Energy security and resilience have become central to national and international policymaking (Siskos and Burgherr, 2022), particularly in the wake of the energy crisis in Europe following the Russia's attack on Ukraine (Giuli and Oberthür, 2023). While resilience is frequently discussed in engineering, environmental, or social protection contexts (Manca et al., 2017), the distinction between energy security, resilience, security of supply, and related terms often remains imprecise. In the past, energy security and security of supply have been evaluated primarily based on the availability and affordability of fossil resources (Cohen et al., 2011;Le Coq and Paltseva, 2009;Månsson et al., 2014;Novikau, 2023;Vivoda, 2009). However, in decarbonised energy systems, where fossil fuels play a minimal role, new measures and assessments for evaluating security of supply are required (Kim et al., 2025). Recent reviews highlight that security of supply now encompasses dimensions beyond fossil fuel availability (Aisyah et al., 2024;Yu et al., 2022). Nevertheless, most studies primarily assess existing systems and rarely account for future uncertainties and risks (Axon and Darton, 2021;Gasser, 2020;Månsson et al., 2014). Moreover, many analyses rely on energy security indices based on factors such as energy availability and pricing (Aisyah et al., 2024), yet these indices fail to capture the energy system's dynamic nature and adaptive capacity (Martišauskas et al., 2018). Resilience research often focuses on the electricity system and its individual components, such as power lines or power plants (Zidane et al., 2025). However, as Jasiūnas et al. (2021) argue, the concept of resilience must be applied to the entire integrated energy system in the future. In longterm energy system planning, optimisation models are commonly used to represent the system's dynamic characteristics (DeCarolis et al., 2017). However, the existing literature provides limited guidance on effectively assessing energy security and resilience within long-term energy system planning. While several reviews have synthesised existing definitions of energy security, resilience and security of supply (Azzuni and Breyer, 2018;Bento et al., 2024;Blum and Legey, 2012;Jasiūnas et al., 2021), to our knowledge, no review specifically addresses these terms in the context of long-term energy system optimisation models. When examining potential threats and hazards to energy security and resilience, a distinction can be made between shock events and so-called slow burn processes (SBPs) (Hanke et al., 2021). The negative impact of such events on the energy system is often described as a deterioration in "energy system performance" (Braun et al., 2020;Jasiūnas et al., 2021;Jesse et al., 2019), yet this term typically lacks differentiation between technical, economic, or environmental performance. Our work aims to introduce such a distinction and propose an approach to track performance trends over time. In considering how energy security and resilience concepts can be applied to planning tasks for future integrated energy systems, a key question arises: what recourse options are available and can be used by decision makers to respond to shock events and SBPs? For instance, energy system planners traditionally rely on historical weather patterns, yet these are becoming increasingly unreliable indicators of future conditions, undermining robust planning for resilience. We provide an overview of potential recourse options across various planning horizons. Building on the research gaps identified thus far and aiming to support policymakers in formulating strategies that balance immediate energy needs with long-term sustainability goals, this work makes the following key contributions:

• A comprehensive review of previous definitions and a mapping of interrelations between energy security and resilience terms in the energy system domain, incorporating more than 180 references;

• The introduction of shock events and slow burn processes (SBPs) as challenges to energy system resilience, including illustrative examples of their effects on technical, economic, and environmental system performance over time;

• A compilation of relevant recourse options at different resilience capacity levels and system planning horizons as responses to disturbances;

• A clarification of trade-offs between resilience levels and system costs, recognising the need for political guidelines on desired system resilience levels and acceptable additional costs;

• Policy recommendations on how shock events and SBPs can be incorporated into the planning task of integrated energy systems to support better-informed, sustainable political decision-making. The remainder is organised as follows. Section 2 presents an overview of key definitions related to energy security and resilience, examining their interrelations within the literature. Section 3 defines shock events and SBPs as potential challenges to energy security and resilience, followed by illustrative analysis of their impact on the energy system over time. Section 4 explores resilience perspectives in integrated energy system planning and introduces a conceptual approach that categorises relevant recourse options of integrated energy systems with regard to different planning horizons. Section 5 outlines the implications of these findings for integrated energy system planning while also hinting at occurring trade-offs between system resilience levels and system costs. Finally, Section 6 discusses policy implications and draws relevant conclusions. This literature review aims to provide a comprehensive overview of key definitions and concepts related to energy security and resilience in energy systems. Section 2.1 presents commonly used definitions from the literature, followed by a discussion of their interrelations in Section 2.2. Additional terms that contribute to the broader context, namely efficiency, vulnerability, and robustness, are categorised and discussed in Appendix A. To establish a comprehensive mapping of interrelations between energy security and resilience terms in the energy system domain, it is first necessary to review relevant terms. Although no consensus on a universal definition of energy security exists (Ang et al., 2015;Kim et al., 2025;Pereira et al., 2024;Rodríguez-Fernández et al., 2022), it is widely recognised as a key objective of energy policy (Winzer, 2012). The concept rapidly evolves (Strojny et al., 2023) and closely intersects with energy system resilience (Jasiūnas et al., 2021). The definition of energy security by the International Energy Agency (IEA) as the "uninterrupted availability of energy sources at an affordable price" (IEA, 2024) features prominently in the academic discourse (e.g. in Mauro, 2024;Molyneaux et al., 2016;Pereira et al., 2024). Another widely referenced framework is the "four A's" of energy security, first introduced by Kruyt et al.
(2009) and frequently cited in the literature (e.g. in Cherp and Jewell, 2011;Esfahani et al., 2021;LaBelle, 2024;Molyneaux et al., 2016;Rodríguez-Fernández et al., 2022;Strojny et al., 2023;Thaler and Hofmann, 2022). Availability pertains to physical resources, accessibility involves the geopolitical aspects of acquiring resources, affordability relates to energy costs and prices, and acceptability addresses environmental and social considerations (Kruyt et al., 2009). In addition, other dimensions of energy security are highlighted in the literature, including infrastructure (Ang et al., 2015;Qiu et al., 2023), import dependency and diversity of energy sources (Bento et al., 2024;Mersch et al., 2024), governance and energy efficiency (Ang et al., 2015;Esfahani et al., 2021;Qiu et al., 2023), and climate protection (Ang et al., 2015;Buck et al., 2022). As noted in the introduction, traditional energy security metrics have historically focused on fossil fuel availability (Kruyt et al., 2009). More recent literature identifies indicators such as energy reserves, import exposure, and energy prices as relevant measures of energy security (Zhang and Zhou, 2024). Comprehensive tabular overviews of various energy security indicators are available in Ang et al. (2015); Siksnelyte-Butkiene et al. (2024). However, assessing energy security through a single key performance indicator (KPI) remains a challenge due to its multidimensional nature (Ang et al., 2015). The concept of resilience has been widely discussed in scientific literature, with early foundational work by Holling (1973) defining ecosystem resilience as the ability to absorb changes in environmental conditions and parameters. This definition has since influenced numerous fields (e.g. in Brand, 2016;Hanke et al., 2021;Wang et al., 2019). The term itself is derived from the Latin "resilire", meaning "the ability to spring back or rebound" (Gatto and Drago, 2020a;Gholami et al., 2018;Hosseini et al., 2016). Despite its widespread use, no single, universally accepted definition of resilience exists, as its meaning varies significantly across disciplines and contexts (Erker et al., 2017b;Gasser et al., 2020;Jesse et al., 2024;Mentges et al., 2023;Wang et al., 2019). It is often described as a multidimensional concept (Altherr et al., 2018;Manca et al., 2017;Siskos and Burgherr, 2022), encompassing diverse aspects such as energy import resilience (He et al., 2015), resilient supply chains (Balteanu et al., 2024), resilient energy communities (Gruber et al., 2024), and resilience of critical infrastructures (Mentges et al., 2023). From a general perspective, Erker et al. (2017a) define resilience as "a concept to ensure the viability of a system by reducing the vulnerability and increasing the adaptive capacity before, during or after a stressful event". Similar definitions appear in Cho et al. (2022), Jasiūnas et al. (2021), VDE (2020), and Zhou (2023). Energy system resilience is defined as "the ability of an energy system to retain, react, overcome and overpass perturbations caused by a shock in economic, social, environmental and institutional terms" (Gatto and Drago, 2020b;Ye et al., 2024). It is also important to note the definitions of relevant institutions: The EU (2022) frames resilience of a critical organisation or infrastructure as the ability to prevent, protect against, respond to, mitigate the consequences of, absorb, manage, and recover from a security incident. In turn, the European Network of Transmission System Operators for Electricity (ENTSO-E) defines power system resilience as "the ability to withstand and mitigate the extent, severity and duration of system degradation following an impactful event" (ENTSO-E, 2024). Almost identical, the International Council on Large Electric Systems (CIGRE) defines power system resilience as "the ability to limit the extent, severity and duration of system degradation following an extreme event" (CIGRE, 2017). Similar adaptions of these definitions can be found in Braun et al. (2023), Izadi et al. (2021), Pitto (2024), andStanković et al. (2023). To characterise resilience, the National Infrastructure Advisory Council of the United States (NIAC) identifies robustness, resourcefulness, rapid recovery, and adaptability as its key features (NIAC, 2010). According to the Cabinet Office of the United Kingdom (2011), components of resilient infrastructure are resistance, redundancy, reliability, response, and recovery. Resilience is closely linked to high-impact low-probability (HILP) events (Braun et al., 2020;Cho et al., 2022;Fang and Zio, 2019;Janta et al., 2024;Mohanty et al., 2024;Pan and Shittu, 2025;Stanković et al., 2023;Zhou et al., 2020;Zou et al., 2024) that are sometimes also referred to as extreme events (Broska et al., 2020), disruptive events (Mentges et al., 2023), or black swan hazards (Krupa and Jones, 2013;Panteli et al., 2018). A resilience trapezoid is commonly employed to track the (energy) system's performance over time to visually represent the resilience of an (energy) system in case of such an HILP event (e.g. in Amini et al., 2023;Braun et al., 2020;Izadi et al., 2021;Janta et al., 2024;Jasiūnas et al., 2021;Jesse et al., 2019;Mohanty et al., 2024;Panteli and Mancarella, 2017;Panteli et al., 2017;Stanković et al., 2023). Although terminology varies across sources, the different phases of resilience assessment typically fall under the categories of defending, preventing, detecting, resisting, absorbing, adapting, and restoring. The assessment of energy system resilience often considers both the duration and severity of disruptions (Panteli et al., 2017). Another key metric is the elapsed time from the occurrence of a disruption to full system recovery. However, relying solely on a single or aggregated energy resilience KPI may not provide a complete picture. Instead, researchers advocate for a multi-indicator framework to capture the complexity of resilience assessment. Comprehensive tabular overviews of various resilience indicators are available in Ahmadi et al. (2021), Shafiei et al. (2025), andMonie et al. (2025). Energy sovereignty has gained significant attention in recent years (Prognos et al., 2023;Timmermann and Noboa, 2022). As Raimi and Davicino (2024) note, a universally accepted definition remains elusive. However, they characterise energy sovereignty as a framework that enables communities or nations to make informed choices regarding all components of their energy systems. LaBelle (2024) further defines energy sovereignty as a state's capability to safeguard its energy system against multidimensional threats through control over its energy policy. Similarly, Westphal (2020) argues that energy sovereignty is achieved when a state can provide sufficient and reliable energy supplies at economic prices without compromising its own values, interests, or foreign policy objectives.
The Observatori del Deute en la Globalització (ODG, 2014) defines energy sovereignty as the right to make independent decisions on energy generation, distribution, and consumption while considering economic, social, and ecological factors. Thaler and Hofmann (2022) distinguish between 'hard' aspects, i.e. independent decisions regarding the structure and sources of energy supply, and 'soft' aspects of energy sovereignty, i.e. control over the operation of the energy system, energy policy, and market regulations. Several KPIs have been proposed to assess energy sovereignty, including the share of domestic energy production in total energy consumption, the ratio of domestic renewable energy production to total energy demand, or the net energy import dependency. Another KPI for energy sovereignty is the Herfindahl-Hirschman Index (HHI) (Bucciarelli et al., 2025), which measures the concentration of energy supply or production within a particular market or region. Closely related to energy sovereignty is the concept of technology sovereignty (Edler et al., 2023), which focuses on the state's ability to produce or control strategic energy technologies domestically. This can be quantified, for example, as the proportion of strategic energy technologies manufactured within a country. The objective of energy solidarity is to ensure the efficient operation of energy markets and the security of energy supply, while promoting energy efficiency and innovation, and enhancing the interconnection of energy networks (Huhta and Reins, 2023b). More broadly, solidarity is a foundational principle of the European Union (EU) (Mišík and Nosko, 2023), implying that Member States are expected to assist one another across various domains, even at the expense of their own national interests (Sangiovanni, 2013). When applied to the energy sector, this principle is embodied in energy solidarity, which serves as a legally binding principle within the EU's energy law (Huhta and Reins, 2023a). Although no universally accepted definition of energy solidarity exists, there is a general consensus that fostering a spirit of solidarity among Member States is essential for the effective functioning of the energy market (Andoura, 2023;Bartenstein, 2023;Huhta and Reins, 2023a). Based on EU (2008), energy solidarity can be defined as the collaborative commitment among countries to ensure a secure, efficient, and sustainable energy market. The literature provides limited guidance on KPIs for measuring energy solidarity. However, potential metrics could include the volume of cross-border electricity and gas exchange, the share of energy imports from allied countries, or the response time for energy crisis interventions. There are various definitions of security of supply (Burkhardt et al., 2024), which is sometimes considered a dimension of energy security (Fouladvand et al., 2024;Kim et al., 2025). However, the literature frequently blurs the distinction between the terms energy security and security of supply (Wettingfeld et al., 2024). According to Möst et al. (2023), security of supply is achieved when the desired quantity of energy (of the required quality) is available consistently throughout the energy system at reasonable prices, which is similar to the definition of energy security. Security of supply primarily focuses on the reliability of power supply (Löschel et al., 2023) and the adequacy of generation and power grids (Wettingfeld et al., 2024). It is often illustrated through the assumption of overcapacities in electricity generation and transmission (Gils et al., 2023). According to the German Federal Network Agency (Bundesnetzagentur, 2024), security of supply is characterised by sufficient generating capacities, electricity grid and gas networks that fulfil their transport tasks, reliable control mechanisms, and sufficient protection against third-party interference. The German Federal Ministry for Economic Affairs and Climate Action (BMWK, 2019) defines security of supply as maintaining electricity supply at all times despite an advancing energy transition. Schittekatte and Meeus (2021) categorise security of supply along the temporal dimension into a realtime to short-term aspect (system reliability) and a mid-term to long-term aspect (resource adequacy). Reliability is viewed as a precursor to resilience (Cramton, 2023), particularly in the context of expansion planning (Cho et al., 2022;Espinoza et al., 2016). With regard to power systems, reliability refers to the probability of satisfying the load demand under uncertain conditions (Lin et al., 2012;Tsao and Thanh, 2020), especially in regionally restricted disruptions. The Cabinet Office of the United Kingdom (2011) explicitly emphasises the design of power system components, defining reliability as the assurance that these components are inherently capable of functioning under various conditions. Unlike resilience, which deals with HILP events, reliability addresses high-probability and low-impact events (Braun et al., 2020;Izadi et al., 2021;Mohanty et al., 2024). The term adequacy, commonly referred to as "system adequacy", is used in various contexts (Consentec and r2b energy consulting, 2015). A widely accepted definition by (TERNA, 2024) describes it as "the system's capacity to satisfy electrical energy requirements while complying with requirements on safety and quality of service". This definition mainly encompasses existing grid and generation capacities (Consentec and r2b energy consulting, 2015; Wettingfeld et al., 2024). The anticipated retirement or phasing out of conventional power plants and the expansion of renewable energy are expected to pose challenges for maintaining generation adequacy in the European power system (Scharf and Möst, 2024). A prominent source monitoring Europe's security of supply over a 10-year horizon is the "European resource adequacy assessment", published by the European Union Agency for the Cooperation of Energy Regulators (2024). Grid adequacy (or transmission adequacy) is a subset of system adequacy and refers to the ability to transport electricity from generation sites to consumers at all times, which requires sufficient transmission and distribution grid capacity (TenneT TSO GmbH, 2024). Several KPIs are commonly used to assess security of supply, including the loss of load expectation (LOLE), expected energy not served (EENS), system average interruption duration index (SAIDI), and value of lost load (VOLL). The LOLE measures the expected number of hours per year in which the demand for (electrical) energy cannot be met (Grant and Clark, 2024). The EENS quantifies the expected amount of energy that will not be provided due to supply interruptions (Qawaqzeh et al., 2023). The SAIDI calculates the average duration of power interruptions per customer served over a given period (Bundesnetzagentur, 2025).
The VOLL estimates the economic impact of supply interruptions (Kachirayil et al., 2025), reflecting society's willingness to pay to prevent power outages (Gorman, 2022). The calculation of the VOLL is influenced by several factors, including the timing and duration of the outage, as well as regional economic conditions (Najafi et al., 2021). Based on the literature review, a conceptual framework illustrating the definitions and interrelations between key terms relevant to energy security and resilience in energy systems has been developed (see Figure 1). The overlapping arrows in the figure indicate that these interrelations do not follow a simple linear hierarchy but are instead strongly interlinked. Starting from the left side, LaBelle (2024) argues that energy sovereignty and energy solidarity contribute to the creation of energy security rather than being variables independent from energy security. Both energy sovereignty and energy solidarity play a supportive role in enhancing security of supply: the former increases security of supply, according to Kardaś (2023), while the latter ensures the security of energy supply in the EU, according to EU (2008) and Maltby (2013). Furthermore, Bartenstein (2023) suggests that energy solidarity also strengthens the resilience of the (European) energy system. Resilience is often regarded as a component of energy security (Jasiūnas et al., 2021). According to (Gasser et al., 2017), many indicators of resilience can also be applied in the context of security of supply. Bento et al. (2024) and Azzuni and Breyer (2018) both argue that energy security is more than just security of supply because of other economic, social, and environmental aspects that also belong to the field of energy security. As discussed in Section 2.1.5, and according to Schittekatte and Meeus (2021), reliability represents the real-time to shortterm aspects of security of supply, while adequacy pertains to the mid-term to long-term elements of security of supply. Figure 1 also categorises the different terms based on their association with either the technical or political level. Energy security and resilience appear across both technical and political levels, encompassing infrastructure, market dynamics, and policy considerations. Energy sovereignty and energy solidarity are primarily linked to the political level, given their association with policy decisions, international cooperation, and regulatory frameworks. Security of supply, along with reliability and adequacy, is primarily considered a technical concept. However, it also borders the political level, as decisions on market design, capacity mechanisms, and cross-border cooperation influence its effectiveness. The interrelations between the terms discussed in Section 2 demonstrate that enhancing the energy system's resilience contributes inherently to improvements in both energy security and security of supply. Consequently, the primary focus of this work is to explore strategies for strengthening energy system resilience, recognising that such efforts will also support energy security and security of supply. For the sake of simplicity, however, the following sections will primarily refer to energy system resilience. As identified in the literature review, resilience in energy systems is particularly challenged by hazards and threats. While hazards typically refer to natural and unintentional events, threats are linked to intentional actions driven by specific actors with the capability and intent to cause harm (Mentges et al., 2023). In the context of energy system planning and modelling, such events can be classified as either transient or disruptive. Transient events are anticipated to some extent but may not be fully accounted for in planning. Disruptive events arise from large-scale mega-trends with unpredictable magnitudes and progression speeds (McCollum et al., 2020). Note that in a narrower context of electrical engineering, transient events are defined as temporary, short-lived phenomena. In macro-scale energy system modelling, the term is used more broadly to describe events with similar characteristics but on a different timescale. In order to optimise system design and enhance resilience, it is essential to consider hazards and threats in planning future energy systems. Hanke et al. (2021) introduce a useful distinction between "shock events" and so-called slow burn processes (SBPs), which provides a structured approach to classifying hazards and threats as well as examining their effects on energy systems' technical, economic, and environmental performances. Section 3.1 first characterises the two terms, followed by a discussion of their impact over time in Section 3.2. As discussed in Section 2.1.2, shock events are often described as HILP events. Although such events are rare, their potential for substantial and difficult-to-mitigate damage is significant. Importantly, shock events cannot be entirely avoided (Manca et al., 2017). Their impact is typically unevenly distributed across countries (Zachmann et al., 2024). In highly interconnected energy systems, such disruptions can propagate across neighbouring regions amplifying their effects. In contrast, slow burn processes (SBPs) refer to protracted, persistent, structural changes in the energy system (Hanke et al., 2021;Manca et al., 2017). They evolve gradually and escalate in urgency over time. While unfolding, they lead to increased vulnerability and diminishing resilience, potentially resulting in a shock event in the future. A frequently used example is climate change, which will have a profound impact on the energy system due to increased extreme weather events, global warming, and changing resource requirements. Various hazards and threats that pose potential risks to the energy system have been identified in the literature. A classification of these risks into shock events and SBPs is provided in Table 1. Beyond commonly discussed shock events in the table, the literature also identifies less frequently explored risks, including individual but more pronounced droughts of solar and wind (Grochowicz et al., 2024;Kapica et al., 2024), or pandemics (Hoang et al., 2021). Note that it is crucial to distinguish between their respective incidents and impacts (Broska et al., 2020). Therefore, the table focuses on event classification rather than detailing their consequences for the energy system. Table 1 Overview of potential hazards and threats to the energy system including a classification into shock events and SBPs, with references from the literature. As discussed in Section 2.1.2, a trapezoidal time curve often represents the resilience behaviour of electricity or energy systems.
In such representations, time is plotted on the x-axis in these representations, while "(energy) system performance" is shown on the y-axis. Typically, system performance declines following a HILP event, remains at a reduced level for a specific duration, and subsequently recovers. Some studies (e.g. Braun et al., 2020;Stanković et al., 2023) suggest that post-recovery system performance may surpass pre-incident levels, as lessons learned from the event can enhance future resilience. Figure 2 categorises system performance into three dimensions, which distinguishes it from the usual trapezoidal representations: technical, economic, and environmental. The axes intentionally lack specific units and should be interpreted schematically. The dotted horizontal line indicates system performance prior to a shock event (Figure 2a, Figure 2c, and Figure 2e) or SBP (Figure 2b, Figure 2d, and Figure 2f). The area between the initial state and the corresponding coloured curve represents the disturbance intensity (illustrated in Figure 2a), which depends on both the duration (horizontal axis) and the degradation of system performance (vertical axis). The latter, often referred to as severity (CIGRE, 2017), reflects the magnitude of the performance loss. For illustration, we consider an earthquake that damages a nuclear power plant as an example of a shock event. As an example of an SBP, we consider a gradual reduction in cooling water availability at the same facility, worsening over time. We generally assume that if a shock event or an SBP is foreseeable, there will be time for preparation (between 𝑡 1 and 𝑡 2 ). Such preparation can reduce the technical, economic, and environmental consequences for the energy system. Accordingly, a timeline is presented that distinguishes between scenarios with preparatory measures ("w/ preparation") and without preparatory measures ("w/o preparation"). As illustrated by the blue and orange integrals in Figure 2b, disturbance intensity is greater in cases without preparation. An SBP may or may not trigger a subsequent shock event (between 𝑡 2 and 𝑡 3 ). For example, the aforementioned reduced power plant availability due to a lack of cooling water could eventually lead to a complete shutdown. We further posit that a sudden shock event will generally cause greater disturbance intensity across all three dimensions compared to an SBP. If such a shock event occurs, performance degradation is most severe between 𝑡 3 and 𝑡 4 , regardless of whether the shock event was preceded by an SBP. However, by 𝑡 6 , the system is expected to return to its best possible state under all scenarios. It is important to note that the horizontal axis in these examples includes breaks and is not to scale. While SBPs may develop over several years, shock events can unfold within seconds or minutes. Additionally, the illustrated sequences serve as examples and do not apply to all possible events. Figure 2a illustrates the technical performance dynamics of an energy system experiencing a shock event caused by an earthquake destroying a nuclear power plant. Without preparatory measures, the technical performance undergoes a sudden and severe decline. The reconstruction of new power plant capacities takes time, resulting in a prolonged period of diminished performance until sufficient capacity is gradually commissioned, ultimately restoring the system's ability to meet total electricity demand. Since earthquake prediction is not yet possible (Akhoondzadeh, 2024), the only viable preparatory measure is the construction of overcapacities. Although this does not improve the technical performance before the event, as the additional electricity cannot be consumed, it mitigates the overall intensity of disruption following the nuclear power plant's destruction. As a result, system recovery occurs at 𝑡 5 instead of 𝑡 6 . As shown in Figure 2c, the economic performance of the system experiences a sharp decline immediately after the shock event if no preparatory measures are taken (𝑡 2 to 𝑡 3 ). The power plant incurs immediate depreciation coupled with potential costs from unmet electricity demands. This economic state persists (𝑡 3 to 𝑡 4 ) until performance begins to improve with the phased commissioning of new power plant capacities (𝑡 4 to 𝑡 6 ). In contrast, the construction of renewable over-capacities initially deteriorates economic performance, incurring upfront costs without immediate demand. However, during the shock event this measure results in a less severe economic decline and a faster recovery as the nuclear power plant must still be fully depreciated. The burden of uncovered loads is reduced. In both cases, the economic performance fails to return to pre-shock levels primarily due to the long-term costs associated with dismantling nuclear ruins. The system's environmental performance (Figure 2e) also experiences a sharp decline in the absence of preparatory measures, as environmental contamination occurs and as we assume that CO 2 -emitting gas-and coal-fired power plants must compensate for the lost capacity. It is assumed that subsequent over-capacity investments will be renewable, leading to a gradual improvement in environmental performance over time. The preparatory construction of over-capacities helps mitigate the environmental decline, as fewer alternative power plants are needed. Nonetheless, similar to economic performance, the environmental performance does not fully recover to its initial state, due to the long-term ecological damage from the nuclear power plant's destruction. In the SBP example involving a gradual reduction of cooling water availability in a nuclear power plant, the decline in technical performance (illustrated in Figure 2b) begins earlier, at time 𝑡 1 , compared to the earthquake-induced shock event, which occurs at 𝑡 2 . Without preparatory measures, the technical performance steadily decreases as cooling water becomes increasingly scarce due to rising ambient temperatures. This decline culminates in a final shock event between 𝑡 2 and 𝑡 3 , where insufficient cooling water forces a complete power plant shutdown. Installing a closed-loop cooling system as a preparatory measure improves technical performance but does not fully restore it to pre-SBP levels, as closed-loop cooling systems are less efficient and reduce the power plant's available capacity (Byers et al., 2014). Nonetheless, early implementation of such a system mitigates the severity of technical decline and prevents a total shutdown.
Lower efficiency of closed loop cooling requires additional use of other power generators (f) Environmental system performance during an SBP Figure 2: Technical, economic, and environmental system performances during a shock event (left side, using the example of an earthquake that destroys a nuclear power plant) and during an SBP (right side, using the example of a lack of cooling water in a nuclear power plant that becomes more severe over time), own illustration. In the absence of preparatory measures, the system's economic performance (Figure 2d) initially mirrors the technical performance. The gradual decline in available capacity, eventually leading to complete failure, necessitates reliance on costlier replacement power plants. Subsequently, additional expenses arise from the late installation of a closedloop cooling system. Conversely, proactively installing the closed-loop system incurs upfront costs but avoids the higher financial burdens associated with a full outage. In line with previous trends, environmental system performance (Figure 2f) also deteriorates due to the shock event, as warmer cooling water is discharged from the power plant into the river. Moreover, relying on gas-and coal-fired replacement power plants causes higher CO 2 emissions. The lower efficiency of the closed-loop cooling system also requires supplementary power plants after installation, the construction and operation of which have additional environmental consequences. However, the closed-loop cooling system reduces the volume of warmer cooling water discharged into the river, thereby improving environmental performance. When comparing the SBP without preparatory measures to the earthquake-induced shock event, the declines in technical, economic, and environmental performance are less severe, primarily because the power plant remains intact. Consequently, the system recovers more quickly, resolving the aftermath by 𝑡 5 rather than 𝑡 6 . A future challenge facing energy system planners is the application of resilience capacities to transformation pathways of complex integrated energy systems. A central consideration is identifying the appropriate levels and dimensions for enhancing system resilience, as well as determining how traditional energy system models can support the identification of economically viable and secure solutions. To broaden and advance planning perspectives, this section explores how resilience capacities can be embedded into planning frameworks for integrated energy systems. Section 4.1 presents the fundamental resilience capacities, followed by detailed explanations of the identified recourse options: absorptive (Section 4.2), adaptive (Section 4.3), and transformative (Section 4.4) measures. We further discuss which markets encourage investments in the respective recourse options. The "shocks and capacities" concept from Manca et al. (2017) provides an overview of different resilience capacities. Based on the disturbance intensity and its duration of exposure, the authors classify these capacities into three levels:

1. Absorptive capacity (first level) -the ability to withstand minor disturbances with normal operational system adjustments. 2. Adaptive capacity (second level) -the ability to adjust operations to accommodate more significant and/or extended disturbances. Transformative capacity (third level) -the ability to fundamentally change system configurations to manage upcoming extreme and/or prolonged disturbances. Drawing inspiration from this conceptual framework, Figure 3 compiles various recourse options aimed at enhancing resilience in the context of integrated energy system planning. This extension serves as guidance, broadening perspectives in system planning tasks by explicitly incorporating resilience capacities and associated recourse measures. More specifically, it qualitatively represents the abilities of an increasingly integrated energy system (or model) to respond to previously defined shock events and SBPs discussed in Section 3. Curative Investment ... Figure 3: Resilience capacities of integrated energy systems in response to shock events and SBPs, own illustration based on the "shocks and capacities" framework by Manca et al. (2017). Note that the options across all levels are illustrative, not exhaustive. The qualitative categorisation translates the time of exposure into different system planning horizons ranging from short-term operational, medium-term curative, to long-term investment planning measures. In each category, we arrange the measures according to their time horizon and disturbance intensity, with decisions placed further outward in the diagram indicating greater time requirements and/or higher implementation efforts. The first level emphasises the absorptive capacity of integrated energy systems, aiming to maintain persistence with relatively minimal or standard effort (Mentges et al., 2023). It comprises recourse options designed to address minor, short-duration disturbances. Examples include:

• Curtailment: Temporarily reducing output from variable renewable energy (VRE) sources or limiting cross-border (XB) trading capacity in response to excess electricity supply or alleviate transmission line congestion. • Transmission switching: Controlling electricity flows within the transmission network by selectively opening or closing transmission assets. • Adjusting thermal generation: Utilising peaking units and operating combined heat-and-power plants in condensing mode, or running thermal generation plants at a generally less efficient operating point. • Load shifting: Incorporating demand response to encourage consumers to adjust (advance/delay) their energy use in response to price signals, demand side management to actively coordinate spatio-temporal energy demand, temporal load shifting via short-term storages, and spatial load shifting (e.g. by data centre computing loads Riepin et al. (2025)). In the EU, these absorptive capacities typically generate revenue through reserve markets and are controlled by the transmission or distribution grid operators (Schittekatte et al., 2020). Future market designs should ensure adequate incentives for maintaining sufficient reserve capacities. In energy system planning -which commonly employs hourly or longer temporal resolutions -these short-term measures may partly play a minor role. Consequently, rapid system restoration capacities and grid-forming inverter capacities essential for grid stability are not depicted in Figure 3, despite their criticality to overall system functionality. The second level features the capacity of integrated energy systems and includes the following response and recourse options:

• Load shedding or rationing: Measures of last resort -whether immediate or gradual, voluntary or enforced -to stabilise the energy system or maintain partial system performance. These involve either disconnecting consumers entirely from energy infrastructure (e.g. electricity grids, heating networks, or gas systems) or limiting their supply during specific time windows or in affected regions. • Activating long-term storage: Utilising energy reserves from hydrogen and gas storage systems, thermal storage solutions, and hydropower reservoirs to ensure system stability during extended disruptions.
• Importing additional fuels and electricity: Increasing the supply of electricity, gas, and other fuels by leveraging existing import infrastructure to address shortfalls in domestic energy production or availability. • Utilising hybrid supply: Adjusting operational modes in hybrid or multivalent systems, e.g. hybrid heat pumps or hybrid boilers, to meet end-use demands by prioritising commodities with lower criticality for the system. • Utilising firm capacities: Providing resources that can consistently deliver electricity as they are crucial for ensuring grid stability and meeting demand. This may also include deferring maintenance, even when it incurs more costs, or deploying back-up generation units. These adaptive capacities typically generate revenue through day-ahead or intraday markets (Schittekatte et al., 2020). However, during significant disruptions, price signals in these markets can become distorted, e.g. through governmentimposed price caps, reducing the incentive to invest in these stability measures (Rüdinger, 2023). The third and outermost level constitutes the transformative capacity, requiring recourse options that fundamentally alter the energy system's structure when its current state can no longer adequately respond to significant and longlasting disturbances:

• Spatial (re-)allocation: Centralising or decentralising supply sources and demands, transforming the spatial distribution of producers and consumers. Examples include the construction of new liquefied natural gas (LNG) terminals (Gritz and Wolff, 2024;Wiertz et al., 2023) or the expansion of domestic electrolysers instead of increased hydrogen imports (Frischmuth and Härtel, 2022). • Developing new technologies and combinations: Investment in research and development for innovative technology combinations and technology breakthroughs, e.g. nuclear fusion (Tokimatsu et al., 2003), despite inherent uncertainties. • Hybridising supply systems: Designing and deploying hybrid, multivalent supply systems with built-in redundancy to enable fuel-switching flexibility, such as combining a direct resistive heating element with a fuel-based boiler. • Deploying storage: Expanding short-to long-term storage options for different commodities to enhance flexibility and reliability. • Scaling generation capacity: Commissioning additional capacities for thermal and renewable generation (e.g. onshore and offshore wind, solar photovoltaics, hydrogen power plants), which may also include building fossil power plants as back-up. • Expanding energy transport: Building and upgrading energy transport infrastructure, e.g. high-voltage alternating current and high-voltage direct current lines, pipelines, and shipping port capacities. • Adopting negative emission technology: Implementing engineered solutions, e.g. direct air capture and bioenergy with carbon capture and storage, alongside natural climate solutions such as reforestation and wetland restoration. In the existing European market design, transformative capacities generate revenue on day-ahead or intraday markets, or by participating in long-term markets (Schittekatte et al., 2020). However, due to the uncertainty associated with HILP events, market signals might not provide sufficient incentives to guarantee resilience. To that end, supplementary mechanisms such as reserve or capacity markets can play a crucial role in encouraging the necessary investments for transformative resilience measures. The previous sections demonstrated the importance of both operational planning and investment planning in maintaining energy security and creating resilient energy systems. Section 5.1 gives an overview of planning approaches that are currently used in energy system modelling. Section 5.2 shows how shock events and SBPs can be incorporated into energy system transformations. Then, Section 5.3 briefly outlines key challenges in the assessment of resilience in integrated energy systems. Finally, Section 5.4 discusses the inherent trade-off between energy system costs and resilience and the need to further substantiate and quantify the underlying effects. In operational planning, critical aspects involve effectively managing short-term uncertainties, identify vulnerabilities during real-time development, and what recourse options are available to system operators (Braun et al., 2024;Moretti et al., 2020). Typical vulnerabilities include threats to physical infrastructure of power and energy systems, threats targeting digital and communication layers, and systemic weaknesses resulting from interdependence failures, coordination challenges, or human errors. Investment and expansion planning, particularly for multi-period transformation pathways, requires comprehensive approaches capable of assessing a broader range of possibilities over more extended time frames compared to operational planning. Forward-looking investment planning approaches for energy markets and infrastructures enhance the ability to anticipate and mitigate future risks. Conventional deterministic energy system planning, which evaluates only one scenario at a time, limits its ability to address extraordinary events (McCollum et al., 2020). To overcome this limitation, these planning approaches typically analyse a small set of scenarios independently (Braun et al., 2024). However, a significant challenge remains in advancing energy system modelling to incorporate essential aspects of resilience into these approaches. Integrating uncertainty explicitly into decision-support processes allows system planners to better recognise and mitigate risks associated with decisions made under uncertainty (Härtel, 2021). While the hedging decisions might not resemble any optimal decisions obtained for individual scenarios (Wallace, 2000), common features among deterministic planning approaches based on perfect information do not necessarily provide robust or least-regret recommendations for planners and policymakers. Forward-looking investment planning is already a crucial feature of sound system planning approaches. With long lead times and lifespans, lumpy and capital-intensive structures, and the potential irreversibility of decisions that might result in stranded assets, energy infrastructure decisions must be made with an expectation of uncertain developments, ensuring the resilience and security of future systems. Planning resilient energy systems involves navigating complex system interactions and uncertainties, extending beyond merely capturing variability in generation and load (Braun et al., 2024). Looking at a myriad of potential shock events and SBPs, forward-looking system development planning must incorporate these additional uncertainties and risks to identify the most effective strategies for integrating resilience into the system design (United Nations Economic Commission For Europe, 2022). Established system planning processes, such as the "Ten-Year Network Development Plan" by ENTSO-E in Europe or the "Transmission Needs Study" in the United States, are key policy instruments facilitating the planning process of developing energy systems and infrastructures. However, these decision-making support frameworks must evolve to address energy systems' growing complexity and uncertainty, embedding resilience and security explicitly into long-term planning strategies. For instance, policy measures such as deploying liquefied natural gas terminals in response to the gas crisis in Germany in 2022 (Gritz and Wolff, 2024;Wiertz et al., 2023) often lacked efficiency and foresight.
These inefficiencies and gaps in foresight are partly a result of swift decision-making required to address disruptive events, which prioritises short-term solutions over long-term planning. Moreover, inadequate coordination and collaboration can cause individual response measures to inadvertently create unintended or counterproductive impacts on interconnected systems (Draghi, 2024). Hence, pressing policy questions emerge regarding the balance between short-term (reactive) goals such as strengthening energy security and maintaining long-term (proactive) goals such as the clean energy transition (Kim et al., 2025). Addressing this dual challenge highlights the necessity of proactive and forward-looking approaches, integrating energy security and resilience into the broader goals of clean energy transformations. Building and maintaining absorptive, adaptive, and transformative capacities is thus essential for resilient energy system transformations. Expanding current planning frameworks to include manifold recourse options fosters new resilience paradigms in integrated energy system design. As discussed in Section 3, shock events and SBPs can challenge resilience in transformation and system development pathways. Section 5.2.1 illustrates how they can influence different system states over time, while Section 5.2.2 discusses various modelling options that allow to incorporate them into system transformation planning. Inspired by the "futures cone" introduced by Voros (2003), van Dorsser et al. (2018), and McCollum et al. (2020), Figure 4 illustrates the potential evolution of different energy system states across several years. Time is represented along the horizontal axis, exemplified by three future planning periods at 10-year intervals. The inner cone symbolises the set of system states that are considered 'probable', while the outer cone symbolises the set of system states that are considered less probable but still 'possible'. The inner cone symbolises system states classified as 'probable' while the outer cone represents less likely but still 'possible' states. System states beyond these cones are currently unpredictable and therefore labelled as 'unexpected'. A 'system state' may encompass numerous variables, including installed capacities, energy demands, technological costs, energy prices, emission budgets, or external factors such as climate conditions. Figure 4 demonstrates various energy system transformation pathways, grouped into three categories: I. Probable transformation pathways consistently contain probable system states across all planning periods and are readily captured by current state-of-the-art energy system models. II. Possible transformation pathways contain plausible, low-probability system states in different planning periods, posing an emerging challenge to handle deep uncertainties and alternative scenarios in energy system planning. III. Unexpected transformation pathways culminate in currently unpredictable system states not currently manageable within existing modelling frameworks. Addressing these future modelling challenges requires capturing an increasingly broad range of potential system developments within the outer cone. Achieving this may necessitate adopting innovative and scalable modelling methodologies beyond those traditionally employed. Resilient energy system planning requires decisionmaking frameworks capable of addressing uncertainties, including shock events and SBPs. These frameworks generally fall into qualitative and quantitative approaches. Qualitative approaches emphasise conceptual understanding and stakeholder engagement to identify risks and formulate strategies. In contrast, quantitative approaches employ analytical methods, such as simulation and optimisation, to derive actionable insights. Simulation methods are primarily predictive and aim to replicate system behaviour under various predefined scenarios. They are widely employed to assess supply resilience and security by modelling energy systems' performance under different stress conditions. However, simulation alone provides limited prescriptive guidance for decision-making. Optimisation methods, on the other hand, are prescriptive and focus on identifying the best course of action under given constraints and objectives. These methods are particularly suited to planning and managing energy systems under uncertainty. Decision support frameworks can achieve a balanced trade-off between competing priorities by integrating system performance indicators, e.g. costs, technical reliability, and emissions, into the optimisation objective. Optimisation under uncertainty provides an alternative to explicitly account for shock events and SBPs and the available recourse options when designing transformation pathways towards clean energy systems. Depending on the chosen risk metrics incorporated into objective functions or constraints, several approaches can be employed, including risk-neutral and risk-averse stochastic optimisation, robust optimisation, distributionally robust optimisation, and chance-constrained optimisation (Roald et al., 2023). These methodologies differ in their representation of uncertainty or ambiguity sets, how uncertainties propagate through the decision model, and their complexity in terms of implementation and computational requirements. Recent examples illustrating the use of stochastic optimisation in energy system modelling include case studies employing EMPIRE (Ahang et al., 2025;Backe et al., 2022) and the EMPRISE framework (Frischmuth et al., 2024;Schmitz et al., 2024). Evaluating resilience in integrated energy systems often reveals inherent contradictions, as certain resilienceenhancing solutions may simultaneously pose new challenges. Two notable challenges are briefly outlined below. 2020). Note that this is a schematic three-dimensional representation, whereas reality is multidimensional. Furthermore, the shown system pathway trajectories are non-exhaustive as other viable alternatives may exist. for incidents that adversely impact all three system performances: Is there a hierarchy among these dimensions? Specifically, does the recovery of one performance dimension take precedence over the others? Moreover, the interplay between these aspects remains ambiguous. How should technical, economic, and environmental performances be balanced or converted to achieve optimal outcomes? When assessing overall system performance, pivotal decisions must be made: Should each dimension be optimised individually, or should an integrated, holistic approach be adopted to achieve a balanced outcome? Deciding whether to optimise each dimension separately or adopt an integrated approach to balance all performance areas is crucial for resilient and sustainable energy system transformations. Integrated commodities refer to energy resources and technologies that are interconnected and coordinated to optimise energy production, distribution, and consumption. Key examples include natural gas, hydrogen, and electricity, all pivotal to modern energy systems. The interaction among these commodities offers both opportunities and challenges. On the one hand, hybridisation fosters flexibility across sectors. For instance, as electrification advances, electricity can address conventional demand in the electricity sector, power heat pumps in the heating sector, and serve as an energy source for electric vehicles in the transportation sector. Furthermore, integration enables cross-sectoral energy flows, where one commodity can supplement another, enhancing overall system adaptability (see Section 4.3). On the other hand, this interconnectedness also introduces vulnerabilities.
Periods of low renewable generation, such as extended low-wind and low-solar events (known as "Dunkelflaute"), can lead to substantial disruptions in electricity supply, potentially cascading across dependent sectors. Heating systems relying on electric heat pumps, electricity-driven industrial processes, and electrified transportation networks become vulnerable, exacerbating system risks. Therefore, integrating commodities effectively with the appropriate recourse options (recall Sections 4.2 to 4.4), despite its complexity, remains fundamental for resilient resilient system development planning. A central challenge for policymakers and system planners is understanding and quantifying the trade-offs between resilience levels and associated system costs. Clarifying these resilience-cost trade-offs is critical to making informed decisions about acceptable expenditure levels for enhanced system resilience. Figure 5 illustrates schematic examples of trade-offs between system resilience and system costs, highlighting that these relationships are complex and highly contextdependent. For illustrative purposes, various trade-off shapes are depicted, including exponential (green), S-shaped (orange), stepwise (grey), slow incremental (dark blue), and aggregate (light blue):

• Exponential cost increase: Here, costs rise sharply as resilience approaches its maximum, indicating that initial improvements are relatively affordable, whereas achieving near-maximum resilience becomes disproportionately costly. • S-shaped (logistic) curve: Initial resilience improvements require substantial effort with moderate costs. However, costs plateau after reaching a saturation point, reflecting diminishing returns beyond a certain resilience level. • Stepwise increase: Trade-off curves illustrate abrupt cost increases at specific resilience thresholds, likely corresponding to significant infrastructure investments or policy-driven decision points. • Slow incremental increase: In this scenario, resilience improvements lead to gradual and relatively steady cost increases, suggesting consistent returns on resilience investments. Understanding the factors that influence these different trade-off shapes is essential. Important questions include: How does the event type affect the cost-resilience relationship? How does the choice of absorptive, adaptive, or transformative resilience capacities impact the shape and steepness of the trade-off curve? A further critical aspect is determining political and societal acceptance of different resilience levels and associated costs. Policymakers must address what level of resilience is desirable or acceptable for each specific shock event or SBP, and what level of additional system cost is justified or politically feasible to achieve this resilience. Beyond individual disturbances and recourse actions, there is a critical need to understand potential aggregated trade-off curves. For instance, are there synergistic effects across multiple resilience measures? Are different resilience-enhancing actions complementary, creating efficiencies, or are they independent or even counterproductive? Addressing these complex questions requires more explicit political guidelines and a better quantitative understanding of how resilience and costs interact. Policymakers face the critical task of balancing immediate energy demands with long-term sustainability objectives. Effective policies must be adaptable to unknown and uncertain futures and ensure resilience amidst evolving energy systems (van Dorsser et al., 2018). Reviewing critical energy security and resilience concepts, we emphasise their importance in light of recent global events such as the pandemic, geopolitical conflicts, supply chain disruptions, and climate change impacts. The study highlights the need for a thorough understanding of these concepts to support the robustness of future integrated energy systems. Key contributions of this work include: I. Conceptual clarification: We provide a detailed review of existing definitions and interrelations between energy security, resilience, and related terms, enhancing clarity for policymakers and system planners to develop effective strategies. II. Classification of shock events and SBPs: We categorise system disturbances into shock events and SBPs, emphasising that shock events arise suddenly and unexpectedly, while SBPs evolve gradually, escalating in urgency over time. By providing examples, we demonstrate their distinct impacts on technical, economic, and environmental system performance, thereby enhancing the understanding of the unique challenges posed by these disturbances. We compile relevant recourse options across resilience capacity levels and system planning horizons. These options provide actionable strategies for enhancing the resilience of integrated energy systems. IV. Recommendations for energy system modelling: Many studies still rely on deterministic planning approaches that do not account for potential threats and hazards. We recommend more frequent integration of shock events and SBPs into future energy system planning to enhance resilience. Incorporating these uncertainties enables forward-looking decisionmaking, helping to mitigate potential disruptions and strengthen resilience in future energy systems. V. Clarifying resilience-cost trade-offs: We highlight the necessity for policymakers to better understand and quantify individual and aggregate trade-offs between resilience levels and associated costs. We recognise the need for clearer political guidelines regarding desired resilience levels and acceptable additional costs. Policymakers must define how much additional expenditure is justified to achieve a more resilient system. Our findings emphasise that incorporating threats and hazardous events into energy system planning is essential for resilience and avoiding high recourse costs. Policymakers should, therefore, ensure that their decisions are informed by energy system planning tools that effectively assess future uncertainties and their impact on energy security and resilience. Achieving this requires a mutual understanding: modellers need clear political guidelines, while policymakers depend on robust modelling analyses for informed decision making. Existing energy-only markets may not sufficiently incentivise for preparation against shock events or SBPs. Hence, additional mechanisms, such as capacity markets or targeted subsidies, should be explored to encourage adequate investment in resilience capacities and recourse options. As a critical next step, quantifying the desired resilience levels and acceptable cost thresholds is essential for informed, strategic planning. During the literature review, additional terms emerged that require definition and categorisation. While not the primary focus of this study, the following sections on efficiency, vulnerability and robustness provide contextual insights. The efficiency of an energy system is commonly defined as the ratio of energy demand to actual energy use (Kardaś, 2023). In the literature, efficiency is frequently referred to as one of several dimensions of energy security (e.g. in Ang et al., 2015;Esfahani et al., 2021;Fouladvand et al., 2024). However, in Kardaś (2023), it is categorised as a dimension of energy sovereignty. Regarding energy system's resilience, some studies (e.g. Brand, 2016;Zhou, 2023) suggest that efficiency and resilience may be at odds with each other. Vulnerability generally refers to the consequences of hazardous events (Izadi et al., 2021).
More specifically, energy vulnerability is defined as "the degree to which an energy system is unable to cope with selected adverse events and risks to fall into traps in economic, social, environmental and institutional terms" (Gatto and Busato, 2020;Gatto and Drago, 2020b). Mohanty et al. (2024) further classify energy system vulnerability into physical vulnerability, cyber vulnerability, and cyber-physical vulnerability. As noted in Aldieri et al. (2021), energy efficiency and resilience are expected to mitigate energy vulnerability. Robustness is defined as the ability of components to resist external and internal influences, ensuring that its structure and functionality remain intact during system during normal operation (VDE, 2020). The definition provided in Zhou (2023) expands on this definition, describing robustness as a "flexibility that enables the system to function properly even when the structure is broken or damaged". There is a consensus in the literature that robustness is not equal to resilience and vice versa (Hanke et al., 2021). Instead, Bitkom (2018) and Braun et al. (2020) argue that resilience is an overarching concept that extends beyond robustness. This distinction is further emphasised by the NIAC (2010), which identifies robustness as just one of several criteria contributing to resilience.