In This Issue
Engineering for the Threat of Natural Disasters
March 1, 2007 Volume 37 Issue 1

Critical Infrastructure, Interdependencies, and Resilience

Thursday, March 1, 2007

Author: T.D. O’Rourke

Resilient physical and social systems must be robust, redundant, resourceful, and capable of rapid response.

The concept of critical infrastructure is evolving. In the 1980s, concerns about aging public works led the National Council on Public Works Improvement (1988) to focus on infrastructure in the public sector, such as highways, roads, bridges, airports, public transit, water supply facilities, wastewater treatment facilities, and solid-waste and hazardous-waste services. In the 1990s, as a result of increased international terrorism, infrastructure was redefined in terms of national security. After 9/11, the number of “critical” infrastructure sectors and key assets listed in the National Infrastructure Protection Plan was expanded to 17 (DHS, 2006). The list includes agriculture and food systems, the defense-industrial base, energy systems, public health and health care facilities, national monuments and icons, banking and finance systems, drinking water systems, chemical facilities, commercial facilities, dams, emergency services, nuclear power systems, information technology systems, telecommunications systems, postal and shipping services, transportation systems, and government facilities.

Adjusting the definition to reflect current concerns has provided for flexibility and adaptability but has also led to some ambiguities about which assets are critical and which criteria should be used to define them. In addition, the proliferation of critical-infrastructure sectors has added complexity to an already complex field. To develop basic principles that govern performance and clarify interactions, it is helpful to consolidate our thinking into unifying concepts and a smaller number of sectors based on common traits.

The concept of a “lifeline system” was developed to evaluate the performance of large, geographically distributed networks during earthquakes, hurricanes, and other hazardous natural events. Lifelines are grouped into six principal systems: electric power, gas and liquid fuels, telecommunications, transportation, waste disposal, and water supply. Taken individually, or in the aggregate, all of these systems are intimately linked with the economic well-being, security, and social fabric of the communities they serve. Thinking about critical infrastructure through the subset of lifelines helps clar-ify features that are common to essential support systems and provides insights into the engineering challenges to improving the performance of large networks.

Lifeline systems are interdependent, primarily by virtue of physical proximity and operational interaction. Consider Figure 1 [see PDF version for figures], for example, a photograph of the corner of Wall Street and Williams Street in New York City in 1917. The congestion shown in this photograph has not improved in the last 90 years, and similar locations can be found in a multitude of cities worldwide. Critical systems in crowded urban and suburban areas like these are subject to increased risk from proximity. Damage to one infrastructural component, such as a cast-iron water main, can rapidly cascade into damage to surrounding components, such as electric and telecommunications cables and gas mains, with system-wide consequences.

To complicate matters, much of this critical infrastructure is underground, which obscures the location and condition of components. The proximity of aging, weakened pipelines to other important facilities, such as high-pressure gas mains and electric power substations, is frequently not recognized, increasing the potential for unanticipated accidents for which no preparations have been made.

Lifeline systems all influence each other. Electric power networks, for example, provide energy for pumping stations, storage facilities, and equipment control for transmission and distribution systems for oil and natural gas. Oil provides fuel and lubricants for generators, and natural gas provides energy for generating stations, compressors, and storage, all of which are necessary for the operation of electric power networks. This reciprocity can be found among all lifeline systems.

The use of electric power at pipeline pumping stations is especially important. After Hurricane Katrina, the supply of crude oil and refined petroleum products was interrupted because of a loss of electric power at the pumping stations for three major transmission pipelines: the Colonial, Plantation, and Capline Pipelines. As a result, major lines of refined products were not available for delivery to southern and eastern states, and gasoline and diesel production in the Midwest was seriously affected by lack of supply. About 1.4 million barrels per day of the crude oil supply were lost, accounting for 90 percent of the production in the Gulf of Mexico. Nearly 160 million liters per day of gasoline production was lost, accounting for 10 percent of the U.S. supply. The three major pipelines were not fully restored until September 14, 2005, more than 17 days after Katrina made landfall in southern Louisiana.

Similar difficulties have been experienced at water-supply pumping stations. After the 1994 Northridge earthquake, electric power was lost for nearly 24 hours in the Van Norman complex, which receives and treats about 75 percent of the potable water for the city of Los Angeles. As a result, the largest water pumping station in the city system could not be operated.

A smaller station where pumps were activated by combustion engines made up for some of the loss. Note, however, that the amount of fuel that can be stored on site at pumping stations, even facilities equipped with combustion engines, is often restricted by environmental regulations. Thus, if fuel runs out, refueling depends on the transportation system, which is also likely to be damaged and difficult to negotiate after a disaster.

The World Trade Center Disaster
The World Trade Center (WTC) disaster has been studied in detail with respect to structural failure, building performance, and the impact of fire on building integrity. WTC also has lessons for lifeline performance and interdependencies. When the twin towers collapsed, water mains servicing the WTC complex were ruptured primarily by falling debris and impact. Records of water flow to the WTC area and nearby neighborhoods show that immediately after the buildings collapsed, water flow suddenly increased by 210 million liters per day, then rose gradually another 30 million liters per day (O’Rourke et al., 2003). The initial jump was caused by water pouring through broken water mains beneath and around the WTC complex. The additional flow represents, approximately, the amount of water drawn from fire hydrants to fight fires in adjacent buildings. Water pressures at hydrants around the WTC complex declined throughout the afternoon. Measurements at 6:00 p.m. showed pressure two to three blocks from the site at approximately one-third of normal. Of course, firefighting was impaired by the falling pressure.

The primary source of water at the WTC complex was fireboats on the Hudson River. Figure 2 is an aerial view of the WTC site, showing the deployment of four fireboats (Firefighter, McKean, Kane, and Smoke II). The tie-up locations and hose paths are shown for each boat. Although the combined pumping capacity of the fireboats was 180,000 liters per minute, only a small fraction of that, approximately 28,000 liters per minute, was conveyed to the WTC complex, partly because the water was relayed through relatively small hoses (90-mm and 125-mm-nominal-diameter) (O’Rourke et al., 2003). Nevertheless, water from the fireboats was about 150 percent of the water available from hydrants and was critical to containing and extinguishing fires on the site.

Water from the ruptured underground pipelines flowed into the underground sections of the WTC complex and flooded the Port Authority and Trans-Hudson (PATH) tunnels beneath the Hudson River. PATH trains had transported commuters from Exchange Place Station on the New Jersey side of the Hudson to the WTC Station in the WTC underground complex. Exchange Place Station, which is approximately 6 meters lower in elevation than the WTC Station, was also flooded.

Water flooded the cable vault of the Verizon building at 140 West Street, where 70,000 copper pairs and additional fiber optic-lines had been severed by falling debris. Nearly 41,600 cubic meters of water had to be pumped from the vault during recovery. The seventh and ninth floors of the telecommunications building also sustained water damage.

The capacity of the telecommunications office at 140 West Street had been one of the largest in the world. The building housed four digital switches, 500 optical-transport systems, 1,500 channel banks, 17,000 optical fiber lines, 4.4 million data circuits, and 90,000 message trunks. As a result of the damage and flooding, Verizon lost 200,000 voice lines, 100,000 private branch exchange lines, 4.4 million data circuits, and 11 cell sites. More than 14,000 business and 20,000 residential customers were affected.

The WTC disaster provides a graphic illustration of the interdependencies of critical infrastructure systems. The building collapses triggered water-main breaks that flooded rail tunnels, a commuter station, and the vault containing all of the cables for one of the largest telecommunication nodes in the world. These included the Security Industry Data Network and the Security Industry Automation Corporation circuits used to execute and confirm block trades on the stock exchange. Before trading resumed on the New York Stock Exchange on Monday, September 17, 2001, the telecommunications network had to be reconfigured. Hence, ruptured water mains were linked directly with the interruption of securities trading and the restoration of international financial stability.

Resilience is defined in Webster’s Unabridged Dictionary as “the ability to bounce or spring back into shape, position, etc., after being pressed or stretched.” Definitions vary slight, but they all link the concept of resilience to recovery after physical stress.

Since Hurricane Katrina, there has been a notable shift in emphasis from protecting critical infrastructure to ensuring that communities are resilient. When translating new ideas or concepts that connote a particular quality, such as resilience, into policy and implementation in the real world, we must remain mindful of the human dimensions of communities, which cannot be easily adapted or convolved into concepts based on the recovery of physical entities.
In addition, the concept of resilience, like the concept of critical infrastructure, is evolving. In its current form, the resilience of a community is an overarching attribute that reflects the degree of community preparedness and the ability to respond to and recover from a disaster. Because lifelines are intimately linked to the economic well-being, security, and social fabric of a community, the initial strength and rapid recovery of lifelines are closely related to community resilience.

Debate is likely to continue about the concept of resilience, and refinements and elaborations of the term are to be expected. Engineers and social scientists at the Multidisciplinary Center for Earthquake Engineering Research (MCEER) have proposed a framework for defining resilience (Bruneau and Reinhorn, 2007; Bruneau et al., 2003). According to Bruneau et al. (2003), resilience for both physical and social systems can be conceptualized as having four infrastructural qualities:

    • Robustness: the inherent strength or resistance in a system to withstand external demands without degradation or loss of functionality.
    • Redundancy: system properties that allow for alternate options, choices, and substitutions under stress.
    • Resourcefulness: the capacity to mobilize needed resources and services in emergencies.
    • Rapidity: the speed with which disruption can be overcome and safety, services, and financial stabil-ity restored.
As illustrated in Figure 3, an infrastructural quality, such as robustness, Q(t), can be visualized as a percentage that changes with time. For buildings, Q(t) may be the percentage of structural or functional integrity. For lifelines, Q(t) may be the percentage of customers with water or electric power. Prior to a natural hazard, severe accident, or terrorist act, Q(t) is at 100 percent. If the system is fully resilient, it remains at 100 percent. Total loss of service results in 0 percent Q(t). If system disturbance occurs at time t0, in response to an earthquake or hurricane, for example, damage to the infrastructure may reduce the quality to less than 100 percent. Level of service, as reflected by the robustness of the system, is a function of the probability and consequences of damage. Robustness is restored over time; at time t1, the system is returned to its original capacity.

For a community, loss of resilience, R, can be measured as the expected loss in quality (probability of failure) over the time to recovery, t1 – t0. Thus, mathematically, R is defined as:

The resilience factor, R, is a simple measure for quantifying resilience. Additional mathematical developments of this concept addressing the probabilistic and multidimensional aspects of resilience are explained elsewhere (Bruneau and Reinhorn, 2007).

Figure 3 can be expanded to three and four dimensions to quantify the effects of resourcefulness and redundancy. The three-dimensional expansion, illustrated in Figure 4, has a third axis that quantifies the capacity to mobilize necessary resources and services in emergencies. As the level of activated resources increases, the time for recovery is reduced. In Figure 4, the initial loss of quality remains the same for purposes of illustration, but in a real event, mitigation activities and strengthening would raise the level of initial quality, and the metric for the loss of resilience, R, would be reduced.

In some cases, a community may not return to pre-disaster levels after a major disaster. After Hurricane Katrina, for example, only about 40 percent of the original population had returned to Orleans and St. Bernard’s parishes as of August 2006. If New Orleans does not recover to pre-Katrina levels, the resilience factor would not converge, reflecting the severity of Katrina’s impact. If some restoration actually exceeds original quality levels, the definition of R would remain unchanged, and additional enhancements in quality would be assessed through related metrics.

The resilience framework also addresses the technical, organizational, social, and economic dimensions of infrastructure. Each intersection of the matrix in Table 1 has examples of technical, organizational, social, and economic activities that support the qualities of a resilient community. Robustness, for example, is considered in terms of technical dimensions, such as building codes and retrofitting procedures. Robustness is linked organizationally to emergency personnel and operations planning, and socially through the preparedness and vulnerability of different neighborhoods. Robustness is further related to the economic diversification in a given community or group of communities.

TABLE 1 Matrix of Resilience Qualities with Examples Pertaining to the Technical, Organizational, Social, and Economic Dimensions of Infrastructure
RobustnessBuilding codes and construction procedures for new and retrofitted structuresEmergency operations planningSocial vulnerability and degree of community preparednessExtent of regional economic diversification
RedundancyCapacity for technical substitutions and “work-arounds”Alternate sites for managing disaster operationsAvailability of housing options for disaster victimsAbility to substitute and conserve needed inputs
ResourcefulnessAvailability of equipment and materials for restora-tion and repairCapacity to improvise, innovate, and expand operationsCapacity to address human needsBusiness and industry capacity to improvise
RapiditySystem downtime, restoration timeTime between impact and early recoveryTime to restore lifeline servicesTime to regain capacity, lost revenue
Source: Kathleen Tierney, director of the Natural Hazards Center, University of Colorado at Boulder, personal communication.

The Human Dimension
The human dimension of community resilience is expressed in the organizations responsible for lifeline systems and in the communities that receive services and resources from them. Community characteristics have a significant effect on resilience, especially the levels of vulnerability and preparedness. Average income, economic growth, level of awareness, and local politics, for example, have significant repercussions on critical infrastructure and disaster preparedness. These human factors set the stage for innovation and initiatives in building robust systems and implementing programs that can speed recovery.

Promoting Resilience
Resilience can be promoted in several ways: by awareness, leadership, resource allocation, and planning. Each of these is discussed briefly below.

Resilience requires public concern about disasters and the operation of critical infrastructure, which, in turn, requires public education. Children can be educated effectively about hazards and environmental concerns at the K–8 level. The national network of some 350 science museums and centers can also help with education and outreach. These institutions are ideally suited to raising awareness of scientific and engineering issues with children, primarily at the K–8 level, and their families.

Public education also involves media coverage via newspapers and television. Thus journalists and news reporters must understand the critical issues, which, in turn, requires that engineers and scientists be able to articulate principles and factual information clearly and effectively. Meaningful public education requires ongoing commitments by both the technical community and the media.

Risk communication is also important to public awareness. An example of effective risk communication is the naming of hurricanes, which identifies and personalizes the hazard. In this way, the danger is made tangible and transparent to people who might be in the path of destruction.

Local professional societies can also contribute significantly to risk communication. For example, the Earthquake Engineering Research Institute (EERI), an organization of professionals in engineering, the geosciences, and social sciences, regularly advocates seismic safety at the local and national levels. The Northern California Chapter of EERI conducted and participated in seminars, news conferences, and news events to promote seismic upgrades for the Bay Area Rapid Transit System (BART). EERI’s efforts were instrumental in generating the votes to pass a $980 million bond issue for the seismic retrofitting of BART.

Leadership is a critical factor in promoting resilient communities. Consider, for example, the actions of Mayor Eugene Schmitz of San Francisco, who presided over what is regarded as a corrupt and ineffective city government at the time of the 1906 earthquake. Schmitz ordered that looters in the aftermath of the earthquake be shot, thereby setting in motion “one of the most infamous and illegal orders ever issued by a civil authority in this country’s history” (Fradkin, 2005). He also allowed the widespread dynamiting of buildings, which triggered fires that added to the conflagration that followed the earthquake. As a result, 490 blocks of the city burned to the ground, the worst single loss from fire in the United States.

Contrast Schmitz’s actions with those of Mayor Rudolph Guiliani of New York City, who led a highly visible and effective response to the WTC disaster. Guiliani was able to galvanize emergency operations, despite the loss of the city’s emergency operation center and the deaths of many fire chiefs and police personnel in the initial hours of the disaster.

Leadership is, perhaps, the most critical factor in promoting resilience, and also the least predictable. However, we know that effective leaders require good advice. Thus the engineering and scientific community must be prepared to communicate accurate, timely information to governmental officials.

Planning for emergencies requires drills and emergency-response exercises, which can reveal weaknesses and lead to improvements in operations. The plan that emerges from any particular exercise, however, is not as important as the planning process itself, because as soon as a disaster unfolds, the reality of the event diverges from the features of even a meticulously designed scenario. With good planning, however, emergency managers and lifelines operators can improvise, and skilled improvisation enables emergency responders to adapt to field conditions.

Significant advances have been made in high-performance computational models that can simulate complex networks. These models put out highly graphic, detailed scenarios that enable modelers and associated emergency personnel to visualize a wide range of responses from an entire lifeline system to a specific part of that system.

Figure 5 is an example of complex simulations of the water-distribution network operated by the Los Angeles Department of Water and Power (LADWP) and its response to a scenario 6.9 magnitude earthquake on the Verdugo Fault in northeast Los Angeles. Figure 5a shows the peak velocity that would be experienced throughout the operating area. Figure 5b identifies functional and non-functional pipelines and pinpoints the locations where water demands cannot be satisfied.

This computer model, which was developed at Cornell University in collaboration with LADWP and MCEER, simulates all 12,000 kilometers of distribution and trunk pipelines and related facilities in the water-supply system. The model includes a special code that accounts for unstable flow in the damaged hydraulic network and is equipped with a library of 59 scenario earthquakes that can be simulated to enable study of water-supply performance in response to different seismic events. System performance can be assessed for a particular earthquake, or the seismic risk can be aggregated and evaluated for all 59 scenarios.

By running multiple scenarios, with and without modifications of the system, operators can identify recurrent patterns of response and develop an overview of potential performance, helping them plan for many eventualities and improving their ability to improvise and innovate in the event of a real temblor.

Resource Allocation
Constructing and sustaining critical infrastructure requires both adequate financial resources and a long-term commitment to finishing complex projects. Consider, for example, the New York City water supply, which is delivered by City Water Tunnel 1 (commissioned in 1917) and City Water Tunnel 2 (commissioned in 1938). The state of repair of these tunnels can only be inferred from indirect evidence because neither can be dewatered for inspection.
A third water tunnel is crucial to providing an alternative path so that each of the first two tunnels can be taken out of service, inspected, and repaired. In fact, no project is more critical to the well-being and security of New York City.

The construction of City Water Tunnel 3 began in 1970 and is scheduled for completion in 2020 at an estimated total cost of $6 billion. The new tunnel will require nearly 100 kilometers of tunneling over a period of five decades. This project is indicative of the size, financial requirements, and time frame associated with many critical infrastructure projects.

Developing resilient communities with appropriate critical infrastructure requires awareness through education and risk communication, strong, innovative leadership, effective planning, and the long-term commitment of resources to put complex systems into place. At first glance, these requirements do not appear to be directly associated with engineering and technology. However, all of them must be informed by accurate, up-to-date science, technology, and information made possible by partnerships and networks among communities, governments, and scientists and engineers.

The author thanks the National Science Foundation for its support of the research reported in this article under Award ECC-9701471 to the Multidisciplinary Center for Earthquake Engineering Research.

Bruneau, M., and A. Reihorn. 2007. Exploring the concept of seismic resilience for acute care facilities. Earthquake Spectra 23(1), in press.
Bruneau, M., S. Chang, R. Eguchi, G. Lee, T. O’Rourke, A. Reinhorn, M. Shinozuka, K. Tierney, W. Wallace, and D. von Winterfelt. 2003. A framework to quantitatively assess and enhance the seismic resilience of communities. Earthquake Spectra 19(4): 733–752.
DHS (U.S. Department of Homeland Security). 2006. National Infrastructure Protection Plan. Available online at:
Fradkin, P.L. 2005. The Great Earthquake and Firestorms of 1906. Berkeley and Los Angeles, Calif.: University of California Press.
National Council on Public Works Improvement. 1988. Fragile Foundations: A Report on America’s Public Works. Final Report to the President and Congress. Washington, D.C.: Government Printing Office.
O’Rourke, T.D., A.J. Lembo, and L.K. Nozick. 2003. Lessons Learned from the World Trade Center Disaster about Critical Utility Systems. Pp. 269–290 in Beyond September 11th: An Account of Post-Disaster Research. Special Publication 39. Boulder, Colo.: Natural Hazards Research and Applications Information Center.
O’Rourke, T.D., A.J. Lembo, L.K. Nozick, and A.L. Bonneau. 2005. Resilient infrastructure: lessons from the WTC. Crisis Response 1(4): 40–42.
About the Author:T.D. O’Rourke is the Thomas R. Briggs Professor of Engineering at Cornell University and an NAE member.