Indirect flood impacts and cascade risk across interdependent linear infrastructures

. Floods are the most frequent and damaging natural threat worldwide. Whereas the assessment of direct impacts is well advanced, the evaluation of indirect impacts is less frequently achieved. Indirect impacts are not due to the physical contact with flood water but result from the reduced performance of infrastructures. Linear critical infrastructures (such as roads and pipes) have an interconnected nature that may lead to failure propagation, so that impacts extend far beyond the 10 inundated areas and/or period. This work presents the risk analysis of two linear infrastructure systems, i.e. the water distribution system (WSS) and the road network system. The evaluation of indirect flood impacts on the two networks is carried out for four flooding scenarios, obtained by a coupled 1D-quasi 2D hydraulic model. Two methods are used for assessing the impacts on the water distribution system and on the road network, a Pressure-Driven Demand network model and a transport network disruption model respectively. The analysis is focused on the identification of: (i) common impact 15 metrics; (ii) vulnerable elements exposed to the flood; (iii) similarities and differences of the methodological aspects for the two networks; (iv) risks due to systemic interdependency. The study presents an application to the metropolitan area of Florence (Italy). When interdependencies are accounted for, results showed that the risk to the WSS in terms of Population Equivalent (PE/year) can be reduced by 71.5% and 41.8%, if timely repairs to the WSS stations are accomplished by 60 and 120 minutes respectively; the risk to WSS in terms of pipes length (km/year) reduces by 53.1% and 15.6%. The study highlights 20 that resilience is enhanced by system risk-informed planning, which ensures timely interventions on critical infrastructures; however, temporal and spatial scales are difficult to define for indirect impacts and cascade effects. Perspective research could further improve this work by applying a system-risk analysis to multiple urban infrastructures.

In order to address the above gap, this study aims at developing and applying a multi-infrastructure framework for the 40 assessment of indirect flooding impacts. The framework is practically developed for addressing flooding impact to two linear CIs, namely WSS and the road system. Compared to point infrastructures, linear ones are more difficult to simulate because they have complex interconnections which induce a non-linear dynamics of impact propagation outside the directly flooded segments, thus they require ad hoc modelling. Three different models are respectively used for simulating inundation, water pressure in WSS and traffic disruption due to flooding. Also, different spatial scales are considered to account for the dynamic 45 nature of indirect impacts. The method is demonstrated for the metropolitan area of Florence (Italy). This study represents one of the first attempts to model flooding impact to CIs for real-world networks, considering mutual interconnections, and it is expected to be relevant to researchers, as well as practitioners.

Cascading effects in CIs and urban resilience
Modern cities are currently defined as "systems of systems", where the "systems" are Critical Infrastructure (CI) systems 50 (Gardner, 2016). Infrastructure include all "the basic physical and organizational structures and facilities needed for the operation of a society or enterprise" (Hilly et al., 2018); CIs identify assets or systems which are so vital to a society that their incapacitation or destruction would debilitate security, economy, public health or safety, or any combination thereof (Serre and Heinzlef, 2018). Transportation systems, communication networks, sewage, water, and electric systems are all examples of linear CIs. 55 The intrinsic nature of a "system" lies in the systemic interdependency, i.e. "a bidirectional relationship between two assets in which the operations of both assets affect each other" (Petit et al., 2015). Since an interdependency is effectively a combination of two dependencies, this constitutes a risk multiplier (Zio, 2016). Therefore, CIs cannot be considered independently, and silo-based analyses are completely inadequate to understand the behaviour of a given infrastructure operating in its environment (Dueñas-Osorio et al., 2007;Rinaldi et al., 2001). These interconnections can lead to domino effects or cascading 60 failures, i.e. the disruption or failure of a component in one infrastructure caused by the disruption or failure of a component in another infrastructure (Hilly et al., 2018).
The "system-of-systems" connotation comprehensively characterises CIs and the wider urban resilience. The resilience of cities depends on both the intra-system resilience (the resilience of the individual CIs) and on the inter-system resilience (systemic resilience) (Kong and Simonovic, 2018). Hazard consequences may indeed extend well beyond the direct effect to 65 the individual CI, and escalate disruption over physical and jurisdictional boundaries. Infrastructure can respond to an hazard in multiple ways by: (i) absorbing the impact and minimizing consequence; (ii) adjusting to non-optimal conditions and provide a lower performance (e.g. reduced service); (iii) failing in some or all its parts, without affecting other services; (iv) failing in some or all its parts and cascade the failure to other services (Kong and Simonovic, 2018).
A more thorough understanding of the complex interactions among CIs and relative consequences is therefore essential in 70 preparing for, responding to, and recovering from disasters. The assessment of the consequences or impact depends on: (i) magnitude of service interruption (intensity, e.g. the number of impacted users); (ii) extent of service interruption (spatial); (iii) duration of service interruption (temporal) (Kong and Simonovic, 2018). The systemic interdependency has a strong temporal dimension (e.g. hazard time window, speed of recovery, repair time, disruption duration, emergency backup time), as well as a spatial one (e.g. physical proximity, physical connection, hazard extent, spatial location of failures). In fact, indirect 75 impacts usually dynamically propagate beyond the hazard domain, with an extension which is not proportional with the return period (Arosio et al., 2020). For other systems (e.g. finance, economy), Rinaldi et al. (2001) also considered logical interdependency, i.e. when the (intangible) connection is within variables and/or human behaviour. Appropriate metrics are essential to objectively measure both direct and indirect impacts; the impact due to a damaging event can be seen as the produce between the duration of the event and the overall number of people affected (De Bruijn et al. 2019). 80 https://doi.org/10.5194/nhess-2020-371 Preprint. Discussion started: 14 November 2020 c Author(s) 2020. CC BY 4.0 License.
Advanced analysis that includes the systemic impact to interlinked CIs is needed to support national and local stakeholders in making better-informed and more holistic decisions, as underlined by The Sendai Framework for Disaster Risk Reduction (United Nations, 2015). Silo-infrastructure studies are limited in their scope since they ignore cascade effects and thus underestimate impact (De Bruijn et al. 2019).
Water Supply Systems (WSS) are essential for bringing freshwater; they are complex systems composed by a range of elements 85 functional for collection, storage, transportation, treatment and distribution (e.g. pipes, water pumps, water treatment plants, reservoirs) (Bartram et al., 2009). The assessment of flood risk on a WSS requires a comprehensive approach including several scales of analysis (e.g. catchment area, riverbed, distribution network) and relative models (flood model, distribution network model). These models simulate pressure behavior in the nodes of the network if components supplied by electricity are affected by flooding (Arrighi et al., 2017;Tarani et al., 2019);pressure fluctuations or low pressures may lead to contamination from 90 leakage orifices and air vacuum valves (Ebacher et al., 2010;Ellison et al., 2003). Existing works implemented methods which integrate GIS analysis, inundation modelling, and hydraulic network modelling with Pressure-Driven Demand (PDD) (Cheung et al., 2005;Siew and Tanyimboh, 2012;Tarani et al., 2019). Two metrics measure flood impact to the WSS operativeness and integrity: (i) the number of inhabitants experiencing lack of service; (ii) the total length of potentially contaminated pipes (Arrighi et al., 2017). 95 Among CIs, roads are also fundamental for everyday needs of mobility, delivery and accessibility; particularly, during emergencies they become critical for medical supplies, rescue and repairs, with some road links more crucial than others when looking at accessibility (Balijepalli and Oppong, 2014). Network analysis is a powerful tool to navigate citizens, civil protection operators and rescue teams to a chosen destination using a specific journey. Thanks to analysis within routing, it is possible to decide if a route would be the shortest (length), the quickest (time) or safest (e.g. less flood-prone, more protected) 100 according to specific needs. For example, an ambulance would rather use the quickest path, while citizens with normal cars could prefer the least vulnerable roads. Routing calculation can improve static vulnerability assessment and integrated analysis improves planning of accessibility to critical infrastructure (hospitals, shelters) during flooding (Arrighi et al., 2019;Pregnolato et al., 2017a). In the context of flooded roads, impact assessment criteria include: (i) number of flooded links; (ii) timing (flood duration, operation time, traffic dynamics); and (iii) level of performance (e.g. speed reduction, road capacity reduction) 105 (Balijepalli and Oppong, 2014).
These silo-based studies investigated road links' vulnerability and their failure impact on the overall network functioning (that is crucial for emergency planning), however they ignore the impact of disconnection and lack of accessibility to critical services which lead to cascading effects. In the last decade, a bulk of research has approached CIs interdependency and pioneered methods to assess cascading effects. Review papers are available in literature for a more comprehensive overview (e.g. Ouyang, 110 2014). Modelling examples of flooding impact to interlinked CIs include: electricity, roads and civil protection infrastructure (Fekete et al., 2017); roads, IT, water and energy supply (Kong and Simonovic, 2018); energy, water and wastewater (Holden et al., 2013); electricity, airports, waste water plants and telecommunication (Pant et al., 2018); sewer and roads (Dong et al., 2019); water and energy supply (Byers et al., 2015). Other studies adopted a participatory approach and investigated interdependencies between infrastructure/services in cities via workshops and/or interviews of residents and utility operators 115  (Pescaroli et al., 2018). In fact, most of existing multi-infrastructure frameworks are limited in their scope since they remain very theoretical or conceptual (this includes network-theory-based studies, e.g. Li et al., 2018), infrastructure parameters are treated as random variables and thus they lack of real-world application. Very few studies (Pant et al., 2018;Dong et al., 2019) developed a truly holistic 120 application to analyse interdependency effects; however, indirect consequences are not investigated, especially regarding the WSS-roads interaction. https://doi.org/10.5194/nhess-2020-371 Preprint. Discussion started: 14 November 2020 c Author(s) 2020. CC BY 4.0 License.

Motivation and aim
Infrastructures have currently to cope with the increase of population, aging of the assets, climate change and inherent complexities (interdependency, technology) of modern cities (Holden et al., 2013). As a result, modellers and decision-makers 125 are looking for advanced methods to assess cascade effects for planning and risk management (Alexander, 2018;Pregnolato and Dawson, 2018), to produce robust strategies for efficient performance in the future (any future). Existing studies offer well-established methods to determine CIs exposure and direct flood impacts for flooding scenarios; however, a limited number of studies is available about indirect impacts and cascade effects. Moreover, most of these works offer complex conceptual frameworks, without application to real-world situations. In particular, existing models could be improved by 130 exploring the impact to CIs due to a real, weather-related hazard by integrating different models, e.g. a flood model and a GIS system (Holden et al., 2013).
Flooding is a threat for any infrastructure system in urban environments. Floodwater can directly affect by physically damaging assets and equipment (e.g. road pavement, power generators), and these damages can reflect into further disruption to other system that rely on such damaged assets and equipment. For example, floodwater can shorts-out the energy supply (direct 135 impact), which leads to disruptions into the systems working with electricity: water supply (e.g. water pumps), transport (e.g. railway, signalling); communication (e.g. routers), waste water (e.g. treatment plants), etc. Figure 1 shows the direct and indirect impacts within the urban infrastructure systems due to a flood event. Hilly et al. (2018) explicitly highlighted that an example of cascading effect from floods is when the WSS cannot be repaired because the roads that provide access to the affected parts are flooded. This is the gap on which this paper focuses ( Figure 1). 140 This study aims at developing and applying a multi-infrastructure framework for the assessment of indirect flooding impacts. 145 This aim is achieved by: (i) proposing a risk-based approach which integrate multiple CIs, their interdependency, direct and indirect impacts; (ii) modelling flooding indirect impact to two linear infrastructure systems (WSS and roads), after identifying metrics which are compatible and representative for both networks, at both silo-based and interdependent level; (iii) modelling the actual WSS and roads of the city of Florence for four flooding scenarios as a proof of concept, with a focus on the consequences on WSS due to the lack of accessibility; (iv) drawing lessons and recommendation on the results, e.g. by 150 comparing methods and results from the silo-based and independent analysis. https://doi.org/10.5194/nhess-2020-371 Preprint. Discussion started: 14 November 2020 c Author(s) 2020. CC BY 4.0 License.

Materials and method
Risk is traditionally described with four moduli: hazard, exposure, vulnerability and consequences (Grossi and Kunreuther, 2005). This study adopts this risk approach to develop a comprehensive methodological framework (Fig. 2) for computing the risk to roads and WSS due to the indirect impact of flooding. Flood hazard includes the probability of a flood event of a certain 155 intensity to happen; exposure represents the assets subject to flooding (road network and WSS); vulnerability is the extent of impact under certain conditions of exposure and hazard, e.g. the population not served by these assets. Direct impacts are impacts that may occur due to the physical impact of water, e.g. structural failure of bridges or instrumentation failure; direct impact assessment is out of the scope if this paper. Indirect impacts include service disruption, such as consequences of travelling delays due to floodwater on the roads or pressure fluctuation due to malfunctioning of lifting stations. Pressure 160 fluctuation and zero pressure in pipes lead to the entrance of undesired pathogens with consequent contamination especially in older networks. Indirect impacts are computed with ad-hoc models (Sec. 2.2) that concern the studied infrastructure systems (WSS and roads); however, the impact analysis could be tailored with different models for exploring impacts to other infrastructures (e.g. power supply and communication). The identified interdependency, which is a key element in cascade effects, concerns the reduced performance of the flooded road system, which do not allow access to WSS main plants for 165 repairs and replacement of the WSS elements damaged by floodwater. Considering the Annual Average Loss (AAL) as a reference risk metric, the risk is finally computed by estimating the impacted road length per year and the contaminated pipes length per year, as well as the delayed travellers and the not supplied Population Equivalent per year respectively.

Flood hazard, exposure and vulnerability analysis
Flood hazard is represented by a map of flood parameters (intensity measures), usually water depths and flow velocity, for assigned probabilistic scenarios. Exposure is evaluated by intersecting hazard maps with GIS elements of the road and WSS networks. WSS nodes are assigned corresponding flood depths through raster zonal statistics. Active nodes, e.g. pumps or https://doi.org/10.5194/nhess-2020-371 Preprint. Discussion started: 14 November 2020 c Author(s) 2020. CC BY 4.0 License. lifting stations, exposed to the flood, are modified in the WSS model and marked as failed to simulate the indirect impacts to 175 the network (see Sec. 2.2). Similarly, road network segments, except those described as bridges or embankments, are assigned the flood depths for each inundation scenario.
This study considers crucial to identify metrics which are compatible and representative for both road network and WSS (Table   1); this compatibility allows to compare results for the silo-based analysis and, more importantly, to develop the interdependent analysis. 180 Regarding the hazard, water depth (m) is commonly referred as intensity measure for flooding and adopted in this study. The exposed elements include the elements of the WSS and road system susceptible to water depth, respectively WSS nodes and 185 road segments (including embankments, elevated roads and underpasses). Vulnerability is defined according to the type of node and road, through the relationships shown in Table 1: (i) for WSS, a binary function determines a pumping station nonoperational when this is touched by floodwater (Tarani et al., 2019); (ii) for the road network, a depth-disruption function computes the reduced velocity for vehicles travelling in flooded roads up to 0.3 m, i.e. the threshold of roadworthiness (Pregnolato et al., 2017b). 190

Indirect impacts and cascading assessment
On the basis of literature (see Sec. 1), two impact metrics are selected for assessing indirect impacts: (i) the length of the disrupted network; and (ii) the population which experiences loss of service. The first metric can be easily converted into economic costs, when replacement/repair costs per unit length are available; the second metric is more suitable to describe unmonetizable social costs. 195 For the WSS, the metrics are the length of potentially contaminated pipework and the Population Equivalent (PE) not served.
PE is commonly defined as the ratio of the sum of the daily total demand to the individual demand of one person. In Italy the individual demand in cities for WSS design is prescribed by technical law and is about 200 l/day per inhabitant in average size cities. PE would coincide with the number of inhabitants for pure domestic water consumption. For the road network, these two metrics are respectively represented by the length of impassable roads and the delayed commuters. When assessing 200 disruption impacts to road and rail, People per Hour (PPH) delay is the metric used to account for both the time loss and the number of people affected (e.g. https://bit.ly/3kCj6tO): by instance, a PPH is the number of hours a public transport service is delayed multiplied by the number of users or passengers.
The WSS model is based on the freeware EPANET software, which calculates pressures at the nodes given a set of initial tank levels, pump switching criteria, base nodal demands, and demand patterns. The standard EPANET simulations describe a 205 https://doi.org/10.5194/nhess-2020-371 Preprint. Discussion started: 14 November 2020 c Author(s) 2020. CC BY 4.0 License. demand-driven approach, which stems from the direct goal of simulating correctly operated networks. When simulating the failure of the network (e.g. in the case of the inundation of the main lifting station), a Pressure Driven Demand (PDD) approach is more appropriate since the nodal demand are not attributed a priori; in fact, their value depends on the current local pressure.
It is thus possible to analyse the temporal dynamics of the pressures in the network and consequently the population not served.
Further details on the PDD methodology can be found in Arrighi et al. (2017). 210 An integrated model that couples flood disruption and transport network is adopted to assess changes in time and distance in users' journey (Pregnolato et al., 2016;Pregnolato et al., 2017a). Floodwater reduces travelling speed of vehicles or stops traffic flows: roads are commonly considered closed when the flood depth reaches 30 cm (i.e. the depth at which a standard passenger's car is unable to operate), underpasses and elevated roads are considered as closed or completely functioning respectively. The model evaluates the disruption to network links by comparing pre-and post-event travel times, thanks to a 215 depth-disruption function (Pregnolato et al., 2017b) and a GIS-based accessibility model (Ford et al., 2015). For the flooded scenarios, the network properties of a link (i.e. travelling speed) are modified according to the functions, and traffic parameters recalculated for the perturbed state. Subsequently, journey travel time will increase in comparison with the baseline scenario, and eventually journeys are re-routed according to the quickest path (Dijkstra's algorithm -Dijkstra, 1959). A network Service Area (SA) defines a region that encompasses all accessible streets within a specified time impedance (e.g. a 5-minute-220 impedance SA of a point includes all the streets that can be reached within five minutes from that point); they can also be defined as isochrones of equal travel time. Pre-and post-event SAs helps to evaluate accessibility and accessibility changes due to flooding.
This study investigates the additional secondary impacts due to the interdependence between road system and WSS by assessing the lack of accessibility to critical elements of the WSS such as pump stations, preventing repairs and replacements. 225 The delay or the lack of repair/replacement greatly undermines the post-event recovery time. The widely accepted definition of resilience is the ability of overcome an impactful event and return to normal condition through a quick recovery; the postevent recovery time is indeed a key metric of resilience. As shown in Figure 3, the pre-event condition (segment 1-2) is the business-as-usual performance of the system where preparedness actions might be adopted. When the natural hazard occurs (2), the state of the system is altered by the impacts of the natural phenomenon, which lead to a reduction of the system 230 performances (e.g. reduced road trafficability, reduced water pressure in pipes). The drop and recovery of the state may have different shapes according to the resilience of the system and the incorporation of the knowledge of cascade effects and interdependencies in preparedness and emergency plans. A low-resilience system, where preparedness and emergency plans are developed with a silo-based approach (c), is subjected to a sensibly higher reduction of system performances (2-3''). In fact, unplanned emergency repairs or the activation of backup systems imply a slower recovery (3''-4''). This slow recovery 235 could be due to the delays in assistance caused by the inaccessibility of WSS lifting stations due to flooded roads (silo-based), as well as a slow activation of emergency actions (low resilience).
Again, when emergency actions are promptly activated (high resilience) but there is a poor understanding of infrastructure interdependencies (silo-based) (b) there are delays due to unpreparedness (2-3').  Timing is crucial for resilience to natural hazards; in a context of flood especially, adequate intervention can follow emergency plans which are activated by Early Warning Systems. The identification of the most vulnerable pumping stations and streets allows to plan accordingly in advance, by e.g. retrofitting some stations or developing emergency plans. The method developed 250 by this study supports informed preparedness, which includes the identification of the pumping station(s) which should be reached in useful time for repair/replacement, reducing the breakdown time, increasing the speed of recovery and decreasing cascade effects.

Case study
The methodology is applied to the metropolitan area of Florence (Tuscany, Italy; 1 Mio inhabitants, of which about 37% 255 corresponds to the city of Florence). The area has a long record of floods since the Middle Ages and is still prone to inundations (Arrighi et al., 2018). For frequent events, only few municipalities downstream of Florence are inundated whereas more severe scenarios (e.g. 200-year-event) affect the whole area, including the historic centre of Florence. From the hydrological point of view, this area is placed in the middle of the Arno catchment where the terrain morphology becomes flatter, the floodplain wider and the riverbed is more affected by anthropogenic changes, i.e. crossings, contractions, rectifications. The wider 260 metropolitan area of Florence includes the three provinces (counties) Florence (FI), Prato (PO) and Pistoia (PT) (around 1000 km 2 of extent), and the province of Florence covers about 40% of the area. The municipality of Florence (city of Florence), the regional and Arno catchment Authorities are involved in the flood risk management of the area, which accounts for prevention, mitigation and preparedness measures. In this work, the Arno River Basin Authority provided hazard information (about half serving the non-permanent supply to Prato). In fact, the WSS provides freshwater to seven outer municipalities, namely Bagno a Ripoli, Calenzano, Campi Bisenzio, Impruneta, Prato, Sesto Fiorentino and Scandicci (Fig. 5c)

Silo-based analysis
The case study analyses four recurrence interval scenarios. The central main pumping station, which draws water from the Arno river as main water resource, is not affected for low recurrence scenarios (i.e. Tr30 and Tr100). For Tr200 the failure of the WSS lifting station causes the reduction of nodes pressures in the whole municipality, also far from the river and with 300 effects on neighbouring municipalities. Initial storage tank levels are assigned with a warm-up simulation to reach a steady https://doi.org/10.5194/nhess-2020-371 Preprint. Discussion started: 14 November 2020 c Author(s) 2020. CC BY 4.0 License. state of the system; these initial levels allow maintaining a partial functionality of the system. After 60 minutes from the inundation of the lifting station, the 23% of the PE is not served and about one third of the pipes undergoes potential contamination. After 120 minutes, the nodes able to serve the nominal demand are limited to those supplied by storage reservoirs in the periphery of the Florence municipality (i.e. three fifth of the nodes down, 47% of PE not served) (Fig. 5a). 305 Three nodes linking to the municipalities of Sesto F.no, Prato and Scandicci fail and the node to Bagno a Ripoli has a residual partial functionality ( Fig. 5a and b). If no remedial actions are taken, after six hours from the onset of the event, the disruption reaches 90% of the nodes and insufficient pressure affects 70% of the Florence PE (i.e. 268,100 people only in one municipality, three times the flooded population). All the links to outer municipalities are cut off with the highest impacts for those municipalities which are not served by other sources and completely rely on the Florence WSS (Fig. 5c). Downstream 310 neighbourhoods are served by local water tanks; also, they are favoured by lower terrain elevations, hence their nodes are affected later than those in the city center (Fig. 5a, green dots). 428 km of pipework in the network, i.e. the 68% of the whole WSS, is potentially contaminated due to null water pressure in this flood scenario.  Table 2 shows the impacts for the analysed scenarios in the eight interconnected municipalities, six hours after the shutdown.
The affected population equivalent (PE) is larger than actual resident population in some municipalities, since there is also an 320 industrial water demand, especially in Scandicci, Sesto F.no and Campi Bisenzio. The municipality of Prato, which is not connected to the network in normal situations, is considered not affected. Similarly, for the WSS analysis, the users of the road network are impacted by flooding within and outside the inundated area.
For example, for a 1-in-200-year event, around the 78% of roads in the hazard area is flooded, including 13 km of highways and 45 km of major roads ( Figure 6 and Table 3).  The Annual Average Loss (AAL) is finally computed by estimating the impacted road length per year and the contaminated pipes length per year, as well as the delayed travellers and the not supplied equivalent population per year respectively (Table  345 4). 52.1 km of roads and 3.2 km of pipes per year are affected in the study area. About 260,000 commuters and 3500 PE are https://doi.org/10.5194/nhess-2020-371 Preprint. Discussion started: 14 November 2020 c Author(s) 2020. CC BY 4.0 License.
yearly affected on average. The comparison between the impacts of the two networks clearly shows that, while roads are increasingly affected with increasing return periods, the WSS has the same impact for the two more severe events. In fact, there is a threshold behaviour triggered by the inundation of the lifting station, which is almost independent from inundation extent and propagates in the system. 350

Systemic analysis
The system analysis includes the modelling and assessment of indirect flooding impacts cascading through the WSS and road system of the city of Florence. In specific, this study evaluates the consequences on WSS due to the lack of accessibility, which 355 prevents timely repairs and replacement at the WSS lifting stations.
The WSS lifting stations should ideally accessed for repairs before 60 minutes from the onset of the event because: (i) about 33% of the pipes undergoes contamination (Sec. 3.1); (ii) ca 90% of the street becomes impassable (by reaching the 30 cm threshold of roadworthiness). At latest, WSS lifting station needs to be repaired in 120 minutes, i.e. the back-up time provided by storage reservoirs; sites in need of repairs would be reached by special vehicles, e.g. SUVs of the Civil Protection. The 360 interdependency induces systemic consequence which is higher than consequences of the single WSS or road system alone. In this case study, the systemic consequence consists in the increase of the recovery time, due to extended outage (due to the lack of repairs), which implies a lower resilience of the city (see Fig. 3). If preparedness and emergency plans are developed with a systemic risk knowledge, i.e. with a full understanding of cascade effects, interdependencies among networks and repairs before 60 minutes from the onset of the event, the AAL of the WSS reduces to 982 PE/year (-71.5%) and 1.5 km/year (-53.1%) 365 in terms of PE and pipe length respectively. With remedial actions before 120 minutes, the AAL reduces to 2007 PE/year (-41.8%), and 2.7 km/year (-15.6%.) ( Table 5).  Results show that for extreme scenarios (Tr200, Tr500), road conditions do not allow to reach both lifting stations on time, 385 unless emergency vehicles are sent before critical depths are reached. Such operation would happen if the city is prepared to act upon flooding events and actions are pre-planned. Although a lifting station is usually equipped with a backup enginegenerator to prevent from power outages, this cannot work in submerged conditions; moreover, the flood duration might be be longer the duration of fuel availability for the engine-generator. The first recommendation is then to develop ad-hoc emergency plans by identifying potential critical hotspots (e.g. WSS lifting stations), and to analyse the accessibility to these sites. 390 Secondly, to equip the WSS implants with vehicles for repairs that are better resistant than normal cars to water, e.g. 4WD or SUVs (like Civil Protection's ones), would allow to reach sites normally cut off by floods. An alternative option would be to equip the implants with a water-resistant back-up system, which increases the time window for repairs. The third recommendation is to enhance the system redundancy for those municipalities totally reliant on a single main system, with e.g. emergency water storage tanks. 395

Discussion and future research
The WSS and road transport system are two linear infrastructure systems, so they are comparable in terms of flood hazard and impact metrics. For example, the indirect impact respectively included pipework to be decontaminated and length of network affected (i.e. closed or reduced speed segments for roads), as well as the population disrupted by the loss of each service. However, the system's exposure to flood is measured differently, since the WSS system considers the number of nodes, while 400 the road network features the road network length. Also, service disruptions can lead to different types of potential consequences: the population not served by WSS may experience health issues due to the lack of a basic resource, especially for more vulnerable categories; in the case of road network, delayed commuters may experience difficulties in reaching their workplace, which can be converted to monetary loss (e.g. using the Value of Time). https://doi.org/10.5194/nhess-2020-371 Preprint. Discussion started: 14 November 2020 c Author(s) 2020. CC BY 4.0 License. Moreover, the two infrastructure types have peculiarities in relation to the temporal and spatial scale. WSS disruption starts as 405 soon as the lifting station (next to the river) is flooded (first significant pressure drop in the network in 60 minutes), while the road network is progressively flooded until reaching the maximum depths (3 to 6 hours depending on location), alongside incremental disruption. For the WSS, the indirect impacts reached eight municipalities and impacted all the users (460243 PE), excluding Prato municipality who does not rely on the nodes of the Florence municipality. For the road network, the indirect impacts affected all the commuters travelling to work in the Florence municipality (1,846,882 people), covering also areas 410 which are not contiguous to Florence (Pisa, Livorno, Arezzo). Commuters settled in the eight municipalities affected by the WSS failures are experiencing both disruptions; hence, if they decided to not travel to work upon an issued flood alert, they would experience lack of water in their homesdue to the same flood event.
This case study highlighted the importance of identifying spatial and temporal thresholds to cascading effects; eventual failures of the WSS system should be addressed in a time window which includes the time to issue the alert, the time to reach the sites 415 and the time to repair the equipment. For example, for the Florence case study, it would be ideal to repair the lifting station before 60 minutes the beginning of the event; in fact, after 60 minutes there is the first WSS pressure drop and the onset of the potential pipe contamination. An upper-end threshold would be to repair the WSS systems in 120 minutes, to avoid reaching the 70% of node pressure dropping; however, potential contamination would still affect part of the network. Timely repairs to the WSS, assisted by back-up system, makes the difference between a high-and a low-resilient urban environment (Figure 3). 420 This work focused on risk analysis, therefore it adopted the worst-case-case hazard map per each scenario, by considering the maximum depth for each point. Static hazard maps (with maximum depth) are also currently typical for urban planning.
However, this approach is not fully satisfying when considering the complex dynamics of water runoff, water supply and traffic flow. A more advanced hydraulic modelling is suggested to produce dynamic hazard maps (with hazard timesteps), and assist with a detailed modelling of infrastructure dynamics. In particular, this advanced modelling is seen necessary for 425 identifying actual emergency operations and plans, looking at fitting the time windows of the disruption. For example, the 'dynamics' of flooding and accessibility are likely to significantly differ for Tr200 and Tr500: Tr500 magnitude is higher, and floodwater would flow away from roads much slower, increasing the recovery time.
Additional work could estimate the risk for a wider range of probabilistic scenarios and investigate how the two infrastructures recover after the events. Further studies could also include the physical impact to road elements (such as bridges), mitigation 430 measure for the WSS and the interdependencies with a third infrastructural system, e.g. power supply. Future studies could particularly focus on the temporal element and scale of the risk analysis, to estimate e.g. operations time. Finally, pressure changes in the WSS network can cause ruptures of aqueduct pipes with consequent water flows in the roads; this cascading effect could be a further topic of future research.

Conclusions 435
This work presented the risk analysis of two linear infrastructure systems, namely the water distribution system (WSS) and the road network system. The study presents a real-world application to the city of Florence (Italy). The evaluation of indirect flood impacts on the two networks was carried out for four probabilistic scenarios (30, 100, 200, 500 years), obtained by a coupled 1D-quasi 2D hydraulic model. A Pressure-Driven Demand network model and a flood-transport network model were used for assessing the impacts on the WSS and the road network respectively. The analysis focused firstly on the identification 440 of common impact metrics for both systems for hazard, exposure, vulnerability and (indirect) consequences. Secondly, the study adopted a silo-based approach to assess impact and risk to the WSS and road system, as separated entities. Results showed that the impact of flooding to the two systems differs in both spatial (up to 5 affected municipalities per WSS, 37 for the road system) and temporal scale (60 minutes before first pressure drop, 30 minutes to reach critical depths on roads).
Thirdly, a systemic approach was used to include interdependency and cascading effects, thus assess impact and risk at system-445 https://doi.org/10.5194/nhess-2020-371 Preprint. Discussion started: 14 November 2020 c Author(s) 2020. CC BY 4.0 License. level. When interdependencies are accounted for, results showed that the risk to the WSS in terms of Population Equivalent (PE/year) can be reduced by 71.5% and 41.8%, if timely repairs to the WSS stations are accomplished by 60 and 120 minutes respectively; the risk to WSS in terms of pipes (Km/year) reduced by 53.1% and 15.6%. The study highlighted that systemic risk-informed planning can support timely interventions and enhance infrastructure resilience; however, it is recommended to conduct further studies which focuses on the complex dynamics of water runoff, water supply and traffic flows to support 450 practical action planning.

Data Availability Statement
All relevant and public available data will be shared via the DataBris repository of the University of Bristol if the paper is accepted for publication; data sources are clearly specified throughout the paper.