A resilience assessment framework for critical infrastructure networks' interdependencies

Critical infrastructures (CIs), including water, energy and transport networks, provide essential services to society. As infrastructures are becoming more interdependent, there is an increasing need for better management of these interactions and interdependencies (Bloomfield et al. 2009). CIs' criticality means it is vital that these systems are resilient to any type of disturbances in the sense that they have an ability to resist failures and/or quickly resume their functionality when events occur (Mattioli & Levy-Bencheton 2014). Therefore, the pursuit of infrastructure resilience requires the reduction of failure probabilities, minimisation of negative consequences when failures do occur, and reduction in recovery time. The centralised nature of urban infrastructure and the interconnectedness between services implies that damage at any point in the system can have knock-on effects through the connections in the system and other infrastructure systems (Guthrie & Konaris 2012). Additionally, the importance of protecting infrastructure from threats lies not only in its critical role of sustaining infrastructure, but also in its role of helping communities and the economy to rebuild themselves post-disruptions (Wang et al. 2010).

The continuity of operation and service in CI should be guaranteed with high design, operation and maintenance standards and a robust decision-making mechanism in place, following disturbing conditions at any scale. The UK government has published a POSTnote (The Parliamentary Office of Science & Technology 2010) and recognised short-term hazards, long-term climate change, and interdependencies as three issues surrounding the resilience of the core infrastructures. However, the common challenge currently faced by CI asset owners and managers is the lack of a robust resilience-informed business planning and management strategies in response to interdependent assets' failures due to low-probability/high-impact hazards.

To overcome the interdependency-induced challenges in CI networks and promote their resiliency, it is necessary to gain an understanding of interdependency relations in order to be able to incorporate resilience thinking into decision making. This could be facilitated through a robust interdependency modelling and analysis method. A number of approaches, from physical to functional and economic, have been proposed by different scholars in relation to CI's interdependencies modelling and analysis (Rinaldi et al. 2001; Glass et al. 2003; Casalicchio et al. 2004; Zimmerman 2004; Dudenhoeffer et al. 2006; Pye & Warren 2006; Rigole & Deconinck 2006; Schmitz et al. 2007) and (Xiao et al. 2008; Bloomfield et al. 2009; Solano 2010; Zhang & Peeta 2011). For example, the study conducted by Satumtira & Dueñas-Osorio (2010) categorised the interdependency modelling approaches according to mathematical method, modelling objective, scale of analysis, quality and quantity of input data, targeted discipline and end user type. Ouyang (2014) categorises the infrastructure interaction modelling approaches into six broad types of empirical, agent based, system dynamics based, economic theory-based, and network-based approaches.

Drawing on the above approaches, the available decision support systems (DSS) (e.g. iRoad, Neptune, etc.) rely on risk/vulnerability measures while interdependencies and their resilience in response to extreme hazards are overlooked. Several factors are involved in limiting the adoption of a resilience-informed decision making in the context of CI networks interconnectedness and interdependencies management such as high level of complexity and interconnection of the CI, growth of emerging challenges such as climate change. Hence, higher frequency of extreme weather conditions, rapid development and urbanisation, demand patterns' changes and many other reasons have been and will be challenging CI (Petit et al. 2015; Lin et al. 2017; Ani et al. 2019). This can also affect CI's service restoration rate and consequently reduce their resilience in coping with these hazardous environmental events. To reduce these impacts, an integrated resilience-informed decision support system (DSS) is required, to map interdependent network vulnerable components and introduce adaptive capacities accordingly. This is of particular importance as CI owners and managers are investing more and more every day on improving the resilience of their assets in response to extreme environmental hazards.

While many well-defined models and simulations exist for infrastructure sectors such as electrical power grid models, water networks, traffic flow, rail systems, computer networks, very few models exist that seek to tie these infrastructures together in a form representative of their actual implementation. Jeziah et al. (2016) reviewed some of the most popular simulation tools under development such as CIPDSS, HAZUS, I2Sim/DR-NEP and ESRI Sim Disaster. However, a study by Dudenhoeffer et al. (2006) showed that many of the models present a physics/engineering-based approach and are very good at individual sector analysis, but they do not necessarily support high level command and control systems. In their study 33 tools were investigated and a few (e.g. Athena, CIP/DSS, FINSIM and RAPIDware) proved to be capable of modelling and analysing multiple infrastructure networks.

A holistic view is key in integrated infrastructure modelling since infrastructure networks and their dependencies are highly non-linear and complex and cannot be predicted with traditional models (Dirks et al. 2015). The benefit of integrated modelling in response to extreme events is to provide tools for decision makers to understand the dynamics and complexity of the system and avoid ineffective responses and poor coordination for rescue, recovery, restoration and, mitigation. This study has approached CI nexus from resilience-informed CI's interdependency management point of view. It thrived to fill the gap of resilience-informed decision making, in the context of interdependent CI networks, by adopting a diagnostic approach. Drawing on this, a resilience-assessment framework was developed to model infrastructure elements and the relation between individual components through network modelling approaches. In the proposed framework, the actions and interactions of each individual infrastructure element (nodes and links) is modelled with a view to assess their effects on the system as a whole. In this project, the nature of the connection is reflected in the flow from source asset (interdependency provider) to sink asset (interdependency receiver). More detail on the nature of interdependencies has been provided in the methodology section.

The proposed integrated framework in this study comprises the following three folds: network modelling using Network Theory, failure propagation mapping and resilience assessment using system functionality over time.

In this study, Network Theory has been used to generate and characterize the topology of the hypothetical benchmark network, comprising three key infrastructures of water, energy and transport, utilized for resilience evaluation of the interconnected infrastructure network. Glass et al. (2003) define networks as flexible abstractions that can be used to study the interaction behaviour of independent infrastructure systems. The abstraction manifests a series of nodes (e.g. power plans, transformers), links (e.g. distribution lines, information exchange, roads) and flows (e.g. energy, information or people) in a given infrastructure system. For the benchmark case study, a network of a total of 21 nodes, 20 links and five interdependent links is produced to illustrate the resilience-informed decision support system framework. These nodes and links represent different critical assets and their corresponding connections in each network; for example, generators, transmission lines, switches and breakers in an energy network; reservoirs, water mains, pumping stations in a water network and bridges, junctions, roads, rail lines in a transport network. The links between assets also represent the physical or any functional connection between two assets. In the case of interdependency links, these are connections between two different systems.

Among these attributes, ⁠, and are a function of time. is formed by the definition of ⁠, ⁠, as demonstrated in Figure 1. The failure propagation function itself,⁠, is dependent on the nature of the infrastructure asset and the imposed failure on the asset. Depending on failure nature, can vary from abrupt change in performance indicator (opt. 1 and 5 in Figure 1) to a linear (opt. 3) or highly nonlinear behaviour as demonstrated in opt. 2 and 4 in asset attribute definition. Similar behaviour can be expected in the recovery process (i.e. ⁠). In practice, these functions can be defined based on historical data on failures and recovery mechanism or design failure mechanism for each asset.

Similar attributes to nodes are defined for each link representing dependency and interdependency connection, and ⁠, respectively. Replacing the coordinates attribute, the sink-source vector is recorded as and for dependency and interdependency links, respectively. Similar to nodes, the state condition of the (inter)dependency links, ⁠, varies from 0 to 1, whereby 1 implies there is a full service flow from a source node, to a sink node, at time t.

Figure 2 demonstrates the network configuration with the specified dependency and interdependency connections.

As the functionality of each system and the continuity of the functionality are of utmost importance for asset owners and managers, in this study, failure in a system is defined as any event resulting in loss of functionality. The functionality of each system can vary depending on the decision-making criteria but ultimately, for utility services, this is tied to continuity of service provision to end-users.

Each component in a system can either be responsible for providing service directly to users or indirectly supporting component(s) that provide service directly, defined as ⁠. Hence, the functionality of the entire system in status-quo is defined as aggregation of the number of users receiving service from the system, ⁠. The failure scenarios are then defined as percentage of loss of functionality for each failed component.

To generalise the analysis, the failure scenarios are defined regardless of the origin, type and severity of the initiating hazardous event (e.g. extreme rainfall, earthquake, etc.), so called ‘failure state’. Failure state represents the condition (operational condition and/or physical condition) of a network, causing a negative impact on network performance (partially or fully), regardless of the initiating source. The impact of these failure scenarios is reflected in the number of users remaining in service, ⁠. Figure 3(a) illustrates an example of a single failure scenario, where asset 3 in energy network has lost 100% functionality (i.e. ⁠) at time ⁠, resulting in 5% immediate loss of users in this asset.

In case of failure of a source node at ⁠, the magnitude of functionality on link reduces to by time ⁠. This is then reflected in sink node performance indicator reaching at time ⁠. In a similar pattern, the failure will continue to propagate to the downstream source-sink pair to reach sink-only nodes (nodes with no service providing role). In the previous example and assuming that the failure in all assets propagates with a rate of 3 h per link (⁠⁠, this scenario will result in failure of assets 4 and 6 in energy network and assets 8 and 9 in the notational transport network at time ⁠. The impact on total number of users (system functionality) is demonstrated in Figure 3(b).

In recent years, resilience of infrastructure has received significant attention and interest among different regulatory bodies, practitioners and researchers in four domains of organisational, social, economic and engineering, the latter being the focus of this study. Literature on definition of resilience indicates that there is not a consensus in the definition and even in engineering context, it varies for different systems' specifications and stakeholders' priorities and values. With resilience being a multi-disciplinary, cross-sectorial and complex context, it is crucial to establish a common understanding of the definition amongst all stakeholders (Ceré et al. 2017).

Considering that the performance of an engineering system is linked to its functionality, it is inevitable that the resilience of an engineering system gets defined as a function of performance indicator over time. In recent years there have been several studies exploring different resilience metrics as a function of system performance (Berkeley III & Wallace 2010; Wang et al. 2010; Hoque et al. 2012; Pant et al. 2014; Barker et al. 2015). To capture key inherent system properties such as robustness, recoverability, rapidity and resourcefulness in response to a failure event, a two-dimensional metric has been utilised in this study to quantify resilience.

Figure 4(a) demonstrates the performance function for all three networks in response to failure of asset 3 in energy network and its subsequent recovery, assuming abrupt recovery with 4 h duration and 1 h recovery initiation (i.e. ⁠), ⁠. Figure 4(b) demonstrates the impact of 1 h difference in recovery duration for the same failure scenario. This can be translated to change in recovery strategy either from resources point of view or rapidity of the resources available to a system. To better compare different recovery strategies, a concept entitled ‘level of resilience’ is introduced herein that demonstrates the resilience level in a network pre and post interventions. These values can be interpreted as acceptable risk zones in resilience context. The thresholds for each zone of resilience can vary depending on expert judgment on what is acceptable or tolerable for each system. The unit for these thresholds is ‘number of user in service × time’. Hence, three resilience zones of low resilience zone (in red), medium resilience zone (in amber) and high resilience zone (in green) are created (Figure 4(c)). The improvement in recovery strategies can include increase in redundancy, robustness or resourcefulness in different parts of the interdependent network. It can be seen from this figure that for an hour change in recovery duration, the resilience of energy network changes from 1,750 (no. users × time) to 1,800. Assuming unit cost of £100,000/(no. users × time), this change represents £500,000 saving in resilience. This value then can represent the benefit in recovery measure against the cost of the recovery.

It is crucial for infrastructure asset owners to have a better understanding of the dynamics of their networks' ‘interdependency zones’, their resilience levels and the impacts of the resilience changes across the integrated network. This will enable them to track the failure propagation at times of failure to make resilience-informed decisions for shared interventions. To demonstrate the importance of interdependency interactions, Figure 5 illustrates the impact of each single failure scenario on the entire network for all three notional networks. For this purpose, the impact of all single failure scenarios is simulated and reported as aggregated loss in number of users per network, shown by thickness of strands in the Figure 5. As can be expected each asset has an impact on the owner network which is typically monitored during the design and maintenance of a network; however, the impact of interdependency-induced failures, shown here by different shades of grey colour for each network, are hidden to each network. Depending on level of interdependencies, this implies that a network may be vulnerable and sensitive to failure scenarios that not only have not been monitored during the design process but also are not under radar for maintenance purposes. As can be seen from Figure 5, given the dependency of the notional transport network on energy and water, failure in either one of these networks can result in equally significant loss of functionality in the network and if not considered in maintenance strategies could result in considerable costs and customer dissatisfaction.

To link the interdependency behaviour to graph theory driven properties, Figure 6 demonstrates the ranking of each nodal asset according to four importance metrics: (i) degree: measuring number of incoming edges to each node; (ii) betweenness: measuring the frequency of each node appearing on a shortest path between two nodes in the graph; (iii) out-closeness: measuring the inverse sum of the distance from a node to all other nodes; and (iv) in-closeness: measuring the inverse sum of the distance from all other nodes to a node. The intensity of colour (shade of grey) for each node demonstrates the ranking of the node in the entire multi-layered network. The first rank is shown by white colour.

As can be seen in Figure 6, betweenness is the closest metric to the findings of Figure 5; however, these metrics are rather limiting in terms of information they provide for decision making purposes. Furthermore, these properties can be calculated assuming that the information for all connected networks is accessible, which generally is not the case in practice.

Extending the failure scenarios considered to multi failure scenarios, Figure 7 demonstrates the resilience value versus maximum failure for all single-, double- and triple-concurrent failure scenarios. Each grey dot in Figure 7 represents a failure scenario and its impact on the loss of number of users for each notional network and resilience metric (considering a constant recovery duration and initiation for all scenarios). The area of the plot is divided into four zones for emphasis on criticality of failure scenarios. For example, a zone with high loss of functionality and low resilience is shown in a dark shade of grey and, in contrast, a zone with high resilience and low loss of functionality is shown in white.

As each notional network has some level of interdependencies, the trend in scattered scenarios is not entirely linear and as this level of interdependency increases (notional transport network in this example), so does the nonlinearity behaviour. This behaviour becomes more pronounced as the scenarios change from single to triple-concurrent failure scenarios.

This study presents the feasibility study of the resilience-informed decision support system framework by creating and testing a framework and its application to a numerical case study. This framework could be expanded and upgraded to other critical infrastructure networks (e.g. ICT) for more comprehensive analysis of interconnected systems.

The results show that as the level of interdependency increases, the nonlinearity behaviour increases. This behaviour becomes more pronounced as the scenarios change from single to triple-concurrent (or n-concurrent) failure scenarios. Failure to integrate modelling and overlooking these non-linearaties can lead to underestimated failure impacts and consequently, inappropriate or insufficient interventions and eventually investments.

As can be expected, each asset has an impact on the owner network which is generally monitored during the design and maintenance of a network; however, the impacts of interdependency-induced failures, depending on level of interdependencies, imply that a network may be vulnerable and sensitive to failure scenarios that have not been monitored during the design process, and they are likely to be not considered for maintenance purposes. This highlights the importance of shared intervention schemes in interdependent infrastructures.

As demonstrated using the notional example, resilience-informed decision making can complement the conventional risk-informed decision making for infrastructure management, particularly in dealing with low-probability high-impact events. Additionally, enhanced critical infrastructure interdependencies management requires collaboration and shared intervention amongst all the role players leading to effective transformation of the investment strategies in critical infrastructure sectors. Therefore, it is crucial for infrastructure asset owners to have a better understanding of the dynamics of their networks' ‘interdependency zones’, their resilience levels and the impacts of the resilience changes across the integrated network. This will enable them to track the failure propagation at times of failure to make resilience-informed decisions for shared interventions.

This work is conducted as part of the project funded by Natural Environment Research Council under NE/R008973/1 grant number. The authors also would like to acknowledge project industry collaborates, Transport Scotland, Scottish Water, Scottish and Southern Energy and Atkins for their kind and constant support, constructive advice and full engagement throughout the project. The authors also would like to thank project research assistant Mr Vasos Christodoulides in assisting in development of the web-based tool and Dr Lakshmi Rajendran and Dr Carlos Jimenez Bescos for their advice during the initial stages of the project.