A Systematic Approach of Global Sensitivity Analysis and Its Application to a Model for the Quantification of Resilience of Interconnected Critical Infrastructures

Abstract

We consider a model for the resilience analysis of interconnected critical infrastructures (ICIs) that describes the dependencies among the subsystems within the ICIs and their time-varying behavior. The model response is a function of uncertain inputs comprising ICIs design parameters and failure magnitudes of vulnerable elements in the system, etc. In this methodological paper, we present a systematic approach based on an innovative blend of methods to perform a sensitivity analysis for identifying the most relevant variables affecting the system resilience at different stages, during a disruptive event. The methods considered include the following: the use of the graphical representation of Cusunoro curves for a visualization of the impact of an input on the resilience metric and an understanding of whether the associated dependence is monotonic, increasing, or decreasing; the introduction of an ensemble of indicators related to different properties of the resilience metric to allow the prioritization of variable importance and avoid false negatives, meaning to regard a variable as non-influential when, instead, it plays a relevant role in the determination of the model response; the calculation of first-order variance-based sensitivity indices to have an appreciation on the relevance of interactions when inputs are independent; and a data approach to visually identify relevant second-order interactions. All the sensitivity methods considered are performed on a provided sample, and do not require additional model evaluations. They allow the analyst to post-process the data to extract, simultaneously, several desirable insights. The systematic approach proposed to apply these methods allows us to identify the model input variables and parameters that are not very relevant, while it enables the identification of the relevant ones which allows prioritizing interventions on the vulnerable elements of the system for its resilience at different stages during a disruptive event. Given the methodological nature of the work, a simplified infrastructure model describing an interconnected gas network and electric power grid is taken as case study: this allows us to show that the approach is straightforward to understand and implement, and the results obtained show the usefulness of the approach in providing meaningful insights that can be used by stakeholders and decision makers to inform strategies for the improvement of system resilience. By the application of the simplified ICIs model to the case study, it is shown that the approach can be straightforwardly implemented to identify the most relevant variables on system resilience and obtain the most important subsystems. The key factors which affect system resilience in multiple initial failures scenarios are found; this allows us to identify the key resilience improvement measurements, and their priorities.

1. Introduction

Critical infrastructures (CIs) are networked systems that provide essential commodities and services and support socioeconomic developments. Examples are represented by electrical power grids, natural gas and water supply networks, transportation systems, and so on [1,2,3].

The CIs are also called lifeline systems [4,5], as their inoperability may cause catastrophic social and economic consequences [6,7]. Therefore, the resilience of these systems, i.e., the capacity to resist undesirable situations and to recover from disruptive events, has become important in risk management and the protection of CIs [8,9].

In different sectors, several efforts have been made to investigate the resilience of single- [10,11] and multiple-infrastructure systems [12,13]. To improve modeling accuracy, it becomes an important task [14,15] to consider physical connections and functional interdependencies among different CIs. These couplings make the operations of individual CIs more efficient in nominal conditions, but also increase their vulnerabilities, due to cascading effects in case of failure; e.g., a minor fault in one infrastructure can lead to failures in dependent infrastructures, cascading to other systems, recursively [16].

In [17], the authors have proposed a resilience analysis framework aiming at evaluating the performance of interconnected critical infrastructures (ICIs) and assisting in decision making for their risk management and protection. In the framework, a state-space dynamic model is combined with a model predictive control algorithm, to forecast the system behavior under normal and accident conditions. The system performance is evaluated through modeling and simulation.

The framework of resilience analysis developed in [17], however, leaves out the question of the uncertainty quantification and sensitivity analysis. Such analysis is needed to complete the framework for two main reasons. On the one hand, there are a large number of input variables in the model for resilience analysis. These model inputs range from system design parameters, system initial operation conditions, and variables related to the failure and recovery processes of vulnerable subsystems. The uncertainty of these model inputs emerges due to the insufficient or imprecise observations and judgement of experts, etc. On the other hand, a systematic application of global sensitivity analysis methods allows us to obtain insights on the system resilience, which can, then, be used to inform strategies of resilience improvement. Therefore, it is important to identify the variables most relevant to the system resilience, in order to identify the most important elements in the system, which are more worthy of investment for the improvement of system resilience when the budget is limited.

In this respect, the use of global sensitivity analysis methods is recommended as part of the best practices for risk assessment studies in influential works such as [18,19,20,21]. Over the years, global sensitivity methods have been applied for the sensitivity of models in, among others, food risk assessment [22,23], the prediction of hurricane losses [24], climate change modeling [25], flood risk modeling [26], and life cycle assessment [27]. As far as we are concerned, this is the first study to put forward and apply global sensitivity analysis in the context of resilience analysis.

The core of the present methodological paper is the innovative application to a system resilience model of a blend of methods of sensitivity analysis. In the paper, we proceed as follows. First, we introduce the dynamic modeling approach for ICIs resilience analysis through a case study. Given the methodological nature of the paper, we consider a simplified ICIs model describing a gas network and an electric power grid. We chose to proceed this way purposely in order to handle a test case as complete as possible in its characteristics of interest but whose dimensionality still allows us to present the methodology compactly, which is the main aim of the paper. We, then, consider uncertainty in the input parameters and propose a systematic approach to global sensitivity analysis based on an innovative blend of methods. The core of our analysis is a one-sample (given data) design that allows one to keep computational complexity under control. We obtain the sample from an uncertainty quantification of the ICIs resilience analysis model with 5000 model runs. From the sample generated, we gather sensitivity information on the contribution of the parameters to the expected value and the variance of the model outputs. In so doing, we are able to extract insights concerning the directions of change and the regional contribution to the output variance. The identification of the key drivers of uncertainty is then performed using variance-based and moment-independent methods. This process yields solid insights on the key parameters affecting system resilience. The insights coming from the contribution to the mean and to the variance provide the risk analysis with an increased understanding of the mechanisms generating system resilience. The parameter ranking provides insights into what factors can be fixed to reduce the computational burden in further numerical investigations. The study of interactions allows one to appreciate whether the model response is additive to parameter changes and to identify the parameters whose interactions impact system resilience the most.

The remainder of the paper is organized as follows. Section 2 introduces the system modeling approach, defines the uncertain variables in the model, and introduces the system resilience metric. The modeling and sensitivity analysis are implemented in the case study as an example of application. Section 3 describes the sensitivity analysis methods at the basis of our approach. Section 4 presents the case study. Section 5 analyzes the results for the resilience model. Section 6 and Section 7 offer discussions and conclusions.

2. Modeling for Resilience Analysis

2.1. Modeling Approach

In the resilience analysis framework proposed in [17], the ICIs are considered as an entire system that can be represented as a networked graph of nodes and links. The nodes represent the subsystems, which are components or functional sets of components. Resources, which can be tangible products or intangible services, are produced, exchanged, transformed, and consumed within or between these subsystems. The directed links represent the physical and functional dependences, which correspond to resources flows among the various subsystems.

For illustration purposes, Figure 1 shows three interconnected CIs, $C{I}_1$, $C{I}_2$, and $C{I}_3$ (rectangular shape), and their corresponding subsystems (circular shape). To model the behavior of infrastructures, the subsystems are classified into different types according to their specific roles and numbered as follows: (1) suppliers, which provide resources to other subsystems in the system; (2) buffers, which are adjustable storage devices (e.g., batteries in power grids and gas reservoirs in gas distribution systems); (3) transporters, which transfer the resources among different subsystems (e.g., distribution stations, compressors, and joints); (4) converters, which produce one type of resource by consuming another (e.g., fossil-fuel power stations that burn fossil fuel to produce electricity); and (5) users that consume resources [28,29,30]. Different types of links, i.e., solid, dotted, and dash-dotted lines, represent functional relationships within ICIs, where one major type of resource flow dominates in each infrastructure.

We apply a state-space modeling approach as in [17]. A linear time-invariant model is used to forecast the dynamic response of the system. The discretized state-space representation is written as follows:

$$\begin{array}{c} x\left(k+1\right)=Ax\left(k\right)+Bu\left(k\right)+d\left(k\right)\\ y\left(k\right)=Cx\left(k\right)\end{array},$$

(1)

where $x=\left[x_1\dots x_N\right]\prime \in {ℝ}^N$ is the vector of system states and interconnections, and k is an integer. The vector of inputs controls $u=[u_1\dots u_M]\prime \in {ℝ}^M$ determines resource allocation according to the user demand. The quantity $y=[y_1\dots y_{N_y}]\prime \in {ℝ}^{N_y}$ is the vector of system outputs, which include the states of users, i.e., the amount of resources reaching the users. The vector $d=[d_1\dots d_{N_d}]\prime \in {ℝ}^{N_d}$ is a noise term. In Equation (1), $A\in {ℝ}^{N\times N}$, $B\in {ℝ}^{N\times M}$ and $C\in {ℝ}^{N_y\times N}$ are state transition matrices which reflect the topological structure of the interconnected systems and subsystems, and are determined by the structure of the system and its functional process. The model also takes into account constraints that affect the system operability. Polyhedral constraints of system states and control inputs can be reformulated in such a way that, for all $k\in \mathbb{N}$:

$$Mi{n}_x\le x(k)\le Ma{x}_x$$

(2)

$$Mi{n}_u\le u(k)\le Ma{x}_u$$

(3)

We apply the model predictive control (MPC) approach to distribute the resources throughout the network, from the suppliers to the users [31]. Typically, in MPC, the objective (or cost) function to be optimized penalizes deviations of the states and inputs from their reference values, while explicitly enforcing the constraints. Due to its versatility, MPC has had a successful record in industrial applications, including refrigeration systems, power production plants, transportation networks, and microgrid networks.

We formulate an optimization problem, where the objective function is the minimization of the differences between the actual states of the users; i.e., the system outputs $y_{i_y}(k)$, with $i_y=1,\dots ,N_y$, and their demands $M_{i_y}(k)$ at each time step, within the predictive horizon $N_q$ of interest:

$$\min {\displaystyle \sum }_{q=0}^{N_q-1}\left({\displaystyle \sum }_{i_y}{\omega }_{i_y}(k)\frac{\left|y_{i_y}\left(k+q|k\right)-M_{i_y}\left(k+q|k\right)\right|}{M_{i_y}\left(k+q|k\right)}\right),$$

(4)

where ${\omega }_{i_y}\in [0,1]$ is the weight assigned to the i_yth user at time $k$, with $i_y=1,\dots ,N_y$, and $k+q|k$ denotes the prediction at time step k + q given the state at time k.

The optimal control actions at time $k$, $u\left(k|k\right)$ are obtained from the control sequence

$$u\triangleq \{u\left(k|k\right), u\left(k+1|k\right), \dots , u\left(k+N_q-1|k\right)\},$$

(5)

resulting from the solution of the optimization problem that activates the resource allocation process.

2.2. System Parameters

Input parameters include the system’s initial conditions, the system’s design parameters and failure levels of vulnerable elements. We suppose that an undesired event occurs at $t_f$, which results in the failure of one or multiple vulnerable elements in the system. The magnitude of the ith initial failure, $F_i$, is introduced to quantify the impact of the disruption on the capacity of the failed subsystems. The initial failures propagate throughout the network and the overall performance of the system is affected. Once the cascading failures are detected, restoration actions start at time $t_r$. In the post-disruption recovery phase, the failed elements are restored with recovery rates ${\mu }_i$. The recovery process continues until $t_h$, when the system performance is expected to be restored. Two critical time durations can be defined in a scenario: the response time $H_r=t_r-t_f$, which is the duration of the failure process, and the time horizon, $H_h=t_h-t_f$, which represents the threshold time within which the restoration is to be finished. Buffer subsystems in the ICIs contribute to system performance by storing resources (for those resources which can be stored), adjusting the supply of resources in nominal operation and compensating for missing resources in case of shortage during accident. To model buffers, we assign initial inventory buffer levels with $x_{B{F}_i}^{t=0}$ representing the initial resource level of buffer $B{F}_i$ at $t=0$.

2.3. System Resilience Metric

The system performance function is denoted as $P(t)$ and the target system performance function, or performance reference function, is represented as $PR(t)$ (Figure 2).

We introduce a resilience metric $R=(R_m,R_r,R_t)$ composed of three indicators [15]: (1) resilience by mitigation $R_m$, which corresponds to the ability of the system to withstand threats in the aftermath of the disruption; (2) resilience by recovery $R_r$, which refers to the capacity of recovery by the restoration actions; and (3) total resilience $R_t$, which indicates the level of system resilience throughout the event. As illustrated in Figure 2, resilience by mitigation is the proportion of the total area between the system performance curve and the time axis (the area shaded with upward diagonal stripes in Figure 2) to the total area between the performance reference curve and the time axis of all users (the dotted area in Figure 2), for the time period $t_f\le t\le t_r$, which corresponds to the response time $H_r=t_r-t_f$,

$$R_m=\frac{{{\displaystyle \int }}_{t_f}^{t_r}P\left(t\right) dt}{{{\displaystyle \int }}_{t_f}^{t_r}PR\left(t\right) dt}.$$

(6)

Resilience by recovery is the proportion of the total area between the actual performance curve and the time axis (the area shaded with downward diagonal stripes in Figure 2), to the area between the performance reference curve and the time axis (the dark area in Figure 2), for the time period $t_r\le t\le t_h$ with $t_h\ge t_r$, i.e., from the start of restoration to the end of the time horizon, $H_h-H_r=t_h-t_r$,

$$R_r=\frac{{{\displaystyle \int }}_{t_r}^{t_h}P\left(t\right) dt}{{{\displaystyle \int }}_{t_r}^{t_h}PR\left(t\right) dt}.$$

(7)

Total resilience, $R_t$, represents the level of system resilience in the entire failure-recovery event; it includes both the resistance and recovery aspects of the system during the disruptive event, i.e., $t_f\le t\le t_h$,

$$R_t=\frac{{{\displaystyle \int }}_{t_f}^{t_h}P\left(t\right) dt}{{{\displaystyle \int }}_{t_f}^{t_h}PR\left(t\right) dt}.$$

(8)

The resilience indicators take values in the interval [0, 1]. If the system performance is not affected by a disruptive event, then the performance of the system is on target, i.e., the indicators equal to 1.

2.4. Resilience Indicators for ICIs

Based on the ICIs dynamic model introduced previously, the performance function $P(t)$ is characterized directly in terms of the weighted sum of the users’ states:

$$P\left(t\right)={\displaystyle \sum }_{i_y}^{i_y=N_y}{\omega }_{i_y}(t)y_{i_y}(t),$$

(9)

where ${\omega }_{i y}$ with $i_y=1,\dots ,N_y$ is the weight of the i_yth user. The target system performance of ICIs, $PR(t)$, which is the total demand of resources or service by the users, is calculated as follows:

$$PR(t)={\displaystyle \sum }_{i_y}^{i_y=N_y}{\omega }_{i_y}(t)M_{i_y}(t).$$

(10)

Under nominal operating conditions, the supply to each user, e.g., $i_y$, with respect to its demand $M_{i_y}$ is always achieved; i.e., $y_{i_y}(t)=M_{i_y}(t)$ and $P(t)$ maintains values close to the nominal performance function $PR(t)$. By combining the general indicator equations of system resilience (6), (7) and (8) with the equations describing the actual performance function (9) and demand function (10) based on the ICIs dynamic model, the system resilience metric for dynamic ICIs can be computed.

3. Global Sensitivity Approach

In this work, we apply a systematic approach of global sensitivity analysis to a ICIs resilience model for the first time. Then, this opens the question of adopting a methodologically rigorous systematic approach. The first step is to define the quantity of interest in the model output. In our case, we consider three resilience indicators, i.e., the resilience by mitigation $R_m$, the resilience by recovery $R_r$, and the total resilience $R_t$, because they evaluate the resilience level for ICIs at different stages in the aftermath of a disruptive event, and give insights on the effects of system protection and restoration measurements in the different stages. Once the quantity of interest has been identified, it is crucial to define the sensitivity analysis settings [32,33]. In this work, we consider the factor prioritization, direction of change, and interaction quantification. In the first setting, the goal is to determine the key drivers of uncertainty. In the second setting, we are interested in understanding whether an increase or decrease in the parameter leads to an increase or decrease in the quantity of interest. In the third setting, we are interested in determining the relevance of interactions.

3.1. A General Framework for Global Sensitivity Methods

Several methods have been defined to provide an answer to the above-mentioned sensitivity analysis settings under uncertainty, and, in particular, global sensitivity methods emerged as the appropriate tools for the analysis [34,35,36]. The framework is as follows. Let $Y=g(\mathsf{\Theta })$ denote the relationship between the model output ($Y$) and the parameters $\mathsf{\Theta }=\{{\mathsf{\Theta }}_1,{\mathsf{\Theta }}_2,\dots ,{\mathsf{\Theta }}_n\}$. The capital letters here denote the fact that the parameters are uncertain random variables following the joint probability distribution $F_{\mathsf{\Theta }}(\theta )=\mathrm{Pr}(\mathsf{\Theta }\le \theta )$. This probability distribution reflects the decision-maker (analyst) viewpoint on the parameters. With uncertainty in $\mathsf{\Theta }$, the model output becomes a function of random variables, because $Y$ depends deterministically on $\mathsf{\Theta }$ through $g(\mathsf{\Theta })$. The model output $Y$, then, may be viewed as a random variable, with a probability distribution given by $F_Y(y)=\mathrm{Pr}(Y<y)$.

Consider now that the decision maker is informed that one of the parameters, ${\mathsf{\Theta }}_i$, has value equal to ${\theta }_i$. Then, the conditional distribution $F_{Y|{\mathsf{\Theta }}_i}(y)=\mathrm{Pr}(Y<y|{\mathsf{\Theta }}_i={\theta }_i)$ represents the decision-maker uncertainty about $Y$ given that she (he) is informed that ${\mathsf{\Theta }}_i={\theta }_i$. Several global sensitivity measures can be written in the form [34]:

$${\xi }_i={\mathbb{E}}_{\mathsf{\Theta }i}[\zeta (F_Y,F_{Y|\mathsf{\Theta }i})]$$

(11)

where $\zeta (\cdot ,\cdot )$ is a generic operator between probability distributions. The quantity $\zeta (F_Y,F_{Y|{\mathsf{\Theta }}_i})$ is a random function of ${\mathsf{\Theta }}_i$ providing a dissimilarity measure. The external expectation over the marginal distribution of ${\mathsf{\Theta }}_i$ makes it unconditional, leading to the numerical value ${\xi }_i$. This numerical value is the global sensitivity measure of parameter ${\mathsf{\Theta }}_i$ based on the inner operator $\zeta (\cdot ,\cdot )$. To illustrate, consider setting the inner operator equal to the relative difference of conditional variances, $\mathbb{V}[Y|{\mathsf{\Theta }}_i]$, and the unconditional output variance, $\mathbb{V}[Y]$:

$$\zeta (F_Y,F_{Y|{\mathsf{\Theta }}_i})=\frac{\mathbb{V}[Y]-\mathbb{V}[Y|{\mathsf{\Theta }}_i]}{\mathbb{V}[Y]}.$$

(12)

Then, taking the expectation with respect to ${\mathsf{\Theta }}_i$ we obtain

$$\mathbb{E}[\zeta (F_Y,F_{Y|{\mathsf{\Theta }}_i})]=\mathbb{E}[\frac{\mathbb{V}[Y]-\mathbb{V}[Y|{\mathsf{\Theta }}_i]}{\mathbb{V}(Y)}]=\frac{\mathbb{V}(Y)-\mathbb{E}[\mathbb{V}(Y|{\mathsf{\Theta }}_i)]}{\mathbb{V}(Y)}={\eta }_i,$$

(13)

which represents the first-order Sobol’s sensitivity measure of ${\mathsf{\Theta }}_i$. Similarly, if we set

$$\zeta (F_Y,F_{Y|{\mathsf{\Theta }}_i})=\frac{1}{2}{{\displaystyle \int }}_{-\infty }^{+\infty }|f_Y(y)-f_{Y|{\mathsf{\Theta }}_i}(y)|dy$$

(14)

and take the expectation, we find

$$\mathbb{E}[\zeta (F_Y,F_{Y|{\mathsf{\Theta }}_i})]=\mathbb{E}[\frac{1}{2}{{\displaystyle \int }}_{-\infty }^{+\infty }|f_Y(y)-f_{Y|{\mathsf{\Theta }}_i}(y)|dy]={\delta }_i,$$

(15)

which is known as Borgonovo’s $\delta$ [35]. This importance measure is a representative of the class of moment-independent importance measures and is based on the distance between density functions. In this work, we shall make use also of moment-independent sensitivity measures based on the distance between cumulative distribution functions, in particular, of

$${\beta }^{KS}=\mathbb{E}[\underset{y}{\sup }|F_Y(y)-F_{Y|{\mathsf{\Theta }}_i}(y)|],$$

(16)

$${\beta }_i^{Ku}=\mathbb{E}[\underset{y}{\sup }(F_y(y)-F_{Y|{\mathsf{\Theta }}_i}(y))+\underset{y}{\sup }(F_{Y|{\mathsf{\Theta }}_i}(y)-F_Y(y))],$$

(17)

$${\beta }_i^{CVM}=\mathbb{E}\left[{\displaystyle {\int }_{-\infty }^{+\infty }{\left(F_Y(y)-F_{Y|{\mathsf{\Theta }}_i}(y)\right)}^{2}dy}\right],$$

(18)

and

$${\beta }_i^{AD}=\mathbb{E}\left[{\displaystyle {\int }_{-\infty }^{+\infty }{\left(F_Y(y)-F_{Y|{\mathsf{\Theta }}_i}(y)\right)}^2{F}_Y(y)dy}\right].$$

(19)

The two global sensitivity measures in Equations (16) and (17) are based on the Kolmogorov–Smirnov and the Kuiper distances between cumulative distribution functions, respectively. The works [36,37] thoroughly discuss the properties of these two global sensitivity measures. The sensitivity measures in Equations (18) and (19) are based on the Cramer–von Mises and Anderson–Darling distances, respectively (see [38] for a discussion of sensitivity analysis using the Cramer–von Mises distance). All these importance measures possess the “nullity-implies-independence” (NII) property. That is, a null value of any of the sensitivity measures in Equations (15)–(19) reassures the analyst that $Y$ is independent of ${\mathsf{\Theta }}_i$. Other sensitivity measures that possess this property are, for instance, sensitivity measures based on the Hilbert–Schmidt independent criterion [38] (see also [39,40,41]). However, not all sensitivity measures possess this property. For instance, a null value of ${\eta }_i$ in Equation (13) does not imply that $Y$ is independent of ${\mathsf{\Theta }}_i$. In this respect, it has been recently proven in [34] that a global sensitivity measure possesses the nullity-implies-independence property if and only if we are considering the entire distribution (either as a density or as a cumulative distribution function) of the model output. The work of [34] requires the continuity of the input densities and of the separation measurement. These conditions are usually met in practical applications. However, more recent works have shown that only the convexity of the separation measurement is needed, relaxing even the conditions on the output distribution.

In addition, the sensitivity measures ${\delta }_i, {\beta }_i^{KS}, {\beta }_i^{Ku} \mathrm{and} {\beta }_i^{CVM}$ are transformation-invariant. That is, if we apply a monotonic transformation to the model output $Y$, their values remain unchanged. Transformation invariance is an advantageous property in estimation, because it accelerates numerical convergence while avoiding the problem of transferring results back to the original scale [36]. In general, one can expect ${\delta }_i,\hspace{0.33em}{\beta }_i^{KS}, {\beta }_i^{Ku} \mathrm{and} {\beta }_i^{CVM}$ to produce a similar ranking of the inputs. Indeed, it has been recently proven that ${\delta }_i \mathrm{and} {\beta }_i^{Ku}$ have identical values if the model output marginal and conditional distributions are unimodal [42]. Thus, in the case where their values were to differ, their simultaneous estimation would allow the analyst to appreciate the deviations from unimodality of the distributions. In general, because different sensitivity measures consider different properties of the output, by relying on a portfolio of sensitivity measures, the analyst avoids the pitfall of overly trusting a single indicator. Then, if the measures in the ensemble agree about the most important inputs, the analyst is reassured about the indication to provide to the engineer or the manager. Conversely, if the measures in the ensemble disagree, then the analyst is informed that the inputs contribute differently to alternative properties of the output (e.g., to the variance or to the overall distribution). In this case, the analyst must communicate the results in accordance with the overall engineering or decision-making goal of the analysis.

Under independence, the sum of the first-order variance-based sensitivity measures equals the portion of the variance explained by individual input contributions. Then, the difference $1-{\displaystyle \sum _{i=1}^n{\eta }_i}$ is the fraction of the variance that can be attributed to interactions among the inputs. This information can then be used to assess whether the model responds additively to input changes and whether further analysis for the determination of the most relevant interactions is warranted. We discuss a method for the visualization of interaction effects in Section 3.3.

3.2. Computational Issues of Global Sensitivity Methods

The estimation of global sensitivity measures has been a traditional challenge in computer experiments. In fact, any estimator based on a brute-force implementation of the common rationale in Equation (11) would correspond to a computational cost of $C^{\mathrm{BruteForce}}=n{N}_{ext}{N}_{int}$, where $n,$ $N_{ext}$, $N_{int}$ are, respectively, the number of model inputs, the size of the Monte Carlo sample for the external loop, which fixes a value of ${\mathsf{\Theta }}_i$ in each outer iteration, and the size of the Monte Carlo sample for the internal loop, in which simulations conditional to the chosen value are performed. To illustrate, if we set $n=10,$ $N_{ext}=$$N_{int}=1000$, we obtain a total estimation cost $C^{\mathrm{BruteForce}}=10,000,000$ model runs. This cost is clearly too expensive for most computer codes. This cost constraint was lowered with the introduction of Sobol’ method [43,44] that estimates variance-based first-order and total effects. The associated pick-and-freeze sample design has computational costs $C^{\mathrm{PickFreeze}}=(n+2)N_{\mathrm{base}}$, where $N_{\mathrm{base}}$ is the size of a basic sample block used to build up the pick-and-freeze sample. Moreover, recent works have exploited an intuition of [45] leading to the so-called given-data estimation [46,47,48,49]. This estimation method requires a single Monte Carlo pass (whence the one-sample name), reducing the cost to $C^{\mathrm{GivenData}}=N$. If a Monte Carlo sample is already available, then it can be used directly. The rationale of this estimation method is that of creating the scatterplot of $Y$ against ${\mathsf{\Theta }}_i$. Then, one partitions this scatterplot on the horizontal axis using $M$ bins. In particular, let ${\mathcal{T}}_i$ denote the support of ${\mathsf{\Theta }}_i$, and ${\mathcal{T}}_{i,m}$ an element of the partition. Formally, we have ${\displaystyle \underset{m=1}{\overset{M}{\cup }}{\mathcal{T}}_{i,m}={\mathcal{T}}_i}$ and ${\mathcal{T}}_{i,r}\cap {\mathcal{T}}_{i,t}=\varnothing$, $r,t=1,2,\dots ,M (r\ne t).$ That is, the partition bins cover the entire support of the parameter ${\mathsf{\Theta }}_i$ and are non-intersecting. We refer to [46] for further technical details. What is relevant here is that, if we substitute the point condition ${\mathsf{\Theta }}_i={\theta }_i$ with the bin condition ${\mathsf{\Theta }}_i\in {\mathcal{T}}_{i,m},$ we can write an estimator of ${\xi }_i$ as

$${\hat{\xi }}_i={\displaystyle \sum }_{m=1}^M\frac{1}{M}\zeta (F_Y,F_{Y|{\mathsf{\Theta }}_i\in {\mathcal{T}}_{i,m}}),$$

(20)

where $F_{Y|{\mathsf{\Theta }}_i\in {\mathcal{T}}_{i,m}}(y)=\mathrm{Pr}(Y<y|{\mathsf{\Theta }}_i\in {\mathcal{T}}_{i,m})$ is the conditional probability of the model output given that ${\mathsf{\Theta }}_i$ is in bin ${\mathcal{T}}_{i,m}$. In [46], it has been proven that, under mild conditions, the given-data estimator in Equation (20) is consistent. That is, as the sample size $N$ increases, ${\hat{\xi }}_i$ tends to ${\xi }_i$. Therefore, in this work, only one single Monte Carlo input–output sample for uncertainty propagation will be necessary to obtain an estimate of the sensitivity measures. This makes the analysis computationally feasible. Regarding the sampling scheme, the analyst can generate the input sample from the input distributions, resorting either to a crude Monte Carlo generator, or to a quasi-Monte Carlo method based on Sobol’ sequences [50,51], Halton sequences [52], or to a Latin Hypercube Sampling scheme [53,54].

3.3. Visual Tools for Sensitivity Analysis

In addition, the same input–output dataset can be used to obtain further insights for the modelers and the risk analyst. In particular, regional information is available using curves which show the cumulative sum of the normalized reordered output (Cusunoro), defined by [55]

$$c_i^{Mean}(\tau )=\frac{\tau \cdot \mathbb{E}\left\{Y-\mathbb{E}\left[Y\right]{\left|\right[\mathsf{\Theta }}_i\le F_{{\mathsf{\Theta }}_i}^{-1}\left(\tau \right)]\right\}}{\sqrt{\mathbb{E}\left[{\left(Y-\mathbb{E}\left[Y\right]\right)}^2\right]}},$$

(21)

where $\tau \in [0,1]$ parametrizes the input factor of interest via its quantile. Here, the output $Y$ is standardized, and its expectation is taken conditional to the input being below a quantile threshold. With a sample pair ${({\theta }_{ji},y_j)}_{i=1,\dots ,k,j=1,\dots ,N}$, we may estimate this curve by rearranging the order in the output and taking cumulative sums via

$${\hat{c}}_i^{Mean}(\tau )=\frac{\frac{1}{N}{{\displaystyle \sum }}_{m=1}^{⌈\tau N⌉}\left(y_{{\pi }_i\left(m\right)}-\overline{y}\right)}{\sqrt{\frac{1}{N-1}{{\displaystyle \sum }}_{m=1}^N{\left(y_m-\overline{y}\right)}^2}},$$

(22)

where $\overline{y}$ is the output mean and ${\pi }_i(\cdot )$ is the order permutation of model input $i$, yielding an increasingly ordered sample of the input of interest ${\theta }_{{\pi }_i(j)i}\le {\theta }_{{\pi }_i(j+1)i}$ for $j=1,\dots ,N-1$. By plotting these curves for each input factor, we obtain insights on the direction of change. To this end, if there are no intersections of $c_i(\tau )$ with the horizontal axis, the contributions from the associated parameters are monotonic on average. For instance, if $c_i(\tau )<0$ for all $\tau$, then the mean to the left of a given $\tau$ is always smaller than the overall mean, signaling that $\mathbb{E}[Y|{\mathsf{\Theta }}_i]$ is increasing in ${\mathsf{\Theta }}_i$. Moreover, if the curve is not symmetric, then the dependence between $Y$ and ${\mathsf{\Theta }}_i$ is non-linear. Cusunoro curves, therefore, yield insights within a direction of change setting. We recall that, in such a setting, an analyst is interested in knowing how the model output $Y$ varies as a model input ${\mathsf{\Theta }}_i$ varies in its range.

To illustrate, we consider the Cusunoro curves for a well-known test case, the Ishigami function [56]. The model has the form

$$y=\sin (x_1)(1+0.1{x_3}^4)+7\sin {(x_2)}^2,$$

(23)

and the three input parameters $X_i,X_2,X_3$ are uniformly distributed in $[-\pi ,\pi ]$. Figure 3a shows the Cusunoro curves $c_i^{mean}(\tau )$ in Equation (21) for the three model inputs. From Figure 3a, we observe that $X_1$ and $X_2$ contribute to the mean, whereas no contribution is offered by $X_3$. Regarding monotonicity, the Cusunoro curve of $X_2$ intersects the horizontal axis at multiple locations, signaling a non-monotonic behavior of the model.

One feature of the Ishigami model is that parameter $X_3$ does not contribute to the mean of the model output. However, this is not enough to deem the model input as non-influential. In fact, we are to see shortly that $X_3$ indeed contributes to the model output variance. With a slight modification, Cusunoro curves can be used to obtain regionalized information on the squared deviation ${(Y-\mathbb{E}[Y])}^2$ (whose expectation is the model output variance, $\mathbb{V}[Y]$). Proceeding with a similar logic as for Equation (21), we can write [55]:

$$c_i^{\mathrm{var}}(\tau )=\frac{\tau \cdot \mathbb{E}\{{(Y-\mathbb{E}[Y])}^2-\mathbb{V}[Y]|X_i\le {F_{X_i}}^{-1}(\tau )\}}{\sqrt{\mathbb{E}[{({(Y-\mathbb{E}[Y])}^2-\mathbb{V}[Y])}^2]}}.$$

(24)

The function $c_i^{\mathrm{var}}(\tau )$ in Equation (23) plots the conditional contribution of $X_i$ to the model output variance as $X_i$ varies from its lowest to its highest value. It can be seen as an alternative approach to the contribution to the sample variance [57]. The idea of analyzing quantities other than the conditional mean has also been discussed in a broader context by [58]. From the plot of one of these curves, we obtain regional information about the contribution of $X_i$ to the model output variance. To illustrate, Figure 3b plots the variance Cusunoro curves [$c_i^{\mathrm{var}}(\tau )$, Equation (24)] for the Ishigami function. This graph shows the region where each $X_i$ contributes to the model output variance. Indeed, we now can visually observe that $X_3$ is an active model input, with a symmetric contribution to the second-order central moment of the output.

3.4. A Tool for Interaction Analysis

As we mentioned in Section 3.1, a sum of the first-order indices lower than unity might communicate to the analyst the need to explore parametric interactions. A frequently used approach to calculating second- and higher-order interaction effects is to make use of polynomial chaos expansion [59]. In this section, we propose a method associated with the calculation of variance-based sensitivity indices using the fast Fourier transform [60]. Here, frequencies are assigned to the input of interest via a suitable reordering, and their resonances and superpositions in the output can be detected and are attributed to the variance-based first- and higher-order effects. For first-order effects, this reordering is induced by sorting the input of interest. For higher-order effects, search curves are used which approximate space-filling curves (see [60] for further details). As a result, one obtains estimates of higher-order variance-based sensitivity measures. In this work, we shall make use of estimates of second-order sensitivity measures. To illustrate, we again use the Ishigami model.

Figure 4 displays the inputs’ relative variance contributions in a heat map, with first-order effect estimates ${\hat{\eta }}_i$ in the diagonal entries and second-order interaction estimates ${\hat{\eta }}_{ij}$ in the off-diagonal entries. Darker colors indicate stronger contributions. The diagonal elements show that ${\eta }_2$ is the highest individual contribution, followed by $X_1$, with a null contribution of $X_3$. This input is, instead, involved in the only active interaction contained in the Ishigami function, with a non-null value of ${\hat{\eta }}_{13}$. These findings agree with previous results on this model.

In summary, several insights about the behavior of a model can be obtained directly from the sample generated by an uncertainty quantification and sensitivity analysis. In the next section, we discuss how these insights can be obtained for our case study in detail.

4. Case Study

The model used here considers two interconnected critical infrastructures: a natural gas distribution network and a power grid (Figure 5, solid and dash-dotted lines, respectively) [31]. The objective of this system is to provide the necessary amount of gas and electricity to the users. In particular, the gas distribution network supplies gas to two demand nodes, $D_1$ and $D_2$, and to two electric power generators, $E_1$ and $E_2$, that provide electricity to two users of electricity, $L_1$ and $L_2$.

The nodes in the network are classified into five categories according to their functionalities, as introduced in Section 2.1. We denote the gas volume unit 1000 cubic feet as MCF. The natural gas distribution network has two suppliers, $S_1$ and $S_2$, whose outputs are assumed to be equal to 90 MCF, and 180 MCF, respectively; two buffers (gas reservoirs), $D{S}_1$ and $D{S}_2$; five transporters $a$, $b$, $c$, $d$, and $e$; and two users $D_1$ and $D_2$, whose demands, $D_{D1}$ and $D_{D2}$, are equal to 100 MCF and 80 MCF, respectively. The electric power network has two converters (electric power generators), $E_1$ and $E_2$, that transform gas into electricity with a constant coefficient $\beta$; two transporters, $G_1$ and $G_2$; and two users $L_1$ and $L_2$, whose demands, $D_{L1}$ and $D_{L2}$, are equal to 500 MWh and 400 MWh, respectively. More information about the case study can be found in [31].

The dynamic modeling approach introduced in Section 2 is implemented to simulate the resilience of this ICIs system under different scenarios. In our previous work [19], we modeled the dynamic response of the different components of the system under scenarios caused by single subsystem random failures. In this work, the resilience analysis is focused on scenarios with multiple initial failures, whereby a large-scale undesired event may lead to different levels of disruptions on multiple vulnerable elements. The vulnerable elements of the system as identified in [31] are marked with bold lines in Figure 6.

The dynamic model output is a function of input variables comprising the system design parameters, initial condition parameters, and failure-related parameters. These constitute the uncertain input of Section 3.1, with n = 20. The ranges of values of the system design and initial condition parameters are given in

Table 1. System design parameters and initial conditions.

Description	Symbol	Bounds	Unit Measure
Response time	Hr	[0, 30]	hours
Time horizon	Hh	[50, 100]	hours
The initial storage of the buffer DS1	$x_{D{S}_1}^{t=0}$	[1000, 4000]	MCF
The initial storage of the buffer DS2	$x_{D{S}_2}^{t=0}$	[2000, 8000]	MCF

, and those related to the failure characteristics of the vulnerable elements are given in

Table 2. Magnitude of failure and recovery rate of vulnerable elements.

$\mathit{i}$	Vulnerable Element	Failure Magnitude Fi	Units of Fi	Recovery Rate μi	Units of μi
1	Supplier $S_1$	[0, 90]	MCF	[0, 1.8]	MCF/h
2	Supplier $S_2$	[0, 180]	MCF	[0, 3.6]	MCF/h
3	Link $a-b$	[0, 300]	MCF	[0, 6]	MCF/h
4	Link $b-c$	[0, 170]	MCF	[0, 3.4]	MCF/h
5	Link $c-d$	[0, 100]	MCF	[0, 2]	MCF/h
6	Link $d-e$	[0, 100]	MCF	[0, 2]	MCF/h
7	Link $E_1-G_1$	[0, 800]	MWh	[0, 16]	MWh/h
8	Link $E_2-G_2$	[0, 400]	MWh	[0, 8]	MWh/h

. The latter parameters are used to describe different failure scenarios (failure magnitude F) and different recovery plans (recovery rate μ). Uniform distributions are assumed for all parameters. The 20 inputs are relabeled as follows: (1) the response time: $H_r$; (2) the time horizon: $H_h$; (3) the initial storage of buffer subsystem $D{S}_1$: $x_{D{S}_1}^{t=0}$; (4) the initial storage of buffer subsystem $D{S}_1$: $x_{D{S}_2}^{t=0}$; (5) the failure magnitude of supplier $S_1$: $F_1$; (6) the recovery rate of supplier $S_1$: ${\mu }_1$; (7) the failure magnitude of supplier $S_2$: $F_2$; (8) the recovery rate of supplier $S_2$: ${\mu }_2$; (9) the failure magnitude of link $a-b$: $F_3$; (10) the recovery rate of link $a-b$: ${\mu }_3$; (11) the failure magnitude of link $b-c$: $F_4$; (12) the recovery rate of link $b-c$: ${\mu }_4$; (13) the failure magnitude of link $c-d$: $F_5$; (14) the recovery rate of link $c-d$: ${\mu }_5$; (15) the failure magnitude of link $d-e$: $F_6$; (16) the recovery rate of link $d-e$: ${\mu }_6$; (17) the failure magnitude of link $E_1-G_1$: $F_7$; (18) the recovery rate of link $E_1-G_1$: ${\mu }_7$; (19) the failure magnitude of link $E_2-G_2$: $F_8$; and (20) the recovery rate of link $E_2-G_2$: ${\mu }_8$. In the following sections, we may use the number of these variables instead of the associated symbols for ease of illustration.

We use the Monte Carlo method to propagate input uncertainty onto the system resilience indicators. The sample size is N = 5000. The output distributions for mitigation $R_m$, resilience by recovery $R_r$ and total resilience $R_t$ are shown as histograms in Figure 7a, Figure 7b, and Figure 7c, respectively.

Table 3. Parameters of the empirical distributions of the resilience indicators.

Distribution of Resilience Indicators	Mean	Standard Deviation
Resilience by mitigation $R_m$	0.6121	0.1815
Resilience by recovery $R_r$	0.5356	0.1557
Total resilience $R_t$	0.5425	0.1471

reports the corresponding means and standard deviations.

While the above analysis characterizes uncertainty in the output, obtaining insights on the influence of the inputs requires one to apply global sensitivity analysis methods.

5. Sensitivity Analysis Results

To implement the sensitivity analysis on the ICIs case study, we generate by Monte Carlo simulation a sample of 5000 system responses and obtain the corresponding resilience indicators. (As a rule of thumb, the Monte Carlo error is of order $\frac{1}{\sqrt{n}}$. Hence, for n = 5000, we can expect a relative error in the estimates of the order of $2\%$.) We proceed in three steps. First, we analyze the sensitivity in terms of contribution to the model outputs’ mean, then in terms of contributions to the model outputs’ variance, and then we estimate moment-independent sensitivity measures to obtain the key uncertainty drivers.

Let us start with the contribution to the output mean.

Figure 8 displays the Cusunoro curves for our case study. The resilience by mitigation $R_m$ decreases as all the model inputs increase, with a nonlinear behavior, and the two major contributors can be easily spotted. The resilience by recovery $R_r$ and the total resilience $R_t$ show only minor differences in their sensitivity. However, while resilience by mitigation is decreasing as all model inputs increase, $R_r$ and $R_t$ are decreasing in model inputs 9($F_3$), 17($F_7$), 7($F_2$), 11($F_4$), 1($H_r$), and 5($F_1$), and increasing in model inputs 2($H_h$), 10(${\mu }_3$), 12(${\mu }_4$), 8(${\mu }_2$), and 18(${\mu }_7$).

We then consider the contributions to the model output variance. A look at the associated Cusunoro curves reveals some regionalized effects (Figure 9). For resilience by mitigation $R_m$, the two most active contributors are model inputs 9 ($F_3$) and 17($F_7$), but model inputs 9 ($F_3$) contributes to the variance of resilience by recovery $R_m$ only for values below 50%. For resilience by recovery $R_r$ and total resilience $R_t$ the variance is only influenced by the major contributor, model input 9 ($F_3$), for values beyond 50%.

Clearly, repeating the analysis for all higher moments is not practical. Thus, this analysis does not lead to a conclusive inference concerning the most important parameters. To do this, we estimate the first-order variance-based sensitivity measures (Figure 10), as well as the moment-independent sensitivity measures ${\beta }_i^{Ku}$, ${\beta }_i^{Ks}$ and ${\delta }_i$ (Figure 11, Figure 12 and Figure 13). Note that these moment-independent sensitivity measures have a larger level of numerical noise than the variance-based measures.

For model output 1, resilience by mitigation $R_m$, model inputs 1($H_r$), 9($F_3$) and 17 ($F_7$), 11($F_4$) are the key uncertainty drivers, with the remaining inputs playing a minor role (Figure 10 and Figure 11). For model output 2, resilience by recovery $R_r$, we have the results in Figure 12. We see that model inputs 9($F_3$) and 17($F_7$) are the most important, with 2($H_h$), 7($F_2$), 11($F_4$), and 10(${\mu }_3$) forming a group of runners-up.

For model output 3, total resilience $R_t$, we have the results in Figure 13. Model input 9($F_3$) is the key driver followed by 17($F_7$), with 2($H_h$), 7($F_2$), and 11($F_4$) forming a group of runners-up, closely followed by 1($H_r$) and 10(${\mu }_3$). Hence, the difference in performance of the resilience by recovery $R_r$ and the total resilience $R_t$ is marginal.

To corroborate these results, we also computed the importance measures in Equations (22) and (23). Results are displayed in Figure 14 and confirm the identification of the uncertainty drivers obtained with the previous methods. The interpretation of all these results is discussed in the next section.

Finally, we note that the sum of the first-order sensitivity indices for this model leads to 92%, 75%, and 79%, respectively, for the outputs. This may prompt an analysis of the interaction structure, especially for the resilience by recovery and the total resilience. As discussed in Section 3.3, the first- and second-order effects may be readily estimated from available data, which are shown in Figure 15. The largest value in each of the subplots is represented by the black color. The sensitivity for the resilience by mitigation is mainly concentrated on the diagonal, where the first-order effects are found in the plot, with a small interaction (3.5%) between $X_1$ and $X_9$. For the recovery and total resilience indicators, we obtain similar results.

We spot small interactions between $X_9$ and $X_{10}$ (6%/4%), and $X_7$ and $X_8$ (2.5%/2%). These two identified interactions indeed represent vital links in the system.

6. Discussion and Interpretation

The approach allows us to identify the most relevant input parameters affecting the response of the system resilience model and to understand how the model behaves as a function of these parameters. In the failure process, the values of the global sensitivity measures indicated as key uncertainty drivers for resilience by mitigation are the response time ($H_r$), the failure magnitude of link $a-b$ ($F_3$), the failure magnitude of link $E_1-G_1$ ($F_7$), and the failure magnitude of link $b-c$ ($F_4$). Regarding the direction of change, the Cusunoro curves indicate that resilience by mitigation decreases monotonically with these system variables. The response time ($H_r$) is important because, in the failure phase, the recovery actions have not been taken and a large response time leads to a strong reduction in the subsystems’ performance and failure propogation through the interdependences among the subsystems. Link $a-b$, link $b-c$, and link $E_1-G_1$ are the most important elements to protect during the failure stage of the disruption, as their initial failures can largely impair the resilience by mitigation. The results of the sensitivity analysis match our intuition about what would happen in reality: the more severe the failures are, the less likely the system will be to maintain its performance.

The most important input variables for resilience by recovery are the failure magnitude of link $a-b$ ($F_3$), the failure magnitude of link $E_1-G_1$ ($F_7$), the time horizon ($H_h$), the failure magnitude of supplier $S_2$ ($F_2$), the failure magnitude of link $b-c$ ($F_4$), the response time ($H_r$), and the recovery rate of the link $a-b$ (${\mu }_3$). The Cusunoro curves show that, among the important variables, the resilience by recovery of system increases with the time horizon ($H_h$) and the recovery rate of the link $a-b$ (${\mu }_3$), and decreases with others. The time horizon represents the expected time duration for recovery; therefore, a large time horizon can ensure the restoration time of the system performance and, in this sense, increase resilience. We notice that the key subysystems for resilience by recovery are partially overlapped with those for resilience by mitigation, i.e., link $a-b$, link $b-c$, and link $E_1-G_1$. This indicates that the protection of these elements is important, as the influence of their failures on system resilience continues throughout the aftermath of the undesired event. The supplier $S_2$ is the largest supplier subsystem, so that its operability guarantees the most supply. The failure magnitude and recovery rate of link $a-b$ are both important for resilience by recovery, implying the importance of link $a-b$ in the recovery stage. The restoration of link $a-b$ should have a higher priority than any other elements. In fact, this conclusion is intuitive, observing the system topological structure (Figure 4), where link $a-b$ is the single bridge between suppliers and users.

As for the total system resilience, it can be seen that the most important input variables and parameters are the combination of those for resilience by mitigation and those for resilience by recovery. This result conforms to the meaning of total resilience, which represents the resilience level of the system cumulated in both the failure and recovery stages. Moreover, the Cusunoro curves show that the important parameters for resilience by recovery and total resilience have similar impacts in terms of the direction of change, which indicates that restoration strategies play a significant and decisive role for the system protection.

The input variables significantly affecting the system resilience during the entire disruptive event are: the response time, $H_r$, the time horizon, $H_h$, the failure magnitude of supplier $S_2$, $F_2$, the failure magnitude of link $a-b$, $F_3$, the recovery rate of link $a-b$, ${\mu }_3$, the failure magnitude of link $b-c$, $F_4$, and the failure magnitude of link $E_1-G_1$, $F_7$. In particular, the most relevant subsystems are identified as link $a-b$, link $b-c$, link $E_1-G_1$, and the supplier $S_2$. The interaction analysis may suggest that ${\mu }_2$, the recovery rate of $S_2$, might also be a non-negligible input variable.

We then performed a conceptual experiment fixing the least influential inputs at their mean values and comparing the distributions of the resilience metrics obtained in this case against the ones obtained when varying all uncertain inputs. Figure 16a–c report the histograms for the three metrics;

Table 4. Parameters of the empirical distributions of the resilience metrics in the case where only important inputs are allowed to vary.

Distribution of Resilience Metrics	Mean	Standard Deviation
Resilience by mitigation $R_m$	0.6177	0.1874
Resilience by recovery $R_r$	0.5678	0.1692
Total resilience $R_t$	0.5597	0.1625

reports the means and standard deviations.

Comparing Table 3 and Table 4, we can observe that the empirical distributions are very similar, especially for the resilience by mitigation metric. As for the resilience by recovery and total resilience, the means of the distributions are slightly higher in the case where the unimportant inputs are fixed (case 2) than when all inputs are allowed to vary (case 1). The cause of this deviation is the conservative setting for the values of the unimportant input variables in case 2. In case 2, the failure magnitude of more than half of the vulnerable subsystems are random, but the buffer subsystems are half-filled and the recovery rates of all vulnerable subsystems, except link $a-b$, are at an average level, so that the relative high inventories and recovery rates make the recovery process more efficient. In brief, it is practical to consider as fixed values the model input variables with minor effects on the system resilience.

In practice, according to the indications obtained from the sensitivity analysis, the loss of system resilience can be mitigated by increasing the robustness of link $a-b$, link $b-c$, and link E₁$-$G₁. Moreover, at the first stage of a disruptive event, speeding up the response is the best solution to reduce consequential effects. That is related to more efficient failure detections and the more effective preparedness of the emergence systems. In the second stage of the scenario, the restoration of link $a-b$, link $b-c$, link $E_1-G_1$, and supplier $S_2$ are most important.

7. Conclusions

This methodological paper has presented a systematic approach that combines off-the-shelf techniques of sensitivity analysis in a novel way to identify the most relevant variables affecting infrastructure resilience. The approach is intended to provide insights on system criticalities, to support the understanding of the system behavior. It is based on the direct use of the input–output sample generated in an uncertainty analysis to obtain global sensitivity insights.

We can summarize the procedure in the steps of Figure 17:

(1) We identify the resilience metric of interest: this step is essential as the metric of interest determines the subsequent engineering decisions. (2) We quantify uncertainty in the resilience metric of interest via uncertainty propagation from the input distributions: this is performed by generating an input sample from the assigned distributions, and then running the ICIs model to obtain the corresponding values of the model output. (3) A third step, sometimes carried out implicitly, consists of analyzing qualitatively the results of the uncertainty quantification. From the distribution of the resilience metric, the analyst obtains information on the mean value, the variance, the interquantile range, etc. (4) Establish the goals of the sensitivity analysis. This step helps the analyst in defining the goals of the analysis, and then in identifying the methods appropriate to answer them. The tools we have proposed allow the analysts to post-process the data to extract simultaneously several desirable insights. (5) For the direction of change, we have proposed the use of the graphical representation of Cusunoro curves. From these graphs, the engineer can have a first visualization of the impact of an input on the resilience metric and can also understand whether this dependence is monotonic, increasing, or decreasing. (6) For factor prioritization, we have proposed the simultaneous use of an ensemble of indicators. These indicators consider alternative properties of the resilience metric and allow the analyst to avoid false negatives, that is, to regard a variable as non-influential when, instead, it plays a role in the model. These two sets of sensitivity indicators complement each other insofar as, from indicators of the trend, it is possible to gauge whether an input is active on the output, but no definitive conclusion can be drawn on the relative importance of the inputs. We have also seen that the calculation of first-order variance-based sensitivity indices allows one to have an appreciation of the relevance of interactions when inputs are independent (step 7) and we have introduced a given-data approach to visually identify relevant second-order interactions. The last step is, then, to present and discuss the results with stakeholders.

Figure 17. Methodology steps.

Figure 17. Methodology steps.

For illustration purposes, we have, then, applied the approach to a simplified ICIs resilience model of a gas network and a power grid. The dynamic behavior of ICIs is simulated using a dynamic model driven by a model predictive control algorithm, with uncertain input variables. The target performance of the ICIs is defined and the system resilience is evaluated. The systematic approach allows us to identify the model input variables and parameters that are not very relevant and enables us to use the relevant ones to prioritize the importance of the vulnerable elements for system resilience at different stages during a disruptive event.

By the application of the simplified ICIs model to the case study, it is shown that the approach can be straightforwardly implemented to identify the most relevant variables on system resilience and obtain the most important subsystems. The key factors which affect system resilience in multiple initial failures scenarios are found. This allows us to identify the key resilience improvement measurements, and their priorities. In the first stage of the aftermath of a disruptive event, the enforcement of failure detections and speeding up the response are the main actions to take, and designing redundancy for the most vulnerable components is also important. In the recovery process, repairing some key subysystems and increasing the capacity of one gas storage device are the most relevant actions for system restoration.

The method is really scalable. In fact, the given-data approach makes the estimation cost-independent of the number of inputs. Throughout the work, we have assumed independent inputs. The removal of this assumption would not impact the way in which first-order variance-based, as well as distribution-based, sensitivity measures are computed. It would, however, impact the interpretation of the graphical tools for trend and interaction analysis. The independence assumption is advantageous in the initial modeling phases, where the analyst wishes to gain confidence in the model behavior. However, as further information on the inputs is collected, the data may reveal correlations. At that moment, alternative ways to study the direction of change and interactions are required. It is part of the future work of the authors to identify new methods, especially those available in the machine-learning literature, to study trend determination and interaction quantification under input correlations. Moreover, an extension to time-dependent outputs is needed to capture the changing importance of the subsystems during recovery, and the corresponding changing priorities of resilience actions. Moreover, part of the future research concerns the application of the method to systems with a greater number of inputs and of a realistic size. In this respect, the given-data approach is advantageous, as it makes the computational cost independent of the size of the input vector, as highlighted in the recent literature outside the resilience realm [61]. We also observe that, for models with a stochastic response, the methods introduced for factor prioritization hold with no formal changes. For the direction of change and interaction quantification, some considerations are needed. If the quantity of interest is a quantile (e.g., the median) or the mean of the resilience metric, then the proposed methods apply with no changes. If the entire distribution is of interest, then the methods for trend identification and interaction quantification used here need to be replaced with alternative methods or tests borrowed from the statistical and machine-learning literature. However, the methodology would warn the analyst up-front of such a need, as soon as step 4 is reached after the selection of a stochastic rather than a scalar quantity of interest. Thus, the applicability of the method for models with a stochastic response is also a further research avenue that follows the present work.