**Assessing Infrastructure Interdependencies:**

**The Challenge of Risk Analysis for Complex Adaptive Systems**

Theresa Brown, Walt Beyeler and Dianne Barton

Sandia National Laboratories[^1]

PO Box 5800, MS 0451

Albuquerque, NM 87185-0451

# Abstract 

Infrastructures are a complex set of interconnected, interdependent,
adaptive systems on which the nation, manufacturing systems and
individuals depend. Understanding the potential consequences of
infrastructure interdependencies, as the infrastructures evolve and the
regulations governing their operation change, is at the heart of
Sandia\'s Infrastructure Interdependencies research program. This
program includes development of analysis methods and simulation tools
for evaluating the potential effects of disruptions and for prioritizing
risks. Fundamental infrastructures simulated using these tools include
transportation, telecommunications, electric power, banking and finance,
water, agriculture, emergency services, fossil fuels, and government.
The complexity of the infrastructures and their interactions prevent us
from knowing *a priori* how these interactions will influence
individuals, states, or the nation; consequences of policy decisions;
vulnerabilities due to interdependencies, natural disasters, malevolent
threats and aging; or vulnerabilities that need to be eliminated in
order to assure individual, state or national economic security. The
goal of the interdependency analyses is to identify significant risks to
critical systems, arising from interconnection, and effective mechanisms
for mitigating those risks.

This article presents Sandia's infrastructure interdependency assessment
process, modeling tools developed to support that process and examples
of assessment results.

# Keywords

Infrastructure Interdependencies, Risk Analysis, Agent-Based Modeling,
Dynamic Systems Modeling

# Biographical Notes

All of the authors are members of the Infrastructure Surety Department
at Sandia National Laboratories. Theresa Brown leads the infrastructure
interdependency assessment team and has a Ph.D. in geology from the
University of Wisconsin, Madison. Walt Beyeler is the lead systems model
developer and has a BS in electrical engineering from the University of
New Mexico. Dianne Barton leads the agent-based modeling and analysis
team and has a Ph.D. from the University of Arizona.

## Introduction

Research on infrastructure interdependencies at Sandia National
Laboratories using a systems viewpoint and analysis techniques has
resulted in development of a suite of simulation tools to support risk
assessment and decision making within a structured framework. The
framework allows us to evaluate the potential responses of complex
systems to perturbations as a function of human behaviors and physical
limitations. The risk-based decision framework, two examples of
interdependency simulation tools and illustrative results of analyses
are used to explain our approach.

## 

## Risk- Based Infrastructure Interdependencies Assessment Process

A generic risk-based assessment process, shown in [Figure 1](#Figure_1),
has been developed to provide a systematic framework for comparing
vulnerabilities, threats, system changes, protection, mitigation and
policies. This process allows informed decisions about complex,
interacting systems using analyses that are based on the decision
objectives and account for the analysis uncertainties in determining the
scale and sophistication of the system models. Within this framework
overarching elements must be considered for each analysis:

1.  The appropriate analysis tools depend on the information that is
    available and the questions that are to be answered.

2.  Uncertainties in simplifying assumptions and model parameter values
    must be incorporated up front to make model results meaningful.

3.  The significance of the risks posed by infrastructure disruptions
    depends on the viewpoint that is taken. Risks to individual
    businesses will tend to be greater than for larger scale entities
    such as industry, states or the nation. The relative importance of
    the risk will depend on the metrics used to describe the
    consequences (e.g., deaths vs. economic losses, down time vs. lost
    sales).

4.  Model accuracy requirements come from the way model results are used
    to make decisions. If model uncertainty is well characterized and
    included in the initial assessment, there is no *a priori*
    requirement for detailed modeling even with complex interacting
    systems. The value of more detailed modeling will be evident in the
    effect of model uncertainty on model results.

### 

### One of the key features of the Infrastructure Interdependencies Assessment process is the "quick- look" analysis. The quick-look analysis is based solely on easily obtained information and is used to identify potentially significant risks given what is known about the system (including uncertainties about the conditions or behavior of the system). A quick-look analysis provides the basis for decisions regarding the best or necessary actions by: identifying the obvious risks, highlighting areas that do not require further study, allowing rapid identification and implementation of mitigation and protection activities for easy to solve or immediate problems, minimizing unnecessary data collection and analyses, and providing justification and focus for more detailed analyses and data collection.

The first step in any analysis is problem definition and project
planning. Analysts, project managers system operators and decision
makers work together to define the problem and understand the system.
Based on past assessments, we have developed background information
questionnaires to elicit information that helps the project team:
understand the system components requirements and operations, specify
the purpose of the proposed system analysis, identify and rank the
consequences of concern, identify the information that is used to make
decisions and identify the information that can be used to construct the
assessment.

The initial data collection step includes filtering existing information
to obtain information and data that are pertinent to the defined system
analysis. These data generally include: the system location, operating
assumptions, input requirements, demands, back-ups, alternative
processes, planning, existing models and analyses, monitoring data,
historical data, standard operating procedures and practices, legal
constraints (e.g. regulations, permits), physical constraints and
financial constraints.

Once the initial data are collected and reviewed, a conceptual model of
the system is developed. In most cases, due to the complexity of the
interactions and potential feedback mechanisms, the conceptual model is
implemented in an analytical or numerical model. Specified boundary
conditions, initial conditions and changes in parameter values as a
function of time can be used to constrain the model using relevant
historical information. Comparisons with historical system behavior can
help verify the model, provide information on the uncertainty in model
output and indicate model limitations.

The analysis phase consists of summarizing and interpreting the results.
The analysis will identify conditions that may lead to system failures,
identify significant uncertainties (i.e. those cases where the decision
or consequence is uncertain due to the parameter or model uncertainty)
and other potential sources of information that could reduce the
uncertainty. If the analysis shows that additional modeling or
information is required to reduce uncertainty then another iteration may
begin.

The results of the analysis are summarized by describing the
vulnerabilities or potential consequences, their likelihood of
occurrence and the immediacy of the threat posed by the vulnerability or
consequence. Examples of hypothetical analyses results are shown in
Table 1. Since vital information can be lost if the consequences are
weighted by a probability and/or time factor, the results are presented
in a tabular format.

The first major decision point in the assessment is to determine if
there are significant risks, based on the results of the analysis.
Specifically, are the risks potentially significant given the
uncertainties? This step marks the end of the quick-look analysis, which
identifies potential problems (vulnerabilities, consequences, risks)
based on existing information.

The assessment proceeds if the risks identified in the analysis are
potentially significant and mitigation or uncertainty reduction is
considered. [Figure 2](#Figure_2) shows how those results can be grouped
in a 2 dimensional graph for prioritization of mitigation or protection
activities.

If further refinement of the estimated risks is required to make
decisions regarding the prioritization of mitigation and protection
activities, the existing, quick-look models can be used to evaluate the
sensitivity of the model results to parameter and model uncertainty.
This sensitivity can be used to define potential data collection
activities or model refinements that may significantly reduce the
uncertainty (see [Figure 1](#Figure_1)). All options and combinations of
options should be identified at this point and compared for their
relative value and likelihood of success in the next step. A
comprehensive evaluation of options is the key to optimizing the
assessment and mitigation process and minimizing costs.

### The identified mitigation, protection, data collection and modeling options should be compared for their relative effects, estimated cost (to implement and maintain), time to implement, time to take effect and the likelihood that the option will effectively reduce the uncertainty or consequences. Selecting the preferred option(s) is the second major decision point for the customer, who must decide what actions will be taken given the risks, the uncertainties in those risks and potential effectiveness of the identified options in mitigating those or reducing the uncertainty in those risks.

Implementing the mitigation or data collection options that were
selected may provide additional data, model results or system
modifications. At this point, the assessment model(s) can be revised to
account for the actions that were taken that reduce uncertainties or
alter the system behaviors. This begins the next iteration of the
assessment. Each of the risk assessment iterations is performed on a
better-characterized or modified system.

This process efficiently focuses analytical effort, data collection, and
mitigation by iteratively refining the analysis and taking actions until
the customer's risk objective is attained. Sandia has developed a set of
modeling tools to support this iterative process. The following sections
describe the capabilities and example applications of these tools.

## 

## Dynamic Simulation Modeling Tools

Infrastructure interconnections create chains of interdependencies that
can propagate disturbances across many infrastructures and over long
distances. Interdependencies may tend to propagate, amplify or dampen
these disturbances. System dynamics modeling is used to simulate the
interconnections between infrastructures, track the flow of commodities
necessary to maintain system operation and identify chains of
interdependencies, which could create unexpected vulnerabilities or
robustness. The screening process supported by these simulations also
provides the technical justification for additional data collection or
model resolution where the uncertainty regarding the risks makes
decisions difficult.

The interdependent modeling approach allows quantification of system
dynamics given existing information and projections of system operation
and supply requirements, evaluation of model and parameter
uncertainties, analysis of events of various magnitudes and duration and
the potential variation in the consequences for specific systems given
different event locations, environmental conditions, system location and
conditions and event response activities. Analyses supported by these
models include: identification of system limitations, limiting elements
or conditions, potential vulnerabilities, potential unintended
consequences of preventative, regulatory or other procedural system
changes, indicators of system manipulation, and economic impacts. We
have applied this process to a variety of systems operating in different
locations with different scales of influence. One example is an analysis
of the potential economic effects of energy supply conditions in
California.

### Dynamic systems models have been developed and parameterized to represent the supply and demand conditions in California for the period of 1999 through 2001 \[[1](#Ref_1)\]. Nominal projections of the demand conditions for the period between April and December of 2001 were made for a variety of potential environmental conditions. Analyses were conducted to identify the limiting factors and potential effects of energy policy on the costs of disruptions. Results of the simulations of California's infrastructure interactions under a range of environmental conditions indicate that regardless of weather conditions (hot and dry, normal, cool and wet) the current natural gas pipeline capacity coupled with limitations on generation capacity result in dwindling natural gas storage in the state. This result is consistent with observed trends in the volume of natural gas stored ([Figure 3](#Figure_2)). Since the modeled transactions were just beginning and there were few data for trend recognition, the model missed an opportunity to increase natural gas stores in 1999 that system operators did not miss. As a result the actual system has not reached the natural gas supply constraints that are shown in the model results for natural gas storage ([Figure 3](#Figure_2)). However, as can be seen in the graph of storage volume, California is approaching storage conditions (virtually no natural gas in storage) that will cause the natural gas pipeline delivery rates to constrain the maximum electric power generation rate. 

The limitations in generation capacity are more significant during more
extreme weather conditions that cause high demand and/or deplete water
stored in reservoirs used for hydro-electric power generation ([Figure
4](#Figure_4)). This result is corroborated by the behavior of the
system over the past two years with greater un-met peak demand in
summer. The summer of 2000 was hot and dry resulting in power outages
and numerous alerts while the relatively mild temperatures of 2001
result in as great a power shortage. The model results also show the
effects over time of dwindling power reserves. In 1999, relatively low
demand allows generation facilities to be regularly taken off line for
maintenance. Beginning in 2000 when the demand consistently approaches
the capacity limits, there is significantly less time for maintenance
and long periods where the system is running at maximum capacity.

The dynamic simulation model of California can also be used to evaluate
the relative effects of different policy options. One example is
evaluating the ability of an industrial system to meet demand under a
variety of policies when there are electric power shortages. The
simulation results can be used to evaluate the potential losses for an
industrial process when it is placed on the protected list, and is not
subjected to power outages during rolling brown-outs. The model can be
used to estimate how the losses may or may not be reduced under
different sets of conditions due to the industry's dependence on other
infrastructures and material flows that are subject to the power
outages. Protecting one industry can increases outages in unprotected
systems such as water supply, which could have the unintended
consequence of continued or even increasing losses to the protected
industry. It is important to compare the anticipated losses under both
policies to evaluate whether or not there are unanticipated interactions
between infrastructures that cause losses to continue despite the
mitigation or protection measure or, in the worst case, increase as a
result of the policy.

## Agent-Based Micro Economic Models

A second tool that has proven useful in the analysis of infrastructure
interdependencies is agent-based modeling. An agent is a model of a real
world decision maker. It is a self-contained piece of code that uses a
genetic algorithm to learn how to interact with other agents in order to
maximize its utility. Agent-based models typically consist of many
dispersed agents acting in parallel without a global controller
responsible for the behavior of all. The actions of each agent depend
upon the states and actions of a limited number of other agents, and the
overall direction of the system is determined by competition and
coordination subject to the system's defined constraints. The complexity
of the system arises more from interactions occurring between agents
than from any complexity inherent in an individual agent. Agent-based
modeling provides a means for understanding properties of complex social
systems and offers a new way of experimenting with, and theorizing
about, dynamic economic systems. Agent-based computer modeling
techniques have been applied to many examples of human social phenomena,
including trade, migration, group formation, combat, interaction with an
environment, transmission of culture, propagation of disease, and
population dynamics \[[2](#Ref_2)\].

SNL's agent-based tools focus on economic interactions between decision
makers in infrastructure networks. Aspen is a parallel agent based model
of the U.S. banking and industrial sectors \[[3](#Ref_3),[4](#Ref_4)\].
Aspen-EE builds on the Aspen model but is focused on the impact of
electric power market structures and power outages on other
infrastructures in the economy \[[5](#Ref_5)\]. Agents in Aspen-EE
represent the producers of electricity (generation companies), the
market structures that control the production of electricity
(independent system operators), and a supplier of electric utility
requirements (fuel company) in a restructured environment. The models
utilize agent-based Monte-Carlo simulation, in which individual agents
in the model represent real-life decision-makers. Macroeconomics
quantities of interest are then generated via the aggregation of the
agents' microeconomic actions.

Agents in the models utilize an adaptive learning techniques to develop
pricing and purchasing strategies. Traditional social science models are
based upon a rational choice paradigm as in game theory. In agent based
models behavioral algorithms can be developed that more closely simulate
imperfect or more \"human\" decision making. Developing the behavioral
algorithms for individual agents in a multi-agent model is one of the
challenges of producing useful models of social behavior. An alternative
to the assumption of rational choice in social models may be some form
of adaptive learning either at the individual or at the population level
through differential survival of the fittest. Simulation is often the
only way to examine the outcome of agent systems that are adaptive
rather than fully rational.

Aspen-EE was used to analyze the economic behavior of players in
short-term electric power markets. Some of the most economically
interesting observations are gathered from an examination of simulations
that involved multiple markets. For a two market system where neither is
under a price cap, both markets share similar patterns over time in the
outcome of their value of the market clearing price (MCP). Buyers and
sellers of power face identical rules in determining their price bids.
In a second example when one market has a price cap and the other does
not, both markets show similar patterns as in the no cap case except for
those rare occasions when the demand is high. In these cases, prices in
the uncapped market are nearly identical to the previous example, but
prices in the capped market only reach the cap. In a final example when
both markets have identical price caps, there is a very different
result. The MCP is appreciably higher under price cap rules than it was
without the price cap, with the notable exception of those times when
price spikes occurred in conjunction with high demand when the market
had no price cap. These exceptions are offset by a consistent increase
in prices under the price cap, regularly running 6 to 7 percent higher
than the MCP without the price cap ([Figure 5](#Figure_5)). This
behavior on the part of both markets is consistent with expected
economic behavior. There is natural trend of these two markets to move
towards a similar price given their identical price caps.

Aspen-EE simulation results for sample power-market scenarios indicate
how agent based simulation can be applied to examine the economic costs
of policy decisions, like price caps, on the short-term trading of
electric power. The Aspen-EE simulation considers the business
constraints on generation companies and Independent System
Operators---unlike other models for the electric utility industry that
focus on the physical system. Aspen-EE power markets also feature a
gaming capability, not commonly found in other utility models, that
permits us to look behind the scenes and discover how individual
generation companies can use their pricing knowledge to their own
economic advantage, including possible collusive behavior.

# 

# Acknowledgements

The infrastructure simulation and analysis tools presented in this paper
are now part of the National Infrastructure Analysis and Simulation
Center (NISAC), a virtual center that provides access to the expertise
and modeling capabilities at Sandia National Laboratories and Los Alamos
National Laboratory. Sandia National Laboratories funded initial
development of the risk assessment process, dynamic simulation and
agent-based modeling tools presented in this paper. However, the process
is based on work funded by the Nuclear Regulatory Commission to develop
a risk-based decision methodology for license termination. The
Department of Energy's Office of Critical Infrastructure Protection
funded adaptation and refinement of the dynamic simulation model for the
California analysis. Additional model modifications and analyses are
underway for DOE's Office of Emergency Operations.

# References

[]{#Ref_1 .anchor}\[1\] Brown, T. and W. Beyeler. *Analysis of the
Potential Economic Impacts of Electric Power Outages in California,*
Sandia National Laboratories, Project Report to DOE/OCIP, Albuquerque
NM, SAND 2001-3368P, 2001, 32 pp.

[]{#Ref_2 .anchor}\[2\] Epstein, J. and R. Axtell. *Growing Artificial
Societies: Social Science from the Bottom Up*, The MIT Press, 1996, 208
pp.

[]{#Ref_3 .anchor}\[3\] Pryor, R.J., N. Basu and T. Quint*. Development
of Aspen: A mircroanalytic simulation model of the U.S. economy*, SAND
Report 96-0434, 1996, 9 pp.

[]{#Ref_4 .anchor}\[4\] Basu, N., Pryor, R.J., and Quint, T. *Aspen - A
microsimulation model of the economy*, SAND Report 96-1225A, 1996, 20
pp.

\[[]{#Ref_5 .anchor}5\] Barton, D.C., Eidson, E.D., Schoenwald, D.A.,
Stamber, K.L., and Reinert, R.K., *Aspen-EE: An agent based model of
infrastructure interdependency*, SAND Report 2000-2925, 2000, 61 pp.

# 

# Tables 

  ----------------------- -------------- ------------------- -------------- -------------
  Vulnerability Class     Potential      Potential Costs     Likelihood of  Time to
                          Consequences                       Exploitation / Exploit /
                                                             Failure        Immediacy

                                                                             

  Infrastructure          System outage  25M/outage + 25 M   high           immediate
  Dependency              hrs - days     /day                               threat
  Electricity/no backup                                                     (weather
                                                                            related)

  Infrastructure          Loss of        0.01-25M/outage +   low - moderate long-term
  Interdependency         cooling for    25 M /day                          drought,
  Water-Electricity       computer                                          moderate to
  primary and backup      systems -                                         long-term
  water supplies require  damage if not                                     major
  power                   shut down,                                        electric
                          system outage                                     power outage
                          hours - days                                      
  ----------------------- -------------- ------------------- -------------- -------------

Table 1: Examples of Analysis Results -- Potential Vulnerabilities,
Consequences, Immediacy and Likelihood of Exploitation

# Figure Captions

Figure 1: Risk-Based Infrastructure Interdependency Assessment Process

Figure 2: Example Analysis Results -- Ranking Vulnerabilities by
Consequence, Immediacy of Threat and Relative Likelihood

Figure 3: Calculated and Historical Natural Gas in Storage

Figure 4: Example Results of a Dynamic Simulation Assessment of Power
Supply and Demand for California

Figure 5: Example Agent-Based Economic Policy Modeling Results

# Figures

![](media/image1.wmf)[]{#Figure_1 .anchor}

![](media/image2.wmf){width="6.834027777777778in"
height="3.9583333333333335in"}[]{#Figure_2 .anchor}

![](media/image3.wmf){width="6.813194444444444in"
height="3.9375in"}[]{#Figure_4 .anchor}

[]{#Figure_5 .anchor}![](media/image1.wmf)

[^1]: ^\*^ Sandia is a mulitprogram laboratory operated by Sandia
    Corporation, a Lockheed Martin Company, for the United States
    Department of Energy under Contract DE-AC04-94AL8500