Resilience assessment for interdependent urban infrastructure systems using dynamic network flow models

Transcription

1 Resilience assessmen for inerdependen urban infrasrucure sysems using dynamic nework flow models Nils Goldbeck* Cenre for Transpor Sudies, Deparmen of Civil and Environmenal Engineering, Imperial College London, Skempon Building, London SW AZ, Unied Kingdom, 0 Panagiois Angeloudis Cenre for Transpor Sudies, Deparmen of Civil and Environmenal Engineering, Imperial College London, Skempon Building, London SW AZ, Unied Kingdom, Washingon Y Ochieng Cenre for Transpor Sudies, Deparmen of Civil and Environmenal Engineering, Imperial College London, Skempon Building, London SW AZ, Unied Kingdom, w.ochieng@imperial.ac.uk *Corresponding auhor 0 0 Absrac: Criical infrasrucure sysems in ciies are becoming increasingly inerdependen, herefore exacerbaing he impacs of disrupive evens hrough cascading failures, hindered asse repairs and nework congesion. Curren resilience assessmen mehods fall shor of fully capuring such inerdependency effecs as hey end o model asse reliabiliy and nework flows separaely and ofen rely on saic flow assignmen mehods. In his paper, we develop an inegraed, dynamic modelling and simulaion framework ha combines nework and asse represenaions of infrasrucure sysems and models he opimal response o disrupions using a rolling planning horizon. The framework considers dependencies peraining o failure propagaion, sysem-of-sysems archiecure and resources required for operaing and repairing asses. Sochasic asse failure is capured by a scenario ree generaion algorihm whereas he redisribuion of nework flows and he opimal deploymen of repair resources are modelled using a minimum cos flow approach. A case sudy on London s mero and elecric power neworks shows how he proposed mehodology can be used o assess he resilience of ciy-scale infrasrucure sysems o a local flooding inciden and esimae he value of he resilience loss riangle for differen levels of hazard exposure and repair capabiliies. Keywords: Resilience assessmen, inerdependen infrasrucure sysems, infrasrucure asses, repairable sysems modelling, dynamic nework flow modelling

2 INTRODUCTION Various disasers in recen years have brough o ligh criical infrasrucure vulnerabiliies linked o ineracions beween differen sysems. For example, he disrupions caused by supersorm Sandy in New York Ciy in 0 were aggravaed by various incidens of cascading failure []. Exensive power ouages made i more difficul o remove flood waer from mero unnels []. The liquid fuel supply chain broke down due o direc flood damage o erminals, refineries and pipelines, combined wih power ouages and raffic resricions on he waerways []. The fuel shorage, in urn, affeced emergency response services and effors o resore power supply. Similar ineracions have been documened for oher disasers, including he ice sorm in Canada [], 00 winer sorms in China [], 00 earhquake in Chile [], and 00/0 earhquakes in New Zealand []. The inerplay of differen infrasrucure sysems can equally exacerbae impacs of much smaller rigger evens. In 0, a fire sared in an underground elecrical subsaion in London and damaged a naural gas pipeline, which in urn fuelled he fire for hours []. Despie being a relaively local inciden, i resuled in high coss for businesses due o disrupions in power, communicaion and ranspor sysems. These examples demonsrae ha he sae of a criical infrasrucure sysem can be affeced by disrupions in oher sysems hrough differen ypes of dependency relaions. Sysems ha are muually dependen on each oher are referred o as inerdependen infrasrucure sysems or a sysem-of-sysems. Rinaldi e al. [] were among he firs o highligh he rend of increasing infrasrucure inerdependency and expressed concern ha assessing he performance of each sysem separaely could be misleading because imporan inerdependency effecs are no aken ino accoun. The issue has since gained he aenion of many researchers, governmen auhoriies and indusry praciioners, especially in conjuncion wih he emerging concep of infrasrucure resilience. Tradiional risk managemen sraegies provide plans o avoid, conrol, ransfer or assume risks based on assessing heir probabiliy and impac. The applicabiliy of such mehods is limied when here is high uncerainy regarding he risk marix and effeciveness of conrol or avoidance measures. This is increasingly he case for urban infrasrucure sysems, and he concep of infrasrucure resilience exends risk managemen effors accordingly. Infrasrucure resilience describes he abiliy of sysems o resis, recover and adap in order o mainain heir core funcion afer a perurbaion (for a comprehensive review of definiions see [0]). As such, resilience approaches seek o undersand he dynamic behaviour of sysems on differen imescales and opimise boh preparedness and recovery capabiliies. As his dynamic behaviour is increasingly deermined by inerdependencies, new mehods are needed o model urban infrasrucure as a sysem-of-sysems and carry ou comprehensive resilience assessmens. Qualiaive sudies in his field have provided definiions and ypologies of infrasrucure dependencies (e.g. [], [], []). Several quaniaive mehods have been developed or adaped o

3 0 analyse he resilience of inerdependen infrasrucure sysems, including faul ree analysis [], sysem dynamics [], agen-based simulaion [], inpu-oupu modelling [], and nework modelling [] []. Comprehensive reviews of such mehods are provided by Ouyang [] and Iurriza e al. []. Regarding prioriies for fuure research, Ouyang [] and Zio [] highligh he imporance of model inegraion and co-simulaion. Modelling approaches using nework science broadly fall ino wo caegories: opological models and flow models. Topological models (e.g. [], [], [], []) show ha inerdependencies are a source of addiional vulnerabiliies and can aid nework collapse. However, opological models only analyse nework srucure and fail o capure fundamenal aspecs of infrasrucure neworks beyond conneciviy, for example, parial capaciy loss, rouing and congesion. Previous sudies have shown ha more realisic vulnerabiliy and resilience assessmens can be achieved wih nework flow models, which seek o predic he flow of passengers, goods, power or informaion, aking ino accoun he capaciy of differen nework componens and oher operaional nework characerisics [] []. The nework flow models proposed by Lee II e al. [], Holden e al. [0], Jin e al. [] and Foouhi e al. [] are paricularly relevan o his paper, given heir abiliy o capure inerdependen neworks. Key feaures of hese models are presened in Table. Table Key feaures of nework flow models for inerdependen urban infrasrucure sysems Lee II e al. [] Holden e al. [0] Jin e al. [] Foouhi e al. [] 0 Case sudy area New York Ciy n.a. Singapore Minneapolis Neworks considered Mero Elecric power Telephone Waer Elecric power Mero Bus Road Elecric power Single-commodiy neworks ( ) Muli-commodiy neworks Nework size nodes nodes nodes nodes Resilience measure Toal cos (incl. penaly for unme demand) Saisfied demand Saisfied demand Toal ravel ime Min. cos flow assignmen Dynamic flows Coupling of flows Parial capaciy loss coninuous discree Miigaion Repair Temporary power and elephone connecions Replacemen bus services Backup power supply, raffic regulaion by police officers Ineger variables Nonlinear consrains Sochasic opimisaion A common feaure found across mos sae-of-he-ar nework flow models is heir use of minimum cos flow mehods o assign flows o capaciaed neworks, wih differences in he represenaion of flow relaionships beween differen neworks. For insance, Holden e al. [0] use a linear producion

4 0 0 0 funcion ha defines he quaniies of inpu resources required for he producion of anoher good. Foouhi e al. [] add delays o road links if raffic signals fail, depending on wheher he juncions are subsequenly unregulaed or regulaed manually by police officers. While such modelling echniques achieve ailor-made soluions o capure specific aspecs of infrasrucure sysems, a more generic approach is needed ha can represen he many differen ineracions beween nework flows and physical infrasrucure asses. In exising nework flow models, infrasrucure asses, such as mero saions, railway racks or elecriciy subsaions, are ofen modelled as simple nodes or links whose operaional characerisics are condensed ino one-dimensional operabiliy variables. Moreover, hese operabiliy variables are usually exogenous or subjec o a simple sochasic process (random failure). In realiy, such infrasrucure asses are complex sysems hemselves, consising of sub-sysems and componens. The realism of nework flow models could be improved by modelling he muli-level archiecure of infrasrucure asses, for example using he reliabiliy engineering concep of series and parallel sysems. Wih recovery ime being a core resilience dimension, resilience assessmen mehods are required o model he dynamic behaviour of inerdependen infrasrucure sysems. The wo-sage sochasic programming mehods proposed in Jin e al. [] and Foouhi e al. [] consider decisions aken a wo poins in ime (before and afer he disrupion), bu he acual flow assignmen is saic. In Holden e al. [0], he saic flow assignmen is repeaed over a series of ime seps. However, none of he reviewed models feaures a dynamic flow assignmen where flows can span over muliple ime seps. Moreover, here exiss currenly no models ha capure he dynamic inerplay of nework flows and asse operabiliy during he recovery period. The opimisaion problems in he reviewed models are eiher inherenly linear or linearly approximaed. However, hey ofen include binary variables and, herefore, belong o he class of NPhard compuaional problems. We noe ha mos case sudies presened in he lieraure involve nework insances feauring fewer han 00 nodes, wih he excepion of he New York Ciy example in Lee II e al. []. Ciy-scale infrasrucure neworks are a leas one order of magniude larger. While in some cases i may be pracical o assess or opimise resilience considering only a smaller local area, here is also a need for models ha are scalable o full-size urban infrasrucure neworks. Summarising, his paper seeks o address hree gaps in he lieraure: i) lack of mehods o represen infrasrucure asses in nework flow models more realisically and capure he relaionship beween nework flows and asse operabiliy, ii) insufficien modelling of dynamic effecs during he recovery period, and iii) limied scalabiliy. The remainder of he paper is srucured as follows. Secion presens resilience measures. Secion inroduces he modelling framework, including four ypes of dependency relaions. Secion presens he inegraed asse operabiliy and nework flow model. The applicaion of he mehod is demonsraed in a case sudy on London in Secion.

5 Table Nomenclaure Ses Parameers Variables A Infrasrucure asses max Number of simulaion imeseps Z k,m Random variable for failure propagaion A S Series sysems asses ph Lengh of he planning horizon z k Asse failure variable for k A P Parallel sysems asses n scn Max. number scenarios x k Operabiliy of asse k H Hazard evens n spl V SC V MC E SC E MC Nodes in singlecommodiy sysems Nodes in muli-commodiy sysems Links in single-commodiy sysems Links in muli-commodiy sysems k u i f o,d v i SC MC OD OD pairs v o,d Number of samples per scenario ree node Number of shores pahs per OD pair Commodiy demand a node i y k f i,j f p Uilisaion of asse k Flow on link (i, j) Flow on pah p Travel demand from o o d g i Commodiy generaion a node i Value of commodiy demand a node i Value of ravel demand from o o d u i VoD Commodiy delivery a node i Value of demand P o,d Shores pahs from o o d f i,j Capaciy of link (i, j) VoS Value of supply Q i,j Pahs using link (i, j) g i Capaciy of node i RLT D F Failure propagaion dependencies f c i,j Cos of flow on link (i, j) D L Logic dependencies c i g Cos of commodiy generaion a node i D U D I Asse uilisaion dependencies Resource inpu dependencies p k,m k,m U α i,k R α i,k Probabiliy of failure propagaion from k o m Time lag of failure propagaion from k o m Resources provided by i for he uilisaion of k Resources provided by i for he repair of k MSP TLD Area of he resilience loss riangle Minimum sysem performance Toal lengh of disrupion

6 RESILIENCE MEASURES Lieraure reviews by Hosseini e al. [0] and Sun e al. [] highligh he exisence of several compeing measures of infrasrucure resilience. One of he mos commonly used approaches is he loss riangle mehod, which quanifies resilience based on he loss of sysem performance inegraed over he ime i akes for he sysem o recover afer a disrupion []. Performance measures used in his conex include hose ha are based on asse operabiliy (e.g. [], [], [], []), nework conneciviy (e.g. [], [] []), nework capaciy (e.g. [0], []), saisfied demand (e.g. [], [], [], [], [], [] []), and he value of services provided (e.g. [], [] [0]). In his paper, we use a performance measure based on he value of service provision because i has he following advanages: Firs, a value-based performance measure is mos relevan from a socieal perspecive, as i capures he quaniy and qualiy of services provided by infrasrucure sysems o mee a cerain demand. Second, i can usually be expressed in moneary values, which faciliaes he aggregaion of performance measures for differen infrasrucure sysems and services. Third, posiive and negaive exernaliies can be inegraed in he performance measure by convering hem o moneary values. The difficuly of using a value-based performance measure is ha more sophisicaed predicion models and daa inpus are required for is evaluaion compared o oher performance measures. We propose a generic performance measure ha can be applied o all ypes of infrasrucure sysems. Services provided by hese sysems are of wo ypes: i) he supply of a homogeneous good or service o a se of demand nodes, or ii) he ransporaion of inhomogeneous goods, passengers or informaion beween origin-desinaion (OD) pairs. Disinguishing hese wo ypes of infrasrucure services is imporan because hey require differen flow assignmen mehods, referred o as single- and muli- commodiy nework assignmen. An overview of he noaion used hroughou his paper is provided in Table. The demand for infrasrucure services is assumed o be given by parameers u i for goods or services required a nodes i V SC in single-commodiy neworks and f o,d for ransporaion services beween wo nodes (o, d) OD in muli-commodiy neworks. In he firs insance, our model does no capure demand elasiciy, bu he framework could be exended in his respec in he fuure. We assume ha he moneary value of fulfilling one uni of he demand for infrasrucure services wih a sandard qualiy of service level can be esimaed by parameers v SC i and v MC o,d. The oal value of demand (VoD) a ime sep can hen be calculaed as follows: VoD = v SC i u i + v o,d i V SC (o,d) OD MC f o,d ()

7 When a disrupion occurs, i is possible ha some of he demand remains unsaisfied. Addiionally, here could be a deerioraion of service qualiy. The value of supply (VoS) is calculaed as follows: VoS = α i v i SC u i i V SC (o,d) OD + v o,d MC f c p p p P o,d c o,d () For a single-commodiy node i V SC, he value of supply is he quaniy supplied u i, muliplied by he value of delivering his commodiy v i SC, and a discoun facor α i [0,] indicaing he qualiy of service. Similarly, for an origin desinaion pair (o, d) OD, he discoun facor applied o pah flows f p is c o,d c p, where c o,d and c p are he generalised coss of ranspor beween o and d over he shores pah and over he chosen pah p respecively. Wih he overall sysem performance measure VoS VoD, we can now calculae he main resilience measure, he area of he resilience loss riangle (RLT), by inegraing over all simulaion ime seps: 0 max RLT = ( VoS ) VoD =0 Two addiional measures are used o capure aspecs which oher sudies describe as he robusness and rapidiy dimensions of resilience []. Robusness can be seen as he minimum sysem performance: () MSP = min ( VoS ) =0,, max VoD () The rapidiy of recovery is measured by he oal lengh of he disrupions, i.e. he number of ime seps where he sysem performance is less han one: max TLD = {x<} ( VoS ) VoD =0 Noe ha he resilience measures formulaed above do no include he coss of infrasrucure service provision, which are likely o increase afer a disrupive even due o recovery and repair coss. Furhermore, exernaliies may occur, such as environmenal impacs. The nework flow modelling mehod can capure hese coss by adding hem eiher o he objecive funcion (e.g. moneised environmenal impacs) or as consrains (e.g. repair budges). ()

8 . METHODOLOGICAL FRAMEWORK In his secion, we presen a modelling and simulaion framework ha can be used o assess he resilience of a sysem of inerdependen infrasrucure sysems. Figure presens he high-level archiecure and he remainder of his secion describes how he model represens infrasrucure sysems and dependency relaions. Origin desinaion pairs Single- and muli-commodiy demand Nodes & links Shores pah esimaion Dynamic nework flow model for = 0 max : for each scenario ree node: Opimise repair resource deploymen Expeced sysemof-sysems performance 00 % RLT MSP Asses & hazards Asse failure scenario generaion asse repair raes commodiy producion link and pah flows over he curren planning horizon 0 % TLD h r max Time Sochasic failure propagaion dependencies Asse uilisaion dependencies Logic dependencies Inpu requiremen dependencies Figure Overview of he modelling framework Infrasrucure sysems We represen infrasrucure sysems as neworks (consising of nodes and direced links) ha are iner-conneced wih physical or non-physical asses. The nework represenaion models he services provided by infrasrucure sysems. The asse represenaion models sysem componens required for providing hese services and heir exposure o hazards. Separaing he nework and asse represenaion enables us o exend he scope of he model wih respec o nework and asse effecs independenly of each oher. Consider he example of a mero saion. In he simples case, i can be represened using one node and one asse. Nework characerisics (i.e. he saion s usage by passengers) could be modelled wih greaer deail by represening enrances, exis and plaforms as separae nodes. Asse characerisics (i.e. he failure and repair of differen componens) could be modelled wih greaer deail by represening escalaors, venilaion and lighing as separae sub-asses. There is no limi o increasing he level of deail by adding addiional componens o he asse and nework mapping. Asses can represen specific pieces of equipmen (e.g. elecriciy ransformers), buildings (e.g. mero saions or unnels) or enire sub-sysems (e.g. rain conrol sysems). Their operabiliy is described by coninuous variables x k [0,]. The occurrence of a hazard even or he propagaion of

9 0 0 failure among inerdependen asses can cause asses o fail, which would be represened by assigning he operabiliy variables of affeced componens o x k = 0. To regain heir operabiliy, asses require repair. The nework and asse represenaions of infrasrucure sysems are inerdependen in he sense ha nework flows may require he uilisaion of asses and he uilisaion and repair of asses may require resources provided by neworks. All iner- and inra-sysem dependencies are represened by direced dependency relaions beween nodes, links and asses... Dependency relaions Several ypes of dependency relaions have been idenified in he lieraure. For example, Rinaldi e al. [] define physical, cyber, geographic and logic dependencies. Zimmerman [] disinguishes beween funcional and spaial dependencies. Dudenhoeffer e al. [] describe physical, informaional, geospaial, procedural and socieal dependencies. A common characerisic of hese ypologies is heir focus on he underlying cause of a dependency. This approach is useful for idenifying and mapping dependencies. As far as modelling dependencies is concerned, we deem heir effecs as more imporan han heir cause. Dependencies can have similar effecs despie having differen causes, or vice versa. Consider, for example, he physical and cyber dependencies proposed by Rinaldi e al. [], describing dependencies on maerial inpus from or informaion ransmied hrough anoher nework. From a nework flow modelling perspecive, here is no fundamenal difference beween hem, because in boh cases a disrupion of flows in he nework supplying a service would disrup flows in he dependen nework. In his paper, we propose a new, effec-based classificaion of dependency relaions ino four ypes: i) sochasic failure propagaion, ii) logic, iii) asse uilisaion, and iv) resource inpu dependencies. Figure presens a simple example of wo inerdependen sysems, which we will use in he following sub-secions o inroduce how hese dependencies are modelled. Nework layer N N N N Node Link Asse Dependency Sysem Asse layer Asse layer A A A A A A H Hazard Dependency ype: Asse uilisaion dependencies Logic dependencies Possible cause: Sysem archiecure, nework opology Series or parallel sysem configuraion Sysem Nework layer N N N Resource inpu dependencies Failure propagaion dependencies Physical inpus, cyber dependencies Spaial proximiy, chain of cause and effec Figure Sysem represenaion and dependency ypes

10 Sochasic failure propagaion dependencies Failure propagaion dependencies relae o geographic, spaial or co-locaion dependencies in cause- based ypologies. They essenially describe a correlaion beween he failure probabiliies of wo asses, which could be he resul of direc causaion (e.g. he failure of a bridge damages railway racks underneah i) or a shared hazard exposure (e.g. cables in a shared uiliy rench). Our modelling framework capuers failure propagaion by considering an asse s failure probabiliy a condiional probabiliy depending on he occurance of hazard evens and failure of oher asses. The example in Figure conains five failure propagaion dependencies, ulimaely linked o a hazard H ha affecs asses A and A. Due o spaial proximiy, he failure of eiher one of hese asses increases he probabiliy ha he oher fails, which is represened by wo direced failure propagaion dependencies beween hem. If A fails, he failure can furher propagae o A. Failure propagaion dependencies are conained in he se D F and specify he probabiliy and ime lag wih which failures can propagae. For simpliciy, we assume ha here is no uncerainy regarding he ime lag. Thus, each dependency relaion (k, m) D F is described by wo parameers: he probabiliy of failure propagaion p k,m and ime lag k,m. For every failure propagaion dependency and every ime sep of he simulaion period, he model conains a binary random variable Z k,m ha indicaes wheher he dependency is acive (Z k,m = ) or no (Z k,m = 0). These random variables are independen and Bernoulli disribued wih Pr(Z k,m = ) = p k,m. If k is a hazard ha is acive a ime or an asse ha fails a ime he failure spreads o he asses conained in he se {m: (k, m) D F and Z k,m = }. Noe ha he model considers only one ype of failure per asse. In cases where i is required o capure differen failure modes, an asse is decomposed ino sub-asses according o a faul ree analysis. Each sub-asse has is own failure mode and hey are conneced hrough logic dependencies.... Logic dependencies We disinguish series sysem asses (conained in he sub-se A S ) and parallel sysem asses (conained in he sub-se A P ). For example, asse A in Figure could represen a mero line modelled as a series sysem asse ha requires he rain conrol sysem (A) and he railway rack (A) o be operaional. The model could be exended by assuming ha he rain conrol sysem is a parallel sysem asse depending on wo redundan conrol cenres which would be added as sub-asses of A. 0

11 The hierarchy of asses and sub-asses is capured by logic dependency relaions conained in he se D L. In conras o failure propagaion dependencies, we consider logic dependencies o be deerminisic and have immediae effecs. The operabiliy of series sysem asses is consrained by he minimum operabiliy of all asses ha hey depend on via a logic dependency relaion: x k x m k A S, (m, k) D L, = 0,, max () The operabiliy of parallel sysem asses is consrained by he following equaion: 0 x k x m k A P, = 0,, max () (m,k) D L This implies he assumpion ha he maximum operabiliy of parallel sysem asses is a linear combinaion of he sub-sysems operabiliies.... Asse uilisaion dependencies Asse uilisaion dependencies are conained in he se D U and connec he asse o he nework represenaion in our modelling framework. Our oy model in Figure conains seven asse uilisaion dependencies, for example asse A is used by he wo links (N, N) and (N, N), and asse A is used by he supply node N. We inroduce asse uilisaion variables y k [0,] ha are defined as he maximum capaciy uilisaion of all nodes and links depending on an asse. In he model, his is capured by inequaliy consrains f i,j f i,j y k k A, (k, (i, j)) D U, = 0,, max () g i g i y k k A, (k, i) D U, = 0,, max () 0 where f i,j and g i denoe he curren link flow and commodiy generaion a a dependen link or node respecively, and f i,j and g i denoe he flow and generaion capaciies. Asse uilisaion dependencies have wo effecs. Firsly, if an asse fails and becomes inoperable he generaion or ransmission capaciies of dependen nodes and links are reduced accordingly unil he asse is repaired. This can be modelled by consraining he asse uilisaion variable o be less han or equal o he asse operabiliy variable: y k x k k A, = 0,, max (0) The second effec of asse uilisaion dependencies occurs in conjuncion wih resource inpu dependencies.

12 ... Resource inpu dependencies Resource inpu dependencies conained in he se D I also form a link beween he wo layers of he modelling framework, bu in he opposie direcion as asse uilisaion dependencies. In he example in Figure, Sysem provides a resource o Sysem, modelled by resource inpu dependencies (N, A) and (N, A). The quaniy of a resource inpu from node i o asse k is assumed o be proporional o he asse uilisaion y k wih parameer α U i,k and o he asse repair rae (x + k x k ) wih parameer α R i,k. The oal amoun of resources supplied by i in ime sep o all asses ha depend on i can be calculaed as follows: 0 k A:(i,k) D I (α U i,k y k + α R i,k (x + k x k )) In he case of supply shorages, resource inpu dependencies have he effec ha he uilisaion of an asse has o be reduced and / or is repair deferred unil sufficien resources are available. ()

13 0. INTEGRATED ASSET OPERABILITY AND NETWORK FLOW MODEL This secion presens an inegraed asse operabiliy and nework flow model ha implemens he modelling principles described above. Key elemens of he mehodology are a sochasic asse failure model, a scenario ree generaion algorihm and a minimum cos flow assignmen model... Time-expanded asse-hazard graph A hazard h H in our model is assumed o occur a a specific ime h. The uncerainy in he model sems from he sochasic failure propagaion dependencies (k, m) D F, which can be acive (Z k,m = ) or inacive (Z k,m = 0). Given a sample of acive failure propagaion dependencies, we can creae he ime-expanded asse-hazard graph G AH, whose node se is A H expanded over ime seps 0,, max. The link se conains he acive failure propagaion dependencies. Figure depics an asse-hazard graph for he example inroduced in Figure. The graph visualises ha in his specific sample he direc impac of he hazard even a h = is he failure of asse A a =. The second order impacs are he failures of A in he same ime sep and A a =. = 0 = = = = Asse Asse Asse Hazard Inacive failure propagaion dependency Acive failure propagaion dependency Hazard even Asse failure Figure Time-expanded asse-hazard graph for he example in Figure Le he variables z k indicae wheher an asse k A fails (z k = ) or no (z k = 0) a ime. Given a sample of failure propagaion variables {Z k,m, : (k, m) D F } we can derive he asse failure variables {z k : k A} by consrucing he asse-hazard graph and esing which nodes can be reached from an acive hazard: z k = { if (k, ) can be reached from any (h, h ), h H 0 oherwise k A, = 0,, max () 0 Asse failures ha are separaed by only one failure propagaion dependency from he hazard node are failures ha occur as a direc impac of he hazard. Failures ha are separaed by more han one dependency can be considered as higher-order cascading failure effecs.

14 0 0.. Scenario ree generaion A simple way of inegraing he sochasic asse failure model and flow assignmen would be o creae a number of asse failure samples and hen carry ou he nework flow assignmen for each scenario independenly. Using such an approach, he flow assignmen would have o be compued for n scn max ime seps, where n scn denoes he number of scenarios. This would be compuaionally inefficien because he flow assignmen compuaions would be redundan for he period before he firs hazard even, in which all asse failure scenarios are idenical. A more efficien model inegraion approach is o generae a scenario ree, aking advanage of he fac ha asse failure scenarios gradually diverge over ime due o he uncerainy of failure propagaion. Assuming ha he firs hazard occurs a h and he scenario ree immediaely diverges from one o n scn branches, he number of ime seps for which he flow assignmen has o be solved reduces o h + n scn ( max h ). In he average case, where divergence is slower, he number of necessary flow assignmen compuaions is even lower. The mehod used o generae a scenario ree is presened in Algorihm, which uses wo parameers o conrol branching. Firsly, n spl is he number of samples generaed for each scenario ree node o populae he se of possible child nodes S children. A higher value of n spl would increase he rae of ree branching and capure a wider range of possible failure propagaion. Moreover, i would increase he accuracy of he probabiliy disribuion over S children, which is calculaed as he number of imes each sample value is observed divided by n spl. Tree branching is resriced by he second parameer n scn in order o ensure ha a maximum number of final scenarios is no exceeded and ha he branching is disribued equally among all exising branches. The maximum number of child nodes added o he ree is n scn S () S where S is he se of scenario ree nodes in ime sep. If he number of unique samples obained from he sochasic asse failure model is greaer han he value in (), he required number of samples is seleced randomly from he samples generaed and he scenario probabiliies are re-normalised.

15 Algorihm Scenario ree generaion Algorihm ScenarioTreeGeneraion Inpu: Se of asses A, se of hazards H Se of failure propagaion dependencies D FP Maximum number of scenarios n scn, Number of samples per paren node n spl Number of simulaion ime seps max Oupu: Scenario ree S Iniialise S = { } for = 0,, max New scenario ree node s roo Probabiliy(s roo ) AsseFailure(s roo ) {z k 0 = 0, k A} 0 Add s roo o S 0 For =,, max For each s paren in S S children = { } For i =,, n spl New scenario ree node s sample Paren(s sample ) s paren Probabiliy(s sample ) Probabiliy(s paren ) / n spl Sample failure propagaion variables Z k,m and creae asse hazard graph AsseFailure(s sample ) {z k = { if (k, ) is reachable from any (h, h ), h H, k A} 0 oherwise 0 If S conains any s iden where AsseFailure(s iden ) == AsseFailure(s sample ) Probabiliy(s iden ) Probabiliy(s iden ) + Probabiliy(s sample ) Else Add s sample o S children If S children > n scn S S Randomly discard S children n scn S child nodes from S S children Normalise probabiliies in S children Add S children o S Reurn S = [S 0, S,, S T ] 0.. Dynamic nework flow model The dynamic nework flow model used in his paper is based on a minimum cos flow assignmen mehod, deployed in a rolling planning horizon framework and exended wih hree ypes of dependency relaions (asse uilisaion, resource inpu, logic) and he opimisaion of asse repair.... Rolling planning horizon Holden e al. [0] model dynamic flows by solving a separae minimum cos flow problem for each ime sep. However, his echnique canno model flows wih a duraion greaer han he lengh of one ime sep and does no allow foresigh and planning. The laer poin is paricularly relevan for models wih repairable sysems and limied repair capaciy because opimal repair sraegies have o anicipae where nework capaciy is mos needed in order o prioriise repair. These limiaions can be overcome by ransforming he nework ino a ime-expanded nework []. However, wih his echnique he size of he resuling opimisaion problem increases linearly wih he number of ime seps, limiing he

16 0 0 0 scalabiliy of he mehod. Moreover, he ransformaion ino a single opimisaion problem for all ime seps means ha he model assumes perfec foresigh, which is arguably as unrealisic as he assumpion of no foresigh. While i is realisic ha sysem operaors anicipae he resuls of heir own acions, such as repair measures, i is unrealisic ha hey can fully anicipae random evens, such as equipmen failure. The model presened in his paper combines he ieraive and ime-expanded nework approaches by using a rolling planning horizon wih a lengh of ph ime seps. Ieraing he curren ime sep c hrough he simulaion period 0,, max, a ime-expanded nework flow problem is solved for each planning horizon c,, c + ph. However, only he opimal values of he decision variables for he firs ime sep of each planning horizon are saved as simulaion resuls. The flows compued for ime seps c +,, c + ph indicae wha is anicipaed a ime c. These predicions are updaed in subsequen ieraions and he final value of a decision variable is obained when is respecive ime sep becomes he curren ime sep. Combining he ieraive and ime-expanded nework approaches has wo imporan advanages. Firsly, i limis he size of he opimisaion problems o ph -imes he size of he corresponding saic nework flow problem. Secondly, i provides a higher degree of realism han boh approaches by hemselves. The consequences of decisions, for example regarding rouing and repair, can be anicipaed, bu no random evens, such as asse failure. The model reflecs how he planning is revised afer each ime sep as new informaion becomes available.... Linear programming formulaion The minimum cos flow assignmen mehod can be formulaed as a linear programming (LP) opimisaion problem []. The mehod requires he k shores pahs for each OD pair, which can be obained in a pre-processing sep using Yen s algorihm []. The LP decision variables are non-negaive and indexed wih superscrip = c, c + ph for he ime seps in he curren planning horizon. They comprise link flow variables f i,j for links (i, j) E, pah flow variables f p for pahs p P o,d beween OD pairs (o, d) OD, as well as commodiy generaion variables g i and commodiy uilisaion variables u i for single-commodiy nodes i E SC. In addiion o hese convenional decision variables for nework flow models, we include he decision variables x k and y k for he operabiliy and uilisaion of infrasrucure asses k A o enable he modelling of dependencies beween he asse and nework represenaions as well as opimisaion of asse repair. The complee LP formulaion of he model is as follows:

17 c + ph min ( = c (i,j) E c f i,j f i,j + c i g gi i V SC + v i u i ) + v o,d (f o,d f p i V SC (o,d) OD p P o,d ) ) () s.. f i,j, f p, g i, u i, x k, y k 0 (i, j) E, p Q i,j, i V SC, k A, = c,, c + ph () u i u i i V SC, = c,, c + ph () f p p P o,d f o,d (o, d) OD, = c,, c + ph () f i,j = f p δ(p,i) p Q i,j (i, j) E MC, = c,, c + ph () x k k A, = c,, c + ph () x c k { 0 if z c k = c k A (0) x k oherwise x k x k k A, = c +,, c + ph () x k x m k A S, (m, k) D L, = c,, c + ph () x k x m (m,k) D L k A P, = c,, c + ph () f i,j f i,j (i, j) E, = c,, c + ph () g i g i i V SC, = c,, c + ph () f i,j f i,j y k k A, (k, (i, j)) D U, = c,, c + ph () g i y k g i k A, (k, i) D U, = c,, c + ph () y k x k k A, = c,, c + ph () g i u i (α U i,k y k + α R i,k (x + k x k )) k A:(i,k) D I + f j,i j V:(j,i) E τ(j,i) f i,j j V:(i,j) E = 0 i V SC, = c,, c + ph () The objecive () comprises he cos of link flows and commodiy generaion, and penaly erms for unme demand in single- and muli-commodiy neworks, summed over all ime seps in he curren planning horizon.

18 Consrains () and () ensure ha he supply of infrasrucure services canno exceed he demand given by parameers u i and f o,d for single- and muli-commodiy neworks respecively. Consrains () ensure consisency beween link and pah flows in muli-commodiy neworks. The noaion Q i,j is used for he se of all pahs ha make use of a link (i, j) E MC. Flows can srech over more han one ime sep and he ime sep index of flow variables indicaes he deparure ime. We use he pah ransi ime funcion δ(p, i) o express how many ime seps afer he deparure from is origin a flow on pah p leaves he inermediae node i. Asse operabiliy variables x k are consrained o values beween 0 and as per (). If he curren asse failure scenario includes he failure of an asse k A a ime c he binary variable z k c has he 0 value one and equaion (0) ses he iniial operabiliy x c k equal o zero. Oherwise, he iniial operabiliy is se o x k 0 0, which denoes he operabiliy afer he opimal repair acion idenified in he previous ieraion has been carried ou. Consrains () enforce ha he operabiliy variables canno decrease over he planning horizon. This means ha he opimisaion only considers asse failures which have already occurred a he curren ime sep and does no anicipae addiional failure evens wihin he planning horizon. Neverheless, such failures can ake place in he sochasic simulaion and will hen affec subsequen ieraions of he dynamic nework flow model. Consrains () and () implemen logic dependency relaions as described in Secion... Consrains () and () se he nominal capaciy for link flows and commodiy generaion. Consrains () and () relae capaciy uilisaion and asse uilisaion according o he concep of asse uilisaion dependencies inroduced in Secion... Consrains () se he operabiliy of an asse as he upper limi for is uilisaion. Finally, conservaion of flow consrains are formulaed in (). They ensure a balance a each node beween commodiy generaion, commodiy uilisaion, commodiy supply for he uilisaion and repair of dependen asses (as described in Secion..), and he ne flow over conneced links. The link ransi ime funcion τ(j, i): E N is used o define how many ime seps afer he deparure a node j a flow arrives a node i. The size of he LP formulaed in Equaions () o () is considerable for ciy-scale infrasrucure neworks wih hundreds or housands of nodes, links, OD pairs and asses. The number of decision variables is ph ( V SC + E + k OD + A ) and an upper bound for he number of consrains is ph ( V SC + OD + E + A + D L + D U ). Owing o he compuaional efficiency of he simplex algorihm, soluions o LP problem insances of his magniude can be obained wihin seconds or minues, hus enabling he analysis of a large scenario ree.

19 .. Simulaion experimens The process for conducing a simulaion experimen wih he inegraed asse operabiliy and dynamic nework flow model is described in Figure. Afer he dynamic nework flow problem is solved, he remaining legs of journeys ha could no be compleed in he firs ime sep of he planning horizon are added as an addiional demand o all scenarios derived he respecive scenario ree node. If such coninued journeys are no beween an exising OD pair, Yen s algorihm is used again o find he k shores pahs. Sar Calculae k-shorespahs Generae scenario ree = Solve dynamic nework flow problems = max? no = + yes End Calculae missing pahs Add incomplee journeys o demand in + Figure Flow char of he inegraed asse failure and nework flow simulaion 0 A bespoke modelling and simulaion environmen was developed using he C# language o implemen he combined sochasic asse failure and dynamic nework flow model. Several pars of he modelling mehodology lend hemselves for parallel processing, namely shores pah finding, scenario ree expansion and flow assignmen for differen scenarios wihin he same ime sep.

20 CASE STUDY OF CRITICAL INFRASTRUCTURE IN LONDON To demonsrae and es he resilience assessmen mehodology proposed in his paper, we presen a case sudy of criical infrasrucure sysems in London. The case sudy aims o quanify he resilience of he elecriciy disribuion and mero neworks agains a hypoheical flood hazard, aking ino accoun various inerdependencies beween he wo sysems... Daa sources and modelling assumpions The case sudy uses real-world daa from several differen sources and also makes a number of modelling and parameer assumpions where daa were unavailable, mosly regarding he risk exposure and repair of infrasrucure asses. Table in he appendix provides an overview of he parameers used o capure he srucure and behaviour infrasrucure sysems. The parameers of dependency relaions are presened in Table. Boh ables make references o Table which summarises he key assumpions of his case sudy.... Infrasrucure sysems The model conains four infrasrucure sysems: he London Power Nework (LPN), London Underground Nework (LUN), and wo repair resource neworks ha provide repair services o asses in he LPN and LUN respecively. The LPN is an elecriciy disribuion nework owned and operaed by UK Power Neworks who provide deailed nework daa in he conex of heir long erm developmen saemen (LTDS) []. The sysem consiss of more han,000 kilomeres of cable, serves around. million cusomers, and delivers. GW during peak demand. The, nodes of he nework include super-grid ransformers, where power is fed ino he sysems, and demand nodes, mos of which represen subsaions a he kv level. The LPN conains, links represening connecors and ransformers, and asses represening subsaions. The main daa source for he LUN is Transpor for London s Rolling Origin and Desinaion Survey (RODS) []. This daase is produced based on passenger surveys o capure informaion on journeys on he London Underground on a ypical weekday. The daily ravel demand consiss of. million passenger journeys beween,0 OD pairs. There are,0 nodes in he LUN, represening saions and heir plaforms, and, links. The asse layer consiss of asses, including mero saions, rack secions, line conrol sysems, conrol cenres, rolling sock flees and depos. Due o he unavailabiliy of daa on specific repair resources and processes for he wo infrasrucure sysems, he LPN and LUN repair sysems are modelled as radial, single-commodiy neworks ha connec engineering depos wih poenial repair sies associaed o individual physical asses. Flows in he repair sysems are absrac represenaions of he repair services ha engineering depos provide o 0

21 0 asses. The model assumes ha he complee repair of any asse (from x k = 0 o x k = ) requires one uni of his repair service.... Hazard To demonsrae how he model can be used o carry ou a resilience assessmen, a hypoheical flooding inciden is assumed as an example hazard. The borough of Bren was chosen as he case sudy area because several infrasrucure asses in his area are locaed close o a poenial source of flooding, he Welsh Harp reservoir. The borough s sraegic flood risk assessmen [] and flood risk managemen sraegy [] idenify a failure of his reservoir as he mos caasrophic, ye unlikely flooding inciden. The repors do no quanify he probabiliy of such an inciden, bu hey sae ha he failure probabiliy for similar reservoirs is esimaed o be one in 0,000 years. This is subsanially lower han he probabiliy of flooding scenarios considered in curren flood proecion policies. Neverheless, i was deemed a suiable example for his case sudy because i demonsraes how he proposed mehod is paricularly ap for exploraory analysis of high-impac, low-probabiliy evens. I is no in he scope of his paper o carry ou deailed flood risk assessmens for individual asses. Insead, we assume ha he risk of flood damage depends only on wheher an asse is locaed in one of he wo flood zones shown in Figure. Flood zone exends,000 m downsream of he reservoir and conains infrasrucure asses. Flood zone encompasses he area beween,000 and,000 m downsream of he reservoir and conains 0 asses. 0 Figure Infrasrucure asses in he wo impac zones of he hypoheical flooding inciden

22 Dependency relaions Dependencies relaions are added o he model following he rules presened in Table (see appendix). The asse uilisaion and logic dependencies are direcly deduced from he sysem archiecure. Inpu dependencies model he supply of elecriciy o operae mero saions and rains. Furhermore, each asse is conneced o is repair sie node via an inpu dependency. Failure propagaion dependencies are added based on he geographic disance of an asse o he hazard or o anoher asse (assumpions A 0 and A ). In oal, he model conains, dependency relaions.... Model validaion The LUN flow assignmen was validaed for he no disrupion case by comparing he prediced passenger flows beween adjacen saions o he esimaed line loading provided in he RODS daase. The mean absolue percenage error for he morning peak hour is. %. Line loading daa for he LPN was no available and he flow assignmen was only validaed by checking ha he demand a all subsaions is fully saisfied in he no disrupion case. Errors regarding he prediced nework flows are o be expeced considering he use of a minimum cos flow mehod ha models neiher passengers roue choice behaviour beyond shores-pah seeking nor physical laws governing power flows. However, he accuracy of he minimum cos flow mehod is deemed sufficien for he purpose of his case sudy and for iniial resilience assessmens in general. The envisioned workflow for a comprehensive resilience assessmen wih he proposed modelling framework is ha, in he firs insance, a large number of scenarios is analysed using he compuaionally efficien minimum cos flow mehod. In a second sep, a smaller number of represenaive scenarios can be analysed wih more compuaionally demanding and infrasrucure-specific assignmen models. Asse failures and repairs simulaed in his case sudy are verified agains he modelling assumpions bu no validaed using real-world daa because parameers for hazard exposure and repair capabiliies are hypoheical. Resilience assessmen models for exreme evens are generally difficul o validae due o he unavailabiliy of hisorical daa. When used in pracice, he model proposed in his paper should be validaed wih he help of subjec maer expers who can check individual model inpus, such as failure probabiliies and repair capaciies... Simulaion We conduc a simulaion experimen assuming ha he flooding inciden akes place a a.m. on a weekday. The simulaion parameers are given in Table.

23 Table Simulaion parameers Parameer Descripion Value max Lengh of simulaion period hours ph Lengh of planning horizon hours n scn Max. no. of scenarios n spl No. of samples per scenario ree node k No. of shores pahs 0 Using he algorihm presened in Secion., we generaed a scenario ree wih unique asse failure scenarios. The LP problem insances had an average of 0,000 decision variables, 00,000 consrains and million non-zero consrain marix coefficiens. They were solved using he Gurobi dual simplex solver version.0.0. On a.0 GHz CPU he average runime was 0 seconds per LP problem insance. The model lends iself o parallel compuing, as he calculaions for each branch in he scenario ree are independen of each oher. On a CPU wih six cores, i ook approximaely one hour o pre-calculae he shores pahs and hours o run he simulaion... Resuls The simulaion experimen provides insighs ino how he flooding inciden could affec he performance of he wo infrasrucure sysems, given our simplifying assumpions on failure propagaion and repair processes.... Asse failure and repair Asse inoperabiliy caused by direc and propagaed failure afer he flooding inciden is shown in Figure. In he firs hour afer he inciden ( = ), he expeced number of asse failures over all scenarios is. and 0. in he LUN and LPN respecively. In he second hour afer he inciden, he oal inoperabiliy in he LUN sysem is expeced o decrease o. due o he effecive deploymen of repair resources which ouweighs he addiional damage caused by direc damage in flood zone (0.) and failure propagaion (0.). In conras, he oal inoperabiliy in he LPN sysem is prediced o rise sharply o.0, mainly due o failure propagaion (.) and also o direc damage in he second flood zone (0.). Due o he large number of asse failures, he LPN sysem is prediced o ake 0 hours unil full recovery of asse operabiliy whereas he LUN nework is prediced o ake only hours. 0

24 Figure Toal asse inoperabiliy (op) and changes in asse operabiliy (boom) Figure Elecriciy demand nodes and origin-desinaion pairs affeced by he flooding inciden

25 Unme demand The asse inoperabiliy prediced by he model would severely affec he sysems abiliy o mee he demand of a ypical weekday. Alhough he flood damage is conained o a relaively small area of he ciy, is effecs spread widely, as shown on he map of unme demand in Figure. The expeced loss of elecric power supply o wo demand nodes locaed wihin he second flood zone amouns o MWh over he duraion of he disrupion. Addiional MWh of unme demand are expeced o occur a hree subsaions which are locaed souh of he area affeced by flooding. The disrupions in he mero nework mainly affec he Jubilee, Meropolian and Bakerloo lines, which run hrough he area affeced by flooding and also depend on rolling sock, rain conrol and elecric power supply asses locaed here. Hence, mos journeys ha are cancelled or delayed are o or from areas served by hese lines, mos noably he Norhwes of London. In oal, he model predics ha journeys beween, OD pairs wih a combined ravel volume of, passenger journeys would be affeced by he disrupion.... Value of demand and supply The model predics he expeced loss (he difference beween he value of demanded and supplied infrasrucure services) o amoun o. and. million GBP in he ranspor and energy secors respecively. These resuls depend srongly on our assumpions regarding he value of infrasrucure services (A and A ). Figure shows ha alhough he esimaed loss is in he range of millions, i is sill relaively small compared o he overall value of services provided by he infrasrucure neworks. The simulaion experimen enables us o quanify he resilience of he wo inerdependen infrasrucure sysems in erms of he resilience measures inroduced in Secion. Figure plos he value-based sysem performance ( VoS VoD ) for he individual scenarios and is probabiliy- weighed average over all scenarios. The model predics an average resilience loss riangle area (RLT) of 0., an expeced minimum sysem performance of 0. and a oal lengh of disrupion of hours.