Review on Energy Resilience

Reliability Engineering and System Safety 121 (2014) 43–60

Contents lists available at ScienceDirect

Reliability Engineering and System Safety

0951-83 http://d

n Tel.: E-m

journal homepage: www.elsevier.com/locate/ress

Review

Review on modeling and simulation of interdependent critical infrastructure systems

Min Ouyang n

School of Automation, Huazhong University of Science and Technology, 1037 Luoyu Road, Wuhan 430074, China

a r t i c l e i n f o

Article history: Received 16 October 2012 Received in revised form 22 June 2013 Accepted 26 June 2013 Available online 16 July 2013

Keywords: Critical infrastructure systems (CISs) Interdependencies Empirical approach Agent System dynamics Economic theory Network Resilience

20/$ - see front matter & 2013 Elsevier Ltd. A x.doi.org/10.1016/j.ress.2013.06.040

+86 18 07 174 9645. ail addresses: [email protected], min.o

a b s t r a c t

Modern societies are becoming increasingly dependent on critical infrastructure systems (CISs) to provide essential services that support economic prosperity, governance, and quality of life. These systems are not alone but interdependent at multiple levels to enhance their overall performance. However, recent worldwide events such as the 9/11 terrorist attack, Gulf Coast hurricanes, the Chile and Japanese earthquakes, and even heat waves have highlighted that interdependencies among CISs increase the potential for cascading failures and amplify the impact of both large and small scale initial failures into events of catastrophic proportions. To better understand CISs to support planning, maintenance and emergency decision making, modeling and simulation of interdependencies across CISs has recently become a key field of study. This paper reviews the studies in the field and broadly groups the existing modeling and simulation approaches into six types: empirical approaches, agent based approaches, system dynamics based approaches, economic theory based approaches, network based approaches, and others. Different studies for each type of the approaches are categorized and reviewed in terms of fundamental principles, such as research focus, modeling rationale, and the analysis method, while different types of approaches are further compared according to several criteria, such as the notion of resilience. Finally, this paper offers future research directions and identifies critical challenges in the field.

& 2013 Elsevier Ltd. All rights reserved.

Contents

1. Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 2. Types and evidence of interdependencies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 3. Conceptual and qualitative studies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 4. Modeling and simulation approaches in infrastructure interdependencies research and practice . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46

4.1. Empirical approaches . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46

4.1.1. Identification of frequent and significant failure patterns . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 4.1.2. Quantification of interdependency related indicators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 4.1.3. Empirically-based risk analyses. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

4.2. Agent based approaches . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 4.3. System dynamics based approaches. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 4.4. Economic theory based approaches . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

4.4.1. Input–output based methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 4.4.2. Computable-general-equilibrium based methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50

4.5. Network based approaches . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50

4.5.1. Topology-based methods. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 4.5.2. Flow-based methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51

4.6. Other approaches. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 5. Discussions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53

5.1. Approach comparisons . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 5.2. Future directions and challenges . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55

6. Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56

ll rights reserved.

[email protected]

M. Ouyang / Reliability Engineering and System Safety 121 (2014) 43–6044

1. Introduction

The economy of a nation and the well-being of its citizens depend on the continuous and reliable functioning of infrastructure systems. According to the report of the U.S. President′s Commission on Critical Infrastructure Protection (PCCIP) [164], an infrastructure system is defined as “a network of independent, mostly privately-owned, man- made systems and processes that function collaboratively and synergistically to produce and distribute a continuous flow of essential goods and services”. Among all infrastructure systems, those systems “whose incapacity or destruction would have a debilitating impact on the defense and economic security” are regarded as critical. Different countries have slightly different lists detailing their critical infrastructure systems (CISs), but most contain the following systems: telecommunications, electric power systems, natural gas and oil, banking and finance, transportation, water supply systems, government services, and emergency services.

CISs are not isolated but highly interconnected and mutually interdependent [172,157,174]. For example, water and telecommu- nication systems need steady supply of electric energy to maintain their normal operations while electric power systems require the provision of water and various telecommunication services for power generation and delivery. Interdependencies can improve infrastructure operational efficiency, but recent worldwide events such as the 1998 storm in Canada, the 2001 World Trade Center attack, the 2003 North American blackout, the 2004 hurricane season in Florida, the 2007 UK floods and the 2010 Chile and the 2011 Japan earthquakes have shown that interdependencies can increase system vulnerability. The damage in one CIS can produce cascading failures, sending ripple effects throughout regional or national scales. Also, most CISs are becoming more congested as population and demands grow, as in the case of the U.S. electric power system. Its increasing demands have not been met by the corresponding increase in capacity and the major blackouts (affecting 1 million or more people) occur about every 4 months on average in the United States [118]. This increased vulnerability of single CIS can be easily amplified due to the interdependencies. Hence, modeling and simulation of interdependent CISs become a critical field of contemporary research and study.

The governments in different countries also recognize the increasing importance of CISs and their interdependencies. In 1996, U.S. President Clinton established the President′s Commis- sion on Critical Infrastructure Protection (PCCIP). This commission comprehensively reviewed and recommended many national policies for protecting CISs to assure their continued operations, with the final report released in October of 1997 [164]. In 1998, the Presidential Decision Directive (PDD) no. 63 was released. It set a national goal that the United States should achieve and maintain the ability to protect the nation′s CISs from deliberate attacks by 2003. Several institutions and departments have since been founded and expanded to protect CISs, including the National Infrastructure Protection Center (NIPC), the National Infrastructure Simulation and Analysis Center (NISAC), and the U.S. Department of Homeland Security (DHS). Similarly, other countries and regions have also made some efforts to better protect their CISs, such as the European Program on Critical Infrastructure Protection (EPCIP), the Critical Infrastructure Program for Modeling and Analysis in Australia, the National Critical Infrastructure Assurance Program in Canada, the Project of Dutch Approach on Critical Infrastructure Protection in the Netherlands, the Critical Infrastructure Resilience Program in the UK, and the Critical Infrastructure Protection Implementation Plan in Germany. This increased government attention has been followed by increases in funding to universities, national laboratories, and private companies involved in the modeling and simulation of CISs interdependencies, which have further led to much innovative and diverse work.

Existing studies on interdependent CISs can be classified in different ways. Some scholars have proposed different taxonomies and compared the studies in terms of different criteria. For example, Pederson et al. [156] summarized studies up to 2006 and compared their research using six criteria: infrastructures, modeling and simulation technique, integrated vs. coupled mod- els, hardware/software requirements, intended user and maturity level. Eusgeld et al. [71] grouped modeling and simulation tech- niques up to 2008 into eight categories: agent-based modeling, system dynamics, hybrid system modeling, input–output model, hierarchical holographic modeling, the critical path method, high level architecture, and petri nets. Each category was evaluated according to nine criteria: maturity, paradigm, monitoring area, data needs, course of triggered events, types of events, types of interdependencies, design strategies, and modeling focus. Satum- tira and Dueñas-Osorio [190] categorized the existing studies up to 2010 according to the following attributes: the mathematical method, modeling objective, scale of analysis, quality and quantity of input data, targeted discipline and end user type. Also, there are many other review references providing classifications of the modeling approaches as well as the evaluation criteria [86,37,165,169,191,82,215,20,21,56,158,196]. Specially, [87] pro- vided a meta-review on 12 review references in the field and suggested a list of 11 categories of criteria and 25 sub-criteria for characterizing each type of models. However, all these review references only cover a small part of the existing studies and focus more on comparisons of the modeling rationale, without carefully reviewing their extensions and applications. Also, none of these papers review existing studies from an overarching perspective, such as the emerging notion of resilience, where resilience is a relatively new yet essential concept in infrastructure engineering and is regarded as the joint ability of infrastructure systems to resist (prevent and withstand) any possible hazards, absorb the initial damage, and recover to normal operation [148,149].

This paper provides a comprehensive review in the field and groups the modeling approaches into several broad types: empirical approaches, agent based approaches, system dynamics based approaches, economic theory based approaches, network based approaches, and other approaches. Different studies of each type of the approaches are grouped and reviewed in terms of key princi- ples, such as research focus, modeling rationale, and the analysis method, while different types of approaches are further compared according to several criteria, such as resilience as the main per- spective. The paper is organized as follows: Section 2 introduces the types of interdependencies and shows their evidence under some extreme events. Section 3 summarizes the conceptual and qualita- tive studies in the field, which pave the way to model and simulate CISs interdependencies. Section 4 critically reviews different mod- eling and simulation approaches, and then Section 5 provides the comparisons across different approaches, and identifies future research directions and challenges. Finally, Section 6 offers general conclusions and insights from the literature review.

2. Types and evidence of interdependencies

CISs are dependent and interdependent in multiple ways, where dependency refers to the unidirectional relationship and interdependency indicates the bidirectional interaction [172]. Usually, dependencies are regarded as interdependencies unless they are specially referred, which is also applied in this paper. To categorize CISs interdependencies, different scholars have pro- vided different classifications, as summarized in Table 1.

In normal operation, some interdependencies are invisible, but under some disruptive scenarios, they emerge and become obvious. To show the evidence of interdependencies and their impacts, this

M. Ouyang / Reliability Engineering and System Safety 121 (2014) 43–60 45

paper studies some extreme events and then identifies the evidence for each interdependency type defined by different scholars. The extreme events include the 1998 Ice Storm in Canada which caused parts of Ontario, Quebec, and New Brunswick and the Northeastern United States experience one of the worst ice storms in recent history [42], the 2001 World Trade Center Attack which led to the collapse of the twin towers and damage of numerous other buildings and utilities at the World Trade Center site [129,144], the 2003 North American Blackout which lasted up to 4 days in various parts of the eastern USA and Canada [209], the 2004 hurricane season in Florida which included a series of hurricanes, such as Charley, Frances and Jeanne, within a short period of approximately 2 months [133], the 2007 UK floods which struck much of the country during June and July [22], and the 2010 Chile Mw 8.8 Earthquake which caused coastal regions to both uplift and subside, and tsunami waves to hit the low lying Chilean coastline as well as distant shores across the Pacific Ocean [213]. All these different types of events cost billions of dollars in economic losses. Some common evidence of CISs interdependencies during and after the events is presented in the following examples:

E1: outages in power systems caused the failures of traffic signals, water supply pumping stations, and automated teller machines as well as the closure of businesses.

Table 1 Summary of interdependency types defined by different scholars and their evidence.

Authors Interdependency Types

Definitions

Rinalidi et al., [172]

Physical The state of one infrastructure system is dependent infrastructure system

Cyber The state of one infrastructure system depends on in information infrastructure

Geographic A local environmental event can create state change Logical The state of one infrastructure system depends on the

geographic

Zimmerman [220]

Functional The operation of one infrastructure system is necess

Spatial It refers to proximity between infrastructures system

Dudenhoeffer et al. [61]

Physical There are direct linkages between infrastructure sys Geospatial There is co-location of infrastructure components w Policy There is a binding of infrastructure components due Informational There is a binding or reliance on information flow b

Wallace et al. [212] and Lee et al. [121]

Input The infrastructure systems require as input one or m provide some other service

Mutual At least one of the activities of each infrastructure sy systems

Shared Some physical components or activities of the infrast one or more other infrastructure systems

Exclusive or (XOR) Only one of two or more services can be provided by infrastructure system or among two or more system

Co-located Components of two or more systems are situated w

Zhang and Peeta [218]

Functional The functioning of one system requires inputs from a other system

Physical Infrastructure systems are coupled through shared p infrastructure systems share flow right of way, leadi

Budgetary Infrastructure systems involve some level of public fi during disaster recovery

Market and Economic

Infrastructure systems interact with each other in th determine the final demand for each commodity/ser regulatory environment where the government agen policy, legislation or financial means such as taxatio

E2: disruptions on communication services affected the situa- tional awareness and control of electric power (or water) systems and caused their partial failures due to lack of observability. E3: electricity loss led to the interruption of communication services (e.g., mobile phone services), which further affected emergency communication and restoration coordination of power systems. E4: during the restoration process, the electric power systems and the communication services were usually given repair priority relative to other infrastructure systems, and received more investment for improvement and retrofit. E5: outages in power systems led to price changes of food and fuels. E6: water-main breaks flooded co-located utility systems. In the case of the World Trade Center, the water flooded rail tunnels, a commuter station, and the vault containing all of the cables for one of the largest telecommunication nodes in the world. E7: emergency services distribute emergency resources to restore various types of damaged utility systems. In the case of the World Trade Center, the New York Waterway with 24 boats dispatched some to work as floating ambulances from piers in Lower Manhattan and others to go to Hoboken, Hunts Point in Queens and the Brooklyn Army Terminal.

Examples

on the material output(s) of another E1, E3

formation transmitted through the E2, E3

s in two or more infrastructure systems E6 state of others via a mechanism that is not a physical, cyber, or E4, E5, E7,

E8, E9, E10

ary for the operation of another infrastructure system E1, E2, E3

s E6

tems from a supply/consumption/production relationship E1, E3 ithin the same footprint E6 to policy or high level decisions E4, E5, E7 etween infrastructure systems E2, E3

ore services from another infrastructure system in order to E1, E2

stem is dependent upon each of the other infrastructure E3

ructure systems used in providing the services are shared with E7, E10

an infrastructure system, where XOR can occur within a single s

E8

ithin a prescribed geographical region E6

nother system, or can be substituted, to a certain extent, by the E1, E2, E3, E10

hysical attributes, so that a strong linkage exists when ng to joint capacity constraints

E6

nancing, especially under a centrally-controlled economies or E4

e same economic system or serve the same end users who vice subject to budget constraints, or are in the shared cies may control and impact the individual systems through n or investment

E5

M. Ouyang / Reliability Engineering and System Safety 121 (2014) 43–6046

E8: debris-covered streets could not be used by both emer- gency response personnel and financial district workers, and lack of the latter could disrupt the financial services. E9: most gas stations unable to pump fuel made drivers scramble to find functional gas stations, resulting in traffic congestion. E10: closure of some metro stations increased the traffic load of the bus transportation system, resulting in long lineups at bus stops.

For each of the above examples, its associated interdependency type defined by different scholars is shown in Table 1. It can be found that some interdependency examples in practice cannot be definitely categorized by some classifications. For example, E4, E5, E7, E8, E9, E10 cannot be clearly sorted out according to the classification by Zimmerman [220]; other non-classified examples include E8, E9, E10 in terms of the classification by Dudenhoeffer et al. [61], E4, E5, E9 by Wallace and Lee [212,121], E7, E8, E9 by Zhang and Peeta [218]. Among these classifications, Rinaldi et al. [172] provided a self-contained classification, which can well sort out all the above interdependency examples and then is used as a criterion in this paper to compare different modeling and simula- tion approaches in Section 5.

3. Conceptual and qualitative studies

Before reviewing modeling and simulation approaches of CISs interdependencies, their conceptual and qualitative studies are first explored. These studies provide the definitions of CISs and their interdependencies, demonstrate the importance to account for CISs interdependencies, offer organizational and administrative strategies to better protect CISs, and also illustrate their modeling complexity. However, these studies do not provide any detailed and specific modeling and simulation approach to analyze the CISs.

Governmental reports typically belong to this type of concep- tual studies. For example, the report of the U.S. PCCIP recom- mended a series of strategies and policies for CISs protection, such as establishing the cooperation and information sharing among infrastructure stakeholders, ingraining infrastructure protection in the culture, reforming or adding some laws, and initiating some programs of research and development on technology and tools needed for infrastructure protection [164]. The Green Paper on the EPCIP also provides some protection measures, such as establish- ing a critical infrastructure warning information network, using CISs expert groups at the E.U. level, sharing CISs information, and identifying and analyzing CISs interdependencies. The Critical Infrastructure Resilience Strategy in Australia recognizes that the best way to enhance the CISs resilience is to partner with owners and operators to share information, raise the awareness of inter- dependencies and vulnerabilities and facilitate collaboration to address any impediments. From these reports, it can be concluded that national and worldwide cooperation, information sharing, situational awareness, and better understanding and analysis of interdependencies are the consensus for effective CISs protection.

Although government reports provide detailed organizational and administrative protection strategies, they neither studied the specific techniques and means to realize them, nor discussed the modeling and simulation approaches of CISs interdependencies to assess strategies′ effectiveness and support decision makings. For the former, some scholars from universities or institutions have addressed. Bologna and Setola [24] proposed many specific recommendations to increase situational awareness, such as pre- paring for the worst, and identifying common mode failure events. Briere [26] recommended the establishment of a fusion center to

facilitate the cooperation and coordination among different CISs, and the fusion center was able to work with public and private sector partners in a unified preparation and mitigation effort, subsequently acting as force multipliers for community stakeholder-driven rapid restoration of CISs following any type of emergency.

For the latter (modeling and simulation on CISs interdepen- dencies), Rinaldi et al. [172] proposed six dimensions to describe interdependencies and facilitate their modeling: types of inter- dependencies, infrastructure environment, coupling and response behavior, infrastructure characteristics, types of failures, and state of operations. These dimensions implicated the complexity of interdependency modeling and simulation [157,173], such as topological complexity, network evolution, connection diversity, dynamical complexity, node diversity, and meta-complication. Taking the interdependent CISs as complex adaptive systems, Rinaldi et al. [173] recommended some promising modeling techniques, such as agent-based approach and system dynamics based approach.

In sum, the conceptual and qualitative studies have motivated the research on CISs interdependencies, and have paved the way to better understand the analysis, modeling, and implementation of practical protection actions for CISs. Following these efforts, many emerging studies have appeared to develop models that accurately capture CISs behavior and analyze their interdependen- cies and vulnerabilities. This paper groups these emerging studies in terms of their modeling approaches in the next section.

4. Modeling and simulation approaches in infrastructure interdependencies research and practice

This section groups and reviews the existing modeling and simulation approaches in the field. They are broadly categorized by the authors into six types: empirical approaches, agent based approaches, system dynamics based approaches, economic theory based approaches, network based approaches, and others. Differ- ent studies of each type of the approaches are further classified and reviewed in the following subsections.

4.1. Empirical approaches

The empirical approaches analyze CISs interdependencies according to historical accident or disaster data and expert experience. The studies with this type of approaches can identify frequent and significant failure patterns, quantify interdependency strength metrics to inform decision making, make empirically- based risk analysis, and provide alternatives to minimize the risk. Relevant studies in this type of approaches are grouped according to their research focus.

4.1.1. Identification of frequent and significant failure patterns It is difficult to identify all interdependencies among CISs

under normal operation, because some intangible interdependent relationships are undetectable by using standard data collection approaches [116] or only emerge after the occurrence of a disruptive event [113]. Hence, historical interdependency incidents can be used to uncover the interdependency structures or relation- ships between CISs under extreme events, such as the earthquakes in Japan [137,110], hurricanes in Florida [113,19], and some others. Establishing special databases from the incident reports and then analyzing the data can identify the frequent and significant failure patterns.

Usually, interdependency incident records are collected from newspapers, media reports, internet news outlets, official ex post assessments, and utility owners and operators [42,126–129,19].

M. Ouyang / Reliability Engineering and System Safety 121 (2014) 43–60 47

Different scholars have constructed different databases to analyze interdependency failures. The database proposed by McDaniels et al. [127,128] and [43] can quantify the consequences of an interdependency failure under extreme events from the stand- point of societal impacts, which were characterized by an impact index (as the product of the failure duration and severity weights) and an extent index (as the product of the failure spatial extent and number of people affected). Based on these two indices, interdependency failure patterns can be classified into four quad- rants, and the patterns in the first quadrant are potential impor- tant points for pre-disaster mitigation and preparedness efforts. This database has been applied to analyze several typical extreme events, such as the August 2003 northeastern North American blackout [127], the 1998 Quebec ice storm [42], a set of three 2004 Florida hurricanes [127] and 2008 Chinese Winter Storms [176]. The frequent and significant interdependency failure patterns that occur in many different extreme events are the mitigation targets from a multi-hazard perspective.

To account for mutual interdependencies, the database intro- duced by Luiijf [126], with 1749 CIS failure incidents in 29 European nations, showed that cascading failures due to depen- dencies were limited within a small number of CISs and did not cascade deeply while the interdependencies occurred far less frequently with only two cases. It is unclear whether this is due to effective management of dependencies (interdependencies) by CIS operator, or weak dependencies (interdependencies) to make cascade begin with, or invisible dependencies (interdependencies) to news report as they occurred at a more technical level. Also, to analyze the interdependency evolvement during the restoration process, the database designed by Wallace et al. [129,212] col- lected 3 months of incident reports following the World Trade Center (WTC) attack. The results demonstrated that banking and finance along with government and emergency services were increasingly impacted both directly and through interdependen- cies during the restoration process, but the CISs with physical networked layout, such as transportation and power, endured many interdependency-related incidents only during the first week of the restoration.

The above studies investigated the interdependency failures at the system level, but if detailed data is available, interdependency analysis can offer more detailed results at the component level to identify and protect key assets. The database provided by Chou and Tseng [44] collected component level failure records within and across CISs. A knowledge discovery process was employed to extract records of frequent interdependency failure patterns asso- ciated with their occurrence probabilities at component level.

The empirical approaches can help identify the potential important interdependency patterns and increase crisis man- agers' awareness and capabilities for responding to the future events. However, this type of the approaches has several weak- nesses. First, due to the bias of reporting, there may exist underreporting of some frequent interdependency failures that may have significant impact. Second, scholars use different databases to collect failure data without a standardized data collection methodology for interdependent CIS performance. This requires a uniform data collection method, including exact definitions of CISs and their interdependencies, so that the media reporting system can follow the requirements to collect the information and support rapid analysis of the data, reducing the time to code and sort out the content of incident reports. Third, the reliance of the empirical approaches on previous failure records, which can give accurate prediction on the future similar events within the range of the collected data already in the database, may not give good predictions for new disasters. These weaknesses call for other modeling and simulation approaches for additional decision support.

4.1.2. Quantification of interdependency related indicators Zimmerman [221] introduced several interdependency related

indicators to inform mitigation and emergency decision making, such as the types of CISs that more frequently damage other CISs, the ratio of being a cause of failure to being affected by failures, combinations of failures that are most frequent, and the number of people affected. These indicators can be easily computed from the collected failure data. Some other indicators, such as interdepen- dent strength, resilience factor, need relatively more calculation.

To quantify the interdependent strength across CISs, Mendonca and Wallace [129] used Pearson′s correlation as the metric. Results show that correlations (interdependent strength) between 50% of the pairs of CISs were statistically significant in the WTC attack. Different from the frequency analysis of the incidents, Duenas- Osorio and Kwasinski [67] exploited the time-series analysis method to reveal interdependencies across CISs from post-event restoration curves. The cross-correlations from the curves without significant lag times reflected the operational interdependencies, and those with significant lag times measured the logistical interdependencies. A synthesized coupling-strength metric incor- porating both cross-correlation and lag times was further pro- posed to quantify the overall CISs interdependencies in 27 February 2010 Mw 8.8 Offshore Maule, Chile earthquake [205]. To quantify the resilience factors of industrial sectors (including CISs) under disruptions, [110] conducted a survey in the Tokai area based on a questionnaire, and defined the resilience factor as the proportion of production level under disruptions to the normal production level. It showed that in the manufacturing sector the resilience factor was almost zero if only the electricity supply was disrupted.

Interdependency related indicators can inform mitigation and emergency decision makings, and can be also used as the input and validation parameters to other models, such as agent-based models, input–output inoperability models and some network based models. But how to associate these indicators with other models, it is still a challenge and calls for an integration concept to link different models in a single framework, which is further discussed in Section 5.

4.1.3. Empirically-based risk analyses According to historical failure data and the expert experiences,

empirically-based risk analyses can be performed to identify the vulnerability of CISs and provide alternatives to minimize their risk of non-functionality. According to previous accidents and disasters, Utne et al. [210] plotted a cascade diagram to describe the cascading failures process across CISs under a specific initiat- ing event. The frequency of the initiating event, the probabilities of all involved events, the number of people being affected, and the duration of each subsequent event were determined based on historical data as well as the expert judgments. Then they estimated the risk associated with the initiating event and identi- fied the optimum strategy for risk reduction [112]. Also, by using a series of time-dependent matrices, where each of its elements (i, j) at some time (measured by experts with qualitative data, such as null, low, medium, high) corresponds to the service quality degradation of infrastructure i due to the outage of infrastructure j, Franchina et al. [79] introduced an impact-based method to construct a time-dependent cascading failure tree associated with each initial failure event to inform emergency decisions. Similar studies include the work from Ezell et al. [74,75] analyzing and managing the risk of interdependent CISs based on empirical data and the event tree, and the work from Robert [175] analyzing the specific cascading failure mechanisms between hydroelectric power generation network and a power transportation network.

M. Ouyang / Reliability Engineering and System Safety 121 (2014) 43–6048

The empirically-based risk analysis largely depends on the empirical data and expert judgments. A little data may bring large errors of the analysis results. But if sufficient record data for the CISs performance during adverse events are available, the errors can be reduced. Also, with sufficient data, some other methods, such as statistical learning theory [88], can be applied to directly draw conclusions from large complex data sets and provide important support for risk management both immediately before extreme events and over the longer term.

4.2. Agent based approaches

Due to the inherent complexity of CISs and the related decision-making processes, CISs are usually regarded as complex adaptive systems (CASs) [3,4,173,18,125,97,206]. To analyze the CASs, one effective way is the agent-based approaches, which adopt a bottom-up method and assume the complex behavior or phenomenon emerge from many individual and relatively simple interactions of autonomous agents [108]. Each agent interacts with others and its environment based on a set of rules, which mimic the way a real counterpart of the same type would react. Most CIS components can be viewed as agents. Hence, agent-based approaches are widely used to model the CISs interdependencies, and are mainly used by several national laboratories to study CISs interdependencies with different mature tools developed.

Sandia developed its first agent-based model called Aspen [14,15] to simulate the behaviors of economic decision-makers individually and investigate macroeconomic quantities of interest in U.S. economy. The outcome of various federal monetary policies in the model agreed qualitatively with predictions based on economic theory and practice, despite the model ignored certain important factors of the economy. In 2000, SNL developed an extended and modified model called Aspen-EE (Electricity Enhancement), which additionally included agents representing the major players in power systems, to simulate the interdepen- dent effects of power market adjustment and power outages on other CISs [12,27]. However, Aspen and Aspen-EE both used the message-passing mechanism to realize the communication between agents without specially representing the telecommuni- cation system. In 2004, SNL developed a new model called CommAspen, which took the telecommunication system into consideration, to simulate the interdependent effect of telecom- munication disruptions on other CISs, such as banking and finance, and the power system [13]. Based on the development experiences from the above models, in 2004 SNL further developed a new model called NABLE to simulate and analyze more complex interdependencies among economic firms, households, the power system, telecommunication system and other CISs [192,69,70], and then in 2008 proposed a method to investigate the cyber and physical interdependencies by the use of a cyber-attack- consequence assessment process [111].

Argonne developed an agent-based model called SMART II in 2000 to represent the electric power marketing and the power transmission system by generation agents, consumer agents and interconnects that represented the transmission topology [138]. Different from the models in Sandia, Smart II considered the topology of the power transmission system, and then it can detect the transmission line configurations which can lead to price spikes. The avoidance of those configurations facilitated greater market price stability. Later, Argonne developed SMART II++ as an extension of SMART II [139]. This new model added a set of new agents and interconnections to represent the natural gas market- ing and distribution infrastructures as well as the interconnections between the two CISs in the form of natural gas-fired electric generators. The interdependency analysis showed that emergency natural gas purchased by electric generators needed to be carefully

monitored to prevent electric failures from spreading to the natural gas infrastructure. Later, ANL developed the FAST (Flexible Agent Simulation Toolkit), which included many features of SMART II+ along with improvements in detail and fidelity [140].

Idaho developed the agent-based CIMS (Critical Infrastructure Modeling System) tool to analyze the cascading effects and con- sequences associated with CISs interdependencies through a graphi- cal (3D) representation of CIS component and the associated relationships [17,60–62]. CIMS modeled the CIS topologies in detail and provided the decision makers the ability to visualize interde- pendencies and damage effects of events. However, when the CIS sizes and complexity increase, the visual analysis methods may not suffice. Additional search and analysis methods are required to identify event–effect relationships especially across multiple CISs. Therefore the INL integrated the genetic algorithms (GA) into CIMS to help refine the search space and identify subsets of possible inter- actions [160]. The integration was realized by allowing the GA to access and affect the simulation agents' attribute and state values [161]. With the integration, CIMS can help determine the optimum or ranking of assets to restore or protect from attacks or other disasters.

Besides the above studies from the national laboratories, there are some other agent-based studies to enhance the modeling flexibility and extend the capacities of existing research with the integration of other modeling techniques, such as UML technique to model high-level behaviors and interactions among agents to facilitate model extension [35], engineering, and maintenance, federated simulation technique [38,39] or the generic ontology technique [52] to facilitate the reuse, share and interoperability of the existing agent-based models and reduce the development time, the Fuzzy Logic method to account for the uncertainties that characterize expert knowledge about the CISs [152,153], GIS technique to support intuitive interdependency analysis [207]. Also, some authors used the agent-based method in some specific applications associated with interdependencies, such as the inter- dependencies between the web system and other CISs [34], the interdependencies between changing power grid due to its dereg- ulation and the increasing amount of distributed generators [170,171], the cyber interdependencies between information infra- structure and the power system [25], the human initiated inter- dependencies between the communication system and the transportation system during the evacuation process [11].

Agent-based approaches model the behaviors of decision- makers and the main system participants in the interdependent CISs, enable to capture all types of the interdependencies among CISs by discrete-event simulations, provide scenario-based what-if analysis and the effectiveness assessment of different control strategies, and can be also integrated with other modeling tech- niques to provide more comprehensive analysis. However, this type of methods has some weaknesses: (1) the quality of simula- tion is highly dependent on the assumptions made by the modeler regarding agent behaviors, and such assumptions may be difficult to justify theoretically or statistically; (2) calibrating the simula- tion parameters is a challenge due to lack of relevant data and the difficulties to model participant behaviors. Detailed information about each CIS is considered very sensible by CIS stakeholders due to the relevance for their business. In addition, existing models and studies usually concentrated on one aspect of the interdepen- dent CIS, such as market structures, and system configurations. Addressing different aspects in a single framework requires an integration concept, which will be further discussed in Section 5.

4.3. System dynamics based approaches

System dynamics (SD) based approaches take a top-down method to manage and analyze complex adaptive systems invol- ving interdependencies [78,199,115,143]. Feedback, stock and flow

M. Ouyang / Reliability Engineering and System Safety 121 (2014) 43–60 49

are the basic concepts in this type of approaches. Feedback loops indicate connection and direction of effects between CIS compo- nents. Stocks represent quantities or states of the system, the levels of which are controlled over time by flow rates between stocks. SD based approaches model the interdependent CISs by two diagrams: causal-loop diagram capturing the causal influence among different variables and stock-and-flow diagram describing the flow of information and products through the system [27,28,197]. CIP/DSS (Critical Infrastructure Protection/Decision Support System) tool is a successful application of system dynamic approach to study CISs interdependencies. This tool was devel- oped by the joint efforts from Los Alamos, Sandia, and Argonne National Laboratories with the assistance of functional modeling and nonlinear optimization techniques [32,186,130]. CIP/DSS used nearly 5000 variables to model all CISs as defined by Homeland Security Presidential Directive 7 (e.g., water, public health, emer- gency services, telecom, energy, transportation) and their major interdependencies at an aggregate level. It enabled decision makers to determine what consequences might be expected from disruptions to infrastructure, explore the mechanisms behind these consequences, and evaluate mitigations for a particular risk.

Currently, CIP/DSS has been applied to a variety of specific scenarios, such as modeling an influenza outbreak and evaluating the impact of interventions and public behavior on spread of the infection [76]; analyzing the cascading effect of a power system disruption on the telecommunications infrastructure as well as the emergency service infrastructure and investigating the conse- quences when more and more consumer population adopt tele- com services without the back-up power support [47]; investigating the impact of an infectious disease release on the metropolitan economy and analyzing the effectiveness of various responses and protective measures, such as quarantine [53]; predicting the impacts of displaced people on Baton Rouge subsequent to Hurricane Katrina [198]. Also, there were some studies extending the capacities of CIP/DSS. For example, LeClaire et al. [119] introduced a desktop simulator to help bridge the gap between the tool developer and the real decision makers.

In sum, SD based approaches model the dynamic and evolu- tionary behavior of the interdependent CISs by capturing impor- tant causes and effects under disruptive scenarios, capture the effects of policy and technique factors to reflect the system evolution in the long term and provide the investment recom- mendations, incorporate multi-attribute utility functions to com- pare alternative infrastructure protection strategies and help build consensus among stakeholders in a decision. The weaknesses of this type of approaches include the following: (1) as the causal- loop diagram is established based on the knowledge of a subject- matter expert, it is also a semi-quantitative method. (2) Many parameters and functions in the models require calibration, which need a huge amount of data. But in reality, data is not easily accessed due to many reasons, such as security concerns. (3) In fact, SD based approaches use a series of differential equations to describe the system-level behaviors of the CISs. They cannot analyze component-level dynamics, such as the adjustment or change of infrastructure topologies. (4) Due to the difficulty to obtain relevant data, validation efforts usually consist of concep- tual validation only for important descriptive variables of each CIS to determine if the model produces a reasonable response to perturbations, so there is relatively limited validation of the model. These weaknesses call for integrating other modeling approaches in a uniform analysis framework for overall decision support.

4.4. Economic theory based approaches

In a market of an economy, there are mainly two types of players: households and producers. Households offer labor

and capital to producers in exchange for income payments. The producers produce goods and services by the use of not only labor and capital, but also various types of raw and processed materials and various services, referred to as “Intermediate Goods”. CISs in an economy fall into this category of intermediate goods since they are essentially required by all procedures. Hence, the CISs interdependencies can be analyzed through models of economic interdependencies [182]. In the existing literature, two types of economic theories are employed to model CISs interdependencies: input–output (I–O) and computable general equilibrium (CGE).

4.4.1. Input–output based methods In 1973 Nobel laureate Wassily Leontief proposed the input–

output economic model [122]. It was a static and linear model of all purchases and sales between sectors of an economy based on the technological relationships of production [179].The original Leontief I–O model follows: x ¼ Ax þ c⇔fxi ¼ ∑jaijxj þ cig∀i, the term xi refers to the total production output from the industry i; the Leontief technical coefficient aij is the ratio of inputs of industry i to industry j in terms of the total production require- ments of industry j; the notation ci represents the industry i′s total output for final consumption by end-users.

Applying the equation in interdependent CISs and interpreting the output as the risk of inoperability which is defined as the inability of a CIS to perform its intended functions, the first- generation physical input–output inoperability model (IIM) was proposed by Haimes and Jiang [92]. In this model, xi was the overall risk of inoperability of the ith infrastructure that can be triggered by malicious attacks or accidental disturbances; aij was the probability of inoperability that the jth infrastructure con- tributed to the ith infrastructure due to their interconnectedness; ci was the additional risk of inoperability that was inherent in the complexity of the ith infrastructure. Hence, given a perturbation from one or multiple infrastructures or industries of the economy, the IIM can estimate the ripple effects measured by infrastructure or industry inoperability.

Based on the Leontief Input–output model and the concept of inoperability, a series of extended IIM based models have been subsequently proposed, such as demand-reduction IIM defining the perturbations as the reduction of the final demand to a set of economic sectors and assessing the output reduction or inoper- ability of each interdependent economic sectors [187,94]; dynamic IIM describing the inoperability evolvement process and the temporally interdependent recovery of economic sectors after an attack or natural disaster while integrating the industry resilience coefficients to quantify and manage the improvement of various sectors [124,94,217]; supply-side price IIM discussing the cascading failures among interdependent economic sectors when the initial inoperability is driven by the value-added perturbations and output-side IIM investigating the perturbations to output levels [123], the International Trade IIM model considering the import activities and proposing the concept of Gross Trade Economy (GTE, sum of gross domestic products and gross imports) to analyze the international trade inoperability for all industry sectors resulting from disruptions to a major port of entry [107] and Multiregional IIM modeling the multi-sector and multiregional economic inter- dependencies and using relevant geo-spatial databases to estimate higher-order impact propagations across multiple regions and industry sectors [50,151].

These IIM based models offer intuitive interpretations of interdependencies and can be used to analyze the inoperability of CISs to different types of perturbations, which led to their successful applications in the hierarchical holographic modeling on the risks of terrorism to the homeland security [93], and the

M. Ouyang / Reliability Engineering and System Safety 121 (2014) 43–6050

risk analysis of terrorism to Virginia′s interdependent transporta- tion systems [48], the impact of high-altitude electromagnetic pulse (HEMP) attack on different economic sectors [95], the demand reduction of air transportation following the terrorist attacks of September 11, 2001 [188], the financial and inoperability effect of the US Northeast blackout in 2003 [5], the major impact of the US Gulf Coast hurricanes in 2005 [49], risk-based decision making under uncertainty [96,9,10], the resilience between the power delivery system and telecommunication system under Hurricane Katrina [168], the economic impact of cyber attacks on the oil and gas sector [189].

In sum, the inoperability input–output models (IIM) can easily analyze how perturbations propagate among interconnected infra- structures and how to implement effective mitigation efforts [105,33]. These models are based on the large-scale databases (Economic Analysis database of national I–O accounts and Regio- nal Input–Output Multiplier System accounts), and measure the interdependencies among infrastructure sectors by economic relationships. Hence, the IIM based models are useful for macroeconomic-level or industry-level interdependency analysis in the aftermath of natural hazards, malicious attack or accidental events. Also, these models can provide analytical solutions so that it is easy to make the parameter sensitivity analysis. The weak- nesses of this type of models include the following: (1) the input– output based models cannot analyze the interdependencies at the component levels. (2) As the interdependent matrix is derived from the economic databases, the elements in the matrix only measure the interdependent strength in normal economic opera- tions. Actually, the interdependent strength would be non-linear and depend on the real-time infrastructure or industry outputs, so IIM based models can give a good approximate analysis on cascading the failure process and recovery process when the perturbations have small impacts on some economic sectors, but for large perturbations or new perturbations on un-recovery economic sectors caused by some old perturbations, the IIM will show large resulting errors and not be applicable any more.

4.4.2. Computable-general-equilibrium based methods Computable General Equilibrium (CGE) can be viewed as an

extension of the input–output model [181]. It inherits the main features of I–O models, such as the consideration of interdepen- dencies among economic sectors, while it overcomes most of their limitations, such as linear interdependencies among economic sectors, lack of consumers′ and producers' behavioral responses to markets and prices subject to labor, resource and capital constraints [180]. In CGE, the production functions of the produ- cers incorporate economic resilience in the equation structures, i.e. allowing for the substitution of the inputs in response to market changes. Applying the CGE, Rose and Liao [183] studied the economic resilience of the Portland, Oregon region under water system disruptions due to an earthquake as well as the effective- ness of various resilience improvement strategies, such as pre- event water pipeline replacement, and post-event increased Water Conservation and Substitution. With a similar approach, Rose et al. [184] analyzed the economic impacts of a terrorist attack on the Los Angeles power system. The economic loss was estimated as $20.5 billion without resilience strategies but reduced to $2.8 billion with the strategies, including conservation, onsite electri- city generation, rescheduling of production.

Recently, by using the CGE theory and its extension spatial CGE theory, Zhang and Peeta [159,218] proposed a generalized approach to analyze various types of CISs interdependencies under a multi-layer infrastructure network (MIN) modeling platform, which uniformed different infrastructures with different operating mechanisms and flow characteristics under a single framework.

MIN modeled different CISs at different network layers, where the vertical links represented the interdependencies among various CISs in the same region and the horizontal links in a layer captured the interactions or flows of a CIS across different regions. Using this modeling platform and the CGE and the spatial CGE (SCGE) theories, the approach can model the infrastructure network structure, substitutability of infrastructure commodities/services, decision-making behavior of producers and system users, and the transportation/transmission costs so that different types of CISs interdependencies, such as functional, physical, budgetary, market and economic, can be captured simultaneously. The authors also discussed and addressed the calibration, implementation, and computational issues related to deployment using available data, as well as the dynamics and disequilibrium analysis involving CISs interdependencies [219].

CGE based methods extend the capacities of the Input–output methods, capture the nonlinear interactions among CISs, provide resilience or substitution analysis of single CIS and the whole economy, and enable to capture different types of interdependen- cies in a single framework. The weaknesses of this type of methods include the following: (1) the calibrations of production functions and utility functions depends on the choice of the function form, and they become difficult when the relevant data is scant. (2) For the resilience analysis for the producers, it relies on external sources for some of the elasticity values required during their calibration. Studies to derive the elasticity value are scant.

4.5. Network based approaches

CISs can be described by networks, where nodes represent different CIS components and links mimic the physical and relational connections among them. Network based approaches model single CISs by networks and describe the interdependencies by inter-links, providing intuitive CISs representations along with detailed descriptions of their topologies and flow patterns. Per- formance response of CISs to hazards can be analyzed by firstly modeling the component failures from hazards at component level, and then simulating the cascading failures within and across CISs at system level. Depending on whether modeling the particle flow on CISs, this subsection groups network-based studies broadly into topology-based methods and flow-based methods.

4.5.1. Topology-based methods The topology-based methods model the interdependent CISs

only based on their topologies, with discrete states for each component (node or link) and usually with two states: failed and normal. Nodes can be failed directly from the hazards, or indirectly due to the disconnections from the source nodes in the same CIS [155] or due to the simultaneous failures of their dependent nodes in another CIS or due to some other factors, such as failures of back-up supports [1]. Depending on how detailed the CISs topologies are modeled, the topology-based studies can be analyzed by analytical methods and simulation methods.

4.5.1.1. Topology-based analytical methods. When CIS topologies are modeled without considering node heterogeneity, i.e. without differentiating source nodes, transmission nodes and sink nodes, each CIS can be then characterized by its node degree distribution represented by a generating function, and the giant component size of interdependent CISs under random hazards and malicious hazards can then be investigated analytically. Here, generating function is a formal power series whose coefficients encode information about a sequence that is indexed by the natural numbers [7]. Based on this definition, distribution pk which is the probability that a randomly chosen vertex in a network has

M. Ouyang / Reliability Engineering and System Safety 121 (2014) 43–60 51

degree k has the generating function G0ðxÞ ¼ ∑1k ¼ 0pkxk [134]. The generating function method can analyze the spread of epidemic disease on networks [135,59], the breakdown of network under intentional and random attack [2,45,46], the structure of shells in networks [194], the fractal boundaries of networks [193] and the cascading failures in interdependent networks [30].

For two interdependent networks A and B with different number of nodes NA, NB, denote their vertex degree distributions respectively by PA(k), PB(k). Initially, remove a fraction 1�RA of A nodes and 1�RB of B nodes, all nodes in the giant components of networks A and B keep functional and others fail. Also, due to the interdependencies, a B (A) node can still function only if at least one of its dependent A (B) nodes is still survival. The recursive failure process proceeds between A and B until there are no further failures. In the literature, there are several following interdependent relationships. (1) The two networks have the same size NA¼NB¼N, and the interdependency is one-to-one corre- spondence Ai2Bi, i.e. Ai depends on Bi while Bi also depends on Ai [30,103]. (2) The two networks have the same size NA¼NB¼N, a fraction qA of A nodes depend on the B nodes and a fraction qB of B nodes depend on the A nodes [154]. (3) The two networks have the same size NA¼NB¼N and the identical degree distribution PA(k)¼PB(k)¼P(k) with still one-to-one correspondence, but an interdependent link connects a A node and a B node with the same degree [31]. (4) The inter links between network A and network B are random and uni-directional, there are cBA0 N

A inter-links dis- tributed randomly from B nodes to A nodes, and there are cAB0 N

B

inter-links distributed randomly from A nodes to B nodes [195]. Under different interdependent relationships, the size of the giant mutually connected component of coupled networks under dif- ferent hazards in the final state μ1 can be calculated, and the general results showed that the interdependencies increased the system vulnerability in contrast to the non-interdependency scenarios. This result was also found by applying mean-field theory in coupled regular networks [36]. Also, the interdependent networks were difficult to defend by strategies such as protecting the high degree nodes that had been found useful to significantly improve robustness of single networks. The above studies all aim at two interdependent networks, Gao et al. [80] further studied the performance response for n interdependent networks (each of them has an average degree k) under random hazards, and a general equation for the giant mutually connected component μ1 was found, μ1 ¼ RA½1�expð�kμ1Þ�m.

Despite the generating function method offers analytical solu- tions of the interdependent networks under different types of hazards, this method can only analyze the randomly constructed networks with large or infinite size under random hazards with identical failure probabilities for all components and malicious hazards by removing the nodes with largest degrees, but becomes incapable for the real infrastructure networks with spatial con- straints and limited size as well as for networks under natural hazards with different component failure probabilities, which can be investigated by simulation methods.

4.5.1.2. Topology-based simulation methods. When some CISs are modeled by their topologies with additional consideration of node heterogeneity, scholars usually use the simulation-based methods to investigate the performance response of interdependent CISs under different hazards, including the natural hazards. In these studies, the performance of each network can be measured by many metrics, such as the number of normal or failed components [1,106], the inverse characteristic path length [145], the connec- tivity loss [65], the redundancy ratio and the cluster related metrics [66]. Also, with the number of damaged nodes or the vector of damaged nodes, incorporating some functional proper- ties of the nodes, such as the duration of the component unavail- ability, the number of customers served, system-level performance

can be also quantified by some functionality metric, such as lost service hour [106], the fraction of customers affected [163]. Measuring the damage level of a CIS by above performance metrics, system-level response can be further reflected by the fragility curves, which represent the probability of the system- level damage exceeding an given damage state under different hazard intensities [63,64,66,99].

Given a performance metric, the interdependent effect can be also quantified as the absolute differences between the indepen- dent and interdependent responses normalized by the maximum independent response [66,146]. This metric facilitates the assess- ment of mitigation actions, such as adding bypass [120], hardening individual component performance [65], the results showed that small disruptions were controlled with bypasses and large disrup- tions were reduced if their components were less fragile. To reduce the cascading failure effects across CISs, adjusting and designing the interface configurations (interdependent topologies) is also an effective strategy. Taking the power transmission system, water and gas system as an example, Winkler et al. [214] compared different strategy effectiveness under random failures and hurricane hazards according to a network based topological model. Those strategies were designed based on component degree, component betweenness, vertex clustering coefficient, Euclidean distance across components. Also, Hernandez-Fajardo and Dueñas-Osorio [98] investigated the cascading failure process of the interdependent CISs from transient to steady state perfor- mance and found that most of the interdependent failure propa- gation across the CISs occurred early.

In sum, the topology-based methods mainly capture the topological features of the interdependent CISs, identify the critical CIS components and provide suggestions on robustness improve- ments from the topological perspective. Despite a system topology determines its functionality, recent studies showed that the topological model alone cannot provide sufficient information about the flow performance of real CISs [100,150]. Hence, topology-based methods cannot be used alone to inform the decision-making for real-world CISs and call for integrating other modeling approaches in a uniform analysis framework for overall decision support.

4.5.2. Flow-based methods The flow based methods take account of the services or flow

made and delivered by the CISs. Nodes and edges constructing the infrastructure topologies have the capacities to produce, load and deliver the services. Based on this concept, some scholars pro- posed uniform network descriptions for different types of CISs and their interdependencies. Wallace and Lee [212,121] modeled different infrastructure functionalities by a uniform network flow mathematical representation. The movement of commodities corresponded to flows, and the services corresponded to a desired level of these flows. For each network, commodities flowed from node to node along arcs in the network. Each node was either a supply node, a demand node or a transshipment node and each arc had limited capacities. It also enabled mathematical represen- tations for different types of interdependencies, and allowed users to assess the post-disruption impact and analyze the restoration process [142,41]. This model has been used in the impact analysis of CISs interdependencies in the operation of health care facilities during disaster events [6]. In addition, [201–204] modeled the CIS components by a set of response functions, which can capture the productions and consumptions of both buffered and un-buffered flows in some CISs. Also, in a much simpler case, where a failed component causes a load transferred to the loads of all other components in the same network while all loads of the compo- nents of the other network are increased by a load increment, the

M. Ouyang / Reliability Engineering and System Safety 121 (2014) 43–6052

performance response of coupled networks under a perturbation can be then solved by applying the branch process theory [136], and results still showed the coupled networks were more suscep- tible to large-scale failures than single network. Instead of trans- ferring the load to all other nodes once the failure of a node, [222,223] modeled the load redistribution only to the first neigh- bors of the failed node and found some similar results.

However, different CISs have different operation mechanisms, which are not suitable to be characterized by a uniform model. Using the physical rules to describe each CIS can provide more realistic modeling on interdependencies. Modeling the power system by the direct current (DC) power flow model [57,58] and the gas system by the pipeline flow model, Ouyang et al. [145] investigated their interdependent effects and found that the results were largely different from those by the topology-based method. By applying the same flow models in power and gas systems in Houston, Ouyang and Duenas-Osorio [147] modeled the multiple hazards (random hazards and hurricane hazards) and proposed a global effectiveness metric to find a global optimum strategy to design the interdependent topologies between CISs. The new models captured the network flow with approximate methods and went beyond previous studies focused only on connectivity. Also, modeling the power system by the DC power flow model and the internet by the data packet model, Rosato et al. [177] studied the variation of the internet quality of service (QoS) with respect to the QoS of the electrical network, and developed a decision support system for the fast and efficient set up of mitigation and healing strategies [178].

There are also many other flow-based studies. Bobbio et al. [23] proposed a service oriented stochastic modeling methods to investigate the availability of interdependent power grid and Telco network under the outage of critical SCADA communication links. Trucco et al. [208] defined a network node as a large functional part of a CIS and then used a dynamic functional model to assess the propagation of impacts within and across CISs at regional level in terms of disservice. Delamare et al. [54] analyzed the impact of the fast-healing telecommunication system (modeled by the router based model) on the operation of the electric power system (modeled by the maximum flow model). Nozick and Turnquist [141] modeled the interdependent gas infrastructure, the SCADA system controlling the gas pipeline flows, and the gas-fired electrical generators by the max flow model and the Markove and semi-Markove process for the holding time distribution for gas flow transition, they investigated the robustness of the gas system by simulating the time distribution for the system to recovery and satisfy all demands when all the capacities on each link was reduced to the minimum values. This approach can be also used to study the optimum restoration investment by updat- ing the state-space, and the transition matrices [216]. To model the U.S. energy system disruption under 2005 hurricanes Katrina and Rita, Gil and McCalley [83] proposed the multi-period network flow model (linear program model) to simulate the nationwide movements of bulk energy flows through the network in the whole nation and analyzed the damage propagation among nature gas, coal, and electric systems by the variation of price [166,167]. They found that the bulk energy system was robust and able to tolerate large and multiple disruptions mainly due to coal storage. The model can also be extended to a long-term investment planning model capable of identifying what, where and when infrastructure investments should be made [104].

In sum, flow-based methods capture the flow characteristics of interdependent CISs, and provide more realistic descriptions on their operation mechanisms. This type of methods can also identify critical CIS components, and provide emergency protection sugges- tions on CISs. However, if the detailed operation mechanisms of CISs are modeled in detail, the computational cost is very high.

4.6. Other approaches

Besides the above approaches, there are some other approaches to model and analyze the interdependent CISs, such as the hierarchical holographic modeling (HHM) method, the high level architecture (HLA) based method, the petri-net (PN) based method, the dynamic control system theory (DCST) based method, the Bayesian network (BN) based method, and so on.

HHM is a holistic methodology aimed at capturing and repre- senting the diverse characteristics and attributes of a CIS [91,96]. It can provide an understanding of risks at different levels and a multi-view image of a CIS with regard to identifying vulnerabil- ities. The basis of HHM is the overlapping among various holo- graphic models with respect to the objective functions, constraints, decision variables, and input–output relationships of the CISs. Through HHM [91], multiple mathematical models can be developed and coordinated to capture multiple dimensions, visions, and perspectives of the interdependent CISs. However, this approach is difficult to apply in the interdependent CISs, because the structural complexity, network evolution, connection diversity, dynamical complexity, node diversity and the interde- pendent complexity of the interdependent CISs lead to the difficulty and infeasibility of providing a mathematical model for some dimension, or vision or perspective of the system.

Interdependent CISs can be regarded as the system-of-systems [72,114], which “consist of multiple, heterogeneous, distributed, occasionally independently operating systems embedded in net- works at multiple levels that evolve over time” [55]. Based on the SoS approach, Zio and Ferrario [224] took the Muir Web as system analysis tool to analyze the contribution of interdependent power and water distribution, and transportation networks to the safety of a critical plant; Eusgeld et al. [73,72] introduced a HLA-based interdependency modeling architecture. The architecture includes three levels: the lower level includes the models of single CISs, the middle level includes the interaction model between CISs and the high level represents the global system of systems model. The HLA standard captures the interdependencies through the communica- tion within a “system-of-systems” by a run time infrastructure in a distributed simulation environment. Applying the approach in the interdependent electric power system and its own SCADA system demonstrated its efficiency to capture the CISs interdependencies [132,131].

The Petri net (PN), proposed by Carl Adam Petri [162], can be represented by a four tuple: PN¼(P, T, I, O), where P stands for a set of places, T for transitions, I for input functions (a mapping from bags of places to transitions) and O for output functions (a mapping from transitions to bags of places). Another element of the Petri-Net is ‘token’ which are placed in the places. Taking the places of the net together with the tokens to represent the states or conditions of the CISs or their components, and the transitions to represent the impacts across CISs or their components, then the CISs interdependencies are simulated by the flow of the tokens throughout the network [16]. Using the petri-net based approach, Laprie et al. [117] provided a petri-net representation for the interdependencies between electricity and information infrastruc- ture systems; Gursesli and Desrochers [89] analyzed the vulner- ability and the recovery strategies for the interdependent CISs originally introduced by [173]; Sultana and Chen [200] modeled the flood-related interdependencies among CISs and their vulner- abilities with the help of fragility curves. Ge et al. [81] developed a GeoPetriNet system to simulate the complex geographical rela- tionships between places and nodes. This method is similar to the network-based approaches, and if modeling the system in detail or having a large system size, the computation complexity is high.

The DCST based method is a quantitative method based on the use of the dynamic control system theory [68,77]. This method

M. Ouyang / Reliability Engineering and System Safety 121 (2014) 43–60 53

describes involved infrastructures and their components by the transfer functions, which express the input/output relationship of two infrastructure components into the domain of Laplace or in the domain of frequency, and then by the application of Mason′s formula, it can compute a global transfer function as well as the corresponding response along a path of interest. The interdepen- dencies can be then quantified by the norm of the global transfer function [185]. This method has been applied in the “Methodology for Interdependencies Assessment” (MIA) EU Project [40], which aims to assess measures of inter-dependencies between the telecommunication system and the electrical system.

The BN based method uses a directed acyclic graph to model involved infrastructure systems and their interdependencies. In this graph, nodes represent random variables, which describe the status of infrastructure components and services as well as the adverse events; edges represent conditional dependencies, reflect- ing the causal relationships among adverse events, CISs compo- nents and infrastructure services [90]. However, the simple BN is associated with each time slice and only provides a static model of the system at each time instant. To capture the dynamic behaviors of CISs, the dynamic Bayesian networks are proposed by introdu- cing inter-time-slice links and conditional probability tables, which represent the temporal probabilistic dependencies between variables belongs to different time slices [85,84].

5. Discussions

Section 5 introduces and reviews different modeling and simulation approaches on the interdependent CISs. This section first compares different approaches from several criteria, with resilience as the main perspective, and then identifies and con- cludes the future research directions and challenges.

5.1. Approach comparisons

To compare different approaches, there exist many comparison criteria in the literature, such as quantity of input data, accessi- bility of input data, types of interdependencies, computation complexity, maturity, CISs types, hazard types. Among these criteria, CISs types and hazard types may well differentiate each detailed study, but not for each approach introduced in Section 4, because almost all approaches can be extended to apply in other CISs and other hazard types. This paper first takes the following five criteria into consideration to compare different approaches.

(1)

Quantity of input data: this criterion refers to the quantity of input data needed for an application of an approach. The input data historical failure reports, economic input–output quan- tities, the topology and geographical sites, component char- acteristics, policy and technical parameters and others. Three letters “S”, “M”, “L” rank the quantity level, and they respec- tively correspond to the small, medium and large amount of input data. Two or three letters may together describe one approach, which indicates the possible extensions.

(2)

Accessibility of input data: this criterion judges the availability to get the required input data. The barriers to get relevant data include antitrust laws, confidentiality and privacy issues, liability issues, access to classified national security information, and reservations about sharing information with the law enforce- ment community [173]. Three letters “S”, “M”, “L” rank the accessibility level, and they correspond to the difficult, medium and easy access of input data, respectively.

(3)

Types of interdependencies: this criterion describes the types of interdependencies that can be modeled by each approach. As discussed in Section 2, despite there exist many types of

classifications, only Rinaldi et al. [173] provide a self-contained classification, which can sort out all the identified interdepen- dency examples and then is used in this paper to compare different approaches. Four letters “P”, “C”, “G” and “L” respec- tively correspond to physical, cyber, geographical and logical interdependencies.

(4)

Computation complexity: this criterion describes the computa- tional cost for each approach to analyze the performance response of CISs under a disruptive event. Fast performance response analysis can support online simulation and accelerate the emer- gency response and decision makings. Three letters “S”, “M”, “L” respectively correspond to fast (less than 1 s), medium (several seconds to several minutes), and slow (several minutes to several hours to several days) computational cost.

(5)

Maturity: this criterion measures the development level of each approach. The judgment is based on the number of relevant publications and applications. Three letters “S”, “M”, “L” respectively correspond to the low (less than 5 publications, few applications), middle (5–20 publications, prototype appli- cations), and high level of maturity (more than 20 publications and successfully applied in real-world CISs).

Based on the above criteria, Table 2 shows the comparison results for those approaches introduced in Section 4. From the table, for the criterion of input data quantity, almost all approaches require medium or large amount of data except the topology- based analytical methods; for the criterion of input data accessi- bility, the input–output based methods are easy to access the required analysis data while agent-based methods and the flow- based methods are difficult to access because agent-based meth- ods need many types of data, such as policy decision variables, human behavior variables, some of which are different to collect; the flow-based methods need the detailed information about component characteristics, which are usually related to the privacy and security issues and are then difficult to obtain. For the criterion of interdependency types, the empirical approaches, agent-based approaches, Computable-general-equilibrium theory based approaches, network based approaches, the HLA based method, the DCST based method, and the BN based method can model all four types of interdependencies; for the criterion of computation cost, empirical approaches, input–output based approaches, and the topology-based analytical methods only need small computational cost, because they all can analyze the CISs interdependencies by analytical calculation without running simu- lations; for the criterion of maturity, agent based approaches have been successfully used by several national libraries to apply in many real-world CISs; input–output theory based approaches have been developed well by Haimes et al. and applied in practice with a lot of publications; the network-based approaches are regarded as mature mainly based on the publications (more than 20), but in fact there still exist many challenges to use this type of approaches in practice to design or improve real-world CISs, as discussed in Section 4.4.

Recently, the concept of resilience is proposed, and the U.S. National Science Foundation committee has spent $0.15 billion in the past 6 years (from 2006 to 2012) to support the research regarding “resilient and sustainable infrastructures”. Resilient CISs are expected to realize the goal of a resilient nation as claimed by the Present Obama of the United States. Regarding the definition of resilience, it varies by disciplines and applications [102,51,109,101,29,168,211]. To sum up these and other definitions, the author defined resilience as the joint ability of a system to resist (prevent and withstand) any possible hazards, absorb the initial damage, and recover to normal operation [148,149]. In other words, system resilience is determined by three system capacities: the resistant capacity as the ability to prevent any possible hazards and reduce the initial damage level if a

Table 3 Sample strategies to improve CISs resilience.

Capacity type Resilience improvement strategies (sample applications)

Resistant capacity

1.1 Adjust and improve the organizational and administrative structure to increase early-warning awareness, such as ingraining the safety culture awareness in CISs, reinforcing staff training to decrease human errors.

1.2 Add and update safety constraints to each participant in the CISs so that the frequency of random hazards can be reduced, such as purchasing high-quality equipment and install properly, implementing strict vegetation program, placing barricades or fences.

1.3 Harden and protect the key CISs or their components, prevent the events enabling to cause large consequences. 1.4 Learn and improve from previous accidents using accident models, such as the System-Theoretic Accident Model and Processes approach. 1.5 Establish an observatory network to sense, monitor, and update system states in real time along with state visualizations based on emerging

infrastructure modeling techniques, such as Bayesian networks, to assess on-line risk for early warning. 1.6 Manage consumer behaviors to keep the CISs load at a certain level to reduce the overload-induced hazards.

Absorptive capacity

2.1 Adjust and improve the organizational and administrative structure to accelerate the emergency decisions, such as sharing information among stakeholders, reinforcing staff training to accelerate the response time, ingraining the interdependency-related culture awareness, adjusting the market structures.

2.2 Optimize and retrofit the topology of each CIS as well as the interface topologies across CISs. 2.3 Design and prepare redundancy, backup and substitution to lower the interdependency impacts. 2.4 Improve the absorptive capacities of some key CISs, such as the transition of the traditional power systems to smart grids. 2.5 Manage or directly control consumer behaviors to adjust the system load in the emergent scenarios to avoid the large-scale cascading failures. 2.6 Improve the robustness and self-configuration of the communication systems to keep the situational awareness for rapid emergency decisions.

Restorative capacity

3.1 Adjust and improve the organizational and administrative structure to accelerate restoration decisions and coordination, such as sharing information among stakeholders, establishing the fusion center to coordinate the participants during emergency scenarios.

3.2 Design advanced decision support platform to quickly find the restoration sequences and priorities, optimum resource allocation strategies. 3.3 Improve the restorative capacities for key CISs, such as electric power systems, communication systems. 3.4 Increase the variety and robustness of communication channels.

Table 2 Approach comparisons from several criteria.

Approach type Sub-approach Quantity of input data

Accessibility of input data

Types of interdependencies

Computation cost

Maturity Resilience

Empirical M, L M P, C, G, L S M 1.3,2.3, 2.4, 3.3 Agent-based L S P, C, G, L L L 1.1, 1.2, 1.4, 1.6, 2.1, 2.5, 3.1, 3.3 SD based M, L M P, C, L M L 1.6, 2.5, 3.3

Economic theory based

Input output M L P, C S L 1.3, 2.3, 2.4, 3.2 Computable general equilibrium

L M P, C, G, L M M 1.3, 1.6, 2.3, 2.4, 2.5, 3.2,

Network based Topology-based method S, M M P, C, G, L S, M L 1.3, 2.2, 2.3, 3.2, 3.3 Flow-based method L S P, C, G,L L L 1.3, 1.5, 1.6, 2.2, 2.3, 2.4, 2.5, 2.6,

3.2, 3.3, 3.4

Others HHM L S P, C, L S S 1.6, 2.5, 3.3 HLA based L L P, C, G, L L S 1.1–1.6, 2.1–2.6, 3.1–3.4 PN M, L M P M, L M 1.3, 1.6, 2.3, 2.4, 2.5, 3.3, 3.4 DCST M, L S P, C, G, L M S 1.3, 1.6, 2.3, 2.4, 2.5, 2.6, 3.3, 3.4 BN M, L S P, C, G, L M S 1.3, 1.5, 1.6, 2.3–2.6, 3.3, 3.4

M. Ouyang / Reliability Engineering and System Safety 121 (2014) 43–6054

hazard occurs, the absorptive capacity as the degree to which the systems absorb the impacts of initial damage and minimize associated consequences, such as cascading failures, and the restorative capacity as the ability to be repaired quickly and effectively. Based on the above concept of resilience, the author concludes a sample series of resilience improvement strategies of the interdependent CISs from each of the three capacities. The results are shown in Table 3. To assess the effectiveness of these strategies, it requires corresponding modeling and simulation approaches to support decision makings among different strategies. This paper next discusses how each type of modeling and simulation approaches introduced in Section 4 can support the effectiveness analysis of those improvement strategies listed in Table 3. The results are additionally shown in Table 2 with resilience as another perspective.

From the table, there are two interesting results. First, most of the modeling and simulation approaches only support a part of the sampled resilience improvement strategies, which indicates the overall resilience analysis and management of interdependent CISs

requires different modeling approaches in a uniform framework. The HLA-based method is supposed to support all strategies because it is a hybrid approach, which can integrate all other approaches, but there still exist many challenges to apply this approach in practice and make it mature. Except the HLA-based method, the agent-based methods and network flow-based meth- ods can support most improvement strategies, but they also require the largest quantity level of input data. Second, some strategies can be analyzed by multiple approaches. For the strategy 1.3, the critical CISs or their components can be found out not only by empirical approaches through identifying the systems or components involved in the frequent and significant failure patterns, but also by the network based methods through compar- ing the performance loss after the failure of each system or component. For the strategy 2.2, the optimum CIS topology can be analyzed not only by the topology-based methods, but also by the flow-based methods. Hence, in practice, how to choose an appropriate approach to support decision making? This requires a

M. Ouyang / Reliability Engineering and System Safety 121 (2014) 43–60 55

concept to integrate different approaches into a single framework and co-simulation platform to address different aspects of inter- dependent CISs and determine their application sequences to avoid conflictions.

5.2. Future directions and challenges

Based on the approach review in Section 4 and the approach comparisons in Section 5.1, this subsection identifies the following research directions and challenges:

A.

Data access and collection Difficult to access data or lack of precise data is a key problem

in the field. To provide a detailed description and modeling of interdependent CISs, it requires a lot of relevant data, such as the topologies of single CISs, component geographical loca- tions, interdependency relationships, operational, emergency and other procedures used by CISs owners under normal or crisis scenarios, government and corporate policies. To access these data is usually difficult due to a series of reasons including the antitrust laws, confidentiality and privacy issues, liability issues, and reservations about sharing information with the law enforcement community [172]. To find a tradeoff strategy to access detailed and high quality data needs the joint efforts from the government agencies, research communities and the utility companies. In addition, historical event data collection can not only support the empirical approaches to facilitate ex ante and ex post mitigations and decisions, but also provide the basis to validate other modeling and simulation approaches. Despite scholars have proposed different databases to collect CISs event data, there is no standardized data collection methodology for interdependent CISs. Hence, a uni- form data collection method should be proposed, including exact definitions on CISs and their interdependencies, while the media reporting systems should follow some requirements to collect the data so that the time to code and sort out the incident reports is saved to support rapid analysis.

B.

Comprehensive modeling and analysis The applications of some approaches in the literature, such as

agent based approaches, network based approaches, usually modeled two or only a proportion of the CISs and mainly focused on the CISs like electricity power, water, gas and communication systems. Other CISs like banking and finance, commercial facilities, and government facilities, received rela- tively less attentions. However, these CISs are of critical importance to disaster mitigation and recovery as well, and their integration can capture more types and more detailed descriptions of the CISs interdependencies in a comprehensive modeling framework. Also, CISs are not static but evolving due to the technological innovation, demand decrease and so on, such as the transition of traditional power systems to smart grids, the topological adjustment of physical CISs after adding new nodes and links, the capacity augment of old links, and so on. An open modeling framework to capture both short-term and long-term change and evolution of CISs is more desired for applications.

C.

Integration and co-simulation Different modeling and simulation approaches capture dif-

ferent aspects of interdependent CISs and sometimes may produce conflicted results, so it needs to integrate different approaches and distinct their responsibilities in a uniform framework. The systems theory may provide an integration concept. The operation and management process of interde- pendent CISs can be viewed as hierarchical structures where each level imposes constraints on the activity of the level beneath it, i.e., constraints at a higher level control the

low-level behavior, and effective communication channels enable the feedback and control between different levels [8,225]. Numerous of feedbacks and controls among subsys- tems (including congress and legislatures, government agen- cies, utility companies, fusion center, operation and management departments, and the physical facilities of CISs) in the hierarchical structures keep the normal and stable operations of CISs. For each subsystem, to realize the systems' overall goal, such as safety, reliability and resilience, it needs to obey some constraints and fulfill some responsibilities, which may require the help of some modeling and simulation approaches. For example, for the departments of CISs planning and design, they may need to retrofit existing CISs or design new CISs, and the network based topological analysis is more appropriate to apply in this scenario. For the departments of CISs supervision and control, they may need to choose which CISs physical components are required to pay more attentions to monitor, and the network based flow analysis can be applied to identify the critical nodes. For the government agencies, they may need to decide the investment priority, and the empirical approaches can provide the critical CISs in priority. In this way, the integration of different approaches is realized through addressing different aspects of the CISs to reach an overall goal and the definitions of “critical” are various in different scenar- ios. However, there are still a lot of challenges for specific implementation of this concept. For example, to make a system-level decision to meet the needs of different CISs stakeholders, a co-simulation platform is required to support the decision making. Despite many studies, such as HLA-based method, have addressed these problems, the successful and comprehensive applications still require much work.

D.

Validation and applications Validation and applications are very crucial for the develop-

ment of different modeling and simulation approaches. First, new models are usually validated by comparing the model outputs to the historical data and obtaining feedback from experts in the field. But it should be careful because the CISs of interest are changing with time and the historical data cannot reflect the evolution. Second, empirical approaches and other validated approaches can produce a series of risk-informed metrics, such as resilience factors, the interdependent strength across CISs, system-level fragilities, but it still exists many challenges on how to use these metrics to inform different types of decisions, such as effectiveness assessment and com- parisons of mitigation, response and restoration strategies, so it requires a comprehensive and standard set of metrics and the proposal of some guidelines and standards to illustrate their applications.

6. Conclusions

The CISs are interdependent so that small failures in one CIS may spread to other CISs and lead to catastrophic event, largely affecting the economy and human beings' life. To understand performance response of interdependent CISs to different hazards and better protect them, scholars have proposed many modeling and simula- tion approaches to identify effective ex ante and ex post mitigation measures. This paper reviews the conceptual and qualitative studies about CISs interdependencies as well as their modeling and simulation approaches in the literature. Existing approaches are broadly grouped into six types: empirical approaches, agent based approaches, system dynamics based approaches, economic theory based approaches, network based approaches and others. For each type of the approaches, this paper organizes pertinent studies in terms of a certain principle, such as research focus, modeling

M. Ouyang / Reliability Engineering and System Safety 121 (2014) 43–6056

rationale, the analysis method. It provides a very clear picture about the connections among these studies and presents an introduction to the new scholars interested in this field. In addition, different types of the approaches are further compared according to several criteria, with the resilience as the main perspective to position their applications and drive the proposal of a system-theory based integration framework.

Despite existing studies contribute a lot to protect and manage the interdependent CISs, there are still many challenges left, as summarized in Section 5.2. In sum, this paper not only presents an introduction about the modeling and simulation approaches of CISs interdependencies to new scholars in the field, but also identifies the future research directions and challenges to better protect and manage the interdependent CISs.

References

[1] Adachi T, Ellingwood BR. Serviceability of earthquake-damaged water systems: effects of electrical power availability and power backup systems on system vulnerability. Reliability Engineering and System Safety 2008;93:78–88.

[2] Albert R, Jeong H, Barabasi AL. Error and attack tolerance of complex networks. Nature 2000;406:378–81.

[3] Amin M. Toward self-healing infrastructure systems. Computer 2000;33 (8):44–53.

[4] Amin M. Toward secure and resilient interdependent infrastructures. Journal of Infrastructure System 2002;8(3):67–75.

[5] Anderson CW, Santos JR, Haimes YY. A risk-based input–output methodology for measuring the effects of the August 2003 Northeast Blackout. Economic Systems Research 2007;19(2):183–204.

[6] Arboleda CA, Abraham DM, Richard JP, Lubitz R. Impact of interdependencies between infrastructure systems in the operation of health care facilities during disaster events. In: Proceedings of the joint international conference on computing and decision making in civil and building engineering. Montreal, Canada; June 14–16, 2006.

[7] Wilf HS. Generating functionology. 2nd ed. Boston, MA: Academic Press; 1994.

[8] Leveson N. A new accident model for engineering safer systems. Safety Science 2004;42(4):237–70.

[9] Baker K, Haimes YY. Assessing uncertainty in extreme events: applications to risk-based decision making in interdependent infrastructure sectors . Reliability Engineering and System Safety 2009;94(4):819–29.

[10] Baker K, Haimes YY. Uncertainty analysis of interdependencies in dynamic infrastructure recovery: applications in risk-based decision making. Journal of Infrastructure Systems 2009;15(4):394–405.

[11] Barrett C, Beckman R, Channakeshava K, Huang F, Kumar VSA, Marathe A, et al.. Cascading failures in multiple infrastructures: From transportation to communication network. In: Proceedings of the fifth international CRIS conference on critical infrastructures. Beijing; 2010.

[12] Barton DC, Eidson ED, Schoenwald DA, Stamber KL, Reinert RK. Aspen-EE: an agent-based model of infrastructure interdependency. Sandia report, SAND2000-2925; 2000.

[13] Barton DC, Edison EC, Schoenwald DA, Cox RG, Reinert RK. Simulating economic effects of disruptions in the telecommunications infrastructure. Sandia report, SAND2004-0101; 2004.

[14] Basu N, Pryor R, Quint T, Arnold T. ASPEN: a micro-simulation model of the economy. Sandia report. SAND96-2459; 1996.

[15] Basu N, Pryor R, Quint T. ASPEN: a micro-simulation model of the economy. Computational Economics 1998;12:223–41.

[16] Beccuti M, Chiaradonna S, Giandomenico FD, Donatelli S, Dondossola G, Franceschinis. Quantification of dependencies between electrical and infor- mation infrastructures. International Journal of Critical Infrastructure Protec- tion 2012;5:14–27.

[17] Becker T, Nagel C, Kolbe TH. Integrated 3D modeling of multi-utility net- works and their interdependencies for critical infrastructure analysis. Advances in 3D geo-information sciences. Lecture Notes in Geoinformation and Cartography 2011;2011:1–20, http://dx.doi.org/10.1007/978-3-642- 12670-3_1.

[18] Bernhardt KLS, McNeil S. Agent-based modeling: approach for improving infra- structure management. Journal of Infrastructure Systems 2008;14(3):253–61.

[19] Bigger JE, Willingham MG, Krimgold F, Mili L. Consequences of critical infrastructure interdependencies: lessons from the 2004 hurricane season in Florida. International Journal of Critical Infrastructures 2009;5 (3):199–219.

[20] Bloomfield R, Popov P, Salako K, Wright D, Buzna L, Ciancamerla E, et al. Analysis of critical infrastructure dependence – an IRRIIS perspective on the CRITIS 2008, Special IRRIIS Session, Italy; 13/15 October 2008.

[21] Bloomfield R, Chozos N, Nobles P. Infrastructure interdependency analysis: introductory research review. Adelard document reference: D/422/12101/4. ⟨http://www.csr.city.ac.uk/projects/cetifs/d422v10_review.pdf⟩; 2009.

[22] Bloomfield R, Chozos N, Nobles P. Infrastructure interdependency analysis: requirements, capabilities and strategy. Adelard document reference: D/418/ 12101/3. ⟨http://www.csr.city.ac.uk/projects/cetifs/d418v13_public.pdf⟩; 2009.

[23] Bobbio A, Bonanni G, Ciancamerla E, Clemente R, Lacomini A, Minichino M, et al. Unavailability of critical SCADA communication links interconnecting a power grid and a telco network. Reliability Engineering and System Safety 2010;95:1345–57.

[24] Bologna S, Setola R. The need to improve local self-awareness in CIP/CIIP. First IEEE international workshop on critical infrastructure protection; 2005. 10.1109/IWCIP.2005.19.

[25] Bompard E, Napoli R, Xue F. Assessment of information impacts in power system security against malicious attacks in a general framework. Reliability Engineering and System Safety 2009;94:1087–94.

[26] Briere J. Rapid restoration of critical infrastructures: an all-hazards paradigm for fusion centers. International Journal of Critical Infrastructures 2011;7 (1):21–36.

[27] Brown T, Beyeler W, Barton D. Assessing infrastructure interdependencies: the challenge of risk analysis for complex adaptive systems. International Journal of Critical Infrastructure 2004;1(1):108–17.

[28] Brown T. Multiple modeling approaches and insights for critical infrastruc- ture protection. Computational models of risks to infrastructure, NATO science for peace and security series D. In: Skanata D, Byrd DM (editors). Information and communication security, vol. 13. Amsterdam: IOS Press. p. 329.

[29] Bruneau M, Chang SE, Eguchi RT, et al. A framework to quantitatively assess and enhance the seismic resilience of communities. Earthquake Spectra 2003;19(4):737–8.

[30] Buldyrev SV, Parshani R, Paul G, Stanley HE, Havlin S. Catastrophic cascade of failures in interdependent networks. Nature 2010;464:1025–6.

[31] Buldyrev SV, Shere N, Cwilich GA. Interdependent networks with identical degrees of mutually dependent nodes. Physical Review E 2011;83:016112.

[32] Bush B, Dauelsberg L, LeClaire R, Powell D, DeLand S and Samsa M. Critical infrastructure protection decision support system (CIP/DSS) overview. Los Alamos National Laboratory Report LA-UR-05-1870, Los Alamos, NM 87544; 2005.

[33] Cagno E, Ambroggi MD, Grande O, Trucco P. Risk analysis of underground infrastructures in urban areas. Reliability Engineering and System Safety 2011;96:139–48.

[34] Cardellini V, Casalicchio E. Agent based modeling of web systems in critical information infrastructures. In: Proceedings of complex network infrastruc- ture protection. Rome; 2006.

[35] Cardellini V, Casalicchio E, Galli E. Agent-based modeling of interdependen- cies in critical infrastructures through UML. In: Proceedings of the 2007 spring simulation multi conference, vol. 2. Norfolk, Virginia; 2007, p. 119–26.

[36] Carreras BA, Newman DE, Gradney P, Lynch VE, Dobson I. Interdependent risk in interacting infrastructure systems. In: Proceedings of the 40th Hawaii international conference on system sciences; 2007.

[37] Casalicchio E, Setola R, Tucci S. An overview on modeling and simulation techniques for critical infrastructures. In: Proceedings of the IEEE computer society′s 12th annual international symposium on modeling, analysis and simulation of computer and telecommunications systems (MASCOTS'04); 2005, p. 4.

[38] Casalicchio E, Galli E, Tucci S. Federated agent-based modeling and simula- tion approach to study interdependencies in IT critical infrastructures. In: 11th IEEE symposium on distributed simulation and real-time applica- tions; 2007.

[39] Casalicchio E, Galli E. Federated agent based modeling and simulation: an approach for complex critical system analysis. In: 22nd workshop on principles of advanced and distributed simulation; 2008, p. 147.

[40] Casalicchio E, Bologna S, Brasca L, Buschi S, Ciapessoni E, D′Agostino G, et al. Inter-dependency assessment in the ICT-PS network: the MIA project results. In: Xenakis C, Wolthusen S, editors. Critical information infrastructures security. Berlin Heidelberg: Springer; 2011. p. 1–12.

[41] Cavdaroglu B, Mitchell JE, Sharkey TC, Wallace WA. Integrating restoration and scheduling decisions for disrupted interdependent infrastructure sys- tems. Annals of Operations Research 2013;203:279–94.

[42] Chang SE, McDaniels TL, Mikawoz J, Peterson K. Infrastructure failure interdependencies in extreme events: power outage consequences in the 1998 ice storm. Nature Hazards 2007;41:337–58.

[43] Change SE, McDaniels T, Beaubien C. Societal impacts of infrastructure failure interdependencies: building an empirical knowledge base. TCLEE 2009: lifeline earthquake engineering in a multi-hazard environment; 2009, p. 693–702.

[44] Chou CC, Tseng SM. Collection and analysis of critical infrastructure inter- dependency relationships. Journal of Computing in Civil Engineering 2010;24(6):539–47.

[45] Cohen R, Erez K, Ben-Avraham D, Havlin S. Resilience of the internet random breakdowns. Physical Review Letters 2000;85(21):4626–8.

[46] Cohen R, Erez K, Ben-Avraham D, Havlin S. Breakdown of the internet under intentional attack. Physical Review Letters 2001;86(16):3682–5.

[47] Conrad SH, LeClaire RJ, O′Reilly GP, Uzunalioglu H. Critical national infra- structure reliability modeling and analysis. Bell Labs Technical Journal 2006;11(3):57–71.

[48] Crowther KG, Dicdican RY, Leung MF, Lian C, et al. Assessing and managing risk of terrorism to Virginia′s interdependent transportation systems.

M. Ouyang / Reliability Engineering and System Safety 121 (2014) 43–60 57

Charlottesville, VA: Virginia Transportation Research Council; 2004 (Final Contract report).

[49] Crowther KG, Haimes YY, Taub G. Systemic valuation of strategic prepared- ness through application of the inoperability input–output model with lessons learned from Hurricane Katrina. Risk Analysis 2007;27(5):1345–64.

[50] Crowther KG, Haimes YY. Development of the multiregional inoperability input–output model (MRIIM) for spatial explicitness in preparedness of interdependent regions. Systems Engineering 2010;13(1):28–46.

[51] Cutter SL, Burton CG, Emrich CT. Disaster resilience indicators for bench- marking baseline conditions. Journal of Homeland Security and Emergency Management 2010;7(1) (article 51).

[52] Dam KH, Lukszo Z. Modeling energy and transport infrastructures as a multi- agent system using a generic ontology. In: Proceedings of the 2006 IEEE international conference on systems, Man and cybernetics, TaiPei; 2006, p. 890–5. http://dx.doi.org/10.1109/ICSMC.2006.384502.

[53] Dauelsberg LR, Outkin AV. Modeling economic impacts to critical infra- structures in a system dynamics framework. In: Proceedings of the 23rd international conference of the system dynamics society. Boston; July 17–21 2005.

[54] Delamare D, Diallo A, Chaudet C. High-level modeling of critical infrastruc- ture′s interdependencies. International Journal of Critical Infrastructures 2009;5(1–2):100–19.

[55] DeLaurentis D. Role of humans in complexity of a system-of-systems. In: Duffy VG, editor. Digital human modeling, LNCS, 4561. Berlin Heidelberg: Springer-Verlag; 2007. p. 363–71.

[56] DePorcellinis S, Panzieri S, Setola R. Modeling critical infrastructure via a mixed holistic reductionistic approach. International Journal of Critical Infrastructures 2009;5(1–2):86–99.

[57] Dobson I, Carreras BA, Lynch V, Newman DE. An initial model for complex dynamics in electric power system blackouts. In: Proceedings of the 34th Hawaii international conference on system sciences. Maui, Hawaii; January 2001.

[58] Dobson I, Carreras BA, Lynch VE, Newman DE. Complex systems analysis of series of blackouts: cascading failure, critical points and self-organization. Chaos 2007;17(2):026103.

[59] Dorogovtsev SN, Goltsev AV, Mendes JFF. Critical phenomena in complex networks. Reviews of Modern Physics 2008;80(4):1275–335.

[60] Dudenhoeffer DD, Permann MR,Boring RL. Decision consequence in complex environments: visualizing decision impact. In: Proceedings of the first joint emergency preparedness and responses and robotic and remote systems topical meeting; 2006, p. 211–8.

[61] Dudenhoeffer DD, Permann MR, Manic M. CIMS: a framework for infra- structure interdependency modeling and analysis. In: Proceedings of the 2006 winter simulation conference. In: Perrone LF, Wieland FP, Liu J, Lawson BG, Nicol DM, Fujimoto RM, editors; 2006, p. 478–85.

[62] Dudenhoeffer DD, Permann MR, Woolsey S, Timpany R, Miller C, McDermott A, et al. Interdependency modeling and emergency response. In: Proceedings of the 2007 summer computer simulation conference. San Diego, CA, USA; 2007, p. 1230–7.

[63] Dueñas-Osorio L, Craig JI, Goodno BJ. Probabilistic response of interdepen- dent infrastructure networks. In: Proceedings of the 2nd annual meeting of the Asian-Pacific network of centers for earthquake engineering research (ANCER). Honolulu, Hawaii, USA; July 28–30, 2004.

[64] Dueñas-Osorio L. Interdependent response of networked systems to natural hazards and intentional disruptions (Dissertation), Georgia Institute of Technology. Atlanta: Georgia Tech Library, UMI 3198529; 2005.

[65] Dueñas-Osorio L, James IC, Barry JG. Seismic response of critical interdepen- dent networks. Earthquake Engineering and Structural Dynamics 2007;36:285–306.

[66] Dueñas-Osorio L, James IC, Barry JG, Ann B. Interdependent response of networked systems. Journal of Infrastructure Systems 2007;13(3):185–94.

[67] Duenas-Osorio L, Kwasinski A. Quantification of lifeline system interdepen- dencies after the 27 February 2010 Mw 8.8 Offshore Maule, Chile earthquake. Earthquake Spectra 2011;28(1):581–603.

[68] D′Agostino G., Bologna S, Fioriti V, Casalicchio E, Brasca L, Ciapessoni E, et al. Methodologies for interdependency assessment. In: Proceedings of the 5th international conference on critical infrastructure (CRIS); 2010, p. 1–7.

[69] Ehlen MA, Scholand AJ. Modeling interdependencies between power and economic sectors using the N-ABLE agent based model. In: Proceedings of the IEEE conference on power systems. San Francisco; July 2005.

[70] Eidson ED, Ehlen MA. NISAC agent-based laboratory for economics (N-ABLE): overview of agent and simulation architectures. Sandia report, SAND2005- 0263; 2005.

[71] Eusgeld I, Henzi D, Kroger W. Comparative evaluation of modeling and simulation techniques for interdependent critical infrastructures. ETH Zur- ich: Scientific report; 50.

[72] Eusgeld I, Nan C. Creating a simulation environment for critical infrastruc- ture interdependencies study. In: Proceedings of the IEEE international conference on industrial engineering and engineering management (IEEM); 2009, p. 2104–8.

[73] Eusgeld I, Nan C, Dietz S. System-of systems approach for interdependent critical infrastructures. Reliability Engineering and System Safety 2011;96:679–86.

[74] Ezell BC, Farr JV, Wiese. Infrastructure risk analysis model. Journal of Infrastructure Systems 2000;6(3):114–7.

[75] Ezell BC, Farr JV, Wiese. Infrastructure risk analysis of municipal water distribution system. Journal of Infrastructure Systems 2000;6(3):118–22.

[76] Fair JM, LeClaire RJ, Wilson ML, Turk AL, DeLand SM, Powell DR, et al.. An integrated simulation of pandemic influenza evolution, mitigation and infrastructure response. In: Proceedings of the IEEE conference on technol- ogies for homeland security; May 16–17, 2007.

[77] Fioriti V, D′Agostino G, Bologna S. On modeling and measuring inter- dependencies among critical infrastructures. In: Proceedings of the 2010 complexity in engineering: IEEE computer society; 2010, p. 85–7.

[78] Forrester JW. Industrial dynamics. Cambridge, MA: MIT Press; 1961. [79] Franchina L, Carbonelli M, Gratta L, Crisci M. An impact-based approach for

the analysis of cascading effects in critical infrastructures. International Journal of Critical Infrastructures 2011;7(1):73–90.

[80] Gao J, Buldyrev SV, Havlin S, Stanley HE. Robustness of a network of networks. Physical Review Letter 2010;107:195701.

[81] Ge Y, Xing X, Cheng Q. Simulation and analysis of infrastructure interde- pendencies using a Petri net simulator in a geographical information system. International Journal of Applied Earth Observation and Geoinformation 2010;12:419–30.

[82] Ghorbani AA, Bagheri E. The state of the art in critical infrastructure protection: a framework for convergence. International Journal of Critical Infrastructures 2008;4:215–44.

[83] Gil EM, McCalley JD. A U.S. energy system model for disruption analysis: evaluating the effects of 2005 hurricanes. IEEE Transactions on Power Systems 2011;26(3):1040–9.

[84] Giorgio AD, Liberati F. A Bayesian network-based approach to the critical Infrastructure interdependencies analysis. IEEE Systems Journal 2012;6 (3):510–9.

[85] Giorgio AD, Liberati F. Interdependency modeling and analysis of critical infrastructures based on dynamic Bayesian networks. In: Proceedings of the 19th Mediterranean conference on control and automation. Aquis Corfu Holiday Palace, Corfu, Greece; June 20–23, 2011.

[86] Glass RJ, Beyeler WE, Conrad SH, Brodsky NS, Kaplan PG, Brown T. Defining research and development directions for modeling and simulation of complex, interdependent adaptive infrastructures, NISAC, Sandia National Laboratories, Infrastructure Complexity R&D Group, SAND 2003-1778; 2003, p. 31.

[87] Griot C. Modelling and simulation for critical infrastructure interdependency assessment: a meta-review for model characterization. International Journal of Critical Infrastructures 2010;6(4):363–79.

[88] Guikema SD. Natural disaster risk analysis for critical infrastructure systems: an approach based on statistical learning theory. Reliability Engineering and System Safety 2009;94:855–60.

[89] Gursesli O, Desrochers AA. Modeling infrastructure interdependencies using Petri Nets. IEEE International Conference on Systems, Man and Cybernetics 2003:1506–12, http://dx.doi.org/10.1109/ICSMC.2003.1244625.

[90] Hadjsaid N, Tranchita C, Rozel B, Viziteu M, Caire R. Modeling cyber and physical interdependencies—application in ICT and power grids. In: Proceed- ings of the 2009 power systems conference and exposition; 2009, p. 1–6.

[91] Haimes YY. Hierarchical holographic modeling. IEEE Transactions on Systems, Man, and Cybernetics 1981;11(9):606–17.

[92] Haimes YY, Jiang P. Leonief-based model of risk in complex interconnected infrastructures. Journal of Infrastructure Systems 2001;7(1):1–12.

[93] Haimes YY. Roadmap for modeling risks of terrorism to homeland. Journal of Infrastructure Systems 2002;8(2):35–41.

[94] Haimes YY, Horowitz BM, Lambert JH, Santos JR, Lian C, Crowther KG. Inoperability input–output model for interdependent infrastructure sectors. I: theory and methodology. Journal of Infrastructure Systems 2005;11 (2):67–79.

[95] Haimes YY, Horowitz BM, Lambert JH, Santos JR, Crowther KG, Lian C. Inoperability input–output model for interdependent infrastructure sectors. II: case studies. Journal of Infrastructure Systems, 11; 80–92.

[96] Haimes YY. Models for risk management of systems of systems. International Journal of Systems of Systems Engineering 2008;1(1–2):222–36.

[97] Heller M. Interdependencies in civil infrastructure systems. The Bridge 2001;31(4):9–15.

[98] Hernandez I, Dueñas-Osorio L. Sequential propagation of seismic fragility across interdependent lifeline systems. Earthquake Spectra 2011;27 (1):23–43.

[99] Hernandez I, Dueñas-Osorio L. Probabilistic study for cascading failures in interdependent lifeline systems. Reliability Engineering and System Safety 2013;111:260–72.

[100] Hines P, Cotilla-Sanchez E, Blumsack S. Do topological models provide good information about vulnerability in electric power networks? Chaos 2010;20:033122.

[101] Hollnagel E, Woods DD, Leveson N. Resilience engineering: concepts and precepts. Aldershot, UK: Ashgate Publishing Co.; 2006.

[102] Holling CS. Resilience and stability of ecological systems. Annual Review of Ecology and Systematic 1973;4:1–23.

[103] Huang X, Gao J, Buldyrev SV, Havlin S, Stanley HE. Robustness of inter- dependent networks under targeted attack. Physical Review E 2011;83:065101.

[104] Ibanez E, McCalley JD. Multiobjective evolutionary algorithm for long-term planning of the national energy and transportation systems. Energy System 2011;2:151–69.

[105] Jiang P, Haimes YY. Risk management for Leontief-based interdependent systems. Risk Analysis 2004;24(5):1215–29.

M. Ouyang / Reliability Engineering and System Safety 121 (2014) 43–6058

[106] Johansson J, Hassel H. An approach for modeling interdependent infrastruc- tures in the context of vulnerability analysis. Reliability Engineering and System Safety 2010;95(12):1335–44.

[107] Jung J, Santos JR, Haimes YY. International trade inoperability input–output model (IT-IIM): theory and application. Risk Analysis 2009;29(1):137–53.

[108] Kaegi M, Mock R, Krӧger W. Analyzing maintenance strategies by agent- based simulations: a feasibility study. Reliability Engineering and System Safety 2009;94:1416–21.

[109] Kahan JH, Allen AC, George JK. An operational framework for resilience. Journal of Homeland Security and Emergency Management 2009;6(1) (article 83).

[110] Kajitani Y, Sagi S. Modeling the interdependencies of critical infrastructures during natural disasters: a case of supply, communication and transportation infrastructures. International Journal of Critical Infrastructures 2009;5(1– 2):38–50.

[111] Kelic A, Warren DE, Phillips LR. Cyber and physical infrastructure interde- pendencies. Sandia report, SAND2008-6192; 2008.

[112] Kjølle GH, Utne IB, Gjerde O. Risk analysis of critical infrastructures empha- sizing electricity supply and interdependencies. Reliability Engineering and System Safety 2012;105:80–9.

[113] Krimgold F, Bigger J, Willingham M, Mili L. Power systems, water, transporta- tion and communications lifeline interdependencies, prepared for American lifeline alliance, March. ⟨www.americanlifelinesalliance.org⟩; 2006.

[114] Krӧger W. Critical infrastructures at risk: A need for a new conceptual approach and extended analytical tools. Reliability Engineering and System Safety 2008;93:1781–7.

[115] Kollikkathara N, Feng H, Yu D. A system dynamic modeling approach for evaluating municipal solid waste generation, landfill capacity and related cost management issues. Waste Management 2010;30:2194–203.

[116] Laefer D, Koss A, Pradhan A. The need for baseline data characteristics for GIS-based disaster management systems. Journal of Urban Planning and Development 2006;132(3):115–9.

[117] Laprie J, Kanoun K, Kaaniche M. Modeling interdependencies between the electricity and information infrastructure. In: Proceedings of the 26th inter- national conference on computer safety, reliability and security, SAFECOMP- 2007. Nurenberg: Allemagne; 2007.

[118] Lave LB, Apt J, Farrell A, Morgan MG. Increasing the security and reliability of the USA electricity system. In: Richardson HW, Gordon P, MooreII JE, editors. The economic impacts of terrorist attacks. Cheltenham: Edward Elgar Publishing, Inc.; 2005. p. 57–70.

[119] LeClaire R, et al. A prototype desktop simulator for infrastructure protection: an application to decision-support for controlling infectious disease out- breaks. In: Proceedings of the international conference of the system dynamics society, Boston, Ma; July, 2007. Available from ⟨http://systemdy namics.org/conferences/2007/proceed/papers/LECLA417.pdf⟩.

[120] Lee E, Mitchell J, Wallace W. Assessing vulnerability of proposed designs for interdependent infrastructure systems. In: Proceedings of the 37th Hawaii international conference on system sciences; 2004.

[121] Lee EE, Mitchell JE, Wallace WA. Restoration of services in interdependent infrastructure systems: a network flows approach. IEEE Transactions on systems, Man, and Cybernetics—part C: Application and Reviews 2007;37 (6):1303–17.

[122] Leontief WW. Input–output economics. Scientific American 1951;185:15–21. [123] Leung M, Haimes YY, Santos JR. Supply- and output-side extensions to the

inoperability input–output model for interdependent infrastructures. Journal of Infrastructure Systems 2007;13(4):299–310.

[124] Lian CY, Haimes YY. Managing the risk of terrorism to interdependent infrastructure systems through the dynamic inoperability input–output model. Systems Engineering 2006;9(3):241–58.

[125] Little RG. Controlling cascading failure: understanding the vulnerabilities of interconnected infrastructures. Journal of Urban Technology 2002;9(1):109–23.

[126] Luiijf E, Nieuwenhuijs A, Klaver M, Eeten MV, Cruz E. Empirical findings on critical infrastructure dependencies in Europe. Setola R, Geretshuber S (editors). Critical information infrastructure security, lecture notes in com- puter science. Berlin, Germany: Springer Berlin/Heidelberg; 2009.

[127] McDaniels T, Chang S, Peterson K, Mikawoz J, Reed D. Empirical framework for characterizing infrastructure failure interdependencies. Journal of Infra- structure Systems 2007;13(3):175–84.

[128] McDaniels T, Chang S, Reed DA. Characterizing infrastructure failure inter- dependencies to inform systemic risk. Wiley Handbook of Science and Technology for Homeland Security 2008:1–16.

[129] Mendonca D, William AW. Impacts of the 2001 world trade center attack on New York City critical infrastructures. Journal of Infrastructure Systems 2006;12(4):260–70.

[130] Min HJ, Beyeler W, Brown T, Son YJ, Jones AT. Toward modeling and simulation of critical national infrastructure interdependencies. IEEE Trans- actions 2007;39:57–71.

[131] Nan C, Eusgeld I, Kroger W. Analyzing vulnerabilities between SCADA system and SUC due to interdependencies. Reliability Engineering and System Safety 2013;113:76–93.

[132] Nan C, Eusgeld I. Adopting HLA standard for interdependency study. Reliability Engineering and System Safety 2011;96:149–59.

[133] National Climactic Data Center (NCDC). Climate of 2004 Atlantic hurricane season. NCDC, Asheville, N.C., ⟨www.ncdc.noaa.gov/oa/climate/research/ 2004/hurricanes04.html#impacts.Feb.1, 2006⟩; 2005.

[134] Newman MEJ, Strogatz SH, Watts DJ. Random graphs with arbitrary degree distributions and their applications. Physical Review E 2001;64:026118.

[135] Newman MEJ. Spread of epidemic disease on networks. Physical Review E 2002;66:016128.

[136] Newman DE, Nkei B, Carreras BA, Dobson I, Lynch VE, Gradney P. Risk assessment in complex interacting infrastructure systems. In: Proceedings of the Thirty-eighth Hawaii international conference on system science. Big Island, Hawaii; 2005.

[137] Nojima N, Kameda H. Lifeline interactions in the Hanshin–Awaji earthquake disaster. The 1995 Hyogoken–Nanbu earthquake investigation into damage to civil engineering; 1996, p. 253–64.

[138] North MJ. Smart II: the spot market agent research tool version 2.0. Natural Resources and Environmental Issues 2001;8(1):69–72.

[139] North MJ. Multi-agent social and organizational modeling of electric power and natural gas markets. Computational & Mathematical Organization Theory 2001;7:331–7.

[140] North MJ. Toward strength and stability: agent-based modeling of infra- structure markets. Social Science Computer Review 2001;19(3):307–29.

[141] Nozick LK, Turnquist MA. Assessing the performance of interdependent infrastructures and optimizing investments. International Journal of Critical Infrastructures 2005;1(2–3):144–54.

[142] Nurre SG, Sharkey TC. Restoring infrastructure systems: an integrated net- work design and scheduling problem. In: Proceedings of the industrial engineering research conference, Cancun, Mexico; 2010.

[143] O′Reilly GP, Jrad A, Kelic A, LeClaire R. Telecom critical infrastructure simulations: discrete event simulation vs. dynamic simulation how do they compare? In: Proceedings of the IEEE global telecommunications conference, Washington, DC; 2007, p. 2597–2601. http://dx.doi.org/10.1109/GLOCOM. 2007.493.

[144] O′Rourke TD, Lembo AJ, Nozick LK. Lessons learned from the world trade center disaster about critical utility systems. In: Monday JL, editor. Beyond September 11th: an account of post-disaster research. Boulder, CO: Natural Hazards Research and Applications Information Center; 2003. p. 269–90.

[145] Ouyang M, Hong L, Mao ZJ, Yu MH, Fei Q. A methodological approach to analyze vulnerability of interdependent infrastructures. Simulation Modeling Practice and Theory 2009;17:817–28.

[146] Ouyang M, Dueñas-Osorio L. An efficient approach to compute generalized interdependent effects between infrastructure systems. Journal of Comput- ing in Civil Engineering 2011;25(5):394–406.

[147] Ouyang M, Dueñas-Osorio L. An approach to design interface topologies across interdependent urban infrastructure systems. Reliability Engineering and System Safety 2011;96(1):1462–73.

[148] Ouyang M, Dueñas-Osorio L. A three-stage framework resilience analysis framework for urban infrastructure systems. Structural Safety 2012;36: 23–31.

[149] Ouyang M, Dueñas-Osorio L. Time-dependent resilience assessment and improvement of urban infrastructure systems. Chaos 2012;22(3):033122.

[150] Ouyang M. Comparisons of purely topological model, betweenness based model and direct current power flow model to analyze power grid vulner- ability. Chaos 2013;23(2):023114.

[151] Pant R, Barker K, Grant FH, Landers TL. Interdependent impacts of interoper- ability at multi-modal transportation container terminals. Transportation Research Part E 2011;47:722–37.

[152] Panzieri S, Setola R, Ulivi G. An agent based simulator for critical inter- dependent infrastructures. Securing Critical Infrastructures. Grenoble ed.2004.

[153] Panzieri S, Setola R, Ulivi G. An approach to model complex interdependent infrastructures. In: 16th IFAC World Congress, Praha, Czech; 2005.

[154] Parshani R, Buldyrev SV, Havlin S. Interdependent networks: reducing the coupling strength leads to a change from a first to second order percolation transition. Physical Review Letters 2010;105:048701.

[155] Patterson SA, Apostolakis GE. Identification of critical locations across multi- ple infrastructures for terrorist actions. Reliability Engineering and System Safety 2007;92:1183–203.

[156] Pederson P, Dudenhoeffer D, Hartley S, Permann M. Critical infrastructure interdependency modeling: a survey of U.S. and international research. Idaho falls, Idaho: Idaho National Laboratory; 83415.

[157] Peerenboom JP, Fisher RE, Rinaldi SM, Kelly TK. Studying the chain reaction. Electric Perspectives 2002;27(1):22–35.

[158] Peerenboom JP, Fisher R. System and sector interdependencies: an overview. Handbook of Science and Technology for Homeland Security. USA: Wiley: Hoboken, New Jersey; http://dx.doi.org/10.1002/9780470087923.hhs218.

[159] Peeta S, Zhang P. Modeling infrastructure interdependencies: theory and practice. Safety, reliability and risk of structures, infrastructures and engi- neering systems—Furuta. In: Furuta H, Frangopol D, Shinozuka M, (editors). London: Taylor & Francis Group; 2010. p. 2872–80.

[160] Permann M.R. Toward developing genetic algorithms to aid in critical infrastructure modeling. In: Proceedings of the IEEE conference on technol- ogies for homeland security; 2007, p. 192–7.

[161] Permann MR. Genetic algorithms for agent-based infrastructure interdepen- dency modeling and analysis, presented at the spring simulation multi- conference, Norfolk, VA; March 25–29, 2007, Paper 28.

[162] Petri CA. Communication with automata (PhD dissertation), the faculty of Mathematics and Physics at the Technische Universität Darmstadt, Germany; 1962.

M. Ouyang / Reliability Engineering and System Safety 121 (2014) 43–60 59

[163] Poljansek K, Bono F, Gutierrez E. Seismic risk assessment of interdependent critical infrastructure systems: the case of European gas and electricity networks. Earthquake Engineering and Structural Dynamics 2012;41:61–79.

[164] President′s Commission on Critical Infrastructure Protection (PCCIP). Critical foundations: protecting America′s infrastructures: the report of the President ′s commission on critical infrastructure protection. Rep. No. 040-000-00699- 1, U.S. Government Printing Office, Washington, D.C.; 1997.

[165] Pye G, Warren MJ. Conceptual modeling: choosing a critical infrastructure modelling methodology. In: Proceedings of the 7th Australian information warfare and security conference (IWAR); 2006, p. 1–9.

[166] Quelhas A, Gil E, McCalley JD, Ryan SM. A multi-period generalized network flow model of the US integrated energy system: Part I—model description. IEEE Transactions on Power Systems 2007;22:829–36.

[167] Quelhas A, McCalley JD. A multi-period generalized network flow model of the US integrated energy system: part II—simulation results. IEEE Transac- tions on Power System 2007;22:837–44.

[168] Reed DA, Kapure Kzc, Christie RD. Methodology for assessing the resilience of networked infrastructure. IEEE Systems Journal 2009;3(2):174–80.

[169] Rigole T, Deconinck G. A survey on modeling and simulation of interdepen- dent critical infrastructures. In: 3rd IEEE Benelux young researcher sympo- sium in electrical power engineering, Ghent, Belgium; 27–28 April 2006.

[170] Rigole T, Vanthournout K, Deconinck G. Interdependencies between an electrical power infrastructure with distributed control, and the underlying ICT infrastructure. In: Proceedings of complex network infrastructure protec- tion. Rome; 2006.

[171] Rigole T, Vanthournout K, De Brabandere K, Deconinck G. Agents controlling the electric power infrastructure. International Journal of Critical Infrastruc- tures 2008;4(1–2):96–109.

[172] Rinalidi SM, Peerenboom JP, Kelly T. Identifying, understanding and analyz- ing critical infrastructure interdependencies. IEEE Control System Magazine 2001:11–25.

[173] Rinaldi SM. Modeling and simulating critical infrastructures and their interdependencies. In: Proceedings of the Hawaii international conference on system sciences (HICSS-37), Big Island, Hawaii; 2004, p. 54–61.

[174] Robert B, Senay MH, Plamondon MEP, Sabourin JP. Characterization and ranking of links connecting life support networks. Public safety and emer- gency preparedness.2003.

[175] Robert B. A method for the study of cascading effects within lifeline networks. International Journal of Critical Infrastructures 2004;1(1):86–99.

[176] Rong M, Han CF, Liu L. Critical infrastructure failure interdependencies in the 2008 Chinese winter storms. In: Proceedings of the 2010 international conference on management and service science (MASS). Wuhan; 24–26 Aug 2010, p. 1–4.

[177] Rosato V, Issacharoff L, Tiriticco F, Meloni S. Modeling interdependent infrastructures using interacting dynamical models. International Journal of Critical Infrastructure 2008;4(1–2):63–79.

[178] Rosato V, Bologna S, Meloni S. Interdependency effects measured on complex interdependent networks. Complexity in Engineering 2010:27–32.

[179] Rose A, Miernyk W. Input–output analysis: the first fifty years. Economic Systems Research 1989;1:229–71.

[180] Rose A. Input–output economics and computable general equilibrium mod- els. Structural Change and Economic Dynamics 1995;6:295–304.

[181] Rose A. Economic principles, issues, and research priorities in hazard loss estimation. In: Okuyama Y, Chang S, editors. Modeling spatial and economic impacts of disasters, 2004. New York: Springer-Verlag; 2004. p. 13–36.

[182] Rose A. Tracing infrastructure interdependencies through economic inter- dependencies. ⟨http://www.usc.edu/dept/ise/assets/002/26423.pdf⟩; 2005.

[183] Rose A, Liao S. Modeling regional economic resilience to disasters: A computable general equilibrium analysis of water service disruptions. Journal of Regional Science 2005;45:75–112.

[184] Rose A, Oladosu G, Liao S. Regional economic impacts of terrorist attacks on the electric power system of Los Angeles: a computable general disequilibrium analysis. Paper presented at the second annual symposium of the DHS center for risk and economic analysis of terrorism events, USC, Los Angeles, CA; 2005.

[185] Ruzzante S, Castorini E, Marchei E, Fioriti V. A metric for measuring the strength of interdependencies. In: Schoitsch E, editor. SAFECOMP 2010, in: LNCS, vol. 6351. Berlin, Heidelberg: Springer; 2010. p. 291–302.

[186] Santella N, Steinberg LJ, Parks K. Decision making for extreme events: modeling critical infrastructure interdependencies to aid mitigation and response planning. Review of Policy Research 2009;26(4):409–22.

[187] Santos JR, Haimes YY. Modeling the demand reduction input–output (I–O) inoperability due to terrorism of interconnected infrastructures. Risk Analysis 2004;24(6):1437–51.

[188] Santos JR. Inoperability input–output modeling of disruptions to interdepen- dent economic systems. Systems Engineering 2006;9(1):20–34.

[189] Santos JR, Haimes YY, Lian C. A framework for linking cyber-security metrics to the modeling of macroeconomic interdependencies. Risk Analysis 2007;27 (5):1283–97.

[190] Satumtira G, Dueñas-Osorio L. Synthesis of modeling and simulation meth- ods on critical infrastructure interdependencies research. In: Gopalakrishnan K, Peeta S, editors. Sustainable infrastructure systems: simulation, imaging, and intelligent engineering. New York: Springer-Verlag; 2010.

[191] Schmitz W, Flentge F, Dellwing H, Schwaegerl C. The integrated risk reduction of information-based infrastructure systems, interdependency taxonomy and interdependency approaches, IRRIS Project N.027568, IABG mbH; 2007, p. 82.

[192] Schoenwald DA, Barton DC, Ehlen MA. An agent-based simulation laboratory for economics and infrastructure interdependency. In: Proceedings of the 2004 American control conference; 2004, p. 1295–300.

[193] Shao J, Buldyrev SV, Cohen R, Kitsak M, Havlin S, Stanley HE. Fractal boundaries of complex networks. Europhysics Letter 2008;84(4):48004.

[194] Shao J, Buldyrev SV, Braunstein LA, Havlin S, Stanley HE. Structure of shells in complex networks. Physical Review E 2009;80:036105.

[195] Shao J, Buldyrev SV, Havlin S, Stanley HE. Cascade of failures in coupled network systems with multiple support-dependent relations. Physical Review E 2010;83:036116.

[196] Solano E. Methods for assessing vulnerability of critical infrastructure, research brief, institute for homeland security solutions; March 2010.

[197] Stapelberg RF. Infrastructure systems interdependencies and risk informed decision making (RIDM): impact scenario analysis of infrastructure risks induced by natural, technological and intentional hazards. Journal of Sys- temics, Cybernetics and Informatics 2008;6(5):21–7.

[198] Steinberg LJ, Santella N, Zoli CB. Baton Rouge post-Katrina: the role of critical infrastructure modeling in promoting resilience. Homeland security affairs 7: article 7; 2011.

[199] Sterman JD. Business dynamics: systems thinking and modeling for a complex world. New York, NY: McGraw-Hill; 2000.

[200] Sultana S, Chen Z. Modeling flood induced interdependencies among hydroelectricity generating infrastructures. Journal of Environmental Man- agement 2009;90(11):3272–82.

[201] Svendsen NK, Wolthusen SD. Connectivity models of interdependency in mixed-type critical infrastructure networks. Information Security Technical Report 2007;12(1):44–55.

[202] Svendsen NK, Wolthusen SD. Multi-graph dependency models for hetero- geneous critical infrastructures. In: Proceedings of the first annual IFIP WG 11.10 international conference on critical infrastructure protection. Hanover, NH, USA: Springer Verlag; 2007, p. 337–50.

[203] Svendsen NK, Wolthusen SD. Analysis and statistical properties of critical infrastructure interdependency multi-flow models. Information Assurance and Security Workshop, West Point, NY 2007:247–54.

[204] Svendsen NK, Wolthusen SD. Graph models of critical infrastructure inter- dependencies. Lecture notes in computer science, 4543. Berlin, Germany: Springer; 208–11.

[205] Technical Council on Lifeline Earthquake Engineering (TCLEE). Preliminary report on lifeline system performance after the Mw 8.8 offshore Maule, Chile Earthquake of February 27, 2010. American Society of Civil Engineers (ASCE). (accessed July 2010) ⟨http://www.asce.org/uploadedFiles/Institutes/Technica l_Activities_Committees_(TAC)/TCLEE%20Chile%20Web%20Report%207.10.pdf⟩; 2010.

[206] Thomas WH, North MJ, Macal CM, Peerenboom JP. Complex adaptive systems representation of infrastructure interdependencies. Naval Surface Warfare Center Technical Digest, Naval Surface Warfare Center, Dahlgren, VA; 2003, p. 58–67.

[207] Tolone WJ, Wilson D, Raja A, Xiang W, Hao H, Phelps S, et al. Critical infrastructure integration modeling and simulation. Intelligence and Security Informatics Lecture Notes in Computer Science 2004;3073:214–25, http://dx. doi.org/10.1007/978-3-540-25952-7_16.

[208] Trucco P, Cagno E, Ambroggi MD. Dynamic functional modeling of vulner- ability and interoperability of critical infrastructures. Reliability Engineering and System Safety 2012;105:51–63.

[209] U.S.–Canada Power System Outage Task Force (Task Force). Final report on the August 14, 2003 blackout in the United States and Canada: causes and recommendations. Final Rep., ⟨https://reports.energy.gov/BlackoutFinal- Web.pdf⟩; 2004.

[210] Utne IB, Hokstad P, Vatn J. A method for risk modeling of interdependencies in critical infrastructures. Reliability Engineering and System Safety 2011;96:671–8.

[211] Vugrin ED, Warren DE, Ehlen MA, Camphouse RC. A framework for assessing the resilience of infrastructure and economic systems. In: Gopalakrishnan Kasthurirangan, Peeta Srinivas, editors. Sustainable and Resilient Critical Infrastructure Systems: Simulation Modeling, and Intelligent Engineering. Berlin, Germany: Springer-Verlag, Inc..; 2010.

[212] Wallace WA, Mendonca DM, Lee EE, Mitchell JE, Chow Wallace JH. Managing disruptions to critical interdependent infrastructures in the context of the 2001World Trade Center attack. In: Monday JL, editor. Beyond September 11th: an account of post-disaster research, special publication #39, 2003. Natural Hazards Research and Applications Information Center, University of Colorado; 2003. p. 165–98.

[213] Wen R, Sun B, Zhou B. Field survey of Mw8.8 Feb. 27, 2010 Chile Earthquake and Tsunami. Advanced Materials Research 2011;250–253:2102–6.

[214] Winkler J, Dueñas-Osorio L, Stein R, Subramanian D. Interface network models for complex infrastructure systems. Journal of Infrastructure Systems 2011;17(4):138–50.

[215] Xiao N, Sharman R, Rao HR, Upadhyaya SJ. Infrastructure interdependencies modeling and analysis: a review and synthesis. In: Proceedings of the Americas conference on information systems (AMCIS); 2008.

[216] Xu N, Nozick LK, Turnquist MA. Optimizing investment for recovery in interdependent infrastructure. In: Proceedings of the 40th annual Hawaii international conference on system sciences (HICSS); 2007, p. 112.

[217] Xu W, Hong L, He L, Wang S, Chen X. A supply dynamic inoperability input– output price model for interdependent infrastructure systems. Journal of Infrastructure Systems 2011;17(4):151–62.

M. Ouyang / Reliability Engineering and System Safety 121 (2014) 43–6060

[218] Zhang P, Peeta S. A generalized modeling framework to analyze interdepen- dencies among infrastructure systems. Transportation Research part B: Methodological 2011;45(3):553–79.

[219] Zhang P, Peeta S. Dynamic analysis of interdependent infrastructure systems. In: Proceedings of the 90th annual meeting of the transportation research board, Washington, DC (CD-ROM); 2011.

[220] Zimmerman R. Social implications of infrastructure network interactions. Journal of Urban Technology 2001;8:97–119.

[221] Zimmerman R. Decision-making and the vulnerability of interdependent critical infrastructure. In: Proceedings of the 2004 IEEE international con- ference on systems, man and cybernetics; 2004, p. 4059–63.

[222] Zio E, Sansavini G. Modeling interdependent network systems for identifying cascade-safe operating margins. IEEE Transactions on Reliability 2011;60 (1):94–101.

[223] Zio E. Stochastic simulation of critical infrastructures for electric power transmission. In: Gheorghe A, Muresan L, editors. Energy security: interna- tional and local issues, theoretical perspectives, and critical energy infra- structures; 2011. p. 109–24.

[224] Zio E, Ferrario E. A framework for the system-of-systems analysis of the risk for a safety-critical plant exposed to external events. Reliability Engineering and System Safety 2013;114:114–25.

[225] Checkland P. Systems thinking, systems practice. New York; John Wiley & Sons, 1981.