# An Improved Decision Support Method for Resilience Assessment Based on Multi-Viewpoint Modeling and Functional Analysis of Interconnected Systems

Blazho Nastov, Daouda Kamissoko, Vincent Chapurlat

► To cite this version:

Blazho Nastov, Daouda Kamissoko, Vincent Chapurlat. An Improved Decision Support Method for Resilience Assessment Based on Multi-Viewpoint Modeling and Functional Analysis of Interconnected Systems. International Journal of Decision Support System Technology, 2021, 13 (3), pp.54-70.
10.4018/IJDSST.2021070104 . hal-03274401

HAL Id: hal-03274401

https://imt-mines-ales.hal.science/hal-03274401

Submitted on 2 Jul 2021

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# An Improved Decision Support Method for Resilience Assessment Based on Multi-Viewpoint Modeling and Functional Analysis of Interconnected Systems

Blazho Nastov, Axellience, France

Daouda Kamisoko, IMT Mines Albi, France

Vincent Chapurlat, IMT Mines Alès, France

## ABSTRACT

Critical infrastructures provide services that are essential to the functioning and well-being of society. Failure to provide these services is unacceptable. This is a problem when considering the unpredictable nature of the environment (leading to crisis, natural disasters, terrorist attacks) and internal failures. The concern is even greater due to the interconnected and interdependent nature of critical infrastructures, which might lead to failure propagation, causing domino and cascade effect

s. The resilience of a system is the ability to reduce the magnitude and/or duration of disruptive events

or their consequences, allowing a satisfactory level of performance and quality of services. Improving critical infrastructures' resilience before any disruption occurs can reassure society's vital needs. The goal of the paper is to define an improved decision support method for resilience by combining resilience assessment and multi-viewpoint modeling methods.

## KEYWORDS

Criteria, Critical Infrastructure, Decision, Functionality Evaluation, Resilience, Resilience Assessment, Simulation, System, Systems Engineering

## 1. INTRODUCTION

The mutual exchange of services of various interconnected and interdependent critical infrastructures, such as healthcare, energy, transport, manufacturing, financial, etc., is essential to the functioning and well-being of modern society (Maier, 2009; Mattsson & Jenelius, 2015). These services must be maintained to a satisfactory level even under threats and disruptive events. The latter becomes significantly more difficult when considering the interconnected nature of critical infrastructures.

Failure to provide services can lead to domino and cascade effect that impacts on other infrastructure s related to the initially affected one (Ouyang et al., 2012). Interconnected systems are therefore by definition less resilient to disruptions (Johanson, 2010). This thesis is confirmed, for instance, by the largest blackout in history that affected more than 600 million people in India in July 2012. Through
a cascade effect, several other systems (transport, telecommunications, finance) also failed (Lai et al., 2013; Romero, 2012). Other examples are the growing number of hurricanes such as Sandy, Isabel, Harvey and Irma, that provoked not only human and material damage but also economic and production/service capacity failures (Saleh et al., 2017).

The notion of resilience is here-defined as “the capacity of a system(s) to recover, in a minimum time, with minimum costs (financial, human, workload, etc.) a certain functioning capacity on all dimensions of its performances”. Note that resilience is related to functioning and can be assessed by analyzing the functioning of systems during the following situations: (a) before a disruptive event, (b) during a disruptive event and (c) after a disruptive event. Improving systems resilience before any disruption occurs can reassure society’s vital needs.

Current resilience assessment approaches are oriented towards individual systems (Pursiainen, 2018), whether they be financial, healthcare or transport systems. These approaches are therefore inflexible (difficult to adapt to other domains), with fixed criteria, mainly performance (other criteria that might be important in the assessment of resilience are overlooked) and not applicable in the context of interconnected systems. This problem is addressed by methods specifically designed for interconnected systems. For instance Kamissoko et al. (2018) introduce a method for “continuous and multidimensional assessment of resilience based on functionality analysis for interconnected systems”. This method provides the means to define functional analysis of interconnected systems, that is linked to some aspects of resilience. The functional analysis is further used to assess resilience, based on several criteria. The proposed generic criteria are easily extendable and adaptable depending on the context and needs. The originality of the method is defined by the authors as: (1) the combination of functional-analysis and continuous resilience assessment following several dimensions of critical infrastructures, (2) the flexibility of criteria metrics for easy adaptation in different contexts and (3) the possibility to aggregate the results of several functionality-analysis models with continuous assessment of the resilience of interconnected systems. The limit of this proposal, however, is in the modeling of interconnected systems and functional analysis. Several core concepts related to the modeling of complex systems (ISO/IEC 15288, 2008) are overlooked (e.g., physical and contextual modeling, influence and dependency modeling, behavioral and functional architecture, etc.). Indeed, an improved modeling (1) eases engineers’ design and analysis work, (2) provides to stakeholders a better understanding of systems, and (3) helps stakeholders to make decisions with confidence and to argument decisions based on both, models and analyses.

The design and engineering of complex systems is the main topic of interest of the multi-disciplinary and collaborative method Systems Engineering (SE) (BKCASE Editorial Board, 2017). SE promotes modeling principles known as Model-Based Systems Engineering (MBSE) (INCOSE, 2008). MBSE is defined as “the formalized application of modeling to support system requirements, design, analysis, verification and validation activities beginning in the conceptual design phase and continuing throughout development and later life cycle phases” (INCOSE, 2007). The MBSE modeling principles are applicable and adaptable in the context of modeling interconnected and interdependent critical infrastructures for resilience assessment quoted above and defined in (Kamissoko et al., 2018). The benefits of such adaptation are twofold and mutual. On the one hand, having a standardized modeling methodology ISO/IEC 15288 (ISO/IEC 15288, 2008) to design some aspects of a model for resilience assessment. On the other hand, the resilience assessment methodology might complete the verification and validation activities natively promoted by the MBSE such as for instance but not limited to, resilience-related requirement verification, but also, safety, quality, sustainability, flexibility-related requirement verification. Indeed, the resilience of systems impacts on several non-functional properties, i.e., “-ilities” (Weck et al., 2012).

This article revisits the Kamissoko et al., (2018) method (Kamissoko et al., 2018) for continuous and multidimensional assessment of resilience based on functionality analysis for interconnected systems. The goal is to define an improved decision support method for resilience combining the benefits of the initial approach for continuous resilience assessment and the basic principles of the
MBSE for modeling interconnected and complex systems based on multiple views. The result is in the form of a multi-viewpoint modeling and resilience assessment platform. The platform is based on 8 views: Territory, Systems, Physical, Organic, Functional, Logical, Criteria Description and Criteria Evolution. The first six views are used to improve scalability of the initial method for the design of complex systems by applying the MBSE principles. The last two views (Criteria Description and Evolution) are used to reassure the integration of initial approach for continuous resilience assessment.

The article is organized as follows: The next section reviews the literature on the definition of resilience, resilience assessment and systems engineering. The contribution is presented and illustrated by a simple case study in the third section, before concluding in the last section by an evaluation of the limits and perspectives of the research work.

## 2. LITERATURE REVIEW

The term resilience comes from the Latin word “Resiliere” meaning “bounce back” (Lenort et al., 2014). The initial and commonly accepted meaning of this term comes from the domain of metallurgy and describes the ability of a piece of metal to return to its initial shape after a thermic or physical deformation (Anaut, 2005). Currently, there isn’t any consensus and the term slightly varies from one definition to another (Hosseini et al., 2016). In general, the concept of resilience is related to three common concepts: (1) a system, (2) its performance (i.e., the ability of a system to fulfill its missions) and (3) a disruptive event. The correlation between the definitions can be summarized into a function that indicates the acceptable performance and quality of service before, during and after a disruptive event. Looking for a consensual position, the following definition is proposed: “the ability of a system [or a network of systems] to reduce the magnitude and/or duration of disruptive events or their consequences allowing a quick return to a satisfactory level of performance and quality of service”. A satisfactory level of performance and quality of service is defined by the stakeholders involved in the operation and organization of the system. Resilience includes measures to prepare for, prevent, absorb, adapt (respond to) and recover quickly from foreseeable risks; and capabilities to manage unforeseen potentially disruptive event”.

Within the context of interconnected and interdependent systems, it is important to consider the dependencies to other systems or to their environment and its constraints. According to (Kamissoko, 2013), a dependency is a circulation of flow (material or immaterial - information) between systems and their components (i.e., an exchange of services and information between systems). The term influence is used in situations where there is no flow circulation. Considering the exchange of services as a set of required services (so that a system can function) and a set of provided services (the result of the functioning of a system), note that, whenever the performance of one system decreases, all systems that are dependent on this system can be directly impacted. Dependency cycles are also possible and the performance of the system is then likely to decrease further, impacting other systems and consequently forming a domino effect that eventually reaches all systems as well as the environment they belong to (Kamissoko et al., 2018). Resilience is a key property that can help prevent domino and cascade effect situations from happening. Stakeholders must therefore first be able to determine the resilience level of systems and then make the right decisions to improve it. For this purpose, resilience assessment methods are needed.

There are two main approaches to assess the resilience of a system: the quantitative and the qualitative approach (Hosseini et al., 2016). The quantitative approach is based on formal and numerical methods to provide quantitative end-value. The qualitative approach relies on more abstract methods to provide qualitative end-results. A classification of resilience assessment methods is proposed by (Hosseini et al., 2016).

Resilience assessment through big data analysis consists of extracting real-time information from different sources and in processing the information to determine resilience. For instance, during Hurricane Sandy, over 20 million tweets were posted (Barker et al., 2017), embedding information
that could be extracted and exploited. Resilience is assessed by means of data monitoring (Garcia
et al., 2012), data visualisation (Capitole. Khan et al., 2013), data mining (Chan & Wong, 2007),
statistical models (Campbell-Sills et al., 2006), machine learning (Zhang et al., 2018), natural language
and crowdsourcing (Mejri et al., 2017). Data analytics are hence centered around three perspectives:
descriptive, predictive and prescriptive (Barker et al., 2017).

Resilience assessment through expertise involves human resources. Experts determine different criteria and alternatives to quantify the situation and assess each decision for each criterion based mainly on a standardized methodology (Taysom & Crilly, 2017). For instance, the 3S indicator validation methodology helps identify criteria (Cloquell-Ballester et al., 2006). Desk and internal review validation identify criteria under some conditions of operability, value relevance, reliability, measurability, non-redundancy, decomposability, preferential independence, intelligibility, comprehensiveness, completeness, and data availability. Multiple-source studies allow the impact of decisions on criteria assessment to be evaluated (Roth et al., 2009). In (Cutter et al., 2008), this approach is used to assess community resilience in its ecological, social, economic, institutional and infrastructure dimensions.

Resilience assessment through simulation is based on a functional model of systems by plotting and analyzing the evolution of different criteria (e.g., a performance, safety or security curve) in various situations (i.e., before, during and after a disruption). Resilience is assessed by comparing the state of the system according to a specific criterion before and after a disruption (Hosseini et al., 2016). Examples of such approaches are introduced in ( ). However, these approaches are mainly oriented for a single system, narrowing their criteria metrics, limiting flexibility and adaptation to other contexts, and overlooking the interconnected nature of systems (Kamissoko et al., 2018). For example, they provide an assessment based on a single criterion (i.e., mainly performance), tidying the result to one particular aspect [40, 42]. This creates a lack of consideration of criteria for all resilience capabilities: absorptive, adaptive, restorative [42, 43]. A method for continuous and multidimensional assessment of resilience based on functionality analysis for interconnected systems is introduced in (Kamissoko et al., 2018). This method provides the means to define functional analysis of interconnected systems, that is linked to several aspects of resilience. The functional analysis is further used to assess resilience, based on several criteria. The proposed generic criteria are easily extendable and adaptable depending on the context and needs. The limit, however, is in the modeling of interconnected systems and functional analysis. Several core concepts related to the modeling of complex systems are overlooked (e.g., physical and contextual modeling, influence and dependency modeling, behavioral and functional architecture, etc.). Indeed, an improved modeling eases engineers’ design and analysis work and provides to stakeholders a better understanding of the system, and helps to make decisions with confidence and to argument decisions based on both, models of a system and resilience assessment results.

The design and engineering of complex systems is the main topic of interest of the multi-
disciplinary and collaborative method Systems Engineering (SE) (BKCASE Editorial Board, 2017).
According to the Le Moigne's general system theory (Le Moigne, 1999) the modeling of a complex
system is carried out through three interdependent aspects: (1) functional, (2) structural and (3)
behavioral. The functional aspect describes what the system must do in its environment, system's
purpose, missions and objectives. It is used to respond to the question: "What is the system for? The
structural aspect define the structure of a complex system. It is used to respond to the question "What
is this system made of? The used resources? How is it structured to fulfill its mission (in its evolving
environment)?". The behavioral aspect describes the way a complex system has to, or must, behave.
It responds to the question: "How does a system evolves in time from one state to another? Are the
conditions satisfied so that a system reaches a certain state?

Le Moigne's general system theory (Le Moigne, 1999) pave the way for the Model-Based Systems Engineering (MBSE) principles (INCOSE, 2008) defined as "the formalized application of modeling to support system requirements, design, analysis, verification and validation activities beginning in
the conceptual design phase and continuing throughout development and later life cycle phases” (INCOSE, 2007). MBSE is standardized by the ISO/IEC 15288 standard (ISO/IEC 15288, 2008) that refines the above three main aspects (functional, structural and behavioral) into six viewpoints: 1) System, 2) Requirements, 3) Functional, 4) Logical, 5) Physical and 6) Organic viewpoint. The system viewpoint is used to define the main characteristics of a system (i.e., the mission, purpose, objectives and other characteristics), the frontier with the environment, various operational contexts,

requested and provided services, input and output flows, interfaces and physical links. The requirements viewpoint is used to define requirements, to understand stakeholder’s expectations, constraints and roles, and to assist along the whole design process. The functional viewpoint defines the functional architecture of a system. It is used to define how a system achieve its mission by transforming input flows into output flows, i.e., how do functions are dynamically arranged, their execution sequencing and how conditions for control or data-flow are taken into consideration to satisfy the requirements baseline. The logical viewpoint defines the logical architecture of a system. It highlights variations of arrangements of functions and sub-functions from a functional architecture, and their internal and external interfaces (ISO/IEC 15288, 2008). In other words, it shows how functions are logically associated, for instance, by regrouping their input and output flows to optimize their future allocation to physical components. The physical viewpoint defines the physical architecture of a system. A physical architecture specifies the arrangement of physical elements (physical components and interfaces) to provide a design solution for a product, service, or enterprise, that satisfies one of the proposed logical architectures and respects the requirements (ISO/IEC 15288, 2008). The organic viewpoint defines the organic architecture that is similar and thus often confused with the physical architecture. The organic architecture highlights technical and configured components representing the final product put in an operational context.

## 3. PROPOSAL FOR IMPROVED DECISION SUPPORT FOR RESILIENCE

This section revisits the approach for continuous and multidimensional assessment of resilience based on functionality analysis for interconnected systems introduced in (Kamissoko et al., 2018). The goal is to define an improved decision support method for resilience combining the benefits of the initial approach for continuous resilience assessment and the basic principles of the MBSE for modeling interconnected and complex systems based on multiple views. This section is divided into two parts. The first part revisits the functional analysis model (i.e., functionality evaluation model) for resilience assessment of interconnected systems introduced in (Kamissoko et al., 2018). The aim is to adapt the principles of the MBSE for a multi-viewpoint modeling of critical infrastructures, including among others, a functional and behavioral architecture similar to the one in the functionality evaluation model. The second part revisits the resilience assessment formulas introduced in (Kamissoko et al., 2018). The goal is to relate the modeling activities with the assessment activities. A simple case study illustrates the new multi-viewpoint modeling and the assessment approach.

### 3.1 Modeling Interconnected Systems

The functionality evaluation conceptual model (see Figure 1) is based on five main concepts: Territory, System, Component, Criterion and Function. Component is a part of the system. The criteria assigned to a Component characterise the Component at a low level and depend on its type and functions within the Territory. The criteria of several Components are aggregated at a higher level to assess those of the System. System is a critical infrastructure that operates in the territory and is composed of several components. The higher-level criteria of several systems are aggregated to assess those of the Territory. Territory is a portion of geographical space that coincides with the spatial extension of a government’s jurisdiction (Gottmann, 1975). A territory can host several systems. The relations between systems might be functional or non-functional. Functional relations allow the circulation of flows. Non-functional relations refer to influence relations described in (Kamissoko, 2013). A
criterion is a characteristic of a component defined by a value and a unit. Criteria and Systems are composable. An evolution function defines the evolution of a criterion, i.e., the change in value over time. The aggregation function, as its name suggests, aggregates the values of at least two criteria. The influence function determines how a given criterion/system changes another one under specified conditions. Note that feared events and flows are also instances of the concept System.

The functionality evaluation model defines multiple aspects of a system (contextual, physical, functional or behavioral) into one viewpoint. This is a problem when considering large scale complex systems (i.e., due to a considerable number of components and subcomponents, complex, unpredictable and emergent behavior). Managing complex system design is indeed the underlying principle of the MBSE. For this, the ISO/IEC 15288 standard (ISO/IEC 15288, 2008) proposes six viewpoints: System, Requirements, Functional, Logical, Physical and Organic viewpoint. The management of these views is provided through modeling languages, such as for example, the Physical Block Diagram (Long, 2007) for the design of a physical view or the Functional Flow Block Diagram for the design of a functional view (Nastov et al., 2015).

The goal of this paper is to resolve the scalability problem of the Kamissoko et al. (2018) model (Kamissoko et al., 2018) detailed above, by introducing a new multi-viewpoint representation. Indeed, complexity can be managed by separating the design of systems across multiple viewpoints. Each view is designed for specific objectives of the initial methodology (Kamissoko et al., 2018) and follows the MBSE principles as introduced in (ISO/IEC 15288, 2008). These objectives are translated as means to define: (1) the territory with its constraints and critical infrastructures (systems), (2) the dependencies and interconnections between systems (3) the physical and organic architecture of systems, (4) the functional and logical architecture of systems, (5) the criteria of components, systems and the territory, and (6) the evolution of criteria over time, criteria influence and criteria aggregation.

Table 1 synthesizes the views of the new multi-viewpoint modeling approach. Each view separately discussed hereafter.

The MBSE system view provides the means to model a system with several macro characteristics: requested services (i.e., services that are needed so that the system can assure its mission), provided services (i.e., as a result of the functioning), physical interfaces and links, and the frontier systems. The relationship with frontier systems defines the environment seen from the perspective of a given system. The initial methodology highlights the need for modeling a territory (i.e., an environment) as a whole (in opposition to a focused view from the perspective of a given system). Furthermore, a territory is a set of interconnected systems among which multiple systems are in the center of interest for the study and other are purely for informative reasons considered as frontier systems. This is

<table><caption>Table 1. The new multi-viewpoint modeling approach for resilience assessment</caption><thead><tr><td>View</td><td>Objectives</td></tr></thead><tbody><tr><td>Territory</td><td>Defines territories (their characteristics and constraints) and the hosted critical infrastructures (Objective 1)</td></tr><tr><td>Systems</td><td>Defines interdependencies between systems (Objective 2)</td></tr><tr><td>Physical</td><td>Defines the physical architecture of a system (Objective 3)</td></tr><tr><td>Organic</td><td>Defines the organic architecture of a system (Objective 3)</td></tr><tr><td>Functional</td><td>Defines the functional architecture of a system (Objective 4)</td></tr><tr><td>Logical</td><td>Defines the logical architecture of a system (Objective 4)</td></tr><tr><td>Criteria Description</td><td>Defines criteria of components, systems or territories, criteria influence and criteria aggregation (Objective 5)</td></tr><tr><td>Criteria Evolution</td><td>Defines criteria evolution and influence over time (Objective 6)</td></tr></tbody></table>
illustrated in the conceptual model (see Figure 1) with the “host-isHosted” relationship between the concepts Territory and System. For this purpose, a new diagram named “Territory Diagram” is defined based on the conceptual model of Figure 1. The Territory Diagram is used to design territories and systems that are hosted in different territories (see the left side of Figure 2).

For illustrative purposes, a simple case study is proposed, composed of two territories (B13 and B33), and four interconnected systems (the motorway and signalization systems B13-B33, the coal power plant CPP2 and the coal mine CM15). The B13 Territory hosts the CPP2 coal power plant, the B33 territory hosts the CM15 coal mine, and both territories jointly host the B13-B33 motorway and signalization systems. For more indicative representation, a second version of the same diagram is proposed based on a simplified geographic information system (GIS) as shown by the right side of Figure 2.

The interconnected nature of systems is defined through “required and provided” services and flows (relationship “relatedTo-relatedFrom” in the conceptual model of Figure 1). For the design and representation of interconnections and interdependencies between systems, a new diagram named “System Interconnections Diagram” (see Figure 3) is defined based on the conceptual model of Figure 1.

The interconnections and interdependencies are illustrated in the case study as follows. The excavated coal from the CM15 mine is transported by tracks through the CM15 motorway into the CPP2 coal power plant. CPP2 uses the coal to produce electricity. The B13-C33 motorway signalization system uses the produced electricity from CPP2 to reassure its performance and the safety of the motorway B13-C33. For illustrative purposes, it is considered that the coal resupply of CPP2 depends on the functioning and safety of the motorway B13-C33. Note that the CM15 coal mine is a frontier system (colored in green). The criteria (e.g., transported coal, produced electricity, road safety, etc.) is discussed in the second part of this section.

The MBSE physical and organic views are used for modeling each system individually as a set of components and subcomponents. These viewpoints allow the design of a physical architecture of a

<figure><img src="image_2.png" /><figcaption>Figure 1. The functionality evaluation conceptual model introduced in (Kamissoko et al., 2018).</figcaption></figure>
<figure><img src="image_3.png" /><figcaption>Figure 3. An example of a model created by using the Systems Interconnections Diagram</figcaption></figure>

<figure><img src="image_4.png" /></figure>

system, i.e., the arrangement of components to provide a design solution for a system and the organic architecture, i.e., the configuration of components representing the final product put in an operational context. The adaptation of both physical and organic views is possible without creating specific diagrams. Indeed, both physical and organic views conform to and are aligned with the objectives of the initial methodology. They provide a more in-depth representation of systems and components than initially introduced in (Kamissoko et al., 2018). In this sense, the physical and organic views are considered as an improvement to the initial methodology. Existing modeling languages can be used for the design and representation of physical and organic views. The UML Component Diagram (OMG, 2011) is here-proposed as a technical solution. Other modeling languages such as the Physical Block Diagram (Long, 2007) or the SysML' Structure Diagrams (OMG, 2015) can also be used.

Figure 4 shows the physical views of the CPP2 coal power plant. For the sake of simplicity and due to lack of space, only one physical view is shown here. This view defines the components (i.e., Furnace, Boiler, Steam Turbine, Generator and Transformer) and the required / provides services and flows of each component (e.g., a steam turbine component requires a high-pressure steam to produce a mechanical energy).
<figure><img src="image_5.png" /><figcaption>Figure 4. An example of a Physical view of a coal power plant</figcaption></figure>

The organic view defines the configuration of components. Figure 5 shows the organic views of the CPP2 coal power plant. For the sake of simplicity and due to lack of space, only one organic view is shown here. The CPP2 coal power plant has two cores composed of two steam turbines (i.e., ST1 and ST2), such that, each one has a dedicated boiler (e.g., B1 and B2) for steam production and produces mechanical energy for a separate generator (i.e., G1 and G2). Note that, the physical and organic architectures are decomposable. This is useful for complexity management (e.g., when considering complex systems with numerous components). For instance, the Furnace component (see Figure 4) can be decomposed separately in a new dedicated diagram.

The MBSE functional view defines the functional architecture of a system. It is used to define how a system achieve its mission by transforming input flows into output flows, i.e., how do functions are dynamically arranged, their execution sequencing and how conditions for control or data-flow are taken into consideration to satisfy the requirements baseline. Note that, a functional architecture is designed considering the physical limits of an environment or a system. The adaptation of the MBSE functional views is also possible without creating specific diagrams. Indeed, a functional view is complementary to the objectives of the Kamissoko et al. methodology. A functional view can provide an improved understanding of the functioning of systems and is therefore considered as an improvement to the initial methodology. Existing modeling languages can be used for the design and representation of a functional view. The Business Process Model and Notation (BPMN) (Aguilar-Saven, 2004) is here-proposed as a technical solution. Other modeling languages such as the Functional Flow Block Diagram (Nastov et al., 2015) can also be used.

Figure 6 shows the functional architecture of a coal power plant. For the sake of simplicity, the functional architectures of the other systems are not shown in this article. The furnace, boiler, steam turbine, generator and transformer, operate in parallel (i.e., control flow) by consuming and producing resources such as water, steam, mechanical energy or electrical energy (i.e., data-flow). This example conforms to the physical limits defined in the territory, system and physical views (see Figure 2, 5, 6 and 7). Functional decomposition is also possible.

The MBSE logical viewpoint defines the logical architecture of a system by highlighting variations of arrangements of functions and sub-functions from a functional architecture, and their internal and external interfaces (ISO/IEC 15288, 2008). A logical architecture shows how functions are logically associated, for instance, by regrouping their input and output flows to optimize their future allocation to physical components. Similarly, the adaptation of the MBSE logical view is also possible without creating specific diagrams because the logical view is complementary to the objectives of the initial methodology. A logical view provides an improved understanding of the arrangements of functions and sub-functions and is therefore considered as an improvement to the initial methodology. Existing modeling languages can be used for the design and representation of a logical view. The Business Process Model and Notation (BPMN) (Aguilar-Saven, 2004) is here-proposed as a technical solution.
Other modeling languages such as the Functional Flow Block Diagram (Nastov et al., 2015) can also be used.

Figure 7 shows the logical architecture of the CPP2 coal power plant conforming to the functional architecture illustrated in Figure 6 and the organic architecture shown in Figure 5. For the sake of simplicity, the logical architecture of the other systems is not shown in this article. The organic architecture illustrated in Figure 5 defines a two-core redundant coal power plant. Consequently, the logical architecture defines the functions of both cores.

<figure><img src="image_6.png" /><figcaption>Figure 6. An example of a Functional view of a coal power plant</figcaption></figure>

<figure><img src="image_7.png" /></figure>
<figure><img src="image_8.png" /><figcaption>Figure 7. An example of a Logical view of the CPP2 coal power plant</figcaption></figure>

Assessing Resilience of Interconnected Systems

This part of the section revisits the resilience assessment rules and criteria design, evolution and
influence, initially introduced in (Kamissoko et al., 2018). The goal is to define new views for an
improved and eased design of criteria, criteria evolution, influence and aggregation. The created
models must conform to the initial assessment rules such that it can be used directly as an input in the
process of continuous resilience assessment. Note that, within the context of the initial methodology,
the resilience assessment and criteria design, influence and aggregation are tightly coupled and must
be here-considered as such.

According to (Kamissoko et al., 2018), a criterion is a characteristic of a component defined by
a value and a unit. To consider uncertainty, in normal functioning, a criterion value is comprised
between a minimal (f<sub>min</sub><sup>n</sup>) and a maximal (f<sub>max</sub><sup>n</sup>) value. The value of a criterion must not be outside
the limits f<sub>min</sub> and f<sub>max</sub>. Criteria and Systems are composable. An evolution function defines the
evolution of a criterion, i.e., the change in value over time. The aggregation function, as its name suggests, aggregates the values of at least two criteria. The influence function determines how a given criterion/system changes another one under specified conditions. The criteria, influences and aggregations are defined mathematically forming the functionality evaluation model using the Obeo Designer platform (https://www.obeodesigner.com). This model is further transformed into the GAMA simulation platform (https://gama-platform.github.io/) for a continuous resilience assessment. The resilience assessment approach is based on ten rules illustrated in Table 2.

The Criteria Description View is here-proposed for the design of criteria, (i.e., to define the characteristics of a component, system or a territory), criteria influence and aggregation as suggested above. The Criteria Diagram represents criteria at three different granularity levels: (1) component level, (2) system level and (3) territory level. A criteria influence is defined either at the same granularity level (i.e., inner-level dependencies) or between levels (i.e., intra-level dependencies). In addition, an influence can concern the owning component, system or territory (i.e., inner-component, inner-system or inner-territory dependencies) or other component, system or territory (i.e., intra-component, intra-system or intra-territory influences). For example, at the bottom side of Figure 8, two criteria are defined for the F1 furnace component: Coal and Water, and two influences: C2W and C2AC. The Water criterion represents the temperature of the water in the Furnace, and the Coal represents the quantity of coal available to produce thermal energy for water heating. The C2W is an inner-level and inner-component influence representing a thermal exchange between the coal in the furnace and the water in the furnace's water pipes. The C2AC is intra-level and inner-system influence represent the coal supply function from the coal stock to the furnace. In addition to influence, criteria can be aggregated at a higher level. For example, the Produced Electricity criterion (see top right

<table><caption>**Table 2. Synthesis of the Kamissoko et al., (2018) rules for resilience assessment based on a functionality evaluation model (Kamissoko et al., 2018).**</caption><thead><tr><th>#</th><th>Rule definition</th></tr></thead><tbody><tr><td>1</td><td>"Several elementary independent criteria that characterize a system can be used to define a Functionality Evaluation Model as a parameter to assess a particular aspect of the resilience of this system."</td></tr><tr><td>2</td><td>"A Functionality Evaluation Model must consider the objectives and constraints of the Territory."</td></tr><tr><td>3</td><td>"The value of the assessed resilience is between 0 (not resilient at all) and 1 (fully resilient)."</td></tr><tr><td>4</td><td>"The value of assessed resilience of a system depends on the value of each criterion aggregated into the model."</td></tr><tr><td>5</td><td>"Based on the Functionality Evaluation Model, the value of a given criterion must not be greater than certain values."</td></tr><tr><td>6</td><td>"Based on the Functionality Evaluation Model, the value of a given criterion must be between certain values."</td></tr><tr><td>7</td><td>"There is a decrease in the value of assessed resilience due to the value of the criteria dropping out of the limits f<sub>min</sub><sup>n</sup> and f<sub>max</sub><sup>n</sup>."</td></tr><tr><td>8</td><td>"Based on a Functionality Evaluation Model, the closer the value of criteria is to the limit f<sub>max</sub> or f<sub>min</sub> the lower the value of assessed resilience is."</td></tr><tr><td>9</td><td>"Based on a Functionality Evaluation Model, if the value of a criterion is between f<sub>min</sub> and f<sub>min</sub><sup>n</sup> or f<sub>max</sub> and f<sub>max</sub><sup>n</sup> (this situation is denoted as "the system stays in a bad functioning period") for more than a given period, then the value of assessed resilience decreases."</td></tr><tr><td>10</td><td>"The more often the value of a criterion goes outside of f<sub>min</sub><sup>n</sup> and f<sub>max</sub><sup>n</sup>, the lower the value of the assessed resilience is."</td></tr></tbody></table>
<figure><img src="image_9.png" /><figcaption>Figure 8. An example of the Criteria Description views at a territory level (top left), a system level (top right) and a component level</figcaption></figure>

side in Figure 8) of the CPP2 coal power plant can be considered as an aggregation of a Produced Transportable Electricity criterion of the Transformer 1 and of the Transformer 2 (see the organic architecture in Figure 5). In this case, an addition can be considered as an aggregation function. Note that for the sake of simplicity this is not illustrated in Figure 8. The criteria influence and aggregation are defined in the conceptual model illustrated in Figure 1.

The Criteria Description view alone is not enough for a complete specification of a functionality evaluation model that can be used for resilience assessment. The criteria description view defines a static representation of criteria (i.e., identifies criteria, influences and aggregation) that must be completed by a dynamic representation (i.e., how criteria evolves or influence other criteria over time). The latter is possible by using the Criteria Evolution view. The goal of this view is to define evolution of criteria over time, the influence of criteria over time and the aggregation over time. For this purpose, the Criteria Evolution Diagram is proposed. Note that the evolution functions of the initial method (Kamissoko et al., 2018) are transformed into a finite state machine (FSM) used by the GAMA platform for simulation. For this reason and also to ease the transformation process, the Criteria Evolution Diagram is based on a FSM. Existing modeling languages can be used for the design and representation of this view. The UML State Machine (OMG, 2011) is here-proposed as a technical solution. Other technical solution supporting the FSM are also possible.

Figure 9 shows the criteria evolution diagram of the F1 Furnace Coal and Water criteria illustrated in the bottom side of Figure 8. The diagram illustrates the evolution functions of the F1 Furnace Coal and Water criteria and the influence functions C2W (thermal reaction) and C2AC (supplying). The diagram reads as follows. When the furnace is in an Idle state, the temperature of the water decreases until reaching a certain value (no thermal reaction). When a thermal reaction is produced, a quantity of coal is consumed each instant and the temperature of the water increases consequently. When supplying, the quantity of coal in the furnace increases (note that the quantity of coal in stock decreases, but for simplicity this is not shown) and the water temperature decreases.
<figure><img src="image_10.png" /><figcaption>Figure 9. An example of a Criteria Evolution view illustrating the evolution function of the Criterion Coal, the influence function C2W (thermal reaction) and the influence function C2AC (supplying)</figcaption></figure>

The continuous resilience assessment method based on the rules illustrated in Table 2 is implemented in the GAMA platform by (Kamissoko et al., 2018). The resulting algorithm needs an input model as a base on which the rules are interpreted to determine the resilience. First, the rules are used to assess resilience factors of criteria. Second, the criteria resilience factors are aggregated to assess resilience factors of systems. Finally, the systems resilience factors are aggregated to assess the resilience of territories. The process is repeated every simulation instant to have a continuous variation of different resilience factors. The input model in (Kamissoko et al., 2018) is obtained by generating a GAML code based on the functionality evaluation model.

Within the context of this work, a new code generation was developed that was based on all discussed diagrams, generates an input model usable in the GAMA platform for resilience assessment. For example, the top left side of Figure 10 illustrates the evolution of the water temperature (criterion water in Figure 8) and the top right side illustrates the resilience factor related to water temperature and the 5th resilience rule defined in Table 2 (i.e., in the value of a given criterion must not be greater than certain values). Note that, the resilience factor has reached a zero value at the instant 10 because the water temperature has exceeded the authorized value. The bottom left side of Figure 10 illustrates the evolution of available coal in the CPP2 coal stock (criterion available coal in Figure 8) and the bottom right side illustrates the resilience factor related to available coal and the 7th resilience rule defined in Table 2 (i.e., there is a decrease in the value of assessed resilience due to the value of the criteria dropping out of the limits $f_{min}^n$ and $f_{max}^n$. Note that, the resilience factor has decreased when the available coal in the stock has dropped out of the nominal limit $f_{min}^n$.

## 4. CONCLUSION

The well-being of modern society relies on various interconnected and interdependent critical infrastructures, such as healthcare, energy, transport, manufacturing or financial. The functioning of critical infrastructures must be maintained at a satisfactory level even under threats and disruptive events. This article focuses on improving resilience of interconnected critical infrastructures to reassure the continuous functioning or to mitigate negative effects and assure recovery after disruptions. For this, an improved decision support method for resilience assessment based on multi-viewpoint modeling and functional analysis of interconnected systems is proposed. The approach comes as a result to revisiting the Kamissoko et al. (2018) methodology for Continuous and multidimensional assessment of resilience based on functionality analysis for interconnected systems (Kamissoko et al., 2018). The advantages of the initial methodology is in the assessment process and the simplicity
<figure><img src="image_11.png" /><figcaption>Figure 10. Resilience assessment of criteria based on the GAMA platform (Kamissoko et al., 2018)</figcaption></figure>

and adaptability of the criteria matrix. The limit, however, is in the modeling of systems. Indeed, several core concepts related to the modeling of complex systems are overlooked (e.g., physical and contextual, functional and logical modeling, etc.) causing scalability problems. The revisited version of the method addresses the above-quoted problem by adapting principles of the Model-Based Systems Engineering for multi-viewpoint modeling.

The main limitation of the approach is in the transformation process to the GAMA platform. Transformations lead to information losses that are of both structural (the structure of the source and target models are different) and representational (the graphical diagrams are unavailable in the target space) nature. Furthermore, users must manually identify systems, components and criteria in the target space to related them with those of the initial space (i.e., a bidirectional mechanism is currently missing).

The first perspective of this study concerns Big-data and the way to exploit incoming data continuously from heterogeneous, various and non-dedicated data sources. The second perspective concerns a bidirectional mechanisms between the modeling and simulation platforms allowing an improved and eased transition.

## ACKNOWLEDGMENT

This paper shows a result of the RESIIST project (Résilience des infrastructures et systèmes interconnectés - Resilience of Interconnected Infrastructures and Systems https://research-gi.mines-albi.fr/display/resiist/RESIIST+Home [in French]). The RESIIST project is funded jointly by the French National Research Agency (ANR) and the General Secretary of Defense and National Security (SGDSN). The GenMyModel modeling platform (https://www.genmymodel.com/) was used to develop the modeling diagrams and the code generation process. The new modeling platform and the results will be publicly available on the RESIIST project website. The authors acknowledge these organizations for their support, and particularly, the industrial partners for the definition of the application cases.
REFERENCES

Aguilar-Saven, R. S. (2004). Business process modelling: Review and framework. *International Journal of Production Economics*, 90(2), 129–149. doi:10.1016/S0925-5273(03)00102-6

Anaut, M. (2005). Le concept de résilience et ses applications cliniques. *Recherche en Soins Infirmiers*, 82(3), 4–11. doi:10.3917/rsi.082.0004 PMID:16231608

Barker, K., Lambert, J. H., Zobel, C. W., Tapia, A. H., Ramirez-Marquez, J. E., Albert, L., Nicholson, C. D., & Caragea, C. (2017). Defining resilience analytics for interdependent cyber-physical-social networks. *Sustainable and Resilient Infrastructure*, 2(2), 59–67. doi:10.1080/23789689.2017.1294859

BKCASE Editorial Board. (2017). *The Guide to the Systems Engineering Body of Knowledge (SEBoK)*, v. 1.8. Hoboken, NJ: The Trustees of the Stevens Institute of Technology. www.sebokwiki.org

Campbell-Sills, L., Cohan, S. L., & Stein, M. B. (2006). Relationship of resilience to personality, coping, and psychiatric symptoms in young adults. *Behaviour Research and Therapy*, 44(4), 585–599. doi:10.1016/j.brat.2005.05.001 PMID:15998508

Capitole. Khan, Z., Anjum, A., & Kiani, S. L. (2013). Cloud based big data analytics for smart future cities. In *Proceedings of the 2013 IEEE/ACM 6th International Conference on Utility and Cloud Computing*. Washington, DC: IEEE Computer Society. doi:10.1109/UCC.2013.77

Chan, N. H., & Wong, H. Y. (2007). Data mining of resilience indicators. *IIE Transactions*, 39(6), 617–627. doi:10.1080/07408170600899565

Cloquell-Ballester, V.-A., Cloquell-Ballester, V.-A., Monterde-Díaz, R., & Santamarina-Siurana, M.-C. (2006). Indicators validation for the improvement of environmental and social impact quantitative assessment. *Environmental Impact Assessment Review*, 26(1), 79–105. doi:10.1016/j.eiar.2005.06.002

Cutter, S., Barnes, L., Berry, M., Burton, C., Evans, E., Tate, E., & Webb, J. (2008). A place-based model for understanding community resilience to natural disasters. *Global Environmental Change*, 18(4), 598–606. doi:10.1016/j.gloenvcha.2008.07.013

Garcia, H. E., Lin, W. C., & Meerkov, S. M. (2012). *A resilient condition assessment monitoring system*. Paper presented at 2012 5th International Symposium on Resilient Control Systems, Salt Lake City, UT. doi:10.1109/ISRCS.2012.6309301

Gottmann, J. (1975). The evolution of the concept of territory. *Social Sciences Information*. Information Sur les Sciences Sociales, 14(3), 29–47. doi:10.1177/053901847501400302

Hosseini, S., Barker, K., & Ramirez-Marquez, J. E. (2016). A review of definitions and measures of system resilience. *Reliability Engineering & System Safety*, 145, 47–61. doi:10.1016/jress.2015.08.006

INCOSE. (2007). *Systems Engineering Vision 2020*. INCOSE-TP-2004.

INCOSE. (2008). *Survey of Model-Based Systems Engineering (MBSE) Methodologies*. INCOSE-TD-2007-003-01, Version/Revision: B.

ISO/IEC 15288:2008(E)/IEEE Standards 15288.2008 – Systems engineering – System life cycle processes (2nd edition), (February 2008).

Johanson, J. (2010). *Risk and vulnerability analysis of interdependent technical infrastructures*. Department of Measurement Technology and Industrial Electrical Engineering. Lund University.

Kamissoko, D. (2013). *Decision support for infrastructure network vulnerability assessment in natural disaster crisis situations* (PhD Thesis). University of Toulouse.

Kamissoko, D., Nastov, B., Benaben, F., Chapurlat, V., Bony-Dandrieux, A., Tixier, J., Amendeep, A., & Daclin, D. (2018). Continuous and multidimensional assessment of resilience based on functionality analysis for interconnected systems. *Structure and Infrastructure Engineering*. Advance online publication. doi:10.1080/015732479.2018.1546327
Lai, L. L., Zhang, H. T., Lai, C. S., Xu, F. Y., & Mishra, S. (2013). *Investigation on July 2012 Indian blackout*. Paper presented at 2013 International Conference on Machine Learning and Cybernetics, Tianjin, China. doi:10.1109/ICMLC.2013.6890450

Le Moigne, J.-L. (1999). La modélisation des systèmes complexes. Dunod, ed.

Lenort, R., Grakova, E., Karkula, M., Wicher, P., & Stas, D. (2014). Model for simulation of supply chain resilience. *Proceeding METAL*. http://metal2014.tanger.cz/files/proceedings/17/reports/2682.pdf

Long, J.E. (2007). *MBSE in Practice: Developing Systems with CORE*. Academic Press.

Maier, M. W. (2009). *The art of systems architecting* (3rd ed.). CRC Press. doi:10.1201/9781420079142

Mattsson, L.-G., & Jenelius, E. (2015). Vulnerability and resilience of transport systems – A discussion of recent research. *Transportation Research Part A: Policy and Practice, 81*, 16–34. doi:2015.06.00210.1016/j.tra

Mejri, O., Menoni, S., Matias, K., & Aminoltaheri, N. (2017). Crisis information to support spatial planning in post disaster recovery. *International Journal of Disaster Risk Reduction, 22*, 46–61. doi:10.1016/j.ijdrr.2017.02.007

Nastov, B., Chapurlat, V., Dony, C., & Pfister, F. (2015). A verification approach from MDE applied to model based systems engineering: XeFFBD dynamic semantics. In *Complex Systems Design & Management* (pp. 225–238). Springer. doi:10.1007/978-3-319-11617-4_16

OMG. (2011). *Unified Modeling Language (UML) Specification 2.4.1*. Available at: https://www.omg.org/spec/UML/2.4.1/

OMG. (2015). *Systems Modeling Language (SysML) Specification 1.4*. Available at: https://www.omg.org/spec/SysML/1.4

Ouyang, M., Duenas-Osorio, L., & Min, X. (2012). A three-stage resilience analysis framework for urban infrastructure systems. *Structural Safety, 36–37*, 23–31. doi:10.1016/j.strusafe.2011.12.004

Pursiainen, C. (2018). Critical infrastructure resilience: A Nordic model in the making? *International Journal of Disaster Risk Reduction, 27*, 632–641. doi:10.1016/j.ijdrr.2017.08.006

Romero, J. J. (2012). Blackouts illuminate India’s power problems. *IEEE Spectrum, 49*(10), 11–12. doi:10.1109/MSPEC.2012.6309237

Roth, S., Hirschberg, S., Bauer, C., Burgherr, P., Dones, R., Heck, T., & Schenler, W. (2009). Sustainability of electricity supply technology portfolio. *Annals of Nuclear Energy, 36*(3), 409–416. doi:anucene.2008.11.02910.1016/j

Saleh, F., Ramaswamy, V., Wang, Y., Georgas, N., Blumberg, A., & Pullen, J. (2017). A multi-scale ensemble-based framework for fore-casting compound coastal-riverine flooding: The Hackensack-Passaic watershed and Newark Bay. *Advances in Water Resources, 110*, 371–386. doi:10.1016/j.advwatres.2017.10.026

Taysom, E., & Crilly, N. (2017). Resilience in sociotechnical systems: The perspectives of multiple stakeholders. *She Ji: The Journal of Design, Economics, and Innovation, 3*(3), 165–182. doi:10.10110/1016/j

Weck, O., Ross, D., & Magee, C. (2012). *Engineering Systems: Meeting Human Needs in a Complex Technological World*. MIT Press.

Zhang, Y., Burton, H. V., Sun, H., & Shokrabadi, M. (2018). A machine learning framework for assessing post-earthquake structural safety. *Structural Safety, 72*, 1–16. doi:12.00110.1016/j.strusafe.2017