Development of an agent-based model to improve emergency planning for floods and dam failures

Extreme floods and dam failures pose significant risks to people worldwide. Globally some 2.2 billion people (29% of the world's population) live in flood-prone areas (Rentschler & Salahab 2020). Between 2000 and 2019 floods caused ∼105,000 fatalities and affected ∼1.65 million people (CRED & UNDRR 2020). As the frequency and magnitude of floods increase, as a result of climate change, so will the risks they pose to people (Gu et al. 2020).

The risks posed by water retaining and tailings dams¹ are also increasing. Most large dams² have a design life of around 100 years (Perera et al. 2021). The average age of dams in the UK is 120 years (Courtnadge et al. 2017). Aging water storage infrastructure is increasing the risk to people living downstream (Perera et al. 2021). In addition, the effects of climate change are often not taken into account when planning dams (Lumbroso et al. 2015), which is likely to increase their future probability of failure, owing to increases in design flood flows (Wasti et al. 2022). There are also thousands of tailings dams located at mines worldwide (Adamo et al. 2020). A recent review of large tailings dams indicated that 10% of these facilities have ‘notable stability concerns’ (Franks et al. 2021) and that on average three to four large tailings dams collapse every year (Lyu et al. 2019).

Improving flood emergency planning can help to reduce loss of life (Johnstone & Lence 2009; Lumbroso et al. 2011a, 2011b, 2017; Shirvani & Kesserwani 2021). However, often emergency plans for floods are impractical because they do not consider key human factors (e.g. age, culture, and gender) which affect emergency response, and evacuation routes and do not fully assess the risks in a transparent, quantitative manner (Clarke 1999; Lumbroso et al. 2011a, 2011b; Lumbroso & Vinet 2012; Dufty 2015; Arrighi et al. 2019; Huang & Liu 2021). In Brazil, there have been over 1,000 deaths in the past 25 years from 12 major tailings dam failures (Palú & Julien 2019). However, in Brazil emergency plans for tailings dams are often not effective and are just ‘a mere bureaucratic formality’ (De Carvalho 2019).

This paper describes the development and application of an agent-based modelling³ piece of freeware, known as the Life Safety Model (LSM), the objective of which is to enhance emergency planning for floods by providing estimates of fatalities, injuries, and the times for people to evacuate an area at risk. The LSM was initially developed by BC Hydro, a Canadian electricity utility and Canada's National Research Council (NRC) in 2002, to improve the assessment of the risks posed by hydropower dams in British Columbia to people living downstream (Sakamoto 2011). Prior to the development of the LSM, empirical methods (e.g. Graham 1999) had been used to estimate the loss of life from dam failures. Such methods are based on limited data sets, including few large dams (i.e. ones greater than 15 m high) and also mixed cases of where warnings were and were not received (Assaf & Hartford 2001). These methods are also generally ‘static’ and do not provide animations of the results which can be helpful for decision makers. In 2006, as part of the European Commission funded FLOODsite research project, HR Wallingford applied the LSM software to a number of pilot sites in the UK (Di Mauro & Lumbroso 2008; Lumbroso & Di Mauro 2008). In 2009, NRC's collaboration with BC Hydro on the LSM ended and HR Wallingford began to further develop the software. In 2020, the LSM was made available to download as a piece of freeware.

The use of agent-based modelling in flood risk management is immature, with the majority of peer-reviewed papers on this subject having been published since 2015 (Zhuo & Han 2020; Anshuka et al. 2022). A recent systematic review of agent-based models for flood risk management looked at 39 peer reviewed papers on this subject, of these articles 20 focused on aspects of emergency management (e.g. flood warnings and evacuation), whilst the remainder concentrated on identifying long-term risks and their associated adaptive strategies (Anshuka et al. 2022). As the paper by Anshuka et al. shows, over the past decade, there have been a number of agent-based models developed by researchers related to emergency planning for floods (e.g. Dawson et al. 2011; Du et al. 2017; Liu & Lim 2018; Coates et al. 2019; O'Shea et al. 2020; Shirvani et al. 2020; Wang et al. 2020; Bernardini et al. 2021; Shirvani & Kesserwani 2021; Shirvani et al. 2021; Taillandier et al. 2021; Wang & Jia 2022). However, these agent-based models have often been developed for specific sites, one source of flooding (e.g. fluvial, dam failure, tsunami, surface water, or coastal) and have generally only been employed in a limited research context, rather being used to inform emergency plans, strategies or risk assessments for floods or dams.

Within the flood risk management community, there are two agent-based models which have been widely used both by practitioners and researchers to inform risk assessments and emergency planning. These are LifeSim and the LSM. LifeSim is an agent-based model developed by the US Army Corps of Engineers primarily to carry out risk assessments and emergency planning for dams (Needham et al. 2016). LifeSim and the LSM are similar but there are some subtle differences. LifeSim uses a simple fatality rate depending upon which one of the three hazard zones, (i.e. ‘chance of fatality’, ‘compromised’, or ‘safe’), people find themselves them in; whereas in the LSM the characteristics of the people (e.g. age, mass, height, gender, and health status) are taken into account by the loss function at every time step, i.e. the loss model for people is physically rather than empirically based. In addition, in LifeSim, people's reactions to warnings are primarily based on empirical evidence from dam failures and evacuations, e.g. Oroville Dam incident (Sorensen et al. 2018), whereas in the LSM there is more flexibility in how people communicate and react upon receiving a flood alert.

LifeSim has primarily been validated using case studies of dam failures in the USA (USACE 2021). The LSM software has been employed worldwide by a large community of academics and practitioners to investigate a range of different sources of flooding including dam failures such as the Brumadinho tailings dam disaster in Brazil (Rotta et al. 2020; Lumbroso et al. 2021) and Malpasset Dam in France (Johnstone et al. 2003; Johnstone & Garrett 2014), breaches of flood defences in the UK (Lumbroso & Davison 2018), flash floods in Italy (Frongia & Sechi 2017), and tsunamis in Canada (Johnstone & Lence 2009; Johnstone 2012). The LSM can also include routes used solely by pedestrians, as well as roads, whereas LifeSim is limited to representing the road network. Another possible limitation of LifeSIM is that it allows the floodwater depths and velocities from the hydraulic model to be sampled over large areas (e.g. 1 × 1 km) which can lead to the hydraulic parameters experienced by an agent being inaccurate because of their coarse spatial resolution. This can significantly affect both the estimates of loss of life and evacuation times, especially in urban areas where the spatial resolution of the floodwater velocities and depths needs to be high (e.g. 5 × 5 m).

The LSM has been used to improve actual emergency plans and risk assessments for dams, fluvial and coastal floods, as well as tsunamis worldwide. The results from the LSM have demonstrated that even relatively short warning times (i.e. less than 10 min) can, for many dam failures, tsunamis and floods, reduce the loss of life by an order of magnitude, if refuges are suitably located and signposted, and evacuations are well planned (Lumbroso et al. 2021).

This paper describes the development of the LSM, its application to historic flood and dam disasters in the UK, France, and Brazil.

Estimating the loss of life likely to be caused by a flood and the time to evacuate the area at risk is challenging because flood events are unique and the parameters that affect them are complex (Jonkman 2007) and include:

• Characteristics of the floodwater (e.g. velocity, depth, temperature).

• Characteristics of each agent, i.e. people, buildings, and vehicles.

• Time at which the event occurs (e.g. night, day, weekend, mid-week, summer, and winter).

• Topography of the area at risk.

• Location and capacity of evacuation routes and shelters.

• The method via which people decide to evacuate, e.g. on foot, in a vehicle, or vertically (i.e. move to a higher floor in a building).

• The way in which warnings are communicated, as well as the awareness and preparedness of the people at risk.

To account for the variability and site specific nature of flood and dam break events, the LSM software takes a phenomenological, agent-based approach. Although more complex than empirical methods, typically used to provide a single estimate of loss of life, the LSM simulates the dynamic interaction of people, vehicles, and buildings (i.e. agents) with floodwater. The estimated loss of life using this approach is more transparent and defensible, incorporating a wider range of variables that influence loss of life, than that found using a simplified ‘black box’ empirical approach. It also provides animations of the results which are useful in showing how a flood emergency could unfold.

The LSM software has been developed to represent:

• The number of people that are killed or injured by floodwater. The time-varying properties of the floodwater (i.e. depth, velocity, and temperature), which affect people's survival capacity and the speed at which they move, are modelled.

• The movement of vehicles via a traffic model, which allows the effects of traffic congestion during evacuations to be taken into account.

• The dynamic interaction of the floodwater with vehicles. If people are leaving the area at risk in a car, then the engine will stop once the vehicle has encountered a certain depth of water or if the combination of floodwater velocity and depth is too high it will get swept off the road.

• The capacity of each building to withstanding the floodwater. Depending on the characteristics of the building and the floodwater, buildings can: suddenly collapse; fail progressively as a consequence of being weakened via continuous exposure to the flood; or remain intact.

• People being modelled as individuals and also as groups (e.g. families) so they do not separate during an evacuation. The speed at which a group moves is influenced by every member of the group and their physical characteristics (e.g. age, health, gender).

• The speed of the dissemination of flood warnings: People can receive warnings from a ‘warning centre’ and also by ‘word of mouth’.

• The evacuation of people along roads or footpaths, to ‘safe zones’ which can be areas of high ground, tall buildings which can withstand the floodwater or specifically defined safe havens or refuges.

The LSM is a dynamic model that represents agents' interactions with the floodwater and provides the number of people that are likely to be injured or killed, as well as the time that is required for them to evacuate the area at risk. For a given study area, the LSM provides the ability to integrate two dimensional (2D), temporally varying floodwater depths and velocities with a 2D ‘people flow’ model. The people flow component includes consideration of the time and event sequence for individuals and groups to become aware, decide on a course of action, and then attempt to move to a safe location. This means that LSM software can be used to contribute to risk assessments and emergency plans by:

• Providing credible estimates of loss of life using transparent auditable methods.

• Allowing estimates of evacuation times to be made both by people on foot, in vehicles, or a combination of these.

• Evaluating existing and residual risks to people against tolerable risk guidelines.

• Assessing the effects of improving evacuation routes, location, and capacity of shelters, as well as flood warnings on the risk to people and evacuation times.

• Displaying the results in the form of animations.

There are three key steps to carrying out a study using the LSM software as follows:

1. Develop a 2D hydraulic model of the flood event.

2. Create a ‘People's World’ within the LSM software.

3. Run the LSM software for a range of plausible scenarios.

The LSM uses irregular mesh or gridded time series of floodwater velocities and depths from a fully hydrodynamic 2D hydraulic model of the flood event built using software such as TUFLOW, TELEMAC, MIKE21, HEC-RAS 2D, FLO-2D, and InfoWorks ICM. When developing the 2D hydraulic and LSM models, both should be discretised at suitable, regular temporal and spatial intervals. The interaction of agents with the floodwater at each time step affects their ‘state’ (e.g. in the case of person ‘states’ can include: evacuating, knocked over, drowned, death from exposure) and evacuation times. Suitable time steps for the hydraulic model, for the purposes of evacuation times and loss of life modelling, are often considerably lower (e.g. ∼10 s) than those needed to fulfil hydraulic modelling requirements (Lumbroso & Davison 2018). For example, a time step that is ‘too big’ (e.g. 10 min) allows people to move a ‘significant’ distance (e.g. ∼500 to ∼1,500 m on foot and several kilometres in a vehicle) during each temporal interval and thus to possibly evade the advancing floodwater. If the spatial discretisation of the hydraulic model is too large (e.g. >5 m) then the velocities and depths at each time step are averaged over a large area leading to a loss of resolution of the flood hazard, which also adversely impacts the accuracy of the results (Lumbroso & Davison 2018).

The ‘People's World’ within the LSM describes the agents which interact with the floodwater. This includes fixed agents such as buildings, as well as agents which can move such as people and vehicles. The most important agent within the LSM is known as a Population At Risk Unit (PARU). A PARU is the means via which an individual person is represented. A group of PARUs who share the same location, such as the same building, or who are travelling in the same vehicle or walking together is called a People At Risk Group (PARG). All PARUs are part of a PARG, even if there is only one person in the group. Each PARG will be exposed to the same floodwater conditions (i.e. velocities, depths and temperatures) and will attempt to escape the floodwater together.

The LSM models the effects of the floodwater on each member of the group using their individual properties or the effects of the floodwater on the group as a whole using the average physical properties of the group. The former description defines a separable PARG (i.e. in which members experience the flood individually). The latter description defines an inseparable PARG (i.e. the members experience the flood collectively). The PARG can be viewed conceptually as a group of people bonded in a way that makes them behave as a collective unit. This bond could be social, such as the relationship among members of the same family or borne out of people's nature to help and support others in danger, or to react in a uniform fashion.

Buildings such as houses, schools, and shopping centres which contain people can be included in the LSM. Outdoor locations where people may congregate can also be modelled as ‘outdoor buildings’. People in large multi-storey buildings can take refuge from the flood by evacuating vertically rather than attempting to evacuate through floodwater.

Road and footpath networks are represented in the LSM and are used by PARGs to evacuate the area at risk either on foot or in a vehicle. Road segments have an even number of lanes in each direction, as well as a speed limit. Multiple PARGs in vehicles on a road segment can cause congestion and reduce the throughput of that segment, thus increasing the time required for evacuation.

Safe havens and refuges are also included in the People's World. They represent locations where a PARG is not at risk from the floodwater. This could be a building, or a section of road or path which is above a predetermined safe elevation. Once a PARG enters a safe haven or refuge they are considered protected from the floodwater and removed from the simulation. The capacity of a safe haven can be limited to a defined number of people. If a safe haven is full then a PARG moves to the nearest safe haven which has capacity.

Warning centres are represented in the People's World as locations from which a flood warning can be disseminated to the local population. Warning centres can be ‘networked’ to communicate warning to each other.

To calculate how the floodwater affects the fate of each PARU, PARG, building and vehicle, at each time step, requires an agent-specific loss function. Each of the agents in the LSM has properties that can vary with time. Agents have a set of properties, such as its location at any given time and a ‘state’ (e.g. a building's state can be ‘intact’, ‘weakened’, or ‘destroyed’). The loss function determines when an agent's state should change based on the properties of the agent, as well as the velocity and depth of the floodwater, it also ultimately determines an agent's ‘fate’, e.g. in the case of a person whether they reach safety.

PARUs and PARGs can have a variety of states as follows:

• • Unaware that there is a flood occurring.

• • Aware that there is a flood happening, because they have received a warning or flooding is occurring near to them.

• • Evacuating either on foot or in a vehicle.

• • Safe because they have entered a shelter or reached an area of high ground.

• • Knocked over by the floodwater, as a result of the combination of the floodwater depth and velocity or the flood water depth being too high to be able to walk in.

• • Deceased via the following means:

• • • Drowning because a specific threshold of floodwater depth and velocity has been exceeded.

  • • Exhaustion from spending too long in the floodwater.

  • • Trapped in a building which collapses.

  • • Drowning as a result of being trapped in a building and being overcome by the water depth.

  • • Trapped in a vehicle which is swept off the road by the floodwater.

Buildings only have two states, i.e. intact or destroyed. Building can be destroyed in three different ways:

• An instantaneous failure, where a building collapses suddenly owing to a combination of the velocity and depth of the floodwater exceeding a defined threshold. This often occurs in the case of dam failures where a building is submerged by a powerful wave of water moving with sufficient momentum or depth to destroy it.

• The depth of the floodwater is greater than the height of the building.

• Cumulative failure, where a building collapses following a prolonged exposure to floodwater which leads to a decline in its structural integrity.

Vehicles can have five main states as follows:

• Stationary outside a building or because their engine has been inundated by floodwater.

• Driving on the road network.

• Safe, having arrived at a safe haven.

• Floating, which occurs when the depth and velocity of the floodwater are such that they are sufficient to cause the vehicle to become unstable and float or to stall the engine. Typically, when travelling through floodwater, vehicles which are heavy or have a high ground clearance will be more stable than lower or lighter vehicles. When a vehicle starts to float, the PARUs in it will attempt to escape from it and commence evacuating on foot.

• Destroyed which occurs when a vehicle is swept off the road, as a result of the velocity and depth of the floodwater. This results in the deaths of all the PARUs in the vehicle.

The basic premise of the loss functions in the LSM is that each agent has a resistance to withstand the ‘loading’ from the floodwater. The state of an agent (i.e. person, building, vehicle) changes to deceased or destroyed if the agent's resistance is less than the floodwater loading. The loss functions in the LSM are based on the properties of the floodwater changing the state of an agent through:

• Being knocked over in the case of a person or swept off the road in the case of a vehicle.

• An instantaneous change (e.g. sudden collapse of a building, a person being overwhelmed by the floodwater).

• A cumulative change (e.g. prolonged exposure of a person or a building to the floodwater).

Consider Person A, shown in Figure 2, who is standing outside when a flood occurs. The combination of the floodwater depths and velocity is never high enough to result in Person A drowning. However, although initially Person A has enough strength to withstand the floodwater, over time the effects of being continually exposed to the water reduce their strength. Eventually, Person A reaches a point where they are overcome by the floodwater owing to either exhaustion or hypothermia and die, i.e. this is a cumulative loss. In the case of Car B, in Figure 2, there is an instantaneous loss. This is because at a certain time the combination of the floodwater velocity and depth is sufficient to suddenly sweep the car off the road leading to the instantaneous death of the driver.

In the LSM, for a PARU to be considered as deceased, they either have to experience a local combination of floodwater velocity and depth greater than a threshold value referred to as the drowning critical value (see Figure 1), or the PARU's physical condition (PPC) needs to decline below a critical value known as the PARU's Physical Critical Condition (PPCC). Once the PARU's PPC < PPCC, the person dies.

This cumulative loss allows the LSM to model the effects of hypothermia on people. Research into hypothermia suggests that an adult can survive for about 1 h immersed in water at 10 °C (Hayward et al. 1975). If a typical adult PARU, with a PPC = 1, experienced essentially still water (i.e. dv = 0.5 m²/s), their PPC would decline to 0 within 1 h with a PCDVM of 1,850 m²/s and an RPCDVM = 0.1. In the LSM, they would die owing to this cumulative loss. The potential survival rate of PARUs increases with the floodwater temperature, to the point where a person immersed in warm water (i.e. near body temperature) would see little reduction in their strength (Golden et al. 1997).

In terms of vehicles, the LSM accounts for the effects of floodwater and losses via the use of:

• A floodwater depth threshold for a vehicle stalling.

• The threshold for the product of the floodwater depth and velocity (dv) which results in a vehicle floating.

• A floodwater dv product threshold for a vehicle being swept off a road.

The movement of agents in the LSM is based on PARGs escaping the area at risk of flooding either in vehicles or on foot to safe havens by travelling on the road network and/or footpaths. PARGs in vehicles can only travel on roads, whereas PARGs on foot can use both the road and footpath network defined in the model to evacuate.

The location of safe havens in the LSM is used as input to the optimal path calculation. There are two cost scenarios, one for vehicles and the other for pedestrians. The optimal paths are determined using a ‘travelling cost’ approach which produces the ‘least expensive’ route for each agent to a safe haven. The PARGs in the LSM have ‘perfect knowledge’, i.e. they are aware of the optimal roads or footpaths to take to reach safety, excluding the effect of traffic congestion. If there is a change to the network, e.g. a road becomes closed, the PARGs become aware that their path is blocked when they reach the next junction, after this they select the new optimal path.

The traversal cost for a vehicle on a road is segment length of the road/speed limit. The traversal cost for a pedestrian is the segment length of the path. The travelling cost to the ‘least expensive’ safe havens or safe elevation is determined at the endpoints of every road and footpath segment. The costs are generated using a modified shortest path (minimum cost) algorithm that recursively calculates ‘minimum cost’ from each safe haven to all segment vertices.

In reality, the evacuation of people will not be as efficient or prescient as the algorithm used in the LSM. As a consequence, the LSM software allows the user to introduce some stochastic behaviour to the agents by randomly introducing the choice of a non-optimal evacuation route when PARGs arrive at road or footpath intersection, which means that there is a chance of the non-optimal route being selected by each PARG at each intersection.

PARGs are constrained to move only on roads or footpaths. The distance travelled by a pedestrian PARG is determined by their escape speed on foot and size of the time step. Pedestrian PARGs can pass each other while travelling on roads or footpaths.

The typical values for the maximum traffic density come from a variety of sources including May (1990) and the Transportation Research Board (2000) which show that the typical range for traffic jam density is 115–155 vehicles per km per lane or 185–250 vehicles per mile per lane. Key features of the LSM traffic model are briefly described below.

Each road lane is unidirectional, for bidirectional flow each road segment must have an even number of lanes. If two lanes are set in the input data there is one for each direction. Single direction roads are allowed, where the number of lanes can be set to one.

Vehicles cannot pass each other in their designated lane. This rule simulates the traffic bottlenecks which may occur on congested escape routes. A vehicle can move to an adjacent lane on multi-lane roads if that adjacent lane is unoccupied. The LSM also considers the space between vehicles while they travel along each road segment. Should the vehicle be too close to the one ahead, it will have to wait for the next time segment before trying to move.

When a vehicle reaches an intersection during a time step it stops, then provided there is space on the receiving road segment, the vehicle will move across the intersection on the next time step. If there is no space on the receiving road segment vehicles wait at the intersection and a queue forms behind the leading vehicle. If there are two or more lanes at an intersection feeding into a road segment, and there is space on the receiving segment, then a vehicle is randomly selected from one of the feed lanes and placed on the receiving road segment. This process is repeated until there is no space left on the receiving segment or there are no vehicles left on the feed lanes or the maximum intersection throughput is reached. The total number of vehicles that can move across a junction is influenced by an LSM input parameter specified as ‘vehicles per second’ and the model time step.

Road and footpath segments which are flooded can be closed if a vehicle or PARG encounters floodwater whilst traversing the road or footpath segment. Once this occurs, the segment is closed, and no other vehicle or pedestrian can enter the road or footpath segment. PARGs that are currently on the road segment that is being closed continue to move in their current direction to the next intersection, if all roads from the intersection are closed, they wait at the intersection.

PARGs in buildings, who are evacuating in a vehicle, initially move to the nearest road segment to the building then start moving. Vehicles can only enter the road segment if there is sufficient space. If a continuous queue has already formed past the building, the vehicle must wait for the end of the queue to advance past the entry point of the building so that there is space before the vehicle joins the road.

The LSM allows the movement patterns of people (PARGs and PARUs) and vehicles to be tracked, as well as visualised via animations. It also allows the different states of the agents to be determined at each time step.

Figure 5 shows just three possible scenarios for the same PARU under generally similar conditions with important differences in the end result. For other PARUs in the same area at risk, strategies that were ineffective for one PARU might be effective for another (e.g. escaping on foot may be optimal for other PARUs). Different PARUs will have different characteristics such as their age, strength and gender all of which affect their ability to move and to survive in floodwater. In addition, some PARUs may decide to spend longer in their house once they have received a warning than others. This myriad of possibilities can all be taken account of in the LSM and can lead to many different outcomes.

The date and time when a flood occur should be taken into account with regard to how the PARGs are distributed within the People's World. Users can decide how the PARGs are dispersed within the People's World, as well as what buildings or open spaces they are situated in. This initial distribution acts as the starting locations of the PARGs when the flood event commences. The LSM allows the PARGs to be spread across the People's World in a deterministic or probabilistic manner.

In setting up scenarios within the LSM, it is not just the time of the day when the flood event occurs, but also the time of week, or in some cases the time of the year which can be important and needs to be taken into account. During a typical day people will be distributed in different parts of a flood risk zone. A common example would be that adults are more likely to be located at their places of work during daytime hours, and in recreational areas, at shops or at home during non-working hours. It is possible that commercial areas are located within floodplains, which may put individuals at greater risk when at work. The day of the week can also be significant, because people will probably be distributed differently on weekdays to the weekend, when the majority of people will not be at work and children will not be at schools. The time of year should also be considered. For example, during summer months, in some holiday resorts, buildings, such as hotels, will generally be more heavily occupied than in the winter. In some cases it is necessary to model a large range of scenarios, in others a ‘worst case’ scenario may suffice, for example, a flood which occurs in the middle of the night when most people are asleep at home.

In terms of warning times a variety of options can be used, typically the following scenarios are modelled in the LSM:

• Evacuation without a flood occurring demonstrates how well a simulated evacuation may transpire during a flood event and help to identify bottlenecks in the road network without having to undertake hydrodynamic modelling of the floodwater.

• No evacuation during a flood to determine how many people might lose their lives should no one evacuate. This case can often serve as a ‘worst case’ scenario for emergency planners.

• Evacuation during flood using a range warning times. This helps decision makers understand how sensitive the potential loss of life may be relative to when warnings are provided. The range of warning times can be set from no warning (i.e. PARGs only evacuate once the floodwater reaches them) to advanced warning of minutes, hours, or days, depending on the scale of the LSM model.

How and when PARGs are warned of a flood can influence their ability to evacuate. Insufficient evacuation time may not provide the PARG with enough time to reach safety; or all the PARGs being warned simultaneously could result in congestion on roads which prevents effective evacuation.

The LSM enables PARGs to be warned in several ways. In the LSM, a PARG becomes aware that a flood is occurring in a number of ways as follows:

• Time to First Awareness of Flooding (TFAF) – Each PARG can be ‘hard coded’ with a specific time to become aware that flood is happening. Once the time assigned in the TFAF has elapsed, the PARGs become aware that a flood is occurring. For example, a fixed TFAF can be set for all PARGs to simultaneously evacuate or the TFAF can be varied randomly through the population at risk using a defined probability distribution. This method can be used to represent warnings via automated methods (e.g. internet, mobile and phone alerts) and evacuation orders directed by emergency services.

• Use of warning centres – The LSM can simulate warnings. These are issued by warning centres which make PARGs aware that a flood is occurring. The warning centres can be located anywhere and issue warnings radially. They can be used to replicate warnings issued by sirens.

• Depth of the floodwater and word of mouth – PARGs can become aware a flood is occurring when they experience a certain depth of water either on a path, in a building or in a vehicle. This water depth can be set by the user. PARGs can also be made aware that a flood is occurring by ‘word of mouth’, which is governed by the minimum distance between PARGs that are aware a flood is occurring and those that are unaware.

The LSM software has been validated against a number of historical flood events, some of which are briefly described in the following.

Malpasset Dam was a 66 m high concrete arch dam located upstream about 12 km of the town of Fréjus in the south of France. On 2 December 1959, Malpasset Dam failed releasing nearly 55 million m³ of water (Alcrudo & Gil 1999). The official death toll was estimated to be 423, the majority of whom lived in Fréjus. Malpasset Dam failure was used to validate the LSM. A 2D calibrated hydraulic model of the flood wave was available, together with accurate estimates of the population at risk, as well as those affected by the disaster (Johnstone et al. 2003; Lumbroso et al. 2010, 2011a). As part of this case study the LSM's input parameters were assessed to see how they affected loss of life estimates, leading to adjustments to some of these parameters (e.g. PARU and building strengths) to produce credible results (Johnstone et al. 2003). All the reasonable parameter values tested in the LSM produced loss of life estimates that were similar, but never lower than the actual losses reported (Table 1) (Johnstone et al. 2003). The Malpasset Dam validation study showed that the LSM was capable of estimating similar losses to those that occurred in an historic dam break event.

Canvey Island is located in the Thames Estuary in the UK with an average elevation of ∼1 m below the mean high water level. It is protected from coastal surges by flood defences. In 1953, the ‘Great North Sea Flood’ breached these defences, killing 58 people out of a population of around 12,900 and destroying several hundred houses (Grieve 1953). A 2D hydraulic model was used with an LSM model to represent the 1953 Canvey Island flood. The LSM estimated the number of people who drowned to be between 40 and 70 which compared well with the 58 fatalities recorded in 1953 (Di Mauro & Lumbroso 2008). Recent research using the LSM to look at the current situation on Canvey Island has shown how loss of life from a future flood event could be significantly reduced by people in houses with one floor evacuating to their nearest neighbour living in a two-storey building, rather than trying to evacuate from the island via the road network which has a limited capacity (Lumbroso & Davison 2018). This case study showed that the LSM is a suitable tool for emergency planning and loss of life estimation for coastal surges and flood defence failures.

In January 2019, the Brumadinho tailings dam in Brazil suddenly failed releasing a mudflow comprising some 10 million m³ of mining waste which killed between 270 and 320 people (Robertson et al. 2019; Lumbroso et al. 2021). The non-Newtonian mudflow resulting from the failure was modelled using 2D software. The number of people at risk downstream of the tailings dam was estimated to be ∼500, based on reports of the incident and the locations of the buildings in the path of the flow. This information together with a detail of the road network and footpaths in the vicinity of the dam and the outputs from the 2D mudflow model were used to set up an LSM model of the 2019 disaster. The LSM model results of the January 2019 incident showed with no warning, there would 456 deaths out of the 502 people at risk (i.e. a 91% fatality rate) and with a warning at the exact time the dam failed there would have been 354 fatalities (Lumbroso et al. 2021). The LSM was used to investigate a range of different warning and evacuation scenarios. It was found that if a warning had been received at least 15 min before the failure the number of fatalities could potentially have been reduced to zero (Lumbroso et al. 2021). These results showed that the LSM is a suitable tool to improve emergency planning and management for tailings dams.

The LSM is a piece of freeware written in the programming C + +. The software is available to freely download from the LSM website (www.lifesafetymodel.net) under a proprietary licence. The download includes documentation in the form of a user manual and a technical reference guide in PDF format, together with an example data set. The test data set includes velocity and depth outputs from a 2D hydraulic model at a suitable temporal and spatial resolution, as well as all the data (e.g. road network, buildings, PARGs) to create a simple People's World and to run a basic LSM model. This test data set allows users to gain an understanding of how the LSM works before they apply it to areas with larger populations. The LSM software is 6 Megabytes in size and can be installed and run on a typical personal computer under a Windows environment.

The run times for the LSM are dependent on a number of factors including:

• Number of PARUs and PARGs.

• Duration of the flood event.

• Size of the road network.

• Number of vehicles.

The largest LSM model constructed to date had ∼200,000 PARUs. Generally large LSM models with 200,000 PARUs take between 10 and 20 min to run. The LSM run times for the Canvey Island and Brumadinho case studies outlined in this paper were less than 2 min. It is important to note that the primary objectives of the outputs from the LSM are to inform risk assessments and emergency plans. Although ideally run times should be as short as possible, the LSM should be used in advance of a flood or dam break occurring to both increase the awareness, preparedness, and the resilience of stakeholders. The LSM can be applied anywhere in the world providing the relevant data sets are available. Where population, building and road network data sets are not available open spatial demographic data sets such as WorldPop (WorldPop 2023) can be used, and evacuation routes, as well as the locations of buildings can be determined from OpenStreetMap (OpenStreetMap 2023) or can be digitised from freely available satellite data.

In the future it is planned to further develop the LSM to improve the traffic model and behavioural aspects of people with respect to floods. These include research which has looked at drivers' willingness to enter a flooded road (Ahsanuzzaman & Messer 2021), work on the stability of vehicles in floodwater, and the ‘critical’ vehicle height related to this (Bocanegra et al. 2020), and research on how flood depths affect driving speed relationships (Pregnolato et al. 2017). These updates will improve the accuracy of the modelling of congestion and vehicle stability in floodwater. There is a need to update the existing traffic model (e.g. using a Nagel–Schreckenberg model) to provide the ability to include traffic management functions related to emergency planning, such as priority lanes.

The current version of the LSM software only runs on Windows Operating Systems, which limits its use by researchers. The majority of the world's High Performance Computing (HPC) facilities run on Linux (Networkworld 2020). The LSM is written in C ++ which is suitable for compilation on Linux; however, the current version requires modifications for it to do this. Re-engineering the LSM software to work on Linux would enable the software to run on large HPC clusters. The largest LSM model constructed to date comprised ∼200,000 people. The move to Linux would help to enable LSM models comprising millions of agents to be constructed and run on HPCs.

Open science is rooted in the principles of equitable participation and transparency, enabling others to collaborate in, contribute to, scrutinise and reuse research, and spread knowledge as widely as possible. To more fully engage with researchers and practitioners it is planned that in the future the LSM code will be open source and be made available via GitHub.

Currently in many countries, emergency plans for dams and floods take little or no account of the risks to life and evacuation times. Recent disasters such as the 2019 Brumadinho Dam failure, the 2021 floods in Germany, April 2022 floods in South Africa, and the 2011 Sendai earthquake in Japan, together with its accompanying tsunami, emphasise the need to prepare for extreme floods, tsunamis, and dam failures. The LSM is being used by practitioners and researchers in a number of countries worldwide to investigate the risks posed to people by fluvial floods, flash floods, tsunamis, and dam failures.

Providing accurate estimates of deaths for floods and dam breaks is challenging. Inherent in any loss of life methodology is the uncertainty associated with natural variability (US Homeland Security 2011) and social factors (Ge et al. 2021). This includes uncertainties associated with the location of people when an event occurs, how people respond, the loss function for each person, building and vehicle, as well as the representation of the floodwater's velocity and depth at each time step.

The use of agent-based models, such as the LSM, helps to increase the accuracy of estimates of loss of life and evacuation times for these events by taking into account a number of parameters which are not described in empirical models. However, it is important that users of the LSM recognise the inherent complexity and uncertainty of such modelling. This means that often the ratio of the upper and lower bounds of the estimates of the loss of life can be as high as 10, i.e. the uncertainty associated with the number of fatalities is high (Lumbroso & Davison 2018; Ge et al. 2021). The value in using the LSM lies not in calculating the ‘exact’ number of deaths which may result from a flood or dam break, but to assess if emergency management interventions can make a significant difference in reducing the likely fatalities (Lumbroso & Davison 2018). For example, in both the Canvey Island and Brumadinho tailings dam cases, the number of fatalities could have been significantly reduced, by an order of magnitude, by implementing some simple and cost effective measures. The LSM can assist organisations responsible for flood risk management, dam operators, planners, civil protection agencies and the emergency services to improve their planning and response to major flood incidents and ultimately to decrease the loss of life from these disasters. The LSM software provides a useful, evidence-based method of investigating ways of reducing the societal risks from floods and dam failures to ensure that they are as low as reasonably practicable.

We wish to acknowledge all the staff at BC Hydro, and Canada's National Research Council who played a key role in the initial development of the Life Safety Model and many of whom continue to be engaged with its ongoing development.

This work was funded by HR Wallingford's internal research programme.

All relevant data are available from an online repository or repositories: (www.lifesafetymodel.net); (www.zenodo.org/record/3872788).

The authors declare there is no conflict.