW y, n , of a disturbance are calculated for link segment y. To incorporate the distinguished disruption scenarios S specified for each link segment y, in our proposed methodology we adjust formula (2) to calculate the societal costs of link segment vulnerability within a specified time horizon as shown by formula (9), thereby explicitly incorporating both exposure to disturbances and impact of disturbances.

Case study network
The developed methodology for identification and quantification of link vulnerability is applied in a case study to the Randstad Zuidvleugel, the southern part of the most (8) ΔW y n , n , = ΔC t + ΔC c + ΔC comf ,seat + ΔC comf ,stand + ΔC non−f + ΔC cancel (9) c y n = ∑ S ∑ n E f S y n , n * E S y n , n * ΔW S y n , n , important economic area of the Netherlands (≈ 2.2 million inhabitants). This area is composed by two main cities The Hague and Rotterdam, and several smaller cities and villages located between and around these cities. This area is selected because of its relatively high PT network density with PT services on different network levels. The interactions between these network levels are especially interesting when considering multi-level PT networks. The PT network is modelled as super-network in a high level of detail with the transport planning software OmniTRANS with 5791 zones. By selecting the Randstad Zuidvleugel as case study area, we allow for a detailed modelling of PT demand and supply within acceptable computation time by the public transport assignment model. For PT lines l ∈ L the seat capacity and crush capacity are specified. A frequency-based network representation is applied, meaning that waiting time for each PT line l ∈ L is assumed to be half of the interarrival time between two PT vehicles of that line L, with a user-specified maximum waiting time. Although a schedule-based representation results in a higher accuracy, this requires more detailed model input and increases computation times for passenger assignment substantially. Besides, because of the relatively high frequency of PT lines in the Randstad, differences in modelled waiting time between a frequency-based and schedule-based network representation remain limited. In our model four different time periods are distinguished: morning peak 7-8 am, morning peak 8-9 am, evening peak 4-6 pm and the remaining hours of the work day. Especially during the morning peak PT demand is not uniformly distributed over the two hours of the morning peak in the Netherlands (CBS 2013). Because we consider societal costs of crowding and non-facilitated demand explicitly, assuming a uniformly distributed PT demand would lead to a biased quantification of these costs. Therefore, the morning peak is split in two separate periods 7-8 am and 8-9 am with separate OD-matrices. The public transport OD-matrices are the result of the regional demand model of this Zuidvleugel area, based on land use input, trip frequencies, trip distribution and modal split. The regional Zuidvleugel demand and PT assignment model we used has been calibrated and validated for the 2011 base year. The Zenith algorithm is applied for performing the passenger assignment in the undisturbed situation and for distinguished disruption scenarios S (Brands et al. 2013). Despite the mentioned importance of comfort and crowding effects, these aspects are not incorporated in the generalized cost function used in the assignment. This is because especially during unplanned disturbances passengers are not expected to know the crowding level of PT services on alternative routes on beforehand, and are therefore not expected to adjust their route choice based on this a priori. Therefore, we do not expect that crowding level is dominant as component of the generalized cost function used to predict passenger route choice during disturbances. Besides, incorporating the capacity of PT lines in the assignment would lead to an iterative, capacity-constrained assignment, which increases computation times substantially. The perceived additional disutility because of discomfort on the chosen route is however incorporated afterwards in the evaluation of link vulnerability by C comf,seat and C comf,stand , where the difference in perceived invehicle time due to crowding between the undisturbed and disturbed scenario is quantified.

Identification of link vulnerability in the Randstad Zuidvleugel network
Vulnerable links are identified for the case study network by using the historic dataset of realized disturbances on the network levels of different PT operators in the Netherlands as input for calculating the first-order, second-order and total link segment exposure. Figure 3 shows the expected first-order, second-order and total exposure to non-recurrent disturbances per year for link segments on the agglomeration (metro/light rail) network level. Figure 4 shows the expected total exposure per year for link segments on the regional (train), agglomeration (metro/light rail) and urban (tram) network level. The metro and light rail network level are taken together, since these modes operate on the same functional network level. Several findings result from Figs. 3 and 4.
First, Fig. 3 shows the importance to incorporate second-order spillback effects when calculating the expected total time a link segment is exposed to large disturbances. Figure 3 clearly shows that the expected total time several link segment y i are blocked is heavily influenced by disturbances occurring on other link segments y j≠i . Not considering these second-order effects would lead to substantial underestimation of link segment vulnerability.
Second, it becomes clear that the expected total link segment exposure of light rail link segments near The Hague (triangular dots in Fig. 3 up to no. 283) is substantially larger compared to link segments of the Rotterdam metro network (triangular dots in Fig. 3  no. 283). This can be explained by the considerably higher switch density on the Rotterdam metro network compared to the light rail network near The Hague. This results in disturbances remaining more local in Rotterdam, reducing their second-order propagation effect to other link segments. A network with a relatively low switch density means that PT services on more links adjacent to the link where the disturbance actually occurs need to be adjusted, thereby affecting a larger group of passengers. This also means that links will suffer more often from disturbances occurring on other adjacent links, thus increasing the second-order exposure time to disturbances. In the Rotterdam metro network, there are switches available near almost every metro station. This means that when a disturbance occurs on a certain metro link segment, thereby blocking the link in either one or both directions, the operator splits metro services in two separate parts up to both sides of the link segment. The second-order effect then equals the first-order effect, since disturbances occurring on link segment y i1 in direction 1 will only affect services on the exact same link segment in the other direction 2 y i2 as second-order effect.

from
Third, Fig. 4 shows that train link segments are relatively robust against exposure to disturbances compared to metro/light rail and tram link segments. Possible explanations for this are the own right of way for trains, the availability of a signaling system to prevent train-train collisions and the relatively low train intensity on train links compared to metro, light rail or tram links.
Fourth, in general the link segments of the tram network of The Hague (triangular dots left in Fig. 4) are more vulnerable to exposure to disturbances compared to link segments of the Rotterdam tram network (triangular dots right in Fig. 4). This can partly be explained because in general more parallel (sometimes unused) tram tracks are available in Rotterdam, which can function as backup in case of disturbances and reduce second-order exposure effects. The triangular outlier in the middle of Fig. 4 shows the specific link segment Ternoot-Laan van NOI of the tram network of The Hague. This link is located directly before/after the light rail route Laan van NOI-Zoetermeer/Rotterdam, without intermediate rescheduling possibilities. A disturbance on the light rail network often also affects PT services on this tram link segment. Therefore, second-order effects are relatively large on this link segment.
In Fig. 5 the results for pre-selection criteria I 3 (expected total exposure to disturbances per year) and I 4 (expected passenger volume) are plotted against each other for each link. Based on this figure we stress the importance of using pre-selection criteria in a methodology to identify vulnerable links in a multi-level PT network which capture both exposure to disturbances and the impact of each disturbance explicitly. Figure 5 clearly illustrates there are link segments on the Pareto frontier of which the impact of a disturbance is expected to be relatively low, but which are very vulnerable because of relatively heavy exposure to disturbances (see for example the most right triangular dots in Fig. 5). If only the impact of a disturbance would be considered, only the busiest links of the train network would be identified as most vulnerable. However, given the Pareto frontier where incident probability and impact are both considered, we conclude that there is no network level or mode which clearly contains most vulnerable links. Links on or nearby the Pareto frontier are from the train, metro/light rail and tram network. Train links are especially vulnerable because of the expected large impact of disturbances, whereas metro and tram links are mainly vulnerable when a combination of relatively heavy exposure to disturbances and a relatively large number of affected passengers is expected.

Quantification of link vulnerability of link segment Laan van NOI-Forepark
The developed methodology to quantify link vulnerability is applied to the light rail segment Laan van NOI-Forepark. This link segment is selected from the Pareto frontier as shown in Fig. 5 as example. To illustrate our methodology, link vulnerability for this segment is quantified in the current situation without additional measures. This is contrasted with the quantification of link vulnerability when a measure would be applied which potentially reduces the vulnerability of this segment. The results of this case study application are shown in Fig. 6, where monetized link vulnerability is expressed for the current situation without measures (left), and after testing the impact of a robustness measure (right). Public transport services on this link segment are operated by two different operators together: HTM and RET. Disturbances are generated using Monte Carlo simulation for a time horizon of 10 years. Based on this simulation we can conclude that during 10 years the light rail segment Laan van NOI-Forepark is expected to be exposed to non-recurrent disturbances for 964 h. Assuming on average 18 h PT operation per day, this means that in 1.5% of the time PT services on that link segment are blocked due to disturbances. In case this link segment is blocked, the applied passenger assignment model shows which alternative routes in the multi-level PT network are used. Link segment vulnerability c y n is calculated using formula (9) in the Methodology section, by multiplying expected exposure to disturbances and expected disturbance impact ΔW y n , n , . ΔW y n , n , is calculated using formula (8), by summation of the monetized impact of a disturbance on passenger travel time, costs, crowding, non-facilitated demand and trip cancellation costs. The total monetized passenger travel time effects, in turn, are calculated using formula (7), in which all travel time components-access time, in-vehicle time, waiting time, walking time, transfer time and number of transfers-are calculated and summed. In the current situation the expected total societal costs of disturbances on this link segment in 10 years equal €4.3 million. This value expresses the societal costs of vulnerability of the analysed link segment. Figure 6 (left) shows that additional transfers and their related waiting time and transfer time are the most important contributors to these societal costs. During these 10 years 787 disturbances on this link segment are expected according to our simulation results. This means that expected average societal costs per disturbance equal €5.4 thousand.
To illustrate our method, we also developed a measure aiming to improve robustness of this link segment. We evaluated this measure using a societal cost-benefit analysis. Since many affected passengers use the local train connection on the more or less parallel train track between Zoetermeer, Ypenburg and The Hague as backup during disturbances, we propose a temporary increase in frequency on this connection. We investigated adding two temporary stops for intercity train services operating on this parallel train track at two already existing local train stops, Zoetermeer and The Hague Ypenburg, only in case PT operations on the light rail segment Laan van NOI-Forepark are disturbed. In that case, the frequency of stopping train services between Zoetermeer, Ypenburg and The Hague is effectively doubled during disturbances. This improves transfer possibilities between network levels and improves the backup function of the train network for the disturbed light rail network. Disadvantage however is that the travel time for through travelers in the intercity service increases with ≈ 5 min, which also results in additional operation costs.
After generating disturbances using a pseudo-random generator, we can quantify the robustness effects of this measure (see Fig. 6 right). Total societal costs of link segment vulnerability after 10 years now equal €3.9 million. This means that this measure reduces the costs of vulnerability of this link segment by 8%, therefore having a positive Net Present Value. The expected average societal costs per disturbance now equal €5.0 thousand. This measure especially reduces waiting time substantially, at cost of an increase in total in-vehicle time. However, monetized benefits from waiting time reduction outweigh the monetized costs of additional in-vehicle time.
We can formulate some points for discussion, regarding the quantification of the robustness benefits of this specific case study measure. First, for a successful implementation of measures using the multi-level PT network it is important to consider the distribution of financial and societal costs and benefits between stakeholders involved. Most costs of the proposed measure are for the Dutch train operator NS, because of additional timetable hours their trains have to run and additional travel time for train passengers, despite the disturbances occurring on the network operated by the HTM and RET. To implement this measure successfully, it seems likely that (financial) incentives have to be provided to the Dutch Railways by PT authorities or the PT operators HTM and RET. Second, we did not quantify the network wide effects for train passengers because of the increased travel time in intercity services, for example when connections later on the route are missed. We however did check that sufficient buffer time between conflicting trains was available in the timetable on the specific train track in case running time of intercity trains would be extended by 5 min in our measure. Third, for a successful implementation of the proposed measure it is required that the RET and HTM provide passengers information about the temporary doubled frequency of train services stopping at the stations Zoetermeer and The Hague Ypenburg, so that passengers can incorporate this in their route choice accordingly.

Conclusions and further research
Despite the importance of robust public transport networks, the full impact of public transport network vulnerability on passengers has not been considered in scientific literature and practice yet. The added value of this study is the development of a methodology to identify the most vulnerable links in multi-level public transport networks, and to quantify link vulnerability for these identified links. To our best knowledge, this study is the first which addresses full and realistic passenger impacts of disturbances in both the identification and quantification of link vulnerability. Based on our study, we formulate methodological, practical and policy-related conclusions.
In our study we propose a methodology to systematically identify the most vulnerable links in a multi-level public transport network. Based on the identified vulnerable links, our methodology allows for quantification of the full passenger impacts of disturbances on these vulnerable links. Contrary to single-level network perspectives, we consider the integrated, total multi-level PT network, including PT services on other network levels which remain available after the occurrence of a certain disturbance. This results in a more realistic impact quantification compared to single-level approaches. In our approach both exposure to large, non-recurrent disturbances and the impact of these disturbances are analyzed in a systematic manner in link vulnerability identification and quantification. Our case study results show the importance of incorporating exposure to disturbances explicitly in the identification of vulnerable links, since only considering the impact of disturbances would result in a very different list of most vulnerable links. Based on our results we also stress the relevance of taking into account second-order spillback effects in this methodology when calculating total link segment exposure to disturbances. Not considering second-order exposure to disturbances can lead to substantial underestimations of link vulnerability.
Our practical case study application shows that train network links are relatively less exposed to disturbances, compared to links of the urban tram network or light rail/metro links on the agglomeration network level. The passenger impact of disturbances on the train network is however relatively large due to the large passenger flows affected. Our study shows that therefore particularly busy links of the light rail/metro network are vulnerable, given the relatively high disruption exposure and relatively high number of passengers affected. From our case study we estimate that the monetized passenger impact of disturbances on one single, relatively vulnerable light rail/metro link segment equals €4.3 million over 10 years.
Currently only the costs of measures aiming to improve robustness are known to policymakers. Based on our methodology we are able to monetize the societal costs of disturbances as well. Besides, applying our methodology enables the quantification of the part of these societal costs which can be reduced by a certain robustness measure. This allows us to express robustness benefits of a certain measure in monetary terms and to compare these with the required costs of that measure, thereby quantifying the value of robustness. This enables policy-makers to make a trade-off between costs of robustness measures and monetized robustness benefits of these measures. From a policy perspective, it is important to realize that the topic of robustness should always be considered as trade-off with other aspects. Some robustness measures (like the construction of additional switches) can on the one hand reduce the societal costs of a disturbance, once a disturbance occurs, but on the other hand increase link exposure to disturbances. Other measures can reduce the impact of a disturbance for affected passengers, while increasing travel time for other groups of passengers. Some measures might be able to improve robustness substantially on the one hand, but require large investments on the other hand. The result of these trade-offs will be different for different locations in the network and depends on the frequency with which disturbances occur, the impact of disturbances, the number of passengers affected by the disturbance and the extent to which alternative routes are available in the multi-level PT network. Applying our methodology allows decision-makers to get insight in these tradeoffs for each specific location, where all aspects relevant in such trade-off are expressed in the same, monetary units. Therefore, our methodology helps to support and rationalize the decision-making process regarding the implementation of different robustness measures. It provides insights in how the additional travel time during disturbances can be reduced by certain robustness measures. This output can be used to quantify the accessibility benefits of different robustness measures, for example by using the number of locations or activities which can be reached by public transport within a certain time during disturbances. This helps prioritizing measures based on their contribution to accessibility.
We formulate five recommendations for further research. First, costs for rescheduling and recovery of the planned timetable, vehicle and personnel circulation are not considered in our study. Incorporating this would further increase the financial and societal costs of disturbances. Therefore, the societal costs of disturbances as calculated in this paper can be considered a lower bound. Second, we recommend a further extension of our proposed method to identify vulnerable links. In our study, the most vulnerable links from the Pareto frontier can be selected based on a qualitative assessment of the number of available alternative routes for each link. By quantifying this last step, our methodology can be further improved. For example, for each OD-pair affected by a disturbance on a certain link, the number of feasible route alternatives and their remaining capacity could be calculated by applying route choice set criteria (see for example Fiorenzo-Catalano 2007). Third, we recommend to incorporate dynamic en-route route choice in the disturbed passenger assignment based on travel information available to passengers (see for example Van der Hurk et al. 2012;Cats and Jenelius 2014). For all our assignments we only considered pre-trip route choice, assuming full information about a disturbance during the whole trip. This shows the potential of the multi-level PT network to function as backup in case of a disturbance. However, in reality disturbances are dynamic and there is not always full information available about the disturbance. It is therefore interesting to incorporate the dynamics of disturbances and the role of information provided to passengers, combined with en-route route choice, in the assignment. Fourth, we recommend a further node-based vulnerability analysis next to our performed link-based vulnerability analysis. By explicitly studying which public transport stops are most vulnerable by executing a similar node-based vulnerability analysis, insights can be gained in different levels of vulnerability for different types of public transport stops. In a Dutch context, the Dutch Railways use a classification of all stations in 6 categories based on their function and number of passengers, as for example applied by Geurs et al. (2016) and La Paix Puello and . A node-based vulnerability analysis can provide insights to policy makers which station type is particularly vulnerable, thereby prioritizing the type of stations where robustness measures have most societal value. Fifth, it should be mentioned that a multi-level approach regarding PT robustness is rather complex in terms of collecting revealed data about disturbances occurring on the networks of multiple PT operators, assignment calculation times, and implementation of measures which exceed the borders of the network of a certain PT operator. PT authorities could play a role here by developing passenger oriented incentives to operators in case of disturbances, which take the total multi-level PT network in consideration.