Supply/demand interface for disaster resilience assessment of interdependent infrastructure systems considering privacy and security concerns

The ability to swiftly restore functionality following an extreme event is an essential characteristic of a disaster resilient infrastructure system. However, the restoration of functionality of a single infrastructure system often depends on the functionality of other systems that provide resources the considered system needs to operate and recover. Furthermore, infrastructure systems are crucial for the post-disaster functional recovery of the building stock of a community. Thus, community resilience assessment and improvement require a system-of-systems perspective, considering the post-disaster performance of several interdependent infrastructure systems and the building stock at the same time. One of the principal issues in resilience assessment and improvement is that such system-of-systems consideration may require detailed information on the vulnerability and recoverability of numerous components. While such information might be available for certain systems (e.g., housing), for others, the information might be unavailable due to privacy and security concerns (e.g., electric power supply systems or buildings housing important functions). In this paper, we propose a supply/demand interface between the system-of-systems simulator, defined within the interdependent Resilience - Compositional Demand/Supply (iRe-CoDeS) framework, and the individual infrastructure system simulators. Such an interface can be used for regional recovery simulation and resilience assessment of interdependent infrastructure systems, while allowing infrastructure system operators to maintain system’s privacy and/or security. We define a tiered supply/demand interface, where the amount of information provided by individual systems can range from system-level to component-level post-disaster evolution of resource supply and demand, assessed using expert opinion or confidential in-house models. The proposed supply/demand interfaces are illustrated in a semi-virtual case study, assessing the seismic resilience of North-East San Francisco, focusing on the effect of interdependent infrastructure on the functional recovery of residential buildings.


Introduction
Due to urbanization, infrastructure aging, and climate change, future disasters are likely to cause significant losses to communities worldwide (CRED and UNDRR 2020;WB 2023).Apart from direct losses resulting from building and infrastructure damage and the associated repair costs, a large portion of disaster losses is due to indirect effects, such as business interruption, infrastructure downtime, and outmigration (GFDRR and WB 2023;Toyoda 2008).Thus, swift post-disaster recovery of the built environment of the affected region is crucial for minimizing disaster losses.To that aim, numerous organizations worldwide are advocating for more resilient infrastructure systems, allowing the built environment to quickly restore its functionality following extreme events.Such efforts are aimed at reducing the post-disaster recovery time of interdependent infrastructure systems, minimizing their negative effects on the functional recovery of the building stock (FEMA/NIST 2021).
In the past two decades, researchers have been developing tools to analyze and improve infrastructure system's resilience (Alipour and Shafei 2022;Baroud et al. 2014;Didier Max et al. 2018;Hackl et al. 2018) and, more recently, evaluate their impact on building's functional recovery (Mohammadgholibeyki et al. 2023).A significant impediment to developing such models for practical use is the security and privacy concern of infrastructure managers that restrict or prevent access to the data needed to conduct the resilience analysis.Such data access restrictions are particularly problematic because infrastructure systems are interdependent and rely on each other to provide resources they need to operate (e.g., water supply system requires electric power to operate).Resources can be scarce after a disaster, causing cascading shutdowns usually not considered by managers of individual infrastructure systems.
Apart from data restrictions due to privacy and security concerns, models of individual infrastructure systems are often not mutually compatible and, thus, cannot be integrated within a system-of-systems models as their inputs and infrastructure performance metrics are different.Researchers developing models that consider interdependencies among infrastructure systems often model individual infrastructure systems in a simplified manner to reduce the complexity of such system-of-interdependent-systems models (Blagojević et al. 2022e;Buldyrev et al. 2010).Although research on coupling infrastructure simulators to consider their interdependencies is on-going (Portante et al. 2017), to the best of the authors knowledge, no standardized interface design between the individual infrastructure simulators and a system-of-systems model that allows the individual infrastructure simulators to dynamically interact with the system-of-systems model over the simulated post-disaster recovery process has been proposed to date.Thus, although advanced models for individual infrastructure systems have been developed and used in resilience assessment, their potential is often not fully utilized in system-of-systems modeling due to their incompatibility.
In this paper, we propose a supply/demand interface for integrated modeling of interdependent systems and the analysis of their effect on buildings' functional recovery.Such an interface aims to address two issues: (1) the privacy and security concerns of infrastructure managers; and (2) standardization of interfaces between infrastructure system simulators and system-of-systems models.The interface allows for dynamic exchange between the individual infrastructure systems simulators and the system-of-systems model at each time step of the recovery simulation, capturing the change in systems' interactions as they are recovering.The system-of-systems model can treat individual infrastructure simulators as black boxes; thus, different methods can be used to simulate individual systems, from expert opinion to GIS-or flow-based simulations, as long as their outputs are compatible with the information specified by the interface.Furthermore, the proposed supply/demand interface is tiered, depending on how much information infrastructure managers or infrastructure models share with the system-ofsystems model, addressing thereby the privacy and security concerns.
The proposed supply/demand interface is illustrated in a semi-virtual Case Study, by assessing the resilience of North-East San Francisco to a hypothetical Mw7.2 earthquake.The Case Study considers about 700 residential buildings and three interdependent infrastructure systems: the electric power supply system, the potable water supply system, and the cellular communication system.

iRe-CoDeS framework for resilience assessment of the built environment
The interface design is based on the iRe-CoDeS framework, which quantifies the resilience of a system by contrasting the supply, demand and consumption of resources provided by the system over time following a disaster.The system of systems (e.g., a city) is discretized into components that can belong to different subsystems (e.g., buildings from the building stock, pipes and pumps from the water supply system and power plants from the electric power supply system) and system-of-systems-level supply, demand, and consumption are obtained by aggregating component-level values.Components' supplies and demands change as their functionality changes due to initial damage and subsequent recovery.Thus, each component is viewed simultaneously as a supplier and as a user of resources, where the amount of resources supplied and requested by the component change as the component is recovering from damage.The recovery process is simulated using component's recovery model that can range from simple, single-activity, linear mathematical models (Blagojević et al. 2020) to more complex and integrated building-level recovery sequencing models (Blagojević et al. 2023).
The interaction among components is simulated as a flow of resources among components at each time step of the resilience assessment interval, accounting for the state of the distribution network, the dispatch/allocation strategies implemented by the network operator, and the technical and physical laws that govern the resource distribution.Resource flow simulation among components allows the components' consumption (i.e., the met demand) to be estimated as well as to capture component's interdependency effects: whenever component's demand for a certain resource it needs to operate (i.e., operation demand) is not fully met, its ability to supply resources to other components is decreased.By repeating the resource flow simulation within a time step of the resilience assessment interval until the system reaches a stable state, the iRe-CoDeS framework captures cascading effects among components (Blagojević et al. 2022).
Apart from considering resources a component needs to operate, the iRe-CoDeS framework can capture the effect of resource constraints and inaccessibility to repair on component's recovery, by considering component's recovery demand (Blagojević et al. 2022c).Such demand consists of all resources that a component needs to recover and can change as the component is going through different recovery activities: these can often be classified into the materials, machinery, and manpower needed for recovery.Analogous to capturing interdependency effect, resource constraints related to recovery are captured by simulating the flow of recovery resources among components and hindering the recovery of those components whose recovery demand is not fully met at a time step of the resilience assessment interval.
In an iRe-CoDeS model, the considered region is discretized into localities, geographically localized units that may contain components of different infrastructure systems, as well as different buildings that constitute the building stock of the considered region.The flow of resources among components and buildings within a locality is assumed to be unconstrained (i.e., the distribution networks within a locality are assumed to be fully functional after a disaster).To facilitate the flow of resource between localities, components that transfer the resources (i.e., infrastructure systems' links) need to be functional.Definition of a locality depends on the level of detail employed in the analysis and the spatial limits of the considered system.
The resulting system-of-systems-level resource supply, demand, and consumption evolution over the recovery period are used to assess system-of-system's resilience for a scenario disaster (Blagojević et al. 2020) or by considering the entire hazard curve (Blagojević et al. 2022b), and can be used to assess community resilience goals (Blagojević et al. 2022a).The principal resilience metric in iRe-CoDeS is Lack of Resilience (LoR) defined as the integrated unmet demand of a system, calculated as the difference between the system's demand and consumption for a certain resource over the resilience assessment interval.

Supply/demand interfaces for resilience assessment in the iRe-CoDeS framework
The iRe-CoDeS framework presented in the previous section requires component-level data to simulate component's supply/demand dynamics during the post-disaster recovery period.However, infrastructure or building managers might not be willing to share such data due to privacy and security concerns.Furthermore, more advanced models of individual infrastructure systems than the ones currently employed in the iRe-CoDeS framework have been developed recently, but are not yet implemented in the iRe-CoDeS framework (Klise et al. 2017;Thurner et al. 2018).The supply/demand interfaces proposed herein aim to solve these two issues simultaneously by defining how individual infrastructure simulators can be coupled with the iRe-CoDeS system-ofsystems model while considering the variable amount of information that the infrastructure managers are willing to share in the resilience analysis.
The main idea behind the supply/demand interface proposed herein is that the interaction among infrastructure systems during the post-disaster recovery period, and their effect on the functional recovery of the building stock, can be assessed by monitoring the supply and demand of infrastructure systems' services using the iRe-CoDeS system-ofsystems model that integrates different infrastructure system models/simulators.In essence, the definition of a component in the iRe-CoDeS framework is broadened such that an entire infrastructure system can be considered as a single component that provides supply and/or demand resources, without requiring in-depth information on that system.The inclusion of such large components is made possible using the proposed supply/demand interfaces.Thus, the iRe-CoDeS framework is extended by proposing three supply/ demand interface tiers to couple individual infrastructure system models with the iRe-CoDeS system-of-systems model (Fig. 1).
Tier 1 interface requires the information on resource supply dynamics from each infrastructure system model at the locality level, shown by the upward arrow in Fig. 1.Tier 2 interface additionally requires resource demand dynamics from infrastructure system at the locality level to capture system's dependency on resources provided by other systems, shown by upward and downward arrows in Fig. 1.Tier 3 interface requires detailed information on component-level supply and demand dynamics and connectivity needed to construct an iRe-CoDeS model of an infrastructure system (shown by the detail of system modeling in Fig. 1) and is, thus, identical to the original iRe-CoDeS framework briefly outlined in the previous section.
Although the supply/demand interfaces are designed to accommodate different levels of data accessibility, as more information is shared by the infrastructure managers or infrastructure system simulators, the capabilities of the iRe-CoDeS system-of-systems model increase.Tier 1 interface allows for assessment of infrastructure system's impact on buildings' functional recovery, but without considering the interdependencies among infrastructure systems, since the information on resources needed for the system to operate are not accessible.Not considering such interdependencies leads to an overly optimistic estimate of infrastructure system's performance after a disaster.Tier 2 interface enables considering the interdependency effects among infrastructure systems at the level of localities, without requiring extensive information on infrastructure system components, as shown in Fig. 1.However, limiting the information to localities limits the scope of resilience analysis.Tier 3 interface, which involves constructing an iRe-CoDeS flow-based model of each infrastructure system where the post-disaster supply/demand dynamic of each infrastructure system component as well as the flow of resources among components is simulated, requires the most detailed information but allows for an in-depth component-level assessment of infrastructure systems' performance.Such level of detail is needed to, for example, identify and rank components important for system and system-of-systems resilience (Blagojević et al. 2022d), or to conduct what-if analyses to identify the most effective resilience-improving actions (Blagojević and Stojadinović, 2022).However, structured iRe-CoDeS system-of-systems models can be complex and computationally demanding.It is important to note that Tier 1 and Tier 2 supply/ demand interfaces facilitate integration of third-party infrastructure system models into an iRe-CoDeS system-of-systems model.The third-party infrastructure system models may range from detailed in-house infrastructure system simulators, across open-source infrastructure system simulators, to surrogate models that may be derived from monitored system operation or even expert opinion.In-house infrastructure system models may employ their own interfaces to supply Tier 1 or Tier 2 supply/demand dynamics information (Fig. 1) while guarding their privacy and security.Finally, different tiers of the supply/demand interface among different infrastructure system models can be employed in the same iRe-CoDeS system-of-systems model.
Selection of an appropriate interface tier depends on the information that infrastructure system managers are willing to share with the system-of-systems model due to privacy and security concerns, on the capabilities of the employed infrastructure system simulators and the outputs they can provide to the iRe-CoDeS systems-ofsystems model, and the required level of detail of the system-of-systems resilience analysis.Compared to existing tiered approaches to resilience assessment (Giannopoulos and Galbusera 2016; Linkov et al. 2018), the tiered supply/demand interface presented here allows combining different tiers for interfacing different infrastructure systems within the same system-of-systems model while preserving a consistent format of resilience analysis outputs-change in resource supply/demand over time following a disaster.Thus, regardless of the tier employed to interface the infrastructure system, the outputs of the system-of-systems model can be used to assess resilience goals, post-disaster resource needs and the effect of infrastructure on buildings' functional recovery.

Case Study: Seismic resilience assessment of North-East San Francisco
A semi-virtual Case Study assessing seismic resilience of North-East San Francisco using an iRe-CoDeS system-ofsystems model that employs the proposed tiered supply/ demand interfaces is presented next.The Case Study considers about 700 residential buildings and three supporting infrastructure systems: the Electric Power Supply System (EPSS), the Potable Water Supply System (PWSS), and the Cellular Communication System (CCS).The considered scenario disaster is a hypothetical Mw7.2 earthquake with an epicenter on the San Andreas fault.
The initial post-earthquake building damage is estimated by attributing a damage state to each building conditioned on its fragility function and the intensity of the ground shaking at its location using the R2D Tool developed at the SimCenter (McKenna et al. 2022).The iRe-CoDeS framework extends the R2D Tools' computational workflow by simulating the recovery of damaged residential buildings while accounting for regional resource constraints.The recovery of each building is simulated as a sequence of recovery activities, such as damage inspection, permitting and repair, each requiring resources to progress (e.g., engineers, workers).At each time step of the recovery simulation, resources are distributed among the damaged buildings.The buildings whose recovery demand is met immediately progress with their recovery activities, while the recovery of remaining buildings' is delayed until the recovery resources become available.Simultaneously, the damaged components of the infrastructure (EPSS, PWSS, and CSS) systems are repaired, resume their functions, and contribute to the recovery of the systems and resolution of interdependencies.As buildings recover their safety and infrastructure system services, their ability to provide functional housing to the residents improves, increasing the regional supply of housing.The regional recovery simulation is probabilistic: the initial building damage states and duration of recovery activities are defined as probability distributions, making it possible to investigate the resilience of Case Study housing in a Monte Carlo simulation framework.Further details regarding the regional recovery model of the building stock are provided in Blagojević and Stojadinović (2022).Novelties introduced in this Case Study involve the consideration of interdependent infrastructure systems and their effect on buildings' functional recovery, as well as minor modifications to occupancy of high-rise buildings.
The principal novelty in this Case Study, however, is the exploration of the effect of different supply/demand interface tiers, introduced above, on the recovery simulation outcomes.In this Case Study, North-East San Francisco is discretized into five localities (Fig. 2).Such a simple discretization is adopted for illustration purposes.However, for practical purposes, an appropriate locality discretization should result from discussions with the infrastructure system managers and city stakeholders on the configuration of their supply systems and the housing demands.In this study, it is assumed that the information on individual buildings is available, and that their post-disaster performance can be simulated using a building-level iRe-CoDeS model (Blagojević and Stojadinović 2022).Such an iRe-CoDeS model evaluates the post-disaster change in buildings' demand for infrastructure systems' services due to their initial damage and the subsequent recovery through an organized repair process.
Buildings provide two types of services to the population: shelter and functional housing (Blagojević et al. 2022f).Occupancy of each residential building is estimated by calculating the total area of the building (plan area times the number of stories) and assuming that a single resident takes up 50 square meters, while limiting the total number of people in a building by 2000.Such occupancy represents a building's supply capacity for shelter and functional housing service.Shelter is provided by buildings that are safe to occupy and depends only on the building's damage.Following the earthquake, buildings in or above moderate damage state (Damage State 2) (FEMA 2020) are assumed to be vacated, and thus, cannot provide shelter services.Buildings with no (Damage State 0) or minor (Damage State 1) damage (FEMA 2020) are assumed to be habitable following the event, and thus, provide shelter to its residents.
Apart from being safe to occupy, this study assumes that the demand of the building's residents for infrastructure services needs to be met for that building to provide functional housing service, and thus, be in the functionally recovered state (FEMA/NIST 2021).The information provided through the supply/demand interfaces and the iRe-CoDeS resource distribution model is used to assess how much of each buildings' demand (i.e., the demand of its residents) for infrastructure systems' services can be met at each time step of the recovery simulation.Therefore, if at a time step of the recovery simulation the demand of a safe-to-occupy building for electric power, potable water and cellular communication can be met by the available supply, such a building is in the functionally recovered state and provides functional housing to its residents.
As residents leave the damaged buildings that cannot supply shelter service in the aftermath of the earthquake, the demand for electric power and potable water is reduced.The demand for shelter and functional housing (i.e., how many people would like to live in the region) is assumed constant following the earthquake (i.e., there is no outmigration).As buildings are repaired and can be occupied again, residents return, resulting in an increase in the demand for electric power and potable water.The demand for cellular communication is an exception, since the demand for this service is assumed to increase following the event due to emergency calls.It is measured in Erlang (Didier Max et al. 2018).The demand of each resident for electric power, potable water, and cellular communication is estimated at 20 kWh/day, 150 l/day, and 0.033 E/day, respectively.The demand of a building for infrastructure services is the product of its consumed shelter services (i.e., how many people are sheltered in the building) and the assumed needs of each resident for infrastructure services.
Table 1 presents the Tier 1 interface information that should be provided by infrastructure managers or infrastructure simulators to the iRe-CoDeS system-of-systems  2. The information includes the time that an infrastructure system needs to restore the supply of a certain amount of service to each locality.Such services are then distributed to buildings within a locality using the iRe-CoDeS utility resource distribution model (Blagojević et al. 2022e).For example, the EPSS provides 150MWh/day immediately following the earthquake and increases its supply capacity from 150 to 450MWh/day in 60 days as it is repaired.
Table 2 presents the additional information required to define the Tier 2 interface.It specifies the portion of the resources provided by other infrastructure systems each infrastructure system needs to operate in a locality.In this Case Study, the WSS and CCS require electric power to operate, while the EPSS is assumed to be independent of WSS and CCS services.It is assumed that if such demand is not met at a time step of the recovery simulation, the infrastructure system's supply is reduced to zero in that locality at that time step, thus, capturing the infrastructure interdependency effects.However, while the demand for infrastructure services from housing varies, the mutual demand for infrastructure systems' component for infrastructure services is assumed, for simplicity, to remain constant at pre-event levels throughout the recovery period.

Results and discussion
The outputs of a single realization of the probabilistic Monte Carlo regional recovery simulation of North-East San Francisco following the hypothetical Mw7.2 earthquake are presented next.The aim is to illustrate the outputs of the proposed iRe-CoDeS system-of-systems model that integrates the building stock model with three infrastructure simulators using the proposed supply/demand interfaces.The recovery of the building stock is simulated on a building level, while the effect of infrastructure systems on each other and the buildings' functional recovery is captured through the supply/demand interfaces at the level of localities.The outputs obtained using the Tier 1 and Tier 2 interface are presented herein, while an example of the Tier 3 interface for a virtual community is presented in (Blagojević et al. 2022e).
Following the earthquake, buildings in or above moderate damage state cannot be occupied, forcing their residents to leave such buildings, and reducing the regional supply of shelter services (Fig. 3).For example, the shelter capacity in Locality 1 drops from about 23,000 beds/day to about 12,000 beds/day due to building damage.As buildings are recovering from damage, they become safe to occupy and their shelter capacity increases.The supply and consumption of shelter services are identical, since it is assumed that as soon as buildings are safe to occupy and provide shelter services, such services are consumed (i.e., the residents move back into the building right away).About 1200 days following the scenario event, the shelter capacity is restored to the pre-event value, thus, meeting the entire shelter service demand of about 81,000 people residing in the region (i.e., in all five localities).The post-event evolution of shelter supply and consumption, presented using the Lack of Resilience (LoR) (i.e., unmet demand) graphs in Fig. 3, also dictates the demand for infrastructure services.In the presented iRe-CoDeS model, buildings that are unsafe to occupy and, thus, are vacated are assumed not to have any demand for electric power and potable water, as there are no residents in such buildings.This affects the regional demand for such infrastructure services during the recovery period.As buildings are repaired and are populated and functional again, the demand for infrastructure services increases and dictates the post-disaster change in the demand for electric power and potable water services in the considered region.The information obtained through the Tier 1 interface for the EPSS is presented in Fig. 4 using LoR graphs for each locality.Apart from electric power supply (Table 1), the demand imposed by the recovering building stock is also presented, enabling the assessment of electric power consumption and the effect of unmet demand for electric power on buildings' functional recovery.The supply of electric power in Locality 1 drops to 150MWh/day for the first 60 days following the event.Such a level of electric power supply is not sufficient to meet the entire demand of people residing in safe and functional buildings in Locality 1, which is about 240 MWh/day.After 60 days, the supply increases to the pre-event amount of 450 MWh/day, meeting the demand of all residents with a considerable supply margin of about 200 MWh/day.Such supply margin decreases as the building stock is recovered and residents repopulate buildings, but remains sufficient to meet the residents' demand.Similar analysis for Locality 2 shows that in the first 15 days after the scenario event, there is 30 MWh/day of unmet demand for electric power.Once the EPSS can provide 40 MWh/day, half of its pre-event supply capacity, the demand of people residing in Locality 2 is met and the EPSS is not inhibiting functional recovery of buildings in Locality 2 during the remaining recovery period.After 30 days, the EPSS in Locality 2 restores its supply capacity to the pre-event value of 80 MWh/day increasing the supply margin.Figure 4 also presents the supply/demand/consumption for electric power in the remaining three localities.The results are showing the first 120 days following the event, since within that time, the EPSS supply is restored to its pre-event level in all localities.As EPSS is not dependent on resources provided by other infrastructure systems (Table 2), interdependency effects do not impact its supply capacity in this Case Study under the adopted assumptions.
To illustrate the infrastructure interdependency effects, Figs. 5 and 6 present the potable water supply, demand and consumption per locality.Figure 5 presents the potable water LoR graphs computed using the iRe-CoDeS systemof-system model with Tier 1 interfaces, while Fig. 6 shows the potable water data computed using the iRe-CoDeS system-of-system model with Tier 2 interfaces.The post-event Fig. 3 Evolution of supply, demand, consumption for shelter services in the five North-East San Francisco localities simulated using the building-level iRe-CoDeS model supply dynamics in each locality corresponds to the information assumed to be provided by infrastructure managers presented in Table 1.By integrating such an interface with the iRe-CoDeS building stock recovery model, the post-event demand and consumption of potable water are estimated, assessing the impact of PWSS on the building stock's functional recovery.However, Tier 1 interface cannot capture the PWSS dependency on the EPSS (Table 2).As in certain localities (e.g., Locality 4), the EPSS has a longer restoration time than the PWSS, the PWSS cannot be supplied with sufficient electric power and cannot operate to supply potable water to the residents in safe-to-occupy buildings.This interdependency effect is captured using Tier 2 interfaces in the iRe-CoDeS system-of-systems model and can be observed by comparing Localities 2 and 4 in Figs. 5  and 6.If Tier 1 interface is used to integrate PWSS into the iRe-CoDeS model, the model estimates that the residents demand for potable water is fully met 10 days after the event in Locality 2 and 80 days in Locality 4.However, when Tier 2 interfaces are employed, the dependence of the PWSS on electric power is captured, showing that the resident's demand for potable water is met only once the EPSS in these localities start supplying electric power, on day 15 in Locality 2 and day 100 in Locality 4. In other localities (e.g., Locality 1), the dependence of the PWSS on electric power has no effect on potable water supply, as the EPSS restores its supply capacity before the PWSS and can meet the PWSS electric power demand.Therefore, although Tier 1 interface requires less data than Tier 2 and, thus, allows for a higher level of privacy as information on infrastructure system's demand is not needed, the results obtained using the Tier 1 interface do not capture the interdependency effects among systems, resulting in a trade-off between accuracy and preserving privacy and security of infrastructure systems.
The LoR graphs for functional housing service provided by buildings that are safe to occupy and have access to a sufficient amount of electric power, potable water, and cellular communication, computed using the iRe-CoDeS model with Tier 2 interfaces, are presented in Fig. 7 for each locality.The supply of shelter services, shown in Fig. 3, and functional housing service differ only in the first 100 days following the scenario event, as all infrastructure systems are restored in, at most, 100 days (Table 1).After 100 days, the supply of functional housing is identical to the supply of shelter and infrastructure systems are not hindering the functional recovery of the building stock.
The outputs of the presented iRe-CoDeS system-of-systems model can be used to evaluate community resilience Fig. 4 Evolution of supply, demand, consumption for electric power in the five North-East San Francisco localities simulated using the iRe-CoDeS system-of-systems model with Tier 1 interfaces goals (Blagojević et al. 2022a; FEMA/NIST 2021).The iRe-CoDeS system-of-systems model can compute the percent of population that has access to functional housing in each locality over the recovery period, an important community resilience goal.For example, in Locality 2, it took about 780 days to meet 90% of demand for functional housing services.In comparison, more than 90% of demand for functional housing service is met in about 100 days for Locality 5, and in about 960 days for Locality 3. The insufficient infrastructure services did not impact the attainment of the functional housing resilience goal in Localities 2 and 3, as the building damage was the governing factor, not the unmet demand for infrastructure services.However, in Locality 5, the lack of available infrastructure services hindered the functional housing supply, as in Locality 5, more than 90% of residents could be sheltered in safe-to-occupy buildings immediately after the earthquake.This is observed when comparing the provision of shelter services and functional housing per locality in Figs. 3 and 7, respectively.
Finally, the iRe-CoDeS system-of-systems model recovery simulation results can be aggregated across all localities to evaluate the resilience goals related to the entire considered region (Fig. 8).More than 90% of demand for functional housing is met about 780 days (i.e., about 2 years) after the earthquake.

Conclusion
Resilience assessment considering infrastructure interdependencies is crucial for assessing and improving community resilience and buildings' functional recovery.However, the access to infrastructure system data is often restricted due to privacy and security concerns, hindering an integrated system-of-systems resilience analysis.Furthermore, existing infrastructure system models are often incompatible in terms of the data they provide and the dynamics they can handle.Herein, we propose a tiered supply/demand interface between the individual infrastructure system models and the iRe-CoDeS system-of-systems model.This interface is based on evaluating the supply and demand of infrastructure systems for various resources during the post-disaster recovery period.At each time step of the recovery simulation, the flow of resources among interdependent infrastructure Fig. 5 Evolution of supply, demand, consumption for potable water in the five North-East San Francisco localities simulated using the iRe-CoDeS system-of-systems model with Tier 1 interfaces systems is simulated to achieve two goals: first, assess user's consumption and as a result assess community resilience goals, and second, capture systems' interaction, by reducing the system's ability to operate or recover conditioned on their resource demand fulfillment.
To accommodate infrastructure manager's privacy and security concerns, we propose three tiers of the supply/ demand interface, conditioned on the information that the infrastructure managers are willing to share in the systemof-systems resilience analysis.The least data-intensive interface tier, Tier 1, requires information on the post-disaster change in infrastructure system's ability to supply resources at the locality level over the post-disaster recovery period.Apart from locality-level supply dynamics, Tier 2 interface requires the information on the resources that the infrastructure system needs to operate, allowing for locality-level interdependency analysis among infrastructure systems.Tier 3 interface is the most data intensive, requiring componentlevel information to simulate the change in component's resource supply and demand over the post-disaster recovery period and capture interdependencies at the more granular, component, level, allowing for better targeted resilienceimproving actions.
Apart from addressing the privacy and security concerns, the proposed supply/demand interface can be used to integrate third-party infrastructure simulators into an iRe-CoDeS system-of-systems model.The interface allows the system-of-systems model to treat the individual infrastructure system models as black boxes, while still allowing for their interactions to model the interdependency effects.The system-of-systems model may use different interface tiers for different infrastructures systems, simultaneously allowing for nuanced handling of sensitive information and for integration of models of different complexity and capabilities, ranging from complex in-house infrastructure system models to surrogate models based on expert opinion.Therefore, different complexity infrastructure simulators can be employed in the same iRe-CoDeS system-of-system model, while providing consistent outputs in terms of post-disaster resource supply/demand dynamics that can be used to capture the change in the demand for infrastructure services, estimate the effect of infrastructure on building's functional recovery, and assess community resilience goals.
Although tiered resilience assessment methods have been proposed in the literature, to the best of the authors knowledge, no tiered interface between the individual infrastructure simulators and the system-of-systems model that allows for dynamic interdependency analysis during the post-disaster recovery period has been proposed to date.The proposed supply/demand interfaces are illustrated using a semi-virtual case study where the resilience of North-East San Francisco to a scenario earthquake is analyzed.Despite based on several assumptions and partially using virtual data, this Case Study illustrates the data requirements to construct the iRe-CoDeS system-of-systems model coupled with infrastructure simulators using the proposed supply/demand interfaces.Furthermore, the Case Study shows how the supply/demand interfaces can be used to assess the effect of interdependent infrastructure on buildings' functional recovery and assess whether the community can meet its resilience goals.The results illustrate the effect of varying levels of data accessibility on the simulation outputs, showing that in certain cases, employing the Tier 1 interface can overestimate system's post-disaster performance, as the system's dependencies on other systems are not accounted for due to data inaccessibility.Sharing data on system's dependencies at the locality level using the Tier 2 interface resolves this issue.By carefully assessing the benefits of sharing data with a system-of-systems simulator using the supply/demand interfaces and addressing privacy and security concerns, infrastructure managers can make informed decisions that strike a balance between enhancing resilience assessments and safeguarding the privacy and security of their systems and stakeholders.
However, the application of the proposed system-of-systems resilience analysis is limited to modern communities with planned recovery procedures and the capacity to ensure a coordinated recovery effort, as it assumes an organized post-disaster recovery process with clearly defined buildinglevel recovery procedures and requires detailed data on the  building stock.Furthermore, the proposed model is used in a scenario-based resilience analysis, thus, requiring the disaster scenario definition, as well as the appropriate hazard and vulnerability models to assess the initial damage of buildings and inform infrastructure system simulators.In addition, as the recovery process is simulated over time, the infrastructure simulators integrated in the iRe-CoDeS system-of-systems model using the supply/demand interfaces have to explicitly consider time in their recovery analysis.Finally, such a scenario-based iRe-CoDeS system-of-systems resilience analysis can be computationally demanding.

Fig. 1
Fig. 1 Tiered supply/demand interface for integrating infrastructure systems into an iRe-CoDeS system-of-systems model.Tier 1 interface requires the information on resource supply dynamics from each infrastructure system model at the locality level.Tier 2 interface additionally requires resource demand dynamics from infrastructure

Fig. 2
Fig. 2 Five North-East San Francisco localities in the iRe-CoDeS system-of-systems model used in the Case Study

Fig. 6
Fig. 6 Evolution of supply, demand, consumption for potable water in the five North-East San Francisco localities simulated using the iRe-CoDeS system-of-systems model with Tier 2 interfaces

Fig. 7
Fig. 7 Evolution of supply, demand, consumption for functional housing in the five North-East San Francisco localities simulated using the iRe-CoDeS system-of-systems model with Tier 2 interfaces

Fig. 8
Fig. 8 Evolution of supply, demand, consumption for functional housing in the entire North-East San Francisco region simulated using the iRe-CoDeS system-of-systems model with Tier 2 interfaces

Table 1
Tier 1 interface specifying the level of supply provided by each infrastructure service to each locality as it evolves during the recovery period following the Case Study scenario earthquake All values are theoretical and used for illustrative purposes