Franck Taillandier
email: franck.taillandier@u-bordeaux.fr

Carole Adam
email: carole.adam@imag.fr

A serious game for teaching natural risk management

Keywords: Serious game, risk management teaching, ABMS

Risk management has become an essential skill for civil engineers. Teaching risk management to engineering students is therefore crucial, but is also challenging: it looks too theoretical to students, and practical works are complex and expensive to organise. It also involves interconnected mechanisms coupling human and technical aspects, that are difficult to explain. In order to support risk management teaching, we propose SPRITE, an agent based serious game using a concrete case study which is exemplary in terms of risk management: the coastal floods on the Oleron Island (France). SPRITE places the player (student) in the role of a local councillor of the Oleron Island, who must ensure the safety and well-being of the island residents, while maximising performance w.r.t. economic and environmental issues, in a context of coastal flood risk. SPRITE is a central piece of a pedagogical sequence which is actually used in risk management courses at Bordeaux University. This paper describes the SPRITE serious game and the underlying agentbased model, and reports on some lessons learnt from its use for teaching risk management.

Introduction

In their activities, engineers are frequently confronted with various risks with potentially strong impacts. Teaching risk management to engineering students is therefore essential to prepare them adequately for their future missions. Indeed, [START_REF] Amyotte | Risk management -an area of knowledge for all engineers[END_REF] present different arguments to justify the importance for engineers to have risk management knowledge and skills: ethics (maintaining the well-being and safety of the public), legal requirements (respecting regulations and laws, integrating new ones or acting on them to improve the legal risk management framework), and financial motivations (minimise cost and optimise financial opportunities). But teaching risk management is also challenging for different reasons: it appears theoretical to students; practical works are complex and expensive to organise; and complex interconnected mechanisms coupling human and technical aspects are difficult to explain. To handle these problems, several authors argue for promoting the use of case studies in risk management teaching: they favour memory to avoid repetition of past failures [START_REF] Saleh | From learning from accidents to teaching about accident causation and prevention: Multidisciplinary education and safety literacy for all engineering students[END_REF]; they improve student engagement and have a positive and enduring effect on their minds [START_REF] Saleh | From learning from accidents to teaching about accident causation and prevention: Multidisciplinary education and safety literacy for all engineering students[END_REF]; and they encourage students to integrate multidisciplinary safety considerations in their practices and decision-making [Hale and de Kroes, 1997].

Case study analysis can be efficiently completed by computer simulation which offers many benefits. Compared to full-scale simulation exercises, it is much less costly, less dangerous, and easier to organise, yet it still allows to discover knowledge by exploring several "what-if" scenarios before an actual crisis happens, with complete control on all parameters. Participatory simulation is a kind of simulation where human users interact with the simulated world by controlling some of the agents in the system. Participatory simulation is therefore a type of serious games, i.e. games that are used not for entertainment but for learning, training, or understanding mechanisms [START_REF] Michael | Serious games: Games that educate, train, and inform[END_REF]. In this article, we propose a serious game based on a concrete case study which is exemplary in terms of risk management: SPRITE (Participatory Simulation of Territorial Risks) places the player (student) in the role of a local councillor of the Oleron Island (France), to raise their awareness about the risk of coastal flood and the need for a balanced management of that risk. Of course, the target students will probably become engineers rather than politicians, but giving them this role has a double interest: (1) it places them in the position of a decisionmaker with a real ability to establish a risk mitigation and real responsibilities to assume; and (2) it makes them understand the complexity and the different issues of such decision-making. It is also interesting to offer them a different perspective on risk management, from the point of view of a different actor. Few students will really be in such a position in their professional life, but as engineers they might have to advise deciders. We argue that playing SPRITE can help students to better understand the responsibilities and constraints of the local authorities, and therefore to better advise them during their career.

This paper is structured as follows: Section 2 briefly discusses some literature about the use of serious games for teaching in general, and teaching risk management in particular. Section 3 introduces our case study (the coastal flood risk on the Oleron island) and the SPRITE model designed to raise awareness about that risk. Section 4 describes the serious game based on this model, its game design and implementation. Section 5 introduces the methodology and first results of our evaluation of the use of SPRITE for teaching risk management. Finally, Section 6 concludes and discusses future prospects.

Serious games for teaching

Serious games span a wide range of applications [Westera, 2017]: training, learning, and raising awareness. Numerous serious games for educational purposes have been developed in the past decade with the advances in technology making electronic media more accessible [START_REF] Madani | Serious games on environmental management[END_REF]. Serious games have several benefits over more classical approaches to teaching. They follow a constructivist logic in which the players build their own knowledge by confronting a problem in a simulated world. A meta-analysis gathering 193 articles about serious games [START_REF] Sauve | Une analyse des écrits sur les impacts du jeu sur l'apprentissage[END_REF] has shown the following benefits: favouring the development of social and human relationships and communication skills; increasing learning motivation, self-esteem and self-confidence, engagement and persistence; developing problem-solving skills; helping learners to structure, build and represent knowledge; and helping learners to integrate information by developing the capability to build links and transfer knowledge from other contexts.

Simulation-based serious games are particularly interesting for raising awareness of various types of risks [Crovato, S. et al., 2016]. By being placed in a risky situation and allowed to try several ways of managing it, players can better comprehend risks, their possibility of occurrence, and the consequences of their actions on them. For major risks such as coastal floods, exploring different strategies and their impact in a serious game provides players with some experience, simulated but close to the real world mechanics. Such experience would be hard to acquire from real crises in such a short time, due to the long duration between events, and the stakes involved that prevent from trying random strategies.

An important aspect of serious games and participatory simulations is to rely on a pedagogical scenario integrated in the game design to answer a specific pedagogical objective. Moreover, a number of rules must guide the player's experience by specifying objectives, conditions of victory or failure, possible interactions with the game and the other players (if any), and mechanisms for the evolution of the game world. These rules can be integrated in the computer model, provided externally (e.g. note card to be referred to when needed), or both. Finally, knowledge delivered in a more classical way (e.g. note cards) is a good complement, with the serious game thus serving as a motivation to acquire knowledge from other sources [START_REF] Wouters | Current practices in serious game research: A review from a learning outcomes perspective[END_REF].

3 Case study

Context: coastal floods on Oléron island

Oleron Island is an island of the Atlantic coast of France, close to La Rochelle. It is the second largest island (174 km2) of Metropolitan France after Corsica; 21 000 inhabitants live permanently on the Island. In 2010, the Xynthia storm had a particularly strong impact on the islands of the Atlantic littoral, specifically the island of Oléron. Indeed, the combination of a barometric depression (977 hpa), strong South-West wind (over 110 km/h with gusts around 140 to 160 km/h), and high tidal coefficient (102) produced a particularly high tide, 50 to 70 cm over predictions [Vinet, F. et al., 2012], leading to the flooding of a part of the island and important human (53 deaths in France), material (4800 flooded houses, 120 km of coastline damaged, 40km of departmental roads flooded), and economical (457 Meof public expenses) damage [Bersani, C. and coll., 2010]. Before Xynthia, only few extended coastal flood events had happened recently, the last remembered one being the Martin storm in 1999 (and unlike Xynthia its resulting damages were mainly due to the wind rather than coastal flood). The coastal flood risk was therefore largely underestimated by both the local authorities and the population, and as a result mostly ignored in territory planning and management policies [Duvat-Magnan, 2010], leading to an increase of both the risks and the island vulnerability (construction in flood-prone areas, failure to maintain dykes, etc.) [Vinet, F. et al., 2012].

Therefore, the risk of coastal flood became a priority for local councillors of the island of Oléron, who began a reflection about the management of this risk and its integrated management in a more global framework considering also social, environment or economics issues. It led to the building of several dykes and other operation in order to increase the protection against the coastal flood. Building a dyke protects the littoral from coastal flood but induces maintenance costs, degrades landscape and has a negative impact on fauna and flora. The suddenly change of objective of the local councillor to security has many drawbacks. Indeed, they must meet various competing objectives: ensure the residents' safety but also respect a limited budget, preserve fauna and flora, promote the island and make it attractive to tourists and new residents, etc. There is no optimal solution answering all (competing) objectives simultaneously; good management requires a combination of actions regarding the different objectives to reach a balanced compromise between them, but it might be difficult to find for the councillors. Indeed, councillors are not experts of everything, and they tend to favour some solutions at the expense of others depending on their history, convictions, knowledge and culture. Understanding the need to reach a balance is therefore an important stake in order to manage relevantly the territory. [START_REF] Adam | SPRITE, participatory simulation for raising awareness about coastal flood risk on the oleron island[END_REF]) seeks to answer that challenge: it is a serious game placing the player (student) in the role of a local councillor to raise his/her awareness about the risk of coastal flood and the notion of balanced management of that risk.

The SPRITE model

SPRITE (Participatory Simulation of Territorial Risks

Parcels and territory

The game board is a grid made up of square cells (the Parcel agents). It is built automatically from real Geographical Information System (GIS) data (planimetric and altimetric information, density of buildings, etc.) by an external module (once and for all, to reduce the game initialisation time). Parcel agents have physical attributes (altitude, water height, dykes, number of residents, etc.) and 4 dynamic values corresponding to the different competing objectives of the mayor (safety feeling, ecological value, housing value and commercial value). Territory agents are composed of a set of parcels and have attributes aggregating the values of their parcels (number of residents, values of the 4 indicators, etc.) as well as specific attributes (tax rate, budget).

Coastal flood Our flood model is based on [Le Cozannet, G. et al., 2015] and was previously validated [START_REF] Adam | SPRITE, participatory simulation for raising awareness about coastal flood risk on the oleron island[END_REF]. From wind strength and direction, barometric pressure and tidal coefficient, it computes water height and wave height. The coastal flood is then simulated based on an overflow algorithm following 4 stages: initialise weather conditions; propagate water in all directions; propagate waves only in wind wave direction; end coastal flood. Water and wave propagation depend on relative water, wave and dyke altitudes. The algorithm also considers the status and resistance of dykes (which can be damaged by waves, can age over time and can be maintained or repaired by the player).

Residents The Resident agents are the only autonomous cognitive agents. They have personal preferences for five dimensions (ecology, safety, housing, commercial and tax rate) that they use to assess their satisfaction with their personal situation (values of these indicators for their current parcel). Satisfaction can also be directly influenced by some actions of the mayor (e.g. expropriation) and by the behaviour of other residents. Based on their satisfaction, residents can choose to stay, move to a different parcel, or leave the island altogether. There is also some degree of randomness in their behaviour (residents can randomly leave or arrive for various external reasons, e.g. new job). Finally, residents also compute their political agreement (positive if their satisfaction increased over the mayor's mandate, negative if it decreased) to determine their vote at the next election.

Turning SPRITE into a serious game

In this section we explain the design of a serious game based on the SPRITE agent-based simulation. We added an interactive mayor agent controlled by the player, as well as several mechanisms to engage the player and improve learning.

Game design

Player interactivity: the Mayor agent The student plays the role of the mayor of the territory, and has competing objectives, different actions to fulfil them, and a limited budget (in a virtual money called 'kopecs') that constrains how many actions can be performed. The available actions, along with their cost and effects, are divided into three categories: dyke actions (build 3 types of dykes, demolish or repair damaged dykes), planning actions (modify landuse plan, build housing or expropriate and demolish) and territory actions (improve infrastructure and promote tourism, promote local products and industry and change tax rate). Each of these actions has a mix of positive and negative effects, and progressing one goal often leads to impeding another one.

Game dynamics

The game is based on a triple dynamic (Figure 1): playing, flooding and election.

-Playing dynamic: each turn of the game is one year on the island, and follows the same process: new year start, tax collection, residents actions (stay, leave), player's actions, end of turn. Engaging mechanisms Beyond interactivity, turning the simulation into a proper serious game requires adding some engaging mechanisms to better immerse the player, improve their learning experience, and maximise acquisition of knowledge, which is the main goal of SPRITE. [START_REF] Brandtzaeg | Enjoyment: Lessons from karasek[END_REF]] studied "funology", i.e. enjoyment in human-computer interaction, by using Karasek's model of engagement and well-being at work, and found three factors influencing engagement: demands on the worker or player (challenge and surprise but not overwhelming); level of control they have (controlled interaction, timely feedback); and support they receive (social interaction, no isolation). These criteria are also in agreement with [START_REF] Garris | Games, motivation, and learning: A research and practice model[END_REF]'s model of motivation in educational games. In order to match these criteria, we have introduced several engaging elements that are detailed in the next paragraphs:

-Demands: actions are constrained by a limited budget, yet sufficient to succeed; elections add some level of randomness and challenge; obtaining a good score requires finding a balance between various indicators; -Control: the interactive map lets the player control the parcels; the console provides immediate and useful feedback on cost and remaining budget; different pedagogical scenarios of different difficulties can be selected; -Support: a high-score table allows comparison with other players; the game gains in interest by being played in teams (the players must discuss and reflect together to establish their strategy); future versions will provide multiplayer experience by splitting the island into several territories that can compete to attract residents.

Implementation

The simulation and serious game are implemented with GAMA, an open-source multi-agent geographical simulation platform [START_REF] Grignard | Gama 1.6: Advancing the art of complex agent-based modeling and simulation[END_REF]. GAMA offers an integrated programming language and development framework, allowing even non-computer scientists to simply design and maintain elaborated models, with up to several millions of agents. GAMA also provides native management of GIS (Geographical Information Systems) data allowing to integrate geographical data files into simulations. Finally, GAMA offers interactive functions (user commands) enabling the use of the participatory dynamics required in SPRITE.

Fig. 2. Game interface

Figure 2 shows the game interface. The console (top left) provides the player with useful information during the whole game, guiding her/him during the game. An indicator box (bottom left) displays the current year, the current level of infrastructures and industry, and the values of four indicators: number of residents (and its evolution w.r.t. last year), popularity, environment, and damage from coastal flood. The different action buttons are available on the right, sorted in three actions categories (dyke, planning and territory); the action symbols are explained in the rules provided to the players (on note cards). Finally, the centre screen proposes two maps: the first map records the consequences of the last coastal flood (the light blue parcels are those which were impacted by this flood) to allow the player to build their strategy based on recent events; the second map is the game board and supports all the actions on parcels (i.e. dyke and planning actions).

On the game board map (Figure 3), squares represent the buildings (darker squares for higher construction density). Circles represent the population (darker circles for more densely populated parcels). On the Dyke view (a), colour indicates parcel altitude (the darker the higher) and triangles of different colours represent dykes of different types. Finally, the three colours of the Land use map (b) indicate the type of parcel (grey: urban, yellow: agricultural, green: natural). The player can switch form one view to another at any moment by pressing a button (Change view button).

Evaluation of SPRITE for teaching

The SPRITE serious game was beta-tested by a small number of heterogeneous participants in order to calibrate the rules, scoring and overall balance of the game, and to improve game design and engagement (e.g. adding elections). We now want to use it with the specific purpose of teaching risk management to students. The paragraphs below describe the design of a pedagogical scenario, our evaluation methodology and our first results.

Designing the pedagogical scenario and sequence

As exposed in the introduction, SPRITE was developed in a pedagogical perspective and enables to propose specific pedagogical scenarios. Creating a relevant scenario is a major issue and is a central point of the learning success. It must be designed according to the notion to learn. In this paragraph we propose a specific pedagogical scenario called Rim (for Risk management).

Notions to learn

The principle of the Rim scenario is to place the student into the position of the Oléron mayor during the 15 last years in order to make him live the same course of events as the real mayor of Oléron. We assume that it allows the student to learn the same lessons that were learnt by the local authorities from the real events, and to guide the player to a balanced management of the territory risk. Students are thus expected to learn various concepts and notions: territory risk, vulnerability of a territory, resilience, risk perception, risk culture, multi-criteria analysis and balanced management.

Pedagogical scenario

The Rim scenario is composed of three distinct parts corresponding to three successive periods; each contains 5 turns (5 years) and finishes by an election. 1. Period 1 (2004-2008) -Prologue: the Rim scenario places the player in 2004, at the beginning of a new mandate. A message informs the player of the importance to grow the population, to ensure the economic development of the island, and to improve their popularity in order to ensure their reelection. During this period, no coastal flood occurs, and no message or warning is given to the player regarding coastal flood risk. The player is encouraged to ensure a good development of the island, therefore increasing (unknowingly) the vulnerability of the island to coastal floods (new buildings near the coast-line, no dyke maintenance, etc.). To ensure the continuity of the game, the player should be re-elected at the end of this first period. If the player was to lose the election, the model falsifies the result and makes him win with 50.01% of votes in the second turn. 2. Period 2 (2009-2013) -Xynthia: after the first period which was positive for the player, the second period begins by a coastal flood: the simulation of Xynthia. The more the player increased the territorial vulnerability in the first period, the more important the damage will be. A message now informs the player of the importance of the damage, and of the necessity to ensure the safety of the residents. The expected behaviour of the player in response to this consists in building numerous dykes and limiting urban areas in vulnerable parcels, leading to expropriations. The popularity of the player should decrease during this period as a result. A medium coastal flood then occurs again in 2014 in order to test the island protection against coastal floods. Most players should successfully be re-elected (if the protection against the second coastal flood was correct, and if they used part of the budget to satisfy residents) but more tightly (around 50-55% of votes). Again to ensure continuity, in case of a defeat the results are automatically falsified to make the player pass with 50.01% of votes in the second turn. 3. Period 3 (2014-2018) -Wise: the limited victory of the player in the second period should alert them on the importance of the other issues than safety alone. A message informs the player of the importance of the environment, the economy, and residents satisfaction. The player is encouraged to have a wide (and wise) management of the island. Two coastal floods occur during this period: a small/medium intensity flood in 2016, and a medium/strong intensity flood in 2018, so safety should not be neglected but the other criteria either. The period finishes by a last election which, this time, is not falsified. The player then receives their final score.

Pedagogical sequence The Rim scenario was conceived for teaching risk management to French Master students in civil engineering, but it could also be used for other types of students or in other contexts. About 20 students in the class work in pairs under the guidance of one teacher.The pedagogical sequence is composed of four phases. The first phase is the presentation of the game: the teacher exposes the learning process, and the principle and rules of the game.

The second phase consists in playing the game: students play the Rim scenario of SPRITE in pairs (each pair on one computer), and discuss strategy and choices of actions together. Exchanges between different groups are not forbidden but not encouraged, and limited by the competitive aspect of the game (each group should try to get the best final score), which ensures that different strategies can be explored, thus enriching the post-game discussions. The teacher answers potential questions and encourages students to reflect on their strategy, but without guiding their choices. The duration of each turn is limited to 10 minutes for the first turn (to let the students understand the interface) and 5 minutes for each subsequent turn. The total duration of this second phase is 80 minutes. The third phase is a discussion organized after the end of the game in order to allow students to share their game experience and their reflexion. These discussion are guided by the teacher ensuring that all the students can equally speak; they have to make emerge question and reflection on the notions to learn. In a last phase, the teacher exposes, in classical teaching form, the different notions that were to be learnt and use example from the game experience to illustrate them.

Experimentation

Experimentation methodology The University of Bordeaux has been offering since 2010 a course on risk management dedicated to engineering students in the Master of Geology and Civil engineering. Our experimentation was conducted with a group of 16 students from this risk management course. To measure the learning impact of SPRITE, the following method was used:

1. at the beginning of the course, students first have to fill in a questionnaire about risks to evaluate prior knowledge; 2. students then play with SPRITE following the pedagogical sequence above (presentation, playing, discussion); 3. one month later students fill in the same questionnaire about risk as they did before to evaluate progress.

The two sets of questionnaires are then made anonymous, mixed, and marked by a teacher who does not participate in SPRITE. In order not to influence his marking, he does not know if the questionnaires were filled in before or after using SPRITE.

Preliminary results

The experimentation was only conducted recently and it is too early 3 to evaluate the impact on knowledge gained by the students. However, we have also asked the students to answer some questions about the SPRITE serious game itself, right after playing it. They have given marks between 1 and 10 to various indicators about the game (immersion, pleasantness, quality of the interface, appropriateness of the game duration, difficulty), about themselves (previous experience with serious games, understanding of the rules, motivation to perform well in the game, understanding of the notions taught), and about the pedagogical impact (quality of the pedagogical sequence, will to use serious games in learning). Figure 4 illustrates the scores on 5 of these indicators with minimum, median, and maximum mark. These scores, as well as qualitative feedback from the students, show that SPRITE was well received by the students, most of whom would want to use serious games again in their studies. Despite a quite simple interface (which received an average score of 7.5), students reported good immersion in the game (average score 8.6) which was found to be pleasant to play (average score 8.8) and motivating (average score 9.4). Students also report a strong feeling of having understood the notions taught, which still has to be confirmed by the (still ongoing) objective evaluation of their game performance. However, students also acknowledge that the game alone is not sufficient but must be accompanied by a more traditional course and a discussion of the notions learnt. This is in agreement with [START_REF] Wouters | Current practices in serious game research: A review from a learning outcomes perspective[END_REF] who insists that knowledge delivered in a more classical way completes the gaming experience, and turns the game into a motivation factor to acquire knowledge.

Conclusion

SPRITE, a participatory simulation tool, was designed for risk management teaching and to raise awareness of territory risks. It allows the user to play the role of the mayor and manage the island of Oleron for a number of years, with the mission of finding an appropriate balance between popularity, economy, attractivity, safety and ecology. SPRITE has a double pedagogical mission: informing the player about territorial risks, and forcing them to reflect on appropriate policies for managing this risk. The model is fully implemented in GAMA and the game is already playable. The evaluation of engagement with the game and learning from playing it is still preliminary but encouraging. Short term future work will mainly be dedicated to pursuing this evaluation. Longer term prospects include several improvements of the model and the interface. In particular, we plan to refine the mechanisms involved in the residents' decision-making, by taking into account more factors, including emotions (fear of the next flood, anger at the mayor after a relocation, etc).

Fig. 1 .

 1 Fig. 1. Game dynamics

Fig. 3 .

 3 Fig. 3. Game board map

Fig. 4 .

 4 Fig. 4. Evaluation (min, median, max) of 5 indicators (marked from 1 to 10) by students after playing with SPRITE.

Questionnaires are still being analysed, final results will be available in time for presentation at the conference.


Carole Adam
email: carole.adam@imag.fr

Benoit Gaudou
email: benoit.gaudou@ut-capitole.fr

Modelling human behaviours in disasters from interviews: application to Melbourne bushfires

Keywords: Human behaviour modelling, agent-based social simulation, crisis management

This paper describes a model for raising the decision-makers' awareness of the real (irrational and subjective) behaviours of the population in crisis situations. We analyse residents' statements and police hearings gathered after Victoria Black Saturday bushfires in 2009 to deduce a model of human behaviour based on the distinction between objective (capabilities, danger) and subjective (confidence, risk aversion) attributes, and on individual motivations. We evaluate it against observed behaviour archetypes and statistics, and show its explicative value.

Introduction

Natural disasters have been getting more and more frequent recently and cause many victims every year. It is particularly important, in order to decrease the number of victims, to prepare the population and the decision-makers in advance so that they can react appropriately when a crisis occurs. In this paper we are interested in the bushfires in the state of Victoria in Australia. The current policy is "Prepare, stay and defend, or leave early", so the population is given a choice between: evacuating early, before fire reaches their area of residence, because "many people have died trying to leave at the last minute" [START_REF]Country Fire Authority: Your guide to survival[END_REF]; or stay and defend their house, only if very well physically and mentally prepared. In both cases, the decision must be made and a plan prepared well in advance. But in the summer 2009, serious bushfires devastated a part of Victoria, culminating on the Black Saturday 7th February when 173 people died, despite all efforts at raising awareness. Several reports [START_REF] Teague | Victorian Bushfires Royal Commission[END_REF][START_REF] Mclennan | Community members decision making under the stress of imminent bushfire threat -murrindindi fire[END_REF] have tried to explain the reasons for this heavy death toll and have identified inconsistencies in behaviour (the population does not react as expected by decision-makers), in information (received information is not always considered as relevant by the population), and in communication means (inefficient, specifically information broadcast).

We focus on the discrepancy between the population behaviour as expected by the decision-makers (that determines what information is sent) and their actual behaviour (that determines what information they would need or find relevant). We propose to explain this mismatch by a gap between objective and subjective values of two aspects: risk, and ability to control it. Decision makers tend to predict behaviour based on objective values, while each resident behaves based on their own, necessarily biased, subjective values. Our approach is agentbased modelling and simulation, where autonomous entities (agents) represent the human residents. We have analysed witness statements to design a conceptual model of population behaviour consistent with psychology (Section 2); implemented it on the GAMA simulation platform (Section 3); and evaluated it against behaviour data (Section 4). We conclude (Section 5) with a discussion of these results, comparison with related works, and future directions of research.

Conceptual model of population behaviour

Methodology. There are 2 main difficulties in building a realistic agent-based model of human behaviour: finding the right balance between model descriptivity (realistic enough to accurately describe and generate real human behaviour for each agent) and complexity (yet simple enough for its results to be easily understandable) [START_REF] Edmonds | From kiss to kids: an anti-simplistic modelling approach[END_REF][START_REF] Adam | BDI agents in social simulations: a survey[END_REF]; and finding and exploiting data to inform the model. In this paper we manually analysed several types of data about the 2009 bushfires: 100 witness statements [START_REF]Royal Commission: Final report -volume 4 -the statements of lay witnesses[END_REF], 86 police hearings about circumstances of deaths [START_REF]Final report, volume i: The fires and the fire-related deaths[END_REF], and statistics about the fatalities [START_REF] Teague | The people who died[END_REF]. The next section discusses a number of relevant extracts and how we exploited them to design and inform our model.

Witness statements and statistics

Under-estimation of danger. Reports state that "among those who died, some misinterpreted the information they had received, not realising how little time they had to respond or how soon the fire would reach them". As a result they did not have enough time to implement their fire plans. Even people who did not plan to defend still found themselves forced to when surprised by the fire. For instance, this father:

When we headed up to [the] property, there was just a little fire at the bottom of the hills and I didn't think there were any major dramas. [...] I wasn't too worried at that stage as the smoke was still two valleys away. [...] We watched the fire come up. [...] When I saw them knock the fire off the top of the hill I was quietly confident that we were going to be okay then. [...] As soon as I saw the smoke I decided it would be too dangerous to drive the 5km bush track out. I then prepared to face the fire.

Over-estimation of capabilities. Many residents had over-estimated their ability to face the fires, and were unaware and unprepared.

Although I had never really given it much consideration, I suppose that my fire plan always consisted of staying and defending my property. [...] Nothing prepared me for this bushfire. Although I never thought about leaving, I now know that my decision to stay and defend was not a well-thought-out decision and that I was very underprepared. In particular, I was psychologically unprepared to fight a bushfire. I simply did not have any idea what the reality of facing a fire would be.

Others did not update their perceived ability with their current condition (age, illness), like this woman's now elderly husband who insisted on defending:

[He] was in Marysville during the 1939 bushfires and fought the fire from the roof of our old house and helped to successfully save that house. [He] also spent many years working for the Forestry Commission and one of his jobs there was to go to different places to fight fires. During his younger years, [ Reports confirm that "most of those who died did not, and often could not, respond appropriately to the risk that the bushfires presented for them on 7 February"; in particular 30% of fatalities occurred in undefendable properties.

Passivity. Many people stayed passive in front of fire until it was too late, therefore feeling as if everything went too fast. It was reported [START_REF] Teague | The people who died[END_REF] that 69% of the fatalities were "passively sheltering" when they died.

This was not a conscious decision, but I was standing just outside the house watching for flames and when they came, they came so suddenly that I just didn't have time to do anything or than stand and watch. It feels almost sacrilegious to say this, but I found the fire fascinating and strangely beautiful. The contrast of the black and red was stunning.

Individual differences. Different individuals can have different perceptions of risk and motivations, resulting in emotions, and a negotiation of the decision. In that first statement, all four members of the family died in their house. In another statement, the wife ended up escaping alone to safety.

I continued to talk to [my husband] and tried several times to persuade him to leave, but he would not budge. I could smell the fire, I could hear the fire and I could see it with my own eyes. But I couldn't get my husband to accept that it was coming. He just sat and sat and sat. [...] I decided that I could not stand it any longer. I was feeling very anxious and angry with [my husband]. I kept saying "hurry up, come on we've got to go". The fire seemed to be coming closer. I could hear the fire crackling. After too much of that I thought "I'm not staying here to burn". So I walked out the gate and I left the house on foot. [...] I had no idea where I was going the only thing I can remember is that I wanted to get out. I was not thinking clearly because I was so annoyed with [him] and I was also feeling terribly guilty about leaving him. I still have this guilty feeling because I survived and he didn't.

External motivations to defend. People can have additional motivation to defend their house, for instance for financial reasons. Some residents report having stored expensive equipment or personal belongings.

I also had many belongings stored on [the] property in four sheds. I am a hoarder by nature [...]. My belongings included the fit out of a cafe that I used to own, $50,000 -$60,000 worth of tools [...]. I also stored family photos and personal papers in the sheds.

Others report drawing additional income from cattle or plantations.

[We] are both retired teachers. The olive grove had been planted in 1999 and the trees were at full production. Both the cattle and the olive grove provided additional income for our retirement.

In both cases they tried to protect their belongings from the fire.

Summary. In conclusion, the manual analysis of these statements highlighted the following factors that we want to include in our model: discrepancy between actual danger and perception of risks; discrepancy between actual abilities and confidence in one's abilities; inter-individual differences in initial motivations for defense (e.g. financial) or escape (e.g. risk aversion); inter-individual differences in awareness of and knowledge about fires. It also showed that residents go through different stages based on these factors (unaware, passive, preparing, defending, escaping...); can stay in each stage for a varying amount of time, with many residents surprised by the fire while still indecisive or passive (58% of fatalities had made no preparation at all, neither for leaving nor for staying); and can die in any of those stages.

Behaviour model: finite state machine

In order to highlight the role of these subjective, irrational determinants of the decisions and behaviours of each resident, we need a model descriptive enough to capture these factors, but not so complex that the results will not be understandable. Our choice is to model the population as heterogeneous agents, each having their own values of attributes (individual motivations, subjective risk, subjective abilities, etc), and a finite-state-machine architecture with the following states and transitions (cf Figure 1) inspired by the stages observed above:

-Unaware: initial state where the agent is (rightly or wrongly) unaware of any danger, and does nothing; agents can become aware by spotting fires in their perception radius (see flames, smell smoke...), with a probability based on their objective abilities; they update their value of subjective danger based on their perceptions and motivations; -Indecisive: the agent is aware of some fires but has not yet made a decision about how to react; agents stay indecisive for a varying amount of time, until they have enough motivation to either fight or escape; initial motivations are individual and then vary based on the evaluation of the situation (subjective danger); -Preparing to escape: the agent has decided to leave and starts preparing, until ready or surprised by the fire before being ready (transition to Escaping), or blocked by the fire and forced to stay (transition to Preparing to defend);

-Escaping: the agent is evacuating towards the closest shelter; travel efficiency depends on objective abilities; injuries can be received from fires on the way. Unless it dies during travel, its next state will be Safe when reaching the shelter; -Preparing to defend: the agent has decided to defend, or was forced to stay because the fire blocks escape; it prepares house and self until the fire is close enough, which triggers the transition to Defending; -Defending: the agent is actively fighting the fire around its house; when that fire is extinguished, the agent transitions back to Preparing to defend until another fire comes; if motivations change (e.g. subjective danger increases when actually seeing the fire, or subjective abilities decrease after failing to fight) and evacuation becomes more urgent, the agent transitions to Escaping; -Safe: the agent is (and will stay) in a shelter, and cannot be injured anymore; -Dead: the agent's health dropped to 0 as a result of injuries received from the fire; -Survivor: final state of all agents that did not die during the fires (e.g. successful defenders, lucky passive, and all sheltered residents). This simple model is sufficient to capture the discrepancies highlighted by the data. Indeed the objective value of danger influences injuries and damage, and the objective value of capability influences the success of actions. But these objective values are inaccessible to the agents, whose decisions are based on their subjective values of danger and abilities, and on their motivations.

Evaluation of the conceptual model

Comparison with the psychology of stress. Our model is in agreement with Lazarus' theory of stress [START_REF] Lazarus | Emotion and adaptation[END_REF], making a distinction between two simultaneous processes: primary (or demands) appraisal consisting in evaluating the significance of the situation for the individual (good, stressing, or irrelevant), matches our subjective danger; and secondary (or resources) appraisal consisting in evaluating the individual's capability (skills, social and material support, resources) to cope with the stressor, matches our subjective ability.

Comparison with cognitive bias theories. Behaviours reported in the statements are consistent with known cognitive bias [START_REF] Yudkowsky | Cognitive biases potentially affecting judgment of global risks[END_REF][START_REF] Kinateder | A review of risk perception in building fire evacuation[END_REF], in particular the confirmation bias, a tendency to give more credit to information consistent with one's beliefs or motivation and to discard inconsistent cues (e.g. interpreting the presence of firemen as a sign that everything is safe, or denying the reality of the fire when wanting to stay). Our model allows to capture such a bias, because motivation plays a role in the computation of subjective danger and ability.

3 Implemented model of behaviour in bushfires

Model of environment

We implemented the model in the GAMA simulation platform [START_REF] Grignard | Gama v. 1.6: Advancing the art of complex agent-based modeling and simulation[END_REF]. For the sake of simplicity, the environment is a grid containing the different types (houses, shelters, fires, and residents). This simplistic environment is not realistic but is sufficient to simulate the residents' decision-making in reaction to fires.

Fire. Very complex and detailed models of fire spreading already exist [START_REF] Duff | Quantifying spatio-temporal differences between fire shapes: Estimating fire travel paths for the improvement of dynamic spread models[END_REF], but realistic fire behaviour is not the focus here. Still with the goal of not adding unneeded complexity, we have designed a very simplistic model of fire that is sufficient to trigger and visualise the reactions of the population that we are interested in here. The fire is composed of fire agents (each with a location and an intensity representing its radius of action), having a reflex architecture, i.e. the following reflexes are triggered at each step of the simulation:

-Increase or decrease intensity: probabilities are parameters.

-Propagate to a non-burning neighbour cell, creating a new fire agent. Probability of propagating, and starting intensity of new fires, are parameters. -Deal damage to buildings in its radius of action (based on its intensity):

the amount of damage is picked randomly between 0 and a maximum value, function of intensity and a "damage factor" parameter. -Deal injuries to residents in its radius of action, also random amount between 0 and the maximum value based on its intensity and an "injury factor" parameter. If the person is in their house, the injury is moderated by its resistance weighed by a "protection factor" parameter. -Disappear when its intensity is null.

The different parameters involved allow the user of the simulation to make the fire more or less dangerous in order to observe the desired behaviours. Actions are also available to start new fires or stop all fires (and thus the simulation).

Houses. The environment initially contains a number (parameter) of houses each inhabited by exactly 1 resident (in future work we plan to consider families and their relationships). Each house is an agent with the following attributes:

-Owner: the resident of that house -Resistance: random initial value between 100 and 200 to simulate different solidity, will be increased by preparing, or decreased by fire damage, and offers some protection from fire injuries to its resident. -Damage: the damage received from fire The houses collapse from fire damage when their resistance drops to 0. They then cease to offer protection, and the resident's motivation to defend them also disappears. They stay in the environment as ruins for final visualisation.

Shelters are safe places whose location is known by all residents3 . They offer a total protection from fires (no injuries can be received while in a shelter). Once a resident has reached a shelter, they stay inside until the end of the simulation.

Model of residents

Architecture. We used GAMA finite-state-machine (fsm) architecture for the residents, with the states specified in Section 2: initial state Unaware; states during the fires: Indecisive, Preparing to defend, Defending, Preparing to escape, Escaping, Dead, Safe; final state Survivor, only reached by agents still alive when all fires are stopped.

Attributes. Residents agents have the following attributes and functions:

-Location on the grid.

-House id (each agent is initially in a house).

-Current state (initially unaware, then following the fsm, see Figure 1).

-Health: random initial value, increased by preparing for fire, decreased when receiving injuries. -Injuries: total injuries received from fires, influencing decision to escape.

-Objective defense ability: random static value impacting the chance to perceive fires in perception radius, and the effect of (prepare, defend) actions. -Subjective defense ability: initialised by applying a (under-or overestimation) bias (based on confidence parameter and defense motivation) on objective ability, then updated (rate is a parameter) by observing performance (success or failure of defense actions); influences defense motivation. -Objective escape ability: random static value (e.g. driving vs walking, fitness), impacting accuracy and speed of evacuation. -Objective danger: based on intensity and distance of all fires around the agent.

-Subjective danger: based on intensity and distance of fires known by the agent, moderated by individual motivations. -Motivation to escape (risk-aversion): random initial value, then updated based on subjective danger, health, and resistance of house (offering protection); determines the decision to escape. -Motivation to defend: random initial value (e.g. financial reasons, previous experience), then updated based on injuries and damage received, and on subjective evaluation of danger and of fighting abilities.

Actions. Residents agents can perform three actions depending on their state:

-Prepare: action performed while in Prepare to defend or Prepare to escape state; consists in raising resistance of the house (watering, weeding, etc) and health (wearing appropriate clothing, etc), by an increment based on objective ability; success or failure influences subjective ability.

-Fight fire: action performed while in Defense state to decrease the intensity of nearby fires by a value based on objective ability; agents monitor success to update subjective ability, thus reconsidering their motivation over time; -Escape: action performed while in the Escaping state, to head towards the closest shelter, with speed and accuracy based on objective escape ability (could take detours); they might get injured if travelling too close to the fire.

4 Results and evaluation of the model

Implementation of the simulation

The environment is a 50x50 non-torus grid Figure 2), initially containing 2 shelters in the NE and SW corners (blue-green circles) and 200 houses (grey squares) inhabited by 200 residents. Attributes are randomly initialised (health and resistance between 100 and 200; capabilities and motivations between 0 and 1). The simulation starts with 20 medium fires (orange triangles) that then grow and propagate. Burning cells are in red, surrounded by yellow cells (radiant heat, radius equal to the fire intensity); green cells are safe. At runtime, the user of the simulation can start random new fires or stop all fires, and can specify 3 categories of parameters concerning: fires (probability to grow or propagate, initial intensity, damage factor, etc); buildings (resistance, protection factor, etc); and residents (confidence bias, perception and action radius, etc). The residents have 2 colours to visualise their current (outside colour) and previous (centre colour) state in the fsm: dark blue (unaware), pink (indecisive), orange (preparing to defend), red (defending), yellow (preparing to escape), light blue (escaping, with an additional nuance of blue grey if escaping before they are ready), dark green (safe), black (dead). There is no specific colour for the survivor state as it is reached by all agents still alive when the fire stops.

Evaluation methodology

Our model is aimed at the reproduction of realistic human behaviours (and not at realistic initial situation or fire spreading), and should therefore not be evaluated as a whole. This is why we focus here on evaluating the generated human behaviour. We have implemented a tool to track and log the agents' states trajectories: what states they went through, at what cycle, and what were the values of their attributes when making the transition. This allows us to study and explain what happens in the simulation. Thanks to this tool, we can evaluate our model on two axis: correctness, by comparing the generated trajectories with those observed in the real population (profiles of behaviours), and in particular comparing the causes of deaths; and explicative value, by showing the importance of the subjective-objective discrepancy, thus proving the potential of our model to raise decision-makers' awareness of this gap.

Evaluation of the correctness of model

Consistency with behaviour profiles. A report [START_REF] Rhodes | Why dont they do what we think they should?[END_REF] has established 6 profiles of behaviours in the residents of fire-affected areas: can-do defenders (most Fig. 2. Screenshot of the simulation in GAMA, with parameters and their values determined, experienced, self-confident and skilled, determined to defend); considered defenders (strongly committed to defend, aware of risks, well prepared and trained); livelihood defenders (committed to defend their livelihood, well prepared); threat monitors (not intending to stay in front of a serious threat, nor to leave until necessary, wait and see); threat avoiders (aware of risks an dvulnerability, plan to leave early before any real threat); unaware reactors (unaware of risk, feel unconcerned, no knowledge, preparation or training).

We were able to observe the same profiles of behaviours in our simulation, and to categorise the agents in these profiles based on their logged trajectories. For instance a typical trajectory for a can-do defender is an early perception of the fire (transition to Indecisive followed by an immediate decision (transition to Preparing to defend), an efficient preparation (strong improvement of health and resistance in that state) and defense (big decrease of fire intensity). Also they have a good perception of risks and are able to reconsider their intention (transition to Escaping when health decreases too much), unlike livelihood defenders who tend to stay on their property no matter what happens. We have then computed average values of the attributes in each category of agents and compared them with the global value on all agents. For instance we found that can-do defenders have a significantly higher self-confidence, which is in agreement with the definition of the profile.

Consistency with death causes statistics. The VBRC report also provides statistics about the circumstances of the 173 deaths drawn from police hearings and experts reports. In particular they found that 14% died while fleeing (4% in cars, 10% on foot); 69% while "passively sheltering" (as opposed to "actively defending"), possibly after having tried to defend; some died while defending, even when well prepared. In total 30% were taken by surprise by the fire. Figure 3 (left) shows the percentage of deaths from each state in our simulation. With a first manual calibration of our parameters, we obtained a distribution of behaviour relatively similar to the real population: 47% of the agents died while still passive (indecisive); 19% die while escaping; the others died while preparing to defend or defending, taken by surprise before they could evacuate. In future works we will do a sensitivity analysis to reduce the number of parameters, and do an automatic calibration of our model.

Explicative value of our model

The goal of our model is to raise decision-makers' awareness of the factors determining real population behaviour, as opposed to expected behaviour. Indeed, the statements clearly show that decision-makers expect a "rational" behaviour based on objective values, while people behaved based on their subjective (possibly wrong) values. Our hypothesis was that the discrepancy between these objective and subjective values of danger and capabilities could explain deaths, and should therefore be taken into account. If we are right, we should observe stronger discrepancy in agents who die than in agents who survive.

Figure 3 (right) shows the evolution over time of the average discrepancy between objective and subjective values of danger and capabilities, for alive agents and for dead agents. Note that once dead, agents do not update their values, so the evolution only comes from new agents dying over time.

-Danger discrepancy for dead agents (red) starts at 0 (no death yet) then jumps to a very high value as the first agents die while unaware of (yet real) danger. It then tends to decrease as the agents dying later in the simulation are those who have a lower underestimation of danger. -Danger discrepancy for alive agents (orange) is always much lower than in dead agents; it also continuously decreases for two reasons: agents with a higher discrepancy die, and those that survive update their perception of danger to tend towards the objective value. -Ability discrepancy for dead agents (blue) also starts (and stays) higher than for alive agents. It decreases quickly at the start (as agents with higher discrepancy died early), then stays mostly stable.

-Ability discrepancy in alive agents (green) keeps going down, until the last survivors tend to actually underestimate their abilities (this is due to them updating their subjective abilities based on their performance at fighting the fire, which gets worse as the fire keeps intensifying).

Discussion and conclusion

Summary. In this paper we therefore provided a realistic model of population behaviour, based on qualitative data from interviews, consistent with statistics of causes of deaths, and with a high explicative value. This model can therefore be used to predict behaviour, in order to raise awareness of decision-makers, and also to let them explore various strategies for reducing population vulnerability.

Comparison with state of the art. Some existing simulations focus on realistic fire behaviour and spreading (e.g. Phoenix [START_REF] Duff | Quantifying spatio-temporal differences between fire shapes: Estimating fire travel paths for the improvement of dynamic spread models[END_REF]), easier to understand in physical terms. On the contrary as far as we know no model provide the same degree of realism for human behaviour. Indeed, many agent-based simulations focus on crowd evacuation in building fires, with often homogeneous reactive agents (e.g. social force model [START_REF] Helbing | Social force model for pedestrian dynamics[END_REF]). More complex models have then appeared, integrating emotions [START_REF] Le | Simulation of the emotion dynamics in a group of agents in an evacuation situation[END_REF][START_REF] Nguyen | Integration of emotion in evacuation simulation[END_REF] or social relationships [START_REF] Chu | Safegress: a flexible platform to study the effect of human and social behaviors on egress performance[END_REF] of agents, but they are usually based on psychological theories, while we based our model on witness statements providing a precise description of people actual behaviour.

Existing simulations often focus on the evacuation of public buildings (e.g. airport [START_REF] Tsai | ESCAPES -Evacuation Simulation with Children, Authorities, Parents, Emotions, and Social comparison[END_REF], stadium) to inform their design and prevent problems (e.g. crowding at doors or in stairs) which are not relevant in bushfires in scarcely populated areas. Besides, most of these simulations tend to focus on evacuation itself, neglecting the pre-evacuation time which is at least as important [START_REF] Kinateder | A review of risk perception in building fire evacuation[END_REF]. On the contrary we did model this decision-making phase, which is even more important in bushfires where people are not evacuating from a public building (where their only motivation is to save their life) but have to abandon their own house to the flames (with an additional contradictory motivation to also save it).

Future work. Our model relies on simplifying hypotheses and will need to be extended in the future. In particular, the initial situation has exactly one person per house, while statements and reports show the importance of family relationships (several people in the same house making a decision together), and of tourists or visitors who (in addition to their lack of knowledge) have nowhere to go when the fire surprises them outside. Also, we need to model how different sources of information (observation of fire, information on the radio, visits from authorities, phone calls from relatives, etc) with different levels of trustworthiness are combined to evaluate risk and make a decision.

Our agent architecture is also very simple, tailored to prove our point about the discrepancy between objective and subjective values of danger and ability. In future work we plan to design a BDI (belief, desire, intention) model of behaviour, improving its descriptivity but also its explaining power, since mental attitudes are people's preferred level of abstraction to explain behaviour [START_REF] Adam | BDI agents in social simulations: a survey[END_REF]. Thanks to this high explicative value, we aim to eventually transform this simulation into a serious game which will be a valuable tool for decision-makers to test response strategies or raise the population's awareness.

Fig. 1 .

 1 Fig. 1. Residents behaviour: states and transitions. Dead and Survivor states are not shown to simplify the figure, as they can be reached from any other state. The flip function represents probabilistic transitions.

Fig. 3 .

 3 Fig. 3. (left) Causes of death in our simulation. (right) Average discrepancy between objective/subjective perception of danger and abilities in alive/dead agents.

This work has been funded by the SWIFT (AGIR) and Genstar (ANR) projects.

In future works we want each resident to have a different (partial, and possibly wrong) knowledge of the position of existing shelters, to simulate varying degrees of preparation, but this adds a lot of computational complexity to the model.