A city is a complex system with many a constituent subsystems and multiple interactions between those subsystems and the city's outer environment (Zevenbergen et al., 2010; Serre et al., 2011). Consequently, risk analysis methods used in industry to identify risks and model complex system functions are considered relevant for modelling and analysing how a crisis-stricken city operates (Baroth et al., 2013; Modarres, 1993). Also, qualitative reasoning models are deemed relevant for representing urban crisis (Forbus, 1996).

Such methods have been used in the past as part of civil engineering projects (Peyras et al., 2012; Serre et al., 2008). They have also been applied to urban engineering with regard to technical networks (Serre et al., 2011).

Our procedure for building a functional model that will outline the functional behaviour of a crisis-stricken city can be summarized in four steps: (i) a functional analysis: the urban system and the subsystems' functions are determined; (ii) failure mode and effect analysis (FMEA): information on failures occurring in an urban system due to a dreaded event are capitalized on from experience feedback; (iii) event-tree method (ETM): for each component, a representation of potential scenarios is suggested, including the scenario resulting from experience feedback, as a sequence of failure modes; (iv) a qualitative reasoning model with causal graph modelling: a dynamic and gradual model of failure is suggested to describe the urban failure scenario from experience feedback.

The information description is based on reference work searches that helped draw up an experience feedback analysis grid of the 1988 runoff flooding in Nîmes as part of the RESILIS project. The pieces of information are derived from a variety of essays, media and books. For instance, the main reference (Fabre et al., 1994) described the event and the 1988 flooding hazard impact on Nîmes and its subsystems.

A runoff flooding occurred on 3 October 1988 within Nîmes catchment area. This rain and storm event took place between 04:00 and 12:00 UTC. This produced a sheet of water of between 300 to 420 mm, corresponding to an estimated 100-year return period, which caused the runoff flooding, especially as it had rained heavily for several days before 3 October 1988. This previous rainfall caused ground saturation, hence the substantial increase in runoff. The natural event was greatly exacerbated by the city's urban structures. Indeed, the intermittent stream beds located upstream the city of Nîmes had been narrowed by road infrastructure and housing. The intermittent streams were directed downstream of the city centre through pipes that were either undersized or cluttered up by technical networks. And the outlets of these intermittent streams down the city were blocked by road or railway embankments. Therefore, Nîmes and its population ended up being trapped by water. The flooding event in Nîmes had disastrous outcomes. Regrettably, there were several casualties, 30 houses were destroyed and about 2000 had their fittings damaged, causing 45 000 disaster victims, of which 200 had to be rehoused. Between 450 and 700 businesses were also damaged. The crisis management public infrastructure buildings were flooded (command post for organization of civil security response in the prefecture, fire and rescue service department, departmental fire and rescue operational centre, emergency ambulance service, police station), as well as the city's utility services (electric power, telecommunications, DWS, road transport). The estimated overall disaster cost was FF 3.3 billion. Nîmes was not prepared to respond to such a large-scale crisis: there was no prevention plan except for the weather report, no hydraulic protection works or structures capable of responding to such a severe flooding event, no flood forecast system since there is no large watercourse flowing through the city, no delineation regulation applied to areas liable to flooding and no specific crisis management procedure. The city of Nîmes had to deal with an unexpected and large-scale event without any specific protection or adaptation resources available.

Once all functions impacted by the urban crisis were identified, the FMEA helped highlight the failure modes, causes and effects thereof on subsystems impacted by such urban crisis. FMEA is applied only to subsystems involved in the crisis event, as determined by the functional analysis (see Sect. 3.2.1).

A FMEA table was used for modelling the failure modes, causes and effects of the subsystems (10 subsystems) impacted by the flooding in Nîmes. The subsystem main and technical functions were analysed in the FMEA table. From such functions, the failure modes, causes and effects were determined based on information provided by the experience feedback of the Nîmes crisis. Information contained in this experience feedback were subsequently organized and classified in the FMEA table.

Table 5 provides sample results for the “DWS technical network”. This table indicates that the function “provide drinking water for the housing, businesses and public infrastructures” of the DWS technical network has the following failure mode: “does not provide drinking water to 50 % of the city”. This failure mode has the following cause: “interruption drinking water for 50 % of the city of Nîmes” and has the following effects: “50 % population, including housing, businesses and public infrastructure, no longer have access to drinking water due to their geographical location”.

The ETM is used to model the potential failure scenarios of October 1988 in Nîmes, in linking the different failure mode sequences.

The initiating event of the ETM to be considered is the runoff flooding. As described in Sect. 3.2.1, the flooding event in Nîmes impacted 10 subsystems. The 10 subsystems require that the urban crisis should be modelled with regard to four essential main functions: (i) “provide drinking water”, carried out by the DWS technical network, (ii) “ensure communication and information”, carried out by the telecommunications technical networks (landline telephone and local radio services), (iii) “meet the needs for travel”, carried out by the road transport network, (iv) “ensure accommodation and shelter” for the population, carried out by constructed entities. A model of the failures occurring in Nîmes was subsequently sought for each of these four essential main functions using the ETM and the procedure outlined in Sect. 2.2.3.

We present in the paper the modelling of the failure of the main function “provide drinking water” (Fig. 5). Event-tree modelling of the “DWS technical network failure” involves the following subsystems: electric power technical network, DWS technical network, decision-making crisis management public infrastructures and operational crisis management public infrastructures. In Fig. 5 we detail the scenario that occurred during the Nîmes crisis in October 1988.

The ETM makes it possible to highlight the different potential scenarios, in a flood crisis-stricken city, induced by various sequences of failure modes, for each one of four urban subsystem essential main functions.

The directed graph dynamic causal model helps to show the dynamic and gradual change in impaired functions and subsystems over time. It demonstrates the impact of an initiating event (P as phenomenon) on one or more variables (F as function), and how it would spread to other variables (other phenomena and functions in the city) having a causal connection thereto through causal paths.

With regard to the experience feedback for Nîmes, a directed graph dynamic causal model may be developed considering the sequence of subsystem failures as suggested in the event trees (see Sect. 3.4). In this respect, this model provides a dynamic perspective on the scenario occurring in Nîmes from 3 to 4 October 1988. In Fig. 6, the DWS technical network section demonstrates that, faced with the runoff flooding phenomenon that occurred on Monday 3 October 1988, the function “provide drinking water” proved poorly efficient. However, the crisis management public infrastructures managed to handle the technical network failure. The population were supplied with substitute drinking water as soon as the following morning (Tuesday 4 October 1988).

Therefore, the directed graph dynamic causal model shows the global scenario derived from the experience feedback on the considered case study, including each relevant subsystem-specific scenario. The scenario is then more specifically defined by describing all phenomena at stake as a result of the failure modes. Unlike the ETM, the dynamic causal model does not highlight the different potential scenarios resulting from an initiating event. For that reason, a scenario's criticality may not be assessed against a whole set of potential scenarios.

In the example of the case study, the flooding of Nîmes in October 1988, we chose to analyse the DWS technical network failure (see Fig. 5). The different scenarios, obtained with the ETM method, show how the function “provides drinking water” may be affected. These different scenarios may result in the failure or non-failure of subsystems' functions that are involved in potential failures of the DWS technical network.

Scenario #5 (see Fig. 5), of all possible scenarios, is the one derived from the experience feedback on the flooding's in Nîmes 1988. Indeed, during the crisis a cut-off of DWS technical network occurred in 50 % of the city. This cut-off is due to the DWS technical network contamination on 3 October 1988 at 09:30 UTC. However, the crisis management public infrastructures ensured their functions with respect to such failure. The function of component “decision making crisis management infrastructure” that is “to decide on implementing substitute of drinking water” was performed with success. Substitute drinking water was quickly supplied to the population on 4 October 1988, as shown in scenario #5 of the event-tree through the sequence of failure modes regarding: “resist a contamination” and “ensure undisrupted service” technical functions for the DWS technical networks; “decide on implementing substitute of drinking water” principal function for decision-making crisis management public infrastructures; “ensure substitute of drinking water” principal function for operational crisis management public infrastructures.

In light of the different scenarios shown in Fig. 5, it may be inferred that the most critical scenarios are related to defaulting crisis management public infrastructures. As a matter of fact, a situation will be deemed under control when crisis management public infrastructures are able to respond, by carrying out their functions, to other urban subsystem failures. For example, a scenario more critical that scenario #5 is scenario #8 which corresponds in experience feedback to Monday 3 October 1988. Indeed, no decision or emergency response operation was considered on this day to respond to the DWS technical network.

The city of Nîmes can be viewed as exhibiting intermediate behaviour in regard to their defaulting DWS technical network on a time limit of 2 days, by calling on their crisis management public infrastructures for action. The city's resilience with regard to the defaulting “provide drinking water” function would most likely be improved with a faster response from crisis management public infrastructures (response in 1 day). Indeed, the principal function “decide on implementing substitute of drinking water” for decision-making crisis management infrastructures and the principal function “ensure substitute of drinking water” for operational crisis management infrastructures should have been carried on Monday 3 October 1988 instead of Tuesday 4 October 1988. A better resilience in Nîmes would also imply securing the DWS technical network against the flooding phenomenon in order to reduce the length of technical network cut-off.

The ETM model proposed is a generic event tree for urban crisis affecting any one of the considered essential main functions, and may therefore apply to a large range of cities that were or might be subjected to this type of crisis. For each event tree, the procedure helped to determine how the city behaved in the event of a crisis, and such behaviour was identified and modelled by one potential scenario.

The functional model developed in this study has a dual purpose: capitalize on the failures of the city affected by a natural hazard and analyse behaviour. We present here the application of our model to the city of Nîmes, which was impacted by a flood in October 1988. Based on information from the experience feedback established following this event, we capitalized the failures of the functions of the various subsystems that have been mentioned in this experience feedback. Failures of the functions of affected subsystems, their causes and their effects are compiled into a FMEA table. The behaviour of each subsystem is then analysed by the ETM. The dependencies and the functional relationships between the subsystems are taken into consideration chronologically. Thus, the functional model can scan potential scenarios of the function failures and their effects for each subsystem. A directed graph dynamic causal model highlights the scenario that occurred during the crisis, by a logical chain of phenomena and functions for each subsystem mobilized during the event.

The novelty in the use of these methods is that their use is based solely on experience feedback. They have been adapted to this problematic, such as FMEA does not aim to find the set of failure modes, their causes and effects possible but retains only the information from the experience feedback.

The application of our model can be performed on a city that has been impacted by various natural hazards (flood, earthquake, landslide…) and for which an experience feedback has been realized, including a complete register of failures subsystems and actions undertaken by the actors during the crisis management. In the framework of the RESILIS project, we have applied our model to four other cases of cities impacted by natural and technological hazards: the city of Annecy (France) impacted by an earthquake in July 1996; the city of Arles (France) impacted by flooding in 2003; the city of Toulouse (France) impacted by the explosion of factory AZF “Grande Paroisse” in 2001; and the city of Voûlte-sur-Rhône (France) impacted by the derailment of a train carrying hydrocarbons. For these four cases, the functional model has facilitated the analysis of positive and/or negative behaviour of the city facing a catastrophic event (Toubin et al., 2013).

This model based on risk analysis methods helps to improve the formalization of an experience feedback. It may be considered as a first step towards the analysis of the actions to be implemented with the aim to improve the resilience of a city impacted by a hazard. This model is intended for municipalities and local authorities wishing to use simple tools to reorganize procedures for prevention and protection, and the risk management for crises that may arise.

Our functional model is limited primarily by the fact that its effectiveness depends on the availability and quality of information from the experience feedback of the city crisis. Second, this model is considered as a first step in the analysis of the crisis in order to improve the resilience of the city studied. It must be supplemented by other tools. Nevertheless, it can give indications of the subsystems of the city that are potentially the most critical and where there is urgent need to implement further study.