Review on Energy Resilience

See discussions, stats, and author profiles for this publication at: https://www.researchgate.net/publication/278652931

A Framework for Assessing the Resilience of Infrastructure and Economic

Systems

Chapter · January 2010

DOI: 10.1007/978-3-642-11405-2_3

CITATIONS

159 READS

2,747

4 authors, including:

Some of the authors of this publication are also working on these related projects:

Economics of New Technologies View project

Economics of Renewable Energy View project

Eric Vugrin

Sandia National Laboratories

40 PUBLICATIONS   669 CITATIONS   

SEE PROFILE

Mark A. Ehlen

Sandia National Laboratories

68 PUBLICATIONS   854 CITATIONS   

SEE PROFILE

All content following this page was uploaded by Mark A. Ehlen on 12 November 2015.

The user has requested enhancement of the downloaded file.

A Framework for Assessing the Resilience of Infrastructure and Economic Systems

Eric D. Vugrin, Drake E. Warren, Mark A. Ehlen, and R. Chris Camphouse

Infrastructure and Economic Systems Analysis Department, Sandia National Laboratories, Albuquerque, New Mexico, USA

[email protected]

Infrastructure and Economic Systems Analysis Department, Sandia National Laboratories, Albuquerque, New Mexico, USA [email protected]

Infrastructure and Economic Systems Analysis Department, Sandia National Laboratories, Albuquerque, New Mexico, USA

[email protected]

Performance Assessment and Decision Analysis Department, Sandia National Laboratories, Carlsbad, New Mexico, USA [email protected]

Abstract Recent U.S. national mandates are shifting the country’s homeland security policy from one of asset-level critical infrastructure protection (CIP) to all-hazards critical infrastructure resilience, creating the need for a unifying framework for assessing the resilience of critical infrastructure systems and the economies that rely on them. Resilience has been defined and applied in many disciplines; consequently, many disparate approaches exist. We propose a general framework for assessing the resilience of infrastructure and economic systems. The framework consists of three primary components: (1) a definition of resilience that is specific to infrastructure systems; (2) a quantitative model for measuring the resilience of systems to disruptive events through the evaluation of both impacts to system performance and the cost of recovery; and (3) a qualitative method for assessing the system properties that inherently determine system resilience, providing insight and direction for potential improvements in these systems.

2

Acronyms, Abbreviations, and Initialisms

Acronym Definition

CIKR critical infrastructure and key resource CIP critical infrastructure protection CIR critical infrastructure resilience CITF Critical Infrastructure Task Force CST Central Standard Time DHS U.S. Department of Homeland Security E.O. Executive Order FAST Fast Analysis and Simulation Team GDP gross domestic product GRP gross regional product HSPD Homeland Security Presidential Directive LDRD Laboratory Directed Research and Development LQR linear quadratic regulator MCEER Multidisciplinary and National Center for Earthquake Engineering

Research MMI Modified Mercalli Intensity NBC Nuclear, biological, or chemical NIPP National Infrastructure Protection Plan NISAC National Infrastructure Simulation and Analysis Center NOAA National Oceanic and Atmospheric Administration NSTAC National Security Telecommunications Advisory Committee PDD Presidential Decision Directive POL petroleum, oil, and lubricants SME subject matter expert SSP sector-specific plan TOSE technical, organizational, social, and economic

1 Introduction

1.1 Protecting the Nation’s Critical Infrastructure Over the past 25 years, the U.S. government has placed increased emphasis on the vulnerabilities and protection of the nation’s critical infrastructure systems. Among others, these systems include the electric power grid, the primary and secondary highway systems, and the internet, and together provide the very “backbone” of the U.S. economy and society. Largely due to the terrorist acts of September 11, 2001, the U.S. Department of Homeland Security (DHS) is now concerned about how these systems perform during and after natural and manmade disruptive events, such as hurricanes (e.g., Katrina, Ike), pandemic influenzas (e.g., H5N1, H1N1), chem-bio attacks, and many others.

To understand this performance, DHS has primarily focused on conducting consequence analyses that estimate the impacts on these infrastructures (and on the economy and other systems that rely on them) of particular disruptive events. For example, in 2008, the DHS National Infrastructure Simulation and Analysis Center (NISAC) estimated the impacts to critical infrastructures and the economy of Hurricane Ike. Prior to the hurricane’s landfall, NISAC used National Oceanic and Atmospheric Administration (NOAA) forecasts of hurricane path and strength to estimate losses of electric power (Figure 1-1), damage to infrastructures, and impacts to economic activity (Figure 1-2).

Figure 1-1: Projected electric power outages caused by hurricane damage (NISAC

2008)

4

Figure 1-2: Projected gross domestic product (GDP) losses resulting from hurricane

damage (NISAC 2008)

The measures of impact that result from this consequence analysis included, among many others, the extent and duration of power losses and communication outages, number of people evacuated and of people without basic amenities and duration of those impacts, loss of banking and finance services, loss of transportation services, damaged and destroyed buildings, and lost economic gross domestic product (GDP). These estimates are traditionally used to determine how to allocate emergency resources and in anticipation of future similar disruptive events, which of these assets deserve the most protection from disruption.

While NISAC has primarily focused on consequence analyses, DHS also recognized the value of understanding restoration and recovery processes that the critical infrastructures undergo following a disruptive event. The concept of critical infrastructure resilience (CIR)

5

includes both of these considerations, and CIR has become a key component of the nation’s CIP policies.

1.2 Resilience as a Homeland Security Mandate The federal government’s traditional policy toward critical infrastructure security has been one of protection. CIP policies date back at least to 1982, with formation of the National Security Telecommunications Advisory Committee (NSTAC), and with issuance in the mid- 1990s of Executive Order (E.O.) 13010, “Critical Infrastructure Protection in the Information Age,” both of which focused on the protection of infrastructure assets. The 1998 Presidential Decision Directive (PDD)-63, “Protecting America's Critical Infrastructures,” also focuses primarily on protection.

Following 9/11, the DHS re-energized the government’s efforts toward physical protection of infrastructure assets. Two of the first post-9/11 Presidential directives explicitly focus on protecting critical infrastructure from acts of terrorism: (1) Homeland Security Presidential Directive (HSPD)-3, which states that each threat level “shall prompt the implementation of an appropriate set of protective measures” by responsible infrastructure agencies; and (2) HSPD-7, which calls for “hardening” of key assets.

In 2005, DHS Secretary Chertoff charged the Homeland Security Advisory Council to form the Critical Infrastructure Task Force (CITF) to provide recommendations on national policy and objectives. The CITF focused on recommendations that would ensure the optimal delivery of critical infrastructure service in the post-9/11 “all-hazards” environment and reduction of the consequences of the exploitation, destruction, or disruption of critical infrastructures. The CITF’s primary recommendation was that DHS focus on CIR as its top- level strategic objective:

…making resilience the overarching strategic objective would stimulate synergistic actions that are balanced across all three components of risk…protection, in isolation is a brittle strategy. We cannot protect every potential target against every conceivable attack; we will never eliminate all vulnerabilities. Furthermore, it is virtually impossible to define a desired end state — to quantify how much protection is enough — when the goal is to reduce vulnerabilities. Critical Infrastructure Resilience (CIR) is not a replacement for CIP, but rather an integrating objective designed to foster systems-level investment strategies. Adoption of CIR as the goal provides a readily quantifiable objective — identifying the time required to restore full functionality. It is businesses that must bear the costs of resilience, that must make cost/benefit decisions in a changing, competitive environment. For example, remaining resilient in the face of disasters that destruct structures and harm employees must be evaluated from a systems functionality perspective so that these businesses make sound investment strategies. (Homeland Security Advisory Council, 2006)

Said differently, the CIR plan attempts to address a basic problem: that many of the critical infrastructures and key resources1 (CIKRs) contain so many assets; e.g., the Commercial

1 The 18 critical infrastructure and key resources (CIKRs) are, by sector-specific agency (in parentheses):

Chemical, Commercial Facilities, Critical Manufacturing, Dams, Emergency Services, Nuclear Reactors, Materials, and Waste (DHS Office of Infrastructure Protection); Agriculture and Food (Department of Agriculture, Food and Drug Administration); Banking (Department of the Treasury); Communications (Department of Homeland Security); Defense Industrial Base (Department of Defense); Energy (Department of Energy); Government Facilities (DHS); Information Technology (DHS); National Monuments and Icons (Department of the Interior); Postal and Shipping (Transportation Security Administration); Public Health and Healthcare (Department of Health and Human Services); Transportation Systems (Transportation Security

6

Facilities Critical Infrastructure, that individual-asset-based risk analysis and policy is difficult and expensive to manage. A systems approach is needed, one where the owners of the individual assets manage their own risks and the overall system functions well during a disruptive event.

To do this, the federal government has started a coordinated set of government resilience initiatives, started the process of understanding what features create resilience in CIKRs, and initiated calls to agencies to start measuring the resilience of their infrastructure systems. The DHS National Infrastructure Protection Plan (NIPP) in particular contains explicit language calling for increasing the resilience of the nation's critical infrastructure; e.g., the overarching goal of the NIPP is to

…build a safer, more secure, and more resilient America by preventing, deterring, neutralizing, or mitigating the effects of deliberate efforts by terrorists to destroy, incapacitate, or exploit elements of our Nation’s CIKR, and to strengthen national preparedness, timely response, and rapid recovery of CIKR in the event of an attack, natural disaster, or other emergency. (U.S. Department of Homeland Security, 2009)

Many of the NIPP sector-specific plans (SSPs) also have broad, if not specific, language that promotes critical infrastructure resilience as a primary objective. In fact, resilience has become such a priority for the United States that President Barack Obama (2009) proclaimed September 2009 as National Preparedness Month, with the goal of recognizing “the importance of preparing for potential emergencies beforehand and to observe this month with appropriate preparedness activities, events, and training to enhance our national resilience.” He further states that “Our goal is to ensure a more resilient Nation -- one in which individuals, communities, and our economy can adapt to changing conditions as well as withstand and rapidly recover from disruption due to emergencies.”

1.3 A Framework for Assessing Infrastructure and Economic Resilience In support of these directives, Sandia National Laboratories (Sandia) has formulated a new resilience framework, including a definition of resilience and system performance metrics and measurement methodologies, which can be applied to studies of natural and man-made CIKR disruptive events. This framework is expanded herein to include qualitative and quantitative measures.

The proposed definition of system resilience is: Given the occurrence of a particular disruptive event (or set of events), the resilience of a system to that event (or events) is the ability to efficiently reduce both the magnitude and duration of the deviation from targeted system performance levels.

Measurement of system resilience involves two components. The first component is systemic impact, which is defined as the difference between a targeted system performance level and an actual system performance following a disruptive event; i.e., it is measured in terms of the changes in system/economic performance (such as GDP). The second component is the total recovery effort, which is the amount of resources expended during recovery processes following the disruption. To be explicit, the measurement of system resilience requires the quantification of systemic impact and total recovery effort.

Administration, U.S. Coast Guard); Drinking Water and Water Treatment (Environmental Protection Agency).

7

Given that system resilience is, in part, due to inherent properties of the system, three such properties or capacities are used to define, quantify, and ultimately design for better resilience of the particular system. These properties are (1) absorptive capacity, or the ability of the system to absorb the disruptive event; (2) adaptive capacity, or the ability to adapt to the event; and (3) restorative capacity, or the ability of the system to recover. Better system resilience can then be designed by developing resilience enhancement features that improve one or more of these capacities. In total, the framework creates a methodology for measuring system performance levels and recovery efforts, determining and sometimes measuring system capacities, and developing cost-effective resilience enhancement features, thereby achieving the overarching goal of more resilient critical infrastructure systems.

This framework has two primary advantages for infrastructure and economic resilience analysis. First, the framework is general enough to be applied to all 18 of DHS’s CIKR systems. This flexibility is necessary for establishing resilience analysis standards across all CIKR systems. Second, it explicitly considers recovery costs following infrastructure disruptions. Recovery is a fundamental aspect of resilience, and evaluation of the recovery costs is necessary to provide a comprehensive resilience assessment. To the authors’ knowledge, this resilience assessment framework is the first of its kind to address both of these considerations.

1.4 Purpose and Scope The purpose of this chapter is to describe a framework for assessing the resilience of critical infrastructures and economic systems. Section 2 begins with a review of existing resilience definitions and frameworks, including definitions of resilience used across different disciplines and applications. Section 3 describes the authors’ proposed, three-part system resilience assessment framework, and Section 4 illustrates how to apply this framework to a specific example. Section 5 summarizes the framework and describes future directions for further developing and applying the framework.

2 A Survey of Resilience Definitions and Frameworks

There are notable differences of opinion across professional disciplines over the fundamental definition of resilience. These differences often originate from inherent complexities in resilience concepts and how and to which disciplines they are applied; e.g.,, whether resilience is concerned with deviations from a steady state (“engineering resilience”) or with changes between completely different states (“ecological resilience”). Given the explicit goal of converging toward a single, simple, and flexible definition for use in homeland security applications, this section first reviews existing definitions of resilience and then develops a functional definition for these types of analyses.

2.1 Existing Definitions of Resilience

2.1.1 General and Systems Definitions The ecologist C. S. Holling is considered by many to be the first to give a systems-level definition of resilience:

8

Resilience is “a measure of the persistence of systems and of their ability to absorb change and disturbance and still maintain the same relationships between populations or state variables” (Holling 1973).

Since that time, others have put forward general and domain-specific definitions; e.g.: Resilience is “the capacity to cope with unanticipated dangers after they have become manifest, learning to bounce back.’’ (Wildavsky 1991, p. 77)

Resilience is “the ability of a system to withstand stresses of ‘environmental loading’... [it is] a fundamental quality found in individuals, groups, organizations, and systems as a whole.” (Horne and Orr 1998, p. 31)

Resilience is “the capacity to adapt existing resources and skills to new situations and operating conditions.’’ (Comfort 1999, p. 21)

Resilience is “both the inherent strength and ability to be flexible and adaptable after environmental shocks and disruptive events.” (Tierney and Bruneau 2007, p. 17)

Resiliency is “the capability of an asset, system, or network to maintain its function during or to recover from a terrorist attack or other incident.” (U.S. Department of Homeland Security 2006)

Resilience is the “ability to resist, absorb, recover from or successfully adapt to adversity or a change in conditions.” (U.S. Department of Homeland Security Risk Steering Committee 2008)

Resilience is the “ability of systems, infrastructures, government, business, and citizenry to resist, absorb, recover from, or adapt to an adverse occurrence that may cause harm, destruction, or loss of national significance.” (U.S. Department of Homeland Security Risk Steering Committee 2008)

Resilience is the “capacity of an organization to recognize threats and hazards and make adjustments that will improve future protection efforts and risk reduction measures.” (U.S. Department of Homeland Security Risk Steering Committee 2008)

Resiliency is “defined as the capability of a system to maintain its functions and structure in the face of internal and external change and to degrade gracefully when it must.” (Allenby 2005)

“Regional economic resilience is the inherent ability and adaptive response that enables firms and regions to avoid maximum potential losses.” (Rose and Liao 2005)

“Engineering resilience […] is the speed of return to the steady state following a perturbation […] ecological resilience […] is measured by the magnitude of disturbance that can be absorbed before the system is restructured….” (Gunderson et al. 2002)

Social resilience as the ability of groups or communities to cope with external stresses and disturbances as a result of social, political, and environmental change (Adger 2000).

Resilience is “the essence of sustainability […] the ability to resist disorder.” (Fiksel 2003)

“Local resiliency with regard to disasters means that a locale is able to withstand an extreme natural event without suffering devastating losses, damage, diminished productivity, or quality of life and without a large amount of assistance from outside the community.” (Mileti 1999)

These definitions all include some aspect of withstanding change, whether by reducing the impact of the change, adapting to the change, or recovering from the change. Many of them assert that one aspect is the speed of the recovery and, for national infrastructure and economic systems, this speed is important; a recovery that takes hours is better than one that takes weeks, all else being equal. Only a few of the above definitions assert that adjusting

9

easily to the change is important; in the case of government homeland security policy, if a disrupted critical infrastructure system can adjust easily and essentially on its own, fewer resources (time and money) need to be committed to the recovery process.

2.1.2 Economic Definitions Rose (2007) defines static economic resilience as

…the ability of an entity or system to maintain function (e.g., continue producing) when shocked […it is] primarily a demand-side phenomenon involving users of inputs (customers) rather than producers (suppliers). It pertains to ways to use resources available as effectively as possible. This is in contrast to supply-side considerations, which definitely require the repair or reconstruction of critical inputs.

Static economic resilience can be thought of as an instantaneous measure of the performance of an entity or system relative to a non-resilient or fragile performance (e.g., where total productive capacity is lost). Rose (2007) defines dynamic economic resilience as

…the speed at which an entity or system recovers from a severe shock to achieve a desired state.

Rose (2007) also notes that dynamic resilience is “more complex because it involves a long- term investment problem associated with repair and reconstruction [that] involves serious tradeoffs.”

2.1.3 Relationships between Resilience and other Systems Concepts Resilience as a concept is related to other system concepts, such as survivability. To illustrate some of these similarities and to more broadly show how Sandia’s overall framework is based on work by others, we can directly compare these two concepts. First, the Multidisciplinary and National Center for Earthquake Engineering Research (MCEER) has developed a comprehensive resilience framework (Bruneau et al. 2003) that lists three constituent features of a resilient system: failure probability, level of impacts, and speed of recovery. Second, the U.S. Army (2005) and others have developed survivability frameworks. The Army defines survivability as

…the capability of a system to avoid or withstand manmade hostile environments without suffering an abortive impairment of its ability to accomplish its designated mission.

Survivability has three primary components, defined as follows:

• Susceptibility: “the inability of a system to avoid being hit by a threat mechanism.” (U.S. Army 2006).

• Vulnerability: “…the characteristics of a system that cause it to suffer a definite degradation (loss or reduction of capability to perform the designated mission) as a result of having been subjected to a certain, defined level of effects in an unnatural or manmade hostile environment.” (U.S. Army 2006)

• Recoverability: “…[following combat damage] the ability to take emergency action to prevent loss of the system, to reduce personnel casualties, or to regain weapon system combat mission capabilities.” (U.S. Department of Defense 2004)

10

Important similarities exist between resilience and survivability. First, as shown in Table 2-1, each of the three MCEER resilience concepts has a direct survivability corollary: failure probability with susceptibility, level of impacts with vulnerability, and speed of recovery with recoverability.

Table 2-1: Relationships between MCEER resilience features and survivability features

MCEER Resilience Concept

MCEER Definition

Survivability Concept

Failure probability “Reduced failure probabilities” Susceptibility

Level of impacts “Reduced consequences from failures, in terms of lives lost, damage, and negative economic and social consequences”

Vulnerability

Speed of recovery “Reduced time to recovery (restoration of a specific system or set of systems to their “normal” level of performance)”

Recoverability

Second, similar to how our definition of resilience is specific to a particular disruption (e.g., a hurricane), this definition of survivability is specific to a particular threat. For example, Ball (2003) defines vulnerability as the conditional probability that an aircraft is destroyed given that it is hit (PK|H). Ball’s mathematical formulation for the probability of combat survivability is PS = 1 – PHPK|H, where PH is the probability of being hit.

Finally, similar to how our framework includes resilience enhancement features, Ball (2003) describes characteristics that make something survivable in a general sense (i.e., across a range of threats) as “survivability enhancement features.” Ball’s list of features of a survivable aircraft includes items such as the characteristics of the aircraft, the characteristics of a crew, and the tactics used in combat. While each listed feature may not enhance survivability against every threat, each feature does enhance survivability against a set of threats. A list of survivability enhancement features can be further tailored to a specific threat. For example, the U.S. Army’s (2006) nuclear, biological, or chemical (NBC) contamination survivability criteria are “engineering design quantitative criteria expressed in terms of decontaminate-ability, hardness, and compatibility” for enhancing survivability in an environment with NBC contamination. Ball’s survivability enhancement features are similar to, but less specific than, the examples of resilience measures provided by Bruneau et al. (2003).

2.2 Resilience Assessment Frameworks

2.2.1 Domains of Resilience MCEER (Bruneau et al. 2003) developed the technical, organizational, social, and economic (TOSE) framework for defining system resilience, which was named after the important domains in which it should be applied. The technical domain includes physical systems that are engineered by humans, such as computer systems or the power grid, and their interconnected components. The organizational domain looks at the resilience capacities of organizations and institutions. The social domain examines population and community characteristics; e.g., the “capacity of globalized, multicultural societies to hold together in the

11

face of systemic shocks such as diseases and terrorist strikes” (The Centre of Excellence for National Security 2008). The economic domain includes economies, which are composed primarily of firms and households. The economic domain can be further refined into three sub-domains: microeconomic (behavior of individual firms and households), mesoeconomic (behavior of a sector, market, or group), and macroeconomic (aggregate behavior of all individual firms, households, and groups) (Rose 2007).

While resilience is generally considered to be a positive feature in infrastructure and economic systems, it is worth noting that resilience may be considered undesirable in other domains, depending on the perspective of the analyst. For example, Hills (2000) examined the resilience of sub-Saharan Africa’s police forces and argues that these undesirable statist institutions have demonstrated high levels of resilience.

2.2.2 Complex Adaptive Systems Recent resilience research in ecology often represents socioeconomic systems as complex systems with multiple equilibria, or “domains of attraction.” Walker et al. (2004) defines crucial aspects of resilience in terms of the ease of moving a system across a threshold that leads to a completely different state of the system. These complex systems-based definitions of resilience may not always be applicable within the TOSE framework because disasters rarely cause such a system to shift to a completely different domain of attraction. For example, in ecology, a new domain of attraction may be populated by a completely different set of organisms. On the other hand, large disasters, such as Hurricane Katrina, can create large changes in the long-term behavior of systems, but usually leave the TOSE systems in a state that is recognized to be the same domain of attraction as before the disaster.

2.2.3 Human-Social Systems The Resilience Alliance (2007a,b) developed a framework for assessing the resilience of social-economic systems, which are driven primarily by ecology (and the ecological definition of resilience) but have impacts on (or are affected by) human-social systems. The Resilience Alliance’s framework is composed of the following steps:

1. Define and understand the system. This step involves understanding the components of the system and how resilience applies to the system.

2. Identify the resilience of what? This step involves demarcating the boundaries of the system, identifying appropriate scales to examine resilience, and identifying the variables of concern. This includes the need to “identify the attributes of the system that…determine the dynamics of the system…[which] are the key targets for management intervention aimed at resilience.”

3. Identify the Resilience to What? This step involves the identification of “system drivers and disturbance,” which are external and internal variables and events that drive system change. Identification is accomplished through consultation with stakeholders in the system and development of a historical profile of the system.

4. Identify the people and governance. This step identifies the key players in the system and how the system is governed externally.

12

5. Assess resilience. This step develops the conceptual and analytical models necessary for identifying the recovery path and recovery efforts needed in the resilience assessment.

6. Identify implications for management intervention. This step uses the results of the modeling in the previous step to inform policymakers or other managers how the system might react to interventions.

7. Synthesize resilience understanding. The final step of the Resilience Alliance’s resilience assessment process is to synthesize the findings of the previous steps.

2.2.4 Seismic Resilience MCEER (Bruneau et al. 2003) proposes that the seismic resilience of a community to an earthquake can be measured by estimating the expected degradation in the quality of community infrastructure, Q(t). Given the occurrence of an earthquake at time t0, this degradation is measured for the period of time immediately following the earthquake (t0) until Q(t) returns to its pre-earthquake levels (t0). Resilience loss, RL, is calculated as

[ ]∫ −= 1

0

)(100 t

t

dttQRL (1)

or, equivalently, as the shaded area in Figure 2-1. The framework assumes that infrastructure quality levels are at 100 percent prior to the earthquake event and will return to this level following the earthquake. Though this method is presented in the context of earthquakes, the approach is also appropriate for other types of disturbances.

50

100

t0 t1 time

Quality of  Infrastructure 

(%)

RL

Figure 2-1: Conceptual illustration of MCEER’s seismic resilience loss measurement

(adapted from Figure 1 in Bruneau et al. 2003)

2.2.5 Probability-Based Resilience Assessment Chang and Shinozuka (2004) propose a probabilistic approach for measuring resilience, which they mathematically define in Equation 2 in terms of pre-defined performance standards A, given a seismic event of magnitude i:

( ) ( )0 1* and t *R P A i P r r t= = < <  , (2)

13

where

r0 = initial system performance loss;

r* = a predetermined standard of robustness that denotes the “maximum acceptable loss” in system performance following an earthquake;

t1 = time to full recovery; and

t* = the “maximum acceptable disruption time”; i.e., the maximum acceptable length of time for system performance to return to pre-earthquake levels.

Using this formulation, Chang and Shinozuka (2004) define resilience R as “the probability that the system of interest will meet predefined performance standards A  [i.e.,  r0<  r*  and  t1<t*] in a seismic event of magnitude i” (Equation 2). Figure 2-2  illustrates how all the parameters are measured. Similar to Bruneau et al.’s framework (2003), Chang and Shinozuka measure resilience in terms of how system output is affected. As with the seismic resilience framework, this approach can also be applied to non-earthquake disruptive events.

System Performance

t0 t1 time

Without Earthquake

Wi th

Ea rth

qu ak

er* r0

t*

Example where r0>r* and t1>t*

System Performance

t0 t1 time

Without Earthquake

Wi th

Ea rth

qu ak

er* r0

t*

Example where r0>r* and t1>t*

Figure 2-2: Measuring probabilistic resilience (adapted from Chang and Shinozuka

2004)

2.2.6 Economic Resilience Section 2.1.2 includes Rose’s (2007) definitions of static and dynamic economic resilience. Rose (2007) also proposes metrics for measuring these quantities. Rose proposes that the static economic resilience of a system to a shock be measured as “the ratio of the avoided drop in [system] output and the maximum potential drop” in system output (Figure 2-3) and applies this metric to assess the resilience of a system at any given instant in time.

System Output

No Disruption

Expected Performance

Worst Case

ΔEP

ΔWC Static Resilience = ΔWC-ΔEP

ΔWC Static Resilience = ΔWC-ΔEP

ΔWC Static Resilience = ΔWC-ΔEP

ΔWC

Figure 2-3: Static economic resilience

14

Rose (2007) incorporates the time-dependent aspects of system recovery in his approach to measuring dynamic economic resilience. As illustrated in Figure 2-4, dynamic economic resilience can be calculated as

( ) ( ) 1

Dynamic Resilience N

HR i WR i i

SO t SO t =

= −∑ (3) where

N = number of time steps considered,

ti = the ith time step,

SOHR = system output under hastened recovery efforts, and

SOWR = system output without hastened recovery efforts.

As with the other frameworks, these economic approaches can be easily adapted to non- economic applications.

System Output

Time

Dyn am

ic R esi

lien ce

Shock Occurs

Recovery Begins

With Hastened Recovery

Without Hastened Recovery

With Hastened Recovery

Without Hastened Recovery

Figure 2-4: Dynamic economic resilience

3 The System Resilience Framework

As demonstrated in the previous section, resilience is not a new concept. However, no existing frameworks are general enough to apply to all eighteen CIKRs while explicitly considering the cost of recovery efforts. The authors developed a three-part resilience assessment framework with the goal of addressing both of these issues. The resilience assessment framework consists of a definition of system resilience, an approach for quantitatively measuring system resilience costs, and a qualitative method for evaluating features that determine system resilience. The individual components of the framework are described in this section.

15

3.1 A Definition of System Resilience for Infrastructure and Economic Systems Based on the review and comparison of resilience definitions and frameworks, including those described in Section 2, our proposed definition of system2 resilience is

Given the occurrence of a particular disruptive event3 (or set of events), the resilience of a system to that event (or events) is the ability to efficiently reduce both the magnitude and duration of the deviation from targeted system performance levels.

This definition emphasizes that resilience is determined by a combination of the impact of the event on the system and the time and cost required for the system to recover. Some clarification of terms is helpful:

• System performance: Given the flexibility of many systems to adjust and reconfigure to a disruptive event, maintaining system structure is not as important as maintaining system performance. For example, a disruptive event may radically change the structure of how a regional economy operates (the structure of markets; the direction and levels of commodity flows), but this is immaterial if the desirable performance levels of gross regional product (GRP) and low unemployment are maintained through and afterwards. As explained below, systems with high levels of adaptive capacity and restorative capacity may be able to achieve targeted system performance levels through even radical (and low-cost) changes in system structure.

• Efficiency: The term “efficiency” means using the lowest possible amount of resources during recovery processes; depending on the domain, these resources could be dollars, repair man-hours, infrastructure replacement assets, or time. By defining it this way, the definition of resilience has the broadest domain application and the framework can have concise applications in other analytical areas, such as consequence analysis, risk analysis, and policy analysis.

• Disruptive event: Our definition considers resilience of a system to a specific disruption. Different disruptions may affect a system in different ways and, thus, necessitate different recovery processes. Hence, a system may have different levels of resilience to different disruptions. Our definition emphasizes that resilience of a system should be considered in the context of a particular disruption.

• Measurement of system resilience costs: The resilience of a system to a specific disruptive event is determined by systemic impact, which is determined by the deviation from the targeted system performance levels; and total recovery effort, which is a function of the duration of recovery (the length of time it takes for the system performance level to permanently recover to the targeted system performance

2 A “system” is a set of related and often explicitly interconnected entities that forms a whole. Engineered

systems—such as infrastructure systems—have a collective, measurable purpose. 3 A “disruptive event” is a shock or perturbation that can transform the system into other states (which are often

worse, but potentially better). This event is most commonly an event of short duration, such as a natural disaster, but the definition also accommodates longer term disturbances such as changes in technology, business cycles, social trends, and climate change. These events are respectively termed “pulse” and “press” disturbances (Resilience Alliance 2007a).

16

level) and the recovery effort (the costs and efforts required to change the structure of the system to recover to the targeted system performance level). Measuring system resilience costs this way allows one to make tradeoffs between systemic impact and total recovery effort: a system that moves quickly to the targeted system performance, but at a high total recovery effort, may not be preferable to a slower but less costly recovery.

• Targeted system performance level: This is a quantifiable measure of how the system performance metric should behave during and after disruptive events. This can be as simple as the pre-disruption system performance metric continued throughout time, or it may vary according to each particular disruptive event. In a scenario involving a destructive earthquake, for example, the targeted system performance level for emergency services will likely increase, overwhelming even an undamaged emergency services infrastructure, but begin declining in the weeks following the earthquake as demand for emergency services decreases.

3.1.1 Example Resilience Domains By design, our definition of resilience is applicable to a large number of system domains. Figure 3-1 illustrates the broad range of interconnected domains whose system resilience can be evaluated.

Technical Environmental

Organizational Ecological

Social Economic Figure 3-1: Domains for assessing system resilience

The definition of system resilience is applicable to human systems (black), environmental/ecological systems (green), and interconnected combinations of these two. All of these domains matter in our definition and measurement of system resilience, and most systems can and do fall across multiple domains.

3.2 A Quantitative Approach to Measuring Resilience Recovery is an inherent component of system resilience, as defined in Section 3.1. The existing measurement approaches described in Section 2 consider impacts to system output. Recovery is implicitly considered in all of these approaches because recovery directly affects system output. However, none of these approaches explicitly considers the cost of recovery or the dependence of system outputs on the selection of recovery strategies. The authors assert that this is a critical aspect of resilience that needs to be considered in the measurement of resilience. A simple example is presented to illustrate this point.

• Consider two systems that experience identical disruptions at precisely the same time. Both systems suffer the same decreases in system output, and both systems return to pre-disruption levels at precisely the same time. System 2 suffers these system output impacts while only few recovery resources are spent by external entities to restore

17

system capabilities. However, significantly more resources are expended by external entities to return System 1 to pre-disturbance output levels.

Each of the existing resilience measurement approaches described in Section 2 would consider that these two systems have identical resilience values because those approaches only consider systemic impact. However, the authors assert that System 2 should be considered to be more resilient because System 1 required a greater recovery effort for identical results or system impacts (Figure 3-2). This section describes a novel approach for explicitly incorporating the cost of recovery into the measurement of resilience costs.

Figure 3-2: Graphical comparison of the resilience of two systems

In contrast to other quantitative methods that measure resilience directly, the authors’ quantitative resilience assessment method indirectly evaluates resilience by quantifying resilience costs. Systems that are more resilient to a disruption will have lower costs than systems that are less resilient to that disruption.

The resilience cost measurement approach requires quantification of two key components of the definition of system resilience: systemic impact and total recovery effort. As previously mentioned, systemic impact is measured by evaluating the difference between a targeted system performance level and the actual system performance following the disruption. Total recovery effort is measured by analyzing the amount of resources expended during the recovery process.

Figure 3-3 graphically represents systemic impact and total recovery effort for a hypothetical system that has been disrupted. Systemic impact (SI) is quantified by calculating the area between the targeted system performance (TSP) and the actual system performance (SP) curves in Figure 3-3a. This area is calculated using the formula in Equation (4).

[ ] 0

( ) ( ) . tf

t

SI TSP t SP t dt= −∫ (4)

18

[ ]∫= tf

t

dttRETRE 0

.)(

Similarly, total recovery effort (TRE) is represented by the area under the recovery effort (RE) curve in Figure 3-3b, and this area is calculated with the formula in Equation (5). Calculation of resilience incorporates both of these quantities.

(5)

S ys te m P er fo rm an ce

Duration=tf-t0

Deviation from targeted system performance level

SP(t)

TSP(t)

Shock occurs at t=t0

Time

Recovery is complete at t=tf

(a)

R ec

ov er

y E

ffo rt

Time Duration

Recovery effort commences following shock

Recovery complete at t=tf

RE(t)

(b)

Figure 3-3: Systemic impact (a) and total recovery effort (b) are measured by calculating the shaded areas under the curves

Before demonstrating how system resilience costs are calculated, it is important to note that the system performance is determined by the recovery effort. That is, different recovery efforts lead to different system performances. For example, if no recovery effort is made following the disruption, the impacts to system performance may be great. In contrast, if

19

]

recovery resources are deployed shortly after the system shock, system performance may not be significantly affected, and systemic impact may be small. The recognition that systemic impact is implicitly determined by the selected recovery strategy leads to the development of two types of resilience cost measurements:

• Optimal resilience (OR) costs are the resilience costs for the system to a particular disruption, d, when the optimal recovery strategy that minimizes a combination of systemic impact and total recovery effort is employed (see Equation [6]), and

• Recovery-dependent resilience (RDR) costs are the resilience costs of a system to a particular disruption, d, under a particular recovery strategy, RE. (see Equation [7]).

[ ] [ 0 0

0

( ) ( , ) ( , ) ( ) min

( )

tf tf

t t RE tf

t

TSP t SP t d dt RE t d dt OR d

TSP t dt

α− + × =

∫ ∫

∫ (6)

[ ] [ ] 0 0

0 0

( ) ( , ) ( , ) ( , )

( ) ( )

tf tf

t t tf tf

t t

TSP t SP t d dt RE t d dt SI TRE

RDR d RE TSP t dt TSP t dt

α α

− + × + ×

= = ∫ ∫

∫ ∫ (7)

Both OR and RDR costs are linear combinations of SI and TRE. The denominator is a normalization factor that permits the comparison of the resilience of systems whose system performance levels may be of different magnitudes. The parameter α is a non-negative weighting factor that allows the analyst to assign the relative importance of the systemic impact and total recovery effort terms. Assigning a small positive value to α weighs the systemic impact more heavily; a large positive value for α weighs the cost of recovery more heavily. To equally weight SI and TRE, α is set to 1. Several things about this resilience cost measurement approach should be considered:

• Smaller RDR and OR costs indicate increasing resilience.

• No finite RDR and OR values correspond with the concept of a minimally “resilient” system.

• The approach for measuring system resilience is neither model- nor domain-specific. It only requires time series data (either historical or from a model) that represent system output and recovery efforts.

• The summation of the SI and α ×TRE terms in Equation 7 requires either that the SI and TRE be measured in the same units and α be a unitless constant or that α be assigned units that are appropriate for converting TRE to the same units as SI.

Because the RDR and OR values are dimensionless quantities, they are most informative when used in a comparative manner. For example, they can be used to compare the resilience of different systems to the same disruption. The system that has lower resilience costs will be the more resilient system. RDR and OR values can also be used to compare the resilience of

20

the same system to different types of disruptions. The system is more resilient to the disruption that results in smaller RDR and OR values. Moreover, they can be used to compare the resilience of a system to a disruption under different recovery strategies. Each different recovery strategy will result in different SI and TRE values. The recovery strategy that results in the smallest RDR values will provide maximal resilience for the system.

It should be noted that the definition of optimal resilience costs is similar to commonly used objective functions in optimal control applications.4 This similarity provides a starting point for research into the measurement of optimal resilience that will be discussed in Section 5.

3.2.1 Example Critical Infrastructure System Performance Metrics The resilience framework is designed to be used on any infrastructure or economic system that has at least one quantifiable measure of the performance. Table 3-1 lists some examples of infrastructure and economic systems and associated performance metrics:

Table 3-1: Example System Performance Metrics

Critical Infrastructure System System Performance Metrics Agriculture and Food Rates of and population exposure to food

contamination; average consumer price of food Chemical Shipments to critical chemical-based

commodities (e.g., pharmaceuticals) Emergency Services Lives saved; average response time Energy: Petroleum, Oil, and Lubricants (POL) Barrels of refined petroleum product

transported to the Midwest; price of domestic refined products; profitability of energy companies

Information Technology Number and efficacies of cyber attacks Public Health and Healthcare: H1N1 vaccine production, storage, and distribution system

Rates of morbidity and mortality; cost per vaccine given

Transportation Systems: Highway Average speed and cost of shipments; number of disrupted shipments

Communications Number of dropped telephone calls 3.3 System Capacities that Determine System Resilience Fiksel (2003) suggests that “it is important to assess not only performance outcomes but also the intrinsic characteristics that contribute to system resilience.” Consequently, our framework features a qualitative analysis component that can be used to explain the results of quantitative measurements or can take the place of quantitative results when no data are available. This analysis is done through consideration of system structures, characteristics, and features.

4 Consider, for example, the tracking formulation of the well-known linear quadratic regulator (LQR) control

problem described by Lee and Markus (1986).

21

This portion of the framework uses three system capacities to formulate how inherent properties of a system can determine system resilience, specifically by reducing systemic impact and total recovery effort. They are: absorptive capacity, adaptive capacity, and restorative capacity. These capacities are affected by resilience enhancement features, features of the system that can increase one or more of the system capacities. The following subsections describe the characteristics of resilience capacities and related resilience enhancement features and provide examples of each. Figure 3-4 summarizes the distinguishing characteristics of the capacities.

Resilience

Component System Impact Total Recovery Effort

Determining Features

Distinguishing Characteristics

of Capacity

Considers aspects that

automatically manifest after the disruption

Considers internal

aspects that manifest over time after the

disruption

Considers ability to affect and repair internal

system features

Effort Required Automatic/Little Effort Internal Effort

Required External Effort Often Required

Measurement of Component Internal Measurement Exogenous Measurement

Absorptive Capacity

Adaptive Capacity

Restorative Capacity

Figure 3-4: Resilience capacities of a system

3.3.1 Absorptive capacity Absorptive capacity is the degree to which a system can automatically absorb the impacts of system perturbations and minimize consequences with little effort. The absorptive capacity is an endogenous feature of the system.

For example, storage can enhance the absorptive capacity; if a chemical plant is disabled but a large amount of collocated storage of its product is undamaged, customers can continue to be supplied by the stored quantities, with little cost to the producer or customer, while the plant is repaired.

Examples of resilience enhancement features that can increase absorptive capacity include:

• System robustness, which decreases systemic impact through the strength of individual connections in the system.

22

• System redundancy, which decreases systemic impact through providing alternate pathways for the system mechanics to operate.

3.3.2 Adaptive Capacity Adaptive capacity is the degree to which the system is capable of self-organization for recovery of system performance levels.5 It is a set of properties that reflect actions that result from ingenuity or extra effort over time, often in response to a crisis situation. It reflects a dynamic ability of the system to change endogenously throughout the recovery period.

Consider the scenario in which a hurricane destroys many high voltage power lines, leaving many customers without electricity. Having customers with emergency generators enhances system adaptive capacity because the system can be changed (customers adapt to the disruptive event by generating power from a fuel source like gasoline rather than connecting to the electric grid) so that some portion of system performance is regained at a relatively low amount of effort.

Substitutability, the ability to replace one system component with another, is a resilience enhancement feature that can affect adaptive capacities. Economic systems with a high adaptive capacity can easily adjust to shocks through ordinary means such as input substitution, which can occur in situations where an input is scarce. For example, if beef becomes scarce, prices may increase and consumers may naturally substitute to other, less- expensive food, such as poultry, with little effort. Similarly, Rose (2007) provides examples of “adaptive resource substitution,” “adaptive import substitution,” and “adaptive conservation,” where people alter their everyday behavior to recover some portion of the lost system functionality.

Other resilience enhancement features that increase adaptive capacity tend to be more difficult to identify because they often rely upon the ingenuity of people faced with adversity.

3.3.3 Restorative Capacity Restorative capacity is the ability of a system to be repaired easily. Typically, these repairs are dynamic and performed by entities exogenous to the system. In the context of infrastructure policies, the government is often considered to be the exogenous, repairing entity. These repairs usually restore the system to near its original, pre-event state, but can also restore the system to a completely new state or regime that anticipates future system requirements. Restorative capacity primarily affects the total recovery effort, although repairs to the system enabled by the system’s restorative capacity may also increase the system performance, reducing systemic impact. Whereas adaptive capacity reflects the ability of a system to be changed endogenously, restorative capacity reflects the ability to be repaired

5 Our definition is similar to the definition by Carpenter et al. (2001) of “self-organization capacity,” which is

“the degree to which the system is capable of self-organization (versus lack of organization, or organization forced by external actors).” This definition emphasizes that organization is an endogenous, emergent property, and is similar to Rose’s (2007) concept of “adaptive resilience,” which is “the ability in crisis situations to maintain function on the basis of ingenuity or extra effort.” It is also similar to Sheffi and Rice’s (2005) definition of “flexibility,” which is the “amounts of building organic capabilities that can sense threats and respond to them quickly.”

23

exogenously. Most importantly, adaptive capacity involves changes that can radically alter the structure of the system to restore system performance, restorative capacity most often involves repairs that are usually implemented with the goal of returning a system to something near its original structure. For example, the electric power grid has monitoring systems that can automatically detect when and where a break in the grid emerges. Such technologies enhance the restorative capacity of the power grid because repair crews can be sent to the location of the break. These technologies result in a shorter disruption that is easier to repair (in terms of cost and time) than it would be if crews had to search large portions of the grid to find the break before repairing it.

3.3.4 Relationships between System Capacities, Performance, and Recovery As with system resilience, system capacities are event-specific. However, because many disruptive events may produce similar system performance and recovery results, capacities of a system to respond resiliently to different events may be highly correlated. For example, a variety of earthquakes could be experienced in California, but the capacities that enhance resilience of a system to one earthquake will be nearly identical to those that enhance resilience to other earthquakes. Therefore, capacities can be identified for classes of disruptive events. Section 4 provides a framework for conducting this qualitative resilience capacity assessment.

Absorptive and adaptive capacities are likely most important in the initial stages of large, widespread disruptions, where repair of the system might be impossible in the short term. For example, even if a large earthquake immobilizes the emergency services sector, people trapped in collapsed buildings will need to be rescued long before the police stations and fire engines are repaired. Restorative capacity is likely most important after the disruptive event, when efforts are underway to repair it.

System dependencies across systems can affect resilience capacities. For example:

• Absorptive Capacity. If system A is dependent upon system B to operate, then this relationship will lower system A’s absorptive capacity in scenarios that negatively affect system B.

• Adaptive Capacity. System A may have adaptive capacities that allow the system to reorganize to reduce its dependency upon system B.

• Restorative Capacity. The operation of system A may not depend upon the functionality of system B, but the repair of the components of the sector may require system B to be operational. In such cases, the restorative capacity of system A is diminished. Additionally, repair of multiple sectors must often be coordinated (for example, where infrastructures are collocated in urban areas), which further reduces institutional capacity by increasing the complexity of repair.

24

3.3.5 Resilience Enhancement Features and Resilience Domains The ability of resilience enhancement features to affect resilience often comes from the particulars of the domain under consideration.6

Resilience enhancement features in the technical domain are often engineering-based solutions that attempt to improve the functional performance level of the infrastructure system. For example, embedded sensors that relay the structural state of bridges to a command center after an earthquake are an example of a technical feature that can be engineered to improve the restorative capacity of highway systems because the sensors will reduce the need for costly and time-consuming inspections of bridges conducted before traffic is allowed back onto the highway. Additionally, design simplicity may be another technical feature that contributes to resilience (Fiksel 2003). A simple design may be more robust (hence, higher absorptive capacity), be easier to adapt (higher adaptive capacity), and easier to repair (higher restorative capacity).

Resilience enhancement features in the organizational domain are especially important from a policy standpoint because they can describe how governments and major stakeholders can affect restorative capacity. These organizations and institutions must attempt to choose an optimal recovery effort, taking into account the absorptive, adaptive, and restorative capacities of the system. This is an economic problem because the costs of recovery (i.e., the total recovery effort) must be weighed against the speed of recovery and the reductions in systemic impact brought about by recovery efforts.

Economic resilience enhancement features may reflect the ability of the structure of the economy to enable resilience capacities. Because the economy is highly influenced by organizations such as the government, there are many overlaps in the economic domain. For example, Rose (2007) uses price “gouging” as an example of a behavior that increases resilience to scarcity. Thus, government policies that ban price increases during disasters are non-resilient (or even negatively resilient) because they reduce the absorptive and adaptive capacities of resilience enabled by the market price system.

Resilience enhancement features from the social domain reflect grassroots characteristics of communities that enhance the resilience capacities. For example, in the heavily damaged Vietnamese Versailles community of New Orleans East following Hurricane Katrina, residents quickly moved back and began “pooling their own resources and volunteer labor” to rebuild despite delays in government aid. The community also worked together to persuade the electric utility to restore power (Chen 2006). Possible capacity measures include egalitarianism, monoculturalism (see, for example, The Centre of Excellence for National Security 2008), and correlates of prosperity (see, for example, Isserman et al. 2009).

6 Focusing on the long-term sustainability of companies, ecosystems, and social systems, Fiksel (2003)

identifies four categories of characteristics of resilient systems that can also be considered as resilient enhancement features and offers examples: (1) diversity, or “existence of multiple forms and behaviors”; (2) efficiency, or “performance with modest resource consumption”; (3) adaptability, or the “flexibility to change in response to new pressures”; and (4) cohesion, or the “existence of unifying forces or linkages.”

25

3.4 Framework Summary The resilience assessment framework that we have developed consists of three primary components. First, our definition of system resilience indicates what factors need to be considered when assessing the resilience of a system. These factors are quantitatively evaluated in the second component of the framework, our resilience cost measurement methodology. This methodology explicitly includes costs resulting from system impacts and recovery efforts following a system disruption. Third, the qualitative analysis component examines resilience capacities and enhancement features of the system to explain or replace quantitative results. Figure 3-5 illustrates the relationships between the components of the resilience assessment framework. Thorough application of this resilience assessment framework can result in a comprehensive evaluation of a system’s resilience and can inform about how to further enhance system resilience.

Absorptive Capacity

Adaptive Capacity

Restorative Capacity

Absorptive Capacity

Adaptive Capacity

Restorative Capacity

Resilience

System Performance Recovery EffortRecovery Duration

R ec

ov er

y E

ff or

t R

ec ov

er y

E ff

or t

Sy st

em P

er fo

rm an

ce Sy

st em

P er

fo rm

an ce

time time

Systemic Impact

Total Recovery Effort

Figure 3-5: Capacities and measures of resilience

4 A Qualitative Resilience Assessment for an Earthquake Scenario

The calculation of RDR values is rather straightforward, and calculation of OR values is a point of ongoing research (see Section 5.2.1). The qualitative analysis component of the resilience assessment framework is the most complex, so this section presents an example qualitative analysis to illustrate its application.

26

As a part of NISAC program, Sandia is conducting a multi-year project to evaluate the potential impacts resulting from a large earthquake in the New Madrid Seismic Zone of the Midwestern United States. The authors performed a resilience assessment of the 18 CIKRs to this earthquake as a part of the multi-year effort (NISAC 2009). The assessment followed the qualitative resilience assessment approach described in Section 3.3, and this section demonstrates how that application was performed and presents some of the results from that assessment. This assessment focuses on the qualitative aspects of the assessment framework because the quantitative measurement approach was not fully developed at the time of that analysis.

4.1 The Earthquake Scenario The proposed earthquake scenario for the infrastructure assessment was as follows: on January 3, 2009, at 4:00 am Central Standard Time (CST), an earthquake of magnitude 7.7 occurred with an epicenter northwest of Memphis. The earthquake occurred on a fault coincident with the southwest linear zone of modern seismicity of the New Madrid Seismic Zone. The Modified Mercalli Intensity (MMI), which shows the degree of shaking, is shown in Figure 4-1.

Figure 4-1: Ground Shaking Intensities for New Madrid Earthquake Scenario7

An earthquake in this region is of particular concern because CIKR systems could be severely affected. Several major natural gas transmission pipelines would be ruptured in this scenario. Consequently, natural gas transmission to the Chicago area and Northeast United States could potentially be reduced by up to 25 and 15 percent, respectively. Additionally, cascading electric grid failure would likely occur, leading to a blackout across the entire Eastern Interconnect within 30 minutes of the event. The Mississippi River would probably

7 Source: http://earthquake.usgs.gov/regional/ceus/products/download/regional/nm_sw_mmi.gif, accessed

October 15, 2008.

27

experience thousands of landslides, making it un-navigable, and the location of the river could actually be moved by up to a mile in some places.

4.2 Approach The objective of this resilience assessment was to provide a high-order, qualitative evaluation of the resilience of the 18 regional CIKR systems to the earthquake described in the previous section. This assessment focused on the resilience of the CIKRs within the technical domain.

To achieve this objective, the authors performed the following steps by interviewing NISAC’s CIKR subject matter experts (SMEs):

• Identified system and subsystem(s) of interest: CIKR Systems are often composed of subsystems that would be best analyzed separately, depending, of course, on the goals of the resilience assessment. For example, energy infrastructure can fall into electric power, petroleum, natural gas, and so on. System boundaries should be set so that the resilience assessment is of a manageable scope.

• Identified system performance metric(s): Because systems are complex and composed of many entities or sub-units, there are numerous possible metrics that could be used. System performance metrics should be chosen that are most fundamental to the purpose the system from the perspective of the relevant stakeholders. For example, for the purposes of the NISAC (2009) study, the percentage of customers with working electric power was more relevant to the DHS than the profitability of power companies.

• Assessed or simulated the recovery path: Assessing or simulating the recovery path consists of identifying the initial systemic impact as well as the changes in that impact over time as recovery proceeds. The recovery path was assessed qualitatively using both the expertise and models of the SMEs and more formal quantitative models and simulations.

• Assessed or simulated the recovery effort: Assessing or simulating the recovery effort as it proceeds through time is related to identifying the recovery path. Because the recovery path is a function of the recovery effort, identifying both will likely follow similar qualitative or quantitative methods.

• Identified resilience enhancement features and assessed resilience capacities: Analysts asked SMEs in the NISAC (2009) study to identify features of their systems that affect resilience capacities.

The authors evaluated the results of the interviews for each CIKR system and made qualitative assessments (high, medium, or low) for the resilience capacities of each CIKR system. The evaluations were then gathered in a single resilience matrix as described in the following section.

4.3 Sample Results Figure 4-2 contains the results of the resilience assessment for two CIKR systems: emergency services and postal and shipping services. Qualitative assessments of the resilience capacities are displayed in a single resilience matrix. In this example, the left column contains the

28

names of the systems being evaluated and the top row lists the resilience enhancement features. The intersections of the rows and columns contain one of the letters H, M, or L (for high, medium, or low). More detailed explanations of the capacity assessments follow the matrix.

Figure 4-2: An example resilience assessment (NISAC 2009)

Resiliency Matrix: Earthquake Scenario Analysis Example

System Absorptive Capacity Adaptive Capacity

Restorative Capacity

Emergency Services L M L

Postal and Shipping M H H

Emergency Services:

- Absorptive Capacity: Low. Emergency services will likely be overwhelmed. The problem will be exacerbated with destruction of emergency services facilities.

- Adaptive Capacity: Medium. Some emergency services functions, such as search and rescue, will be augmented by ordinary community members.

- Restorative Capacity: Low. Local governments, which may be overwhelmed with impacts from the earthquake, are responsible for repair of the sector. Repair will be slowed because local governments will be unable to offer mutual aid and will have to compete for resources.

Postal and Shipping: - Absorptive Capacity: Medium. Shipping facilities tend to exhibit redundancy.

However, the earthquake may damage an important shipping super hub, thus having a large initial systemic impact.

- Adaptive Capacity: High. Shippers have contingency plans for moving goods in the event of disasters. Shipping routes are flexible and can be rerouted around damaged areas.

- Restorative Capacity: High. Shippers are large businesses with financial resources. They have both the contingency plans and the means for recovering quickly to their initial state.

5 Summary and Future Work

5.1 Summary Resilience is a concept that has been considered for decades in many different disciplines. Consequently, numerous resilience definitions and evaluation approaches have been developed, many of them being domain-specific and, thus, not broadly applicable. The federal government’s CIP policy shift towards CIR has necessitated the development of a uniform framework for conducting CIR analysis. Furthermore, because recovery is a fundamental aspect of system resilience, the uniform framework should explicitly consider the costs associated with infrastructure recovery. With these two considerations in mind, the

29

authors have developed a new resilience assessment framework for infrastructure and economic systems.

The framework consists of three components: a definition of system resilience, a quantitative methodology for measuring resilience costs, and a qualitative analysis approach for evaluating resilience affecting system characteristics. Our definition of system resilience identifies key issues that must be considered when evaluating resilience. These issues include the dependence of measurements on particular disruptive events, the evaluation of system impacts, and the utilization of resources during recovery processes.

The quantitative measurement methodology follows directly from our definition of system resilience and requires the quantification of systemic impacts; i.e., deviations from targeted system performance levels, and the costs associated with the total recovery effort. Using these two components allows analysts to compare the relative benefits of alternative resilience policies that specifically make tradeoffs between reductions in level and length of loss of system performance and length and level of cost of recovery.

The last component of our resilience assessment framework is a qualitative analysis that can inform or replace quantitative results. This process evaluates the absorptive, adaptive, and restorative capacities and considers system features that can enhance the resilience of the system. Section 4 contains an illustrative example of how the qualitative analysis can be performed for a hypothetical earthquake scenario.

The development of CIR analysis and this framework have several advantages:

• In the context of CIP, it is impossible to secure all critical infrastructures against all threats. Rather than eliminating all threats or hardening all assets, it may be desirable to bolster resilience in critical infrastructure systems so that the functions of those systems can be maintained during and after disruptions—both natural and manmade. The resilience framework provides a way of analyzing systems based upon their overall function.

• The authors’ definition of resilience is flexible. Systems from a number of human and non-human domains can be analyzed within the same framework. Different aspects of the same system (i.e., system performance metrics) can be examined and compared.

• Decisions made following a disruptive event are fundamentally economic, involving the tradeoff between the system performance and the cost (not necessarily measured in dollars) of the chosen recovery effort. The inclusion of the recovery effort in the resilience analysis ensures that the recovery effort is considered both by analysts and by decision-makers.

• Resilience capacity analysis provides a useful framework for assessing why a system behaves as it does. Resilience is affected by a combination of the three capacities discussed in Section 3.3. The identification of resilience enhancement features and the mapping of the features to resilience capacities provide a more intimate knowledge of the structure of the system and increased confidence in forecasts of consequences from shocks to the system.

30

• Ultimately, agencies like DHS are interested in how to make a system more resilient. This resilience framework can answer these questions and provide analysis of the tradeoffs between the costs of building resilience and increases in resilience.

5.2 Future Work This chapter documents the initial effort performed to develop a resilience assessment framework for infrastructures and economic systems. We are currently engaged in efforts to further expand upon this framework and develop additional CIR analysis methods. Specifically, three areas of work are currently being performed or investigated. They are:

1. Application of optimal control theory and methods to the resilience measurement methodology;

2. Refinement of the resilience capacity analysis approach; and 3. Development of resilient infrastructure design processes.

We have already begun investigating the application of optimal control techniques to the resilience measurement approach and gained initial insights. The following section illustrates approaches and key research questions. The other two efforts remain in conceptual stages, so only brief discussions about that work are presented.

5.2.1 Application of Optimal Control Methods to the Resilience Measurement Methodology

As discussed previously, the quantitative resilience methodology is based on two key measurable components: systemic impact and total recovery effort. These considerations lend themselves nicely to mathematical formulations used for the development of optimal feedback control laws. When applied to a system, feedback controllers use measured system outputs to regulate system behaviors to target conditions while simultaneously providing a measure of the cost to do so. Feedback control has been successfully used in a wide variety of settings and applications, from simple household temperature thermostats to more complicated applications such as the mitigation of aero-acoustic noise in supersonic jets. Incorporating feedback control in the quantitative description of resilience enables automatic system recovery from disruption and provides predictions of recovery cost.

In the context of feedback control design, numerous formulations are currently available that allow for systematic development of optimal control laws. A particular formulation used for the design of optimal feedback control laws is that of the linear quadratic regulator (LQR). Controls developed with this formulation are able to drive system outputs to target values and have built-in robustness to system disturbances. They are developed by use of a tracking LQR cost function:

min u

(x − xt arg et ) T Q(x − xt arg et ) + u

T Ru{ } 0

∞

∫ dt. (8) In the LQR formulation above, x is a vector of system outputs, and xtarget is a vector of target operating conditions for those outputs. The goal of the tracking LQR control problem is to minimize the error between x and xtarget subject to the spatial and temporal dynamics of the

31

system. The quantity Q is a matrix of weights, allowing for more emphasis on particularly important system outputs in the control problem. The quantity u is a vector of inputs to the system that are used to drive x to xtarget. These inputs are the controls and compensate automatically to satisfy a particular tracking objective. R is a matrix of weights on the controls. These weights are used to keep input magnitudes within reasonable bounds. By carefully constructing Q and R, system behaviors can be driven to their target operating conditions while keeping the cost associating with the requisite input reasonable. If impacted by a disturbance, the feedback controllers automatically detect changes in the system due to the disturbance. The inputs u adjust accordingly to keep the outputs x close to the target values xtarget.

Advantages gained by incorporating feedback control methods in the quantitative resilience methodology are now illustrated in a chemical supply chain example. A schematic illustrating the supply chain is shown in Figure 5-1.

Figure 5-1: A control theory-based schematic of a chemical supply chain

In the example shown in Figure 5-1, the supply chain is composed of five chemicals V, W, F, G, and H, with their quantities denoted by CV, CW, CF, CG, and CH, respectively. The quantities vary with time and space, and their evolution is described by a set of five coupled partial differential equations over the spatial interval [0, L]. In this configuration, the normal mode of operation is for species W to dissociate into the three daughter products F, G, and H. The target operating condition is for CG to maintain a constant value at the end of the spatial domain. When the supply of chemical V is disrupted, chemical W can be added to the supply chain and processed, with the resulting daughter product being chemical V. The addition of the chemical V can be considered as a means recovering the chemical supply chain.

Under normal operating conditions, targeted system performance levels are attained by specifying a nominal value of CW(t, x) at the beginning of the spatial domain, x=0. This nominal value results in a concentration profile of species W along the interval [0, L] that yields the desired concentration of daughter product G at x = L. Chemical species V has species W as a daughter product. As a result, the concentration of species V at x = 0 is used as a control input to the supply chain, allowing for production of species W if there is a disruption in its supply. The behavior of the supply chain without disruption, a nominal value of CW(t, 0) = 1, and a target value of CG(t, L) = 0.0372 with L = 40, is shown in Figure 5-2 and Figure 5-3.

32

Figure 5-2: Parent concentrations under nominal conditions

Figure 5-3: Daughter concentrations under nominal conditions

In Figure 5-3, the desired concentration of species G is denoted by the asterisks at x = 40 in the plot of CG(t,x). As is evident, the target value is maintained well under the undisturbed nominal operating condition. In this condition, the emergency supply V is not required for the target performance level to be met, as seen in Figure 5-3.

To illustrate the impacts of disruption on the ability of the default supply chain (without feedback control) to maintain its target output, the nominal configuration is now severely disrupted. At t = 5, species W undergoes a catastrophic failure, with its available supply at x = 0 being completely eliminated. The supply of species W does not begin to recover until t = 75, when it is gradually brought back online to its nominal value. The behavior of the disturbed supply chain with no control is shown in Figure 5-4 and Figure 5-5.

Figure 5-4: Parent concentrations under disturbed conditions and no control

Figure 5-5: Daughter concentrations under disturbed conditions and no control

33

As can be seen in Figure 5-5, the severe disruption in the supply of species W causes the concentration of daughter species G to severely depart from its target value at x = 40. The severe impact of the disruption on the supply chain is more clearly seen in Figure 5-6. In that figure, the dashed curve denotes the desired value of CG(t,40). The solid curve denotes the value attained for CG(t,40) for the disrupted supply chain. As shown in the figure, the disruption causes CG(t,40) to depart significantly from its target value.

Figure 5-6: Deviation from the target condition under disrupted conditions and no

control

The advantage of including optimal control in the quantitative definition of resilience is now apparent. A feedback controller is developed using the LQR formulation in Equation (1) with the aim of holding CG(t,40) at its target value. The control input to the system is the concentration of species V at x = 0. A departure of CW(t,0) from its nominal value causes the feedback control to automatically adjust the concentration of species V to compensate for the disruption. The behavior of the disturbed chemical supply chain with incorporated feedback control is shown in Figure 5-7 and Figure 5-8.

34

Figure 5-7: Parent concentration under

disturbed conditions with feedback control

Figure 5-8: Daughter concentration under

disturbed conditions with feedback control

As seen in Figure 5-7, species V turns on after failure to force the necessary profile in its daughter chemical, species W. This allows for the target value of CG(t,40) to be maintained, even during the severe disruption to the nominal operating condition. The recovery of species W after t = 75 allows species V to vanish from the system, eventually returning to a value of zero. The ability of the feedback control to maintain the target condition, even during a severe disruption, is more clearly seen in Figure 5-9. As is evident by comparing the results of Figure 5-6 and Figure 5-9, incorporating feedback control allows for much better performance during disruption, and increases the resilience of the chemical supply chain.

Figure 5-9: Deviation from the target conditions under disturbed conditions with

feedback control

Several circumstances often arise that make the determination of optimal feedback controllers difficult. In most cases, optimal control theory provides feedback control formulations that are suitable for linear systems. The utility of these methods for systems that are highly nonlinear is questionable. As a result, the development of control methods suitable for nonlinear systems is currently a very active area of research. Another potential hurdle is that

35

the calculation of optimal controllers is computationally intensive. For systems that are very large, numerical calculations required to determine the optimal control quickly become intractable. For very large systems, order reduction methods must be used to reduce system dimension, allowing for the calculation of optimal controllers. The development of system order reduction strategies that lend themselves to typical control formulations is also an ongoing research avenue.

5.2.2 Refinement of Resilience Capacity Analysis The qualitative analysis of a system’s resilience capacity is the most complex aspect of the resilience assessment framework, so this aspect of the framework could be further refined. This could be done through analysis of a broad spectrum of infrastructure systems that are highly resilient (or in contrast, not resilient) to a particular type of disruption; or through assessment of a particular system that is resilient to an array of threats. These analyses could provide further insights into characteristics and resilience enhancement features that are common to “highly resilient” systems. These types of analyses could even lead to a quantitative methodology for evaluating absorptive, adaptive, and restorative capacities.

5.2.3 Resilient Infrastructure Design Our framework provides a means for evaluating the resilience of an existing or proposed infrastructure system, but answering the inverse problem could be even more useful. That is, given a design requirement that a system maintain a certain level of resilience, how does one design a system to meet that requirement? Our framework can provide insight into that question (e.g., how does one quantitatively determine if the design standard is met?). However, the development of a formal process for resilient infrastructure design should be further investigated.

6 Acknowledgements

The authors would like to thank all of the Sandia members of the NISAC Fast Analysis and Simulation Team (FAST) that supported the New Madrid Earthquake resilience assessment. The authors would also like to thank Theresa Brown for her critical evaluations as we developed the resilience assessment framework. P. Sue Downes’s enthusiastic support for the development of the framework, especially the quantitative methodology, is greatly appreciated. Finally, the authors are indebted to Judy Jones for her editing skills and, just as importantly, her patience.

The authors performed this work with funding from the DHS Office of Infrastructure Protection, the DHS Science and Technology Directorate, and Sandia National Laboratories’ Laboratory Directed Research and Development (LDRD) program.

Sandia is a multiprogram laboratory operated by Sandia Corporation for the Department of Energy’s National Nuclear Security Administration under Contract DE-AC04-94AL85000.

36

7 References

Adger, W. Neil, 2000, “Social and Ecological Resilience: Are They Related?” Progress in Human Geography 24(3), pp. 347 – 364

Allenby, Brad, and Jonathan Fink, 2005, “Toward Inherently Secure and Resilient Societies,” Science, August 12, 2005, 309(5737), pp. 1034 – 1036

Ball, Robert E., 2003, The Fundamentals of Aircraft Combat Survivability Analysis and Design, 2d ed., AIAA, Reston, VA

Bruneau, Michel, Stephanie E. Chang, Ronald T. Eguchi, George C. Lee, Thomas D. O’Rourke, Andrei M. Reinhorn, Masanobu Shinozuka, Kathleen Tierney, William A. Wallace, and Detlof von Winterfeldt, 2003, “A Framework to Quantitatively Assess and Enhance the Seismic Resilience of Communities,” Earthquake Spectra 19(4), pp. 737 – 38

Carpenter, Steve, Brian Walker, J. Marty Anderies, and Nick Abel, 2001, “From Metaphor to Measurement: Resilience of What to What?” Ecosystems 4(8), pp. 765 – 781

The Centre of Excellence for National Security (CENS), 2008, “(Un)problematic Multiculturalism and Social Resilience,” Report of a Conference Organized by The Centre of Excellence for National Security at the S. Rajaratnam School of International Studies, Singapore, February 21, 2008, http://www.rsis.edu.sg/cens/publications/conference_reports/Unproblematic%20Multi culturalism.pdf

Chang, Stephanie E., and Masanobu Shinozuka, 2004, “Measuring Improvements in the Disaster Resilience of Communities,” Earthquake Spectra 20(3), pp. 739 – 755

Chen, Michelle, 2006, “Do-it-Yourself Disaster Relief Snubs New Orleans Planners,” The New Standard, February 2, 2006. http://newstandardnews.net/content/index.cfm/items/2753

Comfort, Louise K. 1999, Shared Risk: Complex Systems in Seismic Response, Pergamon: New York

Fiksel, Joseph, 2003, “Designing Resilient, Sustainable Systems,” Environmental Science and Technology 37(23), pp. 5330 – 5339

Gunderson, Lance H., C.S. Holling, Lowell Pritchard Jr., and Garry D. Peterson, 2002, “Resilience of Large-Scale Resource Systems,” in Resilience and the Behavior of Large-Scale Systems, Lance H. Gunderson and Lowesll Pritchard Jr. eds., Island Press: Washington, D.C.

Hills, Alice, 2000, “Revisiting Institutional Resilience as a Tool in Crisis Management,” Journal of Contingencies and Crisis Management 8(2), pp. 109 – 118

Holling, C.S., 1973, “Resilience and Stability of Ecological Systems,” Annual Review of Ecology and Systematics 4, pp. 1 – 23

Homeland Security Advisory Council, 2006, Report of the Critical Infrastructure Task Force, January 2006, http://www.dhs.gov/xlibrary/assets/HSAC_CITF_Report_v2.pdf

37

Horne, John F. III, and J.E. Orr, 1998, “Assessing Behaviors that Create Resilient Organizations,” Employment Relations Today 24(4): 29 – 39

Isserman, Andrew M., Edward Feser, and Drake Warren, 2009, “Why Some Rural Places Prosper and Others Do Not,” International Regional Science Review 32(3), pp 300 – 342

Lee, E. B., and L. Markus, 1986, Foundations of Optimal Control Theory, Robert E. Kreiger Publishing, Malabar, FL

Mileti, Dennis S., 1999, Disasters by Design: A Reassessment of Natural Hazards in the United States, Joseph Henry Press: Washington, D.C.

NISAC (National Infrastructure Simulation and Analysis Center), 2008, “Hurricane Ike L-48 Impact Analysis, based on NOAA Advisory 37,” National Infrastructure Simulation and Analysis Center (NISAC) report to the U.S. Department of Homeland Security, September 11, 2008, (Unclassified, Official Use Only)

NISAC (National Infrastructure Simulation and Analysis Center), 2009, “Scenario Analysis of New Madrid Seismic Zone (NMSZ) Earthquake Impacts to Infrastructures and the Economy,” National Infrastructure Simulation and Analysis Center (NISAC) report to the U.S. Department of Homeland Security, February 2009 (Unclassified, Official Use Only)

Obama, B., “Presidential Proclamation for National Preparedness Month, 2009,” The White House, September 4, 2009, http://www.whitehouse.gov/the_press_office/Presidential- Proclamation-National-Preparedness-Month/ (accessed September 28, 2009)

Presidential Decision Directive/NSC-63, subject: “Critical Infrastructure Protection,” The White House, May 22, 1998, http://www.fas.org/irp/offdocs/pdd/pdd-63.htm

Resilience Alliance, 2007a, Assessing and Managing Resilience in Social-Ecological Systems: A Practitioners Workbook, Version 1.0, June 2007, http://www.resalliance.org/3871.php

Resilience Alliance, 2007b, Assessing Resilience in Social-Ecological Systems: A Workbook for Scientists, Version 1.1, June 2007, http://www.resalliance.org/3871.php

Rose, Adam, 2007, “Economic Resilience to Natural and Man-Made Disasters; Multidisciplinary Origins and Contextual Dimensions,” Environmental Hazards 7(4), pp. 383-398

Rose, Adam, and Shu-Yi Liao, 2005, “Modeling Regional Economic Resilience to Disasters: A Computable General Equilibrium Analysis of Water Service Disruptions,” Journal of Regional Science 45(1), pp. 75 – 112

Sheffi, Yossi, and James B. Rice, Jr., 2005, “A Supply Chain View of the Resilient Enterprise,” MIT Sloan Management Review, Fall 2005, pp. 41 – 48

Tierney, Kathleen, and Michel Bruneau, 2007, “Conceptualizing and Measuring Resilience: A Key to Disaster Loss Reduction,” TR News, May, 2007, pp. 14 – 17

U.S. Department of Defense, 2004, “Glossary,” http://at.dod.mil/docs/glossary.pdf

38

U.S. Department of the Army, 2006, “Survivability of Army Personnel and Materiel,” Army Regulation 70-75, Washington, D.C.

U.S. Department of Homeland Security, 2006, National Infrastructure Protection Plan, http://www.dhs.gov/files/programs/editorial_0827.shtm

U.S. Department of Homeland Security, National Infrastructure Protection Plan: Partnering to Enhance Protection and Resiliency, 2009, http://www.dhs.gov/xlibrary/assets/NIPP_Plan.pdf.

U.S. Department of Homeland Security Risk Steering Committee, 2008, DHS Risk Lexicon. http://www.dhs.gov/xlibrary/assets/dhs_risk_lexicon.pdf

Walker, Brian, C.S. Holling, Stephen R. Carpenter, and Ann Kinzig, 2004, “Resilience, Adaptability and Transformability in Social-ecological Systems,” Ecology and Society 9(2): 5, www.ecologyandsociety.org/vol9/iss2/art5

Wildavsky, Aaron, 1991, Searching for Safety, Transaction Publishers: New Jersey

View publication statsView publication stats