Enhancing Decision Support with Interdependency Modeling

Economic well-being and the social fabric are tightly linked to the critical infrastructure, which includes electric power grids, gas pipelines and telecommunications, transportation, water supply and waste disposal systems. During a disaster, these lifeline systems must, at the very least, quickly recover to provide acceptable levels of service. However, critical infrastructure assets incorporate physical and electronic networks that are interdependent within and across multiple domains, causing unpredictable consequences during adverse events and restoration processes. Therefore, it is mandatory to understand the overall risks that disasters pose to the critical infrastructure in order to recover from these situations. This chapter demonstrates how decision support for critical infrastructure assets during emergencies can be enhanced using interdepen-dency modeling. A complex, realistic scenario involving four interconnected infrastructures is used as a case study. The results are validated with the assistance of key stakeholders such as Italian emergency personnel and electric utility operators.


Introduction
Modern society relies on the secure and reliable operation of critical infrastructure assets.The critical infrastructure comprises industrial facilities, capabilities and services whose interruption or destruction could affect society and the economy, and potentially result in the loss of human lives.Critical infrastructure assets include electric power grids, gas pipelines and telecommunications, transportation, water supply and waste disposal systems, among others.This chapter focuses on an important subset of critical infrastructures that are referred to as lifeline infrastructures.
A disruption of one critical infrastructure asset can affect other interconnected critical infrastructure assets.For example, a large power outage may affect drinking water supply, railroads, airports, telecommunications and factories as in the case of the Great North American Blackout of 2003 [17].Studying how critical infrastructure assets are interconnected and how they react in adverse situations are essential to ensuring their secure and reliable operation.This chapter demonstrates how decision making can be significantly enhanced by understanding the consequences of adverse events and interdependencies.
When an emergency occurs, the relevant management personnel and decision makers need to select the actions that must be taken immediately to mitigate and minimize the negative effects.Historical data underscores the need for efficient plans and careful decision making during the first few minutes of a catastrophic incident.Decisions are critical to successful mitigation, damage management, injury and death prevention, structural loss reduction and the overall solution of a crisis.Clearly, decision support systems are urgently needed to cope with the huge amount of data and the growing complexity of infrastructures.
This chapter demonstrates how decision support for critical infrastructure assets during emergencies can be enhanced using interdependency modeling.A complex, realistic scenario involving four interconnected infrastructures is used as a case study.The results are validated with the assistance of key stakeholders such as Italian emergency personnel and electric utility operators.

Related Work
Interdependencies between critical infrastructures are increasing dramatically as a result of the pervasive use of information and communications technologies.The interdependencies create opportunities, but they also induce vulnerabilities.Exploitation of these vulnerabilities produces negative impacts that are becoming more frequent, longer-lasting and more widespread.A systematic method for evaluating interdependencies and the outcomes of adverse events is needed to mitigate and manage the risk to critical infrastructure assets [18].
Considerable research has focused on decision analysis and support for emergency response operations.Various decision making methods have been proposed for natural events such as floods, fires and industrial hazards.Decision support systems for reducing flood damage are presented in [10,16].A multicriteria evaluation method and a multi-attribute risk analysis method for nuclear accidents are described in [5,7], respectively.A decision support system for risk analysis and impact evaluation of crisis scenarios involving critical infrastructures is presented in [15].This research builds on previous work by leveraging the results of an infrastructure interdependency model to enhance decision making during emergency situations.
Several researchers have applied multi-criteria decision making techniques to emergency management.Peng et al. [14] have proposed an incident information management framework based on data integration, data mining and multi-criteria decision making.Ergu et al. [2] have developed a simple consistency test process to solve decision making problems in emergency situations.Hwang and Yoon [8] have specified a technique for ordering preferences based on their similarity to the ideal solution using multi-criteria decision making.
Analysis of the literature reveals that little research focuses specifically on decision support systems for civil protection control room personnel.Moreover, no approach uses the ELECTRE II method [3].The ELECTRE II method is appealing because it strikes a balance between the amount of data processed and the computational time.However, the method is not good enough to assign interventions in civil protection scenarios.Therefore, this research has focused on the development of a tool that leverages a more complex variant of the greedy algorithm of Martello and Toth [11] to solve the knapsack problem [12] and assign appropriate interventions.
This research investigates the interactions between power demand and response because the primary task of electric utilities is to enhance grid reliability by flexibly matching customer demands.Bu and Yu [1] have solved this problem using a game-theoretic decision making scheme for electricity retailers in the smart grid using real-time demand-side management.The methodology described in this chapter implements a security-constrained unit commitment algorithm along with a novel risk based objective function [9] to manage demand and response in power grids.

Integrated Decision Making
This section describes the basic modules that support integrated decision making: (i) CISIApro interdependency simulator that evaluates the risk posed by adverse events to interconnected infrastructures; and (ii) operator decision support modules.The modules are used in two decision support systems.The first decision support system optimizes civil protection intervention procedures using a hybrid algorithm involving multi-criteria decision making and a knapsack algorithm.The multi-criteria decision making technique sorts the interventions based on a set of criteria while the knapsack algorithm assigns each intervention to a civil protection district.
The second decision support system schedules the startup and shutdown of electricity generators based on forecasted load consumption and power line security constraints.The risk to the generators is incorporated in the objective function and the risk associated with branch capacity is evaluated under the security constraints.

CISIApro Simulator
CISIApro is an agent-based simulator in which each agent is uniformly modeled as an entity that receives resources and failures from upstream entities (agents).A resource can be an asset, service or product used by the agent itself or transmitted to downstream agents.The ability of an agent to produce a resource is expressed using an operative level, which is based on the availabil-ity of the received resources, malfunction propagation and agent functionality.An agent also receives failures from upstream interconnections and the failures propagate along the downstream interconnections.
The interconnections among entities are typically classified as physical, logical, geographical and cyber interdependencies.Interested readers are referred to [4] for additional details.
A risk index is usually evaluated based on the threat occurrence probability p, vulnerability v and impact magnitude m using a non-linear function f : In an application of CISIApro, the occurrence probability is replaced by information reliability.A vulnerability variable can be introduced for each agent.However, the vulnerability is assumed to depend only on the distance from the source and the persistence of the attack.Therefore, the operative level of each agent is associated with the risk level as follows: CISIApro relies on the CISIApro engine to compute the cascading effects using an interdependency model and on the CISIApro geographical information security system to geo-reference critical infrastructure assets.CISIApro engages a database-centric architecture.This centralized asynchronous design enhances modularity and scalability -each element in the infrastructure can independently interface with the centralized database to obtain the latest data from the field.
In addition to analyzing simulations and computing the projected risk, the CISIApro engine plays an important role in the operation of the Hybrid Risk Evaluation Tool.This tool obtains information of various types (from sensors and data acquisition and complex event processing systems) and translates the information to operational levels of resources, faults and services for the agents in the critical infrastructure model.
Mixed holistic-reductionist modeling is one of several approaches implemented in CISIApro.This approach strikes the right trade-off between the decomposition and abstraction of a complex system-of-systems to obtain meaningful information.Mixed holistic-reductionist modeling involves the definition of three layers: (i) holistic entity layer; (ii) service entity layer; and (iii) reductionist entity layer.
A holistic entity represents the infrastructure as a whole (or its general organizational divisions) in order to take into account the global dynamics between infrastructures (e.g., behaviors related to policies or commercial strategies).
A service entity represents an intermediate logical element whose goal is to explicitly define a service.Services are usually offered to customers or to other infrastructures.This layer corresponds to a non-linear aggregation of operative levels of reductionist elements.
Reductionist entities correspond to physical entities (eventually aggregated) of an infrastructure at a proper degree of abstraction.Every entity is described by state variables that specify, instant by instant, the state of the entity in the modeled infrastructure.The most important state variable for a reductionist entity is its operative level, which expresses the ability of the entity to produce a suitable output.
In this work, cities are expressed as holistic entities because a city comprises complex mechanisms that cannot be represented as the functional sum of the performances of individual components.The quality of the services provided by infrastructures such as the power grid, gas pipelines, telecommunications systems, roadways and civil protection can be expressed in a similar manner.The majority of infrastructure interdependencies are developed at the reductionist level where items of equipment are modeled.In this bottom-up approach, the reductionist entities send their operative levels to the related services that, in turn, send their operative levels to the holistic entities.

Decision Support Modules
The decision support modules consider a protection level and an event propagation level: Protection Level: This level expresses the ability of each zone to counter emergencies.The protection level assumes a value from zero to one, where zero means that no operational resources are available and one means that all the resources are available.The protection level corresponds to a mitigation action that is applied after a catastrophic event occurs.
Event Propagation Level: This level expresses the propagation of an adverse event in the neighborhood due to geographical proximity and to specific features (e.g., wind direction in the case of a fire).The event propagation level assumes a value from zero to one, where zero means that no adverse event will occur in the near future (i.e., 5-10 minutes from the first alert) and one means that a disaster is a certainty.
The protection and event propagation levels are discretized into five stages: (i) normality; (ii) attention; (iii) early warning; (iv) warning; and (v) emergency state.Therefore, proper threshold values must be introduced in order to determine the actual states.
First, an emergency situation is defined in terms of civil protection operations.This is accomplished by implementing a numerical comparison to identify the alert level in each area and for each type of event; specifically, the propagation level is compared against a pre-set alarm threshold value.The actual propagation level is evaluated by CISIApro by considering an event v and the geographic area i, which usually corresponds to a town.The outputs of this phase are the type and level of warning for each city i, which are obtained by comparing four different thresholds for event v: (i) attention threshold value S N v ; (ii) early warning threshold value S P v ; (iii) warning threshold value S A v ; and (iv) emergency threshold value S E v .Next, the CISIApro results are used to determine the alarms that are related to large disasters and those that are due to single mechanical faults.This phase, which is similar to the previous phase, performs numeric comparisons between the operative levels and pre-defined thresholds S N , S P , S A and S E .
A multi-criteria decision making method of the ELECTRE II family is employed to identify one or more solutions that best meet the requirements (criteria), Consider a situation where a decision maker is presented with n alternatives and m criteria or attributes, where the alternatives A 1 , A 2 , . . ., A n are explicitly listed and an attribute is assigned to each alternative/criterion.A decision matrix assigns values to the alternatives according to the criteria, where a matrix element e ij corresponds to the alternative A i scored according to criterion j.The decision maker also assigns a weight w j that expresses the relative importance of criterion j with respect to the other criteria.
Two types of analyses enable the verification of the relative ranking of two alternatives: (i) concordance analysis, which considers the factors and criteria that do not present negative evidence that one alternative is preferred over another; and (ii) discordance analysis, which considers the negative evidence in choosing one alternative over another.
An important concept in this work is the notion of preference P j .Given two alternatives A h and A k , A h is preferable to A k according to criterion j (i.e., A h P j A k ) if e hj ≥ e kj .In other words, A h is preferable to A k if there is great satisfaction in preferring A h over A k and there is no great dissatisfaction in preferring A h over A k .
Thus, given two alternatives A h and A k , A h dominates A k (i.e., A h ≥ A k ) if e hj ≥ e kj for all criteria j = 1, . . ., m.
The ELECTRE II procedure defines a concordance value c hk and a discordance value d hk for each pair A h and A k (h ̸ = k) as elements of the concordance matrix C and discordance matrix D, respectively.The concordance value considers the weight of the criteria according to which h is preferred over k: where h = 1, . . ., n; k = 1, . . ., n; and j = 1, . . ., m.
The discordance value considers the criteria that oppose the preference of h over k: where h = 1, . . ., n; k = 1, . . ., n; and j = 1, . . ., m. ELECTRE II introduces two veto thresholds, strong f and weak d, to assess the outranking alternatives.Note that one alternative outranks another if it outperforms the other alternative for a sufficient number of criteria and is not outperformed by the other alternative (in the sense of having significantly inferior performance) for any criterion.
Also, ELECTRE II introduces two concordance thresholds such that 0 < S d C < S f C < 1; if both concordance thresholds tend towards one, then there exists one concordance only and no conflict choosing one alternative over the other.Additionally, it introduces two discordance thresholds such that 0 < S f D < S d D < 1; if both discordance thresholds tend towards one, then no regret exists in choosing one alternative over the other.Therefore two outranking relations exist: Thus, two graphs are obtained, one weak and one strong, which enhance the level of available information and make the choices more accurate.The strong graph is more rigid and strict with few outrankings and many noncomparabilities (i.e., difficult to compare due to missing information during the time of evaluation).The weak graph is less restrictive and richer in outrankings and presents fewer non-comparabilities.The classification of the final alternatives is obtained using two differently-ordered algorithms, one ascending and one descending.
The multi-criteria decision making technique does not consider resource allocation for each civil protection district.For this reason, a modification of the knapsack problem is implemented using a heuristic approach.This method compares the total propagation level d i of abnormal events detected in city i with the protection level LP g of the nearest district g ordered according to the results of the previous phase.If a positive result LP g − d i ≥ 0 is obtained, then the intervention is assigned to district g because the district has enough resources.Otherwise, if LP g − d i < 0, then the algorithm assigns the intervention partially to district g for the available resources, and the remaining to another district based on its proximity and the estimated arrival time.The estimated arrival time t ig is computed as: where dist ig is the distance between city i and district g, and LV ig is the operative level of the roads between the city and district based on the CISIApro results.
If the combined actions involving different districts are unable to address the emergency, then the decision support system advises the emergency management room operator that the available resources are insufficient and that an intervention by external forces is required.

Unit Commitment Problem
This work considers a specific algorithm executed by an energy management system, also referred to as an electrical SCADA system.The algorithm is designed for use in a power control room, which can be affected by emergency situations such as adverse climate events, forest fires and industrial accidents.
The unit commitment problem [9] involves the determination of the startup and shutdown schedules of generating units to meet the forecasted demand in a future short-term period (usually between 24 and 168 hours).The objective is to minimize the total production costs while satisfying a number of operating constraints.The traditional unit commitment problem is adjusted slightly to accommodate information from CISIApro, specifically, the operative levels of electrical generators and lines.
The generic unit commitment problem is formulated as an optimization problem with the objective function: where F C it (P it ) is the function cost of the generator i at time period t depending on the power production P it (it is usually a quadratic curve); and M C it (P it ) is the maintenance cost with two components, one fixed and one proportional to the production P it .The startup and shutdown costs are defined as functions of the numbers of hours down and up, respectively.The number of generators is N G and the time horizon is N T .In order to incorporate the operative levels of the generators, the objective function is adjusted as follows: where opL i is the operative level of electrical source i.If the operative level of source i has the maximum value of one, then the objective function is the traditional function; on the other hand, if the operative level is zero and the risk of the source not producing energy is very high, then the objective function is twice that of the traditional one.In this way, the generator at risk becomes expensive for the algorithm and its use is discouraged.This approach was used to obtain the estimated arrival time in the previous section.
The optimization problem is subject to several constraints.The most common constraints are: Maximum and minimum output limits on generators.
Limit on the production ramp rate ∇P it .

Power balance.
In order to consider failures of the electrical branches, it is necessary to also take into account the topology of the power grid with the maximum capacity at each branch (a damaged line has a capacity of zero).This is referred to as the security constrained unit commitment problem [6], which is a unit constrained problem extended with a constraint on the power flow in the electric grid.

Reference Scenario and Results
This section describes a case study involving the southern region of Rome, Italy.The goal is to optimally allocate emergency resources to achieve adequate and timely responses during a catastrophic event and to optimally schedule electrical generators to meet the forecasted load demands.

Reference Scenario
The reference scenario in the case study involves four interconnected critical infrastructures: a medium-voltage power grid with its SCADA control center, a gas distribution network with its control center, a telecommunications network and a roadway system (Figure 1).The adverse events considered in the reference scenario are drawn from historical documents maintained by the prefecture.Possible events include earthquakes, adverse climate events, forest fires, hydro-geological events and industrial accidents.
The power grid has a mesh topology and is fed by a transmission network comprising two primary substations with transformers.The power grid also draws electricity from an offshore wind farm, solar farm and natural gas power plant.
The natural gas distribution pipelines have radial topologies from the regulators that connect them to the gas transmission network (Figure 1).The model incorporates several compressor stations that maintain constant gas pressure in the pipelines.If a leak occurs or if a compressor fails, gas from storage facilities is fed to the pipelines.Natural gas is also used as fuel by the electricity generators in the natural gas power plants, which are connected to circuit breakers.Electricity is needed by the compressor stations and regulators in the gas pipeline network.
The gas pipeline and electricity infrastructures have SCADA control centers (not shown in Figure 1) for monitoring and control.The SCADA control centers make use of an Ethernet-based telecommunications network.
The optical fiber telecommunications network shown in Figure 1 has a mesh structure.The model incorporates both landline and mobile services to enhance coordination during crisis situations.The telecommunications network is required by the gas pipeline and electricity SCADA control centers and the many field sensors.Additionally, the telecommunications routers and switches need electricity to operate.
Transportation is also an important sector in the case study.During an emergency, it is mandatory to provide residents and responders with access to evacuation routes.The first responders include police, firefighters, coast  guard personnel and hospital volunteers.The ground transportation system is an important component of the reference scenario.Several principal and secondary roadways connect the cities in the scenario.

Results
After several days of rain, water release from a dam on the Amaseno river causes the operative level of the city of Priverno to decrease to 0.35 (according to the CISIApro model).The flooding affects the area closest to the dam due to the dense irrigation canal network in the Pontine levee, potentially causing the levee to collapse.The interdependency model reflects this situation and reduces the operative level to 0.675 for the cities of Sezze, Cisterna di Latina, Latina, Borgo Grappa, Borgo San Donato, Sabaudia and San Felice Circeo (left-hand side of Figure 2).
Figure 3 shows the decreased operative levels of the cities resulting from downgrades of the connected infrastructures (e.g., transportation system with a low operative level).Specifically, the four roads connecting the marked cities on the left-hand side of Figure 3 (i.e., MSA255, SS148, SS156 and SS7) have operative levels of 0.5.The downgrade of the roadway system affects the mitigation efforts by civil protection personnel.
Due to the modeled interdependencies, there is consequent risk propagation to the second primary substation (marked on the left-hand side of Figure 1).This severely affects the power grid to the extent that it cannot meet the power demands of the cities connected to the second primary substation.
The ELECTRE II method used in this work defines a criteria/alternatives array whose elements express the enhancement of adverse event propagation caused by an emergency.Each criterion represents an objective function that is to be minimized.Different criteria such as adverse events, fault propagation levels and city populations are chosen in this research.The decision support system output uses the dominance principle to order the alternatives in descending order of priority.The alternatives correspond to the possible interventions that can be performed by civil protection units.
After the scenario and emergency alarm levels are defined for each area, the decision support system optimally allocates tasks to emergency operations centers based on their distances and the recovery resources available in the districts.This method of resolution is chosen because it takes into account possible inaccuracies in the CISIApro model and strikes the right balance between data processing complexity and the time required to obtain solutions.
The customized decision support system panel presented in Figure 3 has three main components (shown on the right-hand side).The first is the "operating section" that summarizes the magnitudes of situations such as floods and fires and the operative levels of cities.The "side section" is where the decision support system lists the infrastructures that should be monitored.The third "interventions section" helps prioritize actions to be performed by each civil protection district to mitigate actual and forecasted critical issues.The estimated arrival times to perform interventions are also presented.A button on the panel is clicked to evaluate the mitigation actions; in each case, the positive propagation effects are presented based on a CISIApro simulation.
The unit commitment algorithm has a temporal horizon of 24 hours and must schedule five available generators.The electrical loads are the cities and towns and the hourly profiles are based on the populations and public information available from TERNA (Italian transmission system operator) corresponding to the day before the simulation.The algorithm also requires information about each generator, including the minimum and maximum power production, ramp rate and maintenance, and startup and shutdown costs.In order to evaluate the security constraints on power branches, flow limits and operative levels are assigned to the branches.
During normal conditions, the two primary substations are operational and they supply the vast majority of consumer demand as shown in Table 1.The remaining portion of the demand is supplied by the natural gas power plant and wind farm.Solar power generation is usually discouraged due to its low

Conclusions
This chapter has demonstrated how decision support for critical infrastructure assets during emergencies can be enhanced using interdependency mod-eling.The approach is implemented in an innovative tool for studying the impact of catastrophes on interconnected critical infrastructures and optimally allocating resources and services immediately after infrastructure disruptions.
The CISIApro simulator is used to evaluate the consequences of adverse events in complex scenarios involving several interconnected critical infrastructures.The adverse events range from cyber attacks and mechanical faults to natural disasters.Using a decision support system in concert with CISIApro enables operators to make quick, informed decisions during adverse events.
An important contribution is the use of a single critical infrastructure model to support different downstream decision support systems.The case study involves two problems -resource optimization for civil protection interventions and resource optimization for power grid load balancing.The two problems have different features and are solved using two different optimization algorithms, but they both rely on inputs from the CISIApro simulator.The effectiveness of the approach is demonstrated using a complex, real-world scenario involving four interconnected infrastructures.
Future research will focus on extending the multi-criteria decision making method to directly take into account the amounts and types of available resources.Also, efforts will be made to enhance the unit commitment solutions using various models for thermal and renewable sources.

Figure 2 .
Figure 2. Reference scenario with the main cities representing eleven districts.

Figure 3 .
Figure 3. Civil protection panel after the evaluation of Priverno flooding.

Figure 4 .
Figure 4. Unit commitment results during the Priverno flood.

Table 1 .
Unit commitment algorithm results during normal conditions.