Developing a Functional Model for Cities Impacted by a Natural Hazard: Application to a City Affected by Flooding

The experience feedback on a crisis that hit a city is frequently used as a " recollection " tool. To capitalize information about an experience feedback from the cities that have been affected by a natural hazard, the authors propose in this study a functional model to model scenarios of city crises. In this model, the city, considered as a complex system , was modelled using a functional analysis method. Based on such modelling, two risk analysis methods (Failure Mode and Effect Analysis and Event Tree Method) were deployed and adjusted. Lastly, a qualitative reasoning model was used for the scenario modelling of the urban crisis. By functional modelling performed on components of the cities, the objective of this model is to replicate the behaviour of a city affected by a crisis, highlighting the sequences of failure and non-failure modes that have operated during the crisis. This model constitutes a means of understanding the functional behaviour in a crisis of cities and capitalization of the experience feedback of the cities affected by crisis. Such functional modelling was deployed in a case study.


Introduction
For the past decades, growing urbanization and industrialization has given rise to a sharp increase in harmful disastrous events, thereby demonstrating the city's higher exposure to major risks, e.g.flood risk (Ashley et al., 2007).In addition, climate change will lead to a substantial escalation and increase in frequency of a number of natural hazards (Muller, 2007).Cities, particularly vulnerable, need to acquire new tools to guard against future disasters and improve their resilience when facing such hazards.The RESILIS project -Technical urban systems governance for a resilient cityfunded by the French National Research Agency, addresses such issues and aims at improving urban system resilience in the face of natural or anthropogenic hazard-driven crisis.All works described herein were conducted as part of the RE-SILIS project and focus on developing a functional model for cities.
Improving the resilience of crisis-stricken cities is a key objective for crisis management stakeholders in the city.Such an improvement cannot succeed without a better understanding of how urban systems behave when hit by a crisis.For that reason, performing a detailed review of urban crisis experience feedback is essential (Komendantova et al., 2014).The experience feedback can be defined as a process of collecting information about an event in order to trace the detailed evolution of the event and all actions taken to address them.This is usually done within an organization (enterprise, local authorities, state services, etc.) when there is a deviation from normal system operation (Wybo and Van Wassenhove, 2009).Such experience feedback will help identify failures occurring during a dreaded event, analyse the different scenarios and draw meaningful conclusions.Based on such analyses, the city should be able to improve its protection, prevention and crisis management performance, in the event that a similar event were to impact the considered urban system again.However, in order to learn from urban crisis experience feedback, a methodology must be clearly set up so as to formalize the experience feedback, provide a model for the impacted city's failures, and understand the failure processes as well as the sequences and causal relationships thereof.This is not a negligible issue since urban systems appear particularly complex due to their many constituent subsystems, and the multiple organizations and governance (Lhomme et al., 2013;Toubin et al., 2012).The main scientific issue pertains to developing a model that might reproduce the complex operation and deficiencies of urban systems.An underlying issue relates to modelling the experience feedback on crisis-stricken urban systems.The aim is to analyse urban crisis case studies, understand the failure processes thereof and view them within a homogeneous model.
The objective of this research is to develop a model that will allow modelling the crisis-stricken cities functional behaviour.Reference work searches did not reveal many models for urban system modelling existing in the technical literature, except for research undertaken by teams working in urban engineering and more particularly in the field of urban resilience (Campanella, 2006;Serre et al., 2012).Resilience is generally included in the concept of response to sudden impact like natural disasters (Alberti et al., 2003;Pickett et al., 2004).The concept was initially a term of ecology (Holling, 1973) and has evolved significantly in the past 30 years (Folke, 2006;Gallopín, 2006).Recognition has increased across disciplines that human and ecological systems are interlinked and that their resilience relates to the functioning and interaction of the systems rather than to the stability of their components or the ability to maintain or return to some equilibrium state (Klein et al., 2003).The management of urban resilience focuses on reducing the extent of the damage, speeding recovery and adapting to unexpected threats, in addition to protecting against known threats (Linkov et al., 2014).Thus, considering the city as a system, urban resilience can be defined (according to Campanella, 2006) as "the capacity of a city to face devastating event reducing damage at minimum".Concerning the natural hazards -particularly for the flood hazard -resilience concepts are comprised of individual preventive and emergency measures at building scale and a land use policy to adapt building activities to floods (Pasche and Geisler, 2005).The resilience concept has been applied to flood risk management by adopting a system approach (De Bruijn et al., 2005).The system approach tends to overcome the segmentations and level of complexity.Indeed, a system approach proposes a common language for different disciplines and can be considered a good way to study complex systems (Batty, 2009).The research work of Lhomme et al. (2011) is based on this approach and he defines urban resilience as "the ability of a city to absorb disturbance and recover its functions after disturbance".He used a system model for studying cities and for modelling their functions.The model seeks to assess the resilience level of urban networks.Indeed, urban networks play an important part in crises and not always in positive waysfor instance, the reliability and rapid restoration of the electric grid is particularly necessary to support the needs of the population within a disaster area effectively (Winkler et al., 2010).
In this study, in representing the functional behaviour of a city affected by a natural hazard, we are interested in all urban system components including technical networks.Our model uses functional analysis methods in order to understand how the systems work (Baroth et al., 2013), risk analysis methods designed for modelling complex systems and qualitative reasoning models for the representation of failure sequences in the form of causal graphs (Forbus, 1996).After reviewing past experience feedback, the goal is to suggest a functional methodology that will allow us to reconstruct the failure scenarios that occurred in the crisis-stricken cities.We have applied this model to urban crisis case studies, to model the cities impacted by natural hazard, by the successions of failure and non-failure modes that took place during crisis.
Two advantages arise through this model.Firstly, it is possible to have knowledge of satisfactory functioning and dysfunctions at the component level of a city, when hit by a natural hazard.Secondly, it is possible to capitalize on the experience feedback from urban crises in functional form and benefit from this experience feedback for better management and an improvement of the components of a city.These advantages help improve our understanding of urban system failures.
This is an innovative research project as it uses functional analysis, risk analysis and qualitative reasoning models and applies them to urban engineering.Adjusting such methods will result in developing a functional model to outline the behaviour of a crisis-stricken city, and showing how helpful it can be for analysing urban crisis experience feedback.This aspect is described in Sect. 2. In Sect.3, the model is applied to the case study of an urban crisis caused by flash floods.The city selected as a case study is the city of Nîmes (France), which was struck by major runoff flooding in 1988.Such application will show how much can be learnt from such a model about the weak points to be improved in an urban system.Section 4 specifically address the case study.Based on the different suggested models, the urban system's strengths and potential improvements are described.

Developing a functional model for crisis-stricken cities
Our goal is to develop a functional model that will help to better understand the functional behaviour of a city faced with an external hazard, to analyse its failures, reconstruct the failure scenarios, determine which components are more efficient and which are most critical, in order to take the benefit of the experience feedback of crisis and then to improve the city component's resilience in any subsequent similar situation.

Functional model development procedure for crisis-stricken cities
A city is a complex system with many a constituent subsystems and multiple interactions between those subsystems and the city's outer environment (Zevenbergen et al., 2010;Serre et al., 2011).Consequently, risk analysis methods used in industry to identify risks and model complex system functions are considered relevant for modelling and analysing how a crisis-stricken city operates (Baroth et al., 2013;Modarres, 1993).Also, qualitative reasoning models are deemed relevant for representing urban crisis (Forbus, 1996).Such methods have been used in the past as part of civil engineering projects (Peyras et al., 2012;Serre et al., 2008).They have also been applied to urban engineering with regard to technical networks (Serre et al., 2011).
Our procedure for building a functional model that will outline the functional behaviour of a crisis-stricken city can be summarized in four steps: (i) a functional analysis: the urban system and the subsystems' functions are determined; (ii) failure mode and effect analysis (FMEA): information on failures occurring in an urban system due to a dreaded event are capitalized on from experience feedback; (iii) event-tree method (ETM): for each component, a representation of potential scenarios is suggested, including the scenario resulting from experience feedback, as a sequence of failure modes; (iv) a qualitative reasoning model with causal graph modelling: a dynamic and gradual model of failure is suggested to describe the urban failure scenario from experience feedback.

Functional analysis applied to cities
The functional analysis consists of two stages: the external functional analysis, including analysing the system within its environment, and internal functional analysis, including a structural analysis of the system, i.e. identifying its various constituent subsystems, and exploring the subsystems' functions (Baroth et al., 2013).Many functional analysis methods are suitable for industry, services or organizations.It was decided to rely on one method deriving from value analysis: the APTE method as successfully used and applied to civil engineering systems (Peyras et al., 2006).
In functional analysis, two categories of functions are considered to reflect the actions of a system: main and technical functions.The main functions convey the purpose of a system's action.Technical functions model how the system reacts to stresses set by the external environment.Functional analysis also uses functional block diagrams (FBDs) to represent the system and external environment (Baroth et al., 2013).
The external functional analysis aims at defining the system to be reviewed, its limits and interacting external environments (Baroth et al., 2013).When applied to cities, the system is regarded as consisting of the urban system delineated by its geographic and administrative boundaries.Figure 1 shows the FBD of a generic urban system.This FBD makes it possible to show how the urban system interacts with external environment -including neighbouring cities, rural areas, outer technical networks (power, water, telecommunications, transport networks, etc.), environmental factors (meteorology, seismic situation, etc.) and governance.These elements were defined by different experts in urban engineering during work sessions.From this FBD, we deduce the main and technical functions of a generic urban system.
The internal functional analysis is performed for a typical urban system.It is suggested (by experts in urban engineering) that four large categories of subsystems should be differentiated: technical networks, housing, businesses and public infrastructure.The population is implicitly included in each of these four large categories of subsystems.Such categories, referred to as grade 1 categories, may be detailed as grade 2 or grade 3 categories.Table 1 shows how the city is structurally subdivided into different subsystem categories.The main and technical functions have been taken from the FBDs.
As an example, the FBD for the Drinking Water Supply (DWS) technical network is shown in Fig. 2. From the FBD, the DWS technical network, main and technical functions may be differentiated and highlighted.The main functions are to "provide of drinking water for the housing, businesses and public infrastructures" and to "protect the city in case of fire".Technical functions are to "resist to mechanical loadings" and to "resist to failures from other technical networks interrelated with DWS technical network".
All the results from the internal functional analysis are compiled in a functional analysis table detailing the main and technical functions of a city's constituent subsystems.Table 2 provides a sample of such functional analysis table for the DWS technical network subsystem.For an analysis of other urban subsystem functions, see the RESILIS project (www.resilis.fr).
In this paper, we focus on five essential hand or technical functions required for the system to work properly when a dreaded event impacts a city: -the function "provide and/or drain off flows" for "water" technical network,  -the function "ensure": "ensure accommodation" for housing, "ensure their economic and social duties are performed" for businesses and "ensure and serve a public interest purpose" for public infrastructures, -the function "resist to mechanical loadings" for all subsystems.
Finally, the functional analysis drawn up for a typical city may subsequently be applied to a specific city for a case study through adjustments and quick streamlining.There-fore, this is a generic functional analysis that may apply to most urban systems.

FMEA applied to cities
FMEA is one of the most frequently used risk analysis methods in industry.FMEA is an inductive method for analysing the potential failures in a system (Modarres, 1993).Each component is consistently and consecutively considered and their failure modes (lost or impaired function) and effects A FMEA procedure will include a system functional anal-ysis then a systematic research for failure modes and effects thereof (Baroth et al., 2013;Modarres, 1993).
In order to be applied to urban engineering and serve to model the failure scenarios during crisis, the FMEA method had to undergo a number of adjustments.To that end, and to show the causal connections between phenomena and failure modes during an urban crisis, each parameter in the FMEA table and how they are achieved is precisely defined: failure mode, cause, effect.The suggested FMEA analysis includes the following: -subsystems; -subsystem main and technical functions, provided by the functional analysis; -subsystem failure modes, matching a function's failures and/or damages; -possible causes of failure, originating from either the strength and/or location of the given external mechanical loading, or the failure of a subsystem interacting with the analysed subsystem; -possible effects of failure.
For instance, the DWS technical network subsystem's technical function is to "resist to mechanical loadings", hence the failure mode thereof: "did not resist to mechanical loadings".A possible cause of such failure is "damaged DWS pipes".Consequently, the effect of such failure is that the population (housing, businesses and public infrastructures) no longer have access to drinking water.This example is shown in Table 3 as a FMEA table.
Unlike in industry, where FMEA is used as a tool to identify a system's failure modes, the FMEA is used here to identify, based on an experience feedback, the failure modes, causes and effects of crisis-stricken urban systems.At the end of the FMEA, the city's subsystems failure modes, causes and effects are known in connection with an urban crisis as detailed in the experience feedback.

ETM applied to cities
Based on the identification of failure modes, the failure scenario modelling methods are used to construct the sequences of failure modes that may lead to system failure.There are different methods for modelling risk analysis, one of the main ones being the ETM.The sequence of events on the tree is deductive or inductive (Zwingelstein, 1995), from the initiating event to the final events (Baroth et al., 2013;Modarres, 1993).The tree is chronologically developed according to how each modelled subsystem behaves.
As part of our study on urban systems, the ETM will be developed after the FMEA method has been applied.Indeed, failure modes that occurred during an urban crisis are determined.The ETM will then help model the chronological sequence of effects as identified during this urban crisis.
For instance, we consider, based on fictitious experience feedback, an urban system hit by severe flooding, for which the successive sequence of impacted subsystem failure modes is to be modelled.More specifically, three impacted urban subsystems are in focus: the electrical the power technical network, the DWS technical network, and housing.Failure of the functions "provide electric power" and "resist to mechanical loadings" for the electric power technical network lead to a defaulting technical function ("resist to power outage") for the DWS technical network.Thus, the failure of these technical functions results in the failure of the function "ensure suitable accommodation for population" for the housing subsystem.Ultimately, the flooding scenario for such urban crisis consists in the sequence of three failure modes: (i) failure of the electric power technical network that was flooded, (ii) failure of the DWS technical network due to power outage, and (iii) disruption of the electric power and DWS services for housing.This scenario, i.e. the sequence of failure modes described above, is modelled in Fig. 3.
In the end, the ETM allows us to produce a sequence of the subsystem failure modes according to their functional and chronological occurrence.Thus, an event tree consists of modelling an urban crisis as a functional scenario with sequenced urban subsystem failure modes.

Modelling crisis-stricken cities through qualitative reasoning models
The dynamic quality-based models resulting from qualitative reasoning models will help develop dynamic models in order  to reproduce the systems behaviours from their causal relationships: any event (e.g. a P phenomenon occurring in an urban system, see Fig. 4) impacting a variable (e.g. an urban subsystem's F function, see Fig. 4) will spread to other variables (other phenomena and functions in city) having a causal connection therewith, through causal paths (Forbus, 1996).Propagation may be simulated using quality-based and dynamic transfer functions with time as a parameter.
Of all dynamic quality-based models, the directed graph dynamic causal model is the most relevant for modelling an urban crisis scenario based on given experience feedback.Indeed, it will help show the dynamic and gradual change in impaired functions and subsystems over time.Also, redundancies may thereby be incorporated into the scenarios (introducing multiple identical phenomena in the scenario model) in order to take loop and non-linear scenarios into account.
Figure 4 gives an example of a directed graph dynamic causal model considering the experience feedback on a flooding event impacting an urban system and, more specifically, the impact of such an event on the electric power technical network subsystem.

Applying the functional model for flood-stricken cities
The functional model is applied to a case study pertaining to the city of Nîmes (France) after the October 1988 flooding.The event is first described and subsequently modelled following the above procedure: functional analysis, FMEA, ETM and causal model.Finally, the urban crisis is analysed based on the model results in Sect. 4.

Event description
The information description is based on reference work searches that helped draw up an experience feedback analysis grid of the 1988 runoff flooding in Nîmes as part of the RESILIS project.The pieces of information are derived  Operational crisis management public infrastructures 10.
Public infrastructure dedicated to vulnerable inhabitants from a variety of essays, media and books.For instance, the main reference (Fabre et al., 1994) described the event and the 1988 flooding hazard impact on Nîmes and its subsystems.
A runoff flooding occurred on 3 October 1988 within Nîmes catchment area.This rain and storm event took place between 04:00 and 12:00 UTC.This produced a sheet of water of between 300 to 420 mm, corresponding to an estimated 100-year return period, which caused the runoff flooding, especially as it had rained heavily for several days before 3 October 1988.This previous rainfall caused ground saturation, hence the substantial increase in runoff.The natural event was greatly exacerbated by the city's urban structures.Indeed, the intermittent stream beds located upstream the city of Nîmes had been narrowed by road infrastructure and housing.The intermittent streams were directed downstream of the city centre through pipes that were either undersized or cluttered up by technical networks.And the outlets of these intermittent streams down the city were blocked by road or railway embankments.Therefore, Nîmes and its population ended up being trapped by water.The flooding event in Nîmes had disastrous outcomes.Regrettably, there were several casualties, 30 houses were destroyed and about 2000 had their fittings damaged, causing 45 000 disaster victims, of which 200 had to be rehoused.Between 450 and 700 businesses were also damaged.The crisis management public infrastructure buildings were flooded (command post for organization of civil security response in the prefecture, fire and rescue service department, departmental fire and rescue operational centre, emergency ambulance service, police station), as well as the city's utility services (electric power, telecommunications, DWS, road transport).The estimated overall disaster cost was FF 3.3 billion.Nîmes was not prepared to respond to such a large-scale crisis: there was no prevention plan except for the weather report, no hydraulic protection works or structures capable of responding to such a severe flooding event, no flood forecast system since there is no large watercourse flowing through the city, no delineation regulation applied to areas liable to flooding and no specific crisis management procedure.The city of Nîmes had to deal with an unexpected and large-scale event without any specific protection or adaptation resources available.

Identifying the subsystems impacted
The subsystems of Nîmes impacted during flooding were determined based on the experience feedback (see Sect. 3.1).Table 4 shows all 10 impacted subsystems.
Based on such subsystems and by reviewing the event description contained in the experience feedback on the 1988 flooding in Nîmes, the functional model was applied.

Identifying the main functions of subsystems impacted
By analysing the experience feedback in Nîmes and considering the functions identified during an urban system generic functional analysis (Sect.2.2.1), the essential main functions impacted during an urban crisis were determined.The first function is "provide drinking water" which is ensured by the water technical network: due to the flooding event which began at 06:45 UTC on 3 October 1988, the DWS technical network was cut off as of 09:30 UTC, affecting 50 % of the city.Thus the impacted function during crisis was not ensured across the system.
The second function is "ensure communication and information" (to provide telecommunications flows): this function was ensured in Nîmes by two technical subsystems: the landline telecommunications technical network and the local radio telecommunications technical network.Four telephone exchange offices were flooded due to runoff flooding.Such flooding resulted in 60 000 users having their telephone communications cut off.In addition, the police telecommunications network was also cut off, thereby hindering communication in crisis management and emergency response operations.The "ensure information communication" function was indeed impacted by this event, although the second local radio telecommunications technical network subsystem remained in running order.
The third function is "meet the needs for travel": this function, ensured by the road transport technical network, was impacted by the flooding event due to the damaged road system.Indeed, over 30 km of roads were destroyed, resulting in restricted access to housing for crisis management stakeholders.
The fourth function is "ensure accommodation and shelter for the population": this function is ensured by all constructed entities in the city, especially during urban crisis.A Nat. Hazards Earth Syst.Sci., 15, 603-615, 2015 www.nat-hazards-earth-syst-sci.net/15/603/2015/large number of constructed entities were impacted by the flooding event, resulting for the population in loss of their homes, their jobs and access to public services for a variable length of time.
The main technical function involved in urban crisis is "resistance to flooding".

FMEA applied to subsystems impacted by the event
Once all functions impacted by the urban crisis were identified, the FMEA helped highlight the failure modes, causes and effects thereof on subsystems impacted by such urban crisis.FMEA is applied only to subsystems involved in the crisis event, as determined by the functional analysis (see Sect. 3.2.1).
A FMEA table was used for modelling the failure modes, causes and effects of the subsystems (10 subsystems) impacted by the flooding in Nîmes.The subsystem main and technical functions were analysed in the FMEA table.From such functions, the failure modes, causes and effects were determined based on information provided by the experience feedback of the Nîmes crisis.Information contained in this experience feedback were subsequently organized and classified in the FMEA table.
Table 5 provides sample results for the "DWS technical network".This table indicates that the function "provide drinking water for the housing, businesses and public infrastructures" of the DWS technical network has the following failure mode: "does not provide drinking water to 50 % of the city".This failure mode has the following cause: "interruption drinking water for 50 % of the city of Nîmes" and has the following effects: "50 % population, including housing, businesses and public infrastructure, no longer have access to drinking water due to their geographical location".

Event-Tree Method applied to Nîmes crises
The ETM is used to model the potential failure scenarios of October 1988 in Nîmes, in linking the different failure mode sequences.
The initiating event of the ETM to be considered is the runoff flooding.As described in Sect.3.2.1, the flooding event in Nîmes impacted 10 subsystems.The 10 subsystems require that the urban crisis should be modelled with regard to four essential main functions: (i) "provide drinking water", carried out by the DWS technical network, (ii) "ensure communication and information", carried out by the telecommunications technical networks (landline telephone and local radio services), (iii) "meet the needs for travel", carried out by the road transport network, (iv) "ensure accommodation and shelter" for the population, carried out by constructed entities.A model of the failures occurring in Nîmes was subsequently sought for each of these four essential main functions using the ETM and the procedure outlined in Sect.2.2.3.
We present in the paper the modelling of the failure of the main function "provide drinking water" (Fig. 5).Event-tree modelling of the "DWS technical network failure" involves the following subsystems: electric power technical network, DWS technical network, decision-making crisis management public infrastructures and operational crisis management public infrastructures.In Fig. 5 we detail the scenario that occurred during the Nîmes crisis in October 1988.
The ETM makes it possible to highlight the different potential scenarios, in a flood crisis-stricken city, induced by various sequences of failure modes, for each one of four urban subsystem essential main functions.

Modelling the city of Nîmes during the runoff flooding of 1988 using the directed graph dynamic causal model
The directed graph dynamic causal model helps to show the dynamic and gradual change in impaired functions and subsystems over time.It demonstrates the impact of an initiating event (P as phenomenon) on one or more variables (F as function), and how it would spread to other variables (other phenomena and functions in the city) having a causal connection thereto through causal paths.
With regard to the experience feedback for Nîmes, a directed graph dynamic causal model may be developed considering the sequence of subsystem failures as suggested in the event trees (see Sect. 3.4).In this respect, this model provides a dynamic perspective on the scenario occurring in Nîmes from 3 to 4 October 1988.In Fig. 6, the DWS technical network section demonstrates that, faced with the runoff flooding phenomenon that occurred on Monday 3 October 1988, the function "provide drinking water" proved poorly efficient.However, the crisis management public infrastructures managed to handle the technical network failure.The population were supplied with substitute drinking water as soon as the following morning (Tuesday 4 October 1988).
Therefore, the directed graph dynamic causal model shows the global scenario derived from the experience feedback on the considered case study, including each relevant subsystem-specific scenario.The scenario is then more specifically defined by describing all phenomena at stake as a result of the failure modes.Unlike the ETM, the dynamic causal model does not highlight the different potential scenarios resulting from an initiating event.For that reason, a scenario's criticality may not be assessed against a whole set of potential scenarios.

Discussion on functional modelling of the Nîmes crisis
In the example of the case study, the flooding of Nîmes in October 1988, we chose to analyse the DWS technical network failure (see Fig. 5).To last a long time ETM method, show how the function "provides drinking water" may be affected.These different scenarios may result in the failure or non-failure of subsystems' functions that are involved in potential failures of the DWS technical network.Scenario #5 (see Fig. 5), of all possible scenarios, is the one derived from the experience feedback on the flooding's in Nîmes 1988.Indeed, during the crisis a cut-off of DWS technical network occurred in 50 % of the city.This cut-off is due to the DWS technical network contamination on 3 October 1988 at 09:30 UTC.However, the crisis management public infrastructures ensured their functions with respect to such failure.The function of component "decision making crisis management infrastructure" that is "to decide on implementing substitute of drinking water" was performed with success.Substitute drinking water was quickly supplied to the population on 4 October 1988, as shown in scenario #5 of the event-tree through the sequence of failure modes regarding: "resist a contamination" and "ensure undisrupted service" technical functions for the DWS technical networks; "decide on implementing substitute of drinking water" principal function for decision-making crisis management public infrastructures; "ensure substitute of drinking water" principal function for operational crisis management public infrastructures.
In light of the different scenarios shown in Fig. 5, it may be inferred that the most critical scenarios are related to defaulting crisis management public infrastructures.As a matter of fact, a situation will be deemed under control when crisis management public infrastructures are able to respond, by carrying out their functions, to other urban subsystem failures.For example, a scenario more critical that scenario #5 is scenario #8 which corresponds in experience feedback to Monday 3 October 1988.Indeed, no decision or emergency response operation was considered on this day to respond to the DWS technical network.The city of Nîmes can be viewed as exhibiting intermediate behaviour in regard to their defaulting DWS technical network on a time limit of 2 days, by calling on their crisis management public infrastructures for action.The city's resilience with regard to the defaulting "provide drinking water" function would most likely be improved with a faster response from crisis management public infrastructures (response in 1 day).Indeed, the principal function "decide on implementing substitute of drinking water" for decisionmaking crisis management infrastructures and the principal function "ensure substitute of drinking water" for operational crisis management infrastructures should have been carried on Monday 3 October 1988 instead of Tuesday 4 October 1988.A better resilience in Nîmes would also imply securing the DWS technical network against the flooding phenomenon in order to reduce the length of technical network cut-off.
The ETM model proposed is a generic event tree for urban crisis affecting any one of the considered essential main functions, and may therefore apply to a large range of cities that were or might be subjected to this type of crisis.For each event tree, the procedure helped to determine how the city behaved in the event of a crisis, and such behaviour was identified and modelled by one potential scenario.

Utilization, advantages and limitations of the functional model
The functional model developed in this study has a dual purpose: capitalize on the failures of the city affected by a natural hazard and analyse behaviour.We present here the application of our model to the city of Nîmes, which was impacted by a flood in October 1988.Based on information from the experience feedback established following this event, we capitalized the failures of the functions of the various subsystems that have been mentioned in this experience feedback.Failures of the functions of affected subsystems, their causes and their effects are compiled into a FMEA table.The behaviour of each subsystem is then analysed by the ETM.The dependencies and the functional relationships between the subsystems are taken into consideration chronologically.Thus, the functional model can scan potential scenarios of the function failures and their effects for each subsystem.A directed graph dynamic causal model highlights the scenario that occurred during the crisis, by a logical chain of phenomena and functions for each subsystem mobilized during the event.
The novelty in the use of these methods is that their use is based solely on experience feedback.They have been adapted to this problematic, such as FMEA does not aim to find the set of failure modes, their causes and effects possible but retains only the information from the experience feedback.
The application of our model can be performed on a city that has been impacted by various natural hazards (flood, earthquake, landslide. . . ) and for which an experience feedback has been realized, including a complete register of failures subsystems and actions undertaken by the actors during the crisis management.In the framework of the RESILIS project, we have applied our model to four other cases of cities impacted by natural and technological hazards: the city of Annecy (France) impacted by an earthquake in July 1996; the city of Arles (France) impacted by flooding in 2003; the city of Toulouse (France) impacted by the explosion of factory AZF "Grande Paroisse" in 2001; and the city of Voûltesur-Rhône (France) impacted by the derailment of a train carrying hydrocarbons.For these four cases, the functional model has facilitated the analysis of positive and/or negative behaviour of the city facing a catastrophic event (Toubin et al., 2013).
This model based on risk analysis methods helps to improve the formalization of an experience feedback.It may be considered as a first step towards the analysis of the actions to be implemented with the aim to improve the resilience of a city impacted by a hazard.This model is intended for municipalities and local authorities wishing to use simple tools to reorganize procedures for prevention and protection, and the risk management for crises that may arise.
Our functional model is limited primarily by the fact that its effectiveness depends on the availability and quality of information from the experience feedback of the city crisis.Second, this model is considered as a first step in the analysis of the crisis in order to improve the resilience of the city studied.It must be supplemented by other tools.Nevertheless, it can give indications of the subsystems of the city that are potentially the most critical and where there is urgent need to implement further study.

Conclusions
The functional model developed with a view to evaluate the behaviour a crisis-stricken city comes down to five basic steps: (i) to perform a "generic" functional analysis for an urban system.Such analysis includes, on the one hand, an external functional analysis showing all items outside the urban system as well as the principal and technical functions thereof and, on the other hand, an internal functional analysis defining each subsystem's main and their functions.The "generic" functional analysis underlines the essential functions required by the system to work properly; (ii) to have an experience feedback on an urban crisis; (iii) to analyse failure modes and effects using the FMEA method based on the experience feedback on the city of interest; (iv) to model different potential failure scenarios for the different potential sequences of failure modes, based on the initiating event and using ETM; (v) to represent the dynamic and gradual change in failed functions and subsystems as described in the experience feedback using a directed graph dynamic causal model.Such representation will also offer a global perspective on the scenario that occurred during the urban crisis of interest.
This urban crisis experience feedback analysis tool helps modelling the functional behaviour of a crisis-stricken city.The purpose of this model is to help the various stakeholders of a city impacted by a natural hazard to better prepare for a similar hazard occurring in the future.Also, applying a crisisstricken city's functional model to experience feedback will allow the lessons learned from such modelling to be extended to other cities liable to similar hazards.Most lessons learned will stem from the ETM where trees are, in this tool, generic trees representing an urban crisis that impact a specific main function and involve specific subsystems.These may therefore apply to a large range of cities that were or might be subjected to this type of crisis, without further extension to other subsystems.It should also be noted that this functional modelling tool for crisis-stricken cities applies to any types of hazards, should they be natural or technological.Lastly, the functional modelling tool for crisis-stricken cities is limited, as it would show the city's weak points only based on previous experience feedback.As a matter of fact, this tool may not be used to implement proactive crisis management procedures based on hazards the city has never experienced before.

Figure 1 .
Figure 1.Functional block diagram for urban system.

Figure 2 .
Figure 2. Functional block diagram for drinking water supply technical network.

Figure 3 .
Figure 3. Sample of ETM: application to drinking water supply technical network.

Figure 4 .
Figure 4. Sample of a directed graph dynamic causal model application, for the electric power technical network.

Figure 5 .
Figure 5. Event tree representing the drinking water supply technical network failure during the 1988 flooding in Nîmes.

Figure 6 .
Figure 6.Representation of directed graph dynamic causal model for the 1988 crisis scenario in Nîmes, for drinking water supply technical networks.

Table 2 .
Functional analysis table for drinking water supply technical networks.
are analysed.FMEA analysis results are outlined in tables specifically designed for the system type of interest.

Table 3 .
Sample FMEA applied to drinking water supply technical network.

Table 5 .
FMEA table for Nîmes during the 1988 runoff flooding event: sample of drinking water supply technical networks.