ORI GIN AL PA PER

A Bayesian vulnerability assessment tool for drinkingwater mains under extreme events

Alessandro Pagano • Raffaele Giordano • Ivan Portoghese •

Umberto Fratino • Michele Vurro

Received: 25 July 2013 / Accepted: 14 June 2014 / Published online: 28 June 2014� Springer Science+Business Media Dordrecht 2014

Abstract Drinking water security is a life safety issue as an adequate supply of safe

water is essential for economic, social and sanitary reasons. Damage to any element of a

water system, as well as corruption of resource quality, may have significant effects on the

population it serves and on all other dependent resources and activities. As well as an

analysis of the reliability of water distribution systems in ordinary conditions, it is also

crucial to assess system vulnerability in the event of natural disasters and of malicious or

accidental anthropogenic acts. The present work summarizes the initial results of research

activities that are underway with the intention of developing a vulnerability assessment

methodology for drinking water infrastructures subject to hazardous events. The main aim

of the work was therefore to provide decision makers with an effective operational tool

which could support them mainly to increase risk awareness and preparedness and, pos-

sibly, to ease emergency management. The proposed tool is based on Bayesian Belief

Networks (BBN), a probabilistic methodology which has demonstrated outstanding

potential to integrate a range of sources of knowledge, a great flexibility and the ability to

handle in a mathematically sound way uncertainty due to data scarcity and/or limited

knowledge of the system to be managed. The tool was implemented to analyze the vul-

nerability of two of the most important water supply systems in the Apulia region (southern

Italy) which have been damaged in the past by natural hazards. As well as being useful for

testing and improving the predictive capabilities of the methodology and for possibly

modifying its structure and features, the case studies have also helped to underline its

strengths and weaknesses. Particularly, the experiences carried out demonstrated how the

A. Pagano � R. Giordano (&) � I. Portoghese � M. VurroIstituto di Ricerca Sulle Acque del Consiglio Nazionale delle Ricerche (IRSA-CNR), Bari, Italye-mail: raffaele.giordano@cnr.it

A. Paganoe-mail: alessandro.pagano@ba.irsa.cnr.it

U. FratinoDICATECh, Politecnico di Bari, Bari, Italye-mail: umberto.fratino@poliba.it

123

Nat Hazards (2014) 74:2193–2227DOI 10.1007/s11069-014-1302-5

use of BBN was consistent with the lack of data reliability, quality and accessibility which

are typical of complex infrastructures, such as the water distribution networks. The

potential applications and future developments of the proposed tool have been also dis-

cussed accordingly.

Keywords Bayesian Belief Networks � Drinking water supply � Vulnerability

assessment � Decision Support System � Physical hazards

1 Introduction

Protecting the ability to function of critical infrastructures (water, telecommunications,

energy, transport, etc.) is a serious social and economic responsibility for both military and

civilian leaders (Ezell 2007). The various services provided by critical infrastructures

include stable provision of healthy drinking water in urban areas, and this is of paramount

importance for economic, social and sanitary reasons. In particular, research on the

behavior of water supply systems under extreme events has become a central tenet of their

design and management (e.g., Shih and Chang 2006; Lindhe 2010). The analysis of their

susceptibility to threat scenarios, namely their ‘vulnerability,’ is fundamental both for

optimizing infrastructural design and maintenance and for managing emergencies (e.g.,

Christodoulou 2011; Fragiadakis et al. 2013).

An ‘extreme’ event is characterized by high intensity and low occurrence frequency,

and adverse impacts are considered disasters when they produce widespread damage and

cause severe alterations in the normal functioning of communities or societies (e.g., IPCC

2012 referring to climate extremes). In the present work, we define an ‘extreme’ event for a

drinking water infrastructure as an hazardous event able to determine significant conse-

quences to the health of exposed people. The transition from a natural disaster to a

humanitarian tragedy is found to be dependent on several issues, namely natural, eco-

nomic, political factors, awareness and preparedness (Ismail-Zadeh and Takeuchi 2007).

In this present activity, the concept of vulnerability results from the definition of risk

provided by UNDRO (1979). Risk can be expressed as a combination of ‘hazard’ (the

probability, within a specific period of time in a given area, of a potentially damaging

phenomenon occurring), ‘vulnerability’ (the degree of loss to given elements resulting

from the occurrence of a given phenomenon) and ‘element at risk’ (population, buildings

and engineering works, activities, services, utilities and infrastructures at risk in a given

area). Vulnerability analysis is recognized as a fundamental tool in making rational

decisions on how best the effects of potentially disastrous natural events can be mitigated

through proper planning or through a system of permanent controls.

The key to performing a reliable vulnerability assessment is based on a complete

identification of potentially occurring hazards, but also strongly depends on the ability

to correctly detect the main features influencing the behavior of the system under

investigation (Al-Barqawi and Zayed 2006a, b; Liu et al. 2012). Generally, an estimate

of risks, and of the effects of risk-reduction measures, requires detailed modeling of the

system and of its component parts. Indeed, a model based on a good understanding of

the system with a solid theoretical foundation can be of great use in decision making

(Lindhe 2010).

2194 Nat Hazards (2014) 74:2193–2227

123

Hazardous events typically occurring in water supply systems are classified mainly as

natural (such as earthquakes, hurricanes, volcanic eruptions, landslides, fires) or anthropic

(both intentional and accidental, such as pollution, operational mistakes, blackouts).

Referring to the potential consequences on the water system, physical damage consisting in

the breakage or malfunctioning of one or more elements should, on the whole, be dis-

tinguished from resource quality alteration (Haestad Methods et al. 2003). Comprehensive

hazard reviews were proposed by Grigg (2003) and Beuken et al. (2008a), referring to

hazards potentially affecting water quantity and quality. We decided to propose a simple

classification, referring to two hazard classes:

• Physical hazards associated with potential damage to elements of the infrastructure

leading to limitations on water quantity.

• Chemical, biological, radiological (CBR) hazards connected with the possible

contamination of the resource and leading to quality problems.

In both cases, the potential occurrence of natural events (earthquakes, landslides, floods,

etc.) as well as of anthropogenic actions (both intentional, such as terrorist acts or sabotage,

and accidental) should be considered.

Although the research activities globally refer to both hazard classes, the vulnerability

assessment methodology proposed in the present work is discussed only referring to the

case of physical hazards and, particularly, on the resulting vulnerability of the water mains.

Figure 1 below proposes a synthesis of the main concepts associated with risk assess-

ment with specific reference to water supply systems.

In the context of famous natural events involving water systems which have occurred

worldwide, it is worth recalling the Loma Prieta earthquake of 1989 during which 507

pipeline breaks and major leaks occurred in the San Francisco Bay area (California, USA);

the Chi-Chi Taiwan earthquake of 1999 which did serious damage to water delivery

pipelines, treatment plants and reservoirs, similar to those experienced during the devas-

tating Kocaeli and Duzce earthquake (1999) in Turkey; the ‘Great flood of 1993’ which

destroyed an aqueduct serving 250,000 in Iowa (USA); the Indonesia Tsunami of 2004

which, besides severely damaging drinking water infrastructures, placed over 500,000

displaced persons at increased risk of waterborne disease due to resource contamination.

Such experiences revealed the need for simple and effective vulnerability assessment

techniques capable of helping decision makers in the different phases of emergency

management, namely preparedness, management and recovery, and to select the best

strategies and find optimal solutions for reducing the risks and limiting the damages on the

infrastructures and the local population.

A series of severe natural disasters that recently occurred in Italy (earthquakes in

Abruzzo and Emilia, extreme floods in Liguria and Sicilia, landslides in Puglia), with

significant consequences on water systems, underlined once more the pressing need for a

functional and effective framework for vulnerability assessment and emergency manage-

ment. The Italian Department of Civil Protection (Dipartimento della Protezione Civile—

DPC), which is responsible for actions during any contingency when people’s safety is at

risk, acknowledged significant operational problems during these events, mainly due to the

low quality and reliability of ready-to-use data and the absence of tools and protocols for

supporting decision making.

Starting from these premises, a research project is being developed by the Water

Research Institute of the National Research Council (Istituto di Ricerca Sulle Acque del

Consiglio Nazionale delle Ricerche IRSA-CNR), supported by the Italian DPC, with the

aim of defining a strategic Decision Support System (DSS) for efficient and coherent

Nat Hazards (2014) 74:2193–2227 2195

123

decision making in the three aforementioned phases of the emergency management for

what concerns drinking water systems. This work describes the module of the DSS aiming

to support the network vulnerability assessment and, thus, to facilitate the preparedness

phase. Hence, this module aims to identify the main reasons of network vulnerability and

to select the most suitable actions that could contribute to reduce such vulnerability. The

developed module is based on Bayesian Belief Networks (BBNs), a semi-quantitative

probabilistic tool capable of integrating a range of variables and parameters. It also rep-

resents an easily implementable technique in case of lack of detailed data and information,

which is typical of water supply systems. Differently from other infrastructures, water

distribution networks are mainly buried underground and, in most of the cases, they were

developed in several time steps, and the documentations containing the needed information

for a detailed vulnerability assessment are fragmented and incomplete. The accessibility

and usability of this documentation results often very limited. Therefore, as discussed in

the following sections, the adoption of BBNs in this work was justified by several reasons,

but mainly for properly managing the uncertainty due to lack and incompleteness of

information. To this aim, different kinds of knowledge, i.e., scientific and expert judg-

ments, were integrated in the BBN.

In the present paper, the methodological approach adopted is firstly analyzed, starting

from the main features and applications of BBNs (Sect. 2). Furthermore, the technical

process of model development is described in detail (Sect. 3) with particular attention

paid to the process of knowledge elicitation and structuring. Since it is well known that

expertise often represents a major part of the available information, the integration of

different knowledge sources performed during the model building phase is discussed.

BBNs were developed through the modeling shell NeticaTM by Norsys, and their main

features are discussed in Sect. 4. Then, at the end of the conceptual model building stage

and once the BBN were defined, the practical usefulness of the tool as an emergency

DSS is also investigated and specifically proved through real case studies (Sect. 5).

Finally, in Sect. 6, the main potential and drawbacks of the proposed methodology are

discussed.

Anthropogenic – Terrorist acts Planning strategies

Natural – Earthquakes floods

Anthropogenic Terrorist acts,sabotages, accidental actions, etc.

EXTREME

EVENTS

Hazard analysis

Planning strategies

AZ

AR

D

Natural Earthquakes, floods,landslides, etc.

Hazard analysisand reductionH

Y

SK RA

BIL

ITY

WATER

SUPPLY

Planning and Management

Physical vulnerability:Infrastructural damage

Emergency response

RIS

VU

LN

ER

CBR vulnerability:Resource contamination

SUPPLY

SYSTEMS Vulnerability analysis and reduction

VA

T Planning and Emergency

EM

EN

T A

RIS

K POPULATION

EXPOSED

Number of users subjected to water shortage or quality reduction Exposure analysis and

Management response

EL

E p yreduction

Fig. 1 Graphic synthesis of the risk analysis process for water supply systems

2196 Nat Hazards (2014) 74:2193–2227

123

2 State of knowledge

Several research projects have been carried out worldwide in order to deal with risk-

vulnerability issues on water infrastructure. These include the European research project

TECHNEAU, which is directly related to risk assessment and risk management themes.

The main issue underlined was that risk assessment procedures of the single components of

a water system should be integrated into a comprehensive decision support framework for

cost-efficient risk management of safe and sustainable drinking water supply (Rosen et al.

2007; Lindhe 2010). A holistic view of the water supply system is therefore needed for

effective risk management since hazards in one part of the system may lead to conse-

quences in other parts. A solid framework of risk management procedures and methods

was presented in a series of reports (see, for example, Rosen et al. 2007; Beuken et al.

2008a; Hokstad et al. 2009) in which BBNs were recognized as highly useful tools for

developing risk analyses in water systems (Beuken et al. 2008a, b; Goulding et al. 2012).

Despite some methodological differences between different risk-vulnerability assess-

ment techniques, a common approach was found based on three steps (Hokstad et al.

2009): (a) definition of the aims of the analysis and of the main features of the system, also

interacting with stakeholders such as water utility owners, safety managers, consumers,

municipalities and health Authorities; (b) hazard analysis mainly through brainstorming

sessions, past experiences and checklists (among others, Grigg 2003; Beuken et al. 2008a,

created an exhaustive hazard database for natural and human-related threats on drinking

water delivery infrastructure); (c) risk-vulnerability estimate methodology.

Most of the available methodologies are based on the analysis of specific elements of a

water system exposed to a fixed hazard. Specifically, much work has been done on the

assessment of water mains performance subjected to seismic action. For example, Li et al.

(2006) proposed a seismic hydraulic analysis, Shih and Chang (2006) derived fragility

relations between PVC pipes and earthquake parameters, Kakderi et al. (2011) described

methods to evaluate the seismic performance of water and waste-water systems through

several indicators for single components and for whole systems.

Other risk categories, such as landslides, were dealt with in academic papers as well,

although the need for further research on this topic has been underlined (Geertsema et al.

2009). Additionally, Binaghi et al. (2004) configured a neural model capable of learning

the displacement mechanisms in instrumented sites in order to predict displacements in

areas crossed by underground pipelines.

Nevertheless, Marzocchi et al. (2012) argued that classic strategies of risk evaluation

have some significant drawbacks such as difficulties in evaluating and comparing risks of

different origin and the assumption of the independence of different hazards which may

also underestimate the impact of extreme events. The role of new techniques, although still

not widely used, namely qualitative or semi-quantitative probabilistic approaches, should

therefore be emphasized (see, for example, Rosen et al. 2007; Lindhe 2010).

Choosing the most suitable approach is connected to the aim of the analysis (level of

decision, operational or strategic) and the complexity of the problem and is conditioned by

data availability (Rosen et al. 2007). In particular, qualitative methods aim to define

relative risk levels through words or classes, whereas quantitative tools express numerical

risk values. Nevertheless, quantitative tools usually require more resources in building the

model and collecting data, although more detailed data are generally provided. Quantita-

tive or semi-quantitative methods are typically used when the system analyzed is complex

and in order to facilitate comparison with other risks and acceptable levels of risk in

absolute terms (Lindhe 2010). Selecting the best approach, however, also depends on the

Nat Hazards (2014) 74:2193–2227 2197

123

quality of available information, which is frequently affected by uncertainty (consider, for

example, the uncertainty on actual condition and breaking mechanisms of buried infra-

structure underlined by Kleiner and Rajani (2001), Rajani and Kleiner (2001) and Liu et al.

(2012).

A quantitative model of the uncertainty in the failure frequency of gas pipelines is

available in the literature (Cooke et al. 2003). This uncertainty is modeled as a function of

several observable pipeline and environmental characteristics, and based on the integration

of expert judgment, in order to develop a ranking tool for pipe sections. The tool is able to

predict failure frequencies per kilometer year and gives uncertainty bounds.

In the context of semi-quantitative techniques, Ezell (2007), for example, developed an

infrastructure vulnerability assessment model (I-VAM) based on the definition, by subject

matter experts, of value functions for each possible measure, for each component of the

system. The component-based approach fails to provide vulnerability metrics on a node-to-

node basis since it does not enumerate the various paths in a network and it does not

incorporate the hydraulic model of the network. The work by Karamouz et al. (2010a, b) is

worthy of note too. The vulnerability of the whole water supply system was calculated

following the approach by Ezell et al. (2000) as the sum of the subsystems’ vulnerabilities

representing a combination of several parameters chosen and evaluated by experts. A

strategic planning scheme and a driving force, pressure, state, impact and response

(DPSIR) methodology have been adopted for identifying the main internal and external

factors affecting the system, thus helping to establish suitable strategies. In any event, the

most simple and, perhaps, the most widely used approach is based on risk matrices used to

rank the risks related to a range of hazardous events (PAHO-WHO 1998; KDHE-BOW

2003). Other applicable techniques (details are provided by Hokstad et al. 2009) are failure

mode effects and criticality analysis (FMECA), fault tree analysis (FTA), event tree

analysis, Markov analysis and, particularly, Bayesian Belief Networks.

The importance of expert judgment elicitation techniques, particularly in hazard

assessment and risk management problems, was underlined in several studies. An inter-

esting contribution was provided by Aspinall and Cooke (1998) who proposed a formalized

procedure for eliciting expert judgment in real-time crisis management due to volcanic

hazard. The method performed a weighted combination of expert judgments and revealed

very successful for decision makers in handling key issues. The structured elicitation

methodology was used also for the reassessment of the long-term outlook at the volcano,

providing consensus probability values to the different branches of event trees for different

potential eruptive scenarios. Such trees became increasingly detailed and complex as the

eruption progressed. The most attracting features of the procedure are undoubtedly its

implementation effectiveness and the capability of overcoming knowledge discrepancies

and illogicalities. Furthermore, the model is based on a dynamic structure and on the

ability of interpreting complex phenomena during their temporal evolution. This means

that the model is built, modified and developed during the event, as a function of the

specific occurrences. Probability trees are updated as circumstances demand. Regular

assessments of the scientific team’s ‘comfort’ with the current alert level are fundamental

for optimizing decision making as well as for identifying all possible scenarios, the

hierarchy of perceived hazards, keeping track of the uncertainties in the problem.

Despite a still limited application in risk-vulnerability analyses in the water sector (see,

for example, Beuken et al. 2008b), BBNs may emerge as particularly useful in relation to

their numerous interesting features (Aguilera et al. 2011). A BBN is a probabilistic graphic

model and, more specifically, a statistical multivariate model for a set of variables (Jensen

and Nielsen 2007), defined in terms of qualitative (a directed acyclic graph, DAG,

2198 Nat Hazards (2014) 74:2193–2227

123

constituted by nodes, links and conditional probability tables) and quantitative components

(a conditional distribution for each variable, defining the strength of the conditional

relationship with parent variables). Nodes are basically system variables, both discrete and

continuous chance, characterized by a set of possible states representing the conditions that

they might potentially occupy. Links define causal connections between nodes. A node that

has no links to any other variable is named ‘parent’ and the user is expected to define its

state, whereas the destination node of two or more links is termed ‘child’ node. Conditional

probability tables (CPTs) quantify the strength of a link between nodes based on Bayes

theory of probability and represent the key in correctly building a BBN (Bromley 2005).

BBNs are flexible and dynamic tools since they are able to automatically update

knowledge and results (Ordonez-Galan et al. 2009) in addition through the adoption of

learning algorithms (Li et al. 2010). Furthermore, they allow powerful integration between

expert and scientific knowledge, which can guide the model to focus on the most important

features or to find inconsistencies or differences with respect to established theoretical

properties (Batchelor and Cain 1999; Cain 2001; Wang et al. 2009). In particular, the role

of expert judgment has been widely discussed in the literature (Langseth and Portinale

2007) and many applications have confirmed its usefulness in helping assess which evi-

dence is limited or inconclusive, making the published and unpublished knowledge and the

wisdom of experts explicit and serving as a basis for action when problems are too urgent

or stakes too high to postpone measures until more complete knowledge is available. BBNs

are able to incorporate expert knowledge via a participatory modeling procedure (Uusitalo

2007). This potential has also been underlined by Bromley et al. (2005) and Pollino et al.

(2007) as the possibility of working with both huge and limited datasets. Krueger et al.

(2012) examined in detail the formal use of expert opinion too, underlining that expert data

should be treated like any other data, including the propagation of associated uncertainties.

Such data are fundamental as it allows the knowledge base of models to be widened.

The most significant technical features that make BBNs particularly useful for risk-

vulnerability analysis have been summarized by Wang et al. (2013): the combination of

qualitative and quantitative aspects; the possibility of reversal inference (from results to

causes) and the ease with which influencing factors can be ranked; their strong learning

ability; the combination of data with domain knowledge; prediction accuracy even with

rather small sample sizes. Furthermore, BBNs can be used to analyze the complex systems

and complex interactions that typically occur during extreme events (Peng and Zhang

2012; Li et al. 2010). At last, it should be underlined that nodes in BBNs are modeled by

means of probability distributions, thus allowing a more accurate estimate of risk and an

explicit propagation of uncertainty (Uusitalo 2007; Aguilera et al. 2011). As information

accumulates, knowledge on the true value of the variable usually increases, i.e., the

uncertainty of the value diminishes and the probability distribution grows narrower (Uu-

sitalo 2007). BBN can therefore operate with different levels of detail, directly taking into

account the uncertainty associated with input variables. Input data completeness, afford-

ability and reliability, which represent a serious problem in risk management activities, can

thus be properly taken into account. The results provided by BBN simulation could be

useful to support the phases of awareness raising and preparedness. In general, the more

detailed and precise the input data are, the more accurate and reliable will be the results.

Such features also contribute to making BBNs particularly effective for the building of a

Decision Support System (DSS) which is the fundamental objective of the present study. In

particular, the possibility of modeling the relationships between variables, even if they

involve uncertainty, unpredictability and imprecision (Batchelor and Cain 1999), is a basic

challenge for decision makers mainly for correctly evaluating the effects of strategies on

Nat Hazards (2014) 74:2193–2227 2199

123

specific scenarios. As well as the mathematical aspects of BBNs, such tools can be also

highly useful since they promote an improved understanding of the system being modeled,

always taking into account the role of new factors which are relevant for the decision (Cain

2001).

The adoption of Bayesian Belief Networks allows the definition of a fixed general

structure for the model and can be used for mapping vulnerability levels on a typical water

supply system. The model is not built during each event, but simply characterized through

the states of input variables for the investigated infrastructure. A method for emergency

management, such as that by Aspinall and Cooke (1998), is characterized by a dynamic

temporal nature, whereas the Bayesian method adopted in the present work is ‘static,’

aiming at characterizing system’s conditions in specific time frames. Although the tem-

poral evolution of phenomena can be also modeled through Dynamic Bayesian Belief

Networks, this is beyond the aims of the present activity. Differently from Bayesian

Networks, the approach by Aspinall and Cooke (1998) is only based on expert judgment.

Bayesian Networks, instead, are capable of integrating different sources of knowledge and

information, as it will be discussed in the following. This is fundamental, since several

information on vulnerability mechanisms and on the behavior of drinking water infra-

structures is available.

Object-oriented Bayesian networks (OOBNs) are an advance on traditional BBNs based

on object-oriented programming (Molina et al. 2010). OOBNs are hierarchical descriptions

of real-world problems that mirror the way in which humans conceptualize complex

systems. According to the Authors, OOBNs are particularly able to consider the uncer-

tainty in every variable of the model through the implementation of the CPTs, to make the

modeling environment more user-friendly, and to integrate and represent together eco-

nomic, physical, social and other variables (Susnik et al. 2013). Practically, an OOBN

represents a number of networks that can be linked together such that it is possible to

transfer information from one to the other (Molina et al. 2011). Common variables are

identified and used as inputs for each individual BBN and then aggregated in a joint output

network. Such approach was found to be really useful in the field of water resources

management (Castelletti and Soncini-Sessa 2007; Pollino et al. 2007; Carmona et al. 2011;

Henriksen et al. 2012). As it will be discussed in the following, the OOBN approach

revealed particularly useful in the present activity, mainly in order to identify, isolate and

characterize each specific mechanism affecting the global vulnerability assessment. The

whole model domain is thus conceptualized into subdomains, and linkages from variables

in one subdomain to other subdomains are identified and modeled (Molina et al. 2010).

3 Model building

3.1 Aims and scope

The main objective of the research activity is to develop a probabilistic tool (DSS) for

performing a vulnerability assessment of water supply systems in order to prioritize risk

levels, locate weak points, identify potential problems of the infrastructure and risk sce-

narios and thus correctly identify the main actions to reduce infrastructure vulnerability, to

ease the emergency management, and, finally, to recovery the infrastructure. The DSS is

then composed by three main modules. The module described in this work aims to support

water utilities and decision makers to identify the most vulnerable elements of the network,

explain the role of specific features influencing vulnerability levels and thus assisting the

2200 Nat Hazards (2014) 74:2193–2227

123

managers in the selection of the most suitable strategies to reduce infrastructure’s vul-

nerability toward different hazards.

The following sections describe the different phases for developing this module of the

DSS.

3.2 Knowledge elicitation and structuring

Knowledge is generally available in many forms, distributed throughout academic work,

technical reports and the minds of experienced individuals, and is characterized by a

variable degree of reliability (Wang et al. 2009). One of the typical problems encountered

when working in the water management field is the quality of the available information

which depends both on data reliability and on the fragmentation level of the existing

knowledge. Referring specifically to the scope of application of the present work, such

problems are much more evident since extreme events are uncommon, complex and dif-

ferentiated and particularly subject to knowledge dispersion phenomena. Therefore, the

collection and organization of expert knowledge can help in correctly defining and iden-

tifying complex problems. The combination of expert knowledge with other information is

used in many different areas such as risk analysis and reliability analysis (Page et al. 2012).

Although there are benefits to be derived from the use of expert knowledge, several issues

need to be addressed, such as expert selection, the aggregation of opinions, expert bias and

uncertainty (Krueger et al. 2012). In this work, expert knowledge and opinions were used

to fill gaps concerning the characteristics of the water supply system leading to high

vulnerability degree toward extreme events.

In the present activity, the knowledge of a group of experts, both engineers and

researchers working in the field of water management, was collected and represented a

basis for model building. Among the different knowledge elicitation methods, we selected

the one-to-one interview, because it allowed continuous feedback among interviewer and

interviewee (Page et al. 2012). In the following Table 1, a comprehensive list of the

experts involved in model building and validation is provided.

Several methods were used in order to avoid the most common sources of biases in

expert knowledge elicitation. Firstly, the impacts of interviewer’s problem framing on the

elicitation problem were reduced by involving few researchers in developing the frame-

work of the interview. This reduced the subjectivity level in the formulation of questions.

The availability issue—i.e., the tendency of experts to overestimate the likelihood of

events they had recently experienced—was lessened by making the experts aware of the

phenomenon and the scope of the study well in advance (Page et al. 2012). Each interview

started with a brief discussion to clarify the objectives of the activity, thus properly

focusing the aim of the DSS.

The results of the literature review concerning the vulnerability of water supply

infrastructures were used to develop the first draft of the conceptual model representing the

cause-effect chains linking the infrastructure characteristics to the vulnerability. Experts

were then asked to change the conceptual model, adding or deleting variables. The indi-

vidual conceptual models were aggregated to obtain the experts’ model. The process of

individual models aggregation ended when no new concepts and/or relationships emerged

after a number of interviews (Ozesmi and Ozesmi 2004).

Once the aggregated conceptual model was developed, experts were asked to weight the

different elements in conceptual model according to their relative importance in deter-

mining the system vulnerability. We assumed that the higher was the importance degree

assigned by the experts and the higher was the contribution of the elements to system

Nat Hazards (2014) 74:2193–2227 2201

123

Ta

ble

1L

ist

of

the

stak

eho

lder

sin

vo

lved

inm

od

elb

uil

din

gan

dv

alid

atio

n,

and

des

crip

tio

no

fth

eir

role

Sta

keh

old

erT

yp

eN

um

ber

of

un

its

Inv

olv

emen

tP

arti

cip

atio

nle

vel

Info

rmat

ion

pro

vid

ed

DP

CT

echnic

ians

4M

odel

cust

om

eran

duse

rin

emer

gen

cyco

nd

itio

ns

Conce

ptu

alm

odel

buil

din

gan

dd

iscu

ssio

no

fre

sult

sO

bje

ctiv

esof

the

acti

vit

y,

char

acte

riza

tion

of

the

met

ho

do

log

ical

app

roac

h,

dis

cuss

ion

and

ver

ifica

tio

no

fth

ere

sult

s

IRS

A-C

NR

Res

earc

her

s6

Mo

del

bu

ild

eran

du

ser

Mo

del

bu

ild

ing

,m

od

elte

stin

g,

mod

elim

ple

men

tati

on

and

cali

bra

tion

Po

siti

ve

and

neg

ativ

eas

pec

tso

fth

em

ethodolo

gic

alap

pro

ach,

iden

tifi

cati

on

of

var

iab

les

and

wei

ghti

ng

of

cau

sal

rela

tionsh

ips,

BB

Nbuil

din

g,

imp

lem

enta

tion

tore

alca

sest

ud

ies

Poli

tecn

ico

di

Bar

iA

cadem

ics

4M

odel

buil

der

Model

buil

din

g,

model

imple

men

tati

on

and

cali

bra

tion

Iden

tifi

cati

on

of

var

iable

san

dw

eighti

ng

of

causa

lre

lati

onsh

ips,

BB

Nbuil

din

g,

imp

lem

enta

tion

tore

alca

sest

ud

ies

Wat

erau

tho

rity

(AqP

S.p

.A.)

Tec

hnic

ians

6M

odel

use

rin

ord

inar

ym

anag

emen

tco

nd

itio

ns

Conce

ptu

alm

odel

buil

din

gan

dd

iscu

ssio

no

fre

sult

sD

ata

pro

vis

ion

,d

iscu

ssio

nan

dv

erifi

cati

on

of

the

resu

lts

2202 Nat Hazards (2014) 74:2193–2227

123

vulnerability. The experts’ opinions were collected as fuzzy numbers (Zadeh 1983; Zim-

mermann 1991; Page et al. 2012). Compared with other knowledge elicitation and struc-

turing methods, fuzzy numbers presented several advantages. Firstly, fuzzy numbers

allowed us to take the differences among experts’ opinions into account. Secondly, they

were flexible enough to be adapted to experts’ understanding of the phenomenon and to the

associated uncertainty (Page et al. 2012). Thirdly, fuzzy numbers were similar to natural

language, which reflected the ways experts were used to talk and think about the issues

considered. This reduced the perceived efforts of being involved in the knowledge elici-

tation phase (Giordano and Liersch 2012). Finally, fuzzy numbers allowed us to represent

areas of the distribution which are not well known.

The shape of the fuzzy number was developed by interacting with the interviewees,

making the meaning of each shape and the impacts on the results clear to them, i.e.,

relating the shape of the fuzzy numbers to the degree of confidence in the expressed

opinion. Various distributions were described (see Fig. 2), ranging from the wide flat-

topped distribution (low confidence) to much narrower triangular distribution, indicating

higher confidence (Giordano et al. 2013).

For the sake of clarity, we could consider the example in Fig. 3.

Experts were asked to formulate their opinions concerning the relative importance of

‘A’ and ‘B’ in determining the value of ‘C.’ A fuzzy number was assigned to A and to B by

(a)

(b)

(c)

Fig. 2 Fuzzy numbers describing the importance degree according to expert opinions. (a) Low confidence;(b) medium confidence; and (c) high confidence

Nat Hazards (2014) 74:2193–2227 2203

123

each involved expert. In order to facilitate the BBN development, the conceptual models

were built as acyclic graphs. Nevertheless, feedback loops—i.e., circular relations from the

child variable to the parental node—could be identified. In this case, experts were required

to further investigate these loops. They can be the results of some mistakes during the

knowledge-structuring phase, or they can represent dynamic relations between variables

across multiple time frames (Nadkarni and Shenoy 2004). In the first case, the causal

connections were redefined together with the involved experts. If the feedback loops were

intentionally included by the experts to represent dynamic relations between variables over

time, then the parent variable (i.e., the variable receiving the feedback loop) was disag-

gregated in two time frames, as shown in Fig. 4. A fuzzy weight was assigned by the expert

to each variable.

Although it is widely acknowledged in the scientific literature that people can better use

and understand opinions expressed by non-numerical phrases than by numbers (see e.g.,

Budescu and Wallsten 1985) and that the experts are highly internally consistent in their

use of linguistic judgments (Clark 1990), using fuzzy numbers to describe experts’ opin-

ions requires to cope with the ambiguity in the interpretation of the terms related to the

fuzzy weights (e.g., low, medium and high) (Page et al. 2012; Budescu and Wallsten 1985;

Budescu et al. 1988). To this aim, additional semantic anchors were designed to normalize

expert responses and reduce ambiguity (Page et al. 2012). In this work, the used anchors

referred to the expected change of the value of variable C due to change in the parent

variables (Fig. 5).

A formal method of combining experts’ opinions was required. The fuzzy intersection

method was used (e.g., Page et al. 2012). The centroid of the area obtained after fuzzy

intersection allowed us to define the aggregated importance degree (Fig. 6).

The aggregated fuzzy weight was then used to develop the conditional probability table

of the BBN, as described in the next section.

Fig. 3 Causal connectionbetween three variables

A

B

C

A

B

C B'

Fig. 4 Disaggregation of the feedback loops in the conceptual model for the BBN development

2204 Nat Hazards (2014) 74:2193–2227

123

3.3 BBN development

The conceptual model developed aggregating the experts’ knowledge was used as basis for

the development of the BBN. The cause-effect network of the BBN was obtained by

addressing some crucial issues related to the structure of the conceptual model, i.e., the

distinction between ‘direct’ and ‘indirect’ relationships between concepts, and the exis-

tence of loops (Giordano et al. 2013).

The next step was the development of the conditional probability table (CPT) which

determines the probability distribution of the value of a variable starting from the prob-

ability distribution of the parent variables. In this work, the CPT was developed using the

results of the fuzzy weighting process.

The CPT was defined using the following formula:

Ai ¼Xn

j¼1;j6¼i

WjiAj

!ð1Þ

where Aj is the value of the parent concepts; Wji is the weight obtained by aggregating the

expert judgements. Formula (1) makes it possible to assess the expected value of a variable

by considering the values of the parent nodes and the fuzzy weights. Therefore, the CPT

for each variable was calculated by considering the different values of the parent variables.

The probability that C assumes a certain value is assessed by comparing the value cal-

culated using Eq. (1) with the considered value in the CPT. The following formula was

used (Giordano et al. 2013):

P Ci ¼ VCið Þ ¼ 1� VCi

� V 0Ci

�� �� ð2Þ

where P(Ci = Vci) represents the probability that the variable Ci assumes the value Vcj; V0ci

represents the value of Ci obtained using formula (1), which is based on the values of the

LOW MEDIUM HIGH

No changesare expected

Small changes are expected (<10%)

Changes are expected (>10%

and <50%)

Significant changesare expected (>50%

and <75%)

Very significantchanges are

expected (>70%)

Fig. 5 Additional semantic anchoring

Fig. 6 Fuzzy intersection. The aggregated fuzzy weight is obtained as centroid of the intersection area

Nat Hazards (2014) 74:2193–2227 2205

123

parent nodes. The obtained value is then normalized to 1. The involved experts were then

asked to validate the results of the CPT development process.

Once the structure of the model was outlined, feedback sessions were also held

involving the experts to ensure that the system had been modeled correctly and that errors

and inconsistencies had been eliminated.

3.4 Model validation procedure

Testing, validating and updating BBNs are essential to ensure reliability and reduce bias.

Validation is quite a complex process which is generally performed in various phases of

the model development process. Practical validation guidelines have been provided mainly

by Marcot et al. (2006), Marcot (2012) and Pitchforth and Mengersen (2013).

All the validation steps mentioned by Marcot et al. (2006) were performed. The first two

steps—i.e., alpha-level and beta-level—are mainly based on experts and proved to be

fundamental since a model might be tested mainly in terms of formal validity given that no

objective dataset exists (Pitchforth and Mengersen 2013). However, a third validation step,

carried out with real data, is generally required. Therefore, scientific cooperation activities

are being carried out with local water authorities in order to calibrate the model in relation

to a complete range of real case studies.

4 Model description

4.1 Overview

Following a simple scheme proposed by Lindhe (2010), a drinking water system consists

principally of a raw water source, a treatment plant and a distribution system. Going into

greater depth, Haestad Methods et al. (2003) and then Karamouz et al. (2010a) identified

water sources, a water treatment plant, water distribution pipelines and storage and other

facilities as the main components of a water system, vulnerable to both natural and human

influences.

The vulnerability assessment for water distribution networks is a multi-faceted issue,

generally encompassing the following aspects: (a) component analysis (i.e., pipes, valves,

reservoirs); (b) operations (i.e., the operating parameters of a network, such as water

pressure and flow); and (c) topology and connectivity (i.e., the number of arcs/nodes in a

network, elevations, arc lengths). For every aspect, a number of possible analysis methods

exist (see e.g., Fragiadakis et al. 2013). Most of the reported research works on the

vulnerability of water distribution networks focuses on component analysis. More complex

approaches are available, such as network reliability analysis, but they require a complete

knowledge of the topology and of the hydraulic functioning of the system. Considering the

scope of this module of the DSS and the unavailability of reliable and complete infor-

mation about the network, a component analysis was performed in this work.

To this aim, a typical scheme of a drinking water infrastructure was defined taking the

following elements into account: (a) water source, a natural and/or artificial system pro-

viding drinking water volumes (possible water sources include surface water such as rivers

or lakes, groundwater or a combination of these); (b) intake structures (b1. wells; b2.

wellspring intake; b3. dams; b4. river intake); (c) treatment plants; (d) water mains;

(e) tanks and storage; (f) pumping stations used to ensure adequate hydraulic pressure in

the service area; (g) control systems; and (h) urban distribution networks.

2206 Nat Hazards (2014) 74:2193–2227

123

BBNs were developed for each subsystem referring to both hazard classes considered.

The main vulnerability mechanisms were identified, and the foremost variables condi-

tioning the structural behavior selected. In practice, each subsystem was considered

independently and thus vulnerability analysis was performed without taking into account

any connection or mutual dependency. Although this assumption does not affect the

assessment of each element or subsystem, it may determine a misleading interpretation of

overall system behavior (e.g., connections between elements cannot be neglected when the

diffusion of contaminants into the network is modeled). Such a simplified approach,

however, is sufficiently reliable, as clarified above, since it provides a general assessment

procedure for each element of the infrastructure, independently of its specific physical

configuration and the connections between subsystems. Coherently with the aims of the

present tool, technicians involved in risk management of drinking water infrastructures

need to know primarily which are the weakest points of the system (identified by means of

the vulnerability assessment model proposed), since the first failure immediately condi-

tions the hydraulic behavior of the network. Such analysis is then integrated through

hydraulic modeling software, useful for defining operative scenarios for complex and

interconnected networks.

Since the model is based on several BBNs, which are similar in terms both of structure

and applicability, only one of the developed BBNs is analyzed in the following section.

Particularly, the model used for assessing the physical vulnerability of water mains is

proposed and discussed in details.

4.2 The case of water mains: a conceptual model

As has been amply analyzed in the previous sections, one of the most favorable charac-

teristics connected to the adoption of BBNs in environmental modeling is their ability to

manage and integrate a range of different variables. In reference to the case of water mains,

vulnerability depends on a wide range of parameters which contribute to affect their

condition and their response to external action. As previously stated, the model was

developed using both expert knowledge and scientific literature. The most significant

factors affecting water system deterioration were defined in accordance with Kleiner and

Rajani (2001), Rajani and Kleiner (2001), Al-Barqawi and Zayed (2006a, b), Vairava-

moorthy et al. (2006) and Liu et al. (2012) and considering the influence of internal factors

and external conditions on the processes of pipe deterioration and failure (Rostum 2000;

Davies et al. 2001a, b; Sadiq et al. 2004; Wood and Lence 2009). The experts’ knowledge

was added, and the conceptual model developed.

A comprehensive review of the main parameters considered in the present methodology

for assessing pipe conditions, in relation to physical hazards, has been proposed in Fig. 7

below. In the same figure, the main damage mechanisms contributing to the global vul-

nerability analysis are also summarized.

Table 2 below provides a synthetic view of the main input variables considered, their

meaning and possible states.

Damage mechanisms contributing to physical vulnerability, presented in Fig. 7, are

briefly summarized in the following:

• Corrosion: the main reason for metal pipe failure (Sadiq et al. 2004; Al-Barqawi and

Zayed 2006a, b). Structural properties combined with environmental aggressiveness

and poor protection measures may significantly condition the failure rate and determine

Nat Hazards (2014) 74:2193–2227 2207

123

a significant loss of mechanical performance in the event of extreme events and intense

stress.

• Breakage: physical breakage may occur as a consequence of poor mechanical soil and

structure properties, unexpected or intense loading and severe operating conditions. A

summary of external stresses (in buried pipes) can be found in Rajani et al. (2000) and

in Sadiq et al. (2004).

• Joint extraction: both structural and loading conditions determine the possibility of

joint extraction or damage during specific events such as earthquakes (Liu et al. 2012).

• Intentional damage: safety levels represent structural ‘resilience’ to potential anthropic

action of various kinds (sabotage, vandalism, etc.) depending on the protection

measures and detection techniques adopted (Gleick 2006).

As well as defining global physical vulnerability levels, the identification of influential

and independent mechanisms is useful to better identify the causes of vulnerability levels

and consequently of fundamental importance in selecting the best strategy to adopt and the

specific operational measures needed.

4.3 Model analysis

The structure of the BBN that was built for characterizing the physical vulnerability of

water mains is proposed in the following Fig. 8.

In reference to the concepts proposed in the previous section, the BBN can be inter-

preted in two ways. Firstly, a global vulnerability judgment on each element of the network

RS Material

INPUT VARIABLES F

AC

TO Thickness

Pipe coatingCathodic protectionThrust restraint

YSI

CA

L Thrust restraint

DiameterJoint frequencyJoint typeD h

Conceptual model

PH

TA

L

DepthLength

Soil mechanical characteristics

PHYSICAL VULNERABILITY

MECHANISMSBBN

PHYSICAL VULNERABILITY

ASSESSMENTON

ME

NT

AC

TO

RS

Soil mechanical characteristicsSeismicityExisting instabilitiesDynamic loads

MECHANISMS

CorrosionBreakage ASSESSMENT

EN

VIR

OF External pressures

Soil resistivity

H d li i bili

BreakageJoint extractionIntentional damage(safety level)

IVE

RS

Hydraulic variabilityOperating / Nominal PressureVisibilityAccessibility

(safety level)

OP

ER

AT

FAC

TO

ySurveillanceMonitoringAge / Design lifeM i tMaintenancePerformed/ScheduledExtra maintenance

Fig. 7 Overview of the input parameters and of damage mechanisms considered in the BBN developed forassessing the physical vulnerability of water mains

2208 Nat Hazards (2014) 74:2193–2227

123

Table 2 Synthesis of the input variables adopted, of their meaning and of their possible states

Input variable Meaning States

Material Different materials determine variablemechanical behaviors and show a specificresponse to corrosion, breaking anddeterioration phenomena

Cast ironSteelConcretePlastic

Thickness A greater thickness accounts for greaterresistance and corrosion resiliency

HighLow

Pipe coating Inner and outer pipe coatings guaranteeoptimal resistance to chemical actions,deterioration and corrosion

YesNo

Cathodic protection Active protection systems reduce pipeelectrical potential limiting corrosion

YesNo

Thrust restraint The presence of thrust restraints balancesspecific forces (e.g., hydrodynamic force incurves)

YesNo

Diameter Studies have shown that pipe breaks tend toreduce for pipes with greater diameter.

[200 mm\200 mm

Joint type The flexibility of pipe joints conditions theirresponse to external actions

RigidSemi-rigidFlexible

Joint frequency The frequency of pipe joints conditions theoverall flexibility of the system

HighMediumLow

Depth Buried systems are less exposed to superficialevents (e.g., floods) and often not clearlyvisible

SuperficialBuried

Length The higher the length of the system, the lowerthe effectiveness of monitoring activities

HighMediumLow

Soil mechanicalcharacteristics

The mechanical properties of soil and backfillproperties influence the system’s response toexternal actions

GoodPoor

Seismicity The expected external stress level ischaracterized also through the analysis of theseismicity of the investigated area

HighMediumLow

Existing instabilities Increasing vulnerabilities are expected wherelocal instabilities (e.g., faults or landslides)already exist

YesNo

Dynamic loads The higher the dynamic loads (e.g., trafficloads) the higher the system’s vulnerability

FrequentAbsent

External pressures Local aggressive conditions (e.g., proximity ofelectricity lines, external currents) mayincrease vulnerability levels

HighMediumLow

Soil resistivity Soil resistivity summarizes a series of soilchemical, physical and biological featuresdetermining the expected behavior in termsof corrosion

HighMediumLow

Hydraulicvariability

A water system is much more vulnerable ifsubjected to significant variations inhydraulic conditions, particularly pressure.In the case of water mains, the entity ofhydrostatic pressure is considered

HighMediumLow

Nat Hazards (2014) 74:2193–2227 2209

123

is given by the target variable (in the present case ‘physical vulnerability’). This means that

the end user may quickly estimate the global vulnerability level of the system, thus

immediately identifying the weakest points of an infrastructure. Secondly, an elementary

vulnerability judgment may help in verifying the specific contribution of each mecha-

nism—i.e., corrosion, breaking, joint extraction and safety level—to the global vulnera-

bility level. This may help in correctly addressing monitoring and operational efforts as

well as in choosing the most suitable strategies in order to reduce vulnerability. Referring

to the OOBN approach, the network was sketched as in Fig. 8b. Each of the vulnerability

mechanisms depends on a subset of input variables and can be interpreted as a subnet or,

namely, an ‘object’ contributing to the whole BBN.

Let us consider, for example, a part of the BBN as shown in Fig. 9. The nodes are

represented with their possible states.

The methodology for experts’ knowledge elicitation and structuring, described in

Sect. 3.2, was applied to the corrosion vulnerability. The ranking of the different elements

within this vulnerability mechanism was obtained considering the aggregated fuzzy

weights (Table 3).

The results summarized in Table 3 were then transposed into quantitative form via the

definition of CPTs, as described in Sect. 3.3. In Table 4, the CPT relating the ‘corrosion

vulnerability’ variable to its parent nodes is proposed as example.

Table 2 continued

Input variable Meaning States

Operating Pressure/Nominal Pressure

A pipe is much more vulnerable if operatingpressure is close to its nominal pressure

High (0.66–1)Medium (0.33–0.66)Low (0–0.33)

Visibility Most hydraulic structures are hidden.Recognizable structures are more exposed tosabotage and terrorist acts

YesNo

Accessibility Accessible structures (without fences or walls)are more exposed to sabotage and terroristacts

YesNo

Surveillance Surveillance by employees or monitoringsystems reduces the risk of intrusion andaccelerates emergency responses

YesNo

Monitoring Qualitative and quantitative monitoringsystems (both local and centralized),especially if continuous, help in quicklydetecting problems and faults

Existing and continuousExisting non continuousAbsent

Age/design Life Failure probability follows the classical‘bathtub’ curve: older systems are lessefficient and more subject to deterioration,newly completed ones may be affected byconstruction faults

[0.80.1–0.8\0.1

Maintenance:performed/scheduled

Regular maintenance contributes to improvingpipe conditions and response to externalstresses

LowMediumHigh

Extramaintenance Past unexpected maintenance activities denotevulnerable areas or vulnerability conditionsdue to local factors

FrequentAbsent

2210 Nat Hazards (2014) 74:2193–2227

123

Once the structure of the BBN had been outlined, a feedback session with experts

helped in preliminarily validating the network in order to verify if the BBN was coherent

with their knowledge.

BBN for physical vulnerability of water mains

OBJECT 1Corrosion Vulnerability Mechanism

Join3 M

echa

nism

Ont E

xtraction

Corrosion vulnerability

lJoint extr a

Physical vulnerability

OB

JEC

Tal

Intr

usio

nM

OB

JEC

T2

Vulnerability

Safe

tyle

veaction

vulner

Ext

ern

yM

echanism

Breaking vulnerability

ability

OBJECT 4Breaking Vulnerability Mechanism

Protection level

Safety level

Breaking vulnerability

PHYSICAL VULNERABILITY

"Passive" protection level External stress level

VisibilityAccessibility Depth Dynamic loads Existing instabilities

Seismicity

"Active" protection level

Surveillance

Monitoring

Flexibility

Mechanical features

Soil mechanical characteristics

Hydraulic efficiency

Hydralic variability (hydrostatic)

Operating pressure/Nominal pressure

Joint extraction vulnerability Thrust restraint

Joint frequency

Diameter

Joint type

Actual conditions Corrosion Vulnerability

Environmental aggressiveness Corrosion resiliencyExternal pressures

MaterialPipe coating Cathodic protection

Thickness

Maintenance: performed/scheduledAge/Design life

Extra-maintenance

Soil resistivity

Length

a

b

Fig. 8 (a) BBN for the vulnerability assessment of water mains to physical hazards; (b) BBN representedthrough the OOBN approach

Actual conditions

GoodMediumPoor

33.333.333.3

Age/Design life

More than 08Between 01 and 08Less than 01

33.333.333.3

Maintenance: performed/scheduled

LowMediumHigh

33.333.333.3

Extra-maintenance

AbsentFrequent

50.050.0

Environmental aggressiveness

HighMediumLow

33.333.333.3

Corrosion resiliency

HighMediumLow

33.333.333.3

Soil resistivity

HighMediumLow

33.333.333.3

Cathodic protection

YesNo

50.050.0

Pipe coating

YesNo

50.050.0

Thickness

HighLow

50.050.0

External pressures

HighMediumLow

33.333.333.3

Corrosion Vulnerability

HighMediumLow

33.333.333.3

Material

Cast ironSteelConcretePlastic

25.025.025.025.0

Fig. 9 Analysis of the submodel describing the mechanism of corrosion vulnerability

Nat Hazards (2014) 74:2193–2227 2211

123

Table 3 Ranking procedure of variables contributing to corrosion vulnerability

Child variable Rank Aggregated fuzzyweight

Parent variable Rank Aggregated fuzzyweight

Corrosion resiliency 1 0.9 Material 1 0.95

Pipe coating 2 0.87

Cathodic protection 3 0.82

Thickness 4 0.65

Environmentalaggressiveness

2 0.85 External pressures 1 0.9

Soil resistivity 2 0.8

Actual conditions 3 0.7 Extramaintenance 1 0.88

Age/design life 2 0.78

Maintenance performed/scheduled

3 0.68

Table 4 CPT associated with the ‘corrosion vulnerability’ variable

Corrosion resiliency Environmental aggressiveness Actual conditions High Medium Low

High High Good 0.05 0.05 0.9

High High Medium 0.05 0.05 0.9

High High Poor 0.05 0.05 0.9

High Medium Good 0 0.05 0.95

High Medium Medium 0 0.05 0.95

High Medium Poor 0 0.05 0.95

High Low Good 0 0 1

High Low Medium 0 0 1

High Low Poor 0 0 1

Medium High Good 0.5 0.3 0.2

Medium High Medium 0.55 0.25 0.2

Medium High Poor 0.6 0.2 0.2

Medium Medium Good 0.35 0.4 0.25

Medium Medium Medium 0.4 0.35 0.25

Medium Medium Poor 0.45 0.3 0.25

Medium Low Good 0.2 0.2 0.6

Medium Low Medium 0.25 0.25 0.5

Medium Low Poor 0.3 0.3 0.4

Low High Good 0.9 0.1 0

Low High Medium 0.95 0.05 0

Low High Poor 1 0 0

Low Medium Good 0.7 0.2 0.1

Low Medium Medium 0.75 0.15 0.1

Low Medium Poor 0.8 0.1 0.1

Low Low Good 0.5 0.3 0.2

Low Low Medium 0.55 0.25 0.2

Low Low Poor 0.6 0.2 0.2

2212 Nat Hazards (2014) 74:2193–2227

123

The process of validation of the submodel considered was also performed using the

sensitivity analysis tool available in NeticaTM software. Sensitivity is defined as the

expected variation of certain variables as a result of the conditional probability structure of

the BBN and the specific state of its parents. Sensitivity analysis is particularly helpful in

displaying how much the target node (beliefs, mean value, etc.) could be influenced by a

single finding by the other nodes in the net. This analysis is best done (Marcot et al. 2001;

Marcot 2012) by first setting uniform probabilities at each input node because specifying

the value of an input variable sets its sensitivity value to zero, which can also affect

sensitivity of the remaining variables. In reference to the submodel proposed in Fig. 9, the

detailed results of the sensitivity analysis are set out in Table 5 below, expressing the

sensitivity of the target node (in this example, ‘corrosion vulnerability’) to the findings at

other nodes.

Full details on sensitivity analysis can be found in NeticaTM online documentation. A

similar detailed application of sensitivity analysis tools in NeticaTM shell was described

also by Amstrup et al. (2008).

Sensitivity is calculated in the modeling shell NeticaTM as the degree of ‘entropy

reduction’ or ‘mutual information’ (reduction in the disorder or variation) at one node

relative to the information represented in other nodes of the model. Thus, the sensitivity

tests indicate how much of the variation in the node in question is explained by each of the

other nodes considered.

In the following equations, P(q) and P(f) are the individual probabilities associated with

the states q and f of the variables Q and F, respectively, whereas P(q, f) is the short form for

P(q and f) and represents a joint probability distribution. Following a typical Bayesian

approach, the available knowledge is encoded in conditional probability statements, while

belief in joint events, if it is ever needed, is computed through the expression P(q,

f) = P(q|f) P(f). The notation P(q|f) expresses the Bayes conditionalization and attributes

to q a certain degree of ‘belief’ given the knowledge f (f is also called the ‘context’ of the

belief in q) (Pearl 1988).

Going further into details, the degree of entropy reduction I is the expected reduction in

mutual information of an output variable Q, with q states, due to a finding of an input

Table 5 Results of the sensitivity analysis for the ‘corrosion vulnerability’ variable

Node Mutual info (Entropy reduction) Percent Variance of beliefs

Corrosion resiliency 0.46345 42.8 0.0889487

Material 0.17432 16.1 0.0358891

Environmental aggressiveness 0.0215 1.99 0.0040697

Pipe coating 0.01683 1.56 0.003749

External pressures 0.00953 0.881 0.0018894

Cathodic protection 0.0031233 0.289 0.000677

Thickness 0.00171 0.158 0.0003808

Actual state 0.00135 0.125 0.0000565

Soil resistivity 0.00101 0.093 0.0001936

Extramaintenance 0.0004 0.0371 0.0000168

Age/design life 0.00008 0.00734 0.0000033

Maintenance performed/scheduled 0.00005 0.00496 0.0000022

Nat Hazards (2014) 74:2193–2227 2213

123

variable F, with f states. For discrete variables, I is measured in terms of information bits

and is calculated as follows:

I ¼ HðQÞ � HðQjFÞ ¼X

q

X

f

Pðq; f Þ log2 Pðq; f Þ½ �PðqÞPðf Þ ð3Þ

where H(Q) is the entropy of Q before any new findings, H(Q|F)is the entropy of Q after

new findings from variable F, and Q is measured in information bits (Marcot et al. 2006;

Marcot 2012).

The ‘variance of belief’ represents the expected change squared of the beliefs of the

query variable, taken over all of its states, due to a finding at each other variable. The term

‘belief’ is used consistently with Pearl (1988) and represents the posterior probability (the

conditional probability assigned once the evidence is taken into account). The variance of

beliefs is determined according to the following equation:

S2 ¼X

q

X

f

Pðq; f Þ � Pðqjf Þ � PðqÞ½ �2 ð4Þ

From the results of a sensitivity analysis, input variables can be rank-ordered or com-

pared quantitatively as to the degree to which each reduces variance or uncertainty

(entropy) in a specified outcome variable (Marcot 2012). Generally, the number that best

describes the degree of sensitivity of one node to another, in case of discrete nodes, is the

‘mutual information’ (or ‘entropy reduction’). Such parameter was therefore used for

analyzing the influence of single variables.

The results have been discussed with experts who agreed with them. A similar proce-

dure was carried out for each submodel in both BBNs, and changes were then made to the

CPTs in order to match them with the experts’ knowledge.

5 Model implementation

The Apulia region, located in the southern part of Italy, has been unfortunately notorious,

since Roman times, for its arid appearance and climate and for a permanent shortage of

water. The Apulian Aqueduct project, whose conception and initial construction dates back

to the end of nineteenth and the early years of the twentieth centuries, is a response to this

historic water issue. It is the largest aqueduct in Europe and is still considered one of the

foremost works worldwide in the field of hydraulic engineering with about 12,000 km of

urban networks, 4,000 km of water mains serving more than 4 million users. The con-

siderable distance between the water sources and the main urban areas, as well as the

complicated territorial pattern due to the presence of mountains and geologically unstable

areas, has produced, on the one hand, a series of design and construction concerns, and on

the other hand, significant operating and maintenance problems. Several hazards (including

earthquakes, landslides and floods) still represent a serious issue for the functioning of such

an important system.

The present research project is being developed with the support of the technical staff of

Acquedotto Pugliese S.p.A. (AqP), the regional water company. Several case studies

connected to hazardous events were selected and were modeled in order to provide support

for validating and calibrating the vulnerability model. A range of hazards were taken into

account in order to provide a complete and differentiated operational framework. The

results of two case studies, both related to water mains, are summarized in the following.

2214 Nat Hazards (2014) 74:2193–2227

123

5.1 Case study: Ofanto Aqueduct

Firstly, the vulnerability model has been applied to one of the most important elements of

the regional network whose location is shown in Fig. 10. It is a pressurized system with an

overall length of approximately 100 km designed for discharges from 1.9 to 6.5 m3/s

according to specific operational conditions. Steel pipes divided into 16-m-long bars with

welded joints with diameters of 2,400 or 2,000 mm, and thicknesses of 20 mm were used.

The system was designed and built in the 1980s in order to respond to increasing demand

for water in central Apulia’s urban areas and to provide an alternative path to the volumes

conveyed through another water main. Despite this, the Ofanto Aqueduct is still affected

by the existence of active landslide phenomena, especially in the Apennine area and

several pipe branches have been damaged or undergone major maintenance work over the

last few years. Furthermore, in the most hazardous locations, pipe relative displacements

are monitored in real time with a GPS system.

The physical vulnerability model for water mains was applied, integrating the structural

information provided by AqP, with geographical and environmental data available through

geographical databases, useful for defining input variables for the model (see Table 2).

Infrastructural information was available partially in digital form and partially as hard

copy. Environmental and territorial data were available in digital form, mainly through

online Web-GIS platforms, from local authorities and institutions. The procedure was

developed in GIS environment and data attribution partially automated by means of simple

tools.

The infrastructure analyzed was divided into homogeneous elements according to the

input variables required. The associated database was then imported as a ‘cases file’ into

0 20 40 60 8010Kilometers

Ofanto aqueduct

Water supply systems

Railways

Major roads

Rivers

Geomorphological hazard

Hydraulic hazard

Fig. 10 Location of Ofanto Aqueduct and geographical data

Nat Hazards (2014) 74:2193–2227 2215

123

NeticaTM software thus allowing a contextual compilation of the BBN for all the homo-

geneous elements of the infrastructure. The results were then directly joined with the GIS

layer of the infrastructure and plotted on a graph. In particular, Fig. 11 shows the proba-

bilistic values associated with the state ‘high’ of the ‘breaking vulnerability’ variable (the

most representative in the event of landslide). The detailed view proposed within the same

Figure focuses on results in the study area.

BBN results appeared coherent with the real situation since the highest levels of

breaking vulnerability overlapped with the points where severe damage was experienced. It

is worth noting that, besides damaged pipes located in the study area, the model detected

other areas, mainly located in the upstream part of the aqueduct, with significant vulner-

ability levels. Such conclusions were therefore discussed with AqP technicians, and par-

ticularly, the situation of other points investigated in detail and recognized as highly

vulnerable. It was found that several of these pipe sections were under maintenance and

intrusive monitoring due to slight damage.

Referring to Ofanto Aqueduct, an overview of the conditions of the whole infrastructure

provided by the vulnerability assessment methodology is described in the following.

Particularly, five classes were defined referring to the value of high probability of ‘breaking

vulnerability’ (More than 0.6 = ‘Very high’; between 0.5 and 0.6 = ‘High’; between 0.4

and 0.5 = ‘Medium’; between 0.3 and 0.4 = ‘Low’; and Less than 0.3 = ‘Very low’).

The total length of pipes within each class was calculated, and mean probability values

associated with ‘breaking vulnerability’ states (see the following Table 6 for details). The

vulnerability assessment confirms that Ofanto Aqueduct is characterized by ‘Medium’ to

‘Very low’ breaking vulnerability conditions. A few critical locations (‘High’ and ‘Very

0 10 20 30 405Kilometers

Probability of ’high’ breaking vulnerability

0.14 - 0.25

0.26 - 0.36

0.37 - 0.47

0.48 - 0.58

0.59 - 0.69

Water supply systems

Railways

Major roads

Rivers

Geomorphological hazard

Hydraulic hazard

Fig. 11 Results of the first case study: values of high probability of breaking vulnerability on the entireinfrastructure and detail of the study area

2216 Nat Hazards (2014) 74:2193–2227

123

high’ probability of breaking vulnerability) are clearly identified, representing approxi-

mately the 3 % of the global length of the infrastructure. Such information is highly

significant for local water companies, since it can be used for easily prioritizing actions and

for correctly addressing maintenance activities, thus effectively reducing the vulnerability

levels on complex networks.

Referring to the most vulnerable pipe of the network, the OOBN approach was used for

identifying the specific role of single mechanisms contributing to the physical vulnerability

levels. The following Fig. 12 clarifies the influence of each vulnerability mechanism,

through the value of the high probability associated with the worst state of the variable

(‘Breaking vulnerability,’ ‘Joint extraction vulnerability’ and ‘Corrosion vulnerabil-

ity’ = High; ‘Safety level’ = Low).

As depicted in the above Fig. 12, the ‘breaking vulnerability’ mechanism is clearly the

most influential for the network, as expected. The mechanisms described by other ‘objects’

denote, instead, a limited influence on the physical vulnerability levels. The identification

of the foremost mechanism is fundamental for decision makers in order to select the most

suitable actions to be implemented in order to reduce the vulnerability. This, along with the

results of the sensitivity analysis performed for each ‘object,’ useful for identifying the

most influential variables, may directly allow a clear identification of best actions.

Referring particularly to the Ofanto Aqueduct case study, the input variables that primarily

condition vulnerability levels are environmental parameters (‘seismicity,’ ‘existing

Table 6 Overview of the breaking vulnerability levels for Ofanto Aqueduct

Probability P of breaking vulnerability

Very high High Medium Low Very low

Length (m) 174.4 2,882.6 32,330 43,167.8 10,072.3

P = High 0.62 0.54 0.45 0.33 0.28

P = Medium 0.15 0.17 0.17 0.15 0.13

P = Low 0.23 0.30 0.38 0.52 0.58

62.3

31.8

15

25

breakingvulnerability

safetylevel

corrosionvulnerability

joint extractionvulnerability

Fig. 12 Overview of the specificinfluence of vulnerabilitymechanisms (‘objects’) onphysical vulnerability levels forOfanto Aqueduct

Nat Hazards (2014) 74:2193–2227 2217

123

0 30 60 90 12015Kilometers

"Canale principale"

Water supply systems

Railways

Major roads

Rivers

Geomorphological hazard

Hydraulic hazard

Fig. 13 Location of ‘Canale Principale’ and geographical data

0 25 50 75 10012.5Kilometers

Probability of ’high’ breaking vulnerability

0.14 - 0.25

0.26 - 0.36

0.37 - 0.47

0.48 - 0.58

0.59 - 0.69

Water supply systems

Railways

Major roads

Rivers

Geomorphological hazard

Hydraulic hazard

Fig. 14 Results of the second case study: values of high probability of breaking vulnerability on the entireinfrastructure and detail of the study area

2218 Nat Hazards (2014) 74:2193–2227

123

instabilities’ and ‘soil mechanical characteristics’). A reduction of vulnerability levels

could be therefore mainly pursued through environmental interventions (e.g., regulate

surface and underground water and set the body of the landslides to give a long-lasting

slowdown effect), rather than by structural changes. An explicit introduction of possible

actions, for the development of a comprehensive DSS, is one of the main upcoming

developments of the research.

5.2 Case study: ‘Canale Principale’

A second case study was developed in reference to another fundamental water infra-

structure in Puglia whose location is represented in Fig. 13, namely the ‘Canale Princi-

pale.’ It is a gravity water main made of brick laid with cement mortar and designed for a

discharge of 6.5 m3/s. Its overall length is approximately 245 km with several segments in

tunnels. Designed and built starting from the early 1900s, it was an ambitious engineering

challenge (VV.AA. 1929). Canale Principale is currently the most important infrastructure

for conveying drinking water in Puglia although several hazards (mainly a severe earth-

quake in 1980s) have threatened its functioning in different sections.

With the same procedure described for the previous case study, the physical vulnera-

bility model for water mains was applied to the whole ‘Canale Principale,’ combining both

structural and environmental data in the GIS environment. The results expressing the

probability of the ‘breaking vulnerability’ being ‘high’ are plotted in Fig. 14 below. A

detailed view proposed within the same Figure focuses on results in the study area.

In the second case study as well, model predictions reflect the real situation quite well

since the highest levels of breaking vulnerability are within the damaged branches.

Following the same approach used in the previous section, an overview of the condi-

tions of Canale Principale according to the results of the vulnerability assessment meth-

odology is described in the following. Particularly, in the following Table 7, the total

length of pipes within each class was calculated, and mean probability values associated

with ‘breaking vulnerability’ states. In the present case study too, ‘Medium’ to ‘Very low’

breaking vulnerability conditions are prevailing. A few critical locations (‘High’ and ‘Very

high’ probability of breaking vulnerability), where actions should be primarily addressed,

are also identified.

As in the previous section, the OOBN approach can be used for identifying the specific

role of single mechanisms contributing to the physical vulnerability levels referring to the

most vulnerable pipe of the network. The following Fig. 15 clarifies the influence of each

vulnerability mechanism, through the value of the high probability associated with the

worst state of the variable (‘Breaking vulnerability,’ ‘Joint extraction vulnerability’ and

‘Corrosion vulnerability’ = High; ‘Safety level’ = Low).

Table 7 Overview of the breaking vulnerability levels for Canale Principale

Probability P of breaking vulnerability

Very high High Medium Low Very low

Length (m) 553.30 10,788.10 19,611.00 2,490.00 197,173.00

P = High 0.69 0.55 0.42 0.33 0.20

P = Medium 0.15 0.18 0.18 0.15 0.11

P = Low 0.16 0.27 0.40 0.52 0.69

Nat Hazards (2014) 74:2193–2227 2219

123

As depicted in the above Fig. 15, the ‘breaking vulnerability’ mechanism is the most

influential for the network, as expected. However, significant safety problems are also

present. The other mechanisms denote, instead, a limited influence on the physical vul-

nerability levels. The identification of the foremost mechanisms is fundamental for deci-

sion makers in order to identify and select the most suitable strategies to reduce

vulnerability levels. Also in this case, the identification of the most influential mechanisms

and of the main variables help decision makers in selecting optimal strategies. Likewise in

the previous case study, environmental parameters are the foremost to be modified,

although the ‘safety level’ can be also improved, mainly improving the ‘Actual conditions’

of the infrastructure.

5.3 Model validation and update

The model was validated through several steps, as described in Sect. 3.4. Particularly, the

application of the model to the case studies above helped to check and modify the structure

that was preliminarily developed. Particularly, both case studies suggested only a signif-

icant modification of the network confirmed also by technical review sessions with experts,

consisting in the insertion of the ‘extra maintenance’ variable. This variable determines a

negative influence on ‘actual conditions,’ expressing an increase in vulnerability levels in

places where maintenance was required in the past. Besides being an expression of local

vulnerability conditions, this is further justified by the fact that technicians often noticed

the concentration of new damages in the vicinity of past interventions, possibly due to the

change in local conditions and structural response.

Minor changes were also performed in some CPTs, particularly in order to increase the

influence of mechanical soil characteristics on breaking vulnerability. A major role of ‘Soil

mechanical characteristics’ on ‘Mechanical features’ was explicitly taken into account, as

suggested by experts.

5.4 Application of the tool to an operative scenario

The systems described in Sects. 5.1 and 5.2 are interconnected, since Ofanto Aqueduct was

designed and built in the 1980s in order to respond both to increasing demand for water in

57.3

41.5

3.65

10

breakingvulnerability

safety level

corrosionvulnerability

joint extractionvulnerability

Fig. 15 Overview of the specificinfluence of vulnerabilitymechanisms (‘objects’) onphysical vulnerability levels forCanale Principale

2220 Nat Hazards (2014) 74:2193–2227

123

central Apulia urban areas and to provide an alternative path to the volumes conveyed

through Canale Principale, which had been seriously damaged during an earthquake.

Therefore, one of the most probable emergency scenarios, confirmed also by the results of

the modeling activity summarized above as well as by the local water authority, is asso-

ciated to the interruption of the flow within the Canale Principale, with the transfer of the

whole discharge (6.5 m3/s) in the Ofanto Aqueduct, behaving as a sort of ‘bypass’ system.

In the following Fig. 16, we propose the results of a simulation of the hydraulic

behavior of Ofanto Aqueduct considering the scenario of 6.5 m3/s flowing in the system.

The adopted software, EPANET, was used in order to get information about pressures in

nodes and flows in links. The ordinary conditions for Canale Principale were also simu-

lated in HEC-RAS, but the results are omitted for the sake of brevity. Although the

application described in the present section is quite simple, it can be easily argued that

several important information on the variation of the hydrodynamic regime of the system

can be obtained from an hydraulic model. This is mainly useful for assessing the conse-

quences of an event on the ordinary conditions (pressure reduction, discharge variation,

etc.) and for verifying alternative functioning conditions of the network.

The adoption of an hydraulic modeling tool in conjunction with the vulnerability

assessment methodology could reveal even more helpful, since BBN can be firstly used to

get a mapping of vulnerability levels and then, a series of hypothesis on the hydraulic

functioning of the network can be developed accordingly.

6 Discussion and future developments

Currently, several BBNs were built and are available in order to perform the vulnerability

assessment of each element of a water delivery infrastructure in relation to a range of

hazards that are classified as physical hazards (landslides, floods, earthquakes, etc.) and

Pressure

52.00

94.00

136.00

178.00

m

Flow

112444.00

224888.00

337332.00

449776.00

CMD

Fig. 16 Results of the hydraulic simulation performed in EPANET referring to the scenario considered

Nat Hazards (2014) 74:2193–2227 2221

123

CBR hazards (chemical, biological and radiological contamination). Both natural events

and anthropic actions are considered.

The implementation of the vulnerability module of the DSS in the two case studies

revealed its usefulness and satisfactory predictive capability, as well as some practical

difficulties and approximations.

Firstly, it has to be underlined that the application of the model to real cases helped to

confirm, with minor changes, the structure of the model that was preliminarily developed.

Particularly, both case studies suggested only a significant modification of the network

confirmed also by technical review sessions with experts consisting in the insertion of the

‘extra maintenance’ variable. Minor changes were also performed in some CPTs, partic-

ularly in order to slightly increase the influence of mechanical soil characteristics on

breaking vulnerability.

Interaction with the technicians of the local water authority also revealed the tool’s

usefulness to support them in optimizing management procedures and for scheduling

ordinary maintenance, in order to reduce network vulnerability.

Feedback sessions were held with both DPC and a local water authority (AqP), two

different subjects involved in drinking water infrastructures management process, and the

formal structure of the model discussed and modified. Once the case studies were com-

pleted, the results were carefully commented, in order to check whether the proposed tool

was able to comply with requirements and needs by both decision makers. A positive

feedback was provided by DPC on the adoption of the tool in emergency management

activities, as well as by AqP referring to the applicability of the system to ordinary

procedures. Particularly, according to the feedbacks collected during the interaction with

local technicians, the results of the model could be used to prioritize actions, by imme-

diately identifying weak points where further detailed investigations should be performed

or where resources should be firstly directed.

Despite the fact that the proposed vulnerability assessment tool is fundamental to the

development of a DSS for managing emergencies on drinking water infrastructures, it

appears not to be completely satisfactory for performing a comprehensive assessment of

system performance and for selecting operational strategies. In fact, the vulnerability tool

should be integrated with an hydraulic model capable of characterizing the variation in the

hydrodynamic regime due to the potential damage of one or more elements of the system

and scenarios occurring on the network. Such an upgrade is particularly useful for

investigating the impact of hazards on complex and branched systems. This aspect is being

carefully investigated, and a hydraulic model in EPANET (for pressurized systems) and in

HEC-RAS (for gravity systems) was developed and tested, with specific reference to the

case studies, in order to analyze several possible flow configurations.

As already stated, the capability of the model to fill data gaps by referring to experts’

knowledge was really useful in the vulnerability analysis for the two case studies. In fact,

although the amount of information required as input by the tool was rather low, the phase

of data population was quite complicated, since data from different sources, available in

different forms (digital or hard copy), with inhomogeneous level of detail and reliability

had to be combined and manipulated. This demonstrated once more that the implemen-

tation of more quantitative-oriented tools could be strongly hampered by the low acces-

sibility and reliability of information about the infrastructure.

During the feedbacks collection sessions, we were also able to identify potential

drawbacks of the proposed tool. Firstly, local technicians emphasized the subjectivity

related to the definition of the value to be assigned to the variables in the model. Although

these issues were addressed during the knowledge elicitation phase (see Sect. 3.2), the final

2222 Nat Hazards (2014) 74:2193–2227

123

version of the model will be accomplished with practical guidelines which are currently

under development, to help the user with variable comprehension and values attribution.

Another significant issue to be considered is connected to a certain difficulty in working

with different software and environments for managing data: data exchange is not

straightforward since it has not been automated. Nevertheless, a user-friendly interface is

being developed in order to simplify data transfer and processing between GIS and Ne-

ticaTM particularly with the aim of making the data entry interactive and simplifying the

visualization of results.

The model was only validated with specific reference to the case of water mains, but no

significant differences in terms of strengths and weaknesses are expected referring to other

infrastructural elements. The only major issue that may arise is in the application of such

tool to the case of urban water networks. Indeed, such systems are particularly complex

and characterized by a strong information uncertainty, as emerged during interviews with

technicians of water utilities. A different approach based on the vulnerability assessment of

global urban districts should be adopted.

Although the methodological framework was carefully defined and preliminary tests

performed, further research studies may be useful to refine its structure and its inference

ability. The integration of the probabilistic vulnerability assessment tool with an hydraulic

model revealed also fundamental for investigating the effects of specific scenarios on the

behavior of complex networks.

The development of the other two modules aiming to support the emergency man-

agement and recovery phase is one of the most urgent developments of the described

activity. To this aim, actions have to be introduced in the model, in order to dynamically

simulate their impacts on the infrastructure. The uncertainty management and communi-

cation will play a crucial role in this development phase.

7 Conclusions

The present work summarizes the methodological approach adopted and the first results of

a research project that is being carried out by the Water Research Institute of the National

Research Council (IRSA-CNR) supported by the Italian Department of Civil Protection

(DPC), oriented to the definition of a probabilistic vulnerability assessment tool for

drinking water infrastructure. The main aim of the model is to detect weak points and high

vulnerability conditions, thus helping to optimize interventions and limit the consequences

on populations of drinking water quantity reduction and quality alteration in the event of

natural and anthropogenic disasters. It could be therefore mainly used as a DSS for opti-

mizing the risk management activities on drinking water systems. The model proved to be

sufficiently reliable even in case of lack of detailed information, and thus, capable of

providing effective responses and operational strategies to reduce infrastructure

vulnerability.

The experiences carried out in the two case studies demonstrated the potentialities of

BBNs in structuring expert knowledge and making it functional to support vulnerability

assessment. BBNs’ ability to deal with qualitative information was particularly helpful in

the present work. As already discussed, a positive feedback was also provided by AqP

technicians regarding the possibility of using this tool for the detection of vulnerable areas

and the prioritization of intervention even in ordinary conditions.

Nat Hazards (2014) 74:2193–2227 2223

123

The proposed developments of the tool will be particularly oriented to the definition of

other modules mainly aiming at supporting both the emergency management and the

recovery phase, thus widening its applicability conditions.

Acknowledgments The present research activity was supported by the Italian Department of Civil Pro-tection (‘‘Intesa Operativa del 19.12.2006 tra DPC e IRSA—Rep. 618’’). The authors are particularlygrateful to the Acquedotto Pugliese S.p.A. technicians for their support in model development and forproviding data for case studies. We would like to thank Dr. Gianluigi Fiori (Acquedotto Pugliese S.p.A.), Dr.Girolamo Vitucci (Acquedotto Pugliese S.p.A.), Dr. Andrea Duro (Department of Civil Protection) and Dr.Francesco Campopiano (Department of Civil Protection). We are also grateful to all the experts whocontributed to model building and validation too.

References

Aguilera PA, Fernandez A, Fernandez R, Rumı R, Salmeron A (2011) Bayesian networks in environmentalmodeling. Environ Model Softw 26:1376–1388. doi:10.1016/j.envsoft.2011.06.004

Al-Barqawi H, Zayed T (2006a) Condition rating model for underground infrastructure sustainable watermains. J Perform Constr Facil 20(2):126–135. doi:10.1061/(ASCE)0887-3828(2006)20:2(126)

Al-Barqawi H, Zayed T (2006b) Assessment model of water main conditions. In: Proceedings of pipelines2006—service to the owner, July 30–August 2 2006, Chicago, Illinois. doi:10.1061/40854(211)27

Amstrup SC, Marcot BG, Douglas DC (2008) A Bayesian network modeling approach to forecasting the21st century worldwide status of polar bears. In: DeWeaver ET, Bitz CM, Tremblay LB (Eds) Arcticsea ice decline: observations, projections, mechanisms, and implications. Geophysical monograph 180.American Geophysical Union, Washington DC, pp 213–268

Aspinall W, Cooke RM (1998) Expert judgment and the Montserrat volcano eruption. Proceedings of the 4thinternational conference on probabilistic safety assessment and management PSAM4, September 13th–18th, New York City, USA (eds. Ali Mosleh and Robert A. Bari), Vol. 3, pp 2113–2118

Batchelor C, Cain J (1999) Application of belief networks to water management studies. Agric Water Manag40(1):51–57. doi:10.1016/S0378-3774(98)00103-6

Beuken R, Reinoso M, Sturm S, Kiefer J, Bondelind M, Astrom J, Lindhe A, Rosen L, Pettersson T,Machenbach I, Melin E, Thorsen T, Eikebrokk B, Hokstad P, Rostum J, Niewersch C, Kirchner D,Kozisek F, Weyessa Gari D, Swartz C, Menaia J (2008a) Identification and description of hazards forwater supply systems—a catalogue of today’s hazards and possible future hazards. TECHNEAUD4(1):4

Beuken R, Meerkerk M, Bosch A, Reinoso M, Mesman G (2008b) Risk assessment case study—Amster-dam, The Netherlands. TECHNEAU D4.1.5c

Binaghi E, Boschetti M, Brivio PA, Gallo I, Pergalani F, Rampini A (2004) Prediction of displacements inunstable areas using a neural model. Nat Hazards 32(1):135–154. doi:10.1023/B:NHAZ.0000026796.59079.1a

Bromley J (2005) Guidelines for the use of Bayesian networks as a participatory tool for water resourcemanagement. Centre for Ecology and Hydrology Crowmarsh Gifford, Wallingford

Budescu DV, Wallsten TS (1985) Consistency in interpretation of probabilistic phrases. Organ Behav HumDecis Process 36(3):391–405. doi:10.1016/0749-5978(85)90007-X

Budescu DV, Weinberg S, Wallsten TS (1988) Decisions based on numerically and verbally expresseduncertainties. J Exp Psychol Hum Percept Perform 14(2):281–294. doi:10.1037/0096-1523.14.2.281

Cain J (2001) Planning improvements in natural resources management—guidelines for using Bayesiannetworks to support the planning and management of development programmes in the water sector andbeyond. Centre for Ecology and Hydrology Crowmarsh Gifford, Wallingford

Carmona G, Varela-Ortega C, Bromley J (2011) The use of participatory object-oriented Bayesian networksand agro-economic models for groundwater management in Spain. Water Resour Manag25(5):1509–1524. doi:10.1007/s11269-010-9757-y

Castelletti A, Soncini-Sessa R (2007) Bayesian networks and participatory modelling in water resourcemanagement. Environ Model Softw 22(8):1075–1088. doi:10.1016/j.envsoft.2006.06.003

Christodoulou SE (2011) Water network assessment and reliability analysis by use of survival analysis.Water Resour Manag 25(4):1229–1238. doi:10.1007/s11269-010-9679-8

Clark DA (1990) Verbal uncertainty expressions: a critical review of two decades of research. Curr PsycholRes Rev 9(3):203–235. doi:10.1007/BF02686861

2224 Nat Hazards (2014) 74:2193–2227

123

Cooke RM, Jager E, Lewandowski D (2003) Reliability model for underground gas pipelines. In: BonanoEJ, Camp AL, Majors MJ, Thompson RA (eds) Probabilistic safety assessment and management.Elsevier, Amsterdam, pp 1045–1050

Davies JP, Clarke BA, Whiter JT, Cunningham RJ (2001a) Factors influencing the structural deteriorationand collapse of rigid sewer pipes. Urban Water 3:73–89. doi:10.1016/S1462-0758(01)00017-6

Davies JP, Clarke BA, Whiter JT, Cunningham RJ, Leidi A (2001b) The structural condition of rigid sewerpipes: a statistical investigation. Urban Water 3:277–286. doi:10.1016/S1462-0758(01)00036-X

Ezell BC (2007) Infrastructure vulnerability assessment model (I-VAM). Risk Anal 27(3):571–583. doi:10.1111/j.1539-6924.2007.00907.x

Ezell BC, Farr JV, Wiese I (2000) Infrastructure risk analysis model. J Infrastruct Syst 6(3):114–122. doi:10.1061/(ASCE)1076-0342(2000)6:3(114)

Fragiadakis M, Christodoulou SE, Vamvatsikos D (2013) Reliability assessment of urban distributionnetworks under seismic loads. Water Resour Manag 27(10):3739–3764. doi:10.1007/s11269-013-0378-0

Geertsema M, Schwab JW, Blais-Stevens A, Sakals ME (2009) Landslides impacting linear infrastructure inwest central British Columbia. Nat Hazards 48(1):59–72. doi:10.1007/s11069-008-9248-0

Giordano R, Liersch S (2012) A fuzzy GIS-based system to integrate local and technical knowledge in soilsalinity monitoring. Environ Model Softw 36:49–63. doi:10.1016/j.envsoft.2011.09.004

Giordano R, D’Agostino D, Apollonio C, Lamaddalena N, Vurro M (2013) Bayesian belief network tosupport conflict analysis for groundwater protection: the case of the Apulia region. J Environ Manag115:136–146. doi:10.1016/j.jenvman.2012.11.011

Gleick PH (2006) Water and terrorism. Water Policy 8(6):481–503. doi:10.2166/wp.2006.035Goulding R, Jayasuriya N, Hora E (2012) A Bayesian network model to assess the public health risk

associated with wet weather sewer overflows discharging into waterways. Water Res 46(16):4933–4940. doi:10.1016/j.watres.2012.03.044

Grigg NS (2003) Water utility security: multiple hazards and multiple barriers. J Infrastruct Syst 9(2):81–88.doi:10.1061/(ASCE)1076-0342(2003)9:2(81)

Haestad Methods, Walski TM, Chase DV, Savic DA, Grayman W, Backwith S, Koelle E (2003) Advancedwater distribution modeling and management. Haestad Press, Waterbury

Henriksen HJ, Zorrilla-Miras P, de la Hera A, Brugnach M (2012) Use of Bayesian belief networks fordealing with ambiguity in integrated groundwater management. Integr Environ Assess Manag.8(3):430–444. doi:10.1002/ieam.195

Hokstad P, Rostum J, Sklet S, Rosen L, Pettersson TJR, Lindhe A, Sturm S, Beuken R, Kirchner D,Niewersch C (2009) Methods for risk analysis of drinking water systems from source to tap—guidancereport on risk analysis. TECHNEAU D4(2):4

IPCC (2012) Summary for policymakers. In: Field CB, Barros V, Stocker TF, Qin D, Dokken DJ, Ebi KL,Mastrandrea MD, Mach KJ, Plattner GK, Allen SK, Tignor M, Midgley PM (eds) Managing the risksof extreme events and disasters to advance climate change adaptation. A special report of workinggroups i and ii of the intergovernmental panel on climate change. Cambridge University Press,Cambridge, pp 1–19

Ismail-Zadeh A, Takeuchi K (2007) Preventive disaster management of extreme natural events. Nat Hazards42(3):459–467. doi:10.1007/s11069-006-9075-0

Jensen FV, Nielsen TD (2007) Bayesian networks and decision graphs. Springer, New YorkKakderi K, Alexoudi M, Argyroudis S, Pitilakis K (2011) Definition of system components and the for-

mulation of system to evaluate the performance of water and waste-water systems. SYNERG D2:5Karamouz M, Saadati S, Ahmadi A (2010a) Vulnerability assessment and risk reduction of water supply

systems. In Proceedings of world environmental & water resources congress 2010: challenges ofchange, 16–20 May 2010, Providence, Rhode Island, USA. doi:10.1061/41114(371)449

Karamouz M, Ahmadi A, Zahraie B, Moridi A (2010b) Development of an algorithm for risk based strategicwater supply planning: a case study. In Proceedings of world environmental & water resources con-gress 2010: Challenges of change, 16–20 May 2010, Providence, Rhode Island, USA. doi:10.1061/41114(371)236

KDHE-BOW (Kansas Department of Health and Environment—Bureau of Water) (2003) Simplified vul-nerability assessment tool for drinking water. 1000 SW Jackson Street

Kleiner Y, Rajani B (2001) Comprehensive review of structural deterioration of water mains: statisticalmodels. Urban Water 3(3):131–150. doi:10.1016/S1462-0758(01)00033-4

Krueger T, Page T, Hubacek K, Smith L, Hiscock K (2012) The role of expert opinion in environmentalmodeling. Environ Model Softw 36:4–18. doi:10.1016/j.envsoft.2012.01.011

Langseth H, Portinale L (2007) Bayesian networks in reliability. Reliab Eng Syst Saf 92(1):92–108. doi:10.1016/j.ress.2005.11.037

Nat Hazards (2014) 74:2193–2227 2225

123

Li J, Wei S, Liu W (2006) Seismic reliability analysis of urban water distribution networks. Earthq Eng EngVib 5(1):71–77. doi:10.1007/s11803-006-0628-8

Li L, Wang J, Leung H, Jiang C (2010) Assessment of catastrophic risk using Bayesian network constructedfrom domain knowledge and spatial data. Risk Anal 30(7):1157–1175. doi:10.1111/j.1539-6924.2010.01429.x

Lindhe A (2010) Risk assessment and decision support for managing drinking water systems. PhD Dis-sertation, Chalmers University of Technology, Gothenburg, Sweden

Liu Z, Kleiner Y, Rajani B, Wang L, Condit W (2012) Condition assessment technologies for watertransmission and distribution systems. EPA/600/R-12/017

Marcot BG (2012) Metrics for evaluating performance and uncertainty of Bayesian network models. EcolModel 230:50–62. doi:10.1016/j.ecolmodel.2012.01.013

Marcot BG, Holthausen RS, Raphael MG, Rowland MM, Wisdom MJ (2001) Using Bayesian beliefnetworks to evaluate fish and wildlife population viability under land management alternatives from anenvironmental impact statement. For Ecol Manag 153(1–3):29–42. doi:10.1016/S0378-1127(01)00452-2

Marcot BG, Steventon JD, Sutherland GD, McCann RK (2006) Guidelines for developing and updatingBayesian belief networks applied to ecological modeling and conservation. Can J For Res36:3063–3074. doi:10.1139/x06-135

Marzocchi W, Garcia-Aristizabal A, Gasparini P, Mastellone ML, Di Ruocco A (2012) Basic principles ofmulti-risk assessment: a case study in Italy. Nat Hazards 62(2):551–573. doi:10.1007/s11069-012-0092-x

Molina JL, Bromley J, Garcıa-Arostegui JL, Sullivan C, Benavente J (2010) Integrated water resourcesmanagement of overexploited hydrogeological systems using object-oriented Bayesian networks.Environ Model Softw 25(4):383–397. doi:10.1016/j.envsoft.2009.10.007

Molina JL, Farmani R, Bromley J (2011) Aquifers management through evolutionary bayesian networks:the Altiplano case study (SE Spain). Water Resour Manag 25(14):3883–3909. doi:10.1007/s11269-011-9893-z

Nadkarni S, Shenoy PP (2004) A causal mapping approach to constructing Bayesian networks. DecisSupport Syst 38(2):259–281. doi:10.1016/S0167-9236(03)00095-2

Ordonez-Galan C, Matıas JM, Rivas T, Bastante FG (2009) Reforestation planning using Bayesian net-works. Environ Model Softw 24:1285–1292. doi:10.1016/j.envsoft.2009.05.009

Ozesmi U, Ozesmi S (2004) A participatory approach to ecosystem conservation: fuzzy cognitive maps andstakeholder group analysis in Uluabat Lake, Turkey. Environ Manag 31(4):518–531. doi:10.1007/s00267-002-2841-1

Page T, Heatwaite AL, Thompson LJ, Pope L, Willows R (2012) Eliciting fuzzy distributions from expertsfor ranking conceptual risk model components. Environ Model Softw 36:19–34. doi:10.1016/j.envsoft.2011.03.001

PAHO-WHO (1998) Natural disaster mitigation in drinking water and sewerage systems. Guidelines forvulnerability analysis, Washington, DC

Pearl J (1988) Probabilistic reasoning in intelligent systems. Networks of plausible inference. MorganKaufmann Publisher, San Francisco, CA

Peng M, Zhang LM (2012) Analysis of human risks due to dam-break floods—part 1: a new model based onBayesian networks. Nat Hazards 64(1):903–933. doi:10.1007/s11069-012-0275-5

Pitchforth J, Mengersen K (2013) A proposed validation framework for expert elicited Bayesian Networks.Expert Syst Appl 40(1):162–167. doi:10.1016/j.eswa.2012.07.026

Pollino CA, Woodberry O, Nicholson A, Korb K, Hart BT (2007) Parameterisation and evaluation of aBayesian network for use in an ecological risk assessment. Environ Model Softw 22(8):1140–1152.doi:10.1016/j.envsoft.2006.03.006

Rajani B, Kleiner Y (2001) Comprehensive review of structural deterioration of water mains: physicallybased models. Urban Water 3(3):151–164. doi:10.1016/S1462-0758(01)00032-2

Rajani B, Makar J, McDonald S, Zhan C, Kuraoka S, Jen C-K, Veins M (2000) Investigation of grey castiron water mains to develop a methodology for estimating service life. American Water WorksAssociation Research Foundation, Denver, CO

Rosen L, Hokstad P, Lindhe A, Sklet S, Røstum J (2007) Generic framework and methods for integrated riskmanagement in water safety plans. TECHNEAU D4(1):3

Rostum J (2000) Statistical modelling of pipe failures in water networks. Dissertation, Faculty of CivilEngineering, the Norwegian University of Science and Technology

Sadiq R, Rajani B, Kleiner Y (2004) Probabilistic risk analysis of corrosion associated failures in cast ironwater mains. Reliab Eng Syst Saf 86(1):1–10. doi:10.1016/j.ress.2003.12.007

2226 Nat Hazards (2014) 74:2193–2227

123

Shih BJ, Chang CH (2006) Damage survey of water supply systems and fragility curve of PVC waterpipelines in the Chi–Chi Taiwan earthquake. Nat Hazards 37(1–2):71–85. doi:10.1007/s11069-005-4657-9

Susnik J, Molina JL, Vamvakeridou-Lyroudia LS, Savic DA, Kapelan Z. Comparative analysis of systemdynamics and object-oriented Bayesian networks modelling for water systems management. WaterResour Manag 27(3):819-841. doi:10.1007/s11269-012-0217-8

UNDRO (1979) Natural disasters and vulnerability analysis. Report of expert group meeting, Office of theUnited Nations Disaster Relief Co-ordinator

Uusitalo L (2007) Advantages and challenges of Bayesian networks in environmental modeling. Ecol Model203(3–4):312–318. doi:10.1016/j.ecolmodel.2006.11.033

Vairavamoorthy K, Gorantiwar SD, Yan J, Galgale HM, Mohamed-Mansoor MA, Moban S (2006) Riskassessment of contaminant intrusion into water distribution systems. Water, Engineering and Devel-opment Centre, Loughborough University, Leicestershire, UK

VV.AA. (1929) The Apulian Aqueduct, Southern Italy. Reprinted for Engineering, Offices of Engineering,35 and 36, Bedford Street, Strand, W.C.2.

Wang QJ, Robertson DE, Haimes CL (2009) A Bayesian network approach to knowledge integration andrepresentation of farm irrigation: 1. Model development. Water Resour Res 45(2):W02409. doi:10.1029/2006WR005419

Wang J, Gu X, Huang T (2013) Using Bayesian networks in analyzing powerful earthquake disaster chains.Nat Hazards in press. doi: 10.1007/s11069-013-0631-0

Wood A, Lence BJ (2009) Using water main break data to improve asset management for small and mediumutilities: district of Maple Ridge B.C. J Infrastruct Syst 15(2):111–119. doi:10.1061/(ASCE)1076-0342(2009)15:2(111)

Zadeh LA (1983) A computational approach to fuzzy quantifier in natural languages. Comput Math withAppl 9(1):149–184. doi:10.1016/0898-1221(83)90013-5

Zimmermann HJ (1991) Fuzzy set theory and its applications. Kluwer Academic Publisher, Boston, MA

Nat Hazards (2014) 74:2193–2227 2227

123