Involving Risk Reduction Practitioners and Other Experts in the Management of Super-Catastrophes via an Online Interactive Platform

Super-catastrophes that lead to extensive disruption and loss amplification are frequently due to domino effects crossing natural, technological, and socio-economic systems. Although secondary effects of natural disasters are often considered in official hazard assessment platforms (e.g., landslides following earthquakes, storm surges), the main catalysts of long chains-of-events, which are network failure and business interruption, are generally not. This is partly due to the difficulty in handling complex and systemic situations. Yet in an increasingly interdependent world, crisis management requires foresight with the ability to consider those secondary effects. Such an ability can be brought in using interactive numerical tools. We have developed an online interactive platform for the pre-assessment phase of super-catastrophes based on Markov chain theory. The tool is centered on the elaboration of a transition matrix of event interactions, from which domino effects can be modeled and ranked in the background. Risk practitioners and other experts first list hazardous events, which are then populated in the matrix in both rows (trigger events) and columns (target events). As the square matrix grows, the platform’s users indicate which events can directly trigger another event in a binary approach. With enough participants, those binary decisions turn into weighted rules of interactions. In the process, the participants may discover missing links and update the matrix accordingly. To cover the full space of possibilities, three categories of events are systematically considered: natural, technological, and socio-economic. A group of experts can generate a transition matrix to explore the concept of super-catastrophe in general or to draw up possible crisis scenarios for decision-makers at any level of a territory (from a city to a country). Use of such a tool in practical situations, its integration into the management of prevention, planning for potential crisis situations, and training are discussed. Particular attention is given to the ability of this platform to help decision making within the context of a crisis unit with the need for quick evaluations.


INTRODUCTION
Super-catastrophes, which lead to major economic losses and casualties (e.g., Shenhav, 1977), often result from the aggregated effects of connected disasters (Savy et al., 2008). The triggering chains of loss-generating events are often referred to as cascading effects or domino effects (Khan and Abbasi, 1998). Recent examples abound. The COVID-19 pandemic (e.g., Wang et al., 2020) triggered financial turmoil (Zhang et al., 2020), social unrest (Polo, 2020), psychological strain (Hou et al., 2021), and food insecurity (Barrett, 2020), among other domino effects. Other infamous super-catastrophes of the 21st century include the 2005 Hurricane Katrina, which produced a surge large enough to breach levees, ultimately triggering the flooding of New Orleans and cascading failures in numerous economic production sectors (Comfort, 2006;Hallegate, 2008), and the 2011 Tohoku, Japan, earthquake, whose unexpectedly high magnitude triggered a tsunami larger than what was planned in the protection of the Fukushima nuclear power plant, leading to a major nuclear accident with radioactive material released, along with other industrial accidents (Norio et al., 2011). This in turn led to the phase-out of civil nuclear energy in some European countries, whose full impact on energy security has yet to be fully understood.
Earthquakes, storms, and floods-some of the most devastating natural events on Earth-are particularly prone to triggering other natural events, critical infrastructure failures such as industrial accidents and lifeline ruptures, and further socio-economic disruption . Worldwide, many other perils can lead to domino effects, such as epidemics and wildfires to only cite a few more. Man-made disasters directly triggered by malicious acts, malfunction, or human error (Chernov and Sornette, 2016) are more localized, but can also trigger numerous negative chains-of-events (e.g., Mignan et al., 2022).
Despite being among the highest-impact threats to our society, domino effects are often unforeseen as having been rarely experienced in the past. Mostly missing from historical records, complex domino effects may be referred to as downward counterfactuals (e.g., Woo and Mignan, 2018). Until recently, disaster risk reduction practitioners, decisionmakers, and policy makers have treated natural and anthropogenic hazards separately. Although several hazards and risks may have been considered at the same time, spatiotemporal interdependencies have often been neglected (e.g., Schmidt et al., 2011 and references therein). This is understandable given the complexity of the processes involved and the compartmentalization of the expertise. Yet, the United Nations International Strategy for Disaster Reduction (UNISDR) is shifting towards a more dynamic, multi-risk approach to the problem (Aitsi-Selmi et al., 2016). This is urgently needed as our 21st century society is becoming increasingly complex and dependent on technology (Alexander, 2018). Many site-specific projects, often at the critical infrastructure or city levels, consider the multiple mechanisms leading to domino effects (Tang et al., 2019;Argyroudis et al., 2020). Stress test methods also include steps dedicated to the role of cascading effects (Esposito et al., 2020). However, there is no tool aimed at standardizing how complex interactions should be included and how to minimize the surprise effect of missing some critical interactions.
Multi-risk governance has recently been proposed as an extension of risk governance (Komendantova et al., 2014;Mignan et al., 2017;Scolobig et al., 2017). It first emphasizes the barriers related to the management of cascading effects, which are a lack of standardization and of cross-disciplinary expertise for multi-risk reduction planning, inadequate resources, and biases and barriers in communication between the relevant public and private actors, as well as between scientists and policy makers. It then suggests a multi-phase approach of observation (historical cases), social and institutional context analysis (via stakeholder engagement), generation of multi-risk knowledge (modelling), and stakeholder engagement processes (selection, implementation and evaluation of multi-risk management and reduction processes).
In this work, we present an online interactive platform for the pre-assessment phase of super-catastrophes. It is intended to be used by decision-makers and other domain-knowledge experts to brainstorm on the subject of cascading effects, to develop simple rules of event interactions in a qualitative to semi-quantitative manner, and to explore emergent chains-of-events in scenarios computed in the background using Markov chain theory. It brings together the first three phases of multi-risk governance, i.e., observation, stakeholder involvement, and modelling.

Catastrophe Dynamics Using Markov Chain Theory
Catastrophe dynamics, or the study of spatiotemporal interactions leading to complex catastrophic scenarios, can be modelled from Markov chain theory equations (Helbing & Kuehnert, 2003; or via Monte Carlo simulations (e.g., Mignan et al., 2014Mignan et al., , 2018Liu et al., 2015;Matos et al., 2015). In both cases, a transition matrix encodes the conditional probabilities of possible one-to-one event interactions, from which scenarios of chains-of-events emerge. The Markov property simply indicates that the triggering of an event only depends on the last occurring event. The adjacency matrix A represents a convenient way to define hazard interactions (Gill & Malamud, 2014) and to display them in the form of a finite graph (e.g., Rocha et al., 2018). Each element a i,j of the square matrix of size (n ev × n ev ) represents the possibility, or not, of event j being triggered by event i for a total of n ev possible events. An adjacency matrix can act as a transition matrix when the transition between two events (or two states) is defined by a conditional probability instead of a binary input. For sake of simplicity, we use the term 'adjacency matrix' in the main text of this article to refer to both the interaction graph and the transition matrix. We explain below how the conservation of probabilities can be enforced in the adjacency matrix.
Although simulations provide flexibility to also deal with non-Markovian processes (such as n-to-one interactions, long-term trends and seasonality, long-term memory), we here consider the much simpler case of memorylessness. A chain-of-k-events can then be encoded in the interaction matrix M with τ the number of interacting steps . In other words, if A encodes 1 → 2 and 2 → 3, M additionally describes the chain 1 → 2 → 3. As τ increases, non-trivial patterns may emerge depending on the topology of A.
In practice, we can estimate the probability of a chain-ofk-events Z k (z 1 , z 2 , /, z k ) using the Markov property so that p Z k k−1 τ 1 a zτ ,zτ+1 . The probability of a specific chain can then be ranked against all other chains-of-k-events (Mignan et al., 2022). Note that for the conservation of probabilities, an outflow event representing an absorbing state at which the cascade dies off must be added to the adjacency matrix . This is, however, a technicality. An example of scenario generation will be given in Scenario Development by User Elicitation: A Proof-Of-Concept, with the conditional probabilities a i,j estimated by the weighting of binary adjacency matrices produced by the platform's users. The proposed approach is described below.

Online Platform Prototyping
The processes of catastrophe dynamics and their impact on super-catastrophe generation are described respectively by the adjacency matrix and ranked lists of chains-of-events, as defined in the previous subsection. The adjacency matrix can be displayed as a graph, and the chains-of-events as paths emphasized on that graph. We developed an online platform for super-catastrophe analysis based on expert elicitation, in which the adjacency matrix can be filled and expanded by the experts (i.e., the platform users).
The matching interaction graph is then generated automatically and displayed alongside the square matrix of interactions. Figure 1 illustrates the platform's concept. In a first step, prior to any input from the users, examples of chain-of-events encoding are provided to explain the concept. Those are listed in a catalogue of A-templates. The users can then update those socalled templates, merge them, or create an adjacency matrix from scratch. A new graph is generated every time the encoding is modified. It is important to note that all those matrices have binary entries (interactions: yes, a i,j 1 or no, a i,j 0), which simplifies the user experience. A click on a cell a i,j allows one to change the class of that cell. In a second step, the adjacency matrices saved by different users to describe the same system are collated into a second catalogue of user-defined matrices. They are then weighted and used to generate scenarios of chains-ofevents following Markov chain theory, which can be highlighted on the graph. Details about knowledge creation are given in Assessing Event Interactions.
Our platform is built with Python 3.9.0 on the Flask micro framework (https://flask.palletsprojects.com/). The platform relies on a couple of distinct elements to allow its versatility: the database of perils, interactions, and catastrophe models, and the application backbone handling data management and serving the web interface as well as some distinct graphical elements (the main one being the interactive adjacency matrix). Note that by catastrophe model, we mean the adjacency matrix associated with a specific scenario.
A SQL database hosts the data filled in the adjacency matrix by the users (see below). It is composed of distinct tables corresponding to the application data model: perils, interactions between perils, and catastrophe models. The three tables are connected as follow: perils are linked with interactions in two ways depending on whether they act as a trigger (or source) or a target and they can be part of multiple catastrophe models (i.e., individual matrices). Interactions have source and target perils which are taken from the peril table.
The application backbone is based on the micro framework of Python Flask. The core element of the backbone is the application model where perils, interactions, and catastrophe model objects are set. Communication between the application model and the database is relatively straightforward thanks to the Flask-SQLAlchemy module (https://github.com/pallets/flasksqlalchemy). The basis of the web application is then built with Jinja Template Engine incorporated to Flask that enables the generation of HyperText Markup Language (HTML) files with embedded JavaScript (JS) and Cascading Style Sheets (CSS) for interactive plotting which is needed for presentations and online content (see some screenshot examples in Results).
The interactive adjacency matrix is made with D3.js which is a JS library for manipulating documents based on data (https:// d3js.org/). Interactivity with users is made possible by some elements on the HTML page. The first one is the peril button which allows the user to add some new perils that are then incorporated into the matrix. Afterward, the user can create an interaction between two perils by clicking on the matching matrix cell. Finally, the Catastrophe Model Flowchart is dynamically built with Mermaid.js which is a JS based diagramming and charting tool (https://mermaid-js.github.io). Addition of further functionalities and changes in the design can be expected for future versions of the platform once user feedback has been received (see Future Tests of the Platform).

Assessing Event Interactions
The main purpose of the proposed interactive platform is knowledge creation for the critical and complex problem of catastrophe dynamics. Knowledge is created by the encoding of the adjacency matrix. In a first step, examples of encoded adjacency matrices are provided to the users. These include both generic cases and historical cases. Generic examples are used to illustrate the range of possible interactions, which are physically plausible and may occur at the macro-scale  or microscale. By micro-scale, we mean the interactions that occur within an event, specifically in critical infrastructure failures (e.g., Matos et al., 2015;Mignan et al., 2022-
At the micro-scale, we so far include a generic hydro-dam (Matos et al., 2015) which encodes interactions between the natural system and the elements of a hydro-dam. Here, some of the natural events are the same as above, such as earthquakes, floods, and landslides. As for the critical infrastructure failure, it is subdivided into subevents that characterize the micro-scale. Those are: bottom outlet failure, hydropower failure, spillway failure, reservoir rise, overtopping, and dam collapse. This example illustrates the complex interactions which are specific to one critical infrastructure type, indicating the need for domainbased engineering expertise. We plan to include, for example, generic cascades at nuclear plants (Ayoub et al., 2019) and historical cases of such failures, as what happened during the Fukushima disaster (Norio et al., 2011). All those examples are or will be recorded in a catalogue of adjacency matrices. How those examples are implemented and displayed on the platform is described in Display of Generic and Historical Supercatastrophe Scenarios.
In a second step, which corresponds to the core of the interactive platform, users fill the adjacency matrix individually. They can use a template from our catalogue, which may be one of the examples discussed in the previous paragraphs, or their empty counterparts where only the event list is kept but none of the interactions. Another option provided to the user is to build an adjacency matrix from scratch ( Figure 1). For any option, events composing the matrix can be removed and/or others added, while interactions can be turned on or off, providing full control to the user.
As explained in Online Platform Prototyping, we offer a simple binary decision rule for the user: is the triggering of one event j by event i possible or not? User-defined adjacency matrices are saved within a second catalogue ( Figure 1) and a merged adjacency matrix created with conditional probabilities defined as weighted sums of the results, w i,j n i,j /N where n i,j is the number of binary matrices with a i,j 1 and N the total number of matrices. This does not reflect the likelihood of the interaction in any physical sense, but rather the confidence of the experts that this interaction is possible. The resulting adjacency matrix can then be used to define and rank scenarios of chains-of-events (see Scenario Development by User Elicitation: A Proof-Of-Concept). To be consistent with the conditional probability a i,j defined in Catastrophe Dynamics Using Markov chain Theory, the sum of weights per trigger i must be smaller or equal to 1. We therefore define a i,j αw i,j with α a proportionality factor chosen so that nev j 1 a i,j ≤ 1 and a i,j ≪ 1 since events are usually more likely to occur without triggering any secondary event when averaged over different environmental settings. The second condition also avoids exploding cascades.

Display of Generic and Historical Super-Catastrophe Scenarios
We defined several adjacency-matrix templates for the initial testing of our platform prototype. Some of the generic templates and the resulting interaction graphs are shown in Figure 2. It shows that many one-to-one interactions, simple to individually encode based on a binary decision rule (Online Platform Prototyping), can rapidly combine into a complex web of potential chains-of-events. Often surprising scenarios emerge from such chains (see Scenario Development by User Elicitation: A Proof-Of-Concept). The power of the method is illustrated in Figure 2C where the generic macro-and microscale templates are merged into a meta-adjacency matrix that encompasses interactions at both spatial scales. While the operation is a trivial process that could be done in the background by the platform, it further increases the complexity of the interacting system. One can easily imagine encoding adjacency matrices for multiple types of critical infrastructures and combining them at the macro-scale of interactions. In practice, the two merged scales can represent the links between local critical infrastructure failures and their potentially greater consequences at the regional or national level when taking other loss-generating events into consideration.

Scenario Development by User Elicitation: A Proof-Of-Concept
Since the proposed platform has yet to be tested with decision makers and other experts (see future plans in Future Tests of the Platform), we here import the results of a session on reasoned imagination and cascading effects done in 2014 with natural science teachers (Mignan et al., 2016). Being part of a Swiss Seismo@School workshop, the focus was on earthquakes as primary triggers. The participants 38) were schoolteachers in natural sciences coming from 12 countries (Australia, France, Germany, Great Britain, Israel, Italy, Palestine, Portugal, Romania, Switzerland, Turkey, and the United States). The exercise lasted 1 hour and was in two parts: the participants Interactions at both macro-and micro-scales merged into one adjacency matrix. All plots as screenshots from the prototype platform (with font size increased for the present figure).
Frontiers in Earth Science | www.frontiersin.org March 2022 | Volume 10 | Article 829145 first listened to a seminar on historical cases of cascading effects, and then were asked to fill in an adjacency matrix based on what they previously learned as well as on their prior knowledge. To explain how to encode the matrix from chains-of-events to oneto-one interactions, 2 cells were filled during the seminar: 'earthquake' → 'flood' and 'flood' → 'industrial accident', representing a coarse-grained (or macro-scale) version of the Tohoku earthquake triggering the Fukushima nuclear disaster via coastal flooding (i.e., tsunami). Two outcomes of that early study can be used for our present work, in addition to the original data. First, user inputs should be filtered so that unreliable adjacency matrices are removed. This was done by deleting any matrix where the two interactions described during the seminar had not been included. Mignan et al. (2016) showed that an improvement in the number of realistic scenarios arose after such filtering. Note, we have yet to define such filtering rules for the newly proposed online platform. Second, this exercise proved that users were able to define a large number of physically plausible interactions leading to emergent cascades not discussed during the seminar.
The 38 adjacency matrices of the 2014 pen-and-paper exercise ( Figure 3) were digitized, making them equivalent to what the same users would have entered on the online platform. Of those, nine were removed by the filtering rule of Mignan et al. (2016). Considering the remaining 29 matrices for our user-defined catalogue, we defined a weighted matrix, which is shown in Figure 4A. We considered all the perils except asteroid impacts, which are extremely rare and would thus be overweighed compared to other triggers. Note also that three types of interactions were originally considered in the 2014 exercise: triggering (+), inhibiting (−), and both (±), as well as no interaction (Ø). Here, we combined (+) and (±) as a i,j 1, otherwise a i,j 0. We then defined conditional probabilities a i,j αw i,j with α 0.01. We finally applied catastrophe dynamics to rank the most likely chain-of-k-events Z k (see Catastrophe Dynamics Using Markov chain Theory) based on the users input, as shown in Figure 4B for k 5.
The chains-of-events extracted from the exercise are mostly constrained by the historical examples presented during the seminar and cannot be considered representative of the true likelihood of chains-of-events. However, taken as a proof-ofconcept, it shows how scenarios, getting more complex as k increases, can be generated from an adjacency matrix. We can expect that inputs from various experts considering a more constrained problem, such as interactions possible within a specific region or at a specific critical infrastructure, would lead to useful cascade information for further brainstorming in the phase of super-catastrophe pre-assessment.
Let us review the cascades shown in Figure 4B as they indicate some limits that will need to be addressed in future tests. The five most likely cascades contain the 3-event chain 'earthquake' → 'flood' → 'industrial accident' which was the one presented during the seminar, leading to some obvious overweight. In future applications, the impact of background information will have to be carefully assessed. Although it seems rather difficult to avoid the bias of historical events and background information from impacting decisions, aiming at the gradual development of a comprehensive and uniform database of interactions should limit overweighting linked to recent observations and fashionable trends. Moreover, two interactions proposed by the participants appear to be dubious: 'volcanic eruption' → 'earthquake' and 'mass slide' → 'earthquake'. Those interactions are highly unlikely if we mean a damaging earthquake of a relatively large magnitude. It is true however that both volcanic eruptions and landslides (or rock falls) can trigger micro-seismicity. This indicates that the problem of event scale (in terms of intensity, space, and time) is a critical aspect of catastrophe dynamics that will need to be considered. One solution would be to clearly fix the scales to be considered in cascade definition, for example, by only considering lossgenerating events and to keep the resolution relatively coarse in a first stage. Users could also define intensity or damage thresholds to be considered for event selection and/or some bounds on the return period of primary triggers.

Crisis Situation Emulation
In a real crisis situation, crisis managers may need to consider different types of scenarios to make their decisions. Cascading events anticipated by the proposed platform may include planned-for events, or the crisis "automatic" responses already described in planification documents, as well as previously unplanned-for "surprise" events. Therefore, reference scenarios combining "surprise" cascading events and planned-for events may be presented to decision makers in addition to a limited number of optional crisis response scenarios. It appears from presentations of this preliminary platform to decision makers (i.e., internal discussions at the Ministry of Energy, Transport and Ecological transition, Paris) that: 1) for the "situation picture" (i.e., a common crisis system description, including socio-economic sectors and actors' games), the platform first added value appears to be its ability to describe a complex situation involving several economic sectors and stakeholders and hence avoid or at least minimize silo effects; 2) dealing with complex situations, combinations of events lead to a very high number of possible scenarios, which has limited practical value to decision makers. Here, the platform's ability to identify a few relevant scenarios by a ranking strategy is an important outcome; 3) interviewees also stressed that interconnections between the suggested platform "situation picture" with implemented planification responses is essential for identifying where decisions must be taken.
The proposed online platform may have two implementation regimes: • The matrix and scenarios are pre-filled and developed by experts from generic and historical data, crisis management plans, and exercise feedbacks during periods outside of crises. The objective here is twofold: (i) to get a comprehensive "theoretical" matrix at the national scale where interdependences are identified as possible; (ii) to define several relevant scenarios at the local level taking "in field" vulnerabilities into account. • During crisis times, prefilled matrices are handled by dedicated crisis managers who complete and adapt the matrix with regards to the ongoing disaster's specific characteristics (e.g., unforeseen events and interdependences might occur which require scenario updating). They then release context-relevant scenarios and present them to decision-makers.
We believe that the work outside of times of crises is essential to have efficient and relevant scenarios during crises, but that it is not sufficient: adaptation to real events and data during a crisis is essential to make the platform's outcomes relevant to decision makers. During crises, we also believe that the platform can be  Mignan et al., 2016). The top cascade derived from the present adjacency matrix is: an earthquake triggers a tsunami, which in turn leads to an industrial accident. It follows some business interruption and later some economic slowdown.
Frontiers in Earth Science | www.frontiersin.org March 2022 | Volume 10 | Article 829145 used to train analysts who will fill in the matrix by themselves according to the situation and produce relevant scenarios for decision makers. This will require improvements in the platform for improved user experience, efficient input/output workflow, and proof of added value.

Future Tests of the Platform
We plan to test and enrich the proposed platform with crisis practitioners and experts within the context of two types of events, in crisis exercises and crisis laboratories: Crisis exercises offer a double opportunity: on the one hand, they allow the testing of the platform's functionalities. Does it give an appropriate picture of the situation? Does it facilitate policy makers' understanding of the situation? Are the suggested crisis scenarios relevant to the situation? Answering these questions makes the functionalities more adapted to the crisis decision makers' needs. On the other hand, these exercises might be opportunities to fill the platform with data provided by participants. Indeed, the database development is the most critical aspect of the platform alongside the user interface. It will, therefore, require regular additions, analyses, and cleaning procedures outside of crisis periods and is crucial for good quality outcomes.
A "Crisis-Lab", or crisis laboratory, is a place where innovative crisis management tools are presented and discussed among developers and practitioners. At the Ministry of Energy, Transport and Ecological transition in Paris, for instance, there is a meeting every 2 months which aims to facilitate exchanges and make tools adapted to end users' needs. The current platform would benefit from this kind of workshop to gain feedback.

CONCLUSION
We have presented the prototype of an online platform for the pre-assessment phase of super-catastrophes based on Markov chain theory. The tool is centered on the elaboration of a transition matrix of event interactions (i.e., an adjacency matrix defined in terms of conditional probabilities), from which domino effects can be modeled and ranked in the background. The matrix can be pre-filled based on generic processes of peril interactions, or on historical disasters. Matrices can also be built and updated by users, and combined, analyzed, and used for brainstorming on the potential of complex chains-of-events.
The proposed online platform has yet to be tested with decision-makers, for either brainstorming sessions or in real crisis situations. Despite this current lack of feedback, we have shown from a proof-of-concept (Figures 3, 4) how complex cascades and ranked chains-of-events could be generated based on user input. Although we used as data input from natural science teachers (Mignan et al., 2016), the underlying principle and process will remain the same when considering decision makers and scientific experts as participants.
A clear advantage of the online platform will be the added flexibility compared to the "frozen" proof-of-concept previously described. When a matrix is built from scratch or an existing matrix is updated (Figure 1), participants can list additional hazardous events, which are then populated in the matrix in both rows (trigger events) and columns (target events). Removing one event removes the matching row and column automatically. In the process of building the adjacency matrix and encoding it, the participants may discover missing links and update the matrix accordingly in a dynamic process. The essence of this flexibility was shown in Figure 2 where two matrices at two different spatial scales were merged to produce a more complex system of interactions.
This platform needs to be further improved and updated based on future user feedback. Stakeholder workshops, as done in the past but at the time with pen and paper exercises (Komendantova et al., 2014;Mignan et al., 2017), will be required to fully identify the capabilities and usefulness of this new tool in crisis management.

DATA AVAILABILITY STATEMENT
The original contributions presented in the study are included in the article/supplementary material, further inquiries can be directed to the corresponding author.