Natural Hazards and Earth System Sciences Improving risk assessment by defining consistent and reliable system scenarios

During the entire procedure of risk assessment for hydrologic hazards, the selection of consistent and reliable scenarios, constructed in a strictly systematic way, is fundamental for the quality and reproducibility of the results. However, subjective assumptions on relevant impact variables such as sediment transport intensity on the system loading side and weak point response mechanisms repeatedly cause biases in the results, and consequently affect transparency and required quality standards. Furthermore, the system response of mitigation measures to extreme event loadings represents another key variable in hazard assessment, as well as the integral risk management including intervention planning. Formative Scenario Analysis, as a supplement to conventional risk assessment methods, is a technique to construct well-defined sets of assumptions to gain insight into a specific case and the potential system behaviour. By two case studies, carried out (1) to analyse sediment transport dynamics in a torrent section equipped with control measures, and (2) to identify hazards induced by woody debris transport at hydraulic weak points, the applicability of the Formative Scenario Analysis technique is presented. It is argued that during scenario planning in general and with respect to integral risk management in particular, Formative Scenario Analysis allows for the development of reliable and reproducible scenarios in order to design more specifically an application framework for the sustainable assessment of natural hazards impact. The overall aim is to optimise the hazard mapping and zoning procedure by methodologically integrating quantitative and qualitative knowledge. Correspondence to: B. Mazzorana (bruno.mazzorana@provincia.bz.it)


Introduction
In European mountain regions considerable losses resulting from torrent processes occurred during the last decades (e.g., Oberndorfer et al., 2007;Autonome Provinz Bozen-Südtirol, 2008) in spite of considerable efforts undertaken for the protection of endangered areas (Fuchs and McAlpin, 2005;Oberndorfer et al., 2007).It is not only an economic challenge and a political mission to define an optimal protection level against natural hazards, but also a societal desire to guarantee rural development in alpine regions.Therefore, decision makers have to deal with issues of excessive landuse pressure and ecological and economic viability, which is an often complex and interlinked task.One major contribution towards this direction is the attempt to control landuse by reducing vulnerability on the basis of hazard and risk maps (Fuchs et al., 2007(Fuchs et al., , 2009)), as recently laid down in the European Flood Risk Directive (Commission of the European Communities, 2007).Hazard maps indicate, for defined return periods of the underlying design events, the spatial distribution of classes of maximum process intensities.Risk maps result by intersecting these hazard maps with values at risk exposed.Despite the long tradition of hazard mapping in several European mountain regions, a retrospective analysis on hazard maps highlighted a series of shortcomings, above all with respect to the magnitude (and frequency) of torrent processes (Berger et al., 2007;Autonome Provinz Bozen-Südtirol, 2008).
At the watershed scale, the magnitude of channel-based hazard processes is often expressed by the measured geomorphic features, such as potential debris volume, mean flow velocity, peak discharge, and runout distance (Fuchs et al., 2008).For this purpose, empirical and semi-empirical equations may be used.As an alternative dynamic (often numerical) simulation models might be considered to assess the flow properties and the depositional behaviour.However, in particular the effects of changing channel morphology and associated woody debris transport phenomena were found to amplify process intensities considerably (e.g., Diehl, 1997;Lyn et al., 2007), which is not taken into account sufficiently by the respective models.Furthermore, facing recent events existing hazard maps turned out to be not as reliable as expected (e.g., Bezzola and Hegg, 2007).Consequently, subsequent risk reduction measures did not necessarily provide the most efficient management strategy and therefore the implemented solutions were only suboptimal.In order to improve risk analyses and to support decision making, above all underlying scenarios have to be re-defined based on these issues, in particular with respect to sources of uncertainty affecting the predictability of hazardous phenomena (e.g., Paté-Cornell, 1996;Merz et al., 2008).As outlined by Fuchs et al. (2008) and Mazzorana and Fuchs (2009), such uncertainties include with respect to hydrological hazards and torrent processes 1. uncertainties about the possible range of rheological behaviour and about the liquid-solid mixture concentration of debris flows; 2. uncertainties in system loading assumptions (e.g., duration-intensity related uncertainties, uncertainties related to sediment transport rates, uncertainties emerging from woody debris transport); 3. uncertainties in system response mechanisms (e.g., localised obstructions that divert the flow patterns, influence of small-scale topological features); 4. uncertainties concerning the protection system functionality and mitigation reliability (e.g., failure propen-sities of key components within the protection system, sediment dosing behaviour of retention basins, dike failures); and 5. uncertainties concerning morphological changes that induce hazard processes or amplify their disposition (e.g., erosion phenomena in alluvial channels or on alluvial fans, and flow path changes in steep mountain rivers).
Commonly used 2-D-simulation models with limited computation capabilities for movable bed (e.g., only deposition processes are simulated) are only partially capable to take into account hazards induced by morphological changes.Situations when the torrent diverges through lateral erosion processes from the originally incised channel forms are not fully detected and the consequent propagation patterns are therefore not identified (for a comparison, see e.g.ETAlp Consortium, 2003;Rickenmann et al., 2006).
In the procedures and regulations actually being used in hazard mapping it is discretionary to the experts to subjectively set limits to some of the above-mentioned uncertainties, interestingly and fittingly through expertise and by expert knowledge.This methodological gap represents a possible source of controversies during the process of mandatory audit of the preliminary hazard maps by administrative bodies and affected stakeholders with legal standing, which might result in additional work and consequently increased expenditures.
A reliable and efficient procedure that allows for the above-mentioned factors of uncertainty is to conduct a participative scenario analysis.This analysis allows for a multidisciplinary approach merging results derived by different analysis tools such as estimates, empirical and numerical simulation models, and event documentation.By participative scenario analyses, a set of consistent scenarios is identified by a team of specialists.The identified scenarios contribute to the robustness of the entire hazard zoning procedure as a basis for risk assessment.As a result, derived products, such as intervention plans, benefit from this fully coherent derivation procedure.In order to meet these aims, a Formative Scenario Analysis approach (Scholz and Tietje, 2002) was chosen to identify sources of uncertainty resulting from the assessment of hydrologic hazards.Following Scholz and Tietje (2002), Formative Scenario Analysis is a technique to construct well-defined sets of assumptions to gain insight into a system and its potential development.

Background -exploring alternative developments through scenarios
Scenarios are constructed for the purpose of focusing attention on causal processes and decisive points.A scenario is a plausible image of a possible future system state, hence a fundamental premise on which scenario planning is based is the uncertain predictability of the future.Figure 1 shows the scenario trumpet metaphor, where the starting point of scenario analysis is t 0 and all possible future states of the system are represented within the trumpet.While the upper margin identifies the most optimistic case (XE1), the lower margin represents the most pessimistic one (XE2).This representation of possible multiple futures takes into account either deviations from an undisturbed evolution (midline of the trumpet) or other disturbances at t 1 that would change a hypothetic trajectory to XB to the future state XC or a failure event at t 2 that would lead to the final state XD.As shown in Fig. 2 (toppling of a series of consolidation dams), the consideration of disturbances is an indispensable requirement if debris flow phenomena are analysed.However, as O'Brien and Dyson ( 2007) pointed out, one single scenario provides only one possible view of the future state of a system and takes therefore uncertainty not sufficiently into account.
Conversely, scenario planning is an approach to develop sets of scenarios that therefore provide a number of possible future states of a system.Scenarios can be classified following the topology proposed by Ducot and Lubben (1980) according to three different axes (see Fig. 3): 1.The causal nature of the scenario (vertical axis).At one pole exploratory scenarios are situated, where effects are projected given an initial set of causes.At the opposite pole anticipatory scenarios are located which offer explanations of possible causes given an initial set of effects.With respect to torrent processes, an example of an exploratory scenario is the determination of the liquid and solid discharge at the downstream end of a reach with consolidation control structures gives the liquid and solid discharges at the upstream boundary.Key variables determining the output of the considered system are, among others, the performance of the protection system, potential landslides adding a certain volume of solids to the system, and the stability of the torrent bed and bank slopes.Without very detailed information about these key variables, only a scenario set projection gives insight into the system dynamics.Typical anticipatory scenarios include analyses of particular damage configurations in consequence of extreme events.During scenario identification, specialists integrate the available quantitative knowledge (e.g.rainfall data and precipitation distribution) and qualitative knowledge (e.g.silent witnesses, interviews with affected citizens) in order to plausibly reconstruct the dynamics of the event.
2. The existing normative and descriptive relationships between scenarios are represented by the horizontal axis.
The descriptive scenario states an ordered set of possible occurrences regardless of the desirability of the outcomes.Normative scenarios conversely are those which incorporate values, concerns and interests of the developer or consumer of the scenario.In natural hazard risk management the focus is either on descriptive scenarios, namely on the determination of an ordered set of possible incidences given a particular situation, or on normative scenarios when the performance of a planned protection system is defined.
3. The temporal dimension is represented by the inclined axis, and a distinction is made between trends and peripheral scenarios.Trends or timeline scenarios represent hazardous events in a causally related manner to provide explanations of how relevant factors evolve in time (e.g. the temperature evolution within the next 20 years).Conversely, a peripheral or a cross-sectional scenario represents a description of a particular future point in time.Scenario analysis started to become a major tool particularly in the field of management, economics and environmental decision making after the publication of the works of Kahn and Wiener (1967).Determinant reasons for the growing attention paid to scenario analyses were the drawbacks and pitfalls of a relevant number of deterministic environmental, economic or ecological forecasting models.Yielding only individual predictions and not adequately including qualitative system changes (disruptions, Godet, 2000), deterministic models were found to be only partially useful when trying to predict future states of complex systems.If a sediment dosing system, typically composed of an approaching reach, a deposition basin, an open check dam and an outlet reach is considered, the evolution of the channel bed level in the retention basin during either the increasing or the decreasing part of the hydrograph can be accurately and precisely predicted by deterministic models (Armanini and Larcher, 2001;Miyazawa et al., 2003;Remaître et al., 2008).However, the simultaneous presence of woody debris transport phenomena obstructing the openings (e.g.slits) of the check dam interfere significantly with the evolution of the torrent bed, leading to an -at least partially -invalidation of the prediction resulting from the deterministic model.To overcome these restrictions in predictability, the identification of small numbers of scenarios which represent different future states of a system is needed.It is possible, through a reliable scenario analysis, to re-perceive an image of reality, and to enhance individual engagement, commitment and mental flexibility in order to develop best reply strategies (Scholz and Tietje, 2002;Tietje, 2005).In Table 1, the four main applications of scenarios with respect to natural hazard risk management are shown.Apart from the overall goal to assess risk, the development and evaluation of strategies as well as adaptive organisational learning became increasingly important for public bodies involved in dealing with natural hazards in Europe.
From a formal perspective scenario analysis can be classified into three different types, (1) holistic scenario analysis, (2) model scenario analysis, and (3) Formative Scenario Analysis.A holistic scenario analysis (which is analogue to the elicitation of responses from expert hearings) includes the construction of scenarios based on the opinion of specialists from the individual disciplines involved.A subjective mental integration of interdisciplinary qualitative and quantitative knowledge takes place, and intuitions and formal analyses of experts are combined (see e.g.Kahn and Wiener, 1967;van der Heijden, 2005).In doing so, mathematical methods, experimental results and individual local knowledge are used to refine certain aspects of these scenarios.
Model scenario analyses are mainly based on (not always dynamical) systems modelling.By systematically varying the unknowns and assuming different values for uncertain parameters, the model is forced to create a number of trajectories, some of which are subsequently selected as scenarios by the expert pool.
Following Scholz and Tietje (2002), Formative Scenario Analysis is a method to construct well-defined sets of assumptions to gain insight into a system and its potential development.With this procedure the study team is guided towards a differentiated and structured understanding of the current state and dynamics of a system.It is usually performed by small groups with specialised expertise about different aspects of the system, which they share with one another.Hence, Formative Scenario Analysis is based on qualitatively assessed impact factors.Experts determine by a rating procedure quantitative relations between these factors.Basically a Formative Scenario Analysis consists of two steps, (1) analytic modelling and decomposition of the initial state of the case studied, and (2) formative synthesis.In the first step an expert team identifies a set of key impact factors or variables that serve as preceptors.In the second step of formative synthesis, various operations are carried out on these impact variables in order to generate all possible scenarios.Subsequently, a consistency analysis is performed in order to identify a number of different but internally consistent scenarios.A scenario interpretation phase refines this procedure to iteratively identify relevant settings.This methodology was proposed by Scholz and Tietje (2002) by application of a nine-step Formative Scenario Analysis (see Fig. 4).Firstly, the specialised team of experts precisely defines the case study to be investigated, resulting in a conceptual sketch and a concise description of the problem to be assessed (steps 1 and 2).Secondly, the expert team identifies the broad set of impact variables or impact factors that possibly determine the actual state of the studied system and the expected future developments (step 3).Thirdly, the relative importance of the key variables is estimated; based on this rating the case study is structured by an impact matrix (step 4).This impact matrix provides activity, passivity, impact strengths and involvement measures for each variable (Scholz and Tietje, 2002).Activity quantifies the effectiveness of the impact of a variable on other variables.Passivity (or sensitivity) is correlated with the medium dependency of a variable on other variables.Impact strength is a summarising indicator of the medium impact strength of a variable on the entire case studied.Involvement indicates how strongly a certain variable is interlinked with the system.Forthly, a grid of activity and passivity scores supports the expert team in selecting the core set of relevant key variables that are supposed to be most important within the studied system (step 5).The classical Formative Scenario Analysis subsequently applies the MIC-MAC Analysis (Cross Impact Matrix-Multiplication Applied to Classification, step 6).The scenario construction phase (step 7) is of crucial importance for the subsequent consistency analysis (step 8).Scenario interpretation completes the Formative Scenario Analysis (step 9).With respect to hydraulic risk management, two essential criteria for scenario selection were identified, (1) consistency, since inconsistent scenarios draw no realistic image of the system development, (2) difference between scenarios, since decision makers focus on a set of principally possible system developments, while small differences between similar scenarios are of minor importance.With respect to common hazard zoning procedures, Formative Scenario Analysis provides input data for modelling, contributing for example to a retraceable and reproducible explanation of the assumed system loading conditions (e.g., definition of process types and corresponding solid and liquid discharge hydrographs).Moreover, possible systems behaviour at weak points (e.g., log jam at bridge cross sections) can be qualitatively assessed and subsequently considered in the simulations.Furthermore, scenarios provide an integrated framing approach (backward planning) ensuring the adjustment of scenario data and modelling results and facilitate their validation.

Method
As a reference the nine steps Formative Scenario Analysis procedure described above is followed.Outlining succinctly the method it is referred to (1) a failure propensity case in an alpine torrent reach with a relevant number of consolidation protection measures (compare also with Fig. 2) and to (2) woody debris transport hazard scenarios at hydraulic weak points.The key steps of Formative Scenario Analysis applied were the following: 1.The expert team listed d i , i=1, ..., N impact variables, also referred to as system variables, impact factors or case descriptors.
2. For each individual impact variable the expert team assessed the mutual impacts between the variables d i and d j (i, j =1, ..., N ; i =j ).To account for the relative importance of each individual impact variable on the entire Step 9: Scenario interpretation Step 1: System definition Step 4: Impact matrix Step 5: System grid and system graph Step 6: MIC-MAC analysis Step 7: Scenario construction Step 8: Consistency analysis and selection of scenarios Step 3: Impact variables Step 2: System properties system studied, qualitative and quantitative knowledge integration is essential.Only the identified key variables were included in the final set of selected impact factors.Since, with respect to hydrologic hazards, considerable scientific evidence exists for such variables, the specific information content was directly taken into consideration.
3. The expert team subsequently constructed the impact matrix, in which mutual impacts, a i,j , between the variables d i and d j were rated on the basis of three levels: 0 = no or very little impact; 1 = medium impact; 2 = high impact.The impact matrix can be formally written as A= a i,j , i, j =1, ..., N and is shown in extended form as follows: a 1,j and passivity N i=1 a i,1 for each variable were calculated, and mean activity and mean passivity was obtained by the arithmetic mean of the activity and passivity of each key variable.The comparison of the activity of a variable with mean activity, and of the passivity of a variable with mean passivity allowed for categorising the variables into active, passive, ambivalent and buffer variables making use of the system grid representation (compare case studies presented in Sects.4.1 and 4.2).A variable is considered to be active if its activity is above the average activity of all variables and its passivity is smaller than the average passivity of all variables.A variable is considered to be passive if the activity is below the average activity and its passivity is larger than the average passivity of all variables.A variable is considered to be ambivalent if its activity is above the average activity of all variables and its passivity is larger than the average passivity of all variables.A variable is considered to be a buffer variable if its activity is below the average activity of all variables and its passivity is smaller than the average passivity of all variables.4. In a next step, the group of experts defined the levels of impact variables for each individual key variable.Since the combinatorial number of scenarios is considerably influenced by the number of levels defined for each impact variable, impact factors and their levels should be defined parsimoniously (Scholz and Tietje, 2002) which contained the consistency ratings, c (•, •), for all pairs of impact variables at all levels c, i, j =1, ..., N, i =j, n i =1, ..., N i , n j =1, ..., N j (for an application of criteria for consistency ratings see Sects.4.1 and 4.2).
7. For each scenario a consistency value was calculated as additive measure as c * (S k ) = c d n i i , d n j j with i, j =1, ..., N, i =j, 8. The scenario selection was based conjointly on the consistency value of the scenarios and the difference between them.
As proposed by Tietje (2005) the distance measure corresponded to the number of differences between the scenarios . The scenarios were ranked decreasingly according to consistency in an array.The scenario with the highest consistency value S k was selected from the array and compared with the second scenario S l .If (S k , S l ) was sufficiently high, e.g.(S k , S l ) ≥ * , where * was a chosen threshold value, then scenario S l was also selected and become the new comparison reference for scenario three, otherwise the third scenario was compared with the first scenario, etc.
9. Scenario interpretation completed the Formative Scenario Analysis.

Applications and results
In this section two case studies, (1) the analysis of sediment transport dynamics in a torrent reach with a series of consolidation works and (2) the identification of hazards induced by woody debris transport at hydraulic weak points, are presented.Characteristics of both case studies include the need to combine knowledge from well-defined research sectors in order to determine the factors that could significantly influence the current state of each system and the underlying dynamics.In the first application (4.1), a synopsis of the main findings about issues related to sediment transport and a qualitative understanding of protection system responses in terms of reliability and feedback loop effects on sediment transport intensity is required.In the second case study (4.2), a knowledge integration of woody debris recruitment and transport phenomena and the caused interactions (e.g.obstruction) at hydraulic weak points (e.g.bridge locations) is indispensable.Therefore, an interdisciplinary study team with experts of the required knowledge domains (e.g.hydraulics, sediment and woody debris transport, structural reliability, system dynamics) had been formed.4.1 Case study one: failure propensity case in an Alpine torrent and possible effects on sediment transport at the downstream outflow cross section The study team, familiar with the test site, defined the system to be analysed (steps 1 and 2 of FSA) and assessed in an exploratory investigation step the set of impact variables that presumably could have a significant influence on the current state of the dynamics of the system.The case was first decomposed by the study team and analysed by means of different preceptors, e.g.condition monitoring of the protection system, event documentation and topographic surveys, available hydrodynamic simulations, as well as geological and geotechnical expertises.The following synthesis step (step 3 of FSA) lead to a new conception of the case with the identification of relevant impact factors and their interaction.A pre-selection of possible impact factors is shown in Fig. 5.It was assumed that at the upstream boundary of the analysed liquid discharge of the torrent reach and the inflow rate of sediment had to be taken into consideration.As a consequence, two impact factors, hydro inflow [HI] and sediment inflow [SI] were defined.Reliability of the protection system components was judged to play an essential role in releasing significant amounts of sediment in case of a protection system failure.Consequently, an additional impact factor, the reliability of the protection system [PSR] was identified.The study team pointed out that the forest cover [FC] could have a regulating effect on sediment availability in the system [SSA].The ratio between deposition and erosion [ED] on the one hand and the retention capacity of the system [SRC] completed the picture of impact factors that influence the solid transport intensity at the downstream boundary, considered within the model by the impact factor variation of solid outflow [VSO].In a second consultation, after having judged that (1) hydro inflow [HI] and solid inflow [SI] could be considered together as a new key variable solid/liquid input [SLIT], (2) the forest cover [FC] is not con- sidered to be essential and (3) the availability of sediment in the system [SSA] incorporates to a certain extent the retention capacity of the system [SRC], the study team reduced the impact factors to a core set which was taken as basis for the impact analysis (Table 2).
For the further steps of Formative Scenario Analysis, the study team decided to retain all the key variables selected during the second consultation and assessed impact levels for the key factors (for an overview, see Table 3).On the basis of the impact matrix (step 4 of FSA) an additional analysis step consisted in producing the system grid (see Fig. 6), where, as a consequence of the activity and passivity scores determined for each key factor, SLIT turned out to play an active role and VSO a passive role.While PSR had a rather ambivalent character, and ED was a buffer variable.SSA could not be assigned to any of the quadrants in the system grid (step 5 of www.nat-hazards-earth-syst-sci.net/9/145/2009/Nat.Hazards Earth Syst.Sci., 9, 145-159, 2009 Mean passivity 5 Table 3. Definition of impact levels for each key variable for case study 1: failure propensity case in an Alpine torrent and possible effects on sediment transport at the downstream outflow cross section.4, an excerpt of the consistency ratings assigned to each pair of impact levels of different impact variables is presented.Subsequently, all possible scenarios were derived (step 7 of FSA).For each possible scenario an additive consistency value was assigned.Table 5 reports the consistency values for all possible scenarios.While in the first two rows of the table all impact level combinations of the two impact factors SLIT and ED are reported, the last three columns report all possible impact level combinations of the remaining impact factors, VSO, PSR and SSA, respectively.In order to select the relevant hazard scenarios (step 8 of FSA), the additive consistency values of all complete scenarios consisting of determined impact levels for each impact factors were reported at the crossing cell positions of the corresponding rows and columns.The most consistent scenarios are highlighted.The highest consistency value was assigned to the following two different, and thus possible, scenarios:

Impact variable
(1) VSO↑, PSR.FL, SSA.H, ED↓, SLIT.DF, indicating that a positive solid outflow variation was judged to be consistent with a high failure likelihood of the protection system, a large amount of available sediment in the considered torrent reach characterised by erosion propensity and debris flows; and (2) VSO↓, PSR.FU, SSA.L, ED↑, SLIT.HYPO, reflecting an opposite situation.As a result of scenario interpretation (step 9 of FSA) particular attention has to be paid in assessing the possible flow processes at the upstream boundary of the considered torrent reach.In Table 5 the possibility of different sediment transport related behaviours that could take place in the considered torrent reach depending on the inflow type Table 5. Set of all scenarios (step 7 of FSA) and identification of the set of most consistent scenarios (step 8, highlighted) for case study 1: failure propensity case in an Alpine torrent and possible effects on sediment transport at the downstream outflow cross section.(different levels of variable SLIT) and the response in terms of reliability of the protection system (different levels of variable PSR) are highlighted.The subsequent determination of hazard zones on the downstream located alluvial fan has to take into consideration these results of Formative Scenario Analysis by defining a sufficiently broad range of system loading conditions in terms of liquid and solid inflow in order to capture possible system responses.

Case study two: woody debris transport induced hazard scenarios at hydraulic weak points
In full analogy to case investigated in Sect.4.1 the scope of the study team, familiar with the test site, was to determine the factors that could significantly influence the current state of the case and the associated system dynamics.The experts identified five major preceptors explaining the interaction of woody debris transport at hydraulic weak points.First of all, available woody debris, disposed to be transported towards the considered weak point, was considered to be essential.
A second condition to be met was the existence of the necessary flow conditions since the recruited woody debris can potentially reach the hydraulic weak point.The flow conditions at the weak point (liquid and woody debris transport) determined the system loading.The resistance of the configuration of the weak point was defined to be influenced by the structural (also geometrical) properties.The preceptor that incorporates the possible system response mechanisms to the blocking within the flow section, e.g. the entrapment of woody debris at a bridge with a certain number of piers, was called interaction between woody debris and the configuration of the weak point.The subsequent synthesis steps lead to the identification of possible relevant impact variables that significantly influence the current state of the system and related dynamics (see Fig. 7).The study team recognised that in case study 2, the selection of the relevant impact factors was affected by considerable additional criteria, i.e.  included in the variable WFI, as shown in Fig. 9.In a subsequent step, the impact matrix for the selected variables was constructed for the variables CWP, WS, RWP, WFI, and WPC (see Table 6).
Plotting the levels of activity versus the levels of passivity/sensitivity of each key variable in a system grid (Fig. 10), CWP and WFI resulted to be active key variables, therefore influencing the other variables, and RWP and WPC resulted to be sensitive on the influence of the above-mentioned variables.WS was found to be a buffer variable.The impact levels were assigned to each impact factor as shown in Table 7. Concerning the interaction between the wood and the flooding process [WFI], two impact levels were used to describe the interaction intensity: Intense interaction [d 1 1 ], and moderate weak interaction [d 2  1 ].The study team subsequently identified two impact levels for the hydraulic configuration at the weak point [CWP]: Entrapment propensity is ].For the case study presented in Sect.4.2, the expert team assigned the consistency rating for each pair of impact levels of different impact variables (see Table 8).
For each possible scenario an additive consistency value was assigned.Table 9 reports the consistency values for all possible scenarios, and the most consistent scenarios are highlighted.
In Table 9, the additive consistency values for all possible scenarios are shown.While in the first two rows of the table all impact level combinations of the two impact factors CWP and WFI are presented, the last three columns describe all possible impact level combinations of the remaining impact factors WS, RWP and WPC, respectively.The additive consistency values of all complete scenarios consisting of determined impact levels for each impact factors are shown at the crossing cell positions of the corresponding rows and columns.The most consistent scenarios are highlighted.The highest consistency value was assigned to the following two different, and thus possible, scenarios, with an additive consistency value of 25 and 23, respectively:  No variation -→ 0 0 3 0 1 3 1 1.CWP -likely, WFI -intense, WS -long pieces, RWP -low reliability, WPC -hazard increase, indicating that a hazard increase at weak point was judged to be consistent with a weak point configuration where entrapment of woody debris is likely, given that an intense wood-flood interaction takes place, the structural reliability (e.g. at a bridge location) is low and long pieces are involved in woody debris transport.
2. CWP -unlikely, WFI -weak, WS -short pieces, RWP -high reliability, WPC -no variation, reflecting an opposite situation.This is a clear indication that particular attention has to be paid either to the assessment of the structural properties of the wood (large or small pieces of woody debris) or to the structural and reliability characteristics of the weak point configuration (failures and likelihood of entrapment).
In Table 9 other possible and consistent future states for the case study are also highlighted, depending on the levels assumed for the impact variables.The scenario involving catastrophic effects at the weak point has also to be taken into consideration (relatively high additive consistency value).Within the hazard mapping procedure and in particular when performing the hydrodynamic simulations the set of model scenarios should correctly reflect the weak point system behaviour.The results of Formative Scenario Analysis are relevant in order to consider a sufficiently broad range of hydrodynamic simulations and capture possible system responses.By redesigning the weak point configuration, decreasing the likelihood of obstruction through woody debris and increasing the structural reliability, an important step towards efficient hazard mitigation could be achieved.

Conclusions
By adopting the Formative Scenario Analysis framework the study team analysed relevant issues in hazard analysis essential for a comprehensive risk assessment procedure.The underlying case studies were presented in Sects.4.1 and 4.2 accordingly.The expert knowledge available in the different domains was successfully integrated by interaction and collaboration of the study team through a guided scenario building and a rigorous scenario selection procedure.concerning system loading or system response mechanisms provided crucial insights into the systems behaviour.It had been shown that possible case developments can be described with a particular focus on feedback loops (reliability of the protection measures vs. sediment availability) and nonlinear cause-effect chains (transported woody debris vs. entrapment propensity at hydraulic weak point locations).As a consequence, it was possible to better describe the relative importance and uncertainty of each impact factor.The structured decomposition of the case by a series of preceptors, followed by a knowledge integrating synthesis efficiently supported the control of coherence and traceability of the results (as required during hazard mapping) and the informed decision making process (as required for an efficient prioritisation of mitigation strategies).
The two case studies performed in this work put into evidence that a small set of consistent and reliable exploratory scenarios to identify effects given a specific set of causes have to be taken into account.One of the crucial challenges of integral risk management is to be prepared for the unexpected.If weak signals of an unexpected future are not discerned by deterministic models, or probabilistic models neglect important facets of the case, the possibilitybased approach of Formative Scenario Analysis offers apparent problem-solving advantages.
By meeting basic and operational principles (Shepard, 2005), Formative Scenario Analysis can provide remarkable insights in the entire process of hazard assessment, integrating, where necessary, consistent assumptions either concerning system loading or system response mechanisms or bounding uncertainties where possible.However, the method has to be used in combination with hydrological and hydraulic simulation models in order to produce consistent, fully intelligible and retraceable results.It is therefore also of considerable importance to capture at least qualitatively the different facets of multi-hazard situations and nonlinearity in cause-effect relationships in order to design resilient protection systems.
The interaction necessary for Formative Scenario Analysis requires participation within the study team; i.e. with respect to reveal tacit and mental assumptions of the team members or with respect to promote organisational learning aspects (e.g., the use of a common language).
In particular concerning the European Flood Risk Directive (Commission of the European Communities, 2007), but also with respect to the overall aim of building hazardresilient communities, future studies should include the applicability of Formative Scenario Analysis within flood risk management plans.Since such plans are of certain relevance in order to deal pro-actively and from an ex-ante perspective with flooding hazards including torrent processes, the applicability in the framework of flood risk management plans is obvious.A particular focus should be placed on the combination between participative effects such as Formative Scenario Analyses and conventional modelling approaches in order to better achieve the overall aim of managing natural hazard risk in a sustainable manner.

Fig. 1 .
Fig. 1.Scenario Trumpet indicating five identified possible outcomes of a system to be analysed.

30Figure 2 .
Figure 2. Toppling of a series of consolidation structures Fig. 2. Toppling of a series of consolidation structures.

Figure 4 .
Figure 4.The nine steps of Formative Scenario Analysis Fig. 4. The nine steps of Formative Scenario Analysis.

Fig. 5 .
Fig. 5. Pre-selection of possible impact factors or key variables relevant for case study 1.

Fig. 6 .
Fig. 6.System grid of the activity and passivity scores for case study 1.

Table 4 .
MIC-MAC analysis (step 6 of FSA) was judged to be not necessary.As a successive step the impact levels for each impact factor were defined.Concerning incoming solid transport and liquid discharge [SLIT], three impact levels capturing the relevant flow processes were defined: Low sediment transport rate (below the local transport capacity) [SLIT.HYPO, d 1 1 ], average sed-iment transport rate (equals the local transport capacity) [SLIT.ORD, d 2 1 ], and debris flow [SLIT.DF, d 3 1 ].The study team also identified three impact levels for the ratio between deposition and erosion [ED]: Low erosion propensity [ED↓, d 1 2 ], average propensity [ED→, d 2 2 ], and high deposition propensity [ED↑, d 3 2 ].The description of the reliability of the protection system [PSR] was carried out by assigning Nat.Hazards Earth Syst.Sci., 9, 145-159, 2009 www.nat-hazards-earth-syst-sci.net/9/145/2009/B. Mazzorana et al.: Improving risk assessment through consistent system scenarios 153 Excerpt from the consistency matrix for case study 1: failure propensity case in an Alpine torrent and possible effects on sediment transport at the downstream outflow cross section.following two impact levels: Failures likely [FL, d 1 3 ], and failures unlikely [FU, d 2 3 ].The sediment availability of the system [SSA] was described in terms of impact levels by either a high level of availability [SSA.H, d 1 4 ] or a low level of availability [SSA.L, d 2 4 ].The variation of solid transport [VSO] was identified by three levels: Positive variation [VSO↑, d 1 5 ], no variation [VSO→, d 2 5 ] and negative variation [VSO↓, d 3 5 ].The scenario construction (step 7 of FSA) consisted in assigning the consistency rating for each individual pair of impact levels of different impact variables as follows: c (•, •) = 3 → Complete consistency, the levels of the impact factors are coherent and support each other c (•, •) = 1 → Partial or weak inconsistency c (•, •) = 0 → Inconsistency In Table

Figure 7 .Figure 8 .
Figure 7. Pre-selection of possible impact factors or key variables for case study 2

Fig. 7 .
Fig. 7. Pre-selection of possible impact factors or key variables for case study 2.

Figure 9 .
Figure9.key variables for case study 2 after a reconsideration step

Table 1 .
The four main applications of scenarios.

Table 2 .
Impact matrix for case study 1: failure propensity case in an Alpine torrent and possible effects on sediment transport at the downstream outflow cross section.

Table 6 .
Impact matrix case study 2: woody debris transport induced hazard scenarios at hydraulic weak points.

Table 7 .
Definition of the impact levels for each key variable for case study 2: woody debris transport induced hazard scenarios at hydraulic weak points.

Table 8 .
Consistency matrix for case 2: woody debris transport induced hazard scenarios at hydraulic weak points.

Table 9 .
Set of all scenarios (step 7 of FSA) and identification of the set of most consistent scenarios (step 8, highlighted) for case study 2: woody debris transport induced hazard scenarios at hydraulic weak points.