To be able to address and adequately manage criticality, it needs to be assessed and evaluated. State-of-the-art is to integrate criticality into risk evaluation through the approximation of a risk aversion factor, e.g. as done by Swiss authorities. The aversion factor is a multiplier, which estimates the economic loss caused by cascading effects by multiplying direct damages with a logarithmic factor: the higher the damage potential of the event, the greater the multiplier (Bundesamt für Bevölkerungsschutz [BABS] 2008). However, this approach is solely based on the damage potential of the event and disregards the specific characteristics of extreme events which influence cascading effects. Therefore, this section discusses a novel approach to operationalise systemic criticality so it may contribute to a more case-specific risk evaluation. It also points out how the spatial manifestation of a, thus far, non-spatial concept may be addressed.
Conceptual operationalisation of systemic criticality
The German CI strategy states that “an infrastructure possesses a systemic criticality if it is of particularly high interdependent relevance due to its structural, functional, and technical positioning in the overall system of infrastructures.” (BMI 2009) Thus, systemic criticality reflects a system-internal perspective on CI as functional systems and their dependence on one another. The relevance of analysing systemic criticality increases as extreme events and other external hazards also affect the internal system of CI, potentially triggering cascading effects, which should be anticipated through adequate policies.
Methodology: operationalising systemic criticality
The operationalisation of systemic criticality faces several challenges. First, CI systems have an uncountable number of (inter-)dependencies. There are external dependencies of society on CI services, but more importantly, also internal (inter-)dependencies of CI systems relying on the services of other systems. For example, the water supply systems rely on electricity for the operation of pumps. The (inter-)dependencies and cross-sector services result in a tightly woven network of CI systems (Katina and Keating 2015; Pescaroli and Alexander 2015; Uday and Marais 2015) making them more than the sum of their parts (Vester 2015; Eusgeld et al. 2009).
Second, CI are bipolar as they are both physical and functional (service-providing) structures (Zimmerman et al. 2017; Katina and Keating 2015; Bouchon 2006). The functional characteristics of CI are hardly tangible as they are neither place-based nor do they operate within administrative boundaries (and legislative competencies of single stakeholders). However, their physical characteristics pose a challenge as well, because there is an unmanageable number of physical facilities and their components (Pinto et al. 2012).
Third, the CI system is dynamic. It continually evolves due to technological improvements and new dependencies making it unpredictable and never fully known (Zio 2016), as some characteristics of the system may only become apparent during an impairment or CI failure (Hellström 2007). These characteristics make CI a complex system-of-systems [sos] (Katina and Hester 2013; Eusgeld et al. 2011).
CI being a complex sos leads to challenges in the operationalisation, because established concepts like risk and vulnerability cannot address the systemic criticality of CI systems and subsystems (Katina et al. 2014; Hellström 2007; Bouchon 2006). There are again three reasons for this statement: First, classical risk approaches are probabilistic and rely on linear cause-effect relationships that do not exist in complex systems (International Risk Governance Council [IRGC] 2018; Libbe et al. 2018; Pinto et al. 2012, referring to Pinto et al. 2012). Therefore, no assertions about the probability of occurrence, extent of damage, and uncertainties (and hazards) can be made regarding system failures (Fekete 2011; Di Mauro et al. 2010; Hellström 2007). Furthermore, such parameters cannot illustrate what criticality actually means, namely positive and negative, relative relevance (Lukitsch et al. 2018; Engels 2018; Engels and Nordmann 2018). Second, risk and vulnerability are place-based concepts, but the CI sos is—at its core—of functional character (IRGC 2018). Third, (inter-)dependencies require “an assessment of […] the entire network of an infrastructure (e.g., electricity) and its potential cascading effects on other infrastructure systems” (Birkmann et al. 2016). Even if risk analyses were carried out for single facilities and their parts through systemic computational modelling, the system state and embeddedness in the greater sos could not be realised for more than a few directed dependencies, even with computational support (Eusgeld et al. 2009; Haimes 2009).
The complexity of the CI sos and the lack of approaches accounting for the systemic complexity of (inter-)dependencies (Katina et al. 2014) most often result in chronic underestimation of potential cascading effects (IRGC 2018; Eusgeld et al. 2011), which in turn results in incomplete and potentially misleading policies (Garschagen and Sandholz 2018; Bouchon 2006). Therefore, an approach capturing (inter-)dependencies between the subsystems of the sos is required to make systemic criticality measurable.
Approach of “systemic cascade potential”
The approach for operationalising systemic criticality presented in this paper stems from an ongoing PhD (Schmitt, H.C.) in spatial planning. The “systemic cascade potential” approach expresses the possibility and strength of a cascading effect potentially propagating through the CI sos over time. It encompasses the possibility and strength of cascading effects from a solely systemic, i.e. functional, system-internal, and non-spatial, perspective. It aims at uncovering the sos and its potential cascading effects under certain aspirations. First, the operationalisation approach shall be able to encompass the whole CI sos, its subsystems, and their connectivity as comprehensively as possible. Second, the sos shall be reduced in complexity so that it may be (resource-efficiently) transferred to different spatial levels and contexts. Thus, the approach needs to be generic.
Based on these aspirations, conventional interdependency analyses (e.g. Laugé et al. 2015; BABS 2010) are extended into two factors and four parameters, encompassing the individual CI subsystems and their interconnectivity. Factor 1 reflects the “relevance of subsystems” and is parameterised by the (inter-)dependencies of each subsystem to all others. The first parameter of factor 1, the “degree of subsector connectivity”, reflects on the number and the character (unidirectional or bidirectional) of dependencies. The second parameter “centrality” includes the type of dependency (direct or indirect) and the closeness centrality every subsystem has, based on its average path distance. Factor 2 focuses on the “relevance of dependencies” and is parametrised by the intensity of a potential cascading effect over time. Therefore, the third parameter measures the “intensity of a potential cascade” by approximation of the severity of potential impairments. The last parameter is the “propagation speed”, which reflects on the severity of potential impairments over time.
As Fig. 1 displays: Factor 1 is the product of the degree of subsector connectivity (sum of incoming and outgoing dependencies) and the centrality of the subsector in the sos (averaged, normalised path length, calculated in a network visualisation programme). Factor 2 is the product of the intensity of a potential cascade (average impact of outgoing dependencies) and the propagation speed (weighted disruption period causing severe impairments on average).
Application to a German national context
In order to apply this generic approach, which is scalable to any spatial level and context, some assumptions must be made. First, the investigated “subsystems” need to be defined. For an application on the German context, the 29 subsectors of the CI Strategy were used. Second, disruption periods need to be selected. These may vary with different research interests, and they were set to 4 h, 24 h, 4 days, 2 weeks, and 6 weeks within this context to reflect a broad spectrum of responsibilities and stakeholders. Last, the data collection method needs to be selected. In this case, online surveys collected responses from expert interviews.
Experts to be interviewed were selected following specific targeting criteria. First, the experts’ organisation had to represent an objective federal perspective and ideally possess competences related to CI. Consequently, most experts represented federal authorities or nationwide associations. Second, the targeted experts have expertise and experience in CI management. Based on these targeting criteria, experts were (deliberately) contacted via email with a personalised link to the survey of “their” subsector in the online tool SoSci-Survey. Due to reasons of anonymity and representativeness, there had to be at least three responses from each of the 29 subsectors (nmin = 87).
The survey was based on a fictional setting, assuming the impact of a sudden, total, nationwide failure of each and every subsector. The interviewee was exclusively asked about their particular portfolio. It encompassed three questions. The first two multiple-choice questions asked for the number of outgoing and incoming dependencies to gather the information required for factor 1. The third question investigated the intensity of (the previously selected) incoming dependencies for the five disruption periods through a visual analogue scale in order to gather the information for factor 2. Additionally, qualitative information was surveyed to interpret the results.
The survey took place within 8 days in spring 2019 with more than 100 experts participating. The obtained data allows for several analyses, e.g. for issuing subsector profiles contributing to a deeper understanding of single subsectors, but also the sos as a whole (e.g. through network and cascade diagrams). As this article focuses on the operationalisation of systemic criticality, Table 1 shows an excerpt from the calculation of the systemic cascade potential.
Results: measuring systemic criticality
A calculation of the systemic cascade potential becomes possible due to aggregation and averaging the survey data (parameters 1, 3, 4) and calculating closeness centrality through network analysis (parameter 2). Table 1 presents an excerpt of the calculation for the German CI subsectors.
The results show a great range between subsectors with the highest and the lowest systemic cascade potential, leaving electricity with about 80 times the systemic cascade potential compared to domestic shipping. These results may further be categorised, similar to the Swiss CI strategy (s. BABS 2010), prioritising systemic criticality and transferring it to suggestions for the worthiness of protection. The exact demarcation of categories is a normative decision.
Spatial operationalisation of systemic criticality
While criticality is not place-based, system-internal cascades still manifest themselves spatially. The question remains as to how the functional character of systemic criticality can be operationalised to be represented and translated into spatial models. The following section attempts to do just that by assessing the cascades following traffic interruptions following breaking branches and trees during extreme storms.
Methodology: sectoral assessment of the road network’s criticality
This method was developed during the BaumAdapt project, which is funded by the German Ministry for the Environment, Nature Conservation, and Nuclear Safety within the framework of the German Strategy for Adaptation to Climate Change. The project was conceptualised in the wake of storm Ela in June 2014, which ranks among the five most severe convective extreme events in Germany since 1980 (Munich RE 2019b). Traffic infrastructure was severely affected by the direct impact of the storm resulting in prolonged interruptions of road and rail traffic (Haering and Bösken 2014). The systemic criticality of road network segments can be considered to prioritise preventative actions, such as adapting the urban tree stock to evolving climatic conditions. As there was no approach to such an assessment, a new method was developed.
It analyses the systemic criticality of the municipal road network segments by evaluating the effects of selected traffic interruptions on the accessibility of critical facilities. The method applies a multi-step approach (s. Fig. 2) to assess the change of traffic load on routes between two coordinates in a city for various interruption scenarios. The coordinates of these origin-destination-relationships each consist of a critical facility and a residential building block. The method assumes that a network segment is the more critical, the more the traffic load increases and the greater the number of origin-destination-relationships it is relevant for. It utilises the traffic assignment problem: Travel time, and thus traffic load, is linked to individual route choices. These decisions depend on network congestion, which is a function of the choices of all other network users (Ukkusuri and Yushimito 2009). Traffic models attempt to solve this problem.
First, relevant origin-destination-relationships and realistic traffic interruption scenarios need to be selected. In the BaumAdapt project, this selection was made in a consultative process with municipal actors involved in disaster management and the maintenance of the urban tree population. Given the project context, the origin coordinates reflect facilities required for the response to the impact of a storm on urban trees and forests, which the interruption scenarios also reflect. These facilities represent other CI sectors, which could be adversely affected by service disruptions and delays within the transport network. The second coordinate of the origin-destination-relationships needs to be spread across the assessed area to analyse the accessibility of each critical facility from throughout the city. In the case of BaumAdapt, the most populous building block of each city district was used; thus, guaranteeing coordinates are spread out evenly. With five critical facilities selected and nine residential building blocks, 45 origin-destination-relationships were analysed in six scenarios during the project.
Second, a criticality analysis is run applying GIS-based network analysis and a traffic model. The optimal route between each building block and each critical facility is calculated for each scenario using the ArcGIS Pro Network Analyst (Esri 2020). These routes are used to identify the relevant network segments from the traffic model. A traffic model breaks the road network down into nodes, i.e. road junctions, and sections, i.e. the road segments between two junctions. Traffic is fed into this network through cells. Each cell contains statistical data relevant to traffic generation, e.g. number of residents or employees. Traffic gravitates between these cells based on the embedded data and generates traffic loads for each section (Helmert and Henninger 2017). A traffic simulation is run to generate traffic loads for the 0 scenario and all interruption scenarios. The 0 scenario describes a network without any road closures, thus free-flowing traffic without interruptions and delays. The applied traffic model only included the municipal road network. While external traffic flows are accounted for by cells, there are no nodes or sections outside the municipal borders. Based on the results of the network analysis and traffic simulation, all relevant traffic loads can be exported into a spreadsheet and compared to the loads of an uninterrupted network. This difference is one of the indicators applied to assess the criticality of road segments.
The final step concerns the criticality assessment. Based on the spreadsheet, the road segments most relevant in each scenario can be identified. This relevance originates from the increase of traffic load and the number of routes running over this network segment. Criticality increases, the higher the traffic load and the greater the number of routes. All scenario evaluations are compared as the validity of the assessment improves with the number of scenarios reflecting similar assertions. The validity further increases with a greater number of origin-destination-relationships and interruption scenarios. Additionally, the systemic cascade potential (s. 3.1) of each critical facility, which represents a CI subsector, should be considered in the criticality assessment to address additional system-internal cascading effects.
Results: the systemic importance of road network segments
The sectoral criticality assessment of the road network allows making assertions towards the systemic importance of a segment that is relevant for the accessibility of critical facilities. These are the network segments with an especially large increase in traffic load and that are part of multiple origin-destination-relationships. The validity of these assertions can be increased, the higher the number of simulated scenarios and the higher the number of origin-destination-relationships confirming them.
The analysis results show three network segments that have a comparatively higher systemic criticality than the rest of the network for three different reasons:
The primary connection between the south-eastern boroughs and the city centre is blocked, leading to an increased traffic load on the diversion route. At up to 15,000 more vehicles per hour, this is the highest increase on any relevant network segment.
The connection between the south-western boroughs and the city centre only shows a traffic load increase of up to 7000 vehicles per hour, which ranks among the medium values on the scale. However, it is a relevant network segment for twelve origin-destination-relationships, which is more than can be observed with any other segment.
The third segment is only relevant to connect to one critical facility and shows a medium-high traffic load increase of up to 6000 vehicles per hour. The reason for its high systemic criticality is the importance of the facility, which is accessed from the road, i.e. the municipal waste management company. Most heavy machinery to respond to the storm impact on the urban environment is stored there; thus, inaccessibility could start cascading effects affecting other sectors.
Which of the three indicators - traffic load increase, number of relevant origin-destination relationships, or the systemic cascade potential - ranks higher cannot be determined on the factual level and requires a normative decision.
Still, the sectoral analysis is limited and cannot operationalise the real complexity of the CI sos and its systemic criticality. It only considers the road network; thus, assertions towards systemic relevance can only be made regarding one subsector. The limitation is further determined by the boundaries of the spatial scope, as only the road network within the municipal boundaries is considered. However, the spatial scope can be scaled by applying a traffic model on a different scale. Albeit its limitations, this assessment indeed allows operationalising systemic criticality in its spatial context. Previous assessments of the transport network neglect the systemic component or only address facilities, such as tunnels or bridges, without considering the systemic criticality of the network itself (e.g. Ukkusuri and Yushimito 2009, Friedman et al. 2006). The method is further limited as it only addresses the first level of cascading effects from a storm-related interruption of the network. Further system-internal consequences cannot be operationalised through this approach and require consideration of the systemic cascade potential of sources and destinations. The result is evidence that can feed into decision-making processes and support the prioritisation of measures to prevent infrastructure service disruptions and making society more resilient to extreme weather along the way.
While criticality may be accounted for in analyses on the local or regional level, the question remains whether a result is eventually valid. CI networks and dependencies between subsectors do not end with administrative boundaries. Instead, they are deeply interconnected with the critical supply networks of national and supranational concern. This issue does not only concern the assessment of criticality but also how it is managed in the context of hydro-meteorological hazards as the following section explains.