Potential and limitations of risk scenario tools in volcanic areas through an example at Mount Cameroon

. This paper presents an integrated approach to conduct a scenario-based volcanic risk assessment on a variety of exposed assets, such as residential buildings, cultivated areas, network infrastructures or individual strategic buildings. The focus is put on the simulation of scenarios, based on deterministic adverse event input, which are applied to the case study of an effusive eruption on the Mount Cameroon volcano, resulting in the damage estimation of the assets located in the area. The work is based on the recent advances in the ﬁeld of seismic risk. A software for systemic risk scenario analysis developed within the FP7 project SYNER-G has been adapted to address the issue of volcanic risk. Most signiﬁcant improvements include the addition of vulnerability models adapted to each kind of exposed element and the possibility to


Introduction
Within the field of volcanic risk management, hypothetical scenarios are being increasingly used to inform civil security and authorities about potential future threats and to test their procedures. Previous approaches for the design of scenarios can be divided in two categories: (1) event scenarios that are focused on modelling potential adverse events such as lava flows (e.g. Crisci et al., 2010;Favalli et al., 2012), pyroclastic flows (Marrero et al., 2012;Oramas-Dorta et al., 2012), ash fall (e.g. Costa et al., 2009;Macedonio et al., 2008), lahars and floods (Kuenzler, 2012), etc., and (2) risk scenarios that account for the vulnerability of people and stakes affected by hypothesised adverse events to estimate the potential damages during an eruption (e.g. Spence et al., 2005b;Felpeto et al., 2007;Thierry et al., 2008;Marrero et al., 2012).

Utility of scenarios in volcanic disaster risk management
Adverse event scenarios have demonstrated their relevance for disaster risk prevention, mitigation and for improving preparedness to the crisis. For example, Favalli et al. (2012) simulated numerous lava flows to refine the Mount Cameroon hazard map, which is an essential tool for disaster prevention (e.g. Neri et al., 2013). In a similar approach, Crisci et al. (2010) used about 40 000 lava flow simulations from about 400 possible vents on the eastern flanks of Etna to evaluate the efficiency and relevance of mitigation measures such as barriers to protect towns and villages. During a future crisis, civil protection can select in near real time (as the eruption progresses) the most plausible evolution of lava flows out of the exhaustive simulations. The study by Spence et al. (2004) focuses on the potential impacts of a pyroclastic flow on Vesuvius, roughly based on the 1631 AD eruption. In that research, extensive studies of the resistance of building walls and openings and of the effects of temperature and Published by Copernicus Publications on behalf of the European Geosciences Union.
lateral dynamic pressure have led to the development of elaborate vulnerability models and the estimation of potential casualties along the eruption timeline. Risk scenarios provide complementary information that can be used to support mitigation and preparedness to the crisis and for recovery. As a first approach, the simple description of a plausible succession of events helps civil security to understand the potential dimension of a future volcanic crisis (Thierry et al., 2008). For example, Marrero et al. (2012) used a population distribution and simple simulations of pyroclastic flow currents to compute the potential number of potential fatalities in case of an eruption of the Central Volcanic Complex in Tenerife Island. Their results highlighted the relevance of considering large-scale evacuation of population (more than 100 000 persons) in volcanic crisis preparedness plans. Finally, Zuccaro et al. (2008) focused on explosive scenarios for Vesuvius, by considering multiple volcanic phenomena and by tackling the issue of cumulative damage due to joint adverse events (e.g. earthquake sequences or the combined effects of ash fall and seismic aggression).
These examples show that volcanic events and risk scenarios can be used to better anticipate all phases of disaster risk management, from prevention and mitigation up to preparedness to crisis management and recovery.
However, the analysis becomes more complex when attempting to refine initial risk scenarios and to provide more quantitative information to civil security. For example, while reconsidering the emergency plans at Vesuvius, Rolandi (2010) showed that they were too much based on 1631 ADlike events, thus questioning their efficiency in case of other types of events. This calls for the development of scenario builder tools that are able to generate a whole range of risk scenarios.

A brief review of existing volcanic risk scenario tools
The field of geological hazards assessment has benefited from the recent development of seismic scenario tools (e.g. Sedan et al., 2013;Franchin et al., 2011;Cavalieri et al., 2012). This initial effort in the field of earthquake risk can be explained by the fact that when an earthquake occurs, the potential direct damages are an immediate consequence of one physical phenomenon, i.e. the ground motion time history. Conversely, in the case of volcanic risk assessment, the multiplicity of potential volcanic phenomena, of vulnerable elements at risk and of corresponding damage mechanisms represents a difficult challenge (e.g. Douglas, 2007). Significant effort has been recently carried out in this field. This has resulted for example in the development of volcanic risk assessment tools such as EXPLORIS (EXPLORIS Consortium, 2005;Spence et al., 2008;Zuccaro et al., 2008) or RiskScape Volcano (Kaye, 2007). The former is focused on the effects of explosive eruptions (i.e. volcanic phenomena such as tephra fall, pyroclastic density currents and earth-quakes are considered), and it relies on a full probabilistic risk assessment, as it starts from a probabilistic event tree eruption model and accounts for various uncertainties along the risk analysis (e.g. hazard models, vulnerability models, occupancy models). The studied area is divided into cells (i.e. mesh grid), in which the different events and impact assessment are looped using a Monte Carlo scheme, and the global loss outputs are only aggregated over the whole zone at the end. While this approach proves computationally efficient to analyse large areas, it may only be applicable to the risk assessment of ordinary buildings and population; the independent derivation of loss statistics over each cell implies no dependencies between the exposed elements, which is not the case when infrastructures such as networks or health-care systems are considered , if a systemic analysis is carried out (i.e. functionality loss assessment of various systems of exposed elements). On the other hand, RiskScape Volcano offers the possibility of carrying out either fully probabilistic risk assessment with event trees (e.g. Neri et al., 2008;Marzocchi et al., 2004) or scenario-based risk assessment, which are commonly used by local authorities for decision-making or mitigation. This software incorporates hazard and vulnerability models for a wide range of volcanic phenomena and the focus is put on critical infrastructures such as lifeline networks or strategic facilities, with less emphasis on residential buildings.

Objective of this study
Indeed, in the case of Mount Cameroon, the issue of assessing the potential consequences of drastic adverse events may be less relevant than examining how their succession might affect people and infrastructures, how the crisis can be managed and finally how much reconstruction may cost (Thierry et al., 2008). In light of this previous work, the objective of our study is to explore the potential and limitations of risk scenario softwares in supporting disaster risk management at Mount Cameroon, in the scope of the MIAVITA project (7th Framework Programme). To this end, we designed and adapted an object-oriented based software initially developed for seismic risk scenario designs (Franchin et al., 2011;Cavalieri et al., 2012;Franchin and Cavalieri, 2013) and extended its capabilities to take account of existing damage functions in the field of risk assessment (Sect. 2). The focus of this work is therefore the structured management of information during the risk scenario runs. The application to Mount Cameroon (Sect. 3) reveals opportunities and limitations in using such tools, which can be transported elsewhere (Sect. 4). Damage (asset n° N) = func on of (intensity of adverse phenomenon n° K; vulnerability class of asset n°N)

Nat. Hazards Earth
Vulnerability of each type of exposed asset (e.g. from Jenkins and Spence, 2013) Re-assessment of the remaining assets' vulnerability class, when possible Quan fica on of direct damage caused by the adverse phenomenon n°K to asset n°N 1: Itera on on N 2: Itera on on K 3: Results: Iden fica on of poten al damages (maps, tables)

Poten al applica ons (sec ons 1 & 4):
• Preven on: inputs for hazard and risk maps • Tes ng the relevance of mi ga on measures (e.g. lava flow devia ons) • Preparedness to crisis: evacua on and emergency scenarios and plans • Preparedness to post-crisis: cost of reconstruc on Fig. 1. Idealized scheme of a risk scenario builder tool as obtained after collecting and assimilating high level requirements from a group of users, geologists and computer scientists.

Method: framework for multi-risk scenario builder tools
This section starts with presenting the overall approach. Then, it describes the various steps that are carried out within our proof-of-concept tool.

Overall approach
Our approach in developing the volcanic risk scenario tool at Mount Cameroon was the following: in a first step, we defined high-level requirements for this tool with a group of local users (Ministry of Mines of Cameroon), geologists, experts in scenario builders and computer science, and translated them into low-level requirements for use by developers (Quinet, 2011). This led to defining fundamental requirements for volcanic risk scenario tools ( Fig. 1), which should include the possibility to: -perform loss computation within a single architecture, allowing automated probabilistic runs; -integrate spatial features of both adverse events and assets (usually GIS-based) in a seamless way; -jointly compute the damage on both residential buildings and critical infrastructures; and -manage scenarios including a succession of different volcanic and geologic phenomena, e.g. through the removal of previously destroyed assets.
This last addition was considered most important in order to quantify the consequences of additional adverse events in an already degraded environment. In a second step, we adapted the seismic risk scenario methodology of Franchin et al. (2011) and Cavalieri et al. (2012) to the context of volcanic risk. The initial toolbox enables us to perform an analysis of the physical damages for a wide range of elements at risk (e.g. built areas, network infrastructures), with a particular focus on critical systems and infrastructures (e.g. major roads, electricity and water networks). The idea behind it is to facilitate the understanding of vulnerability of essential human activities over the selected territory (systemic vulnerability), beyond the sole assessment of potential physical damages.
We added several modules to the toolbox, including the possibility to (1) merge the damages due to different volcanic phenomena (i.e. "multi-event" scenarios), (2) include various forms of vulnerability models (from deterministic damage matrices to probabilistic fragility curves), and (3) estimate potential damages to cultivated areas and crops, which are an important factor in the case of volcanic risk.

Representation of adverse events
Since a scenario-based approach has been chosen, probabilistic hazard assessment is considered out of the scope of this study and deterministic maps displaying the intensity and extent of hypothesised adverse events are therefore considered as inputs. These have been previously computed or evaluated through various techniques (e.g. event trees, computed hazard models, expert elicitation and so forth).
The various adverse events resulting from a volcanic eruption are characterised by a damage mechanism and an intensity measure, which can be specific to the type of elements they affect. For instance, tephra fall is one type of adverse event; for buildings, the damaging mechanism is vertical static load (i.e. intensity measure is load in kPa), while it is simply burial (i.e. intensity measure is thickness in cm) with respect to roads or airport runways. This type of hazard decomposition has been discussed by Thierry et al. (2007) and it is carried out here for the following adverse events: tephra fall, lava flows, lahars, debris flows, pyroclastic density currents, blast effects, ballistic blocks, flank collapses, and, although not necessarily related to an eruption, landslides and earthquakes.
In practice, once a given scenario has been designed, adverse events are drawn in a geographical information system (GIS) and the time series of intensity maps are directly imported into the toolbox. This modelling choice implies some intensity level bins to define the polygons (see Appendix A). Neri et al. (2013) provide an approach on how to define these bins.

Inventory of exposed elements
Any risk analysis starts with an inventory of exposed people, or elements of the built and natural environment over the selected territory. These assets can be classified into three categories: -Built and cultivated areas: they represent crop fields or industrial plantations, as well as residential buildings. These data are represented as polygons, whose attributes can be typology percentages, number of buildings, population density (for built areas) or crop type (for cultivated areas).
-Networks: they include all types of lifeline networks (e.g. electric power, water or gas supply) as well as transportation networks (e.g. roads or railways). Each network is represented by a set of polylines and points.
-Critical facilities: these point-like components represent strategic buildings such as health-care buildings, decision centres or law enforcement departments. These important structures are treated as single objects, as opposed to regular residential buildings, and their attributes include information about their relative importance before, during and after the crisis.
Similarly to the hazard input, a GIS-format map for each type of exposed element is imported into the toolbox environment. In the case of built or cultivated areas, data are projected on a mesh grid composed of a series of cells; a refinement algorithm has been developed by Cavalieri et al. (2012) in order to generate variable-sized cells, smaller cells being concentrated around the borders of the polygons. The projection of attributes such as population density or building typologies into each cell is carried out by pondering the respective area of each census polygon within the cell; this means that the attributes are represented and averaged as a proportion of the overall cell size. Polylines are also discretized into a series of straight segments, so that they can be defined by only the coordinates of the two extremities; as will be shown in the next subsection, the length of the segment is of little importance and therefore there is no need to carry out further discretization. Finally, point-like objects are imported as they are.
In parallel to this data projection, a taxonomy of the considered assets is proposed in order to classify them in a set of organised systems, following an object-oriented structure. This architecture is slightly adapted from the one introduced by Cavalieri et al. (2012) and it is represented in Fig. 2 as a class diagram in UML notation (Unified Modeling Language). This formalization allows us to define classes for objects with similar features and the inheritance property of object-oriented programming also gives the possibility to pass along the same attributes to subclasses belonging to the same superclass. This approach can prove very useful to organise the asset inventory in the eventuality of a functionality analysis, since all sets of exposed elements can be grouped into the respective system they are composing. In Fig. 2, the water network has been expanded in order to show the different layers in the inventory description, from component level to system level. Finally, depending on the role they play in the system, components of a network can be assigned different characteristics (e.g. linear objects become pipelines; point objects can either be source, distribution or storage nodes), which can be used to perform a network analysis subsequently to the physical damage analysis.
The way this object-oriented architecture is used to model infrastructures is illustrated in Fig. 3, using the example of the water supply system. The attributes of the infrastructure components that are described in the GIS dataset are used to assign them to different classes and to characterise them with properties such as geographic location, material type, capacity, network connectivity or vulnerability model. Another advantage of the object-oriented approach lies in its flexibility, as it always allows us to add modules for extra components and systems, depending on the specific needs of each given case study.

Projection of adverse event intensities on vulnerable sites
The next step consists of the superposition of both adverse event and exposed element layers, resulting in the estimation of the intensity level at each vulnerable site for each volcanic phenomenon. This procedure depends on the type of object that is considered: -For point-like elements, it is very straightforward since the intensity level is the same as the one of the adverse event polygon where the point is located. -For linear elements, the intensity polygons corresponding to each adverse event (see Neri et al., 2013, in this issue) are projected along the length of the exposed segment, which is then assigned different percentages of different intensity levels (see top of Fig. 4). This approach allows the user to account precisely for the exact intensity level on each linear element, whatever its length.
-For projected cells (i.e. built and cultivated areas), the same approach as for the linear elements is used and it is in agreement with one of the options proposed by Kaye (2007). The event's intensity polygons are intersected with each cell and area percentages of intensity are then assigned to the cell (see top of Fig. 4).
Finally, it has to be kept in mind that this procedure relies on the input of adverse event intensity maps that are vector-based, i.e. polygons of binned values of intensity levels, as opposed to raster maps, which would require other techniques such as interpolation.

Damage analysis through fragility models
The potential physical damage of exposed elements can only be evaluated once some prerequisite definitions are set, such as a damage scale for each type of component (Blong, 2003), an intensity scale for each type of hazard and, finally, a vulnerability model that links the input intensity and the resulting damage (Thierry et al., 2008). The existing literature on vulnerability to volcanic hazards contains a variety of very disparate models, ranging from simple binary ones (i.e. the asset is destroyed if it is exposed to the volcanic phenomenon, whatever its intensity) to gradual damage-intensity matrices (e.g. Wilson et al., 2012, where some threshold values of tephra loads are proposed for the vulnerability of utility networks), or even to more elaborate probabilistic fragility functions (i.e. the probability of reaching or exceeding the damage state given the intensity level), as shown in the review by Jenkins et al. (2013). All types of vulnerability models may be used in the developed toolbox, which assigns one specific vulnerability model to each type of exposed element and each type of phenomenon. For deterministic models (i.e. damage-intensity matrices), the event's intensity levels at each site are translated into other bins of values (i.e. the actual intensities used to evaluate the damage) and then they directly yield the discrete damage of the exposed element (see Fig. 4). In the case of probabilistic models (i.e. fragility functions), a sampling procedure using a standard uniform variable is carried out, in order to check whether the exposed element reaches the damage state or not (see bottom of Fig. 4).
When using probabilistic functions, it is necessary to perform numerous simulation runs to get stable estimates of the loss statistics. Also, since buildings are usually well studied components, they can for instance be assigned fragility functions with respect to tephra fall or pyroclastic density currents; in the proposed approach, the damage analysis of buildings is then performed at the scale of each cell, for each typology present, which means that the sampling procedure will assign the same damage state to all buildings of the same typology within the same cell.
Finally, the results for each exposed element are presented in a damage table, which indicates the length (or the area or the proportion of buildings or crops) that is assigned to each of the damage states (see Fig. 4). This representation is very useful as an output, as it enables us to quantify the losses in terms of destroyed or impaired assets (e.g. number of km of destroyed power lines or number of collapsed houses). In parallel, for each network, the toolbox also indicates which edges or nodes are considered damaged (i.e. an edge is considered damaged or non-functioning if it contains at least a portion that is in a non-intact damage state), which enables us to update the connectivity of the whole network in order to estimate its functionality loss in a degraded state.

The case of scenarios composed of a succession of events
While the procedure described above is a straightforward adaptation of previous methods in the field of volcanic risk (EXPLORIS Consortium, 2005;Kaye, 2007) or seismic risk (SYNER-G, 2009(SYNER-G, -2013, another important issue that has not been fully addressed yet is the analysis of the impact of successive volcanic phenomena within a single eruption scenario. When running damage analysis from successive hazards, the inventory of exposed assets has to be updated after each single phenomenon simulation, so that the impact of the subsequent phenomenon is accurately estimated (i.e. computation over a degraded set of exposed elements and not the initial intact one). This discussion reveals the need for state-dependent fragility models that should be able to quantify further damage probabilities based on the current state of each element; for instance, buildings with collapsed roofs due to a previous tephra fall may prove much more vulnerable to other types of hazards. However, the current state of the literature does not yet propose such advanced fragility models for all possible combinations of volcanic hazards and exposed elements, despite some recent efforts Zuccaro and De Gregorio, 2013) that have proposed some fragility functions for cumulative damages due to various phenomena (i.e. earthquakes, dynamic lateral pressures, tephra loads and high temperatures). Still, an "inventory removal" algorithm was implemented, which accounts for the assets that have already been damaged and should not be included in the next damage analysis, at least for the estimation of the lesser damage states they have already reached. This idea has also been raised by Kaye (2007), and we propose here a simple way to apply it. Basically, each object is assigned one damage table for each type of adverse event considered in the scenario (i.e. each phenomenon is considered as a unique event), as well as a global damage table that is updated after the simulation of each phenomenon (i.e. a damage table for the whole scenario). The important advantages of using this approach here are Nat. Hazards Earth Syst. Sci., 13, 2409-2424, 2013 www.nat-hazards-earth-syst-sci.net/13/2409/2013/ twofold. First, the inventory removal algorithm could readily integrate damage-state-dependent fragility functions, if and when such models are developed in the future. Secondly, for stakeholders such as the civil security, it is important for preparedness exercises to evaluate (even roughly) how damages may occur over the time (e.g. over a few hours or a few weeks); their ability to respond will be different depending on the temporal dynamic of the damaging events. The different steps of a scenario run are summed up in Fig. 5. The way the global damage table is updated is based on the following rules: -For point-like objects, there is only one possible damage state at once. If a phenomenon induces heavier damage than the previous one, the damage state is updated. Otherwise, if the induced damage is less than its current state, the object remains in the same state.
-The same procedure applies for linear or area-like objects, with keeping in mind however that portions of the object can be assigned to different damage states at the same time. This leads to less trivial updating equations, since all damage states of the object have to be updated, based on the area or length affected by the next damaging phenomenon (see Fig. 6).

Application to a case study in the Mount Cameroon area
This approach is then applied to hypothesised scenarios around Mount Cameroon, an active volcano located in the south-west part of Cameroon, in the Fako District.

Data inventory
This case study benefits from a previous study on Mount Cameroon, conducted by Thierry et al. (2008) in the frame of the GRINP project (Thierry et al., 2006). Extensive inventory field work as well as the use of GIS databases made available by the Ministry of Industry, Mines and Technological Development of Cameroon (MINIMIDT) have led to the identification of the following systems, which are considered in the scenario implementation (see Appendix B): -Built areas: three main structural typologies have been identified (i.e. 62.8 % of T 1: wooden houses with metal sheet roofs; 33.1 % of T 2: reinforced-concrete or cinder-block masonry buildings with metal sheet roofs supported by wooden frames; 4.1 % of T 3: clay brick masonry buildings with metal sheet roofs), but no data are available on the specific proportions of these typologies within each built-area polygon. This information only exists at the global level and therefore the same proportions are applied to all built areas, as a very rough approximation. Moreover, no information on the number of buildings has been gathered, and therefore the buildings (and the associated losses) are merely represented as percentages of the total built area. Finally, a dataset with the population amount within each built-area polygon is available, allowing us to compute specific population densities (see Fig. 7).  -Cultivated areas with crop types: they are represented as crop polygons, each one being assigned a specific type (i.e. subsistence farming or industrial plantations producing bananas, heating wood, hevea trees, palm trees or tea). The repartition of different crop types around Mount Cameroon is represented in Fig. 8.
-Water supply system: pipelines, water catchments and storage tanks are represented in a GIS database. Demand nodes are also assigned to the end of each network branch that feeds a built area.
-Electric power network: medium-voltage power lines and electric substations are modelled.
-Road network: only the primary paved road segments are considered, as well as bridges. Some traffic analysis zones (TAZ) are assigned to some nodes that are located in built areas, thus leaving the opportunity to estimate accessibility loss through the computation of origin-destination paths (Franchin et al., 2011).
-Critical facilities: the locations of strategic buildings are identified and three types are considered (i.e. heathcare centres, decision centres, and law enforcement buildings).

Selection of scenarios
The study of the volcano's past has suggested that effusive eruptions with lava flows are the most common volcanic events (i.e. cracks opening on the flank or near the summit of the volcano), even though some lakes located in ancient maar craters represent remnants of the occurrence of a few phreatomagmatic eruptions (Thierry et al., 2008). In addition, landslides (not linked with a volcanic eruption) represent a major threat, particularly to the south of the volcano.
Nat. Hazards Earth Syst. Sci., 13, 2409-2424, 2013 www.nat-hazards-earth-syst-sci.net/13/2409/2013/ The motivations for selecting these scenarios are the following: first, although minor eruptions are even more likely, 1922-like events are considered as the most representative type of major event that authorities should be prepared for. Second, the phreatomagmatic events have not been documented in historical records, but geological field investigations have demonstrated that such events may occur and cannot be neglected as they are highly dangerous. The aim of this second scenario is therefore to raise awareness on low probability/high impact events. Finally, the third scenario is based on a landslide and is aimed at illustrating the vulnerability of the regional electrical network to such local events. All three scenarios were tested. In the following, we focus on the first one. An eruption scenario, based on the sequence of events of the 1922 eruption, but hypothesised to affect the eastern side, was presented to the authorities in 2008 by Thierry et al. (2008), using their extensive geological field work which includes a study of the volcano summit. It is supposed to start with the opening of a crack on the volcano edge along the Cameroon line, north-west of the Fako District. This crack may induce flank collapses on its south-east side, and the volcanic gases that are released through the crack generate lava fountains out of the vent. These lava emissions may vertically eject ballistic blocks and tephra up to a few hundreds of metres. The tephra can then be dispersed by the wind to the south-west and cover the coast area with a few millimetres of ash. Finally, once the eruption has slowed down, heavy rains might fall on the thick tephra layers and other fallouts accumulated on the volcano flanks, thus generating lahars along the steepest slopes. The sequence of the different volcanic phenomena involved in this hypothetical scenario is represented in Fig. 9.

Probabilistic impact analysis and results
Now that both adverse event inputs and exposed elements are clearly identified and formatted, the corresponding vulnerability models have to be selected and applied to each combination of phenomenon-exposed asset. As described above, the developed toolbox enables us to host different vulnerability models, whether probabilistic or deterministic. Since the objective of this study is not so much to perform an accurate scenario as to demonstrate the feasibility of our approach, some vulnerability models have been chosen, even though they may not be the most adequate or recent ones, and they are described in Table 1.
Damage matrix models are tables that give intensity ranges (e.g. tephra thickness, see Appendix C) within which the exposed element is assigned a given damage state (e.g. damage ratio expressed in percentages). Binary models just check if the exposed element is located within the hazard occurrence area, resulting in complete damage if this is the case. Finally, fragility curves used here represent the probability of roof collapse given a level of tephra load. For the roof types encountered in this study, a median load of 2 kPa is assigned to simple metal sheet roofs (i.e. building typologies T 1 and T 3) and a load of 3 kPa is set for metal sheet roofs with wooden frame support (i.e. building typology T 2). The standard deviation of the fragility curves is assumed to be 0.3 (Jenkins and Spence, 2009). Since the fragility model from Spence et al. (2005a) uses tephra load as the intensity measure and since our hazard intensity map is expressed in tephra thickness, a rough conversion is performed by considering a tephra deposit density of 1600 kg m −3 (Thierry et al., 2006). This corresponds to the density of wet tephra, which constitutes a reasonable assumption, given the rainy climate of the studied region.
As can be seen in Table 1, the scenario relies on a combination of both probabilistic and deterministic models, thus requiring us to run multiple analyses of the same scenario to obtain stable statistics of the distribution of the proportion of collapsed roofs due to tephra load. Other deterministic models yield the same result for each run, however they should be computed simultaneously with the probabilistic ones, since the loss estimation of infrastructures other than buildings is of crucial importance in the eventuality of a systemic analysis. The final results of this multi-event scenario can now be aggregated for each system (see Table 2). Depending on the asset type, losses can be expressed in terms of discrete amounts (e.g. number of destroyed bridges), lengths of damaged edges (e.g. road segments or power lines) or areas for crops and residential buildings (in ha or km 2 ). For each exposed component, a damage scale is defined, ranging from 0 (intact state) to 1 (destruction); this scale is derived from the damage matrices used in this study (Thierry et al., 2006(Thierry et al., , 2008 or from a trivial interpretation of fragility functions (e.g. the probability of roof collapse due to tephra load is equivalent to the probability of reaching damage state 1 for building roofs).
A careful look at the aggregated damages presented in Table 2 provides a clearer view of the effects of considering a multi-event scenario. For instance, in the case of common built areas, a distinction is made between the building itself (i.e. the vertical structural elements) and the roof system, since some phenomena only affect the roofs (e.g. tephra load) or the load-bearing walls (e.g. lahars or debris flows). If the load-bearing elements are destroyed, the roof is also considered as collapsed, since it is not supported anymore. Therefore, in this specific scenario, 146 ha (in terms of built area) of T 1 and T 3 load-bearing elements are destroyed by the events corresponding to lateral flows (e.g. lahars or lava flow); the same amount of collapsed roof is therefore assigned to roofs T 1 + T 3. However, the difference (i.e. the total area of collapsed T 1 + T 3 roofs is actually 209 ha) is due the additional damage endured by this roof typology due to tephra fall. On the contrary, the amount of destroyed elements is the same for typology T 2, whether it is for roofs or for load-bearing walls. This is due to the fact that these buildings have been assigned a stronger roof system (i.e. metal sheet roofs supported by wooden frames) and that the tephra load level used in this application was not sufficient to reach collapse.
By summing costs of damages or reconstruction provided by Thierry et al. (2006) and Thierry et al. (2008), it is possible to provide estimates of some categories of costs induced by each considered scenario. For example, the economic evaluation of direct tangible damages for the first hypothesised scenario (based on the 1922 eruption) leads to an impact of 7 billion XAF (Franc CFA) due to lava flows. These costs are mostly due to damages to buildings. In addition, for the same eruption scenario, the hypothesised ash fall could lead to indirect tangible costs of 5 billion XAF, mostly due to losses of production in industrial plantations.
This scenario also involves impacts on population that are difficult to estimate in an economic way (124 km 2 of crops would be affected, potentially leading to famine), and intangible impacts, as 380 km 2 of forests would be affected by ash fall of more than 1cm 2 . In the third scenario (landslide affecting a critical electrical facility), the direct economic costs are estimated at about 1 billion XAF. However, since the facility hypothesised to be impacted is critical for the whole region, the indirect costs cannot be estimated, but they would be expected to be extremely high. It must be remembered that these costs are based on hypothetical eruption scenarios, and that these figures are limited by the lack of knowledge in crop vulnerability functions. However, they illustrate the intrinsic limitations of such tools for economic assessment; although indirect or intangible damages can be very important, it remains very difficult to evaluate the economic impacts of eruptions beyond the direct tangible damages.

Utility of the developed scenario builder tool in Mount Cameroon
The application of the proposed approach to this case study has been useful to demonstrate its ability to treat large extents of exposed areas, as well as the possibility to define the analysis resolution, depending on the desired accuracy level and the computation time available. Besides, the present results have been compared to a manual analysis of the scenario using a straightforward GIS-based spatial analysis. It has been found that the damage tables from both analyses are almost identical, thus verifying the assumptions made in our approach (e.g. projection of exposed elements into a set of mesh grid cells).
The results of such a composite scenario can be directly exploited by local planners to estimate the costs associated with repairing or replacing the damaged assets detailed in Table 2 (estimates of repairing costs per unit are provided in Thierry et al., 2006). The implemented toolbox also specifies which cells, edges and nodes are damaged or destroyed, thus allowing us to localize the affected areas in the MAT-LAB mapping environment (see Figs. 10 and 11 for some examples). Syst. Sci., 13, 2409-2424, 2013 www.nat-hazards-earth-syst-sci.net/13/2409/2013/  Fig. 5. The crop typologies V 1 to V 7 correspond to the ones presented in Fig. 8. The average outcome of 200 probabilistic runs has been chosen to represent the damage to built areas.

Complementarity of risk scenarios and risk mapping
Compared to risk assessment and mapping, scenario-based simulations are easier to conduct, although they do not provide a complete picture of all potential crisis situations that may occur (Rolandi, 2010). In practice, some background knowledge on the studied volcano can quite readily be used to propose eruption scenarios and rank them upon their plausibility. On the other hand, a full event tree hazard assessment usually requires extensive studies of the volcano's past and quantitative knowledge of the eruptions' magnitudes and return periods. Finally, outputs from scenario-based risk analyses can be directly understood and exploited by local planners, as they are confronted with the consequences of a hypothetical event and can promote preparedness and mitigation measures accordingly. Probabilistic risk assessment still provides more information, in terms of event occurrence probability for instance; however, the presence of multiple types of damaging volcanic phenomena implies output of different risk maps (i.e. one for each phenomenon) or merging of the risk from all possible hazard types with respect to common damage states. Both of these solutions tend to prove confusing and difficult to exploit, compared to the outcomes of a few carefully selected scenarios. However, Rolandi (2010) shows that to avoid overadaptation to a single scenario (and maladaptation to others), disaster risk management procedures should be revisited periodically with respect to renewed scenarios.

Limitation of the risk scenario approach
On the other hand, intrinsic limitations of complete risk scenario tools must be remembered: -The core of the approach lies in the accuracy of damage functions. Such functions are designed upon observation of adverse events. In the field of volcanic risk, there is a multiplicity of damaging phenomena, and consequently, not all vulnerability functions have reached the same level of maturity. This may either be due to the fact that few data have been analysed (e.g. vulnerability of crops to tephra fall) or that the mechanisms are complex and depend on several factors (see, e.g. Jenkins et al., 2013). For example, the fragility of buildings to tephra fall is a function of both thickness of ash and its humidity (e.g. Macedonio and Costa, 2012).
-The scenario builder tool is primarily designed to evaluate potential direct damages, i.e. those attributable to the physical impact of an adverse event. Some of the direct damages evaluated through the scenario builder tool are intangible (i.e. no monetary value can be given to the affected assets, e.g. a natural forest or a small private cultivated parcel of land) and some indirect damages can be evaluated (e.g. losses of industrial crop production), but these assessments of intangible or indirect damages remain highly incomplete; many indirect damages are not considered (i.e. those due to the unavailability of an infrastructure or of electricity). Hence, the costs presented as a result of the scenario builder tool correspond to the direct tangible damages and to losses of production in the industrial plantations only. Here, they are calculated using the reconstruction costs per unit and values of production evaluated by Thierry et al. (2006) and Thierry et al. (2008) (see their Table 5). In addition, at least two aspects related to the economics of reconstruction are not taken into account here: first, when costs of reconstruction exceed a threshold, the capacity to respond can be in-sufficient to completely recover from a disaster. Secondly, below that threshold, the costs of reconstruction are larger when the economy is growing than in recession (Hallegatte and Ghil, 2008). This is due to the reconstruction activity adding additional pressure to the employment market when the economic activity is expanding. Adding these important features to a cost assessment model would require the coupling of an economic model with a risk scenario model, and these examples illustrate that the scenario tool alone is insufficient for economic assessment of potential eruptions.
-While indirect damages (i.e. those not attributed to the physical impact of an adverse event but to the disturbance to activities) are not quantified in this approach, with the exception of agriculture, two efforts have been made to take account of them: first, we identified the strategic importance of exposed elements. In the case of Mount Cameroon, those include especially crops, water and electricity networks, as well as a series of key facilities during and after the crisis. Secondly, a critical analysis of scenarios has been conducted to evaluate which indirect and potentially intangible damages may result from the scenario, with a particular focus on potential diseases and famine. Indeed, oral reports about previous eruptions and the available knowledge on crops vulnerability functions suggest that food supply security is one critical aspect to consider in volcanic crisis management in Mount Cameroon.
Finally, owing to recent improvements in adverse event modelling, several applications that are based on nearly exhaustive simulations can now be considered as mature enough; this includes the refinement of hazard maps (e.g. Favalli et al., 2012), and the testing of mitigation measures (e.g. Crisci et al., 2010) and evacuation procedures in case of destructive events (e.g. Marrero et al., 2012). However, as recalled by Rolandi (2010), an acute knowledge of the hazard is necessary, as well as the corresponding vulnerability. In the case of relatively moderate volcanic activity, risk scenarios are useful to help authorities identify the potential scale of the events (e.g. Thierry et al., 2008) and prepare for the management of the crisis and recovery. Our study shows it is possible to generate multiple risk scenarios, with intrinsic limitations when coming to the assessment of monetary values and indirect damages.

Conclusions
By benefiting from recent developments in the field of seismic risk, an integrated approach to the quantification of the losses of built infrastructures in the case of an eruption scenario has been proposed. This study has proposed some   (after Stieltjes, 1997;Boiteux and Baumstark, 2001;Thierry et al., 2006Thierry et al., , 2008Neri et al., 2013).

Type of adverse events Related possible intensity
Lava flow I 5 for any affected location Fallout I 1 to I 5 depending on the thickness of deposits Gas and acid rain I 1 to I 2 Lahar I 3 to I 5 depending on slopes Rapid landslides and debris flows I 5 in the particular case of Mount Cameroon Earthquakes Observed intensities: I 1 to I 3 in Mount Cameroon insights on how to compute scenarios that imply the occurrence of successive volcanic adverse events. First, an inventory removal algorithm has been implemented in order to update the exposed assets that have been damaged by a previous hazard. An additional step would be to use vulnerability models that are able to yield different outcomes depending on the initial state of the exposed component (i.e. intact or already damaged). An interesting feature of the proposed approach lies also in the use of an object-oriented architecture that offers significant flexibility in the modelling choices, thus allowing us to consider various types of infrastructure systems (e.g. networks, built areas, individual buildings) and to use different vulnerability models, whether probabilistic or deterministic. Finally, the implementation of this approach in a proof-of-concept tool and its application to an arbitrary scenario around the Mount Cameroon volcano have proved its ability to perform risk scenarios on large spatial areas (i.e. hundreds of km 2 ). Moreover, the validity of the projection procedures and of the cell-based analysis could also be verified. Some current limitations need however to be looked at. Some are inherent to the scenario approach, which primarily focuses on the potential direct damages, excluding indirect ones. Other are related to the developed tool, which presently only addresses the case of deterministic scenarios. A complete probabilistic risk assessment would require event-tree approaches and adverse event propagation models. This part of the risk analysis could be coupled with the current toolbox in order to perform loops of scenarios and obtain physical losses along with their associated return periods. Another potential improvement lies in the implementation of a functionality analysis of the impacted systems; the original toolbox for seismic risk evaluation developed within the SYNER-G project has been developed in order to perform systemic risk analyses on interdependent systems. The scenario-based risk assessment described in this paper only covers physical damage for now. This aspect should definitely be considered in next developments, since it would constitute an invaluable help for local planners to forecast the accessibility of evacuation roads or the performance of lifelines in a volcanic crisis context. Table B1. Description of the damage states of the elements considered in this study (after Stieltjes, 1997;Thierry et al., 2006Thierry et al., , 2008Quinet, 2011 Table C1. Description of the typologies identified during the inventory of exposed elements (after Thierry et al., 2006Thierry et al., , 2008Quinet, 2011 V 2 + V 6 Tea plants and banana trees (herbaceous plants) V 3 + V 4 + V 5 Hevea rubber and oil-palms (trees) V 7 Unknown last input is summarized in Table A2. Finally, the experts can define the extent of potential eruptive events using their knowledge of the volcano, evidences from field surveys and from previous eruptions as well as results from modelling tools, when available. In this particular exercise, the scenarios were defined by a group of geologists and mostly based on field surveys, expert knowledge and digital elevation models.

Appendix B
Input information on the damage scales of exposed elements Table B1 summarizes the basic material which has been collected from previous reports and publications to describe the damage states of exposed elements (Sect. 2.5).

Input information on vulnerability of elements at risk
This appendix summarizes the basic material which has been collected from previous reports and publications to describe the typology of the exposed elements around Mount Cameroon and their corresponding vulnerability models (Sects. 2.3, 2.5 and 3.1). The emphasis is put on the vulnerability to tephra, since this phenomenon is the only one in this study that has been assumed to induce gradual damages (as opposed to binary models for the other adverse events). Table C1 describes the various typologies considered for some of the exposed elements, while Table C2 presents the fragility models that have been used for the elements, when subjected to tephra accumulation.