Review on Energy Resilience

Reliability Engineering and System Safety 111 (2013) 260–272

Contents lists available at SciVerse ScienceDirect

Reliability Engineering and System Safety

0951-83

http://d

n Corr

E-m

leonard

journal homepage: www.elsevier.com/locate/ress

Probabilistic study of cascading failures in complex interdependent lifeline systems

Isaac Hernandez-Fajardo n, Leonardo Dueñas-Osorio

Ryon Laboratory, Department of Civil and Environmental Engineering, Rice University, Room 212, 6100 Main St., Houston, TX 77005, USA

a r t i c l e i n f o

Article history:

Received 18 June 2011

Received in revised form

6 August 2012

Accepted 8 October 2012 Available online 7 November 2012

Keywords:

Lifeline Systems

Interdependence

Cascading failures

Local redundancy

Fragility propagation

Seismic hazard

Random failures

20/$ - see front matter & 2012 Elsevier Ltd. A

x.doi.org/10.1016/j.ress.2012.10.012

esponding author. Tel.: þ1 713 348 5292; fax

ail addresses: [email protected]

[email protected] (L. Dueñas-Osorio).

a b s t r a c t

The internal complexity of lifeline systems and their standing interdependencies can operate in

conjunction to amplify the negative effects of external disruptions. This paper introduces a simulation-

based methodology to evaluate the joint impact of interdependence, component fragilities, and cascading

failures in systemic fragility estimates. The proposed strategy uses a graph model of interdependent

networks, an enhanced betweenness centrality for cascading failures approximation, and an interdepen-

dence model accounting for coupling uncertainty in the simulation of damage propagation for

probabilistic performance assessment. This methodology is illustrated through its application to a realistic

set of power and water networks subjected to earthquake scenarios and random failures. Test case results

reveal two key insights: (1) the intensity of a perturbation influences interdependent systemic fragility by

shaping the magnitudes of initial component damage and, sometimes counter-intuitively, the subsequent

interdependence effects and (2) increasing local redundancy mitigates the effects of interdependence on

systemic performance, but such intervention is incapable of eliminating interdependent effects comple-

tely. The previous insights provide basic guidelines for the design of systemic retrofitting policies.

Additionally, the limitations of local capacity redundancy as a fragility control measure highlight the need

for a critical assessment of intervention strategies in distributed infrastructure networks. Future work will

assess the fragility-reduction efficiency of strategies involving informed manipulation of individual

systemic topologies and the interdependence interfaces connecting them.

& 2012 Elsevier Ltd. All rights reserved.

1. Introduction

Lifeline systems constitute vital components of the public infrastructure of cities around the world. Power, water, and gas networks, among others systems, allow efficient resource trans- portation between distant locations in modern, sprawling cities. Although their importance is clear, public attention to the vulnerability of these systems is fairly recent [8,3]. Furthermore, the careful scrutiny of key factors for their study and protection, such as the effects of infrastructure interdependencies on systemic vulnerability, is still in an early stage.

In the case of interdependence, its existence and integration on vulnerability studies is important given that its presence allows damage transmission between networks, a factor that may alter conventional conclusions obtained from studies on individual systems. Experiences such as the Northeast Blackout of 2003 demonstrated the consequences of damage propagation within and across urban infrastructure networks. The blackout was caused by a set of cascading failures triggered by a short circuit

ll rights reserved.

: þ1 713 348 5268.

.edu (I. Hernandez-Fajardo),

created by tree contact with power lines [25]. This small pertur- bation compounded with computational and human errors and eventually spread to generate systemic perturbations within the power network. For the cities affected, the power outages were followed by the disruption of urban services dependent on power: drinking water (pumping stations), transportation (traffic lights, gas stations), and communication networks (data centers, anten- nas). Similarly, simultaneous random errors, interdependence effects, and cascading failures have also played a role in the damage levels observed during the occurrence of strong natural perturbations like the 2011 Tōhoku earthquake [40].

The noted blackout and earthquake experiences involve two of the systemic fragility sources, in addition to random failures, considered in this paper: cascading failures, CF, and interdepen- dence effects, IE. In this research the term cascading failures stands for internal failures caused by capacity exceedance induced by flow redistribution. The expression interdependence effects denotes the effects of internal failures triggered by failures in external systems.

Previous research used diverse mechanisms to simulate CF occurrence in graph models of infrastructure systems [14,27,10] . One of the key approximate tools used for CF simulation is Nodal Betweenness Centrality, NBC [17,46]. This centrality metric counts the number of the shortest paths passing through a node in a network, associating such amounts with the expected flow in the

I. Hernandez-Fajardo, L. Dueñas-Osorio / Reliability Engineering and System Safety 111 (2013) 260–272 261

component. Motter and Lai [27] use NBC to model the survival or failure of nodes due to direct damage and exceeded capacity after flow redistribution for graph models of real networks like the Internet and the Western US power transmission grid. Crucitti et al. [10] propose an alternative methodology based on nodal congestion, instead of nodal removal, during the flow redistribu- tion phase. These authors propose a time-dependent rule updat- ing transmission efficiency in the event of nodal overloading as the mechanism to simulate network performance degradation. In a third approach, Wang and Rong [42] describe a model in which flow redistribution occurs according to node degree, that is the number of links associated to a node in a network. The failure of a node will mean additional flow to its neighbors in proportion to their own individual degree, which in turn may render the neighbors offline inducing cascading damage propagation.

This paper studies CF by enhancing the original approach in Motter and Lai [27]. A metric called origin-destination nodal betweenness centrality (NBCOD) is used to represent internal flow distributions with nodal removal in the event of cascading failure. Unlike the original NBC, that considers all possible node pairs, the used NBCOD [14,47] analyzes the connection paths between critical generation and consumption nodes in the network— better approximating the flow and load distribution likely to occur in practical system components.

Note that although cascading failure mechanisms are typically captured by physics-based flow models, the computational demand of such types of analyses under probabilistic frameworks, as the one discussed in this paper, is high. In contrast, the absence of a full flow model in graph-based interdependence representa- tions enables probabilistic studies at the expense of using proxy metrics, like NBC or NBCOD, providing only a basic understanding of the adjustments taking place within a service network after perturbation.

In terms of interdependence effects (IE) modeling, Ouyang and Dueñas-Osorio [31] provide a practical classification using four categories: agent-based, inoperability input–output, system dynamics, and network or graph-based methods. This paper pro- vides an alternative classification to reflect recent contributions to the field using four more general categories: (1) agent-based (AB), (2) economics-theory (ET), (3) network-based (NB), and (4) empiri- cal (EA) methodologies. In AB strategies, infrastructure components are represented by agents with rules directing their goals, response, and evolution according to their interactions with different inputs. Key players in an urban network’s operation (e.g., government or weather conditions) can be represented as agents as well. The inherent versatility of this method allows the modeling of diverse infrastructure types, as well as of social systems [15]. However, it is important to consider that in the context of this study the response of infrastructure components after a perturbation is limited to their failure/survival status and their interaction within connected net- works. Such behaviors can be represented through simpler model- ing approaches requiring less data and computational resources for their implementation.

The ET strategy uses well-established economics methodolo- gies to describe different interdependence levels among infra- structures systems, assimilating them to interacting sectors in an economy. In an illustration of the ET strategy, Haimes and Jiang [19] use the Leontief’s input–output model (IIM) to describe the inoperability of interdependent lifelines. Their approach uses a matrix of economic coefficients to capture the interdependent effects in external systems triggered by perturbation of a given infrastructure network. This matrix is at the core of a linear equation whose solution includes the effects of perturbation of infrastructure systems across all other interdependent sectors. In another example, Zhang and Peeta [44] propose a model of infrastructure interaction combining a multilayer infrastructure

network with the computable general equilibrium theory [18]. This last approach includes the IIM paradigm and considers additional non-linear interactions between infrastructure sectors (e.g., the possibility of input substitution). Two key limitations of ET strategies are their minimal account of uncertainty on input data and the substantial amount of information required to model full economic sectors, while in some cases retaining a coarse resolution that precludes the assessment of specific maintenance or intervention actions.

Network-based, NB, strategies use mathematical graphs to represent infrastructure components. This strategy allows intui- tive representations and detailed systemic topology descriptions of infrastructure networks. Studies using NB methods can be subdivided into two types: topological and functional. The topolo- gical category considers only infrastructure topologies and com- ponent classification for systemic assessment. In contrast, functional analysis involves demanding computational modeling and the study of internal flow patterns. Buldyrev et al. [5] exemplify the topological NB approach. Their work studies inter- dependent systems using a macrosystem connecting isolated networks. Using this method, the authors are able to find analytical solutions for the critical number of removed nodes that will trigger macrostructural collapse. The approach followed by Dueñas-Osorio et al. [12] and Ouyang et al. [32] also uses the topological approach but employs simulation-based strategies to study systemic performance, while also enabling probabilistic modeling. In contrast, Svendsen and Wolthusen [39], Rosato et al. [35], and Bonneau et al. [4], use the alternative functional NB approach measuring systemic disruption in terms of flow decrease in terminal nodes as a consequence of perturbation.

Finally, EA strategies measure interdependence properties from the outcomes of past disasters involving interconnected infrastructures [26,7,34]. For instance, McDaniels et al. [26] revise patterns of interdependent infrastructure failures focusing on their consequences to particular social sectors. In particular, these authors review public reports from authorities and the press to characterize infrastructure failures interdependencies using indexes for quantifying their impact and extent. However, the EA approach is in general unable to provide insights about the mechanisms that yield the measured responses. Instead, empiri- cal studies tend to inform the calibration of computational or physical models [48].

Based on the previous considerations, the authors conclude that NB approaches provide an adequate modeling compromise where critical systemic information meets appropriate systemic models, allowing the efficient generation of tangible, engineering insights on the functionality and performance of lifeline systems. In the domain of NB studies, previous efforts modeled cascading failures or interdependent effects, but few efforts [45,47] attempted modeling the combined effect of these two internal fragility sources, and none did it while considering seismic perturbation effects. To address this conceptual gap, this paper introduces a novel approach combining the influence of cascading failures with interdependence effects to study their joint influence on systemic random and seismic fragility. Also, this paper studies interdepen- dence effects by including a coupled deterministic and probabil- istic characterization of interdependence linkages. The dual representation allows accounting for known coupling locations, as well as for the uncertainty on the strength of functional dependence between pairs of nodes in different systems.

The application of the cascading and interdependent failure propagation methodology to a test case of two interdependent power and water networks subjected to earthquake scenarios and random failures yields key insights regarding the levels of disruption intensity that trigger interdependence, the dynamics of interdependence propagation and associated intersystemic

I. Hernandez-Fajardo, L. Dueñas-Osorio / Reliability Engineering and System Safety 111 (2013) 260–272262

properties, and the effects of flow capacity increases on systemic fragility. These insights enhance the understanding of the role of the different factors controlling probabilistic interdependent systemic responses and provide avenues for future studies on the design, operation, and management of infrastructure systems.

The remaining contents of this paper are organized as follows: Section 2, fragility of single distributed systems, describes the basics of networked system models, the principles underpinning single- system fragility assessment, and the simulation of cascading fail- ures. Section 3, fragility of interdependent networks, introduces the interdependence representation and the methodology followed for interdependent fragility assessment. The fourth section, test case: interdependent power and water systems, presents a case study of two coupled systems perturbed by seismic scenarios and random failures as illustration of the proposed systemic fragility assess- ment methodology. Finally, Section 5, conclusions and future work, discusses how the proposed methodology and illustrative results can enhance systemic fragility assessment procedures, as well as its potential for risk assessment and decision-making support.

2. Fragility of single distributed systems

2.1. Representation of lifeline systems

This research represents lifeline systems using simple, directed graphs. A directed graph is a mathematical entity formed by nodes and the directed links connecting them [11]. In this work, nodes correspond to network facilities, while links represent the physi- cal elements connecting facilities at different locations. The graphs used in this research are called directed because their links have an associated direction with defined initial and terminal nodes. Additionally, simple graphs do not allow the same node as initial and terminal node for any link or to have parallel links, conforming to most practical network topologies.

In addition to lists of nodes and links in a network, a graph model includes a description of the network connectivity. Such connectivity can be summarized using a data structure called the adjacency matrix. An adjacency matrix is a square matrix with dimensions equal to the number of nodes in the system. A given location (i,j) in such a matrix is associated to the unique link departing from node i (tail of the link) and reaching node j (head of the link). The location is filled with a one if the link exists or with a zero otherwise.

A basic graph model can be enriched by assigning a role to each node in the system. Based on functionality, nodes can be classified as supply (G), consumption (D) or transmission (T) nodes. This classification is relevant as systemic performance is usually measured based on the network response at consumption nodes. In addition to this, the graph representation can assign a cost to each link as a way to express the effort required to move flow between nodes. This feature can be associated to real distance, resistance, or actual transportation cost, and it can be used to find efficient communication routes between target components.

2.2. Component fragility

In the context of this paper, fragility stands for the probability of a system or a component reaching or exceeding an established performance level under the action of a perturbation of known intensity. This performance level explicitly sets up the minimum acceptable response demanded from a component in the event of a perturbation. If the imposed performance level is not achieved, the component is considered to have failed. A consequence of this definition is that any component can be either in one of two

possible states, failure or survival, in the aftermath of a disrup- tion. Furthermore, threshold probability values defining the boundary between failure and survival depend upon the defini- tion of a performance level: more strict performance levels will lead to higher probabilities of exceedance, while relaxed levels will lead to higher probabilities of survival.

Component fragilities can be estimated using empirical models, computational simulations, or expert judgment [28]. This paper uses for its illustrative case study the component- level fragility information in HAZUS-MH [16]. HAZUS-MH is a computational application developed by the Federal Emergency Management Agency, FEMA, to estimate losses in the event of natural hazards like flooding, earthquakes, or hurricanes. It provides fragility information in the form of fragility curves customized for typical components belonging to a diversity of infrastructure networks considering different performance levels. In HAZUS-MH the selected performance level (also known as damage level and limit state in related literature) can be slight/ minor, moderate, extensive, or complete with probabilities of failure rising in parallel to the implied increasing performance demand.

2.3. Systemic fragility assessment

Systemic fragility assessment evaluates how component fra- gilities and perturbation intensities interact to influence the expected response of a lifeline system. Although alternative approaches to study such interaction exist [24,37,13], this paper uses Monte Carlo simulation due to its versatility to include complex phenomena like cascading failures in the model used for the description of damage propagation.

The simulation procedure used in this paper is as follows. A first step simulates the direct action of a perturbation on exposed components. If such disruption induces component failures, this initial damage can trigger successive failures and readjustments within the network which will conclude only when the network reaches a new stable state. This basic procedure is repeated independently for a number of simulations that guarantees that relative error requirements on the fragility estimates are met. Algorithm 1 summarizes the damage propagation process.

Algorithm 1. Simulation of damage propagation for single networks.

1:

Load graph model: adjacency matrix, link costs, etc.

2:

Proxy flow estimation. Evaluate initial betweenness.

3:

Direct Damage Simulation of component status. x DDS stage

4:

while new failures exist do

5:

Disconnection Failure Estimation. Detection of isolated

nodes. x DFE stage

6:

Cascading Failures Estimation. Updated flow loads after

redistribution. x CFE stage

7:

end while

8:

Systemic Performance Calculation. x SPC stage

The process in Algorithm 1 has four core stages: Direct Damage Simulation (DDS), Disconnection Failures Estimation (DFE), Cascad- ing Failures Estimation (CFE), and Systemic Performance Calculation (SPC). Direct Damage Simulation (DDS, line 3) establishes the status (failure or survival) of all components after disruption. In this stage, the known perturbation intensity is used to identify the probability of a component failing according to its associated fragility curve. The probability so identified is used as the decision parameter in a Bernoulli trial in which the obtained fragility separates the failure and survival zones for the component’s response. This process is

1

0.8

0.6

0.4

0.2

0

P ro

ba bi

lit y

of E

xc ee

da nc

e

1

0.8

0.6

0.4

0.2

0

P ro

ba bi

lit y

of E

xc ee

da nc

e

CL Limit State

20% 40% 50% 60% 80% 90%

20% 40% 50% 60% 80% 90%

0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 Peak Ground Acceleration, PGA (g)

0 3 6 9 12 15 Removed Nodal Fraction, RNF (%n)

Fig. 1. Sample of Systemic Fragility Plots (SFP’s) which display systemic fragilities for several performance levels (CL percentage values in legend). (a) SFP’s for

earthquake hazard (peak ground acceleration, PGA, as intensity measure). (b) SFP’s

for random failures (Removed Nodal Fraction, RNF, as intensity measure).

I. Hernandez-Fajardo, L. Dueñas-Osorio / Reliability Engineering and System Safety 111 (2013) 260–272 263

repeated for all network nodes, and a list of failed and surviving nodes is issued. Note that if the DDS stage produces at least one failed component, the process must continue to examine discon- nection failures. Also note that the factor of component failure correlations in the Bernoulli trials is left for consideration in future work.

Disconnection Failures Estimation (DFE, line 5) checks whether the surviving nodes from the DDS-issued list remain connected to the surviving set of supply/demand components. A node surviving the direct action of a perturbation may still be left isolated from the rest of the system; such nodes are failed for flow transmission purposes, and hence must be detected and included in the corresponding failure list. The DFE process requires executions of graph search algorithms using the surviving supply nodes as search sources. The test case in this paper uses Dijkstra’s algo- rithm [1] given its suitability for efficiently handling directed graphs with non-negative link costs.

The next stage in Algorithm 1 is Cascading Failures Estimation (CFE). Cascading failures occur as a consequence of internal systemic flow redistribution after component failures. In a system with components operating close to their safe capacities, pertur- bations can induce an increase on the flow load passing through surviving elements. This condition may lead to loads surpassing component capacities causing potential instability and failure. From this definition, it follows that flow capacities and loads must be known before and after perturbation. In this regard, the basic graph models described thus far are detailed enough for simpli- fied cascading failures simulation, where centrality metrics can be employed as proxies to estimate flow loads and their redistribu- tion in the aftermath of disruption in real networks [2]. The compromise of using such proxies consists in exchanging the accuracy provided by flow models for the efficient computational assessment associated to graph models.

Previous research has used the topological metric Nodal Betweenness Centrality (NBC) as the proxy metric of choice [27]. The test case in Section 4 of this paper uses the origin-destination nodal betweenness centrality, NBCOD, using only connecting paths between supply (G) and consumption (D) nodes for the between- ness counting operation. Eq. (1) displays the expression for NBCOD

NBCODðkÞ¼ 1

9G9

X i A G

X j A D

sijðkÞ sij

ð1Þ

where the s operator counts path’s usage of a given component; for example, for component k, sijðkÞ counts the paths originating in supply node i and ending in consumption node j that pass through node k. The path count is normalized by the total number of paths originated in supply node i and ending in consumption node j, sij, while the total sum is averaged by the number of supply nodes, 9G9.

Note that NBCOD(k) is used twice in Algorithm 1. It is first used in step 2 to estimate the capacities C(k) of the unperturbed network components, and it is again used in step 6 to approx- imate the new loads (i.e., demands) caused by flow redistribution. The comparison of these two, original and updated, betweenness values, acting as proxies of flow capacities and loads, respectively, determines the occurrence of cascading failures in the tested network.

In addition to the use of NBCOD(k), this research uses an a parameter to represent local redundancy of the flow capacity of components ([27], [14]). This parameter quantifies the excess flow capacity of each component as a proportion of its basic nominal capacity. As presented in Eq. (2), the a parameter works as a multiplier applied to the nominal flow capacities. These augmen- ted capacities are useful to explore the relevance of local redun- dancy on the control of cascading failures and ultimately of

systemic fragilities. The augmenting process described in Eq. (2) makes a equivalent to a safety factor which can be applied globally to all network components, as in this study, or locally according to the known operational ranges of real network facilities

CaðkÞ¼ð1þaÞNBCODðkÞ: ð2Þ

The Systemic Performance Calculation (SPC, line 8) measures the impact of accumulated damage on the system’s ability to meet its original demands. A common strategy to measure systemic per- formance studies the systemic capacity reduction induced by failures. Under this strategy, the affected system’s capacity is contrasted with its original capacity. The systemic property used for this measure defines the complexity and resulting insights of this stage. A first alternative in the selection of such a property is the use of a topological property measuring connectivity within a system, a process typically used when evaluating the reduction on connecting paths between critical components [21,33]. A second alternative uses a functionality approach measuring the change in flow served to consumption points. However, it is important to note that the requirements for information and processing time for measuring flow change are more demanding than those required under topological metrics. This difference presents a potential computational advantage for connectivity- based metrics in light of the Monte Carlo simulation program involved in the systemic fragility estimation procedure used in this research. Naturally, this last advantage comes at the cost of a reduced complexity and insight of the systemic performance results.

Fig. 2. (a) Two interdependent networks with interdependence links (ILs) for several pairs of nodes. Note that ILs can point in any of the two possible directions (S1-S2 or S2-S1 ). (b) Isolated interdependence interface. A value of interdependence strength Istr is associated to each interdependent link (Istr1 ,Istr2 , . . .) according to the likelihood of damage

transmission in each IL.

I. Hernandez-Fajardo, L. Dueñas-Osorio / Reliability Engineering and System Safety 111 (2013) 260–272264

For the illustrative purposes of this work, the test case in this paper uses a connectivity metric referred to as Connectivity Loss, CL [2]. Eq. (3) presents the expression used to calculate CL

CL¼1� 1

9D9

X9D9 i ¼ 1

Pf Po

� � i

ð3Þ

In this equation CL measures the average change in the connec- tivity of consumption nodes (D) to supply nodes (G) after perturbation, Pf and Po stand for number of paths before (o) and after (f) perturbation, and 9D9 stands for the number of network consumption nodes. Note that CL requires a path search within the graph representation of the system. Dijkstra’s algorithm is used for that purpose in this paper’s test case.

2.4. Representation of systemic fragility results

The simulation program in Algorithm 1 produces network performance degradation estimates for each intensity level. Such estimates are statistically analyzed to calculate the sought systemic fragilities. Systemic Fragility Plots (SFPs) are used to display such results in a consistent form.

Fig. 1 displays typical systemic fragilities in the form of network-level probabilities exceeding performance thresholds (CL percentage values) for known perturbation intensities. The characteristics of these SFPs (e.g., their reach in the horizontal or vertical axes or their slopes), as well as the trends they illustrate (e.g., the degree of change between curves for different limit states), allow measuring the influence of intensity levels and hazard types on systemic performance.

Note that in Fig. 1(a), the perturbation is defined by earth- quake scenarios providing peak ground accelerations (PGAs) at the locations of network nodes. A peak ground acceleration measures the maximum level of shaking experienced at ground level in a given site as a product of the propagation of the energy released during an earthquake event. For the illustrative case study in this paper, each earthquake scenario is identified using the value of the maximum PGA observed among all network locations.

For Fig. 1(b), the perturbation is defined in terms of random failures, whose intensity is measured using the amount of nodes that fail randomly as a fraction of the total number of network nodes. These earthquake and random perturbations are used in the test case of this study. They are inherently different as the reaction of a network to seismic action highly depends on the intrinsic fragility of its components, while its response to random failures is mainly associated to the systemic capacity of its

topology and operation to withstand disruption without service collapse. The use of these metrics provides two contrasting views of the network fragility and a more balanced evaluation of the systemic effects of interdependence, perturbation intensity, and cascading failures than that generated by considering a single perturbation type.

3. Fragility of interdependent networks

3.1. Uncertainty and interdependence representation

This research represents interdependence as a local process of interaction of two components belonging to different networks. This definition implies a relationship such that the failure of a controlling node (master node) in one system can induce the failure of a depending node (slave node) in another network. Such dependence has a dual nature; first, the relationship physically exists and it is therefore assigned a fixed, directed interdepen- dence link (IL) departing from the master node and reaching the slave node. At the same time, the likelihood of damage transmis- sion actually taking place is measured by a conditional probability named interdependence strength, Istr [12,21,33]. Fig. 2 illustrates the proposed abstraction of lifeline networks and interdepen- dence interface representation.

The set of all interdependence links (ILs) between two net- works forms their interdependence interface. Note that since ILs can point in one of two possible directions, the description of the interface’s topology between two networks requires two rectan- gular interdependence matrices, Im. An interdependence matrix is built as an adjacency matrix with the difference that nodes joined by an IL belong to different systems, and thus the two dimensions of an Im matrix may not be equal. For the case of two inter- dependent networks, S1 and S2, a location (i,j) in the interdepen- dence matrix Im12 is filled with a 1 if the link i-j (iAS1 ,jAS2 ) exists, otherwise the location is filled with a 0. Note that the existence of the reverse link j-i is recorded in Im21 rather than in Im12 ensuring that each interdependence matrix exclusively represents one of the two opposite directions of interaction (S1-S2 or S2-S1, as in Fig. 2(b)).

Each IL features an associated interdependence strength value, Istr (Fig. 2(b)). In each link, Istr denotes the conditional probability of failure of the slave node given the failure of its external master node. Istr captures the uncertainty on the strength of interconnec- tion between interdependent nodes, and as a probability, it can take values in the range [0, 1]. Kim et al. [23] interpret Istr as the

I. Hernandez-Fajardo, L. Dueñas-Osorio / Reliability Engineering and System Safety 111 (2013) 260–272 265

probability of failure of the backup system for the slave node in the event of failure of the master node. Note that although Istr is concentrated on the interdependency-induced nodal failure event probabilities, it is not necessarily a mutually exclusive event relative to direct nodal failures from external perturbations. An account of the union of events leading to component failures from perturbations and interdependence is presented by Poljanšek et al. [33].

3.2. Interdependent fragility assessment

The existence of interdependence allows the possibility that the fragility of one network may affect the response of external systems. This paper studies such fragility propagation by simulat- ing failures spreading from failed nodes in a system to surviving, dependent components in external networks. Algorithm 2 describes the procedure used for interdependent damage simula- tion under a perturbation scenario.

Algorithm 2. Simulation steps for interdependent systemic performance.

1:

Load descriptions for all systems (S1, S2,y): Adjacency matrices, costs, etc.

2:

Calculate NBCOD. Establish proxy estimation of flow

capacities, CaðkÞ, for each k node in intact networks.

3:

Simulate Direct Damage on components. Assessment of

hazard action. x DDS stage

4:

while new failures in any network exist do

5:

Estimate Disconnection Failures. Isolated nodes are

detected. x DFE stage

6:

Estimate Cascading Failures. Update proxy flow

loads. x CFE stage

7:

while there is new damage do

8:

for i¼1-number_of _systems do

9:

Select master system, SM (each system will be

master once)

10:

Identify failed nodes in SM

11:

Find external nodes depending on SM’s failed nodes

(Use Im’s)

12:

Simulate status of depending external nodes (Use

Istr’s)

13:

Update interdependent damage data structures

14:

end for

15:

Propagate accumulated interdependent damage to all

systems

16:

end while

17:

end while

18:

Calculate Systemic Performance (SPC) x SPC stage

Algorithm 2 enhances Algorithm 1 by adding an internal loop (steps 7–16 ) for interdependent damage propagation. Note that the information in the interdependence matrices Im allows the identification of potentially damaging ILs in step 11. In addition, Istr values are used to determine the status of dependent nodes in step 12 using a Bernoulli trial as in the direct damage assessment stage (step 3). The process of identification of interdependence- induced failures (internal loop) continues until all networks jointly achieve stability.

Three principles control the design of the interdependence simulation iteration in Algorithm 2. First, perturbation effects are evaluated independently for each lifeline system, which implies that each network reaches a stable state individually before being affected by interdependence. Second, the status of each network

is temporal and the stabilization process is cyclical: systems stabilize locally but during that process they may induce disrup- tions in external networks. Finally, intersystemic damage propa- gation is instantaneous: interdependent damage is propagated simultaneously to all networks and an affected system cannot monitor the source of a particular interdependent failure. The authors have found that this instantaneous propagation captures well interdependent dynamic effects when compared to desirable ordered interdependent propagation sequences [20].

4. Test case: interdependent power and water systems

4.1. Sources of external perturbation

This case study subjects test networks to the action of earth- quake scenarios and random failures. The characteristics of the two threats under consideration are as follows.

4.1.1. Earthquake scenarios

Earthquake scenarios represent the action of a single seismic event on the integrity of the test interdependent networks. The simulation uses attenuation models to reflect the geographical distribution of peak ground accelerations (PGA’s) at network components. This attenuated intensity and the node’s limit state define the component fragility (i.e., its conditional probability of failure under the given intensity). Details on the treatment of earthquake scenarios for fragility assessment can be found else- where [12,16].

For the case of earthquake-induced failures, the Direct Damage Simulation (DDS) stage in Algorithm 2 uses component fragilities from HAZUS-MH, with an extensive damage limit state. For the water system, exceeding this performance level implies damage beyond repair for pumps and severe damage for storage tanks, while the power system exceeding the limit state results in the failure of at least 70% of internal devices in substations and considerable damage to pumps in generation plants.

For all types of perturbation, the stability of probabilistic systemic performance estimates requires a certain amount of simulations. Such number depends on the component fragilities, the network topologies, and the properties of the interdepen- dence interface. For the networks in this test case, the authors assessed via trial simulations that 5000 simulations guarantee stability in the estimates for the conditions of the illustrative example.

4.1.2. Random failures

Random failures are nodal breakdowns occurring indepen- dently from internal flow dynamics or external perturbations. Previous research discussed the random failure effects in single networks [2,6,9]. The objective of this example consists on measuring their potential effect on interdependent networks.

The intensity of a random failure scenario is measured in terms of Removed Nodal Fraction (RNF). RNF indicates the percentage of the total network nodes randomly failed (i.e., removed) in a perturbation scenario. For a given RNF the generation of a perturba- tion scenario follows three steps. First, the total number of nodes to remove is calculated; second, Bernoulli trials are applied to ran- domly selected nodes until the required number of failed nodes is reached; and third, lists of randomly failed nodes, one for each network, are generated. As for the case of earthquake perturbation, 5000 simulations were used for the estimation of systemic fragility under each of the test scenarios.

Fig. 3. (a) Power system (S1) in test example: 59 nodes and 73 links. (b) Water system (S2): 49 nodes and 71 links [12]. Shelby county has an area of 2031 km 2 and is

inhabited by approximately 900,000 people [41].

Low Voltage Substation High Voltage Substation

0 0.1 0.2 0.3 0.4 0.5 0.6 0

0.2

0.4

0.6

0.8

1

PGA (g)

P (

D S

> =

E xt

en si

ve |

P G

A )

Medium/Large Pumping Plant Above Ground Steel Tank

0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0

0.2

0.4

0.6

0.8

1

PGA (g)

P (

D S

> =

E xt

en si

ve |

P G

A )

0.7

Fig. 4. (a) Seismic fragilities for power components for an extensive damage state (DS). (b) Seismic fragilities for water components. Comparison of figures (a) and

(b) reveals that power components are more fragile than their water counterparts.

Soil liquefaction is not considered in these fragilities.

I. Hernandez-Fajardo, L. Dueñas-Osorio / Reliability Engineering and System Safety 111 (2013) 260–272266

4.2. Test networks and interdependence interface

The test networks are a power sub-transmission system and a potable water mains network (Fig. 3). The power and water networks are identified hereafter as S1 and S2, respectively. The test systems represent realistic, simplified networks serving Shelby county, TN, USA (county area: 2030 km2) [36]. S1 has 59 nodes and 73 links, while S2 has 49 nodes and 71 links. The description of the topologies and general properties of the test systems presented here is based on [12].

The power system has three types of nodes: gate stations, 23 kV substations, and 12 kV substations. The gate stations of the real network are identified as the supply nodes of its network model, while 12 kV and 23 kV substations are represented as power con- sumption nodes. According to this classification, S1 has eight supply nodes, 37 consumption nodes, and 14 transshipment nodes. Trans- shipment nodes represent crossing points or locations where trans- mission lines intersect. The labeling of nodes follows the previous classification: nodes labeled 1–8 are supply nodes, nodes labeled 9–45 are consumption nodes, and nodes 46–59 are transshipment nodes.

Fig. 4(a) presents HAZUS-MH seismic fragilities for power net- work components. These fragilities contain three assumptions. First, gate stations behave as high voltage substations; second, both types of power substation (12 kV and 23 kV substations) behave as low voltage substations responding similarly under earthquake action; and third, transshipment nodes do not fail in the event of earth- quake. The first two of these assumptions allow the use of HAZUS- MH fragilities, but such a simplification can be removed by replacing the fragility in question with refined data when available. For the third simplification, it can be argued that junctions in real power networks do not contain major structures vulnerable to earthquakes what makes them much less fragile than other power components. All three simplifications could be eliminated by the future availability of additional information and its use for updating the probabilistic seismic response of components [38].

For the water network, four types of nodes are considered: storage tanks, large pumps, pipe junctions, and terminal points. The S2’s graph representation has storage tanks and large pumps as supply nodes, and pipe junctions and terminal points as consumption nodes. Based on this classification, S2 has 15 supply nodes, 34 consumption nodes, and no transshipment nodes. For these components, nodes 1–15 are supply nodes, while nodes 16–49 are consumption nodes.

In terms of the seismic fragility of water components, HAZUS- MH provides direct earthquake fragility curves for storage tanks and pumps based on their response to PGA. In contrast, the fragility of junctions and terminal points depends on the seismic response of the associated pipes whose failure rates and break

probabilities depend on Peak Ground Velocity (PGV) rather than on PGA [30]. Hence, it is assumed here that a junction node fails whenever each of its associated pipes suffers at least one break [12]. However, note that the estimations of water fragilities do not include soil deformation or liquefaction effects, factors known to be responsible for considerable pipeline damage in recent earthquake experiences [22,29,43]. Fig. 4(b) displays the seismic fragility curves for the storage tanks and pumps.

The test interdependence interface is based on the geographic proximity principle discussed in Dueñas-Osorio et al. [12]. Fig. 5(a) presents Im12, the interdependence matrix for the dependence of S2 on S1 (S1-S2, water-on-power dependence),

P ow

er s

ys te

m

W at

er s

ys te

m

T

T

D

D

D

G G

G DG Water system Power system

10 20 30 40 49

59

50

40

30

20

10

Total IL = 9

Total IL = 45

49

40

30

20

10

10 20 30 40 50 59

Fig. 5. (a) Im12’s structure. (b) Im21’s structure. Points in the images are associated to interdependence links in the direction indicated by the matrix’s name.

1

0.8

0.6

0.4

0.2

0 0 0.1 0.2 0.3 0.4 0.5 0.6 0.7

Peak Ground Acceleration, PGA (g) 0 0.1 0.2 0.3 0.4 0.5 0.6 0.7

Peak Ground Acceleration, PGA (g)

0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 Peak Ground Acceleration, PGA (g)

0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 Peak Ground Acceleration, PGA (g)

P ro

ba bi

lit y

of E

xc ee

da nc

e

1

0.8

0.6

0.4

0.2

0P ro

ba bi

lit y

of E

xc ee

da nc

e

1

0.8

0.6

0.4

0.2

0P ro

ba bi

lit y

of E

xc ee

da nc

e

1

0.8

0.6

0.4

0.2

0P ro

ba bi

lit y

of E

xc ee

da nc

e

20% 40% 50%

80% 60%

90%

CL limit State 20% 40% 50%

80% 60%

90%

CL limit State

20% 40% 50%

80% 60%

90%

CL limit State

20% 40% 50%

80% 60%

90%

CL limit State

Fig. 6. Interdependent Systemic Fragility Plots (ISFP) for earthquake perturbation. (a and b) (top row) ISFPs for S1, while (c and d) (bottom row) ISFPs for S2. The left column displays independent systemic fragility (Istr¼0) under small local redundancy (a¼0:5). The right column (Istr¼1.0, a¼1:5) matches the full interdependence strength against an enhanced redundancy level. (For interpretation of the references to color in this figure, the reader is referred to the web version of this article.)

I. Hernandez-Fajardo, L. Dueñas-Osorio / Reliability Engineering and System Safety 111 (2013) 260–272 267

while Fig. 5(b) presents Im21, the interdependence matrix for the dependence of S1 on S2 (S2-S1, power-on-water dependence).

Fig. 5 sketches the structure of the test interdependence matrices. These diagrams display two relevant features. First, the number of links reaching S1 from S2 (45 links) is five times the number of links reaching S2 from S1 (nine links), i.e., there exists asymmetry in the density of interdependence links between the two directions of interaction. Second, the nine links in Im12 go from fragile power consumption nodes to the critical water system supply nodes; in contrast, the 45 links in Im21 go from robust water consumption nodes to power supply (eight links) and consumption (37 links) nodes. These two features show that the test water system depends heavily on power at the production facilities level (pumps and tanks), whereas its consumption nodes are free from such dependence. For the power system, its functionality could depend on the water system both at the supply and consumption levels, with more links concentrated at consumption nodes. These notice- able asymmetries in interdependence density and criticality show in

qualitative terms that both networks, power and water, could affect each other substantially. In particular, results show that the magni- tude of such interactions is shaped by the intensity of the perturba- tion, coupling strength, and component fragilities of each network.

4.3. Results

Figs. 6 and 8 present Interdependent Systemic Fragility Plots, ISFPs, for selected combinations of Istr and a levels under seismic and random perturbations, respectively. Results in Fig. 6 reflect probabilistic systemic earthquake response for PGA intensities ranging from 0.1 g to 0.7 g, with a 0.1 g increasing step experi- enced simultaneously by both networks. Fig. 8 presents analogous results for random failures inducing RNFs of 3%, 6%, 9%, 12%, and 15% of the total number of nodes in each system.

Figs. 7 and 9 present Systemic Fragility Summary Plots, SFSPs. For earthquake perturbation, these plots use selected PGAs of 0.2 g and 0.5 g to contrast the effects of increased perturbation intensity. The

1

0.8

0.6

0.4

0.2

0 0 0.25 0.5 0.75 1 1.25 1.5

Local Redundancy 0 0.25 0.5 0.75 1 1.25 1.5

Local Redundancy

0 0.25 0.5 0.75 1 1.25 1.5 Local Redundancy

0 0.25 0.5 0.75 1 1.25 1.5 Local Redundancy

E [C L]

1

0.8

0.6

0.4

0.2

0

E [C L]

1

0.8

0.6

0.4

0.2

0

E [C L]

1

0.8

0.6

0.4

0.2

0 E

[C L]

E [CL]

σ [CL]

Istr 0.00 0.30 0.50 0.70 1.00

Istr 0.00 0.30 0.50 0.70 1.00

Istr 0.00 0.30 0.50 0.70 1.00

Istr 0.00 0.30 0.50 0.70 1.00

Fig. 7. Systemic fragility summary plots for PGAs 0.2 g and 0.5 g. These plots display means (E½CL�, solid lines) and standard deviations (s½CL�, dotted lines) of Connectivity Loss, CL for the test systems (power, S1, and water, S2) under different levels of a (local redundancy) and Istr values. (a) Summary plot for S1; PGA¼0.2 g. (b) Summary plot for S1; PGA¼0.5 g. (c) Summary plot for S2; PGA¼0.2 g. (d) Summary plot for S2; PGA¼0.5 g.

I. Hernandez-Fajardo, L. Dueñas-Osorio / Reliability Engineering and System Safety 111 (2013) 260–272268

same rationale applies for the selection of 3% and 12% RNFs used for random failures.

For the fragility results discussed below, the input parameter Istr takes values of 0, 0.3, 0.5, 0.7, and 1.0, while the a parameter takes values of 0.25, 0.5, 0.75, 1.0, 1.25, and 1.5.

4.3.1. Earthquake scenarios: Interdependent Systemic Fragility Plots

The results in Fig. 6(a) and (c) describe the response of the test networks acting independently from each other (Istr¼0) and with a moderate amount of local redundancy (a¼0:5) applied to all network nodes. These plots highlight the following: (1) the power network is more fragile to earthquake than the water system of this study and (2) the water system does not surely fail even under the action of the largest PGA value considered (0.7 g). The plots also show that the water systemic fragility curves are well distributed across the PGA range for different CL levels, and while the damage induced by larger intensities is noticeable, the water network does not suddenly collapse from a PGA value to the next, as it occurs for the power system after the PGA¼0.1 g mark.

The sudden deterioration of the power network performance is clear: the probability of exceeding (POE) CL¼20% (blue starred lines) soars from 5.6% under 0.1 g to 94% under 0.2 g (red arrows and boxes in Fig. 6(a)), 16.7 times larger than the first value. Due to the absence of interdependence, the behavior of both networks can be analyzed using only component fragilities and intrinsic network properties. The power network fails in this way because its essential supply nodes are too fragile against earthquake action (Fig. 4(a)). For this system, a PGA of 0.2 g is associated with a median fragility of its supply nodes of 0.337 (0.348 mean), a value forty-two times larger than the median fragility of the same nodes under PGA¼0.1 g (0.008, 0.01 mean). An equivalent examination for the water system produces median values of 0.00 under PGA¼0.1 g and 0.01 for PGA¼0.2 g. The change for the water network is clearly much smaller than that experienced by the power system, a trend that persists for the entire PGA test range and that helps to explain the smooth evolution of the water ISFPs.

Fig. 6(b) and (d) display network response under Istr¼1.0 and a¼1:5. Under this condition, the power ISFPs shows a mixed combination of a small increase on the POE for CL¼90% with POE reductions for all other CL values used as limit states. In contrast to the power system behavior, the water network shows substantial fragility increases for all CL values despite increased local capacities. The observed trends suggest two effects: (1) water-on-power action seems to be minimal when compared with the power-on-water effects and (2) the enhanced local redundancy has a positive, although limited influence on systemic responses. The nature of the first trend is discussed below, while the scope of the second is explored in detail using the results in the next section.

The first trend is of interest as full interdependence seems to have no noticeable effect on the power network, while at the same time, it has a substantial influence on the water network response, except for very high CL levels which are rather depen- dent on local redundancy. The joint reaction to interdependence can be better described using a two-zones partition of the intensity range using PGA¼0.2 as a threshold. For PGAo0:2 g, both networks are likely to retain most of their their connectivity; however, for PGAZ0:2 g, their responses worsen quickly and considerably. The explanation for this behavior is that for PGAs larger than 0.2 g, the power system’s condition redefines the interdependence relationship into a unidirectional power-on- water effect in which the seismically fragile power system leads water supply nodes to failure. These failures of water supply components easily translate into systemic losses of original connectivity as displayed in the water’s ISFP in Fig. 6(d). The reaction of the water system through interdependent links reach- ing back to power components is only marginal given that the power system has already reached an advanced damage level due to its own considerable seismic fragility.

4.3.2. Earthquake scenarios: systemic fragility summary plots

Fig. 7 contains SFSPs for both test networks under a PGA of 0.2 g in the left column and of 0.5 g in the right one.

1

0.8

0.6

0.4

0.2

0 0 3 6 9 12 15

Removed Nodal Fraction, RNF (%n)

0 3 6 9 12 15

Removed Nodal Fraction, RNF (%n)

0 3 6 9 12 15

Removed Nodal Fraction, RNF (%n)

0 3 6 9 12 15

Removed Nodal Fraction, RNF (%n)

CL limit state 20% 40% 50% 60% 80% 90%P

ro ba

bi lit

y of

E xc

ee de

nc e

1

0.8

0.6

0.4

0.2

0

P ro

ba bi

lit y

of E

xc ee

de nc

e

1

0.8

0.6

0.4

0.2

0

P ro

ba bi

lit y

of E

xc ee

de nc

e

1

0.8

0.6

0.4

0.2

0

P ro

ba bi

lit y

of E

xc ee

de nc

e

CL limit state 20% 40% 50% 60% 80% 90%

CL limit state 20% 40% 50% 60% 80% 90%

CL limit state 20% 40% 50% 60% 80% 90%

Fig. 8. ISFPs for the test networks under random failures. Plots for S1 are displayed in the top row (a and b). ISFPs for S2 are in the bottom row (c and d). (a) ISFPs for S1; Istr¼0.0; a¼0:5. (b) ISFPs for S1; Istr¼1.0; a¼1:5. (c) ISFPs for S2; Istr¼0.0; a¼0:5. (d) ISFPs for S2; Istr¼1.0; a¼1:5. (For interpretation of the references to color in this figure, the reader is referred to the web version of this article.)

I. Hernandez-Fajardo, L. Dueñas-Osorio / Reliability Engineering and System Safety 111 (2013) 260–272 269

The comparison of the condition of S1 in Fig. 7(a) and (b) produces a first set of insights.

Fig. 7(a) shows that increasing Istr worsens the power net- work’s E½CL� for all a levels, where the expected value is calculated from all CL simulations at a given PGA. The same figure reveals that adding local redundancy reduces E[CL], and that the CL variability (s½CL�) is rather significant at the selected low PGA level. Also, the short vertical separation between curves for fixed a levels reveals that the effect of Istr is limited. For example, for a¼0:5, increasing Istr from 0 to 1 (leftmost box in Fig. 7(a)) produces a 12% rise in the original E[CL] (0.79 at Istr¼0). This insight of limited inter- dependence effect underlines the impact of component fragility on the power network behavior as also observed in the ISFPs.

Fig. 7(b) highlights the criticality of the perturbation intensity on shaping the impact of interdependence and local redundancy. This figure shows that the power system fails surely under a PGA of at least 0.5 g. Note that the assured systemic collapse occurs independently of the value of Istr and it cannot be moderated by enhancing local redundancy on the power network components.

For the water system, Fig. 7(c) displays the general trends of higher E[CL] when Istrs rises and lower E[CL] induced by higher a’s as observed in the power network response (see red boxes on the figure). However, the water network, being less fragile against seismic perturbation than the power system of this example, shows an additional trend. For Istr¼0, the average independent systemic response shows only a minimal reduction on E[CL] when a increases. This behavior can be explained by the fact that the water network can withstand low perturbation intensities by itself in the absence of interdependence effects.

The water network behavior observed in the remaining Istr curves shows the interplay between the worsening action caused by interdependent damage from the power network and the alleviating effect of local redundancy. In this interaction between a positive and a negative effect it must be observed that once present, negative interdependence effects could not be eliminated even by the highest value of local redundancy (a¼ 1:5). This result shows that the effect of increased local redundancy, typically

aimed at controlling cascading failures, cannot remove global interdependence effects. Also, note the important effects of inter- dependence on the levels of s½CL�. At low PGA levels, interdepen- dence brings about additional potential failure events that are not typically considered in isolated system analyses, thus increasing the associated uncertainty.

Finally, Fig. 7(d) describes the water system’s response for PGA¼0.5 g. This figure reveals two insights. First, the higher perturbation intensity decreases the effectiveness of a to control interdependence effects. This is illustrated by the small change in E[CL] under Istr¼1.0 between a¼ 0:5 and a¼ 1:5 (0:94-0:87 CL; top boxes in Fig. 7(d)), a 7.4% change, much smaller than the 39.2% observed for the same conditions in Fig. 7(c). Second, the potential of a to control systemic damage in the absence of interdependence increases under the same large perturbation intensity. This trend can be explained by considering that when the perturbation intensity increases, the water network is no longer able by itself to control systemic damage, and hence it can use the mitigation potential provided by larger a levels more effectively than in the original case (Fig. 7(c)) where interdepen- dence was absent. Finally, regarding CL uncertainty, interdepen- dencies reduce variability at this PGA level as they contribute to the failure of components already at the onset of direct failure.

4.3.3. Random failures: Interdependent Systemic Fragility Plots

Fig. 8(a) and (c) displays the independent (Istr¼0) response of the test networks under the action of random failures and a moderate level of local redundancy (a¼ 0:5). Under these condi- tions, the power system is consistently the underperformer of the two test networks. In particular, complete collapse is not guar- anteed for any of the two systems, but the likelihood of such event is higher for the power network. For example, most of the power network’s ISFPs curves surpass a 0.5 probability of excee- dance (POE) under an RNF of 6% (red arrow in Fig. 8(a)); in contrast, for the water system, most of the curves passing the 0.5 POE landmark do so at an RNF of 9% (red arrow in Fig. 8(c)).

I. Hernandez-Fajardo, L. Dueñas-Osorio / Reliability Engineering and System Safety 111 (2013) 260–272270

These conditions show that under random failures the grid-like water network performs, in a general sense, better than the more hierarchical power system; however, their fragility differences are clearly not as substantial as under earthquake scenarios.

Fig. 8(b) and (d) present systemic fragilities under full inter- dependence (Istr¼1.0) and enhanced local redundancy (a¼1:5). These plots show a noticeable increase in systemic fragility for both networks. Such increases in fragility occur even after higher levels of local redundancy. These plots showcase, as in the earthquake scenarios, that interdependence effects and local redundancy compete to define systemic fragility values.

4.3.4. Random failures: systemic fragility summary plots

A review of Fig. 9 shows that the trends observed in the SFSPs under earthquake perturbation persist for the case of random failures. Fig. 9(a) and (c) present the average response of the test networks under a 3% RNF. Under this perturbation intensity, the power system’s performance worsens with increased Istr and improves with increased a, and the magnitude of such changes can be significant in their negative and positive impacts, respectively. For example, for a fixed a¼0:5, the power system’s E[CL] degrades from 0.4 at Istr¼0.0 to 0.92 at Istr¼1.0, a 130% E[CL] increase. Likewise, for the water network, for an a¼ 0:5, its E[CL] increases from 0.32 at Istr¼0.0 to 0.86 at Istr¼1.0, a 169% systemic degradation. The same changes for a¼ 1:5 are of 222% (0:18- 0:58 in E[CL]) for the power system, and of 135% (0:2-0:47 in E[CL]) for the water network. These results show that the water systems performs slightly better than the power system for all levels of Istr and a, and also that, in contrast to the earthquake case, the magnitude of changes in performance for both networks are comparable. Also note that the uncertainty in CL increases when interdependencies are accounted for, particularly for important values of a as new failure possibilities are created.

Fig. 9(b) and (d) show the effects of a 12% RNF for the test networks. The comparison of the Istr¼0.0 and Istr¼1.0 curves of these plots against their equivalent in the left column of the same figure reveals a key insight: local redundancy restrains the negative effects of increased perturbation intensity and

1

0.8

0.6

0.4

0.2

0 0 0.25 0.5 0.75 1 1.25 1.5

Local Redundancy

0 0.25 0.5 0.75 1 1.25 1.5 Local Redundancy

E [C L]

1

0.8

0.6

0.4

0.2

0

E [C L]

Istr 0.00 0.30 0.50 0.70 1.00

0.00 0.30 0.50 0.70 1.00

Istr

Fig. 9. Random failures summary plots for RNF 3% and 12%. These plots display means ( CL for the test systems for a variety of a (local redundancy) and Istr values. (a) Summary RNF¼3%. (d) Summary plot for S2; RNF¼12%.

interdependence, but its fragility control effectiveness decays noticeably as RNF increases. The observation of the effects of higher a on the water system’s Istr¼1.0 curves (top boxes in Fig. 9(c) and (d)) provides evidence supporting this insight (analogous trends are observed for the power system). For the first plot (RNF¼3%), an a increase from 0.5 to 1.5 reduces E[CL] by 83% (0:86-0:47); meanwhile, in the second plot (RNF¼12%), the positive effect of a reduces CL only by 14.6% (0:94-0:82), a reduction of about one-sixth of the original alleviating capacity of the local redundancy factor. Finally, the uncertainty in CL also decreases with interdependent effects, as high levels of RNF stress the network to levels under which interdependencies simply reinforce the system’s inherent likelihood of failure.

5. Conclusions and future work

This paper discussed a simulation-based methodology for the assessment of the fragility of interdependent urban service net- works subjected to external perturbations. The proposed proce- dure considers simultaneously the impact of perturbation type and intensity, component fragilities, local capacity redundancies, and interdependence properties on the processes leading to damage propagation and systemic fragility degradation. The illustrative test case developed in this article showcased the effects of such factors on the probabilistic response of interde- pendent networks under earthquake scenarios and random fail- ures of different intensities and for several combinations of interdependence strength (Istr) and local redundancy (a).

The methodology proposed in this work contributes to the literature by its explicit combination of component fragilities and interdependence effects with the important factor of cascading failures in interdependent networks. The last phenomenon had been studied for the case of single networks, but it had never being integrated into fragility studies for interdependent urban infrastructure systems subjected to seismic and random pertur- bations. Additionally, this study highlights the effects of

0 0.25 0.5 0.75 1 1.25 1.5 Local Redundancy

0 0.25 0.5 0.75 1 1.25 1.5 Local Redundancy

1

0.8

0.6

0.4

0.2

0

E [C L]

1

0.8

0.6

0.4

0.2

0

E [C L]

Istr 0.00 0.30 0.50 0.70 1.00

Istr 0.00 0.30 0.50 0.70 1.00

E½CL�, solid lines) and standard deviations (s½CL�, dotted lines) of Connectivity Loss, plot for S1; RNF¼3%. (b) Summary plot for S1; RNF¼12%. (c) Summary plot for S2;

I. Hernandez-Fajardo, L. Dueñas-Osorio / Reliability Engineering and System Safety 111 (2013) 260–272 271

interdependence on system-level response uncertainty, which tend to increase at low hazard intensity levels and decrease at hazard levels leading to critical direct component failure.

The results from the case study produced two key insights regarding the factors contributing to interdependent systemic fragility:

1.

The magnitude of interdependence effects is a function of the perturbation intensity, the likelihood of damage transmission (Istr),

and the distribution of interdependence links. This insight was exemplified in the way that the test power-on-water system influence, with less interdependence links, was more effective under seismic hazards than its water-on-power counterpart due to the former’s focus on the critical water supply nodes and the inherently high power component fragilities. The clear reduction on the asymmetry of the two interdependence directions under random failures, in which seismic fragility differences were not a factor, only confirms the essential influence of component fragi- lities on the magnification of interdependence effects.

2.

Increasing local redundancy mitigates the fragility effects of interdependence, but it cannot eliminate them completely. For the two types of perturbation explored in the case study, increasing the local redundancy factor a led to a reduction on systemic fragility for all levels of interdependence action; however, such reduction was unable to overcome the action of interdependence, and its alleviating effect decreased under the action of increased perturbation intensity.

These insights lead to two recommendations for future work. First, the intensity of a perturbation is likely to be difficult to forecast and control; however, network properties, topologies, component fragilities, and even interdependence interfaces are amenable to adjustment and retrofitting. Future work on fragility control must focus on strategies that assess and efficiently enhance systemic properties leading to a reduction of systemic fragility. Second, increasing local redundancy does not eliminate the fact that components are fragile to perturbation and that the networks lack internal redundancy or backup systems. Hence, the design of an effective strengthening policy is likely to require measures beyond typical local redundancy fixes. Such policies ought to include measures such as critical component identifica- tion and targeted retrofitting, creation of systemic redundancies, and smart interdependencies redistribution. The effectiveness and the efficiency of such measures applied individually or jointly are key topics for further exploration.

Acknowledgments

This material is based upon work supported by the National Science Foundation under Grant CMMI-0728040. However, the opinions, findings, conclusions or recommendations expressed here are those of the authors and do not necessarily reflect the views of the National Science Foundation.

References

[1] Ahuja RK, Magnanti TL, Orlin JB. Network flows: theory, algorithms, and applications. Englewood Cliffs, NJ: Prentice Hall; 1993.

[2] Albert R, Albert I, Nakarado GL. Structural vulnerability of the North American power grid. Physical Review E 2004;69(February (2)):025103.

[3] American Society of Civil Engineers. Report card for America’s infrastructure. American Society of Civil Engineers; 2009.

[4] Bonneau A, ORourke T, Palmer M. Water supply performance and fire suppression during the world trade center disaster. Journal of Infrastructure Systems 2010;16(4):264–72.

[5] Buldyrev SV, Parshani R, Paul G, Stanley HE, Havlin S. Catastrophic cascade of failures in interdependent networks. Nature 2010;464:1025–8.

[6] Callaway DS, Newman MEJ, Strogatz SH, Watts DJ. Network robustness and fragility: percolation on random graphs. Physical Review Letters 2000;85(December (25)):5468–71.

[7] Chang S, McDaniels T, Mikawoz J, Peterson K. Infrastructure failure inter- dependencies in extreme events: power outage consequences in the 1998 Ice Storm. Natural Hazards 2007;41:337–58.

[8] Clinton WJ. The Clinton administration’s policy on critical infrastructure protection: presidential decision directive; May, 1998. p. 63.

[9] Cohen R, Erez K, ben Avraham D, Havlin S. Breakdown of the Internet under intentional attack. Physical Review Letters 2001;86(April (16)):3682–5.

[10] Crucitti P, Latora V, Marchiori M. Model for cascading failures in complex networks. Physical Review E 2004;69(April (4)):045104.

[11] Diestel R. Graph theory, Graduate texts in mathematics, vol. 173, third ed. Heidelberg: Springer-Verlag .

[12] Dueñas-Osorio L, Craig J, Goodno B. Seismic response of critical interdepen- dent networks. Earthquake Engineering & Structural Dynamics 2007;36(2): 285–306.

[13] Duenas-Osorio L, Rojo J. Reliability assessment of lifeline systems with radial topology. Computer-Aided Civil and Infrastructure Engineering 2011;26(2): 111–28.

[14] Duenas-Osorio L, Vemuru SM. Cascading failures in complex infrastructure systems. Structural Safety 2009;31(2):157–67 (Risk Acceptance and Risk Communication, Risk Acceptance and Risk Communication).

[15] Ehlen M, Scholand A. Modeling interdependencies between power and economic sectors using the n-able agent-based model. In: Power engineering society general meeting, June 2005. IEEE; 2005. p. 2842–46 .

[16] Federal Emergency Management Agency. HAZUS-MH MR4 technical manual. Washington, DC: Federal Emergency Management Agency (FEMA); 2003.

[17] Freeman L. A set of measures of centrality based on betweenness. Sociometry 1977;40(1):35–41.

[18] Ginsburgh V, Keyzer M. The structure of applied general equilibrium models. MIT Press; 2002.

[19] Haimes Y, Jiang P. Leontief-based model of risk in complex interconnected infrastructures. Journal of Infrastructure Systems 2001;7(1):1–12.

[20] Hernandez-Fajardo I, Dueñas-Osorio L. Models of interdependence propaga- tion for the fragility assessment of urban networks. In: Proceedings of the 11th international conference on applications of statistics and probability in civil engineering (ICASP11); August, 2011.

[21] Hernandez-Fajardo I, Dueñas-Osorio L. Sequential propagation of seismic fragility across interdependent lifeline systems. Earthquake Spectra 2011;27(1): 23–43.

[22] Idriss I, Boulanger R. Soil liquefaction during earthquakes. Oakland, CA: Earthquake Engineering Research Institute; 2008 [Monograph MNO-12].

[23] Kim Y, Spencer B, Elnashai A, Song J. Seismic performance assessment of interdependent lifeline systems. International Journal of Engineering Under Uncertainty: Hazards, Assessment, and Mitigation 2009;1(3–4):173–81.

[24] Li J, He J. A recursive decomposition algorithm for network seismic reliability evaluation. Earthquake Engineering & Structural Dynamics 2002;31(8): 1525–39.

[25] Liscouski B, Elliot W. Final Report on the August 14, 2003 blackout in the United States and Canada: causes and recommendations. Technical report. U.S.–Canada Power System Outage Task Force; August, 2004.

[26] McDaniels T, Chang S, Peterson K, Mikawoz J, Reed D. Empirical framework for characterizing infrastructure failure interdependencies. Journal of Infra- structure Systems 2007;13(3):175–84.

[27] Motter AE, Lai Y-C. Cascade-based attacks on complex networks. Physical Review E 2002;66(December (6)):065102.

[28] Nuti C, Rasulo A, Vanzi I. Seismic safety evaluation of electric power supply at urban level. Earthquake Engineering & Structural Dynamics 2007;36(2): 245–63.

[29] Orense R. Soil liquefaction during the 2010 Darfield and 1990 Luzon Earth- quakes: a comparative study. In: Proceedings of the ninth pacific conference on earthquake engineering building an earthquake-resilient society; April, 2011.

[30] O’Rourke M, Ayala G. Pipeline damage due to wave propagation. Journal of Geotechnical Engineering 1993;119(9):1490–8.

[31] Ouyang M, Dueñas-Osorio L. An efficient approach to compute generalized interdependent effects between infrastructure systems. Journal of Computing in Civil Engineering 2011 (January).

[32] Ouyang M, Hong L, Mao Z-J, Yu M-H, Qi F. A methodological approach to analyze vulnerability of interdependent infrastructures. Simulation Model- ling Practice and Theory 2009;17(5):817–28.

[33] Poljanšek K, Bono F, Gutiérrez E. Seismic risk assessment of interdependent critical infrastructure systems: the case of European gas and electricity networks. Earthquake Engineering & Structural Dynamics 2012;41(1):61–79.

[34] Reed DA. Electric utility distribution analysis for extreme winds. Journal of Wind Engineering and Industrial Aerodynamics 2008;96(1):123–40.

[35] Rosato V, Issacharoff L, Tiriticco F, Meloni S, De Porcellinis S, Setola R. Modelling interdependent infrastructures using interacting dynamical models. International Journal of Critical Infrastructures 2008;4(1):63–79.

[36] Shinozuka M, Rose A, Eguchi R. Engineering and socioeconomic impacts of earthquakes—an analysis of electricity lifeline disruptions in the New Madrid area. Buffalo, NY: Multidisciplinary Center for Earthquake Engineering Research, MCEER, Monograph 2; 1998.

[37] Song J, Kang W-H. System reliability and sensitivity under statistical dependence by matrix-based system reliability method. Structural Safety 2009;31(2):148–56.

I. Hernandez-Fajardo, L. Dueñas-Osorio / Reliability Engineering and System Safety 111 (2013) 260–272272

[38] Straub D, Der Kiureghian A. Bayesian network enhanced with structural reliability methods: methodology. Journal of Engineering Mechanics 2010;136(10):1248–58.

[39] Svendsen NK, Wolthusen SD. Connectivity models of interdependency in mixed-type critical infrastructure networks. Information Security Technical Report 2007;12(1):44–55.

[40] Takewaki I. Preliminary report of the 2011 off the Pacific coast of Tōhoku Earthquake. Journal of Zhejiang University Science A 2011;12(5):327–34.

[41] U.S. Census Bureau. Population estimate for Shelby County, Tennessee /http://1.usa.gov/lA2j1LS; 2011, June 16.

[42] Wang J-W, Rong L-L. Cascade-based attack vulnerability on the US power grid. Safety Science 2009;47(10):1332–6.

[43] Wu J, Dueñas-Osorio L. Calibration and validation of a seismic damage propagation model for interdependent infrastructure systems. Earthquake Spectra, in press.

[44] Zhang P, Peeta S. A generalized modeling framework to analyze interdepen- dencies among infrastructure systems. Transportation Research Part B: Methodological 2011;45(3):553–79.

[45] Zio E, Sansavini G. Modeling interdependent network systems for identifying cascade-safe operating margins. IEEE Transactions on Reliability 2011;60(1):94–101, http://dx.doi.org/10.1109/TR.2010.2104211.

[46] Ferrario E, Zio E. A system-of-systems framework of nuclear power plant probabilistic seismic hazard analysis by fault tree analysis and Monte Carlo simulation. In: PSAM11 & ESREL 2012, June 2012; p. 1–10.

[47] Zio E, Sansavini G. Modeling cascading failures in ‘systems of systems’ with uncertain behavior, In: Proceedings of the 11th International conference on applications of statistics and probability in civil engineering (ICASP11), August 1–4, 2011; p. 1858–1866.

[48] Dueñas-Osorio L, Kwasinski A. Quantification of lifeline system interdepen- dencies after the 27 February 2010 Mw 8.8 offshore Maule, Chile earthquake. Earthquake Spectra 2012;28(S1):S581–603.