9. Design of DSS for Supporting Preparedness to and Management of Anomalous Situations in Complex Scenarios

The set of Critical Infrastructures (CI) constitutes nowadays an enabling pillar of societal life. They guarantee the supply of vital services (transport of energy products, telecommunication, drinkable water delivery, provide mobility functions) thus concurring to the achievement of citizens’ (and societal as a whole) well-being. CI are complex technological or engineering systems: they are thus vulnerable as exposed to natural and anthropic-related events. Physical damages inflicted to CI elements might produce severe repercussions on their functioning which can reduce (or even reset) their functionality. Other than being individually wounded and functionally reset, they can propagate perturbations to other CI to whom they are functionally (inter-)connected. Connection and inter-connection are two relevant properties of systems of CI: connection indicates a one-direction supply mechanism, when one CI supplies a service to another. When such a service is no longer provided, the supplied CI may undergo a more or less severe perturbation. Inter-dependency indicates the presence of feedback loops: a CI might perturb other CI which, directly or through a further perturbation to other CI, could back-propagate the perturbation to the CI which initiates the perturbation cascade. This might produce a further functionality degradation which is amplify the negative feedback loop, by producing more and more serious effects. Cascading effects may spread perturbations on large geographical scales, on time scales ranging from a few second to days, producing reversible and, in some cases, irreversible societal effects.

Other than having repercussion on citizen activities, CI damages and the consequent services perturbation could affect the environment and produce large economic losses. Industrial activities are directly related to the supply of these services; their loss directly implies a lack of production and revenues contraction. In some cases, moreover, CI outages might produce environmental damages (gas release, spill of oil or other products, fires releasing toxic products, nanoparticles, ashes) that further increase the societal consequences.

As CI deliver relevant (in some cases, “vital”) services to the citizens, their societal impact has increased significantly in the last century. For these reasons, significant efforts are going to be produced at the national and EU scales, either at the governance level¹ and by deploying the most advanced technologies.

Major benefits for protecting CI and enhancing the continuity of services they deliver could come from the deployment of technological systems providing access to crisis related data, allowing their monitoring and, whenever possible, the prediction of their occurrence, allowing the setup of timely preparedness and mitigation actions. A relevant role in this context could be played by Decision Support Systems (DSS). These are technological tools that can be functional to support the whole risk analysis process up to crisis management, in the preparatory and the hot phases.

A new concept of DSS should account for, and support, all phases of the risk analysis process: event forecast (where applicable/predictable), prediction of reliable and accurate damage scenarios, estimate of the impact that expected damages could have on services (in terms of reduction or loss of the services) also accounting for perturbation spreading via cascading effects, estimate of the possible consequences to citizens and to other sectors of societal life. The complete DSS workflow should end up with the identification and definition of preparedness and emergency strategies that, taking into account the different phases of the expected crisis (event, damage, impact and consequence) could be adopted to reduce the impact, speed-up mitigation and healing procedures, ease the recovery phase, thus reducing as much as possible the extent, the severity and the duration of the crisis.

Such new concept of DSS can also be used as effective simulation tools to perform comprehensive stress tests on areas where the impact deriving from CI crises could be large and relevant. This activity would produce educated contingency plans based on the analysis of many (synthetic) crisis scenarios instead of being built upon (a few, when available) records of historical events. This will enhance their quality and adapt them to the effective current scenario conditions (in terms of infrastructures, assets, available technical tools, current settings of the crisis or emergency management etc.).

The EU project CIPRNet² has thus devoted a considerable effort to realize an novel DSS enabling to tackle the entire workflow of risk forecast of CI, from event prediction to consequences analysis.

The DSS can be supported by a large database of information collected from public and private sources. Furthermore, the DSS collects many different real-time data from the field (meteorological stations, sensor networks, meteorological radars, etc.) and forecasts from several publicly available sources (Meteorological Office, Earthquake alerts systems, etc.) producing a comprehensive assessment of the physical state of the area (urban, district, regional up to a national scale).

The availability of the geographical position (in terms of geospatial data) of the CI elements and the networks would allow, through the correlation between the physical vulnerability to natural events and the strength of expected event manifestation, to formulate an educated guess of the probability that some of the CI elements could be physically damaged by a perturbation. This analysis would thus allow to produce a “damage scenario” containing location and probability of predicted faults.

Starting from the “damage scenario”, the DSS will attempt, through the analysis of appropriate simulation tools, to emulate the outages on the affected networks and, through the CI dependency information, to reproduce the effects of the cascading events propagating faults from one network to the others. This task would result in the “impact scenario”, i.e. the expected profile of services unavailability over time for all the considered infrastructures.

Such data would further allow to estimating the consequences that services unavailability might produce on the different societal sectors. This is the goal of the “consequence analysis” which is meant to transform the “impact scenario” into a prediction of the social severity of the crisis, by measuring, through appropriate metrics, the consequences associated to the population, the industrial activities, the primary services (Hospitals functionality, schools, public offices, public transportation) and the environment (in the case when a CI crisis is associated to some type of an environmental damage).

The last step of the DSS would be the elaboration of an optimal strategies for the systems recovery by analysing possible “recovery sequences” of the different elements: the sequence “score” is evaluated in order to reduce as much as possible the social costs of the crisis.

The project CIPRNet has introduced all these elements into the DSS which has been designed and realized as one of the major outcomes of its joint technological activities. The DSS was called CIPCast. We will refer to this name in the course of this work when considering the CIPRNet DSS.

In order to cast all the expected DSS properties and functions, we tried to translate the expected functionalities into a number of prescriptions, of practical issues and of technological requests to the DSS for enabling the implementation of those functions. These are the major key-words which have been translated into related functionalities of the DSS.

The design of CIPCast has taken into account all the issues that have been previously listed. Figure 1 shows the main functional blocks B_i of CIPCast and the relevant components i.e. the Database and the Graphic User Interface (GUI). In the following we will briefly describe the five functional blocks which will be better analysed in the further Sections.

Prediction of Impact and Consequences (B4). This block converts the expected damages of CI elements into impact on the services the CI elements produce. This is the core of the prediction process as, in this block, the DSS transforms the expected punctual damages (to one or more CI) into a reduction (or loss) of services. To do that, CIPCast needs to deploy dependency data connecting the different CI in order to reproduce faults propagation. In addition, starting from the inoperability (or partial operability) of the different services, this block also estimates the consequences that the loss of services produces on citizens, public services, industrial activities and the environment. The consequences on each societal sector are estimated on the basis of specific metrics; a distinct “consequence score” on each societal life domain is presented separately (a unified score is not produced) in order to describe the severity of the expected crisis under many viewpoints.

Support of efficient strategies (B5). This block contains a number of applications which, taking into account the expected critical scenario, made by damages, impacts on services and weighted by the consequences estimate, will attempt to support operators and emergency managers to design and validate mitigation and healing procedures. At the current state of implementation, these supporting actions relates to:

In the following, we will describe, in some more detail, each of the relevant elements of the DSS and the technical contents of the different blocks Bn_i.

The geospatial Database (DB) and the related modules (GIS Server and WebGIS application) has been implemented by adopting a client-server architecture, using Free/Open Source Software (FOSS) packages. Such architecture has been properly designed to allow the interchange of geospatial data and to provide to the CIPCast users a user-friendly application, characterised by accessibility and versatility. The DB is a PostgreSQL object-relational database with PostGIS spatial database extender. PostGIS adds support for geographic objects allowing location queries to be run in SQL. The DB can be used at various levels by exploiting the potential offered by GIS tools, starting with the effective support for the operational management in the frame of the risk assessment workflow.

Data contained in the DB are classified according the following scheme:

Concerning the Input data, the DB contains the following geographical information layers. Concerning with Static Data, the DB contains:

Concerning with Dynamic input data (i.e. data which are collected by field sensors, which are constantly updated), the DB contains:

Concerning with Forecast data, the DB contains:

The GIS Server represents the hardware/software environment that allows organizing information and making them accessible from the network. The GeoServer suite has been adopted, being a largely used open source application server, which plays a key role within the Spatial Data Infrastructure (SDI). It allows sharing and managing (by means of different access privileges) the information layers stored in the DB, according to the standards defined by the Open Geospatial Consortium (OGC), such as, for example, the Web Map Service (WMS). It also supports interoperability (e.g., reads and manages several formats of geospatial data) (Fig. 2).

The basic geospatial data and the results produced (i.e., scenarios) are stored and managed into the DB repository in order to be exploited in the different DSS blocks. To this end, the WebGIS application developed represents the natural geographical interface of CIPCast. Basic information, maps and scenarios can be visualized and queried via web, by means of standard Internet browsers and, consequently, the main results can be easily accessible to CIPCast users.

In order to predict the external scenario, CIPCast has been configured to acquire external information by collecting real time data from field sensors. In particular, it acquires field data from:

Concerning seismic and earthquakes data, given as initial assumption that no real prediction can be achieved for these types of events, CIPCast receives data from the Agency committed to release this information (e.g., the National Institute of Geophysics and Volcanology INGV³ in Italy). In the INGV official site, by accessing the Italian Seismological Instrumental and Parametric Database (ISIDE) portal,⁴ information on the detected earthquakes are produced and released in real time. Upon a constant poll to the ISIDE portal, CIPCast receives the earthquakes data (within 1 min from the occurrence). Earthquake information consists of the GPS coordinates of the epicentre, its depth and the measured intensity (Richter scale). Figure 3 reports a typical snapshot of the ISIDe website.

Once earthquake data are issued, the CIPCast crawler picks them up and reports them into the synoptic chart of the DSS geographical interface (Fig. 4). The knowledge of the coordinates, the depth and the magnitude of the earthquake (basic earthquake’s features) are not sufficient to estimate the “physical manifestations” associated to the natural event. Indeed, an earthquake creates distinct types of waves with different velocities; when reaching seismic sensors, their different travel times allow to locate the source of the hypocentre:

In the case of local, or nearby, earthquakes, the difference in the arrival times of the P and S waves can be used to determine the distance of the event. Once ISIDe operators perform their validation procedures, data of the occurred earthquakes are immediately available: based on the basic earthquake’s features, CIPCast is able to convert them into a Shake Map dataset which contains, for each spatial point of a given area (as large as that involved by the physical manifestations associated to the event), the Peak Ground Acceleration (PGA) distribution induced by the seismic event.

Figure 5 shows an example of a shake map.

Other than being estimated, shake maps are usually measured by seismometers deployed all over the Italian national territory (data are first collected and then post processed by INGV) and then released by the INGV through the specific information websites. This process normally takes about 20–60 min. In order to have an earthquake shake map available in a shorter time (in order to use them for rapidly estimating expected damages), CIPCast, starting from the basic earthquake features, estimates the “predicted shake map” on the bases of empirical propagation models of shock waves in the ground and of the specific ground seismic properties (lithography and waves conductivity properties). Then, when measured shake maps are released, CIPCast perform a second damage estimate.

Concerning weather predictions, CIPCast can deploy either medium-long term weather prediction (from 12 to 72 h) from Weather Forecasts official sources and nowcasting predictions (up to 60 min from the current times) provided by X-band radars. Regarding the nowcasting source, CIPCast receives (each 10 min) the current estimate of rain abundance and its prediction (estimated with a Local Area Model) for a time span of 60 min. The nowcasting data could be constituted either by the mosaic of several stations operating in specific points (at a national scale), mosaic which is then composed to obtain an unique picture or by a single station sweep that covers, in turn, a limited area (usually a single nowcasting station can cover an area of 20–30 × 10³ km²).

In the current setting, nowcasting is produced by using data of a single station (a meteorological X-band radar station) at Mount Media (in the Apennine region, nearby the city of L’Aquila) whose data covering a large fraction of Centre Italy fully comprising the Lazio Region. Data are constantly acquired and treated to extract information. From the reflectivity signals, it is possible to estimate the rain amount. These data are then post-processed in order to obtain the rain abundance prediction in a grid of 1 km of spatial resolution, for the subsequent 60 min from the current time. The resulting data (Fig. 6) are then integrated into the CIPCast DB and used to estimate the resulting damage of the CI elements.

Same data used for nowcasting prediction scan be used to provide lightning prediction. To this aim, CIPCast (every 15 min.) acquires lightning probability data related to the next 45 min and visualises them on the GIS interface. The data source computes the lightning probability using various indices of the Weather Research and Forecasting model.⁵ In the current setting, the monitored area for lightning probability covers a large fraction of centre Italy fully comprising the Lazio Region. Figure 7 shows an example of a lightning probability map. Following the guidelines for lightning probability greater the 60% the CI operators should monitor their infrastructures and in particular those components that are vulnerable to lightning events.

To sum up, there are two events prediction based on:

At the end, CIPCast produces a comprehensive description of the current (and forecast) scenario, by providing a map of all the physical manifestations related to the predicted (and/or the on-going) natural events with their magnitude (each expressed in a specific strength metrics).

These information are then transferred to the further building block, where event’ manifestations strength are “transformed” into expected damages to the CI elements.

The first action is to cast the external prediction into a Threat Strength Matrix, containing the strength of the predicted physical manifestations associated to the expected natural events. Each natural hazard, in fact, manifests in a different way (winds with physical pressure exerted on the structural elements, heat waves with temperature raise etc.). If we normalize the value (expressed in the appropriate unit of measure) of the strength of each perturbation manifestation in an arbitrary scale from 1 to 5, we could define, for each geographical position, a Threat Strength Matrix describing the intensity of the associated manifestations.

Table 1 shows the Threat Strength Matrix S associated to a given geographical position (x, y). Each row contains the expected strength of the manifestation associated to the natural event.

Whereas geographical points will be characterized by the strength of the expected natural manifestation (cast into the Threat Strength Matrix), each CI element (located in some geographical position) will be characterized by a Vulnerability Matrix V, which identifies, for each perturbation manifestation, the limiting strength that the element could sustain before being damaged. The V Matrix will then have same entries of the Threat Strength Matrix; it provides, in turn, the limiting grade of the perturbation strength that the CI element can sustain before failure. If, thus, the \(V_{ij}\) element of the matrix will be different to zero, all other elements \(V_{i(j + k)}\) will be not vanishing: if \(V_{ij}\) strength perturbs (or damages) the CI elements, all larger strengths, a fortiori, will do.

Table 2 shows the Vulnerability Matrix V associated to a specific CI element. Each row contains the perturbation extent that a manifestation of a specific grade is expected to produce on the element. In general terms, the extent of physical damage D produced by a threat manifestations S on the CI element having a vulnerability matrix V will be given by where operation indicated with \(\cdot\) is the ordinary product between the values \({\text{s}}_{\text{ij}} ,{\text{v}}_{\text{ij}} \in {\mathbb{R}}\) of the two matrices. If \({\text{D}} = 0\) the CI element will not be harmed by the perturbation(s), while if \({\text{D}} \ne 0\) it will be damaged up to a certain extent (\(0 < D \le 1\)).

Figure 10 reports the WebGIS interface of CIPCast, containing various geospatial layers and the information on the expected Damage Scenario. CI elements are classified on the bases of the prediction time of their outage (red elements predicted to be failed in 15 min, darker-coloured elements at progressively longer times).

CIPCast, at this stage, run an application called RecSIM (Reconfiguration actions SIMulation in power grids [1, 2]) a simulator that, starting from the identification of the behaviour of the electrical-telecommunication system upon the outage of one (or more) of their components, spreads the perturbation also to other CI infrastructures. This approximation (that is similar to an adiabatic approximation while treating perturbations in quantum theory) is somehow legitimated by the fact that the response of the electro-telecom systems occurs with characteristic times much smaller than those of the other systems. In this respect, CIPCast first deals with fast degrees of freedom (electrical and telecommunication networks response) and then propagates the perturbation to other degrees of freedom (i.e. the other CI networks).

RecSIM is a discrete-time event-based Java simulator designed to emulate the network management procedures by an electrical distribution system operator and to estimate the evolution of the electric network. Although the implemented operations are related to a specific electrical operator,⁷ these procedures should be thought as general; they are, in fact, adopted by other operators for the reasons that they take into account only the basic functioning mechanisms of a switched and controllable electrical network. RecSIM assumes an electrical distribution model where each electrical node (a primary or a secondary substation) may feed a telecommunication device, called Base Transceiver Station (BTS) that, in turn, ensures remote control capability to the electrical grid.

Figure 11 sketches the main ingredients (i.e. the elements) needed to design an electro-telco grid used for the RecSIM modelling and simulation.

In a real electrical distribution network, as soon as a failure occurs, some actions are performed by specific automatic control systems. For instance, the protection systems open some switches in order to avoid the propagation of the failure as well as the damage of electrical components (e.g., electrical feeders). Within a delay of the order of milliseconds, there is usually an automatic reaction of the network to a failure (of a component or along the lines). This automatic reaction is instantaneous, so if the failure happens at time t₀ all actions performed by the protection systems will be performed at t₀. Soon after the perception of the fault, the electric operator will be notified alarms through the SCADA system and will try to isolate the failures as well as to reconfigure the electrical network to provide electrical power to those substations that might be involved in the blackout. The automatic reaction produces the blackout of an entire feeder containing electrical substations (from a few up to some tens, in the worst case). At this stage, the electric operator can usually perform one (or more) of the following actions:

In order to make use of the remote control capability, the operator should first verify the reachability of the remotely controlled devices (e.g., Remote Terminal Units or Programmable Logic Controllers) deployed in the substations and required to perform the opening and closure of breakers. At this stage, dependency mechanisms can play a crucial role. Indeed, the faulted electrical feeders can inhibit the power supply to some BTS. Considering the strong interdependency among electrical SS and telecommunication BTS, damages occurring in one (or both) network can cause disruptions that hold in the short time scale (from a few minutes up to some hours) leaving people without power and/or mobile communication services.

As mentioned, if remote control is available, the electric operator will send commands to close switches to re-energize part of the network. These actions usually take some minutes to be completed (e.g., 3–5 min). In case the SCADA system is not working or the devices cannot be remotely controlled, the electric operator must dispatch an emergency crew to manually perform reconfiguration action. In this case, emergency crew actions may require about 1 h to be completed (depending on the state of urban traffic). However, there are cases where no actions are available to re-energize part of the network. In such cases, the only possible option is to send one (or more) Power Generator to supply the Low Voltage (LV) line(s) usually supplied by electrical substations. The action of displacing a Power Generator and re-supplying a single Medium Voltage (MV) line may require some hours to be completed.

RecSIM takes into account all these procedures and the number of emergency crews and power generators available to the electric operator to estimate the evolution of the networks.

In order to use RecSIM to reproduce a generic electric network the following information about the electric network topology are required:

RecSIM can, on the basis of the available resources, optimize the sequence of restoration operations to be followed in order to produce the least consequences to citizens and/or to minimize the overall outage time. RecSIM allows the operator to autonomously design a strategy given by an ordered sequence of operations to restore the networks. In the latter, no optimization procedures are involved.

Operators are committed to release their services with a predefined Quality Level expressed, for instance, by using the Service Continuity Indicator measured in terms of “kilo-minutes of outages (kmin)”:where kmin is the sum of the products between the number of minutes of outages times \(T_{k}\) for each k-th SS and \(u_{k}\) is the number of electric customers fed by the k-th SS considered for the interval time of interest.

Figure 12 shows the Impact Scenario for a limited area of the electrical grid of Rome where it is possible to observe the SS affected by an electric outage.

Figure 13, in turn, indicates the best possible route to be followed by a technical crew to reach the site where a restoration operation should be executed. The path could also be determined as a function of the current or predicted state of urban traffic, by considering, in the shortest path algorithm, the different times needed to tread the different arcs of the city street graph. CIPCast is also connected to an application which, based on historical traffic data and the current real time data, can predict the state of traffic in the next 90 min. Traffic prediction can improve the quality of the identification of the shortest path (Fig. 13) to be suggested to the technical crew to move toward the site where the technical intervention should be produced.

After having defined the damages produced by a natural event or by a man-made incident and recognised the impacts that those damages might produce on the functioning of CI, the CIPCast system attempts to estimate, as the final step, the consequences produced on society by the events striking a given area.

It is worth noting that although we mostly refer to natural events, the same Consequence Analysis model could be usefully applied to any event (also of anthropic origin) on CI which produces an impact on their services.

In order to define the scope of the Consequence Analysis (CA hereafter) it is useful to point out that, in general, a natural event produces two types of consequences:

Taking an earthquake as a case study, for example, we will ascribe to the direct consequences the number of casualties (due to buildings collapse following the earthquake) and the economic cost needed to restore/retrofit (or rebuild) the damaged buildings. In turn, we attribute to indirect consequences the social and economic costs inflicted to the society by the unavailability (or partial availability) of the primary services (electricity, telecommunications, drinkable water, mobility etc.). Thus damages on CI elements produce impacts on their services which inflict consequences (of the class of indirect consequences) to societal life. Although CIPCast is able to consider both types of consequences, a major effort has been carried out to set up a model able to estimate the indirect consequences.

The first step of the Consequence Analysis has been the identification of the sectors of the societal life to be considered, in order to fully describe the indirect consequences inflicted by a crisis of CI services to those sectors and, for a given sector, to each sector’s element as well as to identify—for each sector element—the “consequence metric” C _i which better measures the extent of the consequences.

A thorough analysis has allowed to focus on the most vulnerable sectors prone to be damaged (in terms of well-being reduction, Wealth hereafter) by the unavailability (or a partial availability) of PS supplied by CI:

We can define the Wealth W(t, t _ij ) of a societal Sector element t_ij as a function of the available Services Q_k at time t as follows:where:

The elements r _k (t _ij ) are the measure of the relevance of the Service k for the Wealth achievement in a given Sector element. For this reason, they will be identified as Service Access Wealth (SAW) indices. They may be different from each other: a Sector element can be more vulnerable to the absence of a given PS and, thus, its Wealth most affected if that specific PS would fail. We then consider a closure relation, such as

It is worth noticing that a more accurate analysis would imply the use of a residual term (r _k (t _ij ) with k = N _k  + 1). This further term would account for the fact that for many societal Sectors, the eventual loss of all services would not imply a total loss of well-being. In other words, the loss of all Services, as a whole, will reduce of a different amount the Wealth of the different societal Sectors. Thus we would rewrite the closure relation in Eq. 2 by adding a further term which we would call “well-being residue”.

In a first approximation, r _k (t _ij ) are considered as time-independent, although their variation in time could be properly assumed (such as, e.g., the loss of a PS for an economic activity could be less detrimental during the night hours when production is stopped). The unitary closure constraint could be kept fixed even in the case of time variation of the SAW indices. For a discussion on the time-dependence of SAW indices see Appendix 1.

If Q _k (t) are all unitary, Wealth W is as expected. If, in turn, some Q _k (t) will be not unitary (or even vanishing) for some time during a period T, say, Wealth is expected to be reduced accordingly. Thus we can identify as Consequence C for a given Sector element in the time T of crisis duration the difference between the expected and the achieved Wealth

It’s worth pointing out that

The residue term represents the part of the Wealth which could not be attributed to the deployment of the Primary Services; if it is non-vanishing, it inhibits the possibility that the Consequence C becomes as large as the total Wealth (see Eq. 5).

The CA model requires the identification of two sets of data: the Wealth metric M(t _ij ) and the SAW indices r _k (t _ij ) for all the Sector elements t _ij . The Primary Services (PS) availability functions Q _k (t) are, in turn, the output of the Impact module of the system. Before considering the SAW indices estimate procedure, it is worth identifying the Sector elements that the model will consider for a complete assessment of societal consequences after a CI crisis (Table 3).

The evaluation of the SAW indices for the different Sector elements may require the use of different approaches (and data sources). Information about Citizens are provided by the National Institutes of Statistics (in Italy, ISTAT⁸) and could be refined by data provided by service Utilities. Information on economic sectors could be, in turn, obtained at the Chambers of Commerce or from trade category Associations or elicited by specific historical or ad hoc surveys.

To elicit the SAW indices for each Sector element, multiple data sources may be used, either alternatively or jointly.

It is clear that, being societal Sectors different from each other, the meaning of the term “relevance” (identifying the impact that the unavailability of a specific PS would have on each Sector) will be very different: we will span from discomfort to economic losses or to the threat of physical integrity. The chosen metrics M(\(t_{ij}\)) expressing the Wealth for a given Sector element will account for these issues. When M(\(t_{ij}\)) is an economic value (the production value for a given plant, for instance), the term “relevance” (and the associated SAW indices) will express the importance of a specific PS to allow the plant to achieve the planned production value. There could be, obviously, activities whose production is more related to the availability of electrical power (i.e. manufacturing), while in other cases it is more related to availability of telecommunications (i.e. digital commerce). This difference will reflect into the values of the corresponding SAW indices.

The following tables (Tables 4 and 5) report the relationships between the term “relevance” and the different Sector’s elements through the indication of the related Wealth metrics M(\(t_{ij}\)).

In the following, we will describe the way to approach the SAW indices identification from available data for two different Sectors: Citizens and Economic Activities. In the first case, a complete assessment of the indices will be provided, where the attempt to estimate time-dependency of relations will also be done.

Other than releasing “real time” prediction (i.e. in a 24/7 operational mode) by collecting external data from forecasts and field sensors, CIPCast can also be used in “off-line” mode. In this mode of operations, real external scenario could be substituted by synthetic events whose main manifestations are somehow introduced in the B1 block as if they were real. In this respect CIPCast can simulate synthetic events (it can currently simulate synthetic earthquakes and abundant rainfalls in specific area). This operation mode is called “Event Simulator”. This mode is meant to be used by operators and other Public Authorities for producing stress tests of their systems and/or to study contingency plans adapted to expected (or risky) events. This could enhance the ability of designing preparedness measures and contingency plans, other than revealing (upon quantitative analysis) infrastructural elements which could be able to trigger large faults if damaged. Figure 14 shows the disruption expected in the area of the city of Florence upon the production of synthetic earthquake in a nearby Apennines area.

A further CIPCast operation mode allows to insert punctual damages by hand, by the operator. Some CI element failure (belonging to one or more infrastructures) could be inserted and the Impact Scenario (with its Consequence Analysis) estimated accordingly. This operation mode (Damage Simulator) could be used to estimate the impact on services produced by types of damages which could hardly be thought as produced by specific natural events but could be rather related to intentional attacks (i.e. a patchy distribution of damages). Also in this case, CIPCast can be used to produce stress-tests, for highlighting elements whose fault could trigger an high impact on service(s). This can be particularly relevant for operators and authorities for planning appropriate actions for security enhancement of their assets.

CIPCast and its DB could act as a central system enabling to gather and to broadcast a number of relevant information, also through the use of innovative multi-media solutions. In the following we report the directions of a number of on-going project to support the usability of CIPCast contents and forecasts.

CI protection and the management of Emergency situation is a major concern of Public Authorities at all scales; from the national one, as severe blackout could produce extended and often uncontrolled perturbations, to the local (city) scales where lack of resilience (i.e. lack of preparedness actions) might result in frequent, albeit limited in space and time perturbations. These, however, could produce damages on citizen’s well-being, with associated economical costs, and moreover undermine citizens confidence in the public administration.

CIPCast belongs to a new class of DSS which attempts to act at three different levels:

Being usable in different operational modes (either fed with 24/7 real time data or by synthetic events of with synthetic damages), CIPCast could be a mean for stress-testing, planning, design of new generation networks and design of coherent contingency plans which could be the result of ad hoc simulations where realistic conditions could be reproduced.