# Assessing Potential Casualties in Critical Events

Simona Cavallini, Fabio Bisogni, Marco Bardoscia, Roberto Bellotti

► To cite this version:

Simona Cavallini, Fabio Bisogni, Marco Bardoscia, Roberto Bellotti. Assessing Potential Casualties in Critical Events. 8th International Conference on Critical Infrastructure Protection (ICCIP), Mar 2014, Arlington, United States. pp.231-242, 10.1007/978-3-662-45355-1_15 . hal-01386767

HAL Id: hal-01386767

https://inria.hal.science/hal-01386767

Submitted on 24 Oct 2016

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>
Chapter 15

ASSESSING POTENTIAL CASUALTIES IN
CRITICAL EVENTS

Simona Cavallini, Fabio Bisogni, Marco Bardoscia and Roberto Bellotti

**Abstract** This paper describes an approach for assessing potential casualties due to events that adversely impact critical infrastructure sectors. The approach employs the consequence calculation model (CMM) to integrate quantitative data and qualitative information in evaluating the socio-economic impacts of sector failures. This is important because a critical event that affects social and economic activities may also cause injuries and fatalities. Upon engaging a structured method for gathering information about potential casualties, the consequence calculation model may be applied to failure trees constructed using various approaches. The analysis of failure trees enables decision makers to implement effective strategies for reducing casualties due to critical events.

**Keywords:** Cascading effects, consequence calculation, casualties, failure trees

# 1. Introduction

The European Commission Directive 2008/114/EC of 2008 [5] defines a critical infrastructure as “an asset, system or part thereof located in [m]ember [s]tates which is essential for the maintenance of vital societal functions, health, safety, security, economic or social well-being of people, and the disruption or destruction of which would have a significant impact in a [m]ember [s]tate as a result of the failure to maintain those functions.” The directive clarifies a European critical infrastructure as one that is located in a European Union (EU) member state whose destruction or malfunction would have a significant impact in at least two EU member states. The significance of the impact should be assessed in terms of cross-cutting criteria, including the effects of cross-sector dependencies involving other infrastructures.

According to Article 3 of Directive 2008/114/EC [5], the identification process of each member state should be based on the following cross-cutting criteria:
* **Casualties Criterion:** Assessed in terms of the potential numbers of fatalities and injuries.

* **Economic Effects Criterion:** Assessed in terms of the significance of economic loss and/or degradation of products and services, including potential environmental effects.

* **Public Effects Criterion:** Assessed in terms of the impact on public confidence, physical suffering and disruption of daily life, including the loss of essential services.

To define and identify critical infrastructures at the national level, each EU member state has adopted a perspective that can be related to one of the following approaches [2]: (i) service-oriented approach, in which the key elements are vital services and/or essential societal functions; (ii) asset-oriented approach, in which the key elements are impact and/or risk assessment; and (iii) operator-oriented approach, in which the key elements are public/private organizations that manage/own infrastructures because of their decision-making role.

A sector-based approach may be considered close to an operator-oriented approach when, in a given area, the number of operators is limited (i.e., natural oligopoly or monopoly) and/or the opportunity to replace their services is difficult in the short term. In this perspective, a critical infrastructure corresponds to key elements of a productive sector at the national level, where the sectors must be identified using official statistical classifications such as NACE in the EU context.

The malfunction or destruction of an infrastructure, especially due to an unexpected event, affects social and economic activities. The relevance of critical infrastructure failures is, in general, not only due to their direct role in socio-economic activities, but also because of their interconnections. Tight interconnections among critical infrastructures and the cascading effects that can occur in the case of failures of one or more infrastructures have been extensively investigated at the theoretical [1, 4] and empirical levels [12]. In both cases, strong connections have been identified in certain sectors that can cause cascading effects in specific cases.

With regard to preventive actions and crisis management, civil protection authorities and first responders would benefit from a preliminary assessment of potential damage caused by accidental or intentional failures of socio-economic sectors. According to an intervention perspective related to the emergency roles of civil protection personnel and first responders, the focus is on evaluating the impacts, especially casualties, in the time frame starting from the end of the direct effect of the event of interest.

This paper describes the consequence calculation model (CCM), which integrates quantitative data and qualitative information in order to evaluate the socio-economic impacts of sector failures. The model has been developed by the FORMIT team and applied in the DOMINO Project [10]. The concrete application of the model provides indications of priorities of intervention in
<figure><img src="image_2.png" /><figcaption>Figure 1. Failure tree reporting effects by sector.</figcaption></figure>

different sectors in order to contain the potential consequences to the extent possible.

## 2. Consequence Calculation Model

The primary goal of the consequence calculation model is to evaluate the effects of failures of socio-economic sectors, including critical infrastructures. The main inputs to the model are time series of the operativity levels of the sectors of interest. The main outputs are time series of the potential impacts in terms of casualties (injured and fatalities), economic effects and public effects due to failures of the affected sectors. The effect of each sector failure at a certain time instant is summarized by an indicator per impact.

In order to assess the impacts (i.e., casualties, economic effects and public effects) of an unexpected event that affects a country (as in the DOMINO Project), the output of the consequence calculation model can be represented using a failure tree for each of the potential impacts (casualties, economic effects and public effects) that captures the dependencies existing among the impacted sectors. In a failure tree, the sectors affected by a critical event and the sectors affected by disruptions of other sectors are represented by considering the time dimension. Figure 1 shows a failure tree that reports the economic effects (EE), public effects (PE), injuries (I) and fatalities (F) by sector.
## 2.1 Model Assumptions

The proposed model for computing the consequences of a disruption of each sector relies on the following assumptions:

* **Independence of Sector Impacts from Disruption Causes (A1):** The estimated impacts, in terms of economic effects, public effects and casualties, due to the disruption of the $i^{th}$ sector are not affected by disruptions of other sectors that occur before or after the disruption of the $i^{th}$ sector. The cause of the failure of the “first” sector does not affect the operativity levels of the other sectors.

* **Time Homogeneity (A2):** The estimated impacts are not affected by their absolute time positions in a failure tree. In other words, the sequences of affected sectors shown in failure trees are used as time-invariant information by the consequence calculation model. The total consequences at time $t$ of the entire failure tree is defined as the sum of the individual impacts generated by the disrupted sectors (see Figure 1 for the effects by sector).

* **Lower/Upper Bounded Operativity Levels (A3):** The operativity level $x_i$ of each sector ranges from zero to one. A value of zero corresponds to the total disruption of the sector, while a value of one corresponds to full (normal) operativity of the sector. The consequence calculation model is constructed to work with discrete operativity levels (i.e., $x_i \in \{0, 1\}$) as well as continuous operativity levels (i.e., $x_i \in [0, 1]$).

Note that, according to Assumption A1, the impacts of the affected sectors are independent, while the disruption of one sector is strictly related to the disruption of one or more other sectors.

## 2.2 Model Hypotheses

The computation of the three indicators of the model relies on the three preceding assumptions and three hypotheses.

The first hypothesis (H1) is that, when a sector fails, its recovery is no longer possible. As a consequence, the effects of a sector disruption and of the consequent failure tree may proceed indefinitely.

The second hypothesis (H2) is that the disruption of a specific sector can occur only once. For example, if the disruption of Sector A could be caused by both Sector B and Sector C, and if, in the failure tree, the disruption of Sector C occurs before the disruption of Sector B, then Sector A fails because of Sector C, but not because of Sector B.

The third hypothesis (H3) is that an outage occurring to a sector cannot be partial, but only complete at least for the first time period. This implies that the operativity levels are discrete.
<figure><img src="image_3.png" /><figcaption>Figure 2. Failure tree reporting eventual effects in terms of casualties by sector.</figcaption></figure>

### 3. Calculating Potential Impacts

The aforementioned European Commission directive [6] defines casualties (C) in terms of injured persons (I) and fatalities (F). In addition, the non-binding guidelines for the application of the directive specify that:

- A casualty is either an injured person or a fatality.

- An injured person is defined as a person who requires more than 24 hours of hospitalization.

- There is no limit on the maximum time following an event that causes the disruption or destruction of an infrastructure during which fatalities should occur.

The potential impacts in terms of casualties are computed in the consequence calculation model according to the metrics suggested by the European Commission directive [6]. According to the assumptions listed above, the estimated impacts in terms of casualties (C) (injured persons and fatalities) due to the disruption of one sector are not affected by disruptions of other sectors (occurring before or after) (Assumption A1) and by the absolute time position in the potential failure tree (Assumption A2) (Figure 2).

In the case of a critical event, the indicators of the total impacts in terms of injured persons $I(t)$ and fatalities $F(t)$ at time $t$ for the entire failure tree are
computed as the sum of the injured persons and the sum of the fatalities occurring in all the affected sectors. Without any loss of generality, the model for assessing the impact in terms of injured persons and fatalities can be described, in general, as casualties and applied to the two cases. Given $n$ sectors, only $m_c$ of the sectors ($m_c \le n$) suffer effects in terms of casualties. In the proposed model, the casualties caused by the disruption of the $j^{th}$ sector at time $t$ are linked to the operativity levels according to the equation:

$$C_j(t) = \alpha_j \Theta[\theta_j - x_j(t)] \quad (1)$$

where $C_j(t)$ is the number of casualties induced at time $t$ by the disruption of the $j^{th}$ sector; $\alpha_j$ is a positive real parameter that represents the average number of casualties induced by the complete disruption of the $j^{th}$ sector per unit of time ($\alpha_j$ takes different values for injured persons and fatalities); $\theta_j$ is a real parameter that can be interpreted as an operativity threshold of the $j^{th}$ sector ranging from zero to one; $x_j(t)$ is the operativity level of the $j^{th}$ sector at time $t$ ranging from zero to one; and $\Theta$ is the step function:

$$\Theta[\theta_j - x_j(t)] = \begin{cases} 1, & \text{if } x_j(t) < \theta_j \\ 0, & \text{otherwise} \end{cases}$$

Equation (1), which gives the casualties caused by a disruption of the $j^{th}$ sector at time $t$, includes a threshold mechanism: the operativity level of the $j^{th}$ sector at time $t$ must fall below the threshold $\theta_j$ to contribute to the casualties by an amount $\alpha_j$ at time $t$. The total casualties at time $t$, denoted by $y_j(t)$, is the sum over all the sectors that potentially suffer effects in terms of casualties (Assumption A1):

$$y(t) = \sum_j \alpha_j \Theta[\theta_j - x_j(t)]. \quad (2)$$

Equation (2) implies that the outage of the $j^{th}$ sector has an instantaneous effect (at the same instant of time) on the casualties. This is relaxed by introducing a delay time $\bar{t}_j$ for the $j^{th}$ sector and modifying the equation accordingly:

$$y(t + \bar{t}_j) = \sum_j \alpha_j \Theta[\theta_j - x_j(t)]. \quad (3)$$

Thus, the operativity level of the $j^{th}$ sector at time $t$ influences the casualties at time $t+\bar{t}_j$. To this point, the additional hypotheses have not come into play. In the case that the operativity levels do not take values in the real interval $[0, 1]$, but only take discrete values of 0 or 1 (Hypothesis H3), the parameter $\theta_j$ has no meaning. In fact, it is perfectly reasonable for a completely functional sector not to have any effect on the casualties, while a completely non-functional sector must have some effect on the casualties. In this case, Equation (3) reduces to:
$$y(t + \bar{t}_j) = \sum_j \alpha_j [1 - x_j(t)]. \quad (4)$$

If the interest is only in the cumulative casualties $Y(T)$, then the integral of the casualties up to the final instant of time $T$ must be computed:

$$Y(T) = \int_{0}^{T} y(t)dt. \quad (5)$$

Time delays do not play any role. Indeed, it can be shown that the integrals over time of the terms in Equation (5) are left unchanged by a time translation. Analogously, it is possible to define the cumulative casualties up to time $t$ as:

$$Y(t) = \int_{0}^{t} y(t)dt. \quad (6)$$

However, in this case, the time delays can play an important role.

## 4. Information Collection

Several academic and empirical works have attempted to assess casualties due to critical events. For example, Cavalieri, et al. [3] evaluate the number of casualties (injuries and fatalities) based on the number of displaced people in the case of an earthquake or damage to infrastructure systems. Hirsch [7] assesses casualties due to critical events based on health care system response.

Casualty assessment in the consequence calculation model employs a general approach. Four pieces of information are needed to validate the model with discrete operativity level values (Hypothesis H3): (i) sectors that potentially cause casualties ($m_c$); (ii) average number of casualties induced by the complete disruption of the $j^{th}$ sector per unit of time ($\alpha_j$); (iii) delay time of the $j^{th}$ sector ($\bar{t}_j$); and (iv) number of casualties induced at time $t$ by the complete disruption of the $j^{th}$ sector (for validation purposes) ($C_j(t)$).

Casualty information needed by the consequence calculation model for an Italian case study was collected from four data sources (DS1–DS4):

* **DS1:** A pilot survey involving nearly 200 sector experts that collected information pertaining to the identification of sector components and the assessment of potential impacts due to sector failures.

* **DS2:** A questionnaire submitted to one expert from each sector that potentially suffers casualties. The information helped refine the assessment of the potential casualties occurring as a result of sector failures.

* **DS3:** Public databases maintained by the Italian National Institute for Statistics (ISTAT) [8].

* **DS4:** Desk research.
## 4.1 Limitations of Information Collection

Information collected by the pilot survey (DS1) was compared with that in the reference database (DS3) and analysis was conducted using real-world data. The pilot survey (DS1) was used to identify the $m_c$ sectors to be investigated, while the desk research (DS4) enabled the analysis of casualty information (i.e., $\alpha_j$ and $C_j(t)$) pertaining to real-world critical events.

With regard to the assumptions and hypotheses, it is important to emphasize that the estimated effects have to be considered as the maximum potential impact affecting the area of interest. Detailed information provided by experts (DS2) was the primary source for estimating the maximum potential number of injured persons and the maximum potential number of fatalities caused by the complete failure (100% loss of service) of a sector.

Estimating the model parameters involves several considerations. The reason is that a portion of the casualties in a disaster occur as a consequence of outages of critical infrastructures in specific sectors and another portion occur as immediate and direct consequences of the disaster itself (e.g. injuries caused by the collapse of a building during an earthquake).

Another obstacle is the unstructured manner in which information is collected, especially in the case of critical events. In the vast majority of cases, only heterogeneous data is available. For example, official data about the L'Aquila earthquake on April 6, 2009 only provides the total number of deaths (298) and injured (1,500) [11] without any details about their causes.

After selecting the subset of sectors in which an outage might produce casualties, efforts were focused on retrieving information about these sectors from widely-accessible sources (non-specialized press articles, websites, etc). Deep scanning of several types of information sources for unexpected critical events (e.g., peer reviewed articles, newspapers and gray literature) (DS4) did not provide useful indications about the distributions of injured persons and fatalities over time.

Official statistics, such as those disseminated by the Italian National Institute of Statistics [9], provide information on the numbers of injured persons and fatalities by cause, but the majority of them (about 85%) are related to health problems. The remaining 15% include four main causes – accidents, suicides, homicides and undetermined events – a classification that is not appropriate for investigating the consequences of critical events.

## 4.2 Limitations due to Data Requirements

Information related to the total number of casualties for a critical event is difficult to adapt with respect to the assumption of independence of sector impacts and disruption causes (Assumption A1) and time homogeneity (Assumption A2). The challenge is related to the fact that the idiosyncratic nature of an event (e.g., earthquake or terrorist bombing) causes an unpredictable number of casualties that cannot be reduced in the time frame of the event. Because of the intervention perspective of civil protection personnel and first responders,
the main interest is in evaluating the number of casualties caused in the time frame starting right after the end of the direct effects of an event. This perspective is considered in the concrete application of the consequence calculation model, which seeks to provide indications of intervention priorities in different sectors in order to contain the potential consequences. For example, in the case of the L'Aquila earthquake, analysis of the data using the consequence calculation model should discriminate between casualties (injured persons and fatalities) directly caused by the event and the casualties caused by consequent failures of infrastructures in the affected area.

Another challenge arises because, in the consequence calculation model, each sector is supposed to have a deterministic impact in case of a total failure regardless of the timing of the failure (Assumption A2). For example, in the case of the L'Aquila earthquake, data on casualties caused by consequent failures of infrastructures in the affected area were not collected with respect to detailed time frames (e.g., casualties due to the electricity sector outage after one hour, one day or one week).

## 5. Direct Collection Approach

The lack of useful structural data from official statistics and information on casualties forced the use of a direct data collection approach for some sectors. In addition, a direct data collection approach was necessary because of the assumption that the numbers of injured persons and fatalities follow the same distributions over time, but with sector-specific parameters.

Direct data collection involved the following steps:

* **Step 1:** Identification of the subset of sectors with potential casualties. For example, these are sectors for which experts questioned in the pilot survey (DS1) answered "Yes" to the question: "According to your opinion/experience, do you believe that a complete service outage of the sector may directly cause fatalities/injuries?" and provided an answer to: "If yes, please quantify the number of casualties as a function of the service outage time (e.g., nothing until two hours, from one to five until 18 hours, and from six to ten until two days)."

* **Step 2:** Second round of interviews with the experts for the selected sectors. The experts were given an *ad hoc* questionnaire (Questionnaire for impact evaluation in terms of casualties in the event of sector failures) (DS2).

* **Step 3:** Final identification of the sectors to be considered.

Step 1 yields the sectors that cause casualties. In theory, a total disruption of any sector would cause casualties in the long term. The sectors that cause casualties are those that have higher probabilities of generating injuries and fatalities in the short term. The selection of sectors was made on the basis of information provided by experts in the pilot survey and a "reasonability
<figure><img src="image_4.png" /><figcaption>Figure 3. Occurrence of injured persons after a total failure of Sector A.</figcaption></figure>

assessment” made by the research team. A preliminary cut was made of the sectors that might be directly responsible for the occurrence of casualties.

The key element of Step 2 was the interviews of sector experts (DS2). General considerations regarding the propensity of a sector to generate casualties in the short term due to a complete and prolonged outage came with detailed information on the impacts along the time dimension. In particular, the Italian sector experts were asked to provide indications to help construct casualty curves of injured persons and fatalities (Figure 3). The casualty curves can help overcome the limitations of Hypothesis H1 by adding a time after which no more impacts occur. Note that the non-recovery of a sector implies the indefinite generation of new casualties.

The key information provided by the experts for their sectors of reference included:

- The instant of time when the effects start and the instant of time when the effects end with respect to the instant of time when the failure occurs.

- The average percentage of casualties in the total population of interest per time unit.

The two parameters $\alpha_j$ and $t+\bar{t}_j$ in the consequence calculation model were estimated using input from experts. The interviews with experts constituted the final criterion to determine the subset of sectors that potentially suffer effects in terms of casualties. A reduced list of sectors for which the casualty effects can be computed was specified based on the availability of data and the possibility of estimating the parameters needed to generate and propagate the casualties that occur during complete sector failures.
## 6. Conclusions

Consolidated approaches are required to assess the consequences of critical events, especially the casualties that potentially occur when critical infrastructures are disrupted, damaged or destroyed. The consequence calculation model is readily applied to any structured classification of socio-economic activities with a predefined geographical scope. The model relies on the definition of sectors of economic activity as identified in official statistical classifications (e.g., NACE for the European context), but it can also be implemented by classifying socio-economic activities in any coherent manner. Moreover, the consequence calculation model can be applied to assess the effects of critical events regardless of the approach used to represent interdependencies (e.g., input-output relationships and direct recognition).

The application of the consequence calculation model in the Italian context proved to be a challenging task. Due to the paucity of publicly-available data, it was necessary to solicit information from sector experts to apply the model and validate the results. Nevertheless, the model and its failure trees are invaluable to operators and strategic decision makers.

Future research will focus on alleviating the limitations induced by the assumptions and hypotheses, thereby providing civil protection personnel and first responders with an effective planning instrument for analyzing potential casualties. Extending the scope to additional countries is another important research topic – it will help tune the model and enhance strategies for reducing event consequences, especially casualties, that directly affect populations.

## Acknowledgement

This research was initiated under Project DOMINO, which was supported by the Prevention, Preparedness and Consequence Management of Terrorism and Other Security Related Risks Programme launched by the Directorate-General Home Affairs of the European Commission. Project DOMINO research was conducted by the Ugo Bordoni Foundation (Italy), FORMIT Foundation (Italy) and Theorematica (Italy) with the support of the Presidency of the Council of Ministries (Italy), Home Office (United Kingdom), SGDN (France) and Ministry of Emergency Situations (Bulgaria).

## References

[1] F. Bisogni and S. Cavallini, Assessing the economic loss and social impact of information system breakdowns, in *Critical Infrastructure Protection IV*, T. Moore and S. Shenoi (Eds.), Springer, Heidelberg, Germany, pp. 185–198, 2010.

[2] F. Bisogni, S. Cavallini, L. Franchina and G. Saja, The European perspective of telecommunications as a critical infrastructure, in *Critical Infrastructure Protection VI*, J. Butts and S. Shenoi (Eds.), Springer, Heidelberg, Germany, pp. 3–15, 2012.
[3] F. Cavalieri, P. Franchin, P. Gehl and B. Khazai, Quantitative assessment and social losses based on physical damage and infrastructural systems, *Earthquake Engineering and Structural Dynamics*, vol. 41(11), pp. 1569-1589, 2012.

[4] S. Cavallini, S. Di Trocchio, F. Bisogni, M. Tancioni and P. Trucco, Study for the Development of a Methodology and Research of Quantitative Data on the Economics of Security and Resilience in Critical Communications and Information Infrastructures (CIIS) – SMART-SEC, Final Report of the Project Supported by the DG Information Society and Media of the European Commission, FORMIT Foundation, Rome, Italy, 2010.

[5] European Commission, Council Directive 2008/114/EC of 8 December 2008 on the Identification and Designation of European Critical Infrastructures and the Assessment of the Need to Improve their Protection, Brussels, Belgium, 2008.

[6] European Commission, Non-Binding Guidelines for the Application of the Directive on the Identification and Designation of European Critical Infrastructures and the Assessment of the Need to Improve their Protection, Brussels, Belgium, 2008.

[7] G. Hirsch, Modeling the consequences of major incidents for health care systems, presented at the *Twenty-Second International Conference of the System Dynamics Society*, 2004.

[8] Italian National Institute of Statistics, About the Italian National Institute of Statistics, Rome, Italy (www.istat.it/en/about-istat).

[9] Italian National Institute of Statistics, Cause di morte, Rome, Italy (www.istat.it/it/archivio/58063), 2009.

[10] D. Perucchi, M. Porcelli, F. Roberti, D. Stasi, S. Trigila, A. Usai, S. Cavallini, F. Bisogni, R. Bellotti, M. Vichi, M. Bardoscia, R. Zollo and A. Battaglia, Domino Effects Modeling Infrastructure Collapse – DOMINO, Final Report of the Project Supported by the DG Home Affairs of the European Commission, FORMIT Foundation, Rome, Italy, 2012.

[11] Protezione Civile, Guido Bertolaso in audizione alla Commissione Ambiente del Senato, Rome, Italy, 2009.

[12] M. van Eeten, A. Nieuwenhuijs, E. Luiijf, M. Klaver and E. Cruz, The state and the threat of cascading failure across critical infrastructures: The implications of empirical evidence from media incident reports, *Public Administration*, vol. 89(2), pp. 381-400, 2011.