Review on Energy Resilience

Reliability Engineering and System Safety 99 (2012) 114–122

Contents lists available at SciVerse ScienceDirect

Reliability Engineering and System Safety

0951-83

doi:10.1

n Corr

E-m

Jose.Ram

journal homepage: www.elsevier.com/locate/ress

Generic metrics and quantitative approaches for system resilience as a function of time

Devanandham Henry, Jose Emmanuel Ramirez-Marquez n

System Development and Maturity Lab, School of Systems and Enterprises, Stevens Institute of Technology, Castle Point on Hudson, Hoboken N.J. 07030, USA

a r t i c l e i n f o

Article history:

Received 9 February 2011

Received in revised form

17 August 2011

Accepted 5 September 2011 Available online 6 December 2011

Keywords:

Network analysis

System resilience

Quantitative methods

Restoration

20/$ - see front matter & 2011 Elsevier Ltd. A

016/j.ress.2011.09.002

esponding author. Tel.: þ12012168003.

ail addresses: [email protected] (D. Henry)

[email protected] (J. Emmanuel Ra

a b s t r a c t

Resilience is generally understood as the ability of an entity to recover from an external disruptive

event. In the system domain, a formal definition and quantification of the concept of resilience has been

elusive. This paper proposes generic metrics and formulae for quantifying system resilience. The

discussions and graphical examples illustrate that the quantitative model is aligned with the

fundamental concept of resilience. Based on the approach presented it is possible to analyze resilience

as a time dependent function in the context of systems. The paper describes the metrics of network and

system resilience, time for resilience and total cost of resilience. Also the paper describes the key

parameters necessary to analyze system resilience such as the following: disruptive events, component

restoration and overall resilience strategy. A road network example is used to demonstrate the

applicability of the proposed resilience metrics and how these analyses form the basis for developing

effective resilience design strategies. The metrics described are generic enough to be implemented in a

variety of applications as long as appropriate figures-of-merit and the necessary system parameters,

system decomposition and component parameters are defined.

& 2011 Elsevier Ltd. All rights reserved.

1. Introduction

The word resilience has its origins in the Latin word ‘‘resiliere’’, which means to ‘‘bounce back’’. The common use of the word resilience in the written and spoken form mostly refers to the ability of an entity to bounce back. Such an entity can be, for example, individuals (or families) who overcome a personal shock or great trouble and are thus considered to be resilient. Similarly, in the world of sports, teams are called resilient when they come back to win a game or a series after an initial loss or a number of setbacks. Also, whenever markets recover from an index drop in the stock exchange, they are called resilient. Soldiers winning a battle from a losing position, cities and communities returning to normalcy after a natural disaster, and stock markets rising up after a setback are also considered resilient. Resilience is surely a popular buzzword today, yet from a physical to a sociological perspective the common understanding of the concept is to be able to ‘‘spring back after receiving a hit.’’ While this concept is reasonably consistent with the meaning of the word resilience, it is not evident in the concept of resilience as defined, described

ll rights reserved.

, [email protected],

mirez-Marquez).

and applied in many technical disciplines over the years and especially in Systems Engineering in recent years.

Holling introduced resilience to the scientific world through his seminal paper on ‘‘Resilience and Stability of Ecological Systems’’ [11]. Subsequently, the concept of resilience developed predominantly and generally independently in disciplines like ecology, psychology and physics (specifically in material science). At the turn of the century, there were a number of different opinions, definitions and classifications of resilience within many disciplines. However, the current interest in resilience of systems and enterprises has been triggered by the events of 9/11 [7].

With extensive globalization and connectivity, the effects of natural and manmade disasters (intentional and unintentional) may no longer be restricted to any geographic or political vicinity. Severe disruptions are also becoming more unpredictable, more frequent and more damaging. In this respect, and as evidenced by the continuous use of the word resilience in the systems engi- neering community, the essence of the concept of resilience seems to be becoming an essential component of systems and enterprises. Unfortunately, currently and from the perspective of this manuscript, there is a lack of standardization and rigor when quantitatively defining resilience [30]. That is, there are too many different definitions, concepts and approaches being used, many of which are not aligned to the basic meaning of resilience [32]. Researchers working in the area of resilience are also coming up with their own subjective definitions of resilience by expanding

D. Henry, J. Emmanuel Ramirez-Marquez / Reliability Engineering and System Safety 99 (2012) 114–122 115

its scope and making it more inclusive [13]. In doing so, some definitions of resilience overlap significantly with a number of already existing concepts like robustness, fault-tolerance, flex- ibility, survivability and agility. This trend makes resilience appear to be just another buzzword and not an attribute of engineering systems, and diminishes the importance and need for resilience. Likewise, the existing quantitative approaches to measuring or computing resilience are also not consistent with the concept of resilience. This prevents the development of a metric to measure resilience in a generic and consistent manner. Such a metric would greatly enable development of resilient systems, comparison of resilience strategies and support of resilience related decisions during design and operation.

To address the above issues, this paper proposes a quantitative metric that represents the fundamental meaning of the concept of resilience as a time dependent function for systems. The proposed metric enables system resilience to be considered as an attribute of a system’s delivery function. The quantitative approach pro- posed in this paper is novel in terms of system safety research and generic, so that it can be applied to different systems in various scenarios and disciplines in a consistent manner. The proposed metric is in accordance to previous efforts to define system resilience [24,32] in that it describes how the system delivery function changes due to a disruptive event and how the system ‘‘bounces back’’ from such distress state into normalcy.

The remaining sections of the paper are organized as follows. Section 2 reviews existing resilience metrics from various dis- ciplines. Section 3 introduces the proposed resilience metrics and formulae starting with a basic formula and then introducing a number of parameters. In Section 4 a network example is used to illustrate the proposed resilience metrics and quantitative approach. Section 5 concludes this paper summarizing the important contributions of this paper and proposed future work.

2. Literature review

Literature from a wide range of disciplines in which resilience metrics and measurement methodologies have already been proposed is reviewed in this section. The many different defini- tions of resilience are presented first, followed by brief summaries of resilience measurement techniques in the areas of psychology, infrastructure systems, networks and enterprises/organizations. It should be noted that this survey is limited to literature that contain a metric and/or formula for measuring resilience.

2.1. General resilience definitions

Dictionary definitions of resilience refer to two traditional usages of this term. The first definition, ‘‘the capability of a strained body to recover its size and shape after deformation caused especially by compressive stress’’, relates to a material property similar to elasticity [18]. In the discipline of material science, a modulus of resilience is also defined, and is understood to represent the energy absorbed per unit volume of material when stressed to the proportional limit (i.e. without creating a permanent distortion [29]). The second dictionary definition, ‘‘an ability to recover from or adjust easily to misfortune or change’’, relates to a personal trait in people [18].

Carpenter et al. [3] define resilience of socio-ecological sys- tems as the magnitude of disturbance that can be tolerated before the socio-ecological system moves to a different region of state space controlled by a different set of processes. This definition is based on the concept of ecological resilience, which according to Holling [12], can be measured as the magnitude of disturbance

that can be absorbed before the system changes its structure by changing the variables and processes that control behavior.

Regarding systems and enterprises, Jackson [14,15] defines the resilience of a system as the ability of organizational, hardware and software systems to mitigate the severity and likelihood of failures or losses, to adapt to changing conditions and to respond appropriately after the fact. According to Fiksel [6], resilience is also defined as the capacity of a system to tolerate disturbances while retaining its structure and function. Hoffman [10] defines resilience in business terms, as the ability of an organization, resource or structure to sustain the impact of a business inter- ruption and recover and resume its operations to continue to provide minimum services. According to Hoffman, an organiza- tion is resilient if it achieves minimum service levels after an interruption. But Vogus and Sutcliffe [31] define organizational resilience as the maintenance of positive adjustment under challenging conditions such that the organization emerges from those conditions strengthened and more resourceful. Wreathall [33] adds the element of quickness and operations during an interruption while defining resilience as the ability of an organi- zation (system) to keep, or recover quickly to, a stable state, allowing it to continue operations during and after a major mishap or in the presence of continuous significant stresses. Hollnagel et al. [13] and subsequent release in the Ashgate series continue to promote resilience engineering as the new paradigm for safety engineering.

Overall, it is becoming popular to define resilience as an overarching umbrella concept with many related concepts within it, where recovery or ‘‘bouncing back’’ is just one among them.

2.2. Resilience metrics: psychology

The Baruth Protective Factors Inventory (BPFI) [2] is based on the theory that there are four delineated protective factors that contribute to resiliency—adaptable personality, supportive envir- onment, fewer stressors and compensating experiences. Four items representative of each of these factors are further identified, and a table of 16 items to be scored using a Likert-type scale (1–5) is used to produce an overall resiliency score between 16 and 80. The Connor–Davidson Resilience scale (CD-RISC) [4] follows a similar approach, where 25 items are listed, each rated on a 5-point scale (0–4) with total scores ranging from 0 to 100.

The Brief Resilience Scale (BRS) [26] provides a reliable scale for the fundamental unitary concept of resilience. The existing measures of resilience generally assess protective factors or resources that involve personal characteristics and coping styles and not resilience directly. BRS includes six items to assess the ability to bounce back or recover from stress, each rated on a 5-point scale (1–5). This is the only measure that specifically assesses resilience (in psychology) in its original and most basic meaning.

2.3. Resilience metrics: infrastructure systems

Attoh-Okine et al. [1] propose a resilience index for urban infrastructure using a belief function framework. Li and Lence [16] had proposed a formula of resilience index, as a ratio of the probability of failure and recovery of the system. Attoh-Okine et al. have modified this formula using belief functions, and illustrate the resilience of a highway network.

Omer et al. [20] use a network topology to propose a quantitative approach to define and measure resiliency of a telecommunication cable system. They define base resiliency as the ratio of the value delivery of the network after a disruption, to the value delivery of the network before a disruption, where value

D. Henry, J. Emmanuel Ramirez-Marquez / Reliability Engineering and System Safety 99 (2012) 114–122116

delivery is the amount of information, that has to be carried though the network.

Reed et al. [22] outline a methodology to evaluate engineering resilience and interdependency for subsystems of a multi-system networked infrastructure for extreme natural hazard events, using power outages and restoration during hurricane Katrina as an example. Resilience is measured as the area under the quality curve Q(t) that takes a value of 1 when fully operable and 0 when inoperable. The quality function is adopted from the earthquake engineering community and is used to describe structural performance over time, following earthquakes.

Tierney and Bruneau [27] define disaster resilience as the ability of social units to mitigate hazards, contain the effect of disasters when they occur, and carry out recovery activities in ways that minimize social disruption and mitigate the effects of future disasters. A resilience triangle is defined from a graph of the quality of an infrastructure over time—where there is sudden loss in quality followed by recovery over time. Resilience enhan- cing measures aim at reducing the size of this resilience triangle.

Todini [28] considers urban water distribution systems that are designed as a series of interconnected closed loops where water can flow in either direction. The problem is formulated as a vector optimization problem with cost and resilience as two objective functions. This produces a Pareto set of optimal solu- tions, as tradeoffs between cost and resilience. Surplus water supply is used to characterize resilience of the looped network, as this is an intrinsic capability of overcoming sudden failures. The proposed heuristic design approach begins with a target value of resilience index, and then identifies the pipe diameters for each node–node connection.

2.4. Resilience metrics: networks

Najjar and Gaudiot [19] proposed network resilience and relative network resilience as two measures of network fault tolerance in a multicomputer system. Network fault tolerance is traditionally expressed as the degree of the network, and does not account for the total number of nodes in the system and the probability of a disconnection. Network resilience NR(p) is a measure that provides the upper bound on the number of node failures allowed, and is defined as the maximum number of node failures that can be sustained while the network remains con- nected with a probability (1�p). The measure relative network resilience RNR(p) is defined as NR(p)/N, where N is the number of nodes in the network.

Rosenkrantz et al. [25] identify resilience metrics for service- oriented networks taking into account both the underlying topology of the network and the manner in which services are distributed. Edge resilience of a network is defined as the largest value k such that no matter, which subset of k or fewer edges fails, the resulting sub-network is self sufficient. Node resilience is also defined in the same manner. These metrics would be useful in assessing the fault tolerance of a given network.

Whitson and Ramirez-Marquez [32] propose an approach based on Monte-Carlo simulation to calculate Category I (or static) resiliency of a network, which is a composite of its ability to provide service despite external failure and the time to restore service. A metric is defined to capture the resiliency as a prob- ability distribution function, and is illustrated on a number of two-terminal networks.

2.5. Resilience metrics: enterprises/Organizations

Dalziell and McManus [5] propose an approach that first requires Key Performance Indicators (KPI’s) to be identified. These are tangible measures by which the organization can track its

performance against its stated objectives in order to measure organizational resilience. The change in the selected KPI is plotted against time, from the start of the impact, until the change becomes zero. The severity of the impact (or maximum change in KPI) denotes system vulnerability while the time to recover denotes the adaptive capacity of the system. Overall resilience of the system is measured as the area under the curve.

McManus et al. [17] provide a set of 15 resilience indicators that are then grouped into three attributes. Based on surveys and analyses, qualitative values are given to the indicators based on which values for the three attributes are obtained. This informa- tion is used to plot a resilience envelope for the organization.

2.6. Summary

The purpose of this literature review is to showcase the many different definitions of resilience currently in use. The resilience metrics and quantitative approaches reviewed here, are also based on different definitions of resilience, and are developed primarily for use in a particular discipline. From this manuscript’s perspective, this fact leads to two issues.

Firstly, there is no consistent quantitative approach to resi- lience because there is no consistent treatment of the concept of resilience. For example, if resilience relates to avoiding disrup- tions and also recovering from disruptions, how can a resilience metric be defined that would be consistent with both perspec- tives? What would any particular value of resilience (as measured by the metric) mean?

Secondly, the quantitative approaches available are limited in their scope and usability and hence are not amenable for use outside the discipline where they have been developed. The metric and formula used for calculating resilience, if any, and the input data required for such calculations are also discipline- dependent. Hence, there is a need for a fundamental generic quantitative approach for resilience that would be usable and useful across various disciplines in a consistent manner, which can be used for the development of resilient systems and effective resilience strategies for systems.

3. System resilience—a time dependent quantifiable metric

To address the issues previously described, this section intro- duces resilience formulation based on the basic meaning of the word resilience. Then the quantitative approach is discussed in detail identifying the parameters needed for its computation, thereby developing a more thorough and usable metric and formula for system resilience.

3.1. Resilience: initial formulation

Let R (t) be the resilience of a system at time t. In its basic form, R (t) describes the ratio of recovery at time t to loss suffered by the system at some previous point in time td, as indicated by the following equation

RðtÞ¼ RecoveryðtÞ=LossðtdÞ ð1Þ

This basic formula is in agreement with the concept of the word ‘‘resilience’’, and is indicative of the ability of a system to ‘‘bounce back’’—this ratio shows that if recovery is equal to the loss, then the system is fully resilient, and if there is no recovery, then no resilience is exhibited. However, the parameters in Eq. (1) need be further defined in order to formulate a consistent quantitative approach.

D. Henry, J. Emmanuel Ramirez-Marquez / Reliability Engineering and System Safety 99 (2012) 114–122 117

3.2. System of interest

Let S be the system of interest for the resilience study. When considering resilience, this S experiences three distinct states: (1) original state, S0, (2) disrupted state, Sd, and, (3) recovered state Sf, and two transitions: (1) system disruption (from the original state to the disrupted state), and (2) system recovery (from the disrupted state to the recovered state). There are two events that trigger and enable these two transitions: a disruptive event and resilience action.

Fig. 1 illustrates that initially the system exists in a stable original state S0. A disruptive event then occurs that triggers system disruption (due to internal and/or external factors). As a result, the system enters a disrupted state Sd. In response, resilience action is taken, which triggers system recovery, enabling the system to bounce back to a recovered state Sf. It must be noted that the recovered state Sf could be the same, similar or different from the original state of the system S0.

3.3. Figure-of-merit or system delivery function

It is important to note that in order to quantify resilience, affecting the system is synonymous with the unambiguous identi- fication of a quantifiable and time-dependent system level deliv- ery function or figure-of-merit F(�). That is, F(�) is the basis for the computation of resilience. Commonly used representations of this function can be network, connectivity, flow or delay as applicable to the system under consideration. Any state of S is characterized by a corresponding value of F(�), and it is assumed that the two events (disruptive event and resilience action) directly affect its value. Fig. 2 illustrates the transformation of Fig. 1 when considering figure-of-merit F(�). It is important to mention that Fig. 2 is representative of a figure-of-merit for which increasing values are considered better (e.g. reliability, flow, connectivity paths, etc.). For the case where decreasing values are preferable G(�)¼F(�)�1 should be considered.

S0 Sd

Stable Original State System Disruption Disrupted State

Fig. 1. System state tran

Stable Original State

F(t)

F(t0)

F(td)

Disruptive Event

System Disruption S

S0

Disrup

t0 tdte

Fig. 2. Delivery function

As described in Fig. 2, F(t0) describes the value of the delivery function of the system corresponding to state S0. This state remains constant until the occurrence of the disruptive event at time te. Once the system is disrupted at time te, it transits to the final disrupted state of the system Sd at time td, where its value F(td) is lower than its original value F(t0). In Fig. 2, the system remains in Sd with delivery function value F(td) until resilience action is started at time ts. Finally, as a result of the resilience action, the system recovers to a recovered state Sf with delivery function value F(tf) at time tf.

It must be noted that the two events viz. disruptive event and resilience action that trigger the transitions system disruption and system recovery, respectively, need not be a one-time step events. They could vary as a function of time, and the resulting transitions could also have different variations with time and not necessarily a linear one. Fig. 2 is only an illustration to describe the overall variation of the delivery function or figure-of-merit over time during resilience. Further, it is also possible in some cases for the system disruption to continue until the resilience action is initiated. i.e., the time steps td and ts could coincide, with no steady disrupted state Sd.

Though this section discusses only a single figure-of-merit, in reality, it is common for multiple figures-of-merit to be studied for a single system under consideration. Hence, for a holistic analysis of system resilience, the system must be analyzed with respect to all figures-of-merit that are relevant and important.

Finally, the final state, Sf, does not necessarily have to coincide with the original state of the system. That is, in terms of the figure-of-merit and based on the resilience actions, F(tf) can be (1) equal to F(t0), (2) greater than F(t0) or (3) smaller than F(t0).

3.4. Disruptive event

In Fig. 2, S enters a disruptive state due to an event that involves the reduction of the delivery function value. While there are many events that could affect S, this alone is not sufficient for the event to be considered disruptive. An event is considered disruptive if and only if it affects the system S in such a way that

Sf

System Recovery Stable Recovered State

sition in resilience.

Stable Recovered State F(tf)

d

Sf

System Recovery

Resilience Action

ted State

timetfts

transition in resilience.

D. Henry, J. Emmanuel Ramirez-Marquez / Reliability Engineering and System Safety 99 (2012) 114–122118

the value of the figure-of-merit F(�) is reduced. Considering the illustrations in Figs. 1 and 2, a disruptive event is one that affects S such that the original value of the figure-of-merit is reduced, F(td)oF(t0). Only then can a system in state S0 enter a disrupted state Sd. In systems where multiple figures-of-merit are consid- ered, an event could be disruptive with respect to one figure-of- merit but not disruptive with respect to another figure-of-merit.

Let E represent the set of all events, E¼{e1, e2,y, em}. Then, the set of disruptive events D can be defined as D¼{ejAE9F(td9ej)o F(t0)}.

3.5. Resilience action

A successful resilience action is one that restores the system to a stable recovered state Sf from a disrupted state Sd, by increasing the value of F(�) from F(td) to F(tf) between time ts and tf, as illustrated in Fig. 2. There are two aspects of the resilience action that need be defined a priori: (1) the component recovery mechanism and, (2) the overall resilience strategy. These two aspects are further described in Section 3.7.

3.6. System resilience as a function of time

Based on the previous descriptions, the value of resilience R F(tr9ej) corresponding to a specific figure-of-merit F(tr9ej) eval- uated at time tr (where trA(td, tf)) under disruptive event ej can be computed via the formula presented in the following equation

R Fðtr9ejÞ¼ Fðtr9ejÞ�Fðtd9ejÞ

Fðt0Þ�Fðtd9ejÞ 8ej AD ð2Þ

The following considerations are important:

1.

R F(tr9ej) indicates the proportion of delivery function that has been recovered from its disrupted state. This measure of system resilience is consistent with the original meaning of the concept of resilience.

2.

The resilience metric R F(tr9ej) is quantifiable if and only if the figure-of-merit F(tr9ej) is quantifiable. Therefore, it is essential that such a quantifiable figure-of-merit is chosen for resilience.

3.

The minimum value of R F(tr9ej) equals 0, obtained when F(tr9ej)¼F(td9ej). In this situation, the system has not recovered from its disrupted state (i.e. there has been no ‘‘bounce back’’). This could imply that either no resilience action has been taken, or that any resilience action that has been taken is totally ineffective.

4.

Whenever F(tr9ej)¼F(t0) the value of resilience R F(tr9ej) equals 1. In this instance, the system recovers from it disrupted state Sd with associated F(td9ej), to the original stable state S0 with associated delivery function value F(t0). In practical terms, because of the resilience action, the system has bounced back fully. It should be mentioned that the value of F(tr9ej) is not necessarily bounded by F(t0), and therefore there can be resilience actions for which the F(tr9ej)4F(t0). This relates to situations where the value of figure-of-merit in the recovered state is better than the original state.

5.

Note that R F(tr9ej) is undefined when F(td9ej)¼F(t0). However, this condition is avoided since only disruptive events (i.e. elements of the set D) are considered. Practically, if a system does not suffer any loss, there is no scope for a recovery or to bounce back and thus there is no scope to exhibit resilience.

3.7. Time and cost of resilience

As with any system, S may be decomposed into components {s1, s2,y, sn} each with specific characteristics including its

relationship with the figure-of-merit F(�), which is the basis for resilience computation. From the perspective of this manuscript a disruptive event disrupts the performance of some of these system components and as a result the figure-of-merit associated with S reduces from F(t0) to F(td9ej). Therefore, a resilience action implies that the disrupted components are restored such that the figure-of-merit value increases to F(tf9ej).

As mentioned in Section 3.5, there are two aspects of the resilience action:

Component recovery mechanism or policy is related to restor- ing (or repairing) a disrupted component. For example, such a component could be replaced or could be repaired with or without removal from the system. The component recovery mechanism depends on the system of interest, the nature of the component and other related factors.

The overall resilience strategy is related to implementing component recovery mechanisms, at the system level. For exam- ple, the overall resilience strategy would determine the number of repair teams that would be operated, and their geographical location.

To illustrate these concepts let S may be decomposed into components {s1, s2,y, sn}. Associated with each component are t(si) and c(si) as the time and cost required to restore component si, respectively, whenever it is disrupted. Furthermore, let set Sj be the set of components that are disrupted due to event ej, ejAD. Define TR as the time needed for F(tr9ej)¼F(t0). That is, TR(ej) is the time elapsed for the system to recover from its disrupted state Sd to its recovered state Sf when event ej occurs. Assuming that the overall resilience strategy considers that each disrupted component is restored sequentially then, the time for resilience may be computed as

TRðejÞ¼ X

si A Sj

tðsiÞ ð3Þ

Similarly, let CR(ej) be the cost for resilience described as the cost incurred in implementing the resilience action so that the system state changes from its disrupted state Sd to its stable recovered state Sf, when event ej occurs, and calculated as

CRðejÞ¼ X

si A Sj

cðsiÞ ð4Þ

However, the total cost incurred by the system, is not only due to the cost incurred in implementing the resilience action as shown in Eq. (4), but would also include any loss incurred due to system’s inability to perform at the normal level due to system disruption (LSYSTEM DISRUPTION). This loss could be combination of time-dependent and time-independent factors, as per the system under consideration and the nature of its operation. Therefore

CTOTAL ¼ CRESILIENCE ACTIONþLSYSTEM DISRUPTION ð5Þ

Evidently, the component recovery mechanism and the overall resilience strategy would affect the total time and cost of resilience. The equations for time and cost of resilience have been simplified for conceptual illustration purposes. In practice, the time and cost of recovery for each component and for the resilience strategy could be more complicated functions involving many more parameters.

4. Illustrative example

In this section, a simple network example is used to discuss the applicability and usefulness of the quantitative approach to resilience that was introduced in the previous section. While the network representation used here is representative of many similar infrastructure systems, the quantitative approach per se

Table 1 Network Behavior under Disruption 1—Strategy 1.

Road segment Network Status

to td ts t1 t2 t3 t4 tf

OA 1 0 0 1 1 1 1 1

OB 1 0 0 0 1 1 1 1

OC 1 0 0 0 0 1 1 1

AB 1 0 0 0 0 0 1 1

AD 1 1 1 1 1 1 1 1

BC 1 0 0 0 0 0 0 1

BD 1 1 1 1 1 1 1 1

BE 1 1 1 1 1 1 1 1

CE 1 1 1 1 1 1 1 1

DT 1 1 1 1 1 1 1 1

ED 1 1 1 1 1 1 1 1

ET 1 1 1 1 1 1 1 1

A D (5 mi, 9 trips)

(7 mi, 3 trips)

(2 mi, 5 trips)

(4 mi, 4 trips)

(4 mi, 4 trips)

(7 mi, 6 trips)

(1 mi, 1 trips)

(1 mi, 2 trips)

(3 mi, 5 trips)

(4 mi, 4 trips)

(2 mi, 1 trips) T

(5 mi, 7 trips) O B

EE

C

Fig. 3. Seervada park problem.

D. Henry, J. Emmanuel Ramirez-Marquez / Reliability Engineering and System Safety 99 (2012) 114–122 119

is applicable to any system, even if it cannot be represented as a network.

4.1. Seervada park problem setup

The Seervada Park Problem is used by Hillier and Lieberman [9] as an example to discuss the shortest-path, minimum span- ning tree and maximum flow problems in Operations Manage- ment. This problem is modified here, to illustrate the quantitative framework to resilience.

Fig. 3 depicts the road network of the Seervada Park (i.e. the system of interest being considered for resilience analysis). Node O is the entrance to the park, and there is a scenic wonder at node T. Nodes A through E are ranger stations that serve as connection nodes for the road network. The park operates trams for visitors to reach the scenic wonder from the park entrance. The distance and maximum daily capacity of trams is provide for each road segment (between a pair of nodes). The arrows point to the direction in which trams ply while transporting passengers from the park entrance to the scenic wonder. The maximum daily capacity of trams includes return trips back to the park entrance. In addition, it is assumed that disruption of any road segment would incur in $1000 per mile and 10 units of time per mile in order to be fully restore.

4.2. Figures of merit

As previously discussed, the resilience of a system is always computed in the context of a particular figure-or-merit, and any system could have multiple FOM of specific importance. Three figures-of-merit have been considered for the Seervada Park Problem:

FOM1: Shortest path from O to T This figure-of-merit describes the case where lower values are preferable. That is the disrupted state would yield a higher value than its original undisrupted value. Therefore, in order to correctly compute resilience G1¼1/shortest path between O and T. FOM2: Maximum flow between O and T The maximum daily capacity of each road segment is used to calculate the maximum flow of trams between O and T in one day. FOM2 is calculated as number of trips per day. FOM3: Overall Health of Road Network It may be noted that some disruptive events may not affect all figures of merit. For example, the disruption of a road segment that is not part of the shortest path between O and T would not affect FOM1. Therefore, with respect to FOM1, the road system is as good as in its original state even though one road segment is unavailable. FOM3 provides for such events to be considered as disruptions. FOM3 is computed as length of usable roads/

total length of roads. In the original state, all roads are usable and hence FOM3¼1.

4.3. Disruptive events

It is assumed that the Seervada Park is located in hilly terrain and that a river runs through it. Two disruptive events are considered here:

Disruption 1: A rock slide occurs in the area near the park entrance and as a result, road segments OA, OB, OC, AB and BC are destroyed. Disruption 2: The river that runs through the park floods and as a result, road segment AD, BD, BE and CE are destroyed.

In both disruptions, it is assumed that the entire road segment is destroyed—i.e. no partial damage or restoration is considered.

4.4. Resilience action

When a road segment is destroyed, the entire length of that road segment needs to be restored. Only one repair team is available for restoring road segments sequentially. Each segment is restored in 10 units of time per mile for a per mile cost of $1000. Initial set-up time and cost for the repair team are assumed to be zero. It is also assumed that no time or cost is spent when the repair team moves from one road segment to another—supportability costs are not considered.

When multiple road segments are destroyed, the restoration strategy indicates the sequence in which the roads would be restored.

4.5. Resilience analysis

Five road segments are destroyed in disruption 1 due to the rockslide. Two restoration strategies are considered: in strategy 1, the road segments are restored in the order OA, OB, OC, AB, and BC. In strategy 2, the road segments are restored in the reverse order BC, AB, OC, OB, and OA.

Table 1 describes the network states for disruption 1 following restoration strategy 1. At to, all road segments are in good condition, indicated by a status ‘1’. The initial values of all three figures of merit (FOM) are indicated in Table 2. So for example, the shortest path from node O to T equals 13 miles. At td, the road network is disrupted, and the individual segments destroyed are indicated by a status ‘0’. The FOM values as per Table 2 quantify the disruption. For this case, all FOM have been reduced to its worst possible values.

D. Henry, J. Emmanuel Ramirez-Marquez / Reliability Engineering and System Safety 99 (2012) 114–122120

Eventually, restoration action is initiated at ts, with FOM values equal to those as in td since there has been no ‘‘bounce back’’ yet. In time steps t1 through tf the road segments are restored sequentially, following the order indicated by the strategy. At each time step, the total time and cost for resilience are computed. The increase of the FOM and R values with time can be seen. It should be noted that R 1 reaches 1 at t4, R 2 reaches 1 at t3 and R 3 reaches 1 at tf. Therefore at tf, the road network is back to its initial condition with all road segments fully operational.

Similar computations can be performed for disruption 1 fol- lowing strategy 2 for restoration. Fig. 4 graphically captures the resilience analysis for both strategies following disruption 1.

Fig. 4 illustrates that value of resilience as the road segments are restored increases differently for the two strategies. When

1.2

1

0.8

0.6 Я

0.4 ЯF1

ЯF2 0.2

ЯF3

Time

Disruption 1 - Strategy 1

R E

S IL

IE N

C E

-50.00 0.00 50.00 100.00 150.00 0

Fig. 4. Resilience analys

R E

S IL

IE N

C E

Disruption 1 - F 1.2

1

0.8

0.6

0.4

0.2

-50.00 0.00 50.00

Time

R E

S IL

IE N

C E

-50.00 0.00 50.00 100.00 150.00

Time

Disruption 1 - FOM1 1.2

1

0.8

0.6

0.4

0.2

"ЯF1 - Strategy1"

"ЯF1 - Strategy2"

0

0

Fig. 5. Comparing strateg

Table 2 Resilience computations for Disruption 1—Strategy 1.

Network Status

Time to td ts t1 t2 t3 t4 tf

FOM1 13.00 p p 14.00 14.00 14.00 13.00 13.00

R G1 0.00 0.00 0.93 0.93 0.93 1.00 1.00 FOM2 14.00 0.00 0.00 3.00 10.00 14.00 14.00 14.00

R F2 0.00 0.00 0.21 0.71 1.00 1.00 1.00 FOM3 1.00 0.58 0.58 0.67 0.75 0.83 0.92 1.00

R F3 0.00 0.00 0.20 0.40 0.60 0.80 1.00 TR 0.00 20.00 70.00 110.00 130.00 140.00

CR $0 $2000 $7000 $11,000 $13,000 $14,000

considering FOM1 following strategy 1, network resilience builds up considerably after the first road segment is restored, and it takes three more road segments to fully restore the network to its original condition as indicated by R¼1. When considering strategy 2, resilience does not increase before the first three road segments are restored so that R¼0 for to60, and it does not become 1 until all road segments get restored. Hence when considering FOM1, strategy 1 is better since it is able to ‘‘bounce back’’ close to its original value with just one road segment getting restored.

Fig. 5 compares the two strategies for all three FOMs following disruption 1. It can be seen that for FOM 1 and 2, strategy 1 is better while for FOM3, strategy 2 is better if the objective is to ‘‘bounce back’’ to the original state as quickly as possible. Similar resilience analysis can be conducted for disruption 2 where road segments AD, BD, BE and CE are destroyed due to the floods. For this disruption, in strategy 1, road segments are restored in the order AD, BD, BE, CE while in strategy 2, the road segments get restored in the order CE, BE, BD and AD. From Fig. 6 it is evident that FOM 2 and 3 follow a very similar trend, and that strategy 2 is preferable for all three FOM.

4.6. Summary

The resilience analysis described in this section illustrates the use of the quantitative approach to resilience proposed in this paper. It is shown that one can consider multiple FOM for the same system, and that resilience behavior can be different among all these metrics. The example described illustrates the benefits of

Disruption 1 - Strategy 2 1.2

1

0.8

0.6

0.4

R E

S IL

IE N

C E

0.2

-50.00 0.00 50.00 100.00 150.00

Time

ЯF1

ЯF2

ЯF3 0

is for Disruption 1.

OM3

100.00 150.00

"Strategy1"

"Strategy2"

R E

S IL

IE N

C E

Disruption 1 - FOM2 1.2

1

0.8

0.6

0.4

0.2

150.00100.0050.00-50.00 0.00

Time

"ЯF1 - Strategy1"

"ЯF1 - Strategy2"

0

ies for Disruption 1.

Disruption 2 - FOM1 1.2

1

0.8

0.6

0.4

0.2

0

Disruption 2 - FOM2 1.2

1

0.8

0.6

0.4R E

S IL

IE N

C E

R E

S IL

IE N

C E

0.2

0

TimeTime -50.00 0.00 50.00 100.00 150.00 200.00-50.00 0.00 50.00 100.00 150.00 200.00

Res1 - Strategy2

Res1 - Strategy1

Res2 - Strategy2

Res2 - Strategy1

R E

S IL

IE N

C E

Disruption 2 - FOM3 1.2

1

0.8

0.6

0.4

0.2

0 -50.00 0.00 50.00 100.00 150.00 200.00

Time

"Strategy2"

"Strategy1"

Fig. 6. Comparing strategies for Disruption 2.

D. Henry, J. Emmanuel Ramirez-Marquez / Reliability Engineering and System Safety 99 (2012) 114–122 121

implementing the right restoration action. This indicates that it is possible to arrive at an ‘‘optimal resilience strategy’’ that would enable the system to bounce back quickly and efficiently con- sidering the FOM of interest.

The system considered here is a typical network, and many infrastructure systems can be analyzed using such a network representation. However, it must be noted that this resilience approach is applicable to any system as long as FOM can be computed for different states of the system under consideration.

4.7. Other considerations

The proposed resilience metrics are generic and applicable to any system. However, there are various kinds of systems that are typically designed, built, operated and managed by systems engineers, ranging from simple to large-scale complex systems. While the resilience metrics apply equally to the entire range of systems, a number of issues must be taken into consideration while computing these metrics for specific systems.

The first task is to clearly identify the system of interest. In large systems, drawing the system boundary may not be a trivial task. The system of interest may also be a sub-system of a larger system or a supra-system consisting of many individual systems.

The next task is to identify the figure-of-merit. In many cases, this could be an existing system function that is quantifiable over time. However for some systems, new figures-of-merit may have to be defined in order to study the resilience of the system. While it is typical for complex systems to perform a large number of functions, it must be kept in mind that the resilience of the system is always with respect to a specific time dependent figure- of-merit. It is always possible for a system to exhibit resilience for one figure-of-merit and not for another figure-of-merit. It is important to make this distinction because only then can a comparison of system resilience be considered for different scenarios or disrupted states.

In the event of a disruption, the recovery of the system from its disrupted state will be dictated by the nature of the system as well as pre-determined policies and available facilities for repair/ recovery. Given all of these, the resilience metrics only help compute the resilience of the system, the time for resilience and the total cost of resilience.

While the proposed resilience metrics only provide a quanti- tative value for the system, these metrics become useful and valuable only when used to devise effective resilience strategies for the system of interest. For a given system of interest and an identified figure-of-merit, the resilience metrics may be used to compute the resilience of a system as well as time and cost implications for different resilience strategies. This would be of help to systems engineers during overall system design or while devising restoration strategies. Managers would now be able to determine the amount of investment that could be used for resilience strategies knowing (in quantitative terms), the level of resilience that they would now enable the system to exhibit in case of a disruption in future.

5. Conclusions and future research

This paper illustrated a new time dependent quantifiable metric for resilience in the context of systems and networks. The manuscript illustrates that resilience can be unambiguously quantified and that a standard for this metric can be developed. Theoretically, system resilience can now be completely character- ized when considering the systems’ associated FOM. As illu- strated, the key parameters in resilience calculation are as follows disruptive events, component restoration and overall resilience strategy. In practice, obtaining these parameters may not be trivial. Nevertheless, the proposed metric allows for the comparison of resilience between alternative system architectures.

Future research will explore the extension to a probabilistic scenario considering component restoration times as stochastic. Also, experimentation will be considered on a set of case studies related to a more complex real-life network/system scenario and considering various figures-of-merit and resources required for performing the resilience action and/or protection strategies.

Computationally, when analyzing large complex systems, it may not be possible to consider every possible failure/disruptive event. Hence, a worst-case scenario approach or an average scenario approach may have to be considered in order to develop a resilience strategy for the most critical event in a class of events (see Rocco et al. [23]). Evidently the resilience metrics presented provide an opportunity to consider system optimization as a

D. Henry, J. Emmanuel Ramirez-Marquez / Reliability Engineering and System Safety 99 (2012) 114–122122

means to develop effective resilience strategies or protective strategies (see Ramirez-Marquez et al. [21] and Hausken and Levitin [8]). Insights gained by performing such resilience studies are expected to be useful in designing systems for resilience i.e., building systems that have the ability to bounce back from a disrupted state.

References

[1] Attoh-Okine NO, Cooper AT, Mensah SA. Formulation of resilience index of urban infrastructure using belief functions. IEEE Systems Journal 2009;3(2):147–53.

[2] Baruth KE, Carroll JJ. A formal assessment of resilience: the baruth protective factors inventory. Journal of Individual Psychology Fall 2002;58(3).

[3] Carpenter S, Walker B, Anderies JM, Abel N. From metaphor to measurement: resilience of what to what? Ecosystems 2001;4:765–81.

[4] Connor KM, Davidson JRT. Development of a new resilience scale: the Connor–Davidson Resilience Scale (CD-RISC). Depression & Anxiety 2003;18(2).

[5] Dalziell EP, McManus ST. Resilience, vulnerability, and adaptive capacity: implications for system performance. International Forum for Engineering Decision Making 2004.

[6] Fiksel J. Designing resilient, sustainable systems. Environmental Science and Technology 2003;37(23):5330–9.

[7] Haimes YY, Crowther K, Horowitz BM. Homeland security preparedness: balancing protection with resilience in emergent systems. Systems Engineer- ing 2010;11(4):287–308.

[8] Hausken K, Levitin G. Minmax defense strategy for complex multi-state systems. Reliability Engineering & System Safety 2009;94:577–87.

[9] Hillier FS, Lieberman GJ. Introduction to operations research. 9th ed. The McGraw-Hill Companies; 2009.

[10] Hoffman E. Building a resilient business, white paper. Raptor Networks Technology Inc.; 2007.

[11] Holling CS. Resilience and stability of ecological systems. Annual Review of Ecology and Systematics 1973;4:1–23.

[12] Holling CS. Engineering resilience versus ecological resilience, engineering with ecological constraints. Washington D.C.: National Academy Press; 1996. [p. 31–44].

[13] Hollnagel E, Woods DD, Leveson N, editors. Resilience engineering: concepts and precepts. Ashgate Publishing Limited; 2006.

[14] Jackson S. System resilience: capabilities, culture and infrastructure. In: Proceedings of the INCOSE annual international symposium; 2007.

[15] Jackson S. Architecting resilient systems: accident avoidance and survival and recovery from disruptions. Wiley Series in Systems Engineering and Management; 2010.

[16] Li Y, Lence B. Estimating resilience of water resources systems. Water Resource 2007;43(7).

[17] McManus S, Seville E, Brunsdon DB, Vargo J. Resilience management: a

framework for assessing and improving the resilience of organisations. New Zealand: Resilient Organizations; 2007.

[18] Merriam-Webster Online Dictionary. Resilience; 2010. /http://www.merriam- webster.com/dictionary/resilienceS.

[19] Najjar W, Gaudiot JL. Network resilience: a measure of network fault tolerance. IEEE Transactions on Computers 1990;39(2):174–81.

[20] Omer M, Nilchiani R, Mostashari A. Measuring the resilience of the trans- oceanic telecommunication cable system. IEEE Systems Journal 2009;3(3): 295–303.

[21] Ramirez-Marquez JE, Rocco C, Levitin G. Source-sink network protection against diverse interdictor strategy via evolutionary techniques and con-

sidering continuous defense efforts. Reliability Engineering & System Safety 2011;96(3):374–82.

[22] Reed DA, Kapur KC, Christie RD. Methodology for assessing the resilience of networked infrastructure. IEEE Systems Journal 2009;3(2):174–80.

[23] Rocco C, Ramirez-Marquez JE, Salazar D. Bi and tri-objective optimization in the deterministic network interdiction problem. Reliability Engineering & System Safety 2010;95(8):887–96.

[24] Rose. Economic resilience to natural and man-made disasters: multi-dis- ciplinary origins and contextual dimensions. Environmental Hazards

2007;7(4):383–98. [25] Rosenkrantz DJ, Goel S, Ravi SS, Gangolly J. Resilience metrics for service-

oriented networks: a service allocation approach. IEEE Transactions on Services Computing 2009;2(3):183–96.

[26] Smith BW, Dalen J, Wiggins K, Tooley E, Christopher P, Bernard J. The brief resilience scale: assessing the ability to bounce back. International Journal of Behavioral Medicine 2008;15(3):194–200.

[27] Tierney K., Bruneau M. Conceptualizing and measuring resilience: a key to disaster loss reduction. TR News; June 2007.

[28] Todini E. Looped water distribution networks design using a resilience index based heuristic approach. Urban Water 2000;2(2):115–22. [June].

[29] Ugural AC. Mechanical design: an integrated approach, McGraw-Hill series in mechanical engineering. The McGraw-Hill Companies; 2003.

[30] VanBreda AD. Resilience theory: a literature review; 2001. [31] Vogus TJ, Sutcliffe KM. Organizational resilience: towards a theory

and research agenda. IEEE Transactions on Systems Man and Cybernetics 2007.

[32] Whitson JC, Ramirez-Marquez JE. Resiliency as a component importance measure in network reliability. Reliability Engineering and System Safety 2009;94(10):1685–93.

[33] Wreathall J. Properties of resilient organizations: an initial view, resilience engineering: concepts and precepts. Ashgate Publishing Limited; 2006.