Contributions to improved risk and vulnerability assessment of critical infrastructure

Abstract

The aim of this thesis is to provide contributions to the assessment of critical infrastructure risk. In particular, the thesis gains insights as to how critical infrastructure is modelled, the role of such models in risk assessment and how to assess risks related to critical infrastructure. Various governments and scientific articles have proposed a variety of definitions of critical infrastructure. Some countries define critical infrastructure in terms of the service provided by the infrastructure. Other countries, however, define critical infrastructure in the context of societal function. In such cases, critical infrastructure comprises that which is needed to ensure a vital societal function is met. Broadly speaking, critical infrastructure is infrastructure that provides a service that is essential to some society, i.e. a country, region or organisation. Within modern society, many critical infrastructures are reliant on each other in order to perform effectively. Such interactions between the infrastructures are referred to as dependencies. The term ‘interdependent systems’ is used to refer to a group of infrastructures that interact or depend on each other. When modelling critical infrastructure with the aim of assessing the impacts of disruptions, it is important to account for the dependencies between different infrastructures and how these can cause the effects to cascade throughout the interdependent system. Network models are commonly used to represent infrastructure systems when simulating the effects of disruptions to infrastructure systems. A network consists of nodes and edges. When modelling infrastructure systems, the nodes represent important components within the system, and the edges, the connections or interactions between such components. Improving methods of assessing infrastructure that contain network models allows for a better assessment of the disruptions of various events that can have negative effects on infrastructure systems and, thus, the associated risk. Paper I reviews different methods that are used to modelinterdependencies between different systems, where the systems are represented as networks. The different methods are summarised into categories, based on the structural form of the model; previously, interdependencies were categorised based on the functionality of the dependency. The suggested categorisation of dependencies is twofold. The first is whether the network has full or partial dependency on another; that is, do all nodes in the network have dependencies, or does only a subset have dependencies? The second is whether a node depends on one and only one or multiple nodes in another network. The categories suggested can be referred to when developing models for a simpler way to provide information on how to model the dependencies than the functional categorisations previously suggested. Paper II investigates the topological properties of a network within an interdependent system that can be used to characterise the network’s robustness when an event causes an initial disruption within a network it depends upon. A variety of network sizes and levels of dependencies were explored to provide results that are generalisable to interdependent network systems. The results suggest the important topological properties that should be considered when developing new infrastructure systems or updating existing systems to improve the robustness of the infrastructure against the cascading effects of a disruption within an interdependent system. The topological properties found to be most important are those pertaining to the level of network redundancy. Although it is important to account for interdependencies when modelling infrastructure, it is equally important that the initiating event be modelled in a way that provides sufficient representation of the event. Paper III suggests an improved method of simulating spatial failures. Current methods simulate spatial failures by failing all components of a network within a specified area, with all components outside the affected area classed as functional. The method suggested in Paper III instead assigns a probability of failure to each component that is dependent on the component’s position in relation to the hazard. This provides a more realistic method of simulating spatial failures that is still relatively simple to simulate. Within the paper, the method was applied to independent network systems only, but it can easily be adapted for simulating spatial failures to interdependent systems. Paper IV develops a model of the dependent electric power and water system of St. Kitts. The aim of the paper is to show that the development of such a model is possible in a poor-data setting context. After developing the model, simulations of tropical storms were used to cause disruptions to the dependent system. These simulations supplied illustrations of how the model can be used to perform analyses that provide useful information when considering improvements to the system. Such analyses included identifying which components of the electric power system are most important to the water system and where best to incorporate redundancy measures such as back-up generators within the water system. Paper V explores the feasibility of Probabilistic Risk Analysis (PRA) of infrastructure systems. Although PRA aims to provide a complete description of the associated risk, it is not a method commonly used to assess infrastructure. Due to the complexity of modern infrastructure, to carry out a PRA of such systems requires a substantial amount of both time and data. Vast amounts of data can be collected in relation to infrastructure systems, but deciding which data is relevant when performing PRA can also add to the time taken to assess the system. The shortcomings of non-PRA methods currently used to assess infrastructure performance were also discussed. Common shortcomings of non-PRA methods included not considering the likelihood of the scenarios assessed and only considering a subset of the possible scenarios that can affect infrastructure systems. This provides information on how to extend current methods in order to improve critical infrastructure risk analysis.