Modeling the resilience of critical infrastructure: the role of network dependencies

Abstract

Water and wastewater network, electric power network, transportation network, communication network, and information technology network are among the critical infrastructure in our communities; their disruption during and after hazard events greatly affects communities’ well-being, economic security, social welfare, and public health. In addition, a disruption in one network may cause disruption to other networks and lead to their reduced functionality. This paper presents a unified theoretical methodology for the modeling of dependent/interdependent infrastructure networks and incorporates it in a six-step probabilistic procedure to assess their resilience. Both the methodology and the procedure are general, can be applied to any infrastructure network and hazard, and can model different types of dependencies between networks. As an illustration, the paper models the direct effects of seismic events on the functionality of a potable water distribution network and the cascading effects of the damage of the electric power network (EPN) on the potable water distribution network (WN). The results quantify the loss of functionality and delay in the recovery process due to dependency of the WN on the EPN. The results show the importance of capturing the dependency between networks in modeling the resilience of critical infrastructure.

1. Introduction

Infrastructure such as water and wastewater, electric power, transportation, telecommunication, and gas and liquid fuel are interconnected systems of distinct and interdependent networks, or systems, (system of systems) that function collaboratively and synergistically to produce and distribute a continuous flow of essential goods and services (PCCIP, 1997). In this way, infrastructure support the safety, well-being, and economic vitality of our society. When hazard events threaten the functionality of one or more infrastructure, the resilience of a community is called into play, which has been defined as the ‘ability to prepare for and adapt to changing conditions and withstand and recover rapidly from disruptions’ (PPD-21, 2013).

Recent events, such as the blackout in northeast America (2003), Hurricane Katrina (2005), Hurricane Sandy (2012), the flood in South Carolina (2015) and the earthquakes in Chile (2010), New Zealand (2010–2011), and the earthquake and tsunami in Japan (2011), underscore the continued vulnerability of society to multiple hazards, and the pressing need to promote resilient infrastructure (Gardoni & LaFave, 2016). The concept of resilience is often measured using dimensions of vulnerability, severity of consequences, and time to recover from failures (Bruneau et al., 2003; Sharma et al., 2016). Extensive work has been conducted on the modeling of individual networks (e.g. Guidotti et al., 2016; Guikema & Gardoni, 2009; Kang et al., 2008; Kurtz et al., 2015; Lee et al., 2011). However, the aforementioned past events have not only revealed the vulnerabilities of individual infrastructure systems, but also showed the importance of dependencies and interdependencies among infrastructure sectors (Chang, 2014; Vespignani, 2010). During normal operations, these interdependencies generally have a positive effect allowing urban systems to operate closer to their design capacity, for example optimizing their efficiency in the exchange of information and resources among different networks (Applied Technology Council, 2016; Nan & Sansavini, 2015; Ouyang et al., 2015). When infrastructure systems are damaged, however, they often propagate failures to other systems and result in widespread disruption. For this reason, interdependent networks may experience system failure for a lower number of directly damaged components and more abruptly than isolated systems (Buldyrev et al., 2010). Modeling the dependencies between networks is important when identifying vulnerabilities of network components, assessing the resilience of critical infrastructure, informing investment prioritization, and, ultimately, improving the robustness and resilience of infrastructure networks.

This paper addresses the limitations of current approaches in network analysis, and provides the following contributions: the paper proposes a unified methodology to model the network dependencies and interdependencies, and incorporates the methodology in a six-step probabilistic procedure to assess the resilience of critical infrastructure. To estimate the system recovery as a function of time at a community system scale, the proposed probabilistic procedure captures the direct physical damage, cascading effects due to interdependencies, and loss of network functionality. The developed methodology and procedure are general and applicable to any network and any natural or anthropogenic hazard. In this paper, it is illustrated the potable water network (WN) depending on the electric power network (EPN) of a virtual community subject to seismic hazard.

2. Modeling of network dependencies

Interdependencies play a crucial role in the resilience of network infrastructure. They not only contribute – through cascading effects – to widespread failure propagation, but also to the smoothness or difficulty of the entire recovery process. The recovery rate of system components depends upon several factors that are often difficult to understand, model, and predict, as for example the recovery strategy and the amount, rate and prioritization of resource mobilization (Bruneau et al., 2003; Franchin & Cavalieri, 2015; Jia et al., 2016; Sharma et al., 2016). It may be impractical and unnecessary to model every infrastructure system within a community fully capturing every physical and societal factors during the recovery. The methodology proposed in this paper is formulated to allow the exchange of information on the state of a system between dependent/interdependent infrastructure. Such information can be used to inform and optimize the recovery strategies at user-defined recovery intervals. With this flexible, systems-level approach to model interdependent infrastructure resilience, we can insert selected modeling components that are of interest, and at the desired level of granularity, for a particular case study area or subset of infrastructure systems.

The need to describe the relationships among infrastructure systems, and the corresponding propagation of system disruptions led to the definition of several classifications of the nature of infrastructure interdependencies (e.g. Dudenhoeffer et al., 2006; Lee et al., 2007; Rinaldi et al., 2001; Wallace et al., 2003; Zhang and Peeta, 2011; Zimmerman, 2001). According to Ouyang (2014), the classification proposed by Rinaldi et al., (2001) appears to be self-contained and able to capture the manifold nature of the interdependencies. Rinaldi et al. (2001) define four types of interdependency: (i) Physical – when the state of one infrastructure system is dependent on the material output(s) of another infrastructure system (e.g. outages in the EPN causing the failure of water pumping stations); (ii) Cyber – when the transmission of information across systems affects the state of different infrastructure systems (e.g. lack of communication or observability affects the control of power systems, resulting in their malfunctioning); (iii) Geographic – when two or more infrastructure systems are affected by the same local event because of their proximity (e.g. viaducts failures causing breaks in co-located water pipelines); (iv) Logical – when others mechanisms that are not physical, cyber, or geographic describe the dependency of a system on the other (e.g. outages in power systems result in price changes of fuel). To understand the nature of these interdependencies and to incorporate those in a unified methodology are among the major challenges in simulating network damage and recovery at the community scale.

The proposed methodology addresses these challenges. The dependency of networks is modeled through a proposed augmented adjacency table A. As presented in Watts and Strogatz (1998), a general undirected network k can be defined by n^(k) nodes or vertexes and m^(k) links or edges connecting the nodes (where undirected means that all the links are bidirectional, not pointing in a specified direction). In the case of K interdependent networks, each one can be represented by a symmetric n^(k) × n^(k) adjacency table ${\mathbf{A}}^{(k)}=[a_{ij}^{(k)}]$, k = 1, …, K, (i, j ∈ k; i, j = 1, …, n^(k)) where $a_{ij}^{(k)}(i\ne j)$ is either 1, if there is a link between nodes i and j of network k, or 0 otherwise, and $a_{ii}^{(k)}=0$. The K adjacency tables are arranged along the main diagonal of A, while the out-of-diagonal, generally rectangular, tables are used to represent pairwise connections between nodes of different networks. For example, considering two generic networks s and t, the connections between nodes of the two networks can be represented by the rectangular n^(s) × n^(t) table ${\mathbf{A}}^{(s,t)}=[a_{ij}^{(s,t)}]$, where $a_{ij}^{(s,t)}$ is either 1, if node i of network s is connected to node j of network t, or 0 otherwise. Being the connections mutual, the relation $a_{ij}^{(s,t)}=a_{ji}^{(t,s)}$ holds true and the augmented adjacency table maintains the symmetry. The matrix representation of the augmented adjacency table A is the following:

$$\mathbf{A}=\left[\begin{array}{cccccc}{\mathbf{A}}^{(1)}& \cdots & {\mathbf{A}}^{(1,s)}& {\mathbf{A}}^{(1,t)}& \cdots & {\mathbf{A}}^{(1,K)}\\ ⋮& \ddots & ⋮& ⋮& \ddots & ⋮\\ {\mathbf{A}}^{(s,1)}& \cdots & {\mathbf{A}}^{(s)}& {\mathbf{A}}^{(s,t)}& \cdots & {\mathbf{A}}^{(s,K)}\\ {\mathbf{A}}^{(t,1)}& \cdots & {\mathbf{A}}^{(t,s)}& {\mathbf{A}}^{(t)}& \cdots & {\mathbf{A}}^{(t,K)}\\ ⋮& \ddots & ⋮& ⋮& \ddots & ⋮\\ {\mathbf{A}}^{(K,1)}& \cdots & {\mathbf{A}}^{(K,s)}& {\mathbf{A}}^{(K,t)}& \cdots & {\mathbf{A}}^{(K)}\end{array}\right]$$ (1)

It is common, especially for physical networks, to weight the adjacency table with a weight table, where the weights are used to capture a characteristic of interest of the link between nodes. In our methodology, we propose to use a weight table to capture the likelihood of failure of a node given the failure of a different node. Therefore, the weight table takes the form of a likelihood table, L = [l_ij]. For example, considering two networks s and t, we use a rectangular n^(s) × n^(t) likelihood table ${\mathbf{L}}^{(s,t)}=[l_{ij}^{(s,t)}],0\le l_{ij}^{(s,t)}\le 1$ to capture the strength of the dependency between nodes of the two networks.

To capture the failure propagation, we introduce a dependency table P obtained by multiplying A and L. With reference to the two networks s and t, the table ${\mathbf{P}}^{(s,t)}=[p_{ij}^{(s,t)}]$, with element $p_{ij}^{(s,t)}=a_{ij}^{(s,t)}\times l_{ij}^{(s,t)}$, provides the conditional probability of failure of node i of network s given the failure of node j of network t. It is important to underline that the dependency between two nodes of different networks may not be mutual (generally $l_{ij}^{(s,t)}\ne l_{ji}^{(t,s)}$ and L^(s,t) ≠ L^(t,s)′). As a result, table P is generally not symmetric. Setting the values in the likelihood tables to zero, table P captures cases of perfect network independency. Setting $l_{ij}^{(s,t)}=1\forall (i\in s,j\in t)$ results in $p_{ij}^{(s,t)}=a_{ij}^{(s,t)}$, describing perfect network dependency (according to the connectivity in table A^(s,t), a failure of node j of network t implies a certain failure of node i of network s, if this is the only connection between the two nodes; if node i of network s is connected with more nodes of network t, it will then fail for a simultaneous failure of all of them).

Values different from zero in both tables L^(s,t) and L^(t,s) capture the mutual dependency (or interdependency) between network s and t; values in table L^(s,t) different than zero with values in table L^(t,s) equal to zero capture the case of a one-way dependency of network s on network t. Moreover, values in the likelihood tables may vary as a function of the dependency/interdependency type, with different values for physical, geographical, cyber of logical dependency, providing the users with a unified tool to incorporate and model the different natures of networks interdependencies. The values could also vary with time, capturing the fact that the dependency/ interdependency could vary over time (e.g. due to deteriorations or other changes over time of the network connections).

3. Assessing the resilience of dependent critical infrastructure

To evaluate the physical performance and system functionality after a disruptive event and during the recovery process, a reliability simulation must include the hazard modeling as well as physical and functional models of the damaged network. Much of the existing research focuses mainly on component performance, investigating the contribution of single components to the functionality of the corresponding single network. However, to understand the overall functionality of a damaged system, one must consider the possibility of multiple component failures and its cascading effects due to the dependencies between infrastructure systems.

The probabilistic procedure presented in this paper integrates the methodology previously described with models of damage, functionality, and recovery. A damage model, in this paper, refers to the simulation of physical damage to system components; a functionality model refers to a flow analysis used to assess the damage impact on system services; a recovery model refers to the restoration process of the damaged system. The approach is general and applicable to any dependent/interdependent networks subject to any natural or anthropogenic hazard. The procedure has the following six steps:

Step 1: Generating a network model for the system. The first step in the assessment of the resilience of dependent infrastructure consists in representing the infrastructure systems, with their dependencies within the network (intra-dependencies) or between the two networks (interdependencies). We adopt linear and nodal elements to represent the network components used for source, supply, and transmission of the quantities of interest, like water and electric power in the cases of water and EPNs. While the terms component and element are sometimes used interchangeably in the literature, in this work the term component refers to a physical entity that is part of the infrastructure system, while the term element refers to the representation used in the modeling. Different levels of resolution may be adopted in the network generation, taking into account the scale of interest and the computational burdens.

Step 2: Generating the hazard for the network area. The second step calls for generating the hazard with spatial variations in intensity for the various linear and nodal elements as appropriate. Critical infrastructure networks typically extend over large areas, and are subject to multiple hazards. In general, the vulnerability of infrastructure systems and their components varies with the type of hazard. For instance, extreme wind events mainly affect the transmission and distribution towers and lines in EPNs, while an earthquake may cause more damage to buried power lines, substations, and generation plants. In this step of the procedure, hazard-specific models need to be adopted to generate spatial maps of the intensity measures of interest. These include, but are not limited to, maps of peak ground values of acceleration, velocity and displacement (peak ground acceleration (PGA), peak ground velocity (PGV), and peak ground displacement (PGD), respectively) in the case of seismic hazard; maps of water depth and velocity or inundation duration for flood hazard; maps of wind speed for tornado and hurricane hazards.

Step 3: Assessing direct physical damage to network components. The third step assesses the direct physical damage to the network components in the immediate aftermath of an event. This is estimated probabilistically through fragility curves for nodal elements and through repair rate curves for linear elements. Fragility curves provide the conditional probability of exceeding a prescribed performance level for a given hazard intensity measure (e.g. Ditlevsen & Madsen, 1996; Gardoni et al., 2002, 2003). Repair rate curves provide the expected number of ruptures -and hence repairs- per unit length, for a given hazard intensity measure (e.g. ALA, 2001; O’Rourke & Ayala, 1993; O’Rourke & Deyoe, 2004). Examples of these curves are available in the literature, for different networks’ components and different hazards.

Step 4: Propagating the cascading effects due to dependencies to fully define the network damage state. This step fully defines the status of the networks’ components adding to the direct damage from Step 3, the cascading effects due to the dependencies. Step 4 can be carried out following the methodology described in Section 2.

Step 5: Assessing functionality loss. This step consists in assessing the functionality of the damaged networks. Network-specific models of the physical flow are considered to evaluate the impact of the hazardous event on the specific damaged network, in terms of the ability to provide essential goods and services. Going from simple connectivity analysis to physical flow modeling is among the most important aspects of the proposed procedure. Connectivity modeling alone provides only a partial and possibly misleading assessment of system performance, since the systems, when damaged, may not satisfy pre-event demands. Assessing the ability to provide essential goods requires in general both a quantification of the capacity of the network and of the demand on the network. Specifically, one of the most challenging modeling aspects is the prediction of the post-event demand because of the uncertainty in the human behaviors, such as evacuation or the decision to relocate. A promising approach to track the post-event evolution of EPN supply and demand has been proposed by Didier et al. (2015), (2017) and Sun et al. (2015). Though underlying models of demand changes during recovery from a hazard have not yet been implemented, the proposed procedure can model variation of the baseline demand through a constant demand multiplier to adjust the base demand of every node. This step of the procedure generalizes the work of Cavalieri et al. (2012), (2014), Franchin (2014) and Franchin and Cavalieri (2015) who studied the seismic vulnerability of buildings considering both the direct damage to buildings and the inhabitability (loss of functionality) due to loss of utility services.

Step 6: Predicting recovery time for network functionality. The final step is to determine the state of damage (which is again both physical and functional) of a network component at time step t after the occurrence of a disrupting event. The recovery time of a dependent system element is a function of its recovery time and that of the supporting element. For each time step t, the proposed procedure updates the state of the elements in the network based on the initial damage state and corresponding restoration functions. Examples of restoration functions can be found in the literature either postulated (e.g. Ayyub, 2014; Bocchini et al., 2012; Cimellaro et al., 2010; Titi et al., 2015) or derived based on more fundamental recovery activities (Sharma et al., 2016). The state of system damage, functionality, and operational values is updated and used for the next time step, taking into account interand intra-system dependencies.

Steps 4–6 are iterated until a desired level of functionality is met within a specified tolerance range. We demonstrate the overall procedure considering a case study infrastructure system composed by a potable WN dependent on an EPN subject to seismic hazard. Figure 1 illustrates the evolution of the procedure, with reference to a generic WN dependent on an EPN. The left hand side illustrates the physical damage state in the two networks at the considered time step t. A cross above an element represents a damaged element. The right hand side shows the functionality analysis (e.g. pressure at given WN nodal elements and flow in linear elements) for the corresponding damage state.

Figure 1.

Illustration of the iterative recovery process between dependent systems.

4. Damage, functionality, and dependency models for water and EPNs subject to seismic hazard

To illustrate the proposed methodology and probabilistic procedure described in Sections 2 and 3, we consider a case study subject to seismic hazard with a dependency of the WN on the EPN. WNs (e.g. potable water, wastewater, and storm water) support residential, commercial, and industrial functions through subsystems that include supply, transmission, treatment, pumping, and storage. These subsystems can be modeled with nodal elements (e.g. for the demand nodes, junctions, pumping stations, tanks, and treatment plants) and linear elements (e.g. for the distribution and transmission pipelines). Similarly, the EPN can be modeled with nodal and linear elements to represent generation, transmission, and distribution subsystems. WN and EPN are vulnerable to multiple hazard events. We select WN and EPN for this illustration because their reliable operation is essential to communities and possible interruptions may result in significant losses, with debilitating impacts on the economic and social welfare of the entire region (PCCIP, 1997; Wen et al., 2011).

This section describes the seismic hazard models used in the illustration (which are needed in Step 2 of the proposed procedure), the damage models for both WN and EPN (needed in Step 3), the dependency models between WN and EPN (needed in Step 4), and finally the functionality models for WN and EPN (needed in Step 5). In the illustration, the focus is on the WN damage, functionality, and recovery, therefore a greater level of detail is provided for WN models.

4.1. Seismic hazard models

Ground motion prediction equations (GMPE) specify the conditional probability of exceeding a ground motion intensity measure at a particular geographic site for a particular source represented in an earthquake rupture forecast (Cornell, 1968). A large set of GMPE (see, for example a review by Douglas 2011) is available to estimate spatially varying intensity measures as a function of the earthquake characteristics (e.g. magnitude, source to site distance, site condition, and fault type).

4.2. Damage models in water and EPNs

Water system components are heterogeneous, typically distributed over large geographic areas, and are constituted of nodal components (e.g. tanks and reservoirs, treatment plants, pumping stations, and wells) and linear components (e.g. pipelines, tunnels, canals, and flumes). As described in Step 3 of the proposed six-step procedure, fragility curves and repair rate curves are used to represent damage to these components. In this illustration, we use seismic fragility and repair rate curves for water systems based on the American Lifelines Alliance (ALA) guidelines (ALA, 2001), which are also used in the HAZUS-MH software (FEMA, 2003). Seismic fragility curves are typically based on PGA for above ground WN facilities (e.g. pumping stations, tanks and treatment plants), while pipelines use repair rate curves based on PGD and PGV. Seismic fragility and repair rate curves from HAZUS-MH have been adopted in recent WN modeling software, such as GIRAFFE – Graphical Iterative Response Analysis for Flow Following Earthquake (Shi & O’Rourke, 2008; Wang, 2006) and MUNICIPAL – Multi-Network Interdependent Critical Infrastructure Program for the Analysis of Lifelines (Loggins et al., 2013). Pumps with a damage level corresponding to extensive damage or collapse are removed from the model and replaced with a linear element that allows water to flow through the node, with no additional static pressure head. This modeling representation is meant to reflect the assumption that pump bypass lines allow flow due to pressure already in the pipes. Similarly, extensively damaged or collapsed tanks are removed from the hydraulic model and thus are no longer a water source for the system. Pipe damage in the WN is categorized as either leaks or breaks, with different repair rate curves, depending on both PGD and PGV. Number and location of breaks and leaks along the pipe follow a Poisson process, with the mean value set to the repair rate. A pipe leak is modeled as a fictitious pipe of cross-sectional area equal to the orifice (leak) area, with one end connected to the leaking pipe and the other end open to the atmosphere to simulate an empty reservoir. For leaks, water loss is calculated based on idealized orifice flow that does not include a discharge coefficient:

$$Q=A\sqrt{\frac{2g\mathrm{\Delta }p}{{\gamma }_w}}$$ (2)

where Q is the volumetric flow, A is the orifice area, g is gravitational acceleration, Δp is the differential pressure between the pipe and the atmosphere, and γ_w is the specific weight of water. A check valve prevents backflow from an artificial reservoir. A broken pipe is replaced with two pipes connected to artificial reservoirs with check valves. The artificial reservoirs with backflow prevention allow the simulation of water loss due to pipe damage.

For each component, HAZUS-MH also has restoration curves that provide the conditional probability of restoration for a given initial damage at a given time after failure. We adopt HAZUS-MH’s restoration curves also in this illustration. These curves, as fragility and repair rate curves, are primarily based on available empirical data and expert judgment.

Physical damage to individual components of the EPN (e.g. generation plants, substations, and distribution circuits) is also represented by fragility curves (e.g. Pires et al., 1996; Vanzi, 1996). In this illustration, we use fragility curves included in HAZUS-MH (FEMA, 2003), while restoration curves are provided by G&E Engineering Systems (1994).

4.3. Dependency models for water and electric power systems

Several works in recent years focused on the physical dependency between potable WN and EPN, because of its importance in the recovery of a community and because it is among the most intuitive to understand and model (e.g. Adachi & Ellingwood, 2008; Franchin & Cavalieri, 2015; Grigg, 2002, 2003; Kim et al., 2007). As presented in Kim et al. (2007), the probability of the loss of functionality of a node in the WN due to a power outage is conditional to the simultaneous failure of each one of the supporting nodes of the EPN. In this illustration, failure of an element in the WN occurs either as the direct failure of an element due to the earthquake or as the cascading loss of functionality due to the failure of supporting elements. In that sense, this conditional probability represents the strength of the dependency between the two networks. In this paper, following the methodology described in Section 2, table P^(WN,EPN) = A(^WN,EPN)·L^(WN,EPN) provides the dependency of the WN on the EPN. According to the proposed methodology then, a conditional probability of failure equal to 0 means that the elements of the WN are decoupled from the EPN. WN elements with backup power units, that can supply the needed electric power in case of failure of the EPN, are an example of such decoupled situation. Conversely, a conditional probability of failure of 1 means that a WN element fails if the supporting EPN element(s) fails, (e.g. when backup units are not available).

4.4. Functionality models for water and electric power systems

To evaluate the functionality of a damaged WN, network connectivity analyses can provide information about the possibility of water delivery from source to demand nodes. In addition, hydraulic analysis is needed to model whether a system can supply sufficient quantity, pressure levels, and water quality for satisfying social functions (e.g. Bonneau & O’Rourke, 2009; Javanbarg & Takada, 2010; Tabucchi et al., 2010). Models of the functionality of WN can be broadly classified as demand-driven or pressure-driven. Among the most widely used hydraulic simulation tools for water distribution networks is the demand-driven software package EPANET (Rossman, 2000). However, in EPANET, if the pressure at a node is insufficient to satisfy the demand, negative pressure errors are raised. The hydraulic analysis of water systems under pressure-deficient conditions is an open research area (e.g. Piller & Van Zyl, 2009; Todini, 2003; Trifunovic, 2012). The EPANET-EMITTER package developed by Pathirana (2010) uses emitters in an iterative pressure-driven adaptation of the EPANET solver. Emitters are openings (e.g. pipe leaks or breaks) that exit to the atmosphere at demand nodes to represent a pressure-dependent component of demand. The analysis in this paper uses the EPANET-EMITTER software because of its modest input data requirements at the level of detail appropriate for community-level analysis (like the one considered in the following case study), and because of its applicability to a large-scale extended-period simulation.

The possibility of cross-contamination resulting from pipe breaks, leaks, and low pressures in the network is a water-quality concern that can be a significant problem in post-event system recovery. Total coliform (e.g. E. Coli) tests can signal the possible presence of harmful bacteria, but there may be a considerable lag time before their detection. Since residual chlorine can slow the growth of bacteria, chlorine levels from different areas of the network are often used to indicate local risk of contamination. Most state regulations require water quality testing anywhere pressure falls below a minimum value that (depending on the state) varies between 130 and 138 kPa (15 and 20 psi) and issue boil water notices to require repeated testing until potentially harmful compounds are no longer detectable (NJDEP, 2016; USEPA, 2002). The simplifying assumption of non-decaying, non-interacting chemicals for water quality modeling is adopted in this paper, consistently with some of the most common water distribution models with contaminant transport (Alfonso et al., 2010; Guidorzi et al., 2009; Kumar et al., 2010).

EPN functionality models can be used to describe the operational state of the components and the network as a whole. The performance of the EPN after a hazard event depends on the extent of physical damage to the individual network components, however only a power flow analysis allows us to determine whether the power demand at a given node is satisfied (e.g. Cavalieri et al., 2014; Eusgeld et al., 2009; Modaressi et al., 2014; Pires et al., 1996). However, in the illustration, the focus is on the WN functionality, therefore the level of detail required to perform a power flow analysis is not assumed for the Centerville testbed, thereby reducing the input data requirements and simplifying the analysis.

5. The Centerville case study

The six-step procedure described in Section 3 is applied to the virtual community of Centerville to simulate the damage and recovery of a WN and its dependency on the EPN when subject to a seismic event. The Centerville virtual community is developed as a testbed for the NIST-funded Center of Excellence for Community Resilience (http://resilience.colostate.edu) with the purpose of testing procedures and methodologies (Ellingwood, 2016). Centerville is representative of a typical mid-size city, with approximately 50,000 inhabitants. The adopted simplified, aggregated models of the WN and EPN have a resolution sufficient for assessing their performance at a community scale under hazard events.

5.1. Application of the six-step procedure to the Centerville WN and EPN

Step 1: Generate infrastructure network models. Figure 2 shows the WN and EPN for Centerville. The WN has 14 demand nodes, 2 tanks, and 5 junctions connected by 24 large-diameter pipelines. A reservoir with a treatment plant and pumping station provides water to the network, with a backup source of water from the northeastern well. Small diameter distribution lines that receive water from large diameter trunk lines are included in the demand nodes. The EPN of Centerville consists of 1 power plant, 1 transmission substation, 1 main grid substation, 2 distribution substations, 3 sub-distribution substations and 24 towers or poles, connected by transmission, distribution and sub-distribution lines. The topologies of the WN and EPN provide us the adjacency tables along the main diagonal of the augmented adjacency table, A^WN and A^EPN, respectively.

Figure 2.

Centerville’s potable WN (top) and EPN (bottom) with the three identified areas of dependency of WN on EPN.

Notes: (A) Auxiliary pumping station; (B) Central WTP and pumping station; (C) Well Field WTP and pumping station.

Step 2: Generate hazard for network area. We consider an earthquake of magnitude 6.5 located approximately 25 km southwest of Centerville. Figure 3 shows the maps of the PGD, PGV, and PGA. These have been obtained from the Fernandez and Rix (2006) GMPE for the mid-western United States.

Figure 3.

Intensity measures (PGD, PGV, and PGA, from left to right) obtained through ground motion prediction equations (Fernandez and Rix, 2006).

Step 3: Assess physical damage of network components. The intensity measures are applied to each WN and EPN element and their damage state is evaluated with the respective fragility and repair curves from HAZUS-MH software (FEMA, 2003), as described in Section 4.2. In the representation of the WN of Centerville, only the large diameter trunk lines are represented. To calculate the repair rate for those pipelines, the pipe length is divided into segments, the intensity measures are determined at the ends of each segment, and the repair rate for each pipe segment is set to the average value. Following a procedure similar to that in GIRAFFE (Shi & O’Rourke, 2008; Wang, 2006), the demand at nodes (that include small diameter distribution lines) is temporarily increased to simulate pipe damage and leakage.

Step 4: Update network damage state for dependencies. The WN and EPN are coupled to model the dependency of the WN system on the EPN system and to capture the impact of failures in one network EPN on the functionality of the other network WN. The dependency of the WN on the EPN functionality is evaluated following the methodology described in Section 2. Insets A, B, and C in Figure 2 show the WN and EPN node dependencies. The auxiliary pumping station PS3 depends on EPN node P15; pumping station PS2 at the central water treatment plant depends on EPN node P14; and pumping station PS1 at wellfield depends on EPN node P28. The dependencies between WN and EPN are modelled with the out-of-diagonal adjacency table, A^WN,EPN, which has values equal to 1 for the node pairs just described and zeroes for all of the other terms. The augmented adjacency table (Equation (1)) in this case is written as

$$\mathbf{A}=\left[\begin{array}{cc}{\mathbf{A}}^{\text{WN}}& {\mathbf{A}}^{\text{WN},\text{EPN}}\\ {\mathbf{A}}^{\text{EPN},\text{WN}}& {\mathbf{A}}^{\text{EPN}}\end{array}\right]$$ (3)

Since EPN is assumed not to depend on WN, the matrix A^EPN,WN will be multiplied by L^EPN,WN = 0. Two limit cases are used to describe the dependency of the WN on the EPN: a likelihood table L^(WN,EPN) having $l_{ij}^{(\text{WN},\text{EPN})}=1$ and, alternatively, $l_{ij}^{(\text{WN},\text{EPN})}=0$, ∀i ∈ WN, j ∈ EPN. In the first case (referred as WN + EPN), since each WN node is connected with only one node of the EPN, a power outage at any of the three EPN supporting nodes (P14, P15, and P28) fails the corresponding WN pumping station nodes (PS2, PS3 and PS1). In this case, pumping station nodes are removed from the network model when either their direct damage level exceeds a given threshold or the supporting EPN nodes fail. In the second case (referred as WN), the WN is decoupled from the EPN and pumping station nodes are removed from the model only when their direct damage level exceed a given threshold (but in this case they do not rely on the EPN to function).

Step 5: Assess network functionality loss. The network damage state is input to the functionality assessment model. The functionality model first performs a baseline hydraulic simulation of the WN without damage. A daily average demand of water is associated to each one of the demand nodes of Centerville. Figure 4 shows three patterns for water demand relative to the baseline demands: residential (R), commercial (C) and industrial (I). The figure shows for each hour of a day the value of the multiplier of the daily average demand of water. The percentage of nodes that meet pressure, demand, and water quality requirements relative to the baseline solution is used to evaluate the post-event functionality of the WN system. However, the nodal water baseline demand may change following a disruptive event, for example due to leaks, changes in day-to-day behavior, and evacuations or relocations, affecting the percentage of nodes that meet the demand and pressure thresholds.

Figure 4.

Daily water demand patterns for residential, commercial, and industrial use.

Step 6: Assess recovery time for network functionality. At each time step, the network damage and functionality are updated from the previous time step using the restoration curves from the HAZUS-MH software (FEMA, 2003). In the illustration, for the case WN + EPN, the recovery of non-functional pumping stations depends both on their own recovery time and on the recovery time of the supporting EPN nodes.

The iterations (involving Steps 4, 5, and 6) are repeated until the WN has achieved 100% baseline performance for 24 consecutive hours, which is the recovery time for that iteration. We consider the mean value of recovery time for the analyses when comparing the WN without EPN dependency (WN), and with EPN dependency (WN + EPN). We use a Monte Carlo Simulation (MCS) to capture the uncertainties in the problem. The described six-step procedure constitutes a single run of the MCS. The uncertainties accounted for in this illustration are in the assessment of the physical damage of the network components (Step 3), in the dependencies (Step 4), and the recovery time for network functionality (Step 6). Uncertainties not modeled include those in the initial network characteristics (Step 1), in the hazard scenario (Step 2), since only one case is considered and each run of the MCS has the same values of seismic intensity measures, and in the models for the flow analysis (Step 5).

5.2. Results

To assess the resilience of the Centerville’s WN and the role of its dependency on the EPN, Figure 5 shows two functionality metrics for recovery. The first metric indicates the percentage of demand nodes for which the demand met is greater than or equal to the demand required at the corresponding time of day relative to the baseline demand of 100%. Immediately after the hazard event (at time 0), WN flow also includes leakage. For each node n, with a baseline demand greater than zero, the threshold to measure flow delivered ${\text{FD}}_n^i$ is

Figure 5.

Percentage of nodes able to satisfy a given demand (top) or pressure (bottom) at each recovery time step.

$${\text{FD}}_n^i=\{\begin{array}{ll}1,\hfill & q_n^i\ge Q_n^i\hfill \\ 0,\hfill & q_n^i<Q_n^i\hfill \end{array}$$ (4)

where $q_n^i$ is the flow delivered to node n during time step i, and $Q_n^i$ is the baseline demand for node n during time step i . The second metric in Figure 5 indicates the percentage of nodes meeting a pressure threshold of at least 138 kPa (20 psi). This threshold is sometimes used as a measure of fire protection capacity (e.g. Davis et al., 2012). After a hazard event, the additional water flow required for fire-fighting would likely reduce available flows and surrounding pressures below 138 kPa (20 psi).

The curves in Figure 5 represent the value of the sample mean X̄ and the sample standard deviation S of the considered functionality metrics as a function of recovery time. (Note that we do not assume any probability density function for the functionality metrics). Figures 5 and 6 show the recovery progress of the WN in meeting flow and pressure requirements in two different ways. Hourly demand satisfied in a damaged system may fluctuate substantially, as shown in Figure 5. Though cyclic demand patterns over 24 h do affect the percentage of baseline demand satisfied, the fluctuations can be misleading, conveying a more optimistic picture of system functionality during off-peak times, when pressure is easier to maintain. To better visualize the progress of system recovery, Figure 6 provides smoother curves for each metric, obtained by shading the area between the minimum and maximum values observed during the previous 12 h.

Figure 6.

Percentage of nodes able to satisfy a given demand (top) or pressure (bottom) as a function of the recovery time (shaded bands show the range of each metric, bounded by solid lines representing the minimum and maximum value observed during the previous 12 h).

Figures 5 and 6 include plots of demand and pressure recovery of the cases WN and WN + EPN. Because of the nature of the dependencies, the WN + EPN system performance generally serves as a lower bound for the performance of the WN. This relationship is manifest in several features of the plots in Figures 5 and 6. Most notably, EPN dependencies result in longer recovery times. Average functionality, plotted in Figures 5 and 6, is taken here to be the mean of each functionality metric over all trials at each time step. Table 1 provides sample mean and standard deviation, and a 95% confidence interval for the mean of the recovery time of each functionality metric. Recovery time is taken here to be the amount of time after the event at which each metric first returns to 100% of its baseline value for 24 consecutive hours. The recovery time to meet the nodal baseline demand and pressure metrics increased from nominally 2–3 days for the WN with a functional EPN, to a recovery time of 6 days for the WN + EPN.

Table 1.

Recovery time (in days) for functionality metrics in WN and WN + EPN systems (sample mean, X̄, and standard deviation, S, and 95% confidence interval, CI).

Metric	WN			WN + EPN
	X̄ (d)	S (d)	CI	X̄ (d)	S (d)	CI
Flow de-livered	2.59	1.49	(2.50, 2.68)	5.94	3.95	(5.70, 6.18)
Pressure	2.78	1.48	(2.69, 2.87)	6.00	3.85	(5.77, 6.24)
Quality met	4.87	1.90	(4.75, 4.98)	8.28	3.78	(8.05, 8.51)
Boil water notice	6.13	2.09	(6.01, 6.26)	9.57	3.86	(9.33, 9.80)

Three additional plot characteristics may be taken into account for explaining longer recovery times and generally lower functionality during recovery efforts in the WN + EPN than in the WN. First, the minimum values of demand and pressure functionality metrics are lower for the WN + EPN than for the WN. In both systems, the lowest point appears to occur around for about12–18 h. The lower minimum performance of the WN + EPN could be attributable to the steeper decline in service during the first 12–18 h, which would support the theoretical findings of Buldyrev et al. (2010), that interdependent systems fail more abruptly than isolated ones. Second, the shape of the recovery curves of the functionality metrics also imply more rapid recovery of the WN, compared to the WN + EPN (for demand and pressure, this is seen more easily in Figure 6). This is consistent with the fact that two systems need to recover from the event, instead of only one system. The shape of the recovery curves for the WN + EPN system experiences a more gradual return to full functionality (longer time constant). Third, due to the presence and the possible failure of a larger number of components, the coupled WN + EPN system has higher standard deviations than the WN system in each of the functionality metrics. It is outside the scope of this paper to set an acceptable threshold for the sample standard deviation, as this may depend on several factors, including economical and societal ones. However, we note that a greater standard deviation reflects a higher level of uncertainty in the functionality assessment and recovery times for the WN + EPN than for the WN system.

Figures 5 and 6 are generated assuming an unchanged baseline demand; however, the baseline demand may change in the aftermath of a damaging event as described in Step 5 of the proposed procedure. Figure 7 shows a sensitivity analysis for the baseline nodal demand and pressure met as a function of time. Values of 60 and 120% of the initial nodal baseline demand (100%) are considered. The WN performance depends on the actual post-event nodal demand of water of the community. The lower baseline demand of 60%, reflecting a reduced population, is more easily satisfied. The higher baseline demand of 120%, reflecting an increase in population, satisfies less of the peak demand periods. The sensitivity analysis in Figure 7 refers to a single run of the MCS; it is a preliminary approach to assess change of the baseline demand, which is assumed to change uniformly, with a global change of scale. Further studies are needed to address the effects of possible patterns in the demand change as well as to include uncertainties in damage state and recovery of the network elements.

Figure 7.

Sensitivity analysis of the input parameter of nodal demand on demand and pressure met. The black line represents the baseline solution (no change in the input parameter ‘nodal demand’ in the post-hazard scenario).

In addition to the functionality metrics of Figure 5, for the assessment of the WN resilience, it is of critical importance to monitor the water quality. The curves in Figure 8 represent the value of the sample mean X̄ and the sample standard deviation S of the functionality metric used to monitor water quality, as a function of recovery time for the WN and the WN + EPN. The ‘boil water’ metric imitates the process of issuing and lifting boil water notices at local demand nodes. Due to low pressures and pipe ruptures, potential sources of cross-contamination may necessitate the local or global issuance of a boil water notice within the WN. If the potential sources of contamination can be isolated, the boil water notice is issued only for the local areas affected. When the potential for contamination is widespread, a boil water notice is issued for the entire system. In Figure 8, a system-wide boil notice issuance is set to occur if 50% or more nodes are affected by contamination. Different criteria may be used for other systems (such as WN with multiple pressure zones), as well as in a WN where more detailed operational changes, such as valve closures, are modeled. After flushing each contaminated node, there is a delay of 24 h to allow for updated results of bacteriological testing before the boil water notice is lifted. We use water quality transport modeling to determine the percentage of nodes free of potential cross-contamination, reported as ‘quality met’ in Table 1. Table 1 shows that the boil water issuance is a more stringent indicator of when water can be safely consumed by the community. The recovery time to meet the nodal baseline quality met and boils notice metrics increases from nominally 4–6 days for the WN, to a recovery time of 8–10 days for the WN + EPN. Similar conclusions can be drawn for the water quality metric in Figure 8 as for the nodal demand and pressure metrics in Figures 5 and 6; dependency of the WN on the EPN results in fewer demand nodes being satisfied and a longer recovery time.

Figure 8.

Percentage of local demand nodes without issuance of a boil water notice at each recovery time step.

6. Conclusions

This paper presents a probabilistic approach to modeling network resilience that considers dependency on other networks and that incorporates both physical damage and network functionality to estimate system recovery as a function of time. The paper proposes a novel methodology to model network dependency/interdependency and integrates it to models of damage, functionality and recovery at a community system scale in a comprehensive six-step procedure, applicable to any networks and hazards. The proposed procedure allows quantification of the effects of damage on network functionality, and the effect of dependency on other networks for selected functionality metrics.

As an illustration, the procedure has been applied to the case study of the potable WN of Centerville, depending on the EPN. The considered functionality metrics for the WN are nodal demand met, nodal pressure met, nodal quality met, and nodal boil water notice. The case study results demonstrate that the time to recover network functionality following a hazard event increases when one network is dependent on another network. The additional failures in the dependent water system due to EPN damage cause a faster decline in water system functionality, resulting in a greater overall loss of service. Although recovery begins around the same time in both systems, it concludes significantly later in all recovery metrics for the dependent system than for the isolated system. The recovery time to meet the nodal metrics of ‘demand met’ and ‘pressure met’ increases from nominally 2–3 days for a WN without dependency on an EPN, to 6 days for a WN with dependency on the EPN. Similarly, the recovery time of network capacity to satisfy the ‘quality met’ and ‘boil notice’ metrics increases from nominally 4–6 days for a WN without dependency on an EPN to 8–10 days for a WN with dependency on an EPN.

The proposed procedure relies upon fragility, repair rate and restoration curves for network components to assess system-level performance following a hazard event and the subsequent time to recover network functionality. The case study examined an earthquake scenario adopting fragility, repair rate and restoration curves from the HAZUS-MH software. These curves are widely used; however, many of them are based primarily upon expert opinion and may be subject to a high level of uncertainty. The modularity of the proposed methodology allows the user to update the adopted curves and models. Different hazards may be considered and new models of fragility and repair rate curves may be implemented, including damage observations from recent events. Different levels of physical dependency strength may be integrated in the proposed methodology, changing the values in the likelihood tables, as well as other natures of dependencies and interdependencies (e.g. geographical, cyber and logical) and time dependent effects (e.g. deterioration). Finally, in resilience modeling, great attention needs to be devoted to the recovery process. The recovery rate of system components depends on recovery strategies and the amount, rate and prioritization of resource mobilization, factors that are difficult to predict and to model. Though these aspects are not fully modeled in the current study, they may be integrated into the proposed procedure throughout the iterative process of Steps (4)–(6) (e.g. by replacing the recovery strategy based on HAZUS-MH curves with more specific, discrete recovery actions).