Review on Energy Resilience

ResilienceofCriticalInfrastructures_ReviewandAnalysisofCurrentApproaches.pdf

Home >Computer Science homework help >Review on Energy Resilience

Risk Analysis, Vol. 38, No. 11, 2018 DOI: 10.1111/risa.13166

Resilience of Critical Infrastructures: Review and Analysis of Current Approaches

Corinne Curt1,∗ and Jean-Marc Tacnet2

In crisis situations, systems, organizations, and people must react and deal with events that are inherently unpredictable before they occur: vital societal functions and thus infrastruc- tures must be restored or adapted as quickly as possible. This capacity refers to resilience. Progress concerning its conceptualization has been made but it remains difficult to assess and apply in practice. The results of this article stem from a literature review allowing the analysis of current advances in the development of proposals to improve the management of infras- tructure resilience. The article: (i) identifies different dimensions of resilience; (ii) highlights current limits of assessing and controlling resilience; and (iii) proposes several directions for future research that could go beyond the current limits of resilience management, but subject to compliance with a number of constraints. These constraints are taking into account differ- ent hazards, cascade effects, and uncertain conditions, dealing with technical, organizational, economical, and human domains, and integrating temporal and spatial aspects.

KEY WORDS: Critical infrastructure; disaster; resilience

1. INTRODUCTION

A critical infrastructure (CI) is defined as a “point, system or part of one . . . essential for main- taining the vital functions of a society, and the health, safety, security and economic and social well-being of the community, whose cessation or destruction would have a significant impact” (European Com- mission, 2008). CIs fulfill this role in different sectors: transport (road and rail networks, etc.), energy, com- munication, water supply, the nuclear industry, etc. The impact of their failure can be expressed by the severity of its effect (duration of lack of service, eco- nomic losses), the extent of the area and the number

1Irstea, UR RECOVER, Centre d’Aix-en-Provence, 3275 Route de Cézanne, CS 40061, 13182, Aix-en-Provence Cedex 5, France.

2University of Grenoble Alpes, Irstea, UR ETGR, Centre de Grenoble, 38402, St-Martin-d’Hères, France.

∗Address correspondence to Corinne Curt, Irstea, UR RECOVER, Centre d’Aix-en-Provence, 3275 Route de Cézanne, CS 40061, 13182 Aix-en-Provence Cedex 5, France; [email protected].

of persons affected, and the speed of recovery from the failure.

The concept of risk is based on identifying a threat and its associated consequences and losses. Its management is aimed at analyzing the level of risk, proposing measures of reducing it, anticipating crises, setting up contingency planning, etc. Unfor- tunately, it is practically impossible to fully protect CIs: they are complex and vulnerable systems faced with a wide array of natural and anthropic threats that are also evolutive (Boin & McConnell, 2007; Fritzon, Ljungkvist, Boin, & Rhinard, 2007). History has shown that many natural events (the tsunami in Southeast Asia in 2004; the fires in Greece dur- ing summer 2007; Hurricane Katrina in 2005; the Xynthia storm in February 2010; the accident of Fukushima in March 2011, etc.) and human ones (the terrorist attack at Atocha station in 2004; the accident at the AZF plant at Toulouse in 2001; an increasing number of attacks on the CIs of the mem- bers of the European Thematic Network on Criti- cal Energy Infrastructure Protection in 2012, mainly

2442 Curt and Tacnet

in the form of thefts, vandalism, and cyberterrorism (TNCEIP, 2012), etc.) have had considerable impacts on these infrastructures.

It is obvious that in spite of significant progress, risk management procedures, particularly in contexts that combine natural phenomena and technological accidents, are particularly fallible. The limits of risk management procedures can be attributed notably to:

– Lack of knowledge (unknown threats— “black swan events”) and uncertainty (unex- pected severity of natural phenomena, low- probability events, accidents). Crisis planning is in itself contradictory: How can one plan for a phenomenon that by nature does not match the hypotheses that planners use as their basis for predicting it (Boin & McConnell, 2007)? This situation is aggravated by global changes and the increasing threat of terrorist attacks.

– The growing complexity of large sociotech- nical systems and combinations of organi- zational and technical failures, leading to unexpected situations and/or cascade effects exacerbated by the strong relations forged be- tween infrastructures. Indeed, CIs interact re- ciprocally, notably due to the increased use of information and communication technologies (Vinchon et al., 2011). These interactions are dependencies (one-way relation) and interde- pendencies (two-way relation) liable to pos- sess different natures: physical, geographic, cy- ber, or logical (Rinaldi, Peerenboom, & Kelly, 2001). Strengthening risk management sys- tems in a context of interconnected networks becomes prohibitive financially and in terms of the time needed to implement them (Linkov et al., 2014).

– Insufficient or poorly designed or maintained defense barriers (Kadri, Châtelet, & Chen, 2014; Landucci, Argenti, Tugnoli, & Cozzani, 2015).

– Errors of procedure (error of application or poorly drafted procedures), insufficient safety training effectiveness, or too long response time (Khakzad, Khan, Amyotte, & Cozzani, 2014; Landucci et al., 2015).

CIs are therefore vulnerable to threats and pos- sible transmitters of malfunctions, but vital for re- construction. During an event, risk management measures may be overcome, and systems, organiza-

tions, and populations can be confronted with events that were intrinsically unforeseeable before their oc- currence, and against which they must react and cope. Vital societal functions, and thus infrastruc- tures, must be restored or adapted as quickly as possible. This capacity refers to the concept of re- silience. From the political standpoint, in the begin- ning of the 2000s, it was asserted that it meant “living with” rather than “fighting against” risks, as exempli- fied in the 2002 draft of the UNISDR report “Liv- ing with Risk” (Quenault, 2015). The impossibility of eradicating disasters and the need for prepared- ness to cope with these major crises led to a frac- ture in the use of concepts, hence the gradual slide from vulnerability to resilience. The Hyogo (United Nations/International Strategy for Disaster Reduc- tion (UNISDR), 2005) and Sendai (UNISDR, 2015) Frameworks for Disaster Risk Reduction empha- sized the concept of societal resilience at the global scale.

Resilience is a term for which many defini- tions exist. They generally include different ca- pacities (Bruneau et al., 2005; Francis & Bekera, 2014; Johnsen & Veen, 2013; Labaka, Hernantes, & Sarriegi, 2016; Matzenberger, Hargreaves, Raha, & Dias, 2015; National Academy of Sciences, 2012; Petit et al., 2013; Rosati, Flynn Touzinsky, & Lilly- crop, 2015; Vugrin, Warren, Ehlen, & Camphouse, 2010): to plan and prepare for the adverse events (planification), to reduce the impact of events (ab- sorption or resistance), to minimize the time to re- covery (recovery), and to evolve through the devel- opment of specific processes (adaptability). Aggrega- tion at a higher level was proposed by Holling, who distinguished engineering resilience, which he linked to the capacity of resistance and the speed of return to a state of equilibrium, and ecological resilience, which he associated with adaptability (Holling, 1973). Other terms can also be found in the literature and are combinations of capacities mentioned at the be- ginning of this paragraph. For example, the term restoration refers to the capacities of recovery and adaptability (Kahan, Allen, George, & Thompson, 2009).

From the technical, organizational, social, and economic standpoints, the territories and infrastruc- tures impacted will be capable to a certain extent of reducing the impact of a disruption (natural, human, or a combination of both) and end by recovering and returning to an “acceptable” state. The level reached after the crisis could be poorer than, equal to, or bet- ter than the initial level (cf. Fig. 1). Thus, the level

Resilience of Critical Infrastructures 2443

Time

Initial level

Increased level

2 3

1 Lowered

level

Extent of Latency Limit (Function #2)

Depth of Minimum Performance Boundary

(Function # 2)

Event

Rapidity (Function #2)

Resistance

Minimum Performance Boundary

Performance

Fig. 1. Evolution of levels before and after an event for three functions.

of service of a road infrastructure after a major event could be degraded (a section of the road is closed per- manently, alternative routes exist but lengthen the journey), restored to normal, or improved (follow- ing an event, lanes are widened and thus improve traffic in terms of safety and fluidity). The recovery phase can be more or less rapid. Variables assessing the acceptable threshold of performance or charac- terizing dynamics of recovery have been proposed in the literature: for instance, the minimum perfor- mance boundary is “the lowest acceptable level of performance for the defined function” (Kahan et al., 2009), while the latency limit describes “the maxi- mum amount of time allowable for a function to re- main in a degraded or suboptimal state before it must begin to recover” (Kahan et al., 2009) and rapidity is “the rate or speed at which a system is able to recover to an acceptable level of functionality, after the oc- currence of a disaster event” (Bruneau et al., 2003). Fig. 1 shows a graphical representation of these vari- ables.

Resilience engineering came into being several years ago with the objective of developing methods and tools to improve resilience. “Resilience Engi- neering looks for ways to enhance the ability at all levels of organizations to create processes that are robust yet flexible, to monitor and revise risk mod-

els, and to use resources proactively in the face of disruptions or ongoing production and economic pressures” (Resilience Engineering Association, 2015). Advances have been made regarding the con- ceptualization of resilience: D. Alexander (Alexan- der et al., 2011) presented a history of using the concept of resilience in crisis and risk management and described its evolution. Klein et al. also de- scribed its history in various fields: ecology, social sciences, economics, etc. (Klein, Nicholls, & Thoma- lla, 2003). Analyses of this concept in different fields have been proposed (Birkmann et al., 2012; Mc Lean & Guha-Sapir, 2013), and emphasize, for example, that the concept of institutional and organizational resilience is a relatively recent phenomenon in the literature (Mc Lean & Guha-Sapir, 2013). Most exist- ing definitions express essential aspects of resilience, though apart from a few rare exceptions, they fail to provide quantitative measures, and definitely lack an operational basis for resilience (Alderson, Brown, & Carlyle, 2015). Thus, this concept remains difficult to measure and apply in practice.

The article aims at performing an analysis of cur- rent approaches for the assessment and control of resilience for CIs. It is based on a literature review. Different dimensions of resilience are identified in Section 2; these are necessary for a relevant analysis

2444 Curt and Tacnet

of current approaches. Sections 3 and 4 point out the current limits of systems for evaluating and managing resilience. The article ends with Section 5, in which several directions for future research that could go beyond the current limits of resilience management are proposed, provided that a certain number of con- straints are taken into account. It also opens the no- tion of resilience to encompass sustainable devel- opment and wider scales (cities, territories, and the community).

2. LITERATURE REVIEW: METHODOLOGY AND FIRST LESSONS

2.1. Methodology

To present a literature review of resilience study, we developed an approach in five steps.

First, to identify the relevant papers, we car- ried out an analysis on the Web of Science (https://www.webofknowledge.com) and the SCO- PUS databases (https://www.elsevier.com/solutions/ scopus), two comprehensive multidisciplinary con- tent search platforms for academic researchers. The requests were:

WoS Research: TI = (Resilience AND (Infras- tructure OR Network NOT Social)) AND TO = (Manag* OR Assess* OR Control OR Indicator OR Metric OR Measure OR Characteri* OR Evaluat* OR Scenario) AND TO = (Resilience AND (Infras- tructure OR Network NOT Social))

Refined by:

– Document Types: (Article or Review). – And Languages: (English). – And Research Areas (Automation Control

Systems Or Physical Geography Or In- struments Instrumentation Or Physics Or Computer Science Or Mathematics Or Con- struction Building Technology Or Science Technology Other Topics Or Energy Fuels Or Engineering Or Telecommunications Or Transportation Or Operations Research Man- agement Science Or Urban Studies Or Geog- raphy Or Water Resources).

Timespan: All years. Indexes: SCI- EXPANDED, SSCI, A&HCI, CPCI-S, CPCI-SSH, ESCI, IC.

SCOPUS Research: TITLE (resilience AND (infrastructure OR network AND NOT social)) AND ABS(manag* OR assess* OR control OR in-

dicator OR metric OR measure OR characteri* OR evaluat* OR scenario) AND (LIMIT-TO (DOC- TYPE, “ar”)) AND (EXCLUDE (SUBJAREA, “MEDI”) OR EXCLUDE (SUBJAREA, “AGRI”) OR EXCLUDE (SUBJAREA, “BIOC”) OR EX- CLUDE (SUBJAREA, “ARTS”) OR EXCLUDE (SUBJAREA, “NEUR”) OR EXCLUDE (SUB- JAREA, “PSYC”) OR EXCLUDE (SUBJAREA, “PHAR”)) AND (LIMIT-TO (LANGUAGE, “English”)).

As our study concerns current approaches, the research was carried out from 2013 until 11/2017. At this step, 223 references were collected (after dupli- cates removing). They represent 70% of the papers published since 1990, justifying the choice of the anal- ysis period.

Second, survey papers, papers dealing with na- tional policies, or resilience conceptualization were mainly used for the analysis of the resilience dimen- sions (Part 3) and removed from the further analysis in step 3. Fifteen papers were identified, leading to consideration of 208 articles for the next step.

Third, abstract and full review refinements were performed. Only papers dealing with assessment and control of CIs’ resilience were kept; articles related to other domains such as ecology or medicine, or pre- senting territorial approaches, etc., were removed. This operation led to keeping 151 references.

Step 4 provides an analysis of papers selected at step 3. Distribution over time, by journals, by types of CIs are presented in Section 2.2 while distributions concerning methods used or developed and types of resilience will be further used to highlight the limits of current approaches (Sections 3 and 4).

2.2. Distribution Analyses

2.2.1. Distribution by Year of Publication

The dynamics of academic research on the as- sessment and control of resilience of CIs are ana- lyzed through its distribution over time. The number of publications dealing with resilience and CI has in- creased significantly over the last five years in com- parison to the previous years as they represent 70% of the total number of articles for the period (1990– 2017). Around 30–35 articles have been published on the topic since the last four years (cf. Fig. 2). The ma- jor disasters mentioned at the beginning of this arti- cle were most certainly the reasons underlying these works. These academic searches have been coupled with the recent government and policy emphasis on resilience mentioned above.

Resilience of Critical Infrastructures 2445

Publish pape

hed rs

2013 2014

Y 2015

Years 2016 2017

Fig. 2. Distribution of papers by year of publication (as of Novem- ber 2017).

Table I. Top Article Sources and Corresponding Number of Papers Published

Journal Title Number of Papers

Reliability Engineering and System Safety

Risk Analysis 6 Transportation Research Part E:

Logistics and Transportation Review 5

Journal of Structural Engineering (United States)

Computers & Industrial Engineering 3 IEEE Communications Magazine 3 International Journal of Critical

Infrastructures 3

Journal of Infrastructure Systems 3 Natural Hazards 3 Optical Switching and Networking 3 Physica A: Statistical Mechanics and its

Applications 3

Telecommunication Systems 3

2.2.2. Distribution by Journal

Ninety-seven different journals from various disciplines were included in this literature review. Table I lists 12 journals that contributed at least three articles examined in this literature review. Among these, Reliability Engineering and Systems Safety is the most significant source followed by Risk Analy- sis and Transportation Research Part E: Logistics and Transportation Review. To complete the list, 14 (resp. 71) different journals published two (resp. one) arti- cles.

2.2.3. Distribution by Type of Infrastructure

Table II shows the distribution of papers related to the various types of infrastructures consid-

Table II. Distribution of the Articles Following the Studied Type of Infrastructure

Types of Infrastructure Number of Papers

Transport 40 Infrastructure or critical infrastructure 22 Communication network 14 Water distribution network 14 Energy infrastructure 13 Interdependent infrastructures 11 Network 11 Supply chain 10 Industrial infrastructures 7 Flood risk infrastructure 4 Health (emergency services – hospital) 2 Data acquisition - supervisory control 1 Heat network 1 Logitics networks 1

ered. The main studied infrastructures are clearly transport (road, railways, maritime, and air trans- port) followed by water and communication networks and energy (electricity and gas) infrastruc- tures. Conversely, works concerning infrastructure such as flood risk management or health are very scarce. Thirty-two papers deal with methodological developments without specific applications (infras- tructure or CI or network in Table II) with possible applications to different types of CIs.

2.3. Resilience Must Be Understood as a Function of Different Dimensions

A bibliographical analysis was performed to identify the specific dimensions of resilience. It is based on the articles collected during the WoS and SCOPUS researches completed with other papers dealing with conceptualization of resilience. The re- sults lead to a better perception of this concept and put in evidence main elements for the analysis of cur- rent approaches.

The analysis allows us to identify four dimen- sions characterizing resilience (cf. Fig. 3):

– The phases of managing an event in re- lation to the capacities of the system pre- sented above (National Academy of Sciences, 2012; Petit et al., 2013): ex ante (planning/ preparation), during the event (absorption), or ex post (recovery and adaptation). They cor- respond to the phases in which infrastructure managers have the opportunity to increase re- silience by reducing vulnerability or the level of risk (McDaniels, Chang, Cole, Mikawoz, &

2446 Curt and Tacnet

Technical

Organisational

Human

Economic

Recover

Absorb

Prepare

Plan

Adapt

Monitor/ Detect

Control Lessons Learned

Anticipate

Domaine s

Mangement phases

Management Components

MIDMR

Surveillance in watchtowers

Domains

Alternative sites for managing disaster

operations

Fund allocation for recovery actions

Management Phases

Redundancy

Resourcefulness

Protectiveness Protectiveness

Fig. 3. Different dimensions of resilience—illustration by examples.

Longstaff, 2008). Resilience is characterized by a temporality that combines the present with the future but also deals actively with problems of insecurity in the past (Cavelty, Kaufmann, & Kristensen, 2015). Resilience must consider different time frames: immedi- ately during the crisis (for example, organizing rescue operations), intermediate (for example, repairs), and long term (for example, recon- struction, relocalization) (Linkov et al., 2014).

– The components of resilience management: anticipation, i.e., predicting the occurrence of an event; monitoring/detection, i.e., identify- ing and interpreting precursory signals; con- trol, i.e., implementing actions of recovery and/or adaptation by evaluating indicators de- fined beforehand; collecting feedback from experience, i.e., analyzing and understand- ing past events in order to fuel anticipation, monitoring/detection; and control (Hollnagel, 2015; Park, Seager, Rao, Convertino, & Linkov, 2013; Sakukai & Kim, 2008).

– The fields (technical, organizational, social, economic, political, hydrological, etc.) con- cerned by resilience (Bruneau et al., 2003; Francis & Bekera, 2014; Roege, Collier,

Mancillas, McDonagh, & Linkov, 2014). Re- silience therefore includes “hard” components that refer to the structural and technical capac- ities of infrastructures and “soft” institutions and components relating to social and human aspects, etc. (Kahan et al., 2009). The influ- ence of CIs on the resilience of communities remains to be studied (Birkmann et al., 2012).

The finalities (robustness and rapidity) and re- sources (redundancy and resourcefulness) defined by Bruneau et al. (Bruneau et al., 2003):

√ robustness: the inherent strength of the system or its elements to withstand external stress or demand without degradation of functioning;√ rapidity: the speed with which disruption can be overcome and services restored;√ redundancy: the extent to which the elements of the system can be substituted; and√ resourcefulness: the capacity to identify prob- lems, establish priorities, and mobilize re- sources (monetary, physical, technological, in- formational, and human) in the case of crisis.

Resources permit improving the finalities: pro- viding redundancy to a CI increases its robustness

Resilience of Critical Infrastructures 2447

and thus its resilience. Nonetheless, robustness does not only depend on redundancy and resourcefulness, it also stems from protection works or equipment planned such as dikes, drainage systems, firewalls, etc. These elements, external to the system studied in terms of resilience, are important resources leading to an improvement of the system robustness. Conse- quently, we propose adding a fifth element, namely, of the type “resource” to this list:

√ protectiveness: the capacity of external works or equipment to protect the system from threats.

The literature shows that resilience must consider several fields (Bach, Bouchon, Fekete, Birkmann, & Serre, 2014; Provitolo, 2013; Zevenber- gen et al., 2015). In line with Bruneau et al. (Bruneau et al., 2003) and Labaka et al. (Labaka et al., 2016), we consider the technical, organizational, human, and economic (TOHE) fields as essential. These dimen- sions were defined by Francis and Bekera (Francis & Bekera, 2014), and Bruneau et al. (Bruneau et al., 2005). The CI must be considered in its environment: its resilience naturally depends on its technical resilience (capacity to fulfill the function, at the necessary level during and after an adverse event) but also organizational resilience (the capacity of organizations to manage installations, maintain key functions, and take decisions to maintain/improve the situation during the event), human (measures specifically designed to decrease the level to which communities and government jurisdictions may be subject to impacts caused by the loss of critical services due to an event, human behaviors during disastrous events), and economic (the capacity to reduce direct and indirect economic losses, the allocation of resources, maintaining activity).

Technical resilience is linked to the perfor- mance of physical systems including their com- ponents, interconnections, and the global systems. Man–machine interfaces (MMIs) are one of the com- ponents of the system to be considered in the case of infrastructures. Works have been performed on in- terface resilience, the latter being defined as the ca- pacity of an MMI to ensure the performances and stability of a system whatever the circumstances, which is to say the occurrence of unexpected or un- precedented disruptions (Enjalbert, Vanderhaegen, Pichon, Ouedraogo, & Millot, 2011; Ouedraogo, En- jalbert, & Vanderhaegen, 2013; Ruault, 2015).

A more resilient system would have lower re- covery costs than one less resilient if both are subject to the same risk. If no effort is made after the disrup- tion, the impacts on the system’s performance can be severe. Conversely, the impacts may be reduced if resources are deployed quickly (Vugrin et al., 2010).

These fields are not independent. For example, the action of emergency services (organizational section) can be adversely affected if the popula- tion moves instead of remaining in place (human section), generating problems of access for these services (Chatry et al., 2010; Curt & Frejaville, 2018).

It is clear that the three dimensions of resilience (management phases, management components, domains) must be taken into account in a single framework to obtain an overall view of this concept. These three dimensions lead to using or developing tools and actions for improving robustness and rapidity of recovery defined as resilience finalities (Bruneau et al., 2003). Fig. 3 presents examples of tools or actions according to these three dimensions. Types of resource (redundancy, resourcefulness, and protectiveness) are also shown for each example. For instance, the Municipal Information Document on Major Risks (MIDMR) is a French anticipatory tool that participates in planning in the human behavior domain and confers protectiveness to the system. Another example concerns personnel assignment to monitoring and watchtowers as a way of detecting forest fires in the framework of preparing for the organizational section and belongs to protectiveness. The choice of alternative sites for crisis management involves planning and anticipation and is part of the redundancy element. The fund allocation for recovery actions concerns economic aspects by the control resources and is part of resourcefulness.

We analyzed the approaches presented in the lit- erature that aim to improve resilience and belong to resilience engineering. These approaches comprise two categories of limitation: those linked to the very principle of the approaches (Section 3) and those linked to the implementation of the process of the evaluation and preventive or corrective control of re- silience (Section 4).

3. LIMITS LINKED TO THE PRINCIPLE OF CURRENT APPROACHES

3.1. Essentially One-Dimensional Approaches

The great majority of approaches are one- dimensional, which reduces the scope of the results:

2448 Curt and Tacnet

Table III. Types of Resilience Addressed in the Literature Survey

Types of Resilience Number of Papers

Technical 90 Technical & economic 39 Multiple (>2 types) 8 Organizational 6 Economic 4 Technical & organizational 2 Technical & human 2

for example, they only consider the technical do- main, the planning phase, etc. Links between dimen- sions are rarely envisaged; but when they are, they are limited, for example, to modeling how physical losses can affect the economic dimension (techni- cal & economic in Table III). Different frameworks have focused on organizational resilience, but have not provided information on how to improve the other dimensions of resilience (technical, economic, and social) (Labaka et al., 2016). The “soft and “hard” aspects of resilience have often been treated separately by different research and political com- munities (technical & organizational or technical & human in Table III), whereas they present interrela- tions (Kahan et al., 2009). Thus, the quantification of resilience involving the different domains remains a challenge (Birkmann et al., 2012).

However, some approaches considering several types of resilience (“Multiple” item in Table III) have been pinpointed: for instance, TOHE types (Labaka et al., 2016; Labaka, Hernantes, & Sarriegi, 2015); technical, organizational, and environmental ones (Hosseini & Barker, 2016; Omer, Mostashari, & Nilchiani, 2013). Moreover, examples of combina- tions of two dimensions can be found in the litera- ture (Domain x Resource in O’Rourke (O’Rourke, 2007)). At present, only one approach combines sev- eral dimensions of resilience and probably provides the fullest framework of analysis. It is the Resilience Matrix developed by the U.S. Army Corps of En- gineers (Linkov et al., 2013). It mixes three dimen- sions: the event management phases (columns of the matrix), the control of resilience, and the domains. However, it keeps a certain number of limits: eco- nomic aspects are not dealt with and it presents (the lines of the matrix) both the capacities (“social” and “physical” aspects) and the control processes (“in- formation” and “cognitive” aspects) of the system according to the same dimension. It is important

to emphasize that this multifaceted approach is not specifically devoted to the resilience of CIs.

3.2. Approaches Barely Cover the Event in Terms of Causes, Propagation, and Effects

Scenario approach permits covering the event in terms of causes, propagation, and effects (see, for example, Fig. 4 where scenarios are represented as a bowtie diagram dedicated to a system compris- ing CIs protected by a dike). Different authors have stated that the resilience process must deal with mul- tirisk sources, multiple scenarios, and cascade ef- fects (Alderson et al., 2015; Chang, McDaniels, Fox, Dhariwal, & Longstaff, 2014; McDaniels, Chang, Hawkins, CHex, & Longstaff, 2015; OECD, 2012, 2014; Ouyang, Duenas-Osorio, & Min, 2012). But, at the same time, the improvement of resilience is mostly defined in the literature as a process with two tasks: the characterization of resilience within a system and the establishment of priorities for ex ante and ex post mitigation actions such as strength- ening the resistance of the system, reorganizing re- sources, etc. (Chang et al., 2014; Francis & Bekera, 2014; McDaniels et al., 2015), which essentially cor- respond to the effects (receptor and consequences in Fig. 4). Some authors even consider that sys- tem malfunctioning is “agnostic to the source of disruption” (Alderson et al., 2015). Nonetheless, in practice, the infrastructure must face different types of risk linked to deliberate and involuntary human actions (human errors, vandalism, terrorism) and natural hazards, which generate different scenarios and thus different impacts on the CI. The sources and scenarios leading to the disruptive event are actually seldom taken into account but works have recently addressed this issue and explicitly quantified resilience against specific scenarios (Hamilton, Lam- bert, Connelly, & Barker, 2016; Thorisson, Lambert, Cardenas, & Linkov, 2017). These developments al- low considering different uncertain future conditions across the system lifecycle, including technology, cli- mate, economy, and others.

We think that it is necessary, in the design of resilience metrics and tools, to take into account sources and scenarios for several reasons:

– the metrics used for evaluating, modeling, and controlling resilience must be adapted for all situations whatever the cause of the event. As myriad hazards of variable magnitudes and du- rations generate different trajectories for the system (Haimes, 2009a, 2009b), it is important

Resilience of Critical Infrastructures 2449

Fig. 4. Example of the source pathway receptor consequence scenario—figure designed using a bowtie diagram for an area protected by a river dike (Ferrer, Curt, Peyras & Tourment, 2015).

to define a set of metrics that could assess the nature and magnitude of the event regardless of the origin of the event;

– interdependencies (physical, cyber, geo- graphic, and logical) between infrastructures and thus cascade effects must be taken into account in the scenarios. However, it appears, for example, that not enough account is taken of the links between the CIs of different sectors, or those beyond the borders of a country (European Commission, 2013);

– preventive actions are characteristic of each source: a natural hazard such as a flood could be dealt with by the existence of a dike, an act of cyber piracy by firewalls, unauthorized ac- cess by detection, etc.

These proposals agree with the works of Bialas (Bialas, 2016).

Representation in the form of scenarios allows grouping all the possibilities considered at a given moment, since this group may evolve with time and as a function of the situation (day/night in relation to different land uses such as shopping precincts, resi- dential districts, etc.) (Vinchon et al., 2011). The en- semble of scenarios defined may cover a wide range of potential events, thereby leading to more efficient decisions for investment during the prevention phase (Turnquist & Vugrin, 2013).

However, it is impossible to enumerate all the scenarios. Thus, the system must be flexible and

Fig. 5. Resilience of critical infrastructures: causes and ex ante and ex post measures.

adaptable regardless of the attack scenario: solutions must be proposed through resilience control systems.

4. LIMITS LINKED TO IMPLEMENTING RESILIENCE CONTROL SYSTEMS

Progress has been made regarding the concep- tualization of resilience, and approaches to control have been developed in the literature. Control en- tails diagnosing the state of the system with respect to its capacities of resilience on the basis of metrics (metrics, indexes), then proposing corrective actions intended to improve these capacities. A chart of this process is shown in Fig. 5. This process is repeated until reaching a predetermined threshold for the metrics. Control can be performed ex ante or by pre- ventive actions. Ex ante or preventive actions and ex post corrective actions must be implemented at the

2450 Curt and Tacnet

right moment to cope with a disruptive event. Differ- ent types of action can be implemented (Jha, Miner, & Stanton-Geddes, 2013) during the risk manage- ment phases: localization (land use, relocalization, rerouting traffic), structural (redundancy of several components, construction of protective structures), operational (planning rescue operations, verification of the state of protective structures), and fiscal (the speed of transferring funds after an event). A cri- sis occurs when these measures are insufficient dur- ing an event or if adequate measures have not been planned. The concept of resilience implies the return to a situation in which CIs function at the requisite level, the latter being specified.

4.1. Resilience Metrics Are Many and Barely Formalized; The Emergence of Analytical Formulations

4.1.1. Adapted Metrics Are Required

A key challenge remains, that of defining re- silience (1) quantitatively and rigorously for precise and objective evaluation; (2) sufficiently flexibly to capture several facets of this concept; and (3) in re- lation to operational aspects (Alderson et al., 2015; Carlson et al., 2012). Metrics allow evaluating a sys- tem (cf. Fig. 5). They are variables evaluated on dif- ferent types of scale: nominal, ordinal, interval, and ratio.

The multiple dimensions through which re- silience can be understood may explain why such a wide variety of resilience metrics is found in the lit- erature. Syntheses can be found in Alexander et al. (2011) and Birkmann et al. (2012). On the other hand, no consensus has been reached. Thus, def- initions do not naturally lead to the development of coherent metrics of resilience (Ayyub, 2014) and discussions on the resilience of infrastructures gen- erally remain qualitative and descriptive (Baroud, Ramirez-Marquez, Barker, & Rocco, 2014). A large number of terms have been proposed and several of them appear to be synonyms, though this assumption is difficult to verify since these terms are rarely de- fined, making operationalization complex.

Furthermore, a serious lack of formalization was observed in the literature and has been men- tioned in very recent works (Alderson et al., 2015; Chang et al., 2014; Hemond, 2013). Very few works have taken this direction (Hollnagel, 2015; Petit et al., 2013; Sikula, Mancillas, Linkov, & McDonagh, 2015). Thus, there is no formal framework, norm,

or methodology for evaluating resilience (Hemond, 2013) and only a few studies have described how to measure the resilience metric (Birkmann et al., 2012). However, formalization is required in order to obtain a reliable and rigorous evaluation of metrics in real situations (Curt, Peyras, & Boissier, 2010; Curt, Trystram, & Hossenlopp, 2001).

It is therefore important to define and analyze all the facets of resilience and their interactions with metrics that can be used for different tasks:

– Comparing systems with each other (testing different design configurations for different hazard configurations).

– Designing resilient systems; diagnosing an existing system during periods outside a crisis; finding weak points; fueling policies (Rodriguez-Llanes, Vos, Yilmaz, & Guha- Sapir, 2013); and aiding decision making (plan- ning, preparing, etc.).

– Performing evaluations of a system dynami- cally during an event, aiding decision making (recovery, adapting).

– Assessing the adequacy of the process engaged to build resilience and evaluating the outcome achieved (OECD, 2012). Indeed, building re- silience is a process that requires time and resources. Process-oriented definitions have been developed more in social science re- search (Gilbert, 2010). For example, Norris et al. defined resilience as “a process link- ing a set of adaptive capacities to a positive trajectory of functioning and adaptation af- ter a disturbance” (Norris, Stevens, Pfeffer- baum, Wyche, & Pfefferbaum, 2008). The pro- cess implies learning, adaptation, anticipation, and improvements for better decision mak- ing in view of ameliorating the capacity to manage hazards. In the literature, resilience is also understood as an outcome. According to Gilbert: “Outcome-oriented definitions define resilience in terms of end results. An outcome- oriented definition would define resilience in terms of degree of recovery, time to recovery, or extent of damage avoided” (Gilbert, 2010). The works of Kahan et al. are oriented accord- ing to this type of principle that places to the fore the capacity to recover after a disaster (Kahan et al., 2009);

– Contributing to feedback from experience af- ter the crisis by assessing the success or failure of the actions implemented during the event

Resilience of Critical Infrastructures 2451

and the effects of alternative strategies and adaptation. A typology of indicators has been proposed (OECD, 2014): system resilience indicators (outcome indicators) that monitor resilience with time completed by negative re- silience indicators that evaluate the negative impacts of alternative strategies (for transport networks, for example, this corresponds to in- creases in travel times and/or distances).

In our opinion and in agreement with other au- thors (Haimes, 2009a, 2009b; Villar & David, 2014), we think it is necessary, notably with operational use in mind, to consider different metrics to evaluate re- silience for the following reasons:

– Resilience is relative to different domains (TOHE): aggregating a single metric makes little sense. Not all the domains may con- tribute to reduce or minimize the impact in the same way and it is important to keep track of their different roles for future deci- sions. Similarly, it also appears difficult to pro- pose a unique metric for each of these do- mains. Indeed, two different scenarios can lead to the same resilience value whereas they are not equivalent in terms of decision making (Khakzad et al., 2014).

– Different types of hazard and frequency can threaten a CI with variable outcomes and their impact has to be evaluated by different vari- ables. In the domain of natural risks, the same event must be analyzed through its potential effects. A torrential flood can cause submer- sion, scouring, and impacts with intensities and frequencies that differ from the global fre- quency of flood events. The operationalization of organizational and institutional resilience appears to occur independently of a spe- cific threat, leading to imprecise descriptions (Birkmann et al., 2012).

– Metrics may correspond to different spa- tial scales (local, regional, national, interna- tional) and represent subsystems of the global system.

– Metrics differ as a function of the phases of re- silience management. For example, prepared- ness metrics appear to predominate in the case of organizational and institutional resilience (Birkmann et al., 2012).

Finally, the problem is to define a sufficient num- ber of metrics necessary, adapted to the situation

(CI type, hazard type, domain analyzed, scale, man- agement phase) and to obtain a clear and legible image of the system’s resilience, in particular, for decisionmakers and stakeholders. In addition, the metrics must be sensitive, robust (repeatable and re- producible), and permit the representation of uncer- tainties inherent in resilience evaluations. Measures of resilience do not generally include the temporal dimension (Francis & Bekera, 2014), but several re- cent works have indicated the importance of integrat- ing this aspect in the definition of resilience (Gay & Sinha, 2013) and dynamic formulations started to be proposed (Ganin et al., 2016; Gao, Barzel, & Barabási, 2016; Gisladottir, Ganin, Keisler, Kepner, & Linkov, 2017). Finally, metrics must be presented carefully and take different forms, i.e., tables, maps, curves, etc., and they must be cost effective (Vinchon et al., 2011).

4.1.2. Evaluation of Metrics

Three types of evaluation can be distinguished. Metrics can be evaluated directly or indirectly (prox- ies) or be obtained from models resulting from sev- eral measures. For example, the duration of lack of service is a direct assessment of resilience; connectiv- ity is an indirect one (Feliciotti, Romice, & Porta); the metric preparedness is evaluated on the basis of the following measures (Boin & McConnell, 2007): preparing respondents, business continuity planning, joint preparations, joint training operations and de- veloping real-life simulation, training leaders (creat- ing expert networks, training for situational and in- formation assessment, organizing outside forces, and working with the media.

Difficulties specific to evaluation have been en- countered, notably:

– Information difficult to access often leads to using indirect metrics or proxies that therefore provide only an approximate representation of reality (Vinchon et al., 2011).

– It can be difficult to quickly acquire infor- mation in order to perform actions and react as soon as possible: this improves resilience (Therrien, 2010).

– The aggregation of different elements to pro- duce a metric can prove difficult due to the dif- ferent natures of the elements, the time steps linked to them, their associated uncertainties, etc.

2452 Curt and Tacnet

– The data and information used to measure the metrics are often imperfect (uncertain, imprecise, incomplete, contradictory): such imperfections must be considered to better represent reality. Resilience is strongly linked to the concept of the progression of unknown transitional states not foreseen by the system. Up to now, few works have focused on tak- ing imperfections into account in resilience management (Hosseini, Al Khaled, & Sarder, 2016; John, Yang, Riahi, & Wang, 2016; Mojtahedi, Newton, & Von Mading, 2017; Nogal, O’Connor, Martinez-Pastor, & Cau- filed, 2017; Yodo, Wang, & Zhou, 2017). Ap- propriate models should be proposed to rep- resent imperfection with a twofold constraint: adaptation to the type of data (elicitation of expertise, data, feedback from experience) and epistemic and aleatory uncertainties.

Three approaches are generally used to feed re- silience metrics: knowledge formalization, feedback from experience, and the analysis of historic and cal- culated data (Chang et al., 2014; McDaniels et al., 2015; Rosati et al., 2015). They are complementary insofar as resilience is a complex property involving different variables and in which (fortunately) disas- ters rarely occur.

In our literature analysis, we found that several works specifically dealt with the development of re- silience metrics: 26 concern quantitative metrics and three others qualitative ones (cf. Table V).

4.2. Control Systems Must Respond to Various Situations

The resilience control process relies on preven- tive and corrective actions based on the evalua- tion of metrics. Preventive actions reduce the level of risk through measures that do not necessarily change the vulnerability of the system and thus its state variables. These actions include detection, pre- vention, protection, prohibition, etc. They modify the effect of a potential hazard for a determined level of risk. Corrective actions control the states of the system by improving its resilience, for exam- ple, in terms of resistance (improvement of structural protection measures), adaptation (preventive infor- mation), etc. Two kinds of measures are possible: “Structural measures are any physical construction to reduce or avoid possible impacts of hazards, or the application of engineering techniques or technology

to achieve hazard resistance and resilience in struc- tures or systems. Non-structural measures are mea- sures not involving physical construction which use knowledge, practice or agreement to reduce disas- ter risks and impacts, in particular through policies and laws, public awareness raising, training and ed- ucation” (UNISDR, 2016). The goal is to restore a target level within an acceptable period of time and cost. These actions are aimed at absorbing shocks, and adapting so that the systems are less exposed to them, or transforming these systems so that they are no longer affected by these shocks (OECD, 2014). Different types of TOHE action can be distinguished considering the types of action (structural or non- structural) and the management phase (preventive, corrective actions). Table IV gives some examples of the various kinds of actions.

Models supplying these actions must be pro- posed and incorporated in decision-aid systems and concern the different management components (Anticipate, Monitor/Detect, Control, Feedback—cf. Fig. 3).

All of these actions obviously have a cost. This is reflected in our literature review: one-third of the published researches concern the economic aspects alone or in combination (cf. Table III). By defini- tion, preventive strategies tie down resources and can become costly in the medium and long terms (Ther- rien, 2010): they overprotect a system under normal conditions. Kahan et al. (2009) have proposed alloca- tions of resources distributed for resistance, absorp- tion, and restoration as a function of the resilience profile and more particularly gravity (the quality that determines the degree to which any particular func- tion plays a key role within its host system) (Kahan et al., 2009). Recovery must be done at acceptable costs (Haimes, 2006). Here, we converge with the concept of efficiency that seeks to balance the alloca- tion of human, technical, and financial resources with expected effects.

Different qualitative and quantitative ap- proaches have been developed (cf. Table V) with various purposes: optimization/improvement, as- sessment/diagnosis, prediction, and modeling/ representation of resilience. The most widely used approach is based on network/graph theory; it represents 40% of the whole set of articles. This can be related to the great majority of networked infrastructures studied as stated before (cf. Table II): network/graph theory is applicable to all networked infrastructures and provides resilience-specific tools (Gay & Sinha, 2013). In the articles selected for our

Resilience of Critical Infrastructures 2453

Table IV. Examples of Different Types of Action

Preventive Actions Adaptive Corrective Actions Recovery Corrective Actions

Structural actions

Protective structures Creation of redundancies Stock management

Modification of the CI Repair of the CI

Nonstructural actions

Training operators to control abnormal situations

Community risk culture Preparation of emergency services Increasing flexibility

New corporate organization Modifications of procedures in the

case of crisis Relocalization

Increased allocation of funds

Table V. Types of Approach

Type of Approach Number of Papers

Network/graph-theory-based modeling 60 Quantitative metrics & modeling 26 Numerical optimization 18 Proposal of new methods or

technological solutions 10

Framework 8 Bayesian networks 6 Spatial information approach 5 Lessons learned 4 Statistical/probabilistic approach 3 Qualitative metrics 3 Collaborative control theory 2 Econometric model 2 Multicriteria decision analysis approach 2 Scenario analysis 2

survey, network/graph-theory-based and numerical optimization approaches notably aim at optimiz- ing design to improve the resilience of concerned infrastructures. Very recent works have proposed network-science-based frameworks to operationalize resilience of infrastructures (Ganin et al., 2016; Gao et al., 2016; Gisladottir et al., 2017): they rely on the definition of a single universal dynamic resilience function (called critical functionality in Ganin et al. (2016) and Gisladottir et al. (2017)) combined with network theory approaches. They are particularly well-suited to multidimensional systems consisting of a large number of components that interact through a complex network such as CIs in a given territory. As stated by Opdyke, Javernick-Will, and Koschmann (2017), a future step relies on innovative methods and greater mixed-method studies (Opdyke et al., 2017).

Models must be adapted for uncertain situa- tions. Methods such as Bayesian networks (Simon & Weber, 2009), multicriteria aggregation (Tacnet,

Dezert, Curt, Batton-Hubert, & Chojnacki, 2014), and knowledge-based systems (Curt, Talon, & Mau- ris, 2011; Talon & Curt, 2017) can be used to propagate these imperfections in decision models. Obviously, the spatial aspect is important for net- work infrastructures and because resilience manage- ment is generally performed at territorial level. The communication and visualization of model results on maps complete decision-aid tools intended for differ- ent users (infrastructure managers, political decision- makers, etc.) (Fekete, Tzavella, & Baumhauer, 2017; Shiraki, Takahashi, Inomo, & Isouchi, 2017; Vinchon et al., 2011). Decision-aid systems based on GIS (geo- graphical information systems) to manage spatial as- pects appear essential.

At present, very few models of this type can be used to improve resilience (Alderson et al., 2015; Robert, Morabito, Cloutier, & Hémond, 2012). Guides and formal frameworks are beginning to emerge (Cavallini et al., 2014; Labaka et al., 2016; OECD, 2014). This situation is probably due to the following causes:

– the scarcity of genuinely operational metrics, as seen above;

– the large number of decision situations that have to be investigated comprising dimen- sions of resilience, decisionmakers, informa- tion available on initiating events and those in cascade;

– the large number of ex ante and ex post actions, “hard” or “soft”;

– interactions between variables; and – different measurement situations: elicita-

tion of expertise, data, and feedback from experience.

Finally, two recent papers deal with biomimicry approaches. Middleton and Latty stated that “human infrastructure management networks

2454 Curt and Tacnet

are rapidly becoming decentralized and in- terconnected; indeed, more like social insect infrastructures. Human infrastructure management might learn from social insect researchers” (Mid- dleton & Latty, 2016). Gao et al., (2016), for their part, exemplified their development dedicated to multidimensional systems and complex networks on ecological networks such as plants and pollinators but their developments can help to guide the design of technological systems resilient to both internal failures and environmental changes (Gao et al., 2016).

5. SYNTHESIS AND RESEARCH DIRECTIONS

We put forward the idea that future develop- ments could respond to the current limits of re- silience management on the basis of the elements discussed above. The aim is therefore to pursue methodological developments, then develop the first prototype decision-aid tools. This type of approach converges with the DROP (Disaster Resilience Of Place) model proposed by Cutter et al. (Cutter et al., 2008). Different qualitative and qualitative ap- proaches like those presented in Table V offer inter- esting frameworks to enhance CIs’ resilience. These developments must conform to the following con- straints. These constraints come from the analysis of the articles used in this review (cf. Fig. 6):

– Consider different hazards, the cascade ef- fects, thus the interactions between CIs and uncertain conditions across the system lifecy- cle, including technology, climate, economy, and others.

– Take several domains into account: the TOHE domains (and others as a function of applica- tion) must be considered to define resilience metrics and for corrective and preventive ac- tions. Indeed, the actions taken can be eco- nomic (funds allocated to resources to protect forests against fire), technical (strengthening dikes), human (preparing the population), and organizational (training emergency services). This holistic approach has been implemented in the French MARATHON project (Léger et al., 2009) focused on risk.

– Consider different phases of resilience man- agement (preparation, prevention, event/pos- tevent, recovery) and incorporate the tempo- ral aspect.

– Take into account spatial aspects and multi- scale effects. It should be recalled that CIs are points, systems, or parts of systems es- sential for maintaining functions vital for so- ciety. They are intrinsically vulnerable and can accentuate the vulnerability of a territory when they can no longer ensure their mis- sion. Their interruption can significantly dis- rupt societies at different scales: local, na- tional, and international. Infrastructures play a role in a given territory that can over- lap the borders of countries such as those of Europe, leading to cooperation within the European Union and the emergence of a joint policy to protect CIs, since small disrup- tions can quickly transform into crises (Frit- zon et al., 2007). The resilience of CIs is intrinsically important but it is also a determi- nant of resilience at a larger scale of a com- munity or region (Carlson et al., 2012; Rose & Liao, 2005): activities not directly affected can be impacted by the consequences of an event if they are deprived of electricity or com- munication networks. The analysis of these ef- fects and changes of scale remains to be done (Birkmann et al., 2012).

– Integrate the role of dynamics. First, the dy- namics of the system’s environment must be considered: change of technology, climate, economy, environment, and other conditions; aging, maintenance of CIs. Second, at the sys- tem’s level, the temporal profile of system re- covery in response to adverse events should be evaluated in relation with the recovery capacity.

– Manage, in real time, very heterogeneous and potentially imperfect information stemming from many unequally reliable sources.

The last element of reflection we want to add to this article concerns the positioning of resilience with respect to sustainable development. These two approaches share common principles (European En- vironment Agency (EEA), 2016; Linkov et al., 2014; Morchain & Robrecht, 2012):

– the demand for continuous improvement; – the minimization of the adverse effects of

hazards on societies in a situation of global changes;

– the continuation and even improvement of the functionality of systems by adapting to

Resilience of Critical Infrastructures 2455

Preparation – Prevention

Post-Event Response Recovery

ResilienceCI Defense Barriers

Corrective Systems

Event Natural Hazard - Human

Actions - Cascading Effect

Event

TOHE

Real �me management of highly heterogeneous, imperfect informa�on stemming from different, unequally reliable sources

Fig. 6. Synthesis of proposals.

and learning about the fundamental changes caused by these events.

However, there is no unified framework that combines resilience and sustainable development for the design, evaluation, and maintenance of civil engineering infrastructures and convergence is slow. This can be explained by developments pursued in- dependently (Bocchini, Frangopol, Ummenhofer, & Zinke, 2014). Using a comparison of concepts of re- silience and sustainability, these authors proposed a unified approach for these two concepts that consid- ers the entire life of a structure and estimates its im- pact on society, though by focusing on events with different magnitudes and probabilities of occurrence.

REFERENCES

Alderson, D. L., Brown, G. G., & Carlyle, W. M. (2015). Opera- tional models of infrastructure resilience. Risk Analysis, 35(4), 562–586.

Alexander, D., Barbat, A., Carreño, M. L., Kienberger, S., Miniati, R., Welle, T., . . . Glade, T. (2011). MOVE PROJECT (Meth- ods for the Improvement of Vulnerability Assessment in Europe)—Handbook of vulnerability assessment in Europe Deliverable 4.2, Diana Contreras and Stefan Kienberger (Eds), 129 pages.

Ayyub, M. B. (2014). Systems resilience for multihazard environ- ments: Definition, metrics, and valuation for decision making. Risk Analysis, 34(2), 340–355.

Bach, C., Bouchon, S., Fekete, A., Birkmann, J., & Serre, D. (2014). Adding value to critical infrastructure research and dis- aster risk management: The resilience concept. SAPIENS, 6.

Baroud, H., Ramirez-Marquez, J. E., Barker, K., & Rocco, C. M. (2014). Stochastic measures of network resilience: Applications to waterway commodity flows. Risk Analysis, 34(7), 1317–1335.

Bialas, A. (2016). Risk management in critical infrastructure— Foundation for its sustainable work. Sustainability, 8(3), 240.

Birkmann, J., Chang Seng, D., Abeling, T., Huq, N., Wolfertz, J., Karanci, N., . . . Jülich, S. (2012). EMBRACE / Systematization of different concepts, quality criteria, and indicators.

Birkmann, J., Chang Seng, D., Wolfertz, J., Setiadi, N., Karancı, N., İkizer, G. K., . . . Fordham, M. (2012). EMBRACE (Build- ing Resilience Among Communities in Europe)—Early discus- sion and gap analysis on resilience Deliverable 1.1, 77 pages.

Bocchini, P., Frangopol, D. M., Ummenhofer, T., & Zinke, T. (2014). Resilience and sustainability of civil infrastructure: Toward a unified approach. Journal of Infrastructure Systems, 20(2) 04014004-1 – 04014004-16.

Boin, A., & McConnell, A. (2007). Preparing for critical infrastruc- ture breakdowns: The limits of crisis management and the need for resilience. Journal of Contingencies and Crisis Management, 15(1), 50–59.

Bruneau, M., Chang, S. E., Eguchi, R. T., Lee, G. C., O’Rourke, T. D., Reinhorn, A. M., . . . von Winterfeldt, D. (2003). A frame- work to quantitatively assess and enhance the seismic resilience of communities. Earthquake Spectra, 19(4), 733–752.

Bruneau, M., Filiatrault, A., Lee, G. C., O’Rourke, T. D., Rein- horn, A. M., Shinozuka, M., & Tierney, K. (2005). White pa- per on the SDR grand challenges for disaster reduction: Mul- tidisciplinary Center for Earthquake Engineering Research (MCEER).

Carlson, L., Bassett, G., Buehring, W., Collins, M., Folga, S., Haf- fenden, B., . . . Whitflield, R. (2012). Resilience: Theory and applications Report ANL/DIS-12-1. Decision and Information Sciences Division, Argonne National Laboratory, 65 pages.

Cavallini, S., d’Alessandro, C., Volpe, M., Armenia, S., Carlini, C., Brein, E., & Assogna, P. (2014). A system dynamics framework for modeling critical infrastructure resilience. Vol. 441. IFIP Advances in Information and Communication Technology (pp. 141–154).

Cavelty, M. D., Kaufmann, M., & Kristensen, K. S. (2015). Re- silience and (in)security: Practices, subjects, temporalities. Se- curity Dialogue, 46(1), 3–14.

Chang, S. E., McDaniels, T., Fox, J., Dhariwal, R., & Longstaff, H. (2014). Toward disaster-resilient cities: Characterizing re- silience of infrastructure systems with expert judgments. Risk Analysis, 34, 416–434.

Chatry, C., Le Gallou, J., Le Quentrec, M., Lafitte, J., Lau- rens, D., Creuchet, D., & Grelu, J. (2010). Rapport de la mis- sion interministérielle “Changements climatiques et extension des zones sensibles aux feux de forêts” (National Report on

2456 Curt and Tacnet

Climate Change and the Extension of Fire Prone Areas in France). Ministère Alimentation Agriculture Pêche.

Curt, C., Peyras, L., & Boissier, D. (2010). A knowledge formaliza- tion and aggregation-based method for the assessment of dam performance. Computer-Aided Civil and Infrastructure Engi- neering, 25, 171–183.

Curt, C., Talon, A., & Mauris, G. (2011). A dam assess- ment support system based on physical measurements, sen- sory evaluations and expert judgements. Measurement, 44, 192–201.

Curt, C., Trystram, G., & Hossenlopp, J. (2001). Formalisa- tion of at-line human evaluations to monitor product changes during processing. Integration of human decision in the dry sausage ripening process. Sciences des Aliments, 21(6), 663–681.

Curt, T., & Frejaville, T. (2018). Wildfire policy in Mediterranean France: How far is it efficient and sustainable? Risk Analysis, 38, 472–488.

Cutter, S. L., Barnes, L., Berry, M., Burton, C., Evans, E., Tate, E., & Webb, J. (2008). A place-based model for understanding community resilience to natural disasters. Global Environment Change, 18, 598–606.

Enjalbert, S., Vanderhaegen, F., Pichon, M., Ouedraogo, K. A., & Millot, P. (2011). Assessment of transportation system re- silience. In H. M. Cacciabue C. A. Luedtke, & C. Riccioli (Eds.), Human modelling in assisted transportation (pp. 335– 341). Milan, Italy: Springer-Verlag Italia Srl.

European Commission. (2008). COUNCIL DIRECTIVE 2008/114/EC of 8 December 2008 on the identification and designation of European critical infrastructures and the assess- ment of the need to improve their protection. Official Journal of the European Union.

European Commission. (2013). Commission staff working docu- ment on a new approach to the European Programme for Crit- ical Infrastructure Protection making European critical infras- tructures more secure, SWD(2013)318, 17 pages.

European Environment Agency (EEA). (2016). Urban adapta- tion to climate change in Europe 2016—Transforming cities in a changing climate - Report N° 12/2016.

Fekete, A., Tzavella, K., & Baumhauer, R. (2017). Spatial ex- posure aspects contributing to vulnerability and resilience as- sessments of urban critical infrastructure in a flood and black- out context. Natural Hazards, 86, 151–176. Retrieved from https://doi.org10.1007/s11069-016-2720-3.

Feliciotti, A., Romice, O., & Porta, S. (2016). Design for change: Five proxies for resilience in the urban form. Open House In- ternational, 41(4), 23–30.

Ferrer, L., Curt, C., Peyras, L., & Tourment, R. (2015, 27- 29/05/2015). Impact des réseaux techniques sur la performance d’une digue—Analyse système et Modèle fonctionnel. Paper presented at the 33èmes Rencontres de l’AUGC, Anglet, France.

Francis, R., & Bekera, B. (2014). A metric and framework for re- silience analysis of engineered and infrastructure systems. Reli- ability Engineering and System Safety, 121, 90–103.

Fritzon, A., Ljungkvist, K., Boin, A., & Rhinard, M. (2007). Protecting Europe’s critical infrastructures: Problems and prospects. Journal of Contingencies and Crisis Management, 15(1), 30–41.

Ganin, A. A., Massaro, E., Gutfraind, A., Steen, N., Keisler, J. M., Kott, A., . . . Linkov, I. (2016). Operational resilience: Con- cepts, design and analysis. Scientific Reports, 6.

Gao, J., Barzel, B., & Barabási, A. L. (2016). Universal re- silience patterns in complex networks. Nature, 530(7590), 307– 312.

Gay, L. F., & Sinha, S. K. (2013). Resilience of civil infrastructure systems: Literature review for improved asset management. In- ternational Journal of Critical Infrastructures, 9(4), 330–350.

Gilbert, S. W. (2010). Disaster resilience: A guide to the literature, NIST Special Publication 1117: Office of Applied Economics, Engineering Laboratory, National Institute of Standards and Technology.

Gisladottir, V., Ganin, A. A., Keisler, J. M., Kepner, J., & Linkov, I. (2017). Resilience of cyber systems with over- and underreg- ulation. Risk Analysis, 37(9), 1644–1651.

Haimes, Y. Y. (2006). On the definition of vulnerabilities in mea- suring risk to infrastructures. Risk Analysis, 26(2), 293–296.

Haimes, Y. Y. (2009a). On the complex definition of risk: A systems-based approach. Risk Analysis, 29(12), 1647–1654.

Haimes, Y. Y. (2009b). On the definition of resilience in systems. Risk Analysis, 29(4), 498–501.

Hamilton, M. C., Lambert, J. H., Connelly, E. B., & Barker, K. (2016). Resilience analytics with disruption of preferences and lifecycle cost analysis for energy microgrids. Reliability Engineering and System Safety, 150, 11–21. Retrieved from https://doi.org10.1016/j.ress.2016.01.005.

Hemond, Y. (2013). Concepts et démarche d′évaluation du poten- tiel de résilience d’une infrastructure essentielle. Ecole Poly- technique de Montréal.

Holling, C. S. (1973). Resilience and stability of ecological systems. Annual Review of Ecology and Systematics, 4, 1–23.

Hollnagel, E. (2015). Technical Note. RAG—Resilience analysis grid, http://erikhollnagel.com/ideas/resilience%20 assessment%20grid.html.

Hosseini, S., Al Khaled, A., & Sarder, M. D. (2016). A general framework for assessing system resilience using Bayesian net- works: A case study of sulfuric acid manufacturer. Journal of Manufacturing Systems, 41, 211–227.

Hosseini, S., & Barker, K. (2016). A Bayesian network model for resilience-based supplier selection. International Jour- nal of Production Economics, 180, 68–87. Retrieved from https://doi.org10.1016/j.ijpe.2016.07.007.

Jha, A. K., Miner, T. W., & Stanton-Geddes, Z. (2013). Building urban resilience—Principles, tools, and practice: Directions in development. Washington, DC: World Bank.

John, A., Yang, Z., Riahi, R., & Wang, J. Y. T. (2016). A risk as- sessment approach to improve the resilience of a seaport system using Bayesian networks. Ocean Engineering, 111(1), 136–147.

Johnsen, S. O., & Veen, M. (2013). Risk assessment and resilience of critical communication infrastructure in railways. Cognition Technology & Work, 15, 95–107.

Kadri, F., Châtelet, E., & Chen, G. (2014). Method for quantita- tive assessment of the domino effect in industrial sites. Process Safety and Environmental Protection, 91, 452–462.

Kahan, J., Allen, A., George, J., & Thompson, G. (2009). Concept development: An operational framework for resilience. Home- land Security Studies and Analysis Institute.

Khakzad, N., Khan, F., Amyotte, P., & Cozzani, V. (2014). Risk management of domino effects considering dynamic conse- quence analysis. Risk Analysis, 34(6), 1128–1138.

Klein, R. J. T., Nicholls, R. J., & Thomalla, F. (2003). Resilience to natural hazards: How useful is this concept? Global Environ- ment Change Part B: Environmental Hazards, 5(1), 35–45.

Labaka, L., Hernantes, J., & Sarriegi, M. (2015). Resilience frame- work for critical infrastructures: An empirical study in a nuclear plant. Reliability Engineering and System Safety, 141, 92–105.

Labaka, L., Hernantes, J., & Sarriegi, M. (2016). A holistic frame- work for building critical infrastructure resilience. Technologi- cal Forecasting & Social Change, 103, 21–33.

Landucci, G., Argenti, F., Tugnoli, A., & Cozzani, V. (2015). Quantitative assessment of safety barrier performance in the prevention of domino scenarios triggered by fire. Reliability En- gineering and System Safety, 143, 30–43.

Léger, A., Weber, P., Levrat, E., Duval, C., Farret, R., & Iung, B. (2009). Methodological developments for probabilis- tic risk analyses of socio-technical systems. Proceedings of the

Resilience of Critical Infrastructures 2457

Institution of Mechanical Engineers, Part O. Journal of Risk and Reliability, 223, 313–332.

Linkov, I., Bridges, T., Creutzig, F., Decker, J., Fox-Lent, C., Kröger, W., . . . Thiel-Clemen, T. (2014). Changing the re- silience paradigm. Nature Climate Change, 4, 407–409.

Linkov, I., Eisenberg, D. A., Bates, M. E., Chang, D., Convertino, M., Allen, J. H., . . . Seager, T. P. (2013). Measurable resilience for actionable policy. Environmental Science & Technology, 48, 10108–10110.

Matzenberger, J., Hargreaves, N., Raha, D., & Dias, P. (2015). A novel approach to assess resilience of energy systems. Interna- tional Journal of Disaster Resilience in the Built Environment, 6(2), 168–181.

McDaniels, T., Chang, S., Cole, D., Mikawoz, J., & Longstaff, H. (2008). Fostering resilience to extreme events within infrastruc- ture systems: Characterizing decision contexts for mitigation and adaptation. Global Environmental Change—Human and Policy Dimensions, 18, 310–318.

McDaniels, T., Chang, S. E., Hawkins, D., CHex, G., & Longstaff, H. (2015). Toward disaster-resilient cities: An approach for set- ting priorities in infrastructure mitigation efforts. Environment Systems & Decision, 35, 252–263.

Mc Lean, L., & Guha-Sapir, D. (2013). EnNHANCE (Enhancing Risk Management Partnerships for Catastrophic Natural Dis- asters in Europe) / Developing a resilience framework, Deliv- erable 2.2, 35 pages.

Middleton, E. J. T., & Latty, T. (2016). Resilience in social insect infrastructure systems. Journal of the Royal Society Interface, 13(116). Retrieved from https://doi.org10.1098/rsif.2015.1022.

Mojtahedi, M., Newton, S., & Von Mading, J. (2017). Predicting the resilience of transport infrastructure to a natural disaster us- ing Cox’s proportional hazards regression model. Natural Haz- ards, 85(2), 1119–1133.

Morchain, D., & Robrecht, H. (2012). Background paper for the Council of Europe’s report on resilient cities: ICLEI—Local Governments for Sustainability European Secretariat.

National Academy of Sciences. (2012). Disaster resilience: A national imperative: Washington, DC: National Academy of Sciences.

Nogal, M., O’Connor, A., Martinez-Pastor, B., & Caufiled, B. (2017). Novel probabilistic resilience assessment framework of transportation networks against extreme weather events. ASCE-ASME Journal of Risk and Uncertainty in Engineering Systems - Part A - Civil Engineering, 3(3)).

Norris, F., Stevens, S., Pfefferbaum, B., Wyche, K., & Pfefferbaum, R. (2008). Community resilience as a metaphor, theory, set of capacities, and strategy for disaster readiness. American Jour- nal of Community Psychology, 41, 127–150.

O’Rourke, T. D. (2007). Critical infrastructure, interdependencies, and resilience. Bridge, 37(1), 22–29.

OECD. (2012). Global modelling of natural hazard risks— Enhancing existing capabilities to address new challenges. Or- ganisation for Economic Co-operation and Development.

OECD. (2014). Guidelines for resilience systems analysis. Organ- isation for Economic Co-operation and Development.

Omer, M., Mostashari, A., & Nilchiani, R. (2013). Assess- ing resilience in a regional road-based transportation network. International Journal of Industrial and Sys- tems Engineering, 13(4), 389–408. Retrieved from https:// doi.org10.1504/IJISE.2013.052605.

Opdyke, A., Javernick-Will, A., & Koschmann, M. (2017). Infras- tructure hazard resilience trends: An analysis of 25 years of re- search. Natural Hazards, 87(2), 773–789.

Ouedraogo, K. A., Enjalbert, S., & Vanderhaegen, F. (2013). How to learn from the resilience of human–machine systems? Engi- neering Applications of Artificial Intelligence, 26, 24–34.

Ouyang, M., Duenas-Osorio, L., & Min, X. (2012). A three-stage resilience analysis framework for urban infrastructure systems. Structural Safety, 36-37, 23–31.

Park, J., Seager, T. P., Rao, P. S. C., Convertino, M., & Linkov, I. (2013). Integrating risk and resilience approaches to catas- trophe management in engineering systems. Risk Analysis, 33, 356–367.

Petit, F. D., Bassett, G. W., Black, R., Buehring, W. A., Collins, M. J., Diclinson, D. C., & Peerenboom, J.P. (2013). Resilience Measurement Index: An indicator of critical infrastructure re- silience Report ANL/DIS-13-01. Decision and Information Sci- ences Division, Argonne National Laboratory.

Provitolo, D. (2013). Resiliency vulnerability notion—Looking in another direction in order to study risks and disasters. In D. Serre, B. Barocca, & R. Laganier (Eds.), Resilience and urban risk management. London, UK: CRC Press, Taylor and Francis Group.

Quenault, B. (2015). De Hyōgo à Sendai, la résilience comme impératif d’adaptation aux risques de catastrophe: Nou- velle valeur universelle ou gouvernement par la catastrophe? Développement durable et territoires, 6(3)

Resilience Engineering Association. (2015). Retrieved from https://www.resilience-engineering-association.org/.

Rinaldi, S. M., Peerenboom, J. P., & Kelly, T. K. (2001). Iden- tifying, understanding, and analysing critical infrastructure in- terdependencies. IEEE Control Systems Magazine, December, 11–25.

Robert, B., Morabito, L., Cloutier, I., & Hémond, Y. (2012). Inter- dependent critical infrastructures: From protection towards re- silience. Disaster Prevention and Management: An International Journal, 24(1), 70–79.

Rodriguez-Llanes, J. M., Vos, F., Yilmaz, L., & Guha-Sapir, D. (2013). EMBRACE (Building Resilience Among Communities in Europe) / Developing indicators and indicators systems of societal resilience to disasters: Benefits of systematic reviews Deliverable 3.3.

Roege, P. E., Collier, Z. A., Mancillas, J., McDonagh, J. A., & Linkov, I. (2014). Metrics for energy resilience. Energy Policy, 72, 249–256.

Rosati, J. D., Flynn Touzinsky, K., & Lillycrop, W. J. (2015). Quantifying coastal system resilience for the US Army Corps of Engineers. Environment Systems and Decisions, 35, 196– 208.

Rose, A., & Liao, S.-Y. (2005). Modeling regional economic re- silience to disasters: A computable general equilibrium analysis of water service disruptions. Journal of Regional Science, 45(1), 75–112.

Ruault, J. R. (2015). Proposition d’architecture et de processus pour la résilience des systemes: Application aux systèmes cri- tiques a longue durée de vie. Université de Valenciennes et du Hainaut-Cambresis.

Sakukai, K., & Kim, T. (2008). Enhanced resilience approach. Journal of Security Engineering, 6, 193–200.

Shiraki, W., Takahashi, K., Inomo, H., & Isouchi, C. (2017). A proposed restoration strategy for road networks after an earthquake disaster using resilience engineering. Jour- nal of Disaster Research, 12(4), 722–732. Retrieved from https://doi.org10.20965/jdr.2017.p0722.

Sikula, N. R., Mancillas, J. W., Linkov, I., & McDonagh, J. A. (2015). Risk management is not enough: A conceptual model for resilience and adaptation-based vulnerability assessments. Environment Systems & Decision, 35, 219–228.

Simon, C., & Weber, P. (2009). Imprecise reliability by eviden- tial networks. Journal of Risk and Reliability in the Proceed- ings of the Institution of Mechanical Engineers, Part O, 223(2), 119–131.

Tacnet, J. M., Dezert, J., Curt, C., Batton-Hubert, M., & Choj- nacki, E. (2014). How to manage natural risks in mountain ar- eas in a context of imperfect information? New frameworks and paradigms for expert assessments and decision-making. Envi- ronment Systems and Decisions, 34(2), 288–311.

2458 Curt and Tacnet

Talon, A., & Curt, C. (2017). Selection of appropriate defuzzifi- cation methods: Application to the assessment of dam perfor- mance. Expert Systems with Applications, 17, 160–174.

Therrien, M. C. (2010). Stratégies de résilience et infrastructures essentielles. Téléscope, 16(2), 154–171.

Thorisson, H., Lambert, J. H., Cardenas, J. J., & Linkov, I. (2017). Resilience analytics with application to power grid of a devel- oping region. Risk Analysis, 37(7), 1268–1286. Retrieved from https://doi.org10.1111/risa.12711.

TNCEIP. (2012). Position paper of the TNCEIP on EU policy on critical energy infrastructure protection.

Turnquist, M. A., & Vugrin, E. D. (2013). Design for resilience in infrastructure distribution networks. Environment Systems & Decision, 33(1), 104–120.

United Nations/International Strategy for Disaster Reduction (UNISDR). (2005). Hyogo Framework for Action 2005- 2015: Building the resilience of nations and communities to disasters—Extract from the final report of the World Confer- ence on Disaster Reduction. Kobe, Hyogo, Japan.

United Nations/International Strategy for Disaster Reduction (UNISDR). (2015). Sendai Framework for Disaster Risk Re- duction 2015–2030. Sendai, Japan.

United Nations/International Strategy for Disaster Reduction (UNISDR). (2016). Report on the open-ended intergovern-

mental expert working group on indicators and terminology re- lating to disaster rik reduction.

Villar, C., & David, M. (2014). La résilience, un outil pour les territoires? Paper presented at the Séminaire IT-GO Rosko.

Vinchon, C., Carreño, M. L., Contreras-Mojica, D. M., Kien- berger, S., Schneiderbauer, S., Alexander, D., . . . Welle, T. (2011). MOVE Project (Methods for the Improvement of Vul- nerability Assessment in Europe)—Assessing vulnerability to natural hazards in Europe: From principles to practice—A manual on concept, methodology and tools Deliverable 4.2.

Vugrin, E. D., Warren, D. E., Ehlen, M. A., & Camphouse, R. C. (2010). A framework for assessing the resilience of infras- tructure and economic systems. In K. G. S. Peeta (Ed.), Sus- tainable & resilient critical infrastructure systems (pp. 77–116). Berlin Heidelberg: Springer-Verlag.

Yodo, N., Wang, P. F., & Zhou, Z. (2017). Predictive resilience analysis of complex systems using dynamic Bayesian networks. IEEE Transactions on Reliability, 66(3), 761–770.

Zevenbergen, C., van Herk, S., Escarameia, M., Gersonius, B., Serre, D., Walliman, N., . . . de Graaf, R. (2015). Assessing quick wins to protect critical urban infrastructure from floods: A case study in Bangkok, Thailand. Journal of Flood Risk Management, 11, S17–S27.