Modeling flood induced interdependencies among hydroelectricity generating infrastructures

Journal of Environmental Management 90 (2009) 3272–3282

Contents lists available at ScienceDirect

Journal of Environmental Management journal homepage: www.elsevier.com/locate/jenvman

Modeling flood induced interdependencies among hydroelectricity generating infrastructures S. Sultana*, Z. Chen Department of Building, Civil, and Environmental Engineering, Concordia University, 1455 de Maisonneuve Blvd. W., Montreal, Quebec, Canada H3G 1M8

a r t i c l e i n f o

a b s t r a c t

Article history: Received 30 August 2008 Received in revised form 23 March 2009 Accepted 2 May 2009 Available online 30 June 2009

This paper presents a new kind of integrated modeling method for simulating the vulnerability of a critical infrastructure for a hazard and the subsequent interdependencies among the interconnected infrastructures. The developed method has been applied to a case study of a network of hydroelectricity generating infrastructures, e.g., water storage concrete gravity dam, penstock, power plant and transformer substation. The modeling approach is based on the fragility curves development with Monte Carlo simulation based structural–hydraulic modeling, flood frequency analysis, stochastic Petri net (SPN) modeling, and Markov Chain analysis. A certain flood level probability can be predicted from flood frequency analysis, and the most probable damage condition for this hazard can be simulated from the developed fragility curves of the dam. Consequently, the resulting interactions among the adjacent infrastructures can be quantified with SPN analysis; corresponding Markov Chain analysis simulates the long term probability matrix of infrastructure failures. The obtained results are quite convincing to prove the novel contribution of this research to the field of infrastructure interdependency analysis which might serve as a decision making tool for flood related emergency response and management.  2009 Elsevier Ltd. All rights reserved.

Keywords: Infrastructure Interdependency Extended Petri net Fragility curves Flood hazard Markov Chain Emergency management

1. Introduction Flood occupies the highest rank among the natural disasters regarding the adverse impacts they impose on the regional infrastructures (Istomina et al., 2005). Disruptions of multiple infrastructure systems in the City of New Orleans USA and in Europe for flood hazard resulted mainly due to the complex interactions among the interdependent infrastructures (Leavitt and Kiefer, 2006; Rahman, 2005). Works had been done before on the risk assessment of single independent infrastructures whereas studies on the interdependent risk assessment are very few and it is imperative to address this issue for representing the real scenario of overall vulnerability. This paper proposes and applies a novel modeling method of vulnerability assessment and cascading infrastructure interdependency analysis for assisting the related emergency management in decision making. Interdependencies among multiple infrastructures connected as a ‘system of systems’ can significantly increase the overall complexity due to the change in the system(s) (Rinaldi et al., 2001).

* Corresponding author. Present address: Department of Civil Engineering and Applied Mechanics, McGill University, Montreal, QC, Canada. Tel.: þ1 514 298 7569. E-mail address: [email protected] (S. Sultana). 0301-4797/$ – see front matter  2009 Elsevier Ltd. All rights reserved. doi:10.1016/j.jenvman.2009.05.019

A number of approaches had been explored for the quantitative analysis of infrastructure interdependency. A mathematical framework of Markov–Semi Markov model had been used to estimate the infrastructure performance (Nozick et al., 2005). Ezell et al. (2000) developed a systematic probabilistic model to simulate the expected and extreme risks for a water infrastructure system with event tree-fault tree analysis. Based on the Leontief economic model, Haimes and Jiang (2001) developed an infrastructure input–output model to demonstrate the degree of intra and inter-connectedness of the critical infrastructures. Pederson et al. (2006) listed the ongoing modeling studies which are intended to develop software for simulating the infrastructure interdependency in any specific region. Some important studies among them are: agent based infrastructure modeling and simulation, critical infrastructure modeling systems, the critical infrastructure protection decision support system, distributed engineering workstation, fast analysis infrastructure tool, interdependent energy infrastructure simulation system, multi-network interdependent critical infrastructure program, net-centric effects based operations model, network security risk assessment model tool, critical infrastructure integration modeling and simulation, etc. However, there is no work done based on the integrated network analysis and vulnerability assessment which is intended to be addressed in this paper.

S. Sultana, Z. Chen / Journal of Environmental Management 90 (2009) 3272–3282

Network based analysis has become increasingly popular in studying the behavior of the interconnected engineering infrastructures. For example, Petri net is a system analysis method introduced by Carl Adam Petri in early 1962 (Petri, 1962). Gursesli and Desrochers (2003) used Petri net for identifying the qualitative vulnerabilities of the infrastructures in a network system. In addition to the basic Petri net model, extensions had been incorporated to capture the stochastic time duration associated with an event; in response, stochastic Petri net (SPN) model had been introduced (Ramchandani, 1974). Later, Zuberek extended that study to illustrate the viability of the methodology for practical applications (Zuberek, 1985, 1987, 1991). Few other applications of SPN had also been reported. Petri net based coordination mechanisms were performed for multiple workflows (Raposo et al., 2000). A simple ‘Generalized Stochastic Petri net’ was introduced to identify common mode faults for modeling cascading failures of critical infrastructures (Krings and Oman, 2003). However, Petri net model had never been applied for examining the flood induced interdependencies among critical infrastructures which is the main agenda of this paper. Issues of infrastructure interdependency are directly related to the environmental or economical risks. For the infrastructure risk analysis, fragility curves development approach had been practiced widely. Hwang et al. (2000) presented application of the fragility model for evaluating the seismic damages of bridges and highway systems. Chock (2005) developed fragility curves of Hawaii residential buildings using a hurricane damage database. Infrastructure vulnerability assessment with fragility curves development for a national scale flood risk analysis was discussed by Hall et al. (2003). The objective of this paper is to introduce the development of an integrated modeling approach to study the vulnerability of an infrastructure system and the consequent cascading effects. Especially, flood hazard and its impacts on the related hydroelectricity generating infrastructure systems consisting of the water storage concrete gravity dam, penstock, power plant, and transformer substation will be addressed. The frequency of a certain flood level will be determined with the flood frequency analysis. To develop the fragility curves of the gravity dam for assessing its vulnerability, hydraulic and structural modeling will be performed; interdependencies among the interconnected infrastructures following the disruption of the dam from flood hazard will be simulated through the construction of a network based SPN model and corresponding Markov Chain generation. This integrated model will yield the probability matrix of infrastructure vulnerability which might help the emergency management system for decision making such as prioritizing the rehabilitation of the critical infrastructures. The development of the method and its application are demonstrated in next sections.

3273

and structural modeling associated with Monte Carlo simulation to convey the information about the vulnerability of dam for different flood levels. Considering the most probable hazard condition, the cascading impacts on the interconnected infrastructures can be captured through the development and analysis of a network based model, such as SPN; further analysis of the corresponding Markov Chain simulates the long term probability of the infrastructure failure. The framework of the new integrated modeling analysis is shown in Fig. 1.

2.2. Fragility curves development Definition of basic damage states, corresponding fragility curves and conditional probabilities for estimating damage matrices were discussed before (Filliben et al., 2002). Fragility curve is defined as a mathematical expression that represents the conditional probability of reaching or exceeding a certain damage state of an infrastructure at a given hazard level. Fragility curves can be developed empirically with damage database and analytically with structural failure modeling. In this paper, the analytical fragility curves development of dam will be presented. In this approach, the outputs of the structural–hydraulic modeling of dam for flood hazard will be used as the inputs of the fragility model. The steps of the analysis include, [i] Classifying the damage states of the dam, e.g., sliding, overturning, cracking, overtopping; [ii] Structural and hydraulic modeling of the dam with the Monte Carlo simulation of the uncertain design parameters for a certain value of water level; [iii] Calculating the exceeding probabilities of the damage states; [iv] Repeating the same analysis for different water levels; [v] Developing the analytical fragility curves with the water level in X-axis and the corresponding damage exceeding probability in Y-axis.

Modeling components

Fragility analysis of the critical water infrastructure for flood hazard

Flood frequency analysis

Development of Petri net model of the interconnected infrastructures

Model validation by structural analysis of the developed Petri net model

2. Development of a network based vulnerability modeling approach: fragility curves, flood frequency and Petri net analysis

Extended Petri net analysis and Markov Chain development

2.1. Modeling framework According to Moselhi et al. (2005), the critical infrastructure systems can be represented as nodes in a network where they are connected through a set of links representing the logical relationships among them. In this network system, failure of one node affects the functioning of the interconnected node(s). With this concept, the cascading impacts throughout the network can be assessed. Therefore, vulnerability assessment of infrastructures can be combined with a network analysis to study the safety of interconnected infrastructure systems. In this study, a set of fragility curves will be developed for the gravity dam using the hydraulic

Probability of failure of the critical water infrastructure

Safety assessment of the network infrastructures

Overall vulnerability of the network infrastructures

Decision support system for emergency management Fig. 1. Modeling of floodplain infrastructure interdependency.

3274

S. Sultana, Z. Chen / Journal of Environmental Management 90 (2009) 3272–3282

2.2.1. Classifying the damage states The damage states can be classified into structural and non structural categories. For the structural failure modeling of the dam, three damage states can be classified as following, [i] Sliding of dam due to the frictional resistance at the intersection plane of the dam and foundation; [ii] Overturning of dam against its toe; [iii] Cracking of dam due to tension in the dam base when resultant force acts outside of the middle half of dam. The non structural damage condition is the overtopping of the dam, since, even the structural damages are not attained for dam overtopping condition, hazard might come from the inundation of the downstream infrastructures. In this analysis, for the sliding and overturning failure modes, factor of safety greater than 1 is desirable for retaining a safe condition. The inverse of the factor of safety is used in this study as an indicator of the risk when its value exceeds 1. For the tension cracking, it is checked whether the resultant force acts in the middle half of the dam base; if this condition is not met, a risk condition is implied. All the damage states will be investigated with and without considering the drainage criteria. Generally, drainage system is provided into a dam to significantly reduce the uplift pressure. However, non drainage condition will also be addressed in this study to simulate the hazards in case the drainage service is failed due to any unintended reasons. 2.2.2. Structural–hydraulic modeling of dam Structural–hydraulic modeling of the dam is conducted with the following modeling equations (Linsley and Franzini, 1992; Ellingwood and Tekie, 2001; Novak et al., 1990):

Mo ¼ Hh *xh þ u*xu

(1)

MR ¼ Wc *xc þ Hv *xn

(2)

Rv ¼ Wc þ Hv  u

(3)

2.3. Flood frequency analysis In hydrology, statistical frequency analysis is applied for predicting the probability of extreme flood events. Magnitude and frequency of extreme flood events are estimated from the highest flood events recorded in each year over a series of years (Subramanya, 2001). According to the Gumbel’s distribution concept, if the highest flood level in a given year is a variate and the flood annual series constitutes a series of highest flood levels, x, then,

xT ¼ x þ K*sx

where, xT ¼ random hydrologic series data with a return period T; x; sx ¼ mean value and standard deviation of x; respectively; T ¼ inverse of the probability of occurrence P; K ¼ frequency factor.

2.4. Petri net analysis Petri net had been applied to study the behavior of concurrent, asynchronous, distributed, parallel, non deterministic, and/or stochastic systems (Murata, 1989). A basic Petri net structure C can be described as a seven-tuple, C ¼ (P,T,I,O,A,w,B), where, P stands for place, T for transition, I for input function, O for output function, A for arc connecting P–T, w for arc weight expressing the number of arcs, and, B for inhibitory place. The existence of the characteristic of a place is indicated by the presence of token. One important structural property of the basic Petri net enables the determination of the place invariant by the incidence matrix, C. A place invariant is the set of places in which the weighted sum of the tokens remain constant for all markings (Murata, 1989). It was shown that the minimal place invariants of a Petri net are capable of representing the interdependencies among the interconnected infrastructures (Gursesli and Desrochers, 2003). The incidence matrix has the dimension m * n if the numbers of places and transitions are m and n, respectively. If the place invariant ‘y’ is a m * 1 column vector, then, solution of ‘y’ is given by the following equation,

C T *y ¼ 0 M  Mo e ¼ R Rv

(4)

Hw3 ¼ Hw2 þ Kd *ðHw1  Hw2 Þ

(5)

For the sliding failure along the intersection plane of the dam and foundation, it is assumed that there is no bond between them, only frictional resistance is existing; then it can be written that,

Ff ¼ m*Rn FSs ¼

Ff Hh

(6)

(7)

Here, e ¼ eccentricity; Ff ¼ friction force along the intersection plane of dam and foundation (kN/m); FSs ¼ factor of safety for sliding along the intersection plane; Hh, Hn ¼ hydrostatic pressure at the horizontal face and vertical face of dam, respectively (kN/m); Hw1, Hw2, Hw3 ¼ hydraulic head at the upstream, downstream and drainage line, respectively (m); Kd ¼ coefficient of drainage; Mo, MR ¼ overturning and righting moment, respectively (kN-m/m); Rn ¼ normal force on the intersection plane (kN/m); u ¼ uplift pressure (kN/m); Wc ¼ weight of gravity dam (kN/m), calculated by multiplying the concrete unit weight with the volume of dam; xc ¼ distance of the center of gravity of dam from its toe (m), the other similar notations indicate the corresponding distances m ¼ coefficient of friction along the intersection plane.

(8)

(9)

where, CT is the transpose matrix of C. Transition expressing the occurrence of an event is characterized by instantaneous time in basic Petri net model whereas it is more realistic for such problems to be characterized by stochastic time distribution which can be addressed by applying a SPN model (Bobbio, 1990). The SPN model states that, in a timed Petri net, each transition takes a positive time to fire (occurrence of an event) and the firing time is an exponential random variable (Zuberek, 1985). This paper adapts the related theory of SPN analysis from Zuberek (1991). SPN analysis is performed to depict the reachability graph which indicates all the possible markings for a specific initial marking condition. The resulting reachability graph from this analysis can be used to generate the corresponding Markov Chain, analysis of which simulates the steady state of the Petri net (Bobbio, 1990). The flowchart of the model execution is given in Fig. 2. 2.4.1. State transition probability and Markov Chain For SPN analysis, if state sj is directly tk reachable from state si, the transition probability,

  rðt Þ*ni ðtk Þ q s i ; sj ¼ P k rðtÞ*ni ðtÞ

(10)

t˛T

where, r ¼ a firing rate function which assigns firing rate r(t) to each transition ‘t’; n ¼ a firing rank function indicating the number of active firings for each transition.

S. Sultana, Z. Chen / Journal of Environmental Management 90 (2009) 3272–3282

B ¼ N*R

Inputs: initial marking, transition rates

(15)

The proposed integrated infrastructure interdependency modeling approach is further delineated with a case study of flood impacts on the hydroelectricity generating infrastructures in a floodplain area. In summary, the fragility curves of the dam will show the probability matrix of its various hazard conditions, the flood frequency analysis will predict flood probability, the SPN model will simulate the cascading impacts for dam disruption and the corresponding Markov Chain analysis will show the long term failure trend of the vulnerable infrastructures.

Starting the firing of the enabled transitions for initial marking state

State transition probability (equation 10)

New marking states

3275

Enabled transitions for each of the new states

3. Case study on the integrated modeling of flood induced infrastructure interdependency and safety assessment Firing of the enabled transitions

3.1. An overview of the study system The developed integrated modeling methodology is applied to a case study of hydroelectricity generating infrastructures network consisting of concrete gravity dam, penstock, hydraulic power plant, and transformer substation. In this study, infrastructure interdependency for the flood with a return period of 100 years will be investigated. Interrelationships among these infrastructures are briefly stated below towards the development of a Petri net model; some of the information are taken from a study by Robert (2004).

Transition probability matrix

Markov Chain development and analysis (equation 11 – equation 15)

Safety assessment Fig. 2. Stochastic Petri net analysis algorithm.

The transition probability matrix is used to generate the corresponding Markov Chain. Theory of Markov Chain can be found elsewhere (Howard, 1971; Kemeny et al., 1974); therefore, only a brief description is given here. Markov Chain is developed with a transition probability matrix, Tr with probability entries, which come from Equation (10), summing up to 1. It represents a sequence of probability vectors p0, p1, p2, ., pn and, following general relationship can be obtained:

pn ¼ p0 *Trn ;

n ¼ 1; 2; 3; .

(11)

where, p is called a steady state vector if the state vectors pn get closer and closer to p as n increases. The entries of p are the long term probabilities of the Markov Chain states. If any absorbing state is present in the Markov Chain, they can be separated from transient states according to the following canonical form:

Q Tr ¼ . 0

« « «

R . I

(12)

where, I, 0, Q, and R are the identity, zero, transient and remaining matrix, respectively. The fundamental matrix,

N ¼ ðI  Q Þ1

(13)

where, N indicates the expected number of times in transient states before being absorbed for starting at different states. If ti be the expected number of steps before the chain is absorbed, given that the chain starts in state si, and let t be the column vector, then,

t ¼ N*c

(14)

where, c is a column vector all of whose entries are 1. If bij is the probability that an absorbing chain will be absorbed in the absorbing state sj if it starts in the transient state si, and, B is the matrix with entries bij, then,

3.1.1. Gravity dam Concrete gravity dam in a floodplain area is built to store reservoir water for various purposes. Reservoir water from upstream side is delivered to the downstream area with pipelines. When dam is flooded or collapsed due to a high flood flow, it causes invasion of floodwater into the adjacent floodplain area. Besides, high pressure from floodwater leads to the rupture of water carrying penstock. Inundation from floodwater causes malfunction or failure of the power plant and substation infrastructures. 3.1.2. Penstock A penstock is a pipe conduit with large diameter used to deliver the reservoir water to the turbines of hydroelectric power plant to cause rotation. For controlling the water flow, penstock is equipped with valves or gates. Sudden malfunction of valves/gates halts the water supply to the turbines and the power plant needs to be shutdown. 3.1.3. Power plant The power plant consists of the turbines, shafts, and generators. Water supplied by the penstock falls from a high head on the turbines and the connected shafts rotate moving the generator with a high speed to produce electricity which is transmitted to the transformer substation. Any damage or failure of the generator impedes the supply of electricity to the substation. Also, if the generators are not capable of receiving the rotation, the penstock operation has to be stopped. Thus, the downstream infrastructure failure also induces the upstream infrastructure shutdown. 3.1.4. Transformer substation The transformer substation infrastructure consists of transformer and overhead lines. Main functions of a substation are adjusting the voltage of the produced electricity received from the power plant and sending it to the users in remote places. Electricity supplied from the substation is vital for operating the penstock valves-gates. If the substation equipments are damaged, it cannot

3276

S. Sultana, Z. Chen / Journal of Environmental Management 90 (2009) 3272–3282

absorb the produced electricity; consequently, the turbines have to be stopped to avoid any accidental risks.

3.2. Modeling and results 3.2.1. Analytical fragility curves development of the dam For developing the analytical fragility curves of the dam, the hydraulic–structural modeling of dam with Monte Carlo simulation using Equations (1)–(7) is performed; the model outputs are used to generate the probability matrix of different damage states for different water levels. The schematic of the hydroelectricity generating gravity dam is shown in Fig. 3. In this study, the Monte Carlo simulation is carried out to address the uncertainties of the model. The uncertain parameters and the range of their random values are listed in Table 1. The classified structural and non structural damage states are investigated considering the uplift pressure with and without the drainage condition (‘Dr’ and ‘No Dr’, respectively) if they are attained for certain water levels. The Monte Carlo simulation analysis renders the exceeding probabilities of the defined damage states. The developed analytical fragility curves of different damage states are shown in Fig. 4. Here, the water level is measured from the dam base, and the flood levels and the flood levels are measured from the dam base and dam top, respectively. Fig. 4 provides the fragility curves of the structural damage states with and without considering the drainage condition; also, the overflow probability is shown as 1 when dam height is surpassed by the rising water level. In this study, slight probability is expressed as 1% and full probability as 100%. As shown in Fig. 4, probability of sliding with drainage condition has slight probability at the flood level of 1.75 m and reaches to full probability at the flood level of 4.7 m; for non drainage condition, the risk occurs in the range of lower water levels (28 m–30.8 m). For overturning of dam, provision of efficient drainage system delays the probability of hazard occurrence, rendering the slight and full probability for flood levels ranging between 7.25 m and 9.1 m; however, no drainage condition lowers the range to 3.75 m–5.4 m flood levels. The range for cracking hazard in the dam base from ‘tension’ with drainage condition is 2.75 m–4.2 m flood levels and with no

4m 5m

1

1.3 25 m

Table 1 Random values of the dam design parameters for Monte Carlo simulation. Parameters

Range

Concrete unit weight, gc Drainage coefficient, Kd Friction factor, m

22–23.6 kN/m3 0.35–0.45 0.8–0.9

drainage condition, it is 30 m water level to 1.3 m flood level. When water level exceeds 30 m, the dam is overtopped. The model results show that the dam is in higher risk for sliding and tension cracking than overturning. The implication is that physical overturning is not realistic, rather, the hazard poses risk through the other types of failures, such as sliding, tension cracking, etc. (Novak et al., 1990). Also, the results show that provision of drainage system into the dam vastly reduces the hazard possibility. 3.2.2. Flood frequency analysis The flood frequency analysis has been done with the Gumbel’s distribution method (Subramanya, 2001) according to Equation (8). The results are shown in Table 2. The simulated flood frequency results show that a flood with 50 years return period will overtop the dam. In this study, a flood level of 100 years is a matter of concern; also, as a conventional practice, it is assumed that the drainage system is provided into the dam. From the flood frequency analysis and fragility curves, it is evident that a 100 years flood with 1.406 m flood level will overtop the dam but no structural damage states will be attained. As a result of overtopping, the hydroelectricity generating infrastructures will be inundated and their functioning will be hampered due to their interdependency. The consequences will be modeled by the Petri net and Markov Chain analysis in the next sections. 3.2.3. Petri net modeling of flood induced infrastructure interdependency For developing the Petri net model of the study system, the places and transitions are defined accordingly. The conditions or states of the infrastructures are characterized as ‘places’, the events of impacts or disruptions as ‘transitions’, occurrence of an event as ‘firing’, and retaining a condition is denoted with ‘token’. The places–transitions and the transition firing rates are listed in Tables 3 and 4. The developed Petri net model of the study system is shown in Fig. 5. Here, ‘D’ stands for gravity dam, ‘P’ for penstock, ‘PP’ for power plant, and, ‘S’ for transformer substation. Initially, there was no hazard, so, place 1 has a token. Also, before the occurrence of any hazard, each infrastructure was functioning, that is, place 2 through place 5 have no tokens. However, in this model, dummy places (place 6 through place 13) with tokens have been incorporated to carry out the analysis correctly and to avoid the self loop problem which is a precondition of place invariant analysis (Murata, 1989). As a result, the initial marking is (Fig. 5),

M0 ¼ 1

23.23 m Fig. 3. Cross section of the case study dam.

0

0

0

0

1

1

1

1

1

1

1

1

The network execution starts with the dam overflow event which is deterministic. Further, the effects of dam overflow on penstock, power plant, substation and their interactions will be simulated; however, contributions to the water level increments from the penstock and spillway shutdown are not considered in this study.

S. Sultana, Z. Chen / Journal of Environmental Management 90 (2009) 3272–3282

3277

Sliding (Dr)

Overturning (Dr)

Tension (Dr)

Sliding (No Dr) Overflow Condition

Overturning (No Dr)

Tension (No Dr)

1 0.9

Probability of exceedence

0.8 0.7 0.6 0.5 0.4 0.3 0.2 0.1 0 27

28

29

30

31

32

33

34

35

36

37

38

39

40

Water level (m) Fig. 4. Analytical fragility curves of the case study dam.

3.2.3.1. Structural property: invariant analysis. For this model, the incidence matrix is,

p1 p2 p3 p4 p5 p6 C ¼ p7 p8 p9 p10 p11 p12 p13

t1 1 1 0 0 0 0 0 0 0 0 0 0 0

t2 0 0 1 0 0 1 0 0 0 0 0 0 0

t3 0 0 0 1 0 0 1 0 0 0 0 0 0

t4 0 0 0 0 1 0 0 1 0 0 0 0 0

t5 0 0 0 1 0 0 0 0 1 0 0 0 0

t6 0 0 1 0 0 0 0 0 0 1 0 0 0

t7 0 0 0 0 1 0 0 0 0 0 1 0 0

t8 0 0 1 0 0 0 0 0 0 0 0 1 0

t9 0 0 0 1 0 0 0 0 0 0 0 0 1

According to Equation (9), four place invariants are identified in the network (Table 5). 3.2.3.2. Result interpretations and the model validation. From the place invariant analysis of the developed Petri net model, four

Table 2 Flood frequency analysis by Gumbel’s method. T (year)

P ¼ 1/T

Water level, xT (m)

2 10 25 50 100 200 500 1000

0.5 0.1 0.04 0.02 0.01 0.005 0.002 0.001

27.067 28.998 29.97 30.69 31.406 32.119 33.059 33.77

minimal invariants (IP1 through IP4) are found, which simulate the infrastructure interdependency in the study system as following, [1] IP1 interprets that the number of tokens flowing between place 1 and place 2 is always 1 throughout the simulation of the model, i.e.

Mðp1Þ þ Mðp2Þ ¼ 1 Examining the model, it is noticed that, Dam overflow (place 2) results from the occurrence of high water flow in the reservoir (place 1). [2] IP2 gives, M(p5) þ M(p8) þ M(p11) ¼ 2 This simulation indicates that the substation is disrupted (place 5) if it is inundated from dam overflow (place 8), or if the power plant is not supplying power to the substation (place 11). [3] IP3 gives, M(p3) þ M(p6) þ M(p10) þ M(p12) ¼ 3 This result interprets that the penstock can be ruptured (place 3) by the thrust of the floodwater from dam overflow (place 6); also, if the power plant doesn’t work (place 10) or disrupted

Table 3 List of places. Place

Condition

p1 p2 p3 p4 p5 p6 p7 p8 p9 p10 p11 p12 p13

No hazard Flooded dam Disrupted penstock Disrupted power plant Disrupted substation Flooded dam (dummy place for penstock) Flooded dam (dummy place for power plant) Flooded dam (dummy place for substation) Disrupted penstock (dummy place for power plant) Disrupted power plant (dummy place for penstock) Disrupted power plant (dummy place for substation) Disrupted substation (dummy place for penstock) Disrupted substation (dummy place for power plant)

3278

S. Sultana, Z. Chen / Journal of Environmental Management 90 (2009) 3272–3282

Table 4 List of transitions.

Table 5 Place invariants.

Transition

Description

Transition rate

t1 t2 t3 t4 t5 t6 t7 t8 t9

Dam is overtopped Dam overflow affects penstock Dam overflow affects power plant Dam overflow affects substation Penstock disruption affects power plant Power plant disruption affects penstock Power plant disruption affects substation Substation disruption affects penstock Substation disruption affects power plant

Deterministic 80 70 50 45 85 95 90 95

substation doesn’t supply electricity (place 12) for penstock operation, flow through the penstock has to be shutdown. [4] IP4 gives, M(p4) þ M(p7) þ M(p9) þ M(p13) ¼ 3 This simulation implies that power plant disruption (place 4) occurs due to the inundation from dam overflow (place 7), or, penstock rupture (place 9), or, if the substation is unable to absorb the supplied energy from the power plant (place 13). Comparing the modeling result interpretations and the existing interactions among the concerned infrastructures, it can be stated that the developed Petri net model is valid and an extended analysis can be performed. Further, the constructed Petri net will be analyzed considering the stochastic distribution of transition firing time in order to assess the safety of the network infrastructures. 3.2.4. Safety assessment with extended Petri net analysis The theory of SPN analysis will be applied to the developed Petri net model. In this study, the functional condition of each infrastructure whether it is operating or not, will be investigated. Once any infrastructure becomes inactive, further deterioration due to another interlinked infrastructure disruption is out of scope of this paper. To capture this scenario, inhibitor arcs are incorporated in the model which can be interpreted as a place having capacity of 1 (Fig. 6). For example, if the substation is flooded and the service is unavailable, the disrupted power plant cannot put the damage token to the substation as it is already out of service. Again, if the disrupted penstock cannot provide its

Places

Place invariants

p1 p2 p3 p4 p5 p6 p7 p8 p9 p10 p11 p12 p13

Ip1

Ip2

Ip3

Ip4

1 1 0 0 0 0 0 0 0 0 0 0 0

0 0 0 0 1 0 0 1 0 0 1 0 0

0 0 1 0 0 1 0 0 0 1 0 1 0

0 0 0 1 0 0 1 0 1 0 0 0 1

service to the power plant, it has to be shutdown; in this case, the damage token from flood flow is not considered as the plant is already shutdown. For the extended analysis of the developed Petri net, the transition rates are used to track the token flow for developing the reachability graph for the same initial condition. The reachability graph is provided in Table 6. Here, si ¼ previous state; sj ¼ next state; r(t) ¼ firing rate; q ¼ transition probability; tk ¼ firing transition. The transition probability is calculated using Equation (10). As we have the reachability graph, the corresponding Markov Chain can be developed next. 3.2.5. Markov Chain development and analysis The Markov Chain from the reachability graph derived in the previous section can be developed with the calculated transition probabilities. The developed chain is shown in Fig. 7. 3.2.5.1. Transition matrix. The transition matrix (Tr) can be generated from the developed Markov Chain. In this case, the initial state matrix p0 states that, the probability of state 1 is ‘1’, and the probabilities of the remaining states are ‘zero’. With these two parameters, Tr and p0, the steady state probabilities of the states are calculated using Equation (11).

p13 p13

t9

t9 p4

S

p4

PP p5

S

PP p5

p11

t7

p11

t7

p10

p10

p8

p8

t4

t3

t5

p7 p9

t6

t4

t3

p12

t5

p7 p9

t2

t6 p12

t2

D

P

D p3

p2

t8

P

p3

p2

p6 p1

t1 Fig. 5. Petri net of the hydropower generating infrastructures (D – Dam, P – Penstock, PP – Power plant, S – Substation).

t8

p6 p1

t1 Fig. 6. Extended stochastic Petri net of the hydropower generating infrastructures (D – Dam, P – Penstock, PP – Power plant, S – Substation).

S. Sultana, Z. Chen / Journal of Environmental Management 90 (2009) 3272–3282

3279

The transition matrix; Tr ¼ states s1 s2 s3 s4 s5 s6 s7 s8 s9 s10 s11 s12 s13 s14 s15 s16 s17 s18 s19 s20 s21 s22 s23 s24

s1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0

s2 :4 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0

s3 :35 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0

s4 s5 s6 s7 s8 s9 s10 s11 s12 s13 s14 s15 s16 s17 s18 s19 s20 s21 s22 s23 s24 :25 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 :424 :303 :273 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 :258 0 0 :161 :274 :307 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 :239 0 :209 0 0 :269 :283 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 :345 :655 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 :333 0 :214 :453 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 :345 0 :655 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 :314 0 0 0 0 :333 :353 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 :345 0 :655 0 0 0 0 0 0 0 0 0 0 0 0 0 0 :314 0 0 0 0 0 :333 :353 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 :333 0 0 :214 :453 0 0 0 0 0 0 0 0 0 0 0 0 0 :314 0 0 0 0 0 0 :353 :333 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1

Initial state matrix,

p0 ¼ 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 For calculating the steady state probability, p is multiplied with successive powers of Tr until the steady state is reached (Table 7). The results show that the states s13 through s24 will be attained at steady state, which is compatible as it indicates that all the infrastructures are disrupted in course of time. In this model, the recovery strategy is not considered; it is assumed that the infrastructures do not recover if they are disrupted once. For this reason, the steady state should indicate that all the infrastructures are disrupted in the long run which has been captured by the developed model.

0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 :345 :655 0 0 0 0 0 0 0 0 0 0 :333 0 :214 :453 0 0 0 0 0 0 0 0 R¼ 0 0 :345 0 :655 0 0 0 0 0 0 0 :314 0 0 0 0 :333 :353 0 0 0 0 0 0 0 0 0 0 :345 0 :655 0 0 0 0 0 :314 0 0 0 0 0 :333 :353 0 0 0 0 0 0 0 0 0 :333 0 0 :214 :453 0 0 0 0 :314 0 0 0 0 0 0 :353 :333 With these matrices, the analysis can be extended as below:

3.2.5.2. Extended analysis of the Markov Chain. In the developed Markov Chain, there are twelve absorbing states, s13 through s24. The behavior of the network can further be analyzed considering the effects of the existence of the absorbing states in the network. The analysis steps are described below. First, the transition matrix Tr can be divided into transient states and absorbing states according to Equation (12). In this case ‘I’ is 12by-12 identity matrix, and, Q and R are 12-by-12 matrices as following,

0 0 0 0 0 0 Q¼ 0 0 0 0 0 0

:4 :35 :25 0 0 0 0 0 0 0 0 0 0 0 :424 :303 :273 0 0 0 0 0 0 0 0 :258 0 0 :161 :274 :307 0 0 0 0 0 0 :239 0 :209 0 0 :269 :283 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0

(i) From Equation (13), the fundamental matrix,

States s1 s2 s3 s4 s5 s6 s7 s8 s9 s10 s11 s12 s1 1 :4 :35 :25 :26 :181 :109 :109 :096 :107 :067 :071 s2 0 1 0 0 :424 :303 :273 0 0 0 0 0 s3 0 0 1 0 :258 0 0 :161 :274 :307 0 0 s4 0 0 0 1 0 :239 0 :209 0 0 :269 :283 s5 0 0 0 0 1 0 0 0 0 0 0 0 1 0 0 0 0 0 0 N ¼ s6 0 0 0 0 0 s7 0 0 0 0 0 0 1 0 0 0 0 0 s8 0 0 0 0 0 0 0 1 0 0 0 0 s9 0 0 0 0 0 0 0 0 1 0 0 0 s10 0 0 0 0 0 0 0 0 0 1 0 0 s11 0 0 0 0 0 0 0 0 0 0 1 0 s12 0 0 0 0 0 0 0 0 0 0 0 1

The first row of the matrix indicates that if we start in state 1, the expected number of times in states 1, 2, 3, ., 12 before being absorbed are 1, 0.4, 0.35, ., 0.071. The remaining rows imply the same type of interpretations.

3280

S. Sultana, Z. Chen / Journal of Environmental Management 90 (2009) 3272–3282

Table 6 Reachability graph. Track

Previous state, si s0 s1

1

s2

1,2

s3

1,3

s4

1,4

s5

1,2,3

s6

1,2,4

s7

1,2,5

s8

1,3,4

s9

1,3,6

s10

1,3,7

s11

1,4,8

s12

1,4,9

tk

r(t)

Next state, sj

Damaged infrastructures

Transition probability, q

1 2 3 4 3 4 5 2 4 6 7 2 3 8 9 4 7 3 5 9 4 7 2 6 8 4 7 2 6 8 3 5 9 2 6 8

Deterministic 80 70 50 70 50 45 80 50 85 95 80 70 90 95 50 95 70 45 95 50 95 80 85 90 50 95 80 85 90 70 45 95 80 85 90

s1 s2 s3 s4 s5 s6 s7 s5 s8 s9 s10 s6 s8 s11 s12 s13 s14 s13 s15 s16 s15 s17 s13 s18 s19 s18 s20 s14 s20 s21 s19 s22 s23 s16 s24 s23

D DþP D þ PP DþS D þ P þ PP DþPþS D þ P þ PP D þ PP þ P D þ PP þ S D þ PP þ P D þ PP þ S DþSþP D þ S þ PP DþSþP D þ S þ PP D þ P þ PP þ S D þ P þ PP þ S D þ P þ S þ PP D þ P þ S þ PP D þ P þ S þ PP D þ P þ PP þ S D þ P þ PP þ S D þ PP þ S þ P D þ PP þ S þ P D þ PP þ S þ P D þ PP þ P þ S D þ PP þ P þ S D þ PP þ S þ P D þ PP þ S þ P D þ PP þ S þ P D þ S þ P þ PP D þ S þ P þ PP D þ S þ P þ PP D þ S þ PP þ P D þ S þ PP þ P D þ S þ PP þ P

1 0.4 0.35 0.25 0.424 0.303 0.273 0.258 0.161 0.274 0.307 0.239 0.209 0.269 0.283 0.345 0.655 0.333 0.214 0.453 0.345 0.655 0.314 0.333 0.353 0.345 0.655 0.314 0.333 0.353 0.333 0.214 0.453 0.314 0.333 0.353

(ii) Applying Equation (14) with c as a 12-by-1 column vector of all entries as 1,

tT ¼

s1 3

s2 2

s3 2

s4 2

s5 1

s6 1

s7 1

s8 1

s9 1

s10 1

s11 1

s12 1

(iii) Following Equation (15),

3.2.5.3. Result discussion. The generated matrix B shows the probability of reaching to the absorbing states from the transient states. For example, if the network starts at transient state 1, that

States s1 s2 s3 s4 s5 B ¼ s6 s7 s8 s9 s10 s11 s12

s13 :184 :247 :14 :145 :345 :333 0 :314 0 0 0 0

s14 :204 :278 :265 0 :655 0 0 0 0 :314 0 0

s15 :076 :159 0 :051 0 :214 :345 0 0 0 0 0

s16 :104 :137 0 :197 0 :453 0 0 0 0 0 :314

s17 :072 :179 0 0 0 0 :655 0 0 0 0 0

s18 :069 0 :148 :07 0 0 0 :333 :345 0 0 0

s19 :061 0 :057 :163 0 0 0 :353 0 0 :333 0

s20 :099 0 :282 0 0 0 0 0 :655 :333 0 0

is, the dam overflow occurs, then, the probabilities of reaching at state 13 through state 24 are 0.184, 0.204, ., 0.055, and 0.024, which matches with the steady state results considering the occurrence of state 1 first. Similarly, if the net work starts at state 2 indicating the ruptured penstock from floodwater pressure, the probabilities of reaching at the same absorbing states are 0.247, 0.278, ., 0. Checking the reachability graph of the extended Petri net, it is noticed that state 18 through state 24 are not reachable from state 2. The other results can also be checked from the reachability graph and they are found to be satisfactory. Thus, the model results show that the network analysis addressed the scenario correctly. In the extended analysis, the derived absorbing states, state 13 through state 24 indicate the same condition, that is, all the

s21 :038 0 :108 0 0 0 0 0 0 :353 0 0

s22 :014 0 0 :058 0 0 0 0 0 0 :214 0

s23 :055 0 0 :222 0 0 0 0 0 0 :453 :353

s24 :024 0 0 :094 0 0 0 0 0 0 0 :333

S. Sultana, Z. Chen / Journal of Environmental Management 90 (2009) 3272–3282

3281

s1 .25

.4 .35 s2

s3

s4

.303 .258 .307 .209

.269

.273

.283 .274

.424 .239

s7

s5

.161

s6

s10

s9

s8

s11

s12

.655 .333 .345

.314

.214 .655

.345 .655

.453

.333

.333 .345

.314

.333

.353

.314 s17

s13

1

1

s15

s14

1

1

s16 1

s20 1

s18

s19

1

1

.453 .353

.333 .214

s21 1

s22

s23

1

.353

1

s24 1

Fig. 7. Markov Chain of the stochastic Petri net.

infrastructures in the network are out of service, but they are attained in different ways. For example, state 13 is attained by firing the transitions t1, t2, t3, and t4, that is, the floodwater inundates penstock, power plant and substation, leading towards the shutdown of these infrastructures. State 14 is reached by firing t1, t2, t3, and t7, that is, the penstock and power plant are inundated by floodwater and their operations are halted, whereas, the shutdown of the substation results from the unavailability of the power supply from the power plant generator. Another absorbing state s22 is reached by firing t1, t4, t8, and t5, which means, the substation outage occurs from floodwater inundation, subsequently, the electricity outage halts the penstock operation which finally disrupts the power plant operation. The steady state result shows that state 14 has the highest probability with 0.204, and state 22 has the lowest probability with 0.014.

3.3. Integrated modeling result Dam vulnerability assessment from the fragility curves, flood occurrence probability from the flood frequency analysis, and the predicted risk from the extended SPN analysis can be integrated to forecast the overall vulnerability of any network infrastructure. In this study, hydroelectricity generating infrastructure interdependency is being examined for the 100 years flood which results in dam overtopping and inundation of the downstream infrastructures. From the extended Petri net analysis, when the network execution starts at state 1, that is, dam overflow occurs, the steady state probability of state 13 (the penstock, power plant and substation infrastructures become inactive from the floodwater inundation) is 0.184. With the following notations, pfc ¼ overtopping hazard probability from the fragility curves analysis ¼ 1;

Table 7 Steady state probability of the states of the hydropower generating infrastructures.

3282

S. Sultana, Z. Chen / Journal of Environmental Management 90 (2009) 3272–3282

pf ¼ 100 years flood occurrence probability from the flood frequency analysis ¼ 0.01; pext ¼ steady state probability of state 13 from the extended Petri net analysis ¼ 0.184; Then, the overall vulnerability ¼ Pfc * Pf * Pext ¼ 1 * 0.01 * 0.184 ¼ 0.00184. The other damage states can be investigated in a similar way. For example, a 500 years flood with 3 m flood level will cause sliding failure of the dam having probability of around 50% which might devastate the adjacent infrastructures as well as the other remote infrastructures. 4. Conclusions New dams are being constructed for meeting the increasing energy demands of rapidly growing economies and for controlling flood, which represents a whole complex of social, economic and ecological processes (McNally et al., 2009); vulnerability of such huge infrastructure disrupts the socioeconomic equilibrium seriously. This paper has carried out the dynamic simulation of the overall safety of the floodplain hydroelectricity generating infrastructures with an integrated infrastructure interdependency modeling study based on the fragility curves development, flood frequency analysis, Petri net development with extended stochastic analysis, and, Markov Chain generation and its extended analysis. In this study, infrastructure vulnerability and their interdependencies have been modeled for 100 years flood. The fragility analysis was done analytically based on the structural and hydraulic modeling with Monte Carlo simulation. Flood frequency analysis was performed with Gumbel’s distribution method. The basic Petri net model was developed and analyzed to investigate its validity where the model captured the infrastructures interrelations correctly. Further, the extended dynamic analysis of the developed Petri net model was performed considering the most probable disaster scenario for 100 years flood, that is, the dam is overtopped which was interpreted from the fragility analysis and flood frequency analysis results. The resulting reachability graph quantified the possible ways and corresponding probabilities of the attainment of the infrastructure damage states. Analysis of the Markov Chain generated from the reachability graph rendered the probability matrix of the steady sate or long term condition of the network infrastructures. The extended analysis of the developed Markov Chain tracked the extended Petri net analysis accurately. Integration of these modeling techniques provides a useful and significant tool for predicting the overall probability matrix of infrastructure damage states. For the future work, the study can be carried out to predict the hazardous scenarios for higher flood levels. Overall, works done in this paper lead towards a new direction of flood induced infrastructure interdependency modeling which could help in developing an efficient flood related emergency management strategy. Acknowledgement This research was supported by the ‘Joint Infrastructure Interdependencies Research Program (JIIRP)’ from the ‘Natural Science and Engineering Research Council Canada (NSERC)’ and the ‘Public Safety and Emergency Preparedness Canada (PSEPC)’.

References Bobbio, A., 1990. System modeling with Petri nets. In: Colombo, A.G., Saiz de Bustamante, A. (Eds.), System Reliability Assessment. Kluwer P.C, pp. 102–143. Chock, G.Y.K., 2005. Modeling of hurricane damage for Hawaii residential construction. J. Wind Eng. Ind. Aerodyn. 93, 603–622. Ellingwood, B., Tekie, P.B., 2001. Fragility analysis of concrete gravity dams. J. Infrastruct. Syst. 7 (2), 41–48. Ezell, B.C., Farr, J.V., Wiese, I., 2000. Infrastructures risk analysis model. J. Infrastruct. Syst. 6 (3), 114–117. Filliben, J.J., Gurley, K., Pinelli, J.P., Simiu, E., 2002. Fragility curves, damage matrices, and wind induced loss estimation. In: Third Int. Conf. on Comp. Sim. in Risk An. & Haz. Mit, June 19–21, Sintra, Portugal, 119–126. Gursesli, O., Desrochers, A.A., 2003. Modeling infrastructure interdependencies using Petri nets. IEEE Int. Conf. Syst. Man Cybern. 2, 1506–1512. Haimes, Y.Y., Jiang, P., 2001. Leontief-based model of risk in complex interconnected infrastructures. J. Infrastruct. Syst. 7 (1), 1–12. Hall, J.W., Dawson, R.J., Sayers, P.B., Rosu, C., Chatterton, J.B., Deakin, R., 2003. A methodology for national-scale flood risk assessment. Proc. Inst. Civ. Eng. – Water Maritime & Eng. 156 (3), 235–248. Howard, R.A., 1971. Dynamic Probabilistic Systems, vol. 1. John Wiley Sons, New York. Hwang, H., Jernigan, J.B., Lin, Y.W., 2000. Evaluation of seismic damage to Memphis bridges and highway systems. J. Bridge Eng. 5 (4), 322–330. Istomina, M.N., Kocharyan, A.G., Lebedeva, I.P., 2005. Floods: genesis, socioeconomic and environmental impacts. Water Resour. 32 (4), 349–358. Kemeny, J.G., Snell, J.L., Thompson, G.L., 1974. Introduction to Finite Mathematics, third ed. Prentice-Hall, Englewood Cliffs, New Jersey. Krings, A., Oman, P., 2003. A simple GSPN for modeling common mode failures in critical infrastructures. In: Proc. 36th Hawaii Int. Conf. on Syst. Sci., Island of Hawaii. Leavitt, W.M., Kiefer, J.J., 2006. Infrastructure interdependency and the creation of a normal disaster: the case of Hurricane Katrina and the City of New Orleans. Public Works Manage. & Policy 10 (4), 306–314. Linsley, R.K., Franzini, J.B., 1992. Water Resources Engineering, fourth ed. McGrawHill, New York. McNally, A., Magee, D., Wolf, A.T., 2009. Hydropower and sustainability: resilience and vulnerability in China’s powersheds. J. Environ. Manage 90 (3), S286– S293. Moselhi, O., Hammad, A., Alkass, C., Debbabi, M., Haider, M., 2005. Vulnerability assessment of civil infrastructure systems: a network approach. In: First CSCE Specialty Conf. on Infra. Tech., Manage. & Policy, Ontario. Murata, T., 1989. Petri nets: properties, analysis and applications. Proc. IEEE 77 (4), 541–580. Novak, P., Moffat, A.I.B., Nalluri, C., Narayanan, R., 1990. Hydraulic Structures. Prentice Hall. Nozick, L.K., Turnquist, M.A., Jones, D.A., Davis, J.R., Lawton, C.R., 2005. Assessing the performance of interdependent infrastructures and optimizing investments. Int. J. Crit. Infrastruct. 1 (2/3), 144–154. Pederson, P., Dudenhoeffer, D., Hartley, S., Permann, M., 2006. Critical Infrastructure Interdependency Modeling: a Survey of U.S. and International Research. Idaho Nat. Lab., U.S. Dept. of Energy Nat. Lab. Petri, C.A., 1962. Kommunikation mit Automaten. PhD thesis, Technical University Darmstadt, Germany. Rahman, S., 2005. Impact of natural disasters on critical infrastructures. In: The First Bangladesh Earthquake Symp., December. Ramchandani, C., 1974. Analysis of Asynchronous Concurrent Systems by Timed Petri Nets. Project MAC Tech. report MAC-TR-120. Massachusetts Institute of Technology, Cambridge, MA. Raposo, A.B., Magalha˜es, L.P., Ricarte, L.M., 2000. Petri nets based coordination mechanisms for multi-workflow environments. Int. J. Comput. Syst. Sci. & Eng. 15 (5), 315–326. Rinaldi, S.M., Peerenboom, J.P., Kelly, T.K., 2001. Critical infrastructure interdependencies. IEEE Control Syst. Mag. 21 (6), 11–25. Robert, B., 2004. A method for the study of cascading effects within lifeline networks. Int. J. Crit. Infrastruct. 1 (1), 86–99. Subramanya, K., 2001. Engineering Hydrology, second ed. McGraw Hall, New Delhi. Zuberek, W.M., 1985. Performance evaluation of concurrent systems using timed Petri Nets. In: Proc. 1985 ACM Comput. Sci. Conf. – Agenda for Computing Res.: the Challenge for Creativity, March 12–14. Zuberek, W.M., 1987. Modified M-timed Petri nets in modeling and performance evaluation of systems. ACM 0-89791-218-7/87/0002-0261. Zuberek, W.M., 1991. Timed Petri nets. Microelectron. Reliab. 31 (4), 627–644.