Susanna Loris

Fanny Anne

Yi-Ping Zhiguo

Andrea Bellè
email: andrea.belle@centralesupelec.fr

Zhiguo Zeng
email: zhiguo.zeng@centralesupelec.fr

Carole Duval

Marc Sango
email: marc.sango@sncf.fr

Anne Barros
email: anne.barros@centralesupelec.fr

Adam F Abdin
email: adam.abdin@centralesupelec.fr

Yi-Ping Fang
email: yiping.fang@centralesupelec.fr

Modeling and vulnerability analysis of interdependent railway and power networks: Application to British test systems

Keywords: Critical infrastructures Vulnerability Interdependent networks Cascading failures Power network Railway network Critical infrastructures, interdependent networks, power network, railway network, cascading failures, vulnerability Coupling interface, resilience, defender-attacker-defender, interdependent critical infrastructures, optimization List of Symbols Abbreviations CI Critical infrastructure Risk analysis, interdependent critical infrastructures, coupling interface, random failures, distributionally robust optimization Coupling interface, resilience, defender-attacker-defender, interdependent critical infrastructures, optimization, redundancy allocation Energy infrastructures, vulnerability, independent operators, interdependent networks, Stackelberg game, optimization Power network, optimal protection, distributionally robust optmization, moment-based ambiguity set, critical infrastructures

EDF, the major French energy utility company, Orange, the major French

Titre: Résilience et couplage des infrastructures critiques interdépendantes: modèles, optimisation et gestion opérationnelle Mots clés: Infrastructures critiques interdépendantes, résilience, interface de couplage, analyse de vulnérabilité, optimisation Résumé: Les infrastructures critiques (IC) sont essentielles au maintien de la stabilité socioéconomique et la prospérité d'une population. Assurer leur résilience face aux défaillances et aux perturbations est un enjeu majeur. De par leurs diverses relations d'interdépendance, leurs interfaces de couplage complexes, ainsi qu'une exploitation souvent réalisée par des entités indépendantes, l'analyse et l'optimisation de leur résilience est une tâche difficile. Cette thèse expose trois sujets liés à la résilience des IC interdépendantes, avec un accent particulier sur leur couplage. Premièrement, elle approfondit la vulnérabilité des réseaux ferrovi-aires et électriques interdépendants, en prenant en compte les interfaces de couplage réalistes et de défaillances en cascade, afin de mieux comprendre leurs risques mutuels. Deuxièmement, elle propose une approche mathématique pour améliorer la résilience des IC interdépendantes à travers l'optimisation de la topologie de leur interface de couplage. Enfin, elle suggère une approche préliminaire pour la prise de décision dans les IC interdépendantes qui tient compte des divers comportements des opérateurs indépendants dans des conditions normales et des situations de perturbation.

Title: Resilience and coupling of interdependent critical infrastructures: models, optimization, and operations Keywords: Interdependent critical infrastructures, resilience, coupling interface, vulnerability analysis, optimization Abstract: Critical infrastructures (CIs) are essential for maintaining the socio-economic stability and wealth of a population, and ensuring their resilience against failures and disruption is of the utmost importance. As CIs are connected with each other through various relationships of interdependency and complex coupling interfaces, and they are often operated by independent entities, their analysis and optimization is a challenging task. In this dissertation, three topics related to the resilience of interdependent CIs, with a particular focus on their coupling, are investigated. Firstly, the vulnerability of interdependent railway and power networks, accounting for realistic coupling interfaces and cascading failures, is investigated, in order to better understand the mutual risks of these interdependent CIs. Secondly, a resilience-based mathematical programming framework for the optimization of the topology of coupling interfaces between interdependent CIs is presented. Lastly, a preliminary approach for decision-making in interdependent CIs, accounting for the different behaviours of independent operators under normal conditions and in situations of disruption, is proposed. In red, the Great Britain reduced power transmission network [41] is shown. In blue, the proposition for a new high-speed British railway network made in [42] is shown. • on September 28, 2003, failures of power transmission lines near the Swiss-Italian border caused a general blackout of the Italian peninsula which affected tens of millions of people for several hours [3], [5], [6];

List of Tables

• on November 4, 2006, a disconnection of high-voltage transmission lines on the Ems River, Germany, caused electrical disturbances in more than 10 million European households [7];

• on January 12, 2010, a magnitude 7.0 earthquake occurred in Haiti, causing vast disruption of the national CIs systems [8], and hampering crisis management operations.

CIs are extremely complex systems, as they are composed of a large variety of technologies and managed by various entities and stakeholders. Moreover, CIs are often interdependent on each other in terms of functionality and performance [9], and failures and disturbances within one infrastructure can propagate to other systems and cause multi-sectoral disruption [10], [11]. For example, in August 2019, British railway networks were heavily disrupted by disturbances within power networks [12], and the aforementioned Italian blackout was partially caused by a failure propagation process between interdependent power and telecommunications networks [13].

Within this context, it is clear that the analysis, optimization, and design of CIs are issues of the utmost importance. Despite interdependent CIs being an active and prolific research field, many questions remain unanswered, as their analysis and optimization are particularly challenging tasks. In fact, CIs are often dependent on each other in terms of functionality and performance, and they are often operated by independent entities and stakeholders. These factors highly increase the complexity of analyzing and designing interdependent CIs.

In this dissertation, three topics within the framework of interdependent CIs and their resilience, with a particular focus on their coupling, are addressed and investigated: vulnerability of interdependent railway and power networks, optimization of coupling interface topology, and joint decision-making with independent operators. The rest of this chapter is dedicated to the introduction of the main concepts of this dissertation. In Section 1.3, the topic of interdependent CIs, from a research perspective, is outlined; in Section 1.4, the concept of resilience and its connection to this work is addressed; in Section 1.5, the main contributions of this dissertation are highlighted.

. Interdependent critical infrastructures

. Interdependencies

An infrastructure A is dependent on infrastructure B if the state, functionality, and/or performance of infrastructure A depends on the state, functionality, and/or performance of infrastructure B. The interdependencies are unidirectional if infrastructure A is dependent on infrastructure B, but not vice versa; if infrastructures A and B are mutually dependent on each other, the interdependencies are bidirectional [11], [14].

Relationships of interdependencies between CIs can be classified in different ways. The most used classification of interdependencies is the one proposed in [11], where the authors identify four classes of interdependencies:

• physical : infrastructure A is dependent on infrastructure B through the flow of physical quantities, such as energy commodities, equipment, or goods. Typical examples are all those systems and infrastructures which are dependent on power networks in terms of electricity supply;

• cyber : infrastructure A is dependent on infrastructure B through the flow of data and information. Typical examples are all those systems and infrastructures which are dependent on telecommunications networks in terms of exchange of data and information;

• geographic: infrastructure A and infrastructure B (or some of their components) share the same geographical location, and a change in the local environment can impact both the infrastructures;

• logic: infrastructure A is dependent on infrastructure B through a relationship that does not belong to the previous categories. Examples can be infrastructures that are dependent on each other through human factors, regulations, policies, or financial markets.

Alternative classifications are available in the existing literature. For example, in [15], the authors analyze the existing classifications of infrastructure interdependencies, sorting them into six categories (types of interdependencies, environment, coupling and response behaviour, type of failure, infrastructure characteristics, state of operation), and propose their own classification based on the dimensions of ontology and epistemology. The dimension of ontology refers to when interdependencies between CIs exist, and it is classified into two categories [15]:

• chronic, when the interdependencies are permanent and exist during the whole infrastructures lifetime;

• episodic, when the interdependencies are temporary and exist only during particular circumstances.

The dimension of epistemology refers to the classification of interdependencies parallelly to the mathematical models used to describe them, and it is divided into four categories [15]:

• hazard and exposure models, which describe the interdependencies in terms of environment and hazard occurrence;

• policy and control models, which capture the interdependencies due to economic and regulatory factors;

• operation and performance models, which describe the operational nature of interdependencies in terms of performance, supply/demand, and cascading effect;

• deterioration and recovery models, which describe the temporal evolution of interdependencies and their effect on the functional state of CIs [15].

In general, relationships of interdependencies between infrastructures and systems are complex and variegate, and multiple types of interdependencies can exist simultaneously.

. Modeling of interdependent critical infrastructures

A suitable modeling framework is essential for an accurate analysis and/or optimization of interdependent CIs. Different modeling approaches are available in the existing literature, and a comprehensive review of the existing frameworks is presented in [9], where the author identifies six modeling categories: empirical, agent-based, system dynamics-based, economic theory-based, network-based, and other approaches. Some illustrative existing works and considerations on the modeling of interdependent CIs highlighted in [9] are recalled in this section.

Empirical approaches focus on available historical data and expert judgement to infer the nature and the strength of interdependencies between different infrastructures. These approaches are useful to identify failure patterns and failure propagation between existing infrastructures. For example, these models have been used to identify failure patterns [16], [17], empirically quantify interdependency indicators and metrics [18], or perform risk analyses [19].

Agent-based approaches found their foundations in the fact that interdependent infrastructures can be interpreted as complex adaptive systems [20], and their macroscopic behaviour can be modeled as the result of microscopic interactions of multiple agents [21]. For example, these models have been used to study power systems and their dependent infrastructures [22].

System dynamics-based approaches are another class of models that describe interdependent infrastructures as complex adaptive systems in terms of concepts of feedbacks, stocks, and flows. For example, a system dynamics-based approach has been used by a consortium of US National Laboratories (Los Alamos, Sandia, and Argonne) [23] to develop a supportive tool for CIs protection [24].

Economic theory-based approaches apply economic models to the study of interdependent CIs. For example, the traditional Leontief's input-output model [25] has been adapted into the CIs inoperability model proposed in [26]. Input-output based models have been extended to the Computable General Equilibrium method to study economic resilience of CIs in case of extreme weather events [27] and terroristic attacks [28].

Network-based approaches utilize networks to represent interdependent infrastructures and study the complex correlations and behaviours that can arise. These models have been widely used in the existing literature, for analyzing and optimizing interdependent CIs with topological approaches [13], [29]- [31] and flow-based approaches [32]- [34].

Other approaches include hierarchical holographic modeling method [35], high level architecture-based method [36], petri-net-based method [37], dynamic control system theory-based method [38], and Bayesian networks [39].

The modeling of interdependent CIs include a large variety of frameworks and approaches. A comprehensive review is out of the scope of this work, and the reader is referred to the extensive review available in [9].

In the context of this thesis, network-based models have been extensively used. In the next section, the main concepts of network-based models, along with some important results of network science related to CIs, are presented.

. Network-based models

Network science is a branch of mathematics that focuses on the study of complex networks and their properties. A complex network is a mathematical object, represented by a graph G = (V, E), usually with nontrivial topology [40], composed of a set V , containing N nodes (or vertices), and a set E, containing M edges (or arcs). In this work, each edge k is assumed to be directed and defined by an origin node O(k) and a destination node D(k). Interdependent networks are represented as individual networks connected by directed edges which represent interdependencies (also referred to as interdependency links). A representative graphical example of interdependent networks is shown in Figure 1.1. CIs can be easily represented by networks: nodes can be used to represent components, while edges can be used to represent connections (physical and nonphysical). For example, power networks are composed of buses, which can be represented by nodes, and power lines, which can be represented by edges. Similar representations can be used for railway networks, where stations (nodes) are connected by tracks (edges), gas networks, where hubs (nodes) are connected by pipelines (edges), and many other CIs (telecommunications networks, water networks, etc.). In Figure 1.2, the Great Britain reduced power transmission network [41], composed of 29 buses connected by 50 power lines, is represented as a network of 29 nodes and 50 edges. Similarly, always in Figure 1.2, the proposition for a new high-speed British railway network contained in [42] is represented as a network composed of 16 stations connected by 21 tracks.

Networks are not only an intuitive tool for the graphical representation of CIs, but also a modeling framework for their analysis and optimization. Interdependent CIs can be modeled with two different classes of network models: topology-based and flow-based [9]. In red, the Great Britain reduced power transmission network [41] is shown. In blue, the proposition for a new highspeed British railway network made in [42] is shown. In topology-based models, nodes and edges are considered to be homogeneous, and their physical properties, such as node production capacity or edge flow capacity, are not taken into account. CIs are modeled and analyzed only accounting for their topological properties and network metrics, such as node degree and betweenness. Node degree and betweenness belong to the so-called centrality measures, a group of metrics that defines the importance of each node (or edge) within a network. The degree centrality denotes the number of edges connected to a node. If the edges are directed, the degree centrality can be split into in-degree and out-degree, by distinguishing edges entering and exiting the node [43]. The betweenness centrality denotes the fraction of shortest paths within the network passing through a specific node i, and it is computed as in Equation (1.1):

c B (i) = j̸ =i̸ =k∈V σ jk (i) σ jk (1.1)
where σ jk is the number of shortest paths between nodes j and k, and σ jk (i) is the number of shortest paths between nodes j and k passing through node i [44]. Other centrality measures, such as closeness centrality [45] and graph centrality [46] exist and can be used for the analysis of networks and CIs. In general, these metrics contain valuable topological information, and they can also be used as surrogate models for physical properties of CIs. For example, betweenness centrality can be used to simulate cascading failures processes in systems with heterogeneous loads, such as power grids and Internet networks [47], [48].

Within the existing literature on CIs, topology-based models have been used to assess the resilience of telecommunications networks [49], [50], identify critical locations [51], design coupling interfaces of interdependent CIs [31], and analyze cascading failures in interdependent CIs [13].

The pioneering work of Buldyrev et al. [13] is of particular relevance in the context of interdependent CIs. In this paper, the authors highlight that the behaviour of interdependent networks in terms of cascading failures and failures propagation is inherently different to the behaviour of single non-interacting networks. In particular, using percolation theory as a framework to model cascading failures in networks [52], they demonstrate that interdependent networks are characterized by a first-order phase transition when subject to cascading failures, contrary to single networks which are characterized by a second-order phase transition. This feature results in an increased vulnerability of interdependent networks, and into "the need to consider interdependent network properties in designing robust networks" [13]. This consideration provides a solid theoretical background that justifies the study of interdependent CIs, rather than individual CIs.

Topology-based models represent a versatile modeling approach; however, topological information and metrics are often not enough for a comprehensive assessment and analysis of interdependent CIs. Flow-based models integrate the networkbased representation of CIs with physical properties, such as production capacity, requested demand, and flow capacity of goods, services, or commodities supplied by CIs. Nodes and edges are heterogeneous, as they are characterized by different physical properties. The functionality and the performance of CIs are described by a flow-based approach, such as maximal flow models [34], [53]- [56], power flow models (for power networks) [57]- [59], or pressure-driven models (for water networks) [60]. Among the various existing applications, flow-based models have been applied to optimize the recovery of disrupted CIs [START_REF] Lee | Restoration of services in interdependent infrastructure systems: a network flows approach[END_REF]- [63], model cascading failures within power networks [64]- [66], assess the vulnerability of interdependent CIs [14], [67], [68], and enhance the resilience of interdependent CIs [34], [55], [69]- [START_REF] Ouyang | A methodological approach to analyze vulnerability of interdependent infrastructures[END_REF].

Flow-based models, as they integrate network representation and physical modeling of CIs, represent a more realistic approach, and they are applied within the work of this thesis.

. Resilience: concept and metrics

Resilience is a concept that has gained increasing attention in recent years. However, an exact definition of resilience seems to be missing, and several interpretations are present within the existing literature [START_REF] Liu | Review of studies on the resilience of urban critical infrastructure networks[END_REF], [START_REF] Petersen | Who cares what it means? practical reasons for using the word resilience with critical infrastructure operators[END_REF]. In this dissertation, it is interpreted as the ability of a system to "withstand stressors, adapt, and rapidly recover from disruptions" [START_REF] Sharma | Resilience analysis: a mathematical formulation to model resilience of engineering systems[END_REF]. In general, resilience defines the behaviour of a system or a network under conditions of disruption, in terms of temporal evolution of performance. It can be described by resilience curves, such as the one shown in Figure 1.3.

As it can be clearly seen in Figure 1.3, resilience is divided into three phases: disturbance phase, degraded phase, and recovery phase [START_REF] Panteli | Metrics and quantification of operational and infrastructure resilience in power systems[END_REF]. A system in a stable state with nominal performance p 0 , after a disruptive event at time t e , enters the disturbance phase, which describes the disruption propagation and temporal decrease of performance p(t). The disturbance phase is strictly connected to the concepts of vulnerability and survivability. Vulnerability is defined as the "degree of loss or damage to a system when exposed to a strain of a given type and magnitude" [68], and it can be interpreted as the loss of performance due to a specific disruptive event. Survivability is defined as "the capability of a system to fulfill its mission in a timely manner in the presence of attacks, failures, or accidents" [START_REF] Trivedi | Chapter 7 -stochastic modeling techniques for secure and survivable systems[END_REF], and it can be interpreted as the residual performance after a specific disruptive event. At time t d , when the performance p(t) reaches the minimum value, the degraded phase starts. This phase describes the time necessary for information collection, organization, and decision-making. At t r , the recovery phase starts and lasts until time t f , when the performance are back to the nominal value p 0 .

In reality, the separation between phases is not always straightforward, and the three phases are often overlapped. However, these concepts are still useful to understand the nature of resilience in systems and networks.

The resilience of a system can be measured using different approaches, and various metrics are available in the existing literature [START_REF] Poulin | Infrastructure resilience curves: performance measures and summary metrics[END_REF]. In this section, two of the most common approaches are mentioned.

The first method consists in taking an integral approach, by measuring the area below the resilience curve (or part of it). Using the nomenclature in Figure 1.3 as a reference, the integral resilience metric R can be computed as in (1. This approach is equivalent to computing the area under the black curve in Figure 1.3 between t e and t f , and it can be interpreted as the cumulative performance of the system between t e and t f . A similar approach consists in computing the cumulative losses of the system, corresponding to the area between the dashed horizontal line that defines the nominal performance p 0 and the solid black curve between t e and t f . A second method consists in computing separately different metrics related to various aspects of resilience. A renowned approach is called ΦΛEΠ (pronounced "FLEP") [START_REF] Panteli | Metrics and quantification of operational and infrastructure resilience in power systems[END_REF], and it consists in the computation of four different metrics [10]:

• Φ: it corresponds to the rate of performance drop in the disturbance phase.

Using Figure 1.3 as a reference, it can be computed as in (1.3): Φ = p(t e )p(t d ) t dt e ;

(1.3)

• Λ: it corresponds to the magnitude of the drop in performance. This metric is related to the concept of vulnerability and survivability. It can be computed as in (1.4): Λ = p(t e )p(t d );

(1.4)

• E: it corresponds to the temporal extension of the degraded phase, and it can be computed as in (1.5):

E = t r -t d ;
(1.5)

• Π: it corresponds to the rate of recovery, and it can be computed as in (1.6):

Φ = p(t f ) -p(t r ) t f -t r .
(1.6)

In this dissertation, the focus is on vulnerability and survivability, strictly connected to the Λ metric of the ΦΛEΠ approach.

. Timeline and contributions of the thesis

The first year of doctorate was dedicated to the investigation of interdependent railway and power networks (IRPNs), in order to assess their mutual risks. During this phase, three literature gaps and research questions were identified:

• How to model the interconnections between railway and power networks and how do they affect the operational model?

• What is the impact of cascading failures in power networks on the dependent railway networks?

• How to assess the impact of failures in railway networks on power networks?

These questions are addressed by introducing traction networks to act as an interface between railway and power networks, by proposing a flow-based approach for cascading failures in IRPNs, and by evaluating the feedback effect of failures in railway networks on the cascading failure dynamics of power networks. The main results are highlighted in Chapter 2, which is based on the work contained in Paper I [14] and Paper II [START_REF] Bellè | Towards a realistic topological and functional modeling for vulnerability analysis of interdependent railway and power networks[END_REF].

One of the main results in Paper II suggested that the topology of interdependency links between interdependent CIs, i.e. how interdependent CIs are interconnected and coupled, might play an important role in determining their resilience, and a new research question emerged:

• How to optimize the topology of interdependency links (also referred to as the coupling interface) in order to enhance the resilience of interdependent CIs?

The existing literature presents a limited number of works on this topic, mostly based on network metrics-based heuristic strategies. In this work, the optimization of coupling interface topology is addressed with a mathematical programming approach. Two different models (robust and distributionally robust) for the optimal design of coupling interfaces are proposed, as well as an approach for the optimal allocation of redundant interdependency links. The main results are highlighted in Chapter 3, which is based on the work contained in Paper III [10], Paper IV [START_REF] Bellè | A data-driven distributionally robust approach for the optimal coupling of interdependent critical infrastructures[END_REF], and Paper V [START_REF] Bellè | Resilience enhancement by optimal allocation of redundant interdependency links in interdependent critical infrastructures[END_REF].

When optimizing the coupling interface, the interdependent CIs are assumed to be operated in a centralized way. However, interdependent CIs can also be operated in a decentralized way, in which the different operators act independently. In particular, CIs are usually operated in a decentralized way under normal conditions, when the focus of each operator is to minimize its own individual costs, and in a centralized way under conditions of disruption, when the different operators collaborate in order to minimize the negative impact on the general population. When designing a coupling interface -or taking any other joint decision -planners and decision-makers should take into account that the behaviour of independent operators in interdependent CIs might change according to the state of their systems. Given this consideration, a new research question emerged:

• How to take joint decisions in interdependent CIs when independent operators might display different behaviours according to the systems' conditions?

This question is addressed in Chapter 4, where some preliminary results based on Paper VI are presented. Moreover, a proposal for a decision-making framework that takes into account the behaviour of independent operators (decentralized under normal conditions, centralized under conditions of disruption) of interdependent CIs is presented.

In Chapter 5, the main results and contributions of this thesis, as well as possible developments, are highlighted.

At the end of the manuscript, the aforementioned papers are appended. Paper VII, which contains the results of a distributionally robust approach with endogenous uncertainty for the optimal protection of power networks, is appended but not discussed in this manuscript.

-Vulnerability of railway and power networks

. Introduction

The disturbance phase of resilience is strictly connected to the concept of vulnerability, which is defined as the "degree of loss or damage to a system when exposed to a strain of a given type and magnitude" [68]. In other words, the vulnerability V of a system defines the drop in performance after a specific disruptive event, and it can be generally computed as in (2.1):

V =      p(t e ) -p(t d ), if not normalized p(te)-p(t d ) p(te) , if normalized (2.1)
where p(t e ) and p(t d ), consistently with Figure 1.3, define the performance of the system before and after the disruptive event, respectively. The vulnerability V is a time-independent metric, and when not normalized, is equivalent to the Λ metric of the ΦΛEΠ resilience framework.

When dealing with CIs, analyzing and understanding the possible negative consequences that might arise from various disruptive events is of the utmost importance. Vulnerability analysis, defined in [68] as the process of "systematically and comprehensively identifying the possible states a system can be put into, due to specific strains, and estimating the negative consequences associated with them", is a suitable framework for estimating negative impacts of disruptive events in CIs.

In the case of interdependent CIs, a comprehensive vulnerability analysis must take into account the effect of interdependencies and the mutual impact that interdependent CIs can have on each other. As it is highlighted in [67] and [68], vulnerability analysis is a suitable framework for the evaluation of interdependent CIs. However, the results of the analysis are heavily impacted by the starting assumptions and the modeling of cascading effects 1 between different CIs.

The focus of this work is on interdependent railway and power networks (IRPNs), in order to understand the mutual risks associated with these infrastructures. Consistently with the framework in [11], the interdependencies between these two infrastructures are defined as unidirectional and physical, as railway networks (when 1 Cascading effect defines the propagation of disruption and disturbances from one infrastructure to another [14].

electrified) are dependent on power networks in terms of electricity supply.

Railway and power networks are amongst the most important infrastructures in any advanced society. As railway networks are often electrified, especially in Europe, IRPNs are a very common configuration. In addition, it is well known that failures in power networks can rapidly propagate and cause disruption in railway networks [12]. Consequently, railway operators should be aware of risks related to disruption of power supply from power networks [START_REF]A european-wide power and infrastructure break-down ("blackout") and railways operators[END_REF]. Surprisingly, in the existing literature, vulnerability analysis of IRPNs is not treated comprehensively and sufficiently in detail. The reader is referred to Section 1.2 of Paper I for more details.

The existing literature presents some common drawbacks:

• the structure of the coupling interface, i.e. how IRPNs are coupled and interconnected, is oversimplified;

• cascading failures in power networks and their effect on dependent railway networks are overlooked or treated approximately;

• the feedback effect of failures in railway networks on the cascading failure dynamics of power networks is not evaluated.

The first drawback is related to the modeling of coupling interfaces between IRPNs, and in particular the modeling of traction networks. In fact, electrified railway networks are supplied by power networks through traction networks, composed of electrical substations fed by an external power network that regulate the electricity supply to the railway catenary 2 . In this context, the term coupling interface refers to traction networks, which indeed act as an interface, and the interdependency links connecting traction networks to power networks and railway networks. In the existing literature, with the exception of [67] and [68], this topological configuration is overlooked, and railway and power networks are often connected directly by interdependency links without modeling explicitly traction networks (see Paper I for more details). This might result in an unrealistic topological configuration.

The second drawback is related to the modeling of cascading failures in power networks and their consequences on railway networks in terms of vulnerability. Cascading failure is defined as a "kind of failure in a system comprising interconnected parts, in which the failure of a part can trigger the failure of successive parts" [START_REF] Mahmoud | Networked control systems: cloud control and secure control[END_REF], and it can affect power networks. Cascading failures in power networks can be modeled with various approaches (the reader is referred to [START_REF] Guo | A critical review of cascading failure analysis and modeling of power system[END_REF] for a comprehensive review). In the context of IRPNs, cascading failures in power networks and their impact on railway networks are evaluated only in [START_REF] Zhang | An approach for modeling vulnerability of the network of networks[END_REF]- [START_REF] Zio | Modeling cascading failures in systems of systems with uncertain behavior[END_REF]. However, in these works, cascading failures are modeled with a network-based approach [START_REF] Motter | Cascade-based attacks on complex networks[END_REF], [START_REF] Crucitti | Model for cascading failures in complex networks[END_REF], which is not suitable to capture physical interdependencies based on power supply. Network-based approaches for cascading failure modeling usually apply network metrics, such as betweenness centrality, as a surrogate model for power flows, and the results obtained by these models are locally inconsistent with the results obtained with more realistic flow-based models [START_REF] Cupac | Comparing dynamics of cascading failures between network-centric and power flow models[END_REF].

The third drawback is related to the modeling of the impact of failures in railway networks on power networks. Failures within railway networks modify the power demand within power networks, impacting their cascading failure dynamics. This aspect has not been addressed within the existing literature.

From this exploratory literature review on vulnerability of IRPNs, three main research questions emerged, related to the identified research gaps:

• How to model the interconnections (the coupling interface) between railway and power networks and how do they affect the operational model?

• What is the impact of cascading failures in power networks on the dependent railway networks?

• How to assess the impact of failures in railway networks on the cascading failure dynamics of power networks?

In Paper I, these drawbacks are addressed by introducing traction networks within the analysis, by proposing a cascading failure model for IRPNs based on the traditional ORNL-PSerc-Alaska (OPA) model [64]- [66], and by evaluating the feedback effect of railway network failures on the cascading failure dynamics of power networks.

In Paper II, a preliminary model which is able to account for different configurations of traction networks is proposed. This chapter focuses on the work contained in Paper I. Some insights on Paper II are available in Section 2.6.

. Modeling framework

. Operational model

Each network is modeled as a graph G = (V, E), and characterized by the subscript P N (power network), T N (traction network), and RN (railway network).

Power networks operations are modeled with a DC Optimal Power Flow (DC-OPF) model. Each node i represents an electrical bus, containing generators j, each with power production capacity p i,j , and loads j, each with requested power demand d i,j . Buses are connected by transmission lines, characterized by a power flow capacity f k . The DC-OPF model in (2.2)-(2.8) is implemented using Pandapower [START_REF] Thurner | Pandapower -an open-source python tool for convenient modeling, analysis, and optimization of electric power systems[END_REF]:

min p,d,f i∈V P N j∈G i p i,j -W i∈V P N j∈L i d i,j (2.2) 0 ≤ p i,j ≤ p i,j , ∀i ∈ V P N , ∀j ∈ G i (2.3) 0 ≤ d i,j ≤ d i,j , ∀i ∈ V P N , ∀j ∈ L i (2.4) -f k ≤ f k ≤ f k , ∀k ∈ E P N (2.5) j∈G i p i,j - j∈L i d i,j + k | D(k)=i f k - k | O(k)=i f k = 0, ∀i ∈ V P N (2.6) x k f k -(θ O(k) -θ D(k) ) = 0, ∀k ∈ E P N (2.7) -θ ≤ θ i ≤ θ, ∀i ∈ V P N (2.8)
where p i,j is the power produced in generator j within the bus i, d i,j is the power supplied to load j within the bus i, and f k is the power flow in power line k. The goal is to minimize the objective function in (2.2), where W is a penalty constant (in this work, W =100) that guarantees the minimization of load shedding. This objective function is based on the work in [66]. Each bus i can contain multiple generators, contained within the set G i , and multiple loads, contained within the set L i . The power produced in each generator p i,j and the power supplied to each load d i,j are bounded by production capacity and requested power demand, as shown in Constraints (2.3) and (2.4), respectively. As shown in Constraint (2.5), the power flow in each line f k is bounded, in absolute value, by the flow capacity. The net power balance in each node must be 0, as enforced in Constraint (2.6). The DC power assumption is enforced in Constraint (2.7), where θ i is the phase angle in bus i and x k is the reactance of line k. The phase angle in each bus i is bounded, in absolute value, by a maximum value θ, as shown in Constraint (2.8). For more details, the reader is referred to Paper I, particularly Section 2.43 .

Traction networks act as an interface between IRPNs. Traction networks consist of multiple isolated substations, such as in AC-electrified railway networks, which depend on power networks in terms of power supply. The binary functional state of each substation i is dependent on the corresponding power network. In particular, each substation i in a traction network is dependent on a load j within the bus h of the corresponding power network. The binary functional state S t,i of substation i (1 if functional, 0 if failed) depends on the power supplied to load j in bus h according to the relation in Equation (2.9):

S t,i =      1, if R t,i h,j ≥ T t←p and 0 < T t←p ≤ 1 0, if R t,i h,j < T t←p and 0 < T t←p ≤ 1 0, if R t,i h,j = T t←p and T t←p = 0 (2.9)
where R t,i h,j defines the ratio between power supplied and requested power demand of load j in bus h, as defined in Equation (2.10):

R t,i h,j = d h,j d h,j .
(2.10)

The parameter T t←p ∈ [0, 1] defines the level of tolerance of traction substations to lack of electricity supply from the power network. For example, if T t←p =1, each substation is considered as failed if its corresponding load is not supplied with its entire requested power demand; if T t←p =0, each substation is considered as functional as long as its corresponding load is supplied with some electricity. For values 0 < T t←p < 1, each substation is functional if at least a fraction T t←p of electricity is supplied to its corresponding load. The values of T t←p selected in Paper I are 0.0, 0.5, and 1.0.

Railway networks are composed of nodes, representing stations, connected by edges, representing tracks. They are modeled with a topological approach, and they are dependent on traction networks in terms of electricity supply. Specifically, it is assumed that each railway track k is dependent on a subset of traction substations

V RN,k T N ⊆ V T N . Each railway track k is functional (S r,k =1) if all the substations in V RN,k T N
are functional, as defined in Equation (2.11):

S r,k = i∈V RN,k T N S t,i .
(2.11)

. Cascading failure model

Disruption within power networks can trigger cascading failure processes, which can propagate to railway networks through traction networks and the corresponding interdependency links. The proposed cascading failure modeling approach is based on the ORNL-PSerc-Alaska (OPA) model [64]- [66] (see Paper I for more details). The OPA model is a realistic flow-based modeling approach that has been validated with historical data [65], and it involves the following steps:

1. initialize network and initiating disruptive event. Go to Step 2; The proposed cascading failure model for IRPNs is based on the OPA model and accounts for the impact of failures in railway networks on the cascading failure dynamics of power networks. The flowchart is shown in Figure 2.1. The main concept to highlight is that, in case of failures within railway networks, the loads in the corresponding power networks do not require any power supply. This can modify the cascading failure dynamics of power networks. The proposed approach consists of the following steps:

. Vulnerability analysis

Vulnerability analysis consists in identifying the negative impact that various disruptive events can have on one or more systems or infrastructures. The three main steps of a vulnerability analysis are:

• define the initiating disruptive event;

• define the new states of the systems/infrastructures after the disruptive event;

• compute the associated negative consequences.

For a comprehensive vulnerability analysis, these three steps must be iteratively repeated for multiple types of initiating disruptive event.

In Paper I, the initiating disruptive events are simulated with the random removal of an increasing fraction of edges within the power network [67], [68]. In order to make the analysis agnostic about the cause of failures, no spatial nor temporal correlation between failed components is taken into account. This approach is typical of network science, and it can be used to simulate initiating disruptive events with different magnitudes. The new states of the IRPNs are then computed taking into account cascading failures and cascading effects within and between networks, using the algorithm shown in Figure 2.1.

Without indulging in details, the proposed approach allows to evaluate:

• cascading failures in power networks, with a power flow-based approach, and their propagation on railway networks through traction networks;

• the impact of failures in railway networks on the cascading failure dynamics of power networks.

The negative impact of disruptive events is computed in terms of loss of performance. For example, in power networks, the negative impact can be computed in terms of fraction of demand not supplied F DN S, while in railway networks, it can be computed in terms of loss of topological accessibility A r (the average fraction of stations accessible from each other [START_REF] Ouyang | Comparisons of complex network based models and real train flow model to analyze chinese railway vulnerability[END_REF]). The average results are evaluated for fractions of removal from 0% to 100%, with steps of 10%, and 1000 simulations per fraction of removal. In Paper I, vulnerability analyses with cascading failures included (p ol =1) and not included (p ol =0) are compared.

. Case study

This approach is applied to investigate the vulnerability of a British case study. The system is composed of a railway network, a traction network, and a power network. The railway network consists of 16 nodes (stations) and 21 edges (tracks), and it is based on a proposition made in [42]. The power network is based on the Great Britain reduced power network, and it is composed of 29 nodes (buses) and 50 edges (lines), 49 in double-circuit configuration and one in single-circuit configuration [41]. The railway and power networks are connected by the traction network, composed of 85 isolated nodes (substations). Each substation is connected with, and supplied by, the geographically-closest bus in the power network. Each railway track is supplied by a subset of substations.

. Results

The results in terms of loss of accessibility in the railway network are shown in Figure 2.4. The x-axis denotes the fraction of removed edges in the power network, which is used to simulate initiating disruptive events. The y-axis denotes the loss of accessibility. Solid curves denote results when cascading failures within power networks are included in the analysis (p ol =1), while dashed curves denote results without accounting for cascading failures (p ol =0). The three colors denote different levels of tolerance of traction substations to lack of electricity supply, as defined by the parameter T t←p . As it can be clearly seen, the tolerance T t←p of traction substations plays a key role in terms of vulnerability of electrified railway networks, as the the results for different values of T t←p vary considerably. In addition, as it can be clearly noticed by comparing solid and dashed lines, it is essential to include cascading failures within the vulnerability analysis of IRPNs, in order to avoid vulnerability underestimation.

In Figure 2.5, the results in terms of F DN S in the power network are shown. The x-axis denotes the fraction of removed edges in the power network. The y-axis denotes the fraction of demand not supplied. The black curve denotes the results of a traditional OPA model, which does not account for the effect of failures in the railway network on the cascading failure dynamics of the power network. The other curves include the impact of railway network failures within the analysis. As it can be clearly seen, when including the effect of failures in the railway network on the cascading failure dynamics of the power network, the results differ from a traditional OPA model, indicating that including the feedback effect of interdependencies on cascading failure dynamics is essential in order to estimate accurately the vulnerability of IRPNs.

. On the coupling interface topology

In Paper I, traction substations are assumed to be in electrical isolation and disconnected from each other. This corresponds to the configuration of an ACelectrified railway network. For DC-electrified railway networks, traction substations are often more numerous and connected with each other. A preliminary model for evaluating the vulnerability of IRPNs with different traction network configurations is proposed in Paper II. Within this framework, when traction substations are connected to each other, such as in a DC-electrified railway network, traction networks are modeled as a power network. Specifically, they are modeled using a DC-OPF model. A preliminary vulnerability analysis is performed on the French case study shown in Figure 2.6.

The initiating disruptive events are simulated by removing, one by one, buses in the power network. The negative impact of removals is measured on the three networks. For example, in the power and traction networks, the negative impact is As it can be seen in Figure 2.7, the worst-case scenarios for the power network and the traction network, in terms of F DN S, are different. In particular, the scenario which leads to the highest F DN S in the power network is the failure (removal) of bus 83, which leads to F DN S=0.210; for the traction network, the worst scenario is the failure (removal) of bus 78, which leads to F DN S=0.146 4 . Failures and disruption in the power network spread to the traction network through their interdependency links, collectively referred to as the coupling interface. Clearly, as the worst-case scenario of the power network does not correspond to the worstcase scenario of the traction network, the topology of their coupling interface, i.e. where the interdependency links are present, plays a key role in terms of failures 0 10 20 30 and disruption propagation. This observation leads to the next research question of this dissertation:

• how to design and optimize the topology of coupling interfaces between interdependent CIs in order to enhance their resilience?

. Conclusion

In this chapter, the models for the vulnerability analysis of IRPNs proposed in Paper I and Paper II are highlighted. The main contribution of this chapter and the related papers is to propose an approach for assessing the vulnerability of IRPNs while accounting for a realistic coupling interface and cascading failures within and between networks. The obtained results demonstrate the importance of considering cascading failures within the vulnerability analysis. In Paper II, preliminary results show that the worst-case scenarios for individual interdependent networks might differ. Intuitively, this result might be strongly influenced by the coupling interface topology. Consequently, in the next chapter, the optimization of coupling interface topology and design is investigated.

-Design and optimization of coupling interface topology

. Introduction

As CIs are the backbone of advanced societies, it is essential to guarantee their resilience under conditions of disruption. In the previous chapter, it was highlighted that the topology of coupling interfaces, i.e. how interdependent CIs are coupled together, might play a key role in terms of vulnerability and survivability, as it defines how failures and disruption propagate between different infrastructures. Despite playing such an important role, coupling interface optimization has not been investigated thoroughly in the existing literature.

NB:

In this chapter, the term "coupling interface" strictly refers to the ensemble of interdependency links connecting two interdependent CIs.

In the community of network science, it is already acknowledged how coupling interfaces can strongly impact failure propagation between interdependent networks. In [START_REF] Parshani | Interdependent networks: reducing the coupling strength leads to a change from a first to second order percolation transition[END_REF], it is shown how the coupling strength between interdependent networks, i.e. the fraction of nodes in each network which is dependent on nodes of the other network, strongly impacts the failure propagation between networks. The results are evaluated in terms of transition phase using percolation theory. Similarly, in [START_REF] Fu | Interdependent networks: vulnerability analysis and strategies to limit cascading failure[END_REF], the authors explore the effect of interdependencies and different coupling strategies on the vulnerability of interdependent networks. Moreover, other authors have already investigated various allocation strategies of interdependency links in interdependent networks using percolation theory as a modeling approach [START_REF] Yagan | Optimal allocation of interconnecting links in cyber-physical systems: interdependence, cascading failures, and robustness[END_REF]- [START_REF] Chattopadhyay | Designing optimal interlink patterns to maximize robustness of interdependent networks against cascading failures[END_REF]. These works acknowledge the importance of optimizing the coupling interface topology between interdependent networks. However, their modeling framework, based on percolation theory, is not suitable for real-world decision-making, as it provides only an approximation of the realistic functionality of CIs.

In the existing literature on interdependent CIs, design and optimization of coupling interfaces have been rarely investigated. In fact, in most of the existing literature on interdependent CIs, the coupling interface topology is a constant parameter, and no sensitivity analysis nor optimization is performed. In some works, coupling strategies based on network metrics have been investigated for different types of interdependent infrastructures, such as power and water networks [START_REF] Wang | Vulnerability analysis of interdependent infrastructure systems: a methodological framework[END_REF] or power and telecommunication networks [START_REF] Guo | A complex network theory analytical approach to power system cascading failure-from a cyber-physical perspective[END_REF]- [START_REF] Rueda | Using interdependency matrices to mitigate targeted attacks on interdependent networks: a case study involving a power grid and backbone telecommunications networks[END_REF]. While these papers investigate the impact of different coupling interface topologies on the cascading effect in interdependent CIs, they still rely on heuristics approaches based on network metrics. Thus, these works can not provide a solid framework for decision-making, as heuristic approaches do not guarantee the optimality of solutions and are hardly generalizable.

The need to optimize coupling interfaces between interdependent infrastructures is acknowledged in [31] and [32]. In [31], the authors rely on network metrics, such as Euclidean distance, node degree, and betweenness, to identify hybrid coupling strategies between power, water and gas networks and reduce cascading effect under conditions of disruption. A similar approach is taken in [32], where the authors propose a similar framework for coupling interdependent CIs, relying on network metrics and physical properties of the CIs, in order to increase their resilience. While these works investigate different hybrid strategies for coupling interdependent infrastructures, their approaches are based on heuristics and network metrics, and they do not guarantee optimal solutions. In this chapter, a resilience-based mathematical programming framework for the optimal coupling of interdependent CIs is proposed. Firstly, an approach for designing robust coupling interfaces, based on the content of Paper III, is presented. In this paper, the topology of coupling interfaces is optimized in order to maximize the combined survivability of interdependent CIs in the worst-case feasible failure scenario. Secondly, in Paper IV, this framework is extended including uncertainty within the analysis, leveraging on a distributionally robust optimization (DRO) approach. Lastly, in Paper V, the model is extended with the inclusion of redundant interdependency links, which exist in reality but are often overlooked in the existing literature.

. Operational modeling framework

Interdependent CIs are modeled as networks, and represented by a graph G=(V, E), where V is the set of N nodes and E is the set of M edges. Each edge k is directed, and is defined by an origin node O(k) and a destination node D(k). Components belonging to different infrastructures can be connected by interdependency links, which denote relationships of interdependency. The ensemble of these links is referred to as the coupling interface.

Given a system of interdependent CIs, coupled through a coupling interface y, their operations are defined by an operational model Q(y, ξ), where ξ denotes the uncertainty realization. In this case, as it will be clear in the next sections, the uncertainty ξ defines the functional state of the CIs components, which depends on failures and disruption.

The operational model simulates the actions of CIs operators, and is modeled as an optimization problem. It is assumed that the operators aim at optimizing the combined performance P comb of the interdependent CIs. For a set I of interdependent infrastructures, the combined performance P comb can be generally defined as in Equation (3.1):

P comb = i∈I w i P i (3.1)
where P i is the individual performance of infrastructure i, and w i is its weight (i.e. its importance) when computing the combined performance.

For a fixed coupling interface y * and fixed failure scenario u * , which defines the uncertainty realization ξ, the operational model Q(y, ξ) is defined as a maximization problem, represented in its compact matrix formulation as in (3.2)-(3.4):

max h,δ b T h (3.2) subject to: Rh ≤ q -Tu * -Hy * -Wδ -y * T Dδ (3.3) h ∈ R N h , δ ∈ {0, 1} N d . (3.4)
The vectors h and δ, with dimensions N h and N d , represent the continuous and binary operational variables of the problem, respectively. The vector b and the matrices R, T, H, W, and D contain the coefficients of objective function and constraints, while the vector q contains the parameters of the constraints. The objective function in (3.2) represents the combined performance of interdependent infrastructures, previously shown in Equation (3.1). Equation (3.3) contains the operational constraints. The details of the optimization problem depend on the infrastructures involved and the operational assumptions. For the full formulation of the operational models, with a detailed explanation of the operational variables h and δ and the related operational constraints, the reader is referred to the appended papers (e.g. Section 2 of Paper III)5 .

. Case study

In Paper III, Paper IV, and Paper V, a case study based on interdependent power and gas networks (IPGNs) is used. The geographical representation of the two infrastructures is shown in Figure 3.1. The power network, defined by the subscript P N , is based on the IEEE 14-bus system [101], composed of 14 nodes and 20 edges. The gas network, defined by the subscript GN , is based on the IEEE 9-bus system [102], composed of 9 nodes and 9 edges. Each node i is characterized by production capacity of power or gas p i and requested demand of power or gas d i . These energy commodities are distributed through power lines and gas pipelines, represented by edges, with a maximum flow capacity f k . The power network operations are modeled with a DC power flow model, while the gas network operations are modeled with a maximal flow approach, which represents a linear approximation of gas flow models [34]. In this case, the operational model of the IPGNs, represented by the recourse function Q(y, ξ), denotes the maximization of the fraction of requested demand of power and gas which is possible to supply. The objective function of Q(y, ξ) is shown in Equation (3.5):

P comb = w P N d P N i∈V P N d i + w GN d GN i∈V GN d i .
(3.5)

The coefficients w P N and w GN , here assumed to be both equal to 0.5, are the weights of power network and gas network when computing the combined performance. The coefficients d P N and d GN are the total requested power demand in the power network and the total requested gas demand in the gas network. The variable d i defines the supplied power or gas in each node i of the networks. The combined performance P comb ranges from 0, when no power and gas demand is supplied, to 1, when 100% of the requested demand of power and gas is supplied [10].

The interdependencies between IPGNs are based on the following assumptions:

• each node in the power network with power production capacity p i > 0 contains a gas-fired power plant, and is dependent on the gas network in terms of gas supply;

• each node in the gas network needs electricity in order to guarantee the functionality of various electrical equipment, such as pumps or valves, and is dependent on the power network in terms of power supply.

These relationships of interdependency are built within the constraints of the operational model Q(y, ξ), using mathematical assumptions which are consistent with the existing literature on interdependent CIs [34]. For example, in each node i of the power network with production capacity p i > 0, it is possible to produce electricity only if there is a functional interdependency link with a node j in the gas network, i.e. the gas-fired power plant receives the necessary gas supply. It is assumed that the interdependency link from j ∈ V GN to i ∈ V P N is functional only if the requested demand of gas in j ∈ V GN is fully satisfied. The rationale behind this assumption is that, if node j is not supplied with its entire gas demand, the dependent gas-fired power plant in i ∈ V P N might not receive the necessary gas supply. Similar assumptions are considered for the interdependencies from the power network to the gas network. For more details on the operational model and the related equations and constraints, the reader is referred to the appended papers (e.g. Section 2 of Paper III).

. Coupling interface topology -toy model

Before presenting the mathematical programming framework, it is useful to introduce an illustrative example of the coupling interface design problem and its impact on the failure propagation between interdependent CIs.

Let us have two interdependent power and gas networks, both consisting of two nodes connected by one edge, as shown in Figure 3.2. In the power network, the electricity is produced by a gas-fired power plant in node 1, and general customers (industries, households, etc.) are supplied by node 2. Similarly, in the gas network, the gas is produced (extracted) in node 1, and general customers are supplied by node 2. The gas-fired power plant in node 1 ∈ V P N receives the necessary gas supply from node 2 ∈ V GN , while nodes 1 ∈ V GN and 2 ∈ V GN receive the necessary electricity from nodes 2 ∈ V P N and 1 ∈ V P N , respectively. These relationships of interdependency define the coupling interface of the IPGNs, and they are represented by the interdependency links (dashed lines) in Figure 3.2.

Let us assume that a failure occurred in the power line connecting nodes 1 ∈ V P N and 2 ∈ V P N . Consequently, the electricity produced in node 1 ∈ V P N can not be delivered to node 2 ∈ V P N , and the interdependency link from node 2 ∈ V P N to node 1 ∈ V GN can be considered as nonfunctional, as no electricity is supplied to node 2 ∈ V P N . With no functional interdependency links from the power network to node 1 ∈ V GN , i.e. no power supply to node 1 ∈ V GN , the gas network can not produce gas, as the electrical equipment, such as pumps, valves, and compressors, is not provided with electricity. With no supply of gas, the interdependency link from node 2 ∈ V GN to node 1 ∈ V P N is considered nonfunctional. Consequently, it is not possible to produce electricity in the gas-fired power plant in node 1 ∈ V P N . The failure of the power line results, thus, in the total disruption of the IPGNs, as no power and gas is produced nor supplied.

Let us modify the coupling interface topology, by making node 1 ∈ V GN coupled with, and dependent on, node 1 ∈ V P N , as shown in Figure 3.3. In this case, the failure of the power line would result only in partial disruption of the IPGNs. The general consumers of electricity can not be supplied, as no electricity is delivered to node 2 ∈ V P N due to the power line failure. However, as in this case node 1 ∈ V GN is dependent on node 1 ∈ V P N , the production of gas is not disrupted, and the general gas consumers, as well as the gas-fired power plant in the power network, are normally supplied by node 2 ∈ V GN .

As it can be clearly understood in this qualitative example, the topology of the coupling interface, which defines the specific location of interdependency links, is a driving factor of failures and disruption propagation in interdependent CIs, and its optimization is of the utmost importance.

. Robust coupling interface

. Defender-attacker-defender formulation

The approach taken in Paper III consists in identifying the coupling interface topology that maximizes the combined performance of the IPGNs in the worst-case feasible failure scenario. Using the resilience framework defined in Chapter 1, the problem is equivalent to identifying the coupling interface topology that maximizes the combined survivability of the IPGNs in the worst-case feasible failure scenario. The proposed approach is based on the defender-attacker-defender (DAD) model, which is often applied in the context of protection and resilience enhancement of CIs [55], [69], [START_REF] Brown | Analyzing the vulnerability of critical infrastructure to attack and planning defenses[END_REF]- [START_REF] Oster | Power system resilience through defender-attackerdefender models with uncertainty: an overview[END_REF]. The DAD approach is a three-players sequential game: the outer defender represents planners and decision-makers, and aims at identifying the optimal planning decisions or resource allocation in order to maximize the objective function; the middle attacker represents various sources of failures and disruption, and aims at identifying the most disruptive attack plan in order to minimize the objective function; the inner defender represents the various CIs operators, and aims at maximizing the objective function by controlling the operational variables [START_REF] Yuan | Optimal power grid protection through a defender-attacker-defender model[END_REF].

In this case, the outer defender aims at identifying the optimal coupling interface topology, in order to maximize the combined performance of the IPGNs against the optimal attack plan of the middle attacker, which aims at minimizing the combined performance of the IPGNs. The inner defender represents the operators, and it is defined by the operational model Q(y, ξ). The problem takes the form in (3.6)- (3.12):

max h ′ ,δ ′ ∈{0,1} N d y∈{0,1} Nc min u∈{0,1} M P N Q(y, ξ) (3.6)
subject to:

j∈V P N y g←p ij ≤ 1, ∀i ∈ V GN (3.7) j∈V GN y p←g ij ≤ 1, ∀i ∈ V P N (3.8) i∈V GN j∈V P N y g←p ij d km ij c g←p km + i∈V P N j∈V GN y p←g ij d km ji c p←g km ≤ B ci (3.9) Rh ′ ≤ q -Hy -Wδ ′ -y T Dδ ′ (3.10) b T h ′ ≥ 1 (3.11) k∈E P N (1 -u k ) ≤ K att .
(3.12)

The problem presents a trilevel max-min-max formulation, where the innermost maximization is contained within the recourse function Q(y, ξ). The outer defender aims at maximizing the combined performance of the IPGNs, represented by the objective function of the recourse function Q(y, ξ), by allocating the coupling interface through the binary variables y g←p ij and y p←g ij , contained within the vector y with dimension N c =N 2 P N × N 2 GN . The binary variable y g←p ij =1 if node i ∈ V GN is dependent on node j ∈ V P N , and y g←p ij =0 otherwise. Similarly, the binary variable y p←g ij =1 if node i ∈ V P N is dependent on node j ∈ V GN , and y p←g ij =0 otherwise. In other words, when a y variable is equal to 1, it denotes the presence of an interdependency link between two nodes of the power and gas network. The middle attacker aims at minimizing the combined performance of the IPGNs by targeting and failing power lines of the IPGNs through the binary variables u k , contained within the vector u with dimension M P N . The binary variable u k =1 when line k is functional, and u k =0 when line k is targeted and failed by the attacker. The inner defender, represented by the recourse function Q(y, ξ), aims at maximizing the combined performance by controlling the operational variables of the IPGNs (variables of the operational model in Section 3.2). The recourse function, as it was previously explained, depends on the coupling interface placed by the outer defender through the binary variables y and the uncertain functional state of the systems ξ, defined by the components targeted and failed by the middle attacker through the binary variables u.

The optimal objective value corresponds to the maximized combined performance of the IPGNs, expressed as in Equation (3.5), in the worst-case feasible failure scenario. The coupling interface topology which maximizes the combined performance of the IPGNs in the worst-case failure scenario is obtained as a byproduct of the optimization model. This model can be interpreted as a robust optimization problem. In fact, the attacker can target and fail a finite combinations of components. All the feasible combinations of failed components are contained within the set of feasible failure scenarios, which can be interpreted as a discrete uncertainty set. Accordingly, the outer defender seeks to optimize decisions against the worst-case scenario within the uncertainty set, i.e. the worst-case failure scenario.

The actions of both the outer defender and the attacker are regulated by some assumptions, defined by Constraints (3.7)- (3.11) for the outer defender and Constraint (3.12) for the attacker. In these equations, the coefficient d km ij denotes the distance in kilometer between two nodes, while the coefficients c g←p km and c p←g km denote the price per kilometer of allocating interdependency links, here both assumed to be equal to 1 $/km. The vectors h ′ defines the continuous operational variables of the outer defender, while the vector δ ′ defines the binary operational variables of the outer defender. The other vectors and matrices in Constraints (3.10) and (3.11) represent coefficients and parameters of the operational constraints of the outer defender.

The actions of the outer defender are regulated by the following assumptions:

• each node in the gas network can be dependent on a maximum of one node of the power network, and vice versa. This is defined as "singledependency" assumption and is enforced by Constraints (3.7) and (3.8). In other words, each node in the gas network can be the receiving end of only one interdependency link from the power network, and vice versa;

• the allocation of interdependency links has a cost per kilometer, and it is limited by the available monetary budget B ci , as enforced by Constraint (3.9);

• the coupling interface must be allocated in order to ensure that, under normal conditions, i.e. all the components are functional, the total requested demand of power and gas can be fully satisfied. This condition is enforced by Constraints (3.10) and (3.11) (see Section 2 of Paper III).

The actions of the attacker, similarly to other works [69], are limited by the maximum number of lines K att that can be targeted and failed, as enforced by Constraint (3.12). The attacker is assumed to target only power transmission lines. With these assumptions, the attacker can choose from a limited number of attack plans, contained within the set of feasible failure scenarios A, defined as in (3.13):

A = u {0, 1} M P N , ||1 M P N -u|| 1 ≤ K att . (3.13)
As it is highlighted in Paper III, "by considering the simultaneous failures of transmission lines, the model is agnostic about the source of disruption, providing a rapid and objective way of calculating the consequence of damage to any set of components" [10].

These assumptions are used to establish the general framework, and they can be easily adapted to describe different situations. For example, the possibility for the attacker to target other components, such as nodes or interdependency links, can be easily included with additional constraints similar to Constraint (3.12) and by modifying the relative operational constraints within the inner defender recourse function Q(y, ξ).

. Solution strategy

When the recourse function is extended in its explicit form, previously shown in Equations (3.2)- (3.4), the problem presents a trilevel max-min-max formulation. As the inner maximization includes binary variables, a strategy based on the dualization of the inner problem, in order to merge it with the middle minimization, is not suitable. In this work, a cutting plane strategy, called Nested Column&Constraint Generation (NC&CG) algorithm, is applied [START_REF] Zeng | Solving two-stage robust optimization problems using a column-and-constraint generation method[END_REF], [START_REF] Zhao | Vulnerability analysis of power grids with line switching[END_REF]. With this approach, the original problem is extended into a four-level max-min-max-max problem by separating the binary and continuous variables of the inner level. The problem is then separated into an outer layer and an inner layer. Each layer is composed of a master problem and a subproblem. These problems and layers are solved separately and iteratively, by exchanging primal binary variables between them. The general flowchart of the NC&CG algorithm is shown in Figure 3.4. This procedure is proven to converge to the global optimal solution, and it has already been applied in similar problems [34], [START_REF] Yuan | Optimal power grid protection through a defender-attacker-defender model[END_REF]. For more details, the reader is referred to Appendix A of this manuscript and Section 3 of Paper III.

. Results

The results are evaluated in terms of combined performance of the IPGNs in the worst-case feasible failure scenario. For the sake of comparison, the results obtained by the proposed DAD approach are compared with the results obtained by designing the coupling interface with network metrics-based heuristic strategies. [10], [START_REF] Bellè | A data-driven distributionally robust approach for the optimal coupling of interdependent critical infrastructures[END_REF], [START_REF] Bellè | Resilience enhancement by optimal allocation of redundant interdependency links in interdependent critical infrastructures[END_REF].

degree, and betweenness centrality, are used. The description of the five strategies contained in Paper III is here recalled [10]:

• "Euclidean: each node in the power network (or gas network) is dependent on the geographically closest node in the gas network (or power network);

• DD ast : the node with the k th highest degree in the power network (or gas network) is dependent on the node with the k th highest degree in the gas network (or power network);

• DD dst : the node with the k th highest degree in the power network (or gas network) is dependent on the node with the k th lowest degree in the gas network (or power network);

• BB ast :the node with the k th highest betweenness in the power network (or gas network) is dependent on the node with the k th highest betweenness in the gas network (or power network);

• BB dst : the node with the k th highest betweenness in the power network (or gas network) is dependent on the node with the k th lowest betweenness in the gas network (or power network)."

The results of the network metrics-based coupling interfaces and optimal coupling interfaces identified with the proposed DAD approach are shown in Figures 3.5 and 3.6, respectively. The x-axis indicates different values of K att , from 1 to 5, which denotes the maximum number of power lines that can be targeted and failed by the attacker. The y-axis denotes the worst-case combined performance of the IPGNs, i.e. the combined fraction of requested demand of power and gas which is possible to supply in the worst-case scenario within the set of feasible failure scenarios A.

In Figure 3.5, it can be clearly noticed how different coupling interfaces lead to considerably different worst-case combined performances. Particularly, the Euclidean coupling strategy, based on node geographical proximity, seems to outperform the other strategies. However, these heuristic strategies are strongly casedependent, and for a different case study the best-performing coupling strategy might differ. In Table 3.1, the cost associated with each network metrics-based coupling strategy is computed assuming costs per kilometer c g←p km and c p←g km equal to 1 $/km.

The results of the optimal coupling strategies, identified with the proposed approach for different available monetary budgets B ci , are shown in Figure 3 Worst-case combined performance

B ci = $823 B ci = $900 B ci = $1000 B ci = $1100 B ci = $1200 B ci = $1300 B ci = $1400 B ci = $1500

Strategy Cost

Euclidean $823

DD ast $1518 DD dst $2098 BB ast $1943 BB dst $2126
interfaces (see Table 3.1), to $1500.

Firstly, it can be noticed that the results for the Euclidean coupling interface in Figure 3.5 (blue solid line) and the results with a budget B ci =$823 in Figure 3.6 (blue dashed line), are equivalent. This is because, with a budget equal to $823, the Euclidean coupling interfaces are the only ones which is possible to allocate 6 . With lower budgets, the problem is unfeasible, as it is not possible to respect Constraint (3.11).

Secondly, it can be clearly seen that the network metrics-based coupling interfaces are outperformed in terms of worst-case combined performance. For example, for the case K att =5, the Euclidean coupling interface, the best-performing in Figure 3.5, leads to worst-case combined performance equal to 0.308, while an optimal coupling interface with a budget B ci =$900 leads to worst-case combined performance equal to 0.514. This corresponds to a 66.9% increase in combined performance for a 9.3% increase in budget.

. Remarks

This work represents the first mathematical programming approach for optimizing the topology and the design of coupling interfaces between interdependent CIs.

The main contributions of this work are:

• demonstrating the importance of coupling interface optimization for increasing the survivability of interdependent CIs under conditions of disruption;

• proposing an optimization-based approach that can be used by decisionmakers for analyzing, designing, or retrofitting existing and new coupling interfaces.

It should be mentioned that in Paper III, the proposed optimization framework also accounts for the cost of the coupling interface. In fact, for each combination of K att and B ci , multiple optimal coupling interfaces might exist, and the proposed approach identifies the cheapest optimal coupling interface thanks to a cost penalty term. In other words, among the set of optimal coupling interfaces that maximize the combined performance, the proposed DAD approach selects the cheapest solution. For the sake of simplicity and clarity, this part is omitted from this dissertation. The reader is referred to Paper III for more details.

The approach based on the DAD model suffers from some limitations. Particularly, similarly to other works developed with a DAD approach (or, in general, a robust optimization approach), the solutions are optimized against the worst-case scenario, and this might lead to over-conservative solutions. Despite the decisionmakers having control over the size of the set of feasible failure scenarios through the parameter K att , it might not suffice to avoid over-conservative solutions. In Paper IV, an alternative approach, based on distributionally robust optimization, is proposed, in order to provide decision-makers with more control over the conservativeness of the model. In this work, the occurrence probability of each failure scenario in the set A is taken into account.

. Distributionally robust coupling interface

. Distributionally robust approach

When dealing with optimization under uncertainty, the two most traditional approaches are robust optimization (RO) and stochastic optimization (SO).

In RO, the decision-maker seeks to optimize decisions against the worst-case realization of the uncertainty. For example, in the previously explained DAD approach, assuming that the uncertainty set A denotes the discrete set of feasible failure scenarios, the decision-makers seek to optimize the coupling interface against the worst-case failure scenario in A. The RO framework, as the decisionmakers seek to optimize against the worst uncertainty realization, is considered a risk-averse approach In SO, decision-makers are assumed to possess full probabilistic knowledge of the uncertainty distribution, and to have a neutral attitude towards risk 7 . Decisionmakers seek, thus, to identify decisions that optimize the expectation of the objective function considering the whole spectrum of uncertainty realization. In the case of coupling interface design, this situation would translate into identifying a coupling interface topology that optimizes the expected combined performance of the IPGNs under the conditions of disruption defined by the set A. As the uncertainty set A is discrete, it can be described by a multinomial probability distribution. The expected performance of the IPGNs are simply computed as the weighted sum of the combined performance in each individual scenario within the set A, where the weight of each scenario corresponds to its probability mass within the multinomial distribution. This approach relies on the assumption that the multinomial probability distribution of the set A of feasible failure scenarios is perfectly known.

In practice, this assumption is considerably difficult, if not impossible, to guarantee, due to various reasons:

• sparsity of data: detailed historical data on contingencies and failures are rarely available. Even when available, the quantity of events does not usually allow to estimate a probability distribution with high confidence;

• environment: the environment variability and external factors (weather, climate changes, geopolitical factors, etc.) introduce large uncertainties which make it difficult to estimate failure scenario probabilities accurately;

• unpredictability: it is often impossible to estimate the likelihood of intentional attacks, such as terroristic attacks or deliberate sabotages, against one or more CIs.

Thus, in this context, this approach is impractical and it does not represent a feasible modeling choice for the optimization of coupling interface topologies. While it might be not feasible to identify the true multinomial probability distribution of the set A, it is often possible to identify partial probabilistic information, such as moment information, from historical data and/or expert judgement. This available information can be exploited in a robust stochastic approach, called distributionally robust optimization (DRO), that protects decision-makers against the ambiguity of the probability distribution [START_REF] Rahimian | Distributionally robust optimization: a review[END_REF]. With this approach, decision-makers seek to optimize decisions against the worst probability distribution that can describe the uncertainty set. In practice, the available probabilistic information is encoded within the optimization model. The decision-makers aim at optimizing the expectation of the objective function under the worst probability distribution (which becomes a variable of the problem) that can describe the uncertainty set while respecting the encoded probabilistic information. In terms of risk-aversion, DRO lies in-between RO and SO, and it can be considered as their generalization.

The DRO approach has gained the interest of several research fields in the recent years. For example, the reader is referred to [START_REF] Wang | Wasserstein distributionally robust shortest path problem[END_REF]- [START_REF] Arrigo | Wasserstein distributionally robust chanceconstrained optimization for energy and reserve dispatch: an exact and physically-bounded formulation[END_REF] for applications in various fields.

Probabilistic moments are particularly convenient information to encode within DRO approaches, as they are usually easy to estimate. In Paper IV, a DRO approach based on the upper bounds of the conditional marginal probability of each line to be in a failure state is proposed [START_REF] Babaei | Distributionally robust distribution network configuration under random contingency[END_REF]. In other words, given the condition that one of the scenarios within A has occurred (except the "normal" scenario, where all the lines are functional), i.e. at least one line has failed, this conditional marginal probability defines the likelihood of each line k to be in a failure state (u k =0). Accordingly, decision-makers seek to identify the coupling interface topology that maximize the expected combined performance of the IPGNs under the worst probability distribution of the set A that respects the encoded upper bounds on the conditional marginal probability of each line to be in a failure state.

. Distributionally robust optimization -toy model

The purpose of DRO is to protect decision-makers against ambiguous probability distributions. This is achieved by optimizing the expectation of an objective function accounting for the worst probability distribution that respects the enforced probabilistic conditions. Before presenting the DRO formulation for the optimal coupling of interdependent CIs, it is useful to introduce an illustrative example to clarify the meaning of worst probability distribution with upper bounds on the conditional marginal probability of each line to be in a failure state.

Let us have a power network, composed of three buses (nodes) connected by two power lines (edges), as shown in Figure 3.7. Node 1 contains a power plant with a very large production capacity p 1 (enough to supply the whole network). Nodes 2 and 3 both contain a load with a requested power demand d 2 =d 3 =1 MW, for a total requested power demand d P N =2 MW. The two power lines are characterized by a very large flow capacity, greater than 2 MW. Under normal conditions, 2 MW are produced within node 1 and supplied to nodes 2 and 3 (1 MW each) through the power lines.

In this work, the purpose of the DRO approach is to identify a solution (the design of the coupling interface topology) that maximizes the expected performance in the worst probability distribution of the set A of feasible failure scenarios. The toy model in Figure 3.7, solely based on a power network, is useful to understand the concept of worst probability distribution with enforced moment information.

Assuming only failures of power lines and a value K att =2, the set A of this toy model consists of four different scenarios u k , as shown in Table 3.2. The corresponding performance P k , in terms of fraction of total requested power demand d P N which is possible to supply for each scenario u k are also shown in Table 3.2. In the scenario with no failures u ∅ , the performance P ∅ is equal to 1.0, as it is possible to supply 100% of the total requested power demand d P N . In the scenarios with one line failed, u 1 and u 2 , the performances P 1 and P 2 are equal to 0.5, as it possible to supply either node 2 or node 3. In the scenario with two lines failed u 1,2 , the performance P 1,2 is equal to 0.0, as it is not possible to supply any power to nodes 2 and 3. As the set A is a finite set with discrete scenarios, it can be described by a multinomial distribution P, in which each scenario u k is assigned a probability mass ϕ k . The assigned probability masses must respect the condition in (3.14):

k∈A ϕ k = 1. (3.14)
Moreover, some probabilistic moment information are enforced to the probability distribution of A. In this work, an upper bound π max k on the conditional marginal probability of each line k to be in a failure state 8 , defined as π k , is en-forced. The reason of this choice are detailed in the next section. The marginal probability π k for line 1 and 2 are defined as in (3.15) and (3.16), respectively:

π 1 = ϕ 1 + ϕ 1,2 (3.15) π 2 = ϕ 2 + ϕ 1,2 (3.16)
In this specific example, the distribution P should respect the conditions in (3.17)- (3.19):

ϕ ∅ = 0 (3.17) ϕ 1 + ϕ 1,2 ≤ π max 1 (3.18) ϕ 2 + ϕ 1,2 ≤ π max 2 . (3.19)
Equation (3.17) states that the probability mass of the normal scenario u ∅ should be 0. In other words, P defines a conditional distribution, where the condition is that at least one line is in a failure state. The reason of this choice is explained in the next section. Equations (3.18) and (3.19) define the upper bounds on the conditional marginal probability of each line k to be in a failure state. Under these assumptions, the set A can be described by any multinomial distribution that respects the conditions in (3.17)- (3.19). The worst probability distribution P defines the probability distribution that respects the aforementioned conditions and leads to the lowest expected performance in the power network. Mathematically, it can be identified by solving Equation (3.20) =0.8, it can be easily verified that the worst distribution P is the one defined in (3.21), which leads to expected performance equal to 0.20.

P =        ϕ ∅ = 0.0 ϕ 1 = 0.2 ϕ 2 = 0.2 ϕ 1,2 = 0.6 (3.21)
Any other distribution would either lead to higher expected performance or fail to meet the conditions enforced in (3.14) and (3.17)- (3.19). The purpose of DRO is, thus, to identify solutions that are robust against the worst probability distribution that can characterize the set of feasible failure scenarios.

. Distributionally robust formulation

In Paper IV, the DRO framework for the optimal coupling of interdependent CIs is developed using IPGNs as case study. The operational model is represented by the recourse function Q(y, ξ), which defines the maximization of the combined performance of the IPGNs under the operational constraints. The decision-makers allocate the coupling interface in order to maximize the expected combined performance of the IPGNs under conditions of disruption, and its actions are limited by the same assumptions of Section 3.4.1, defined by Constraints (3.7)- (3.11). The middle minimization still represents the disruptive agent. However, instead of identifying the worst-case feasible failure scenario in A, this agent aims at identifying the worst multinomial distribution which can describe the uncertainty set A, while respecting the encoded probabilistic information.

The DRO approach for optimizing the coupling interface topology can be defined as Equation (3.22):

max h ′ ,δ ′ ∈{0,1} N d y∈{0,1} Nc min P∈M E P [Q(y, ξ)] (3.
M = P ∈ P(A) : 0 ≤ E P [1 M P N -u] ≤ π max . (3.23)
The set M, called the ambiguity set, contains all probability distributions on a σ-field of A that ensure that the conditional marginal probability of each line k to be in a failure state is lower or equal to the upper bound π max k . The upper bounds are contained within the vector π max . The term 1 M P N defines an M P N - dimensional vector of 1s. As the middle agent in (3.22), rather than selecting the worst-case scenario in A, aims at identifying the worst distribution in M, Equation (3.23) replaces Constraint (3.12) of the DAD model.

The motivation for choosing an ambiguity set M based on the conditional marginal probability of each line k to be in a failure state is threefold:

• the conditional marginal probability, where the term conditional refers to the condition that at least one is failed, allows to optimize the expected combined performance in situations of disruption. In fact, the combined performance under normal conditions is already ensured by Constraints (3.10) and (3.11);

• this marginal probability provides a meaningful physical interpretation of the problem, as it represents the "tendency" of each line to be in a failure state;

• moment information is usually easy to estimate and encode within an optimization problem.

In summary, the ambiguity set M denotes the set of conditional multinomial distributions which define the probability of the system to be in a specific failure scenario, under the condition that at least one line is failed. In order to guarantee that M defines the set of conditional multinomial distributions, i.e. the probability mass assigned to the normal scenario is equal to 0, the upper bounds π max must respect some specific conditions (see Section 3.2 of Paper IV for more details).

In Paper IV, the upper bounds of the conditional marginal probability π max are estimated empirically from an artificial dataset of contingency scenarios. The estimated upper bounds π max are shown in Table 3.3. For more details, the reader is referred to Section 4.1 of Paper IV. The optimal objective value corresponds to the maximized expected combined performance of the IPGNs under the worst distribution in M. The advantage of a DRO model is to identify coupling interface topologies with a robust approach that avoids the "worst-case" over-conservativeness of the DAD model.

. Solution strategy

The problem can be solved with an NC&CG approach. However, it needs to be recast into an equivalent tractable formulation. Particularly, the problem in (3.

max h ′ ,δ ′ ∈{0,1} N d y∈{0,1} Nc β≥0 min u∈{0,1} M P N Q(y, ξ) + k∈E P N β k (1 -u k -π max k
).

(3.24)

As the reformulation involves duality theory, the problem in (3.24) contains the dual variables β k , contained within the vector β. In this form, the problem can be solved by an NC&CG algorithm, shown in Figure 3.4. For details on the solution procedure and the derivation of the reformulation, the reader is referred to Section 3 of Paper IV.

. Results

The results are evaluated for a maximum number of failed edges K att =3 and a monetary budget B ci =$1100, and they are shown in Figure 3.8. The results are evaluated in terms of expected combined performance of the IPGNs under conditions of disruption, as indicated by the y-axis. As indicated by the x-axis, the results are evaluated in terms of ambiguity set size by multiplying the upper bounds π max in Table 3.3 by an increasing factor (from 1 to 6). For example, 2π max indicates that the upper bounds in Equation (3.23) are equal to the bounds in Table 3.3 multiplied by a factor of 2. The results are also evaluated when the upper bounds π max are all set equal to 1. Results with a budget B ci =$823, corresponding to the cost of Euclidean coupling interfaces, are shown for the sake of comparison. Four curves are shown in Figure 3.8: the blue curves represent the worst expected performance associated with the optimal and Euclidean coupling interfaces, computed by the distributionally robust optimization model; the red curves represent the worst-case scenario in A associated to the optimal and Euclidean coupling interfaces. As it max 2 max 3 max 4 max 5 max 6 max max = 1

Combined performance

Optimal -worst expected performance Optimal -worst-case performance Euclidean -worst expected performance Euclidean -worst-case performance can be clearly seen in Figure 3.8, the Euclidean coupling interface is outperformed by the optimal coupling interface. Firstly, the worst expected performances are significantly higher in the optimal case. For example, using the upper bounds in Table 3.3, the optimal case leads to worst expected performance equal to 0.984, while the Euclidean case, for the same upper bounds, to worst expected performance equal to 0.927. As it is graphically evident, this difference increases as the upper bounds π max increases. For example, using the upper bounds π max multiplied by a factor 6, the optimal case leads to worst expected performance equal to 0.937, while the Euclidean case, for the same upper bounds, to worst expected performance equal to 0.756. Secondly, the associated worst-case performances are also significantly better in the optimal case. For example, using the upper bounds in Table 3.3, the optimal case leads to an associated worst-case performance equal to 0.902, while the Euclidean case, for the same upper bounds, leads to an associated worst-case performance equal to 0.703.

As it was expected, increasing the upper bounds π max , by multiplying them by factors from 2 to 6, increases the conservativeness of the solution. In fact, as it can be clearly seen, the worst expected performances decrease, while the worst-case performances remain constant or increase.

If the upper bounds π max are set to 1, worst expected performance and worstcase performance are equivalent. This corresponds to a situation where the probability mass is entirely allocated to the worst-case scenario. In other words, the worst probability distribution is the one where the worst-case scenario occurs with probability 1. Accordingly, the results of the DRO approach with the upper bounds π max set to 1 are equivalent to the results of the DAD model explained in the previous section. This fact is easily verifiable by comparing worst expected combined performance in Figure 3.8 with π max =1 and the results of the DAD model for K att =3 and B ci =$1100 in Figure 3.6. In both cases, the worst (expected) combined performances are equivalent to 0.913.

Additional results with a sensitivity analysis of the parameters K att and B ci are available in Paper IV [START_REF] Bellè | A data-driven distributionally robust approach for the optimal coupling of interdependent critical infrastructures[END_REF].

. Remarks

The DRO approach displays good properties of robustness and control over the conservativeness of the problem. In fact, decision-makers can exploit historical contingency data and expert judgment to inform their choice on the coupling interface topology, and tune their risk attitude using the upper bounds π max . In this specific illustrative example, the DRO approach also displays good properties in terms of worst-case scenarios. In fact, as it can be clearly seen in Figure 3.8, the worst-case scenario associated with the identified optimal coupling interface presents considerably high combined performance. However, this is not an intrinsic property of the DRO approach, but it is strictly related to the case study to which it is applied.

In both the DAD and DRO models, the coupling interface is modeled with a "single-dependency" assumption. In fact, consistently with the existing literature (e.g. [34] or [START_REF] Ouyang | A mathematical framework to optimize resilience of interdependent critical infrastructure systems under spatially localized attacks[END_REF]), each node of the gas network is dependent on a maximum of one node of the power network, and vice versa. In other words, each node in the IPGNs can be the receiving end of a maximum of one interdependency link. How- ever, redundant interdependency links exist in real CIs, and decision-makers should take this possibility into account when designing and optimizing coupling interfaces.

In Paper V, the framework based on the DAD model is extended in order to include the possibility of allocating redundant interdependency links between CIs.

. Allocation of redundant interdependency links

. Redundancy allocation problem

In Paper III and Paper IV, each node in the gas network is assumed to be dependent on a maximum of one node of the power network, and vice versa. This assumption, previously defined as the "single-dependency" assumption, is often applied in the existing literature on interdependent CIs [34], [START_REF] Ouyang | A mathematical framework to optimize resilience of interdependent critical infrastructure systems under spatially localized attacks[END_REF], [START_REF] Liu | A hierarchical resilience enhancement framework for interdependent critical infrastructures[END_REF]- [START_REF] Almoghathawi | Resilience-driven restoration model for interdependent infrastructure networks[END_REF], even though, in reality, redundant interdependencies can be present [31], [32]. In addition, redundant relationships of interdependency are also acknowledged within the network science field [START_REF] Shao | Cascade of failures in coupled network systems with multiple supportdependence relations[END_REF]. In fact, each node in one CIs can be dependent on multiple nodes of another CIs. For example, in IPGNs, each node in the gas network can be supplied by multiple nodes of the power network, and be the receiving end of multiple interdependency links. These multiple interdependencies can be represented by redundant interdependency links, as shown in Figure 3.9, where node 1 ∈ V GN can be supplied by both nodes 1 ∈ V P N and 2 ∈ V P N .

The optimal allocation of redundancies is a traditional reliability problem [START_REF] Peiravi | Reliability optimization of series-parallel systems with k-mixed redundancy strategy[END_REF]- [START_REF] Yeh | A novel boundary swarm optimization method for reliability redundancy allocation problems[END_REF]. In Paper V, the concept of optimal redundancy allocation is extended to the problem of optimizing coupling interface topologies in interdependent CIs. In particular, the impact of redundancy allocation on the combined survivability of interdependent CIs under conditions of disruption is investigated. The model is developed with a DAD approach for illustrative purposes; however, a DRO approach can also be easily adopted.

. Defender-attacker-defender formulation

In Paper V, the IPGNs in Figure 3.1 are used as case study. The DAD model for the optimal allocation of redundant interdependency links is developed considering the following assumptions [START_REF] Bellè | Resilience enhancement by optimal allocation of redundant interdependency links in interdependent critical infrastructures[END_REF]:

• a coupling interface is already present, and it already ensures the necessary performance under normal conditions;

• the cost of allocating a redundant interdependency link depends on the distance between the two nodes;

• the middle attacker can target and fail a maximum number of power lines.

The operational model of the IPGNs is defined by the recourse function Q r (y, ξ), where the superscript r denotes that, in this case, the operational model accounts for the presence of redundant interdependency links (see Paper V for more details). In particular, it is assumed that each node in the gas network can receive multiple interdependency links from the power network, but only one is assumed to actively supply the electricity. The same assumption is considered for the power network and the interdependency links from the gas network.

The DAD approach for the optimal allocation of redundant interdependency links takes the form of Equation

y g←p ij ≥ y g←p ij , ∀i ∈ V GN , ∀j ∈ V P N (3.26) y p←g ij ≥ y p←g ij , ∀i ∈ V P N , ∀j ∈ V GN (3.27) i∈V GN j∈V P N y g←p ij d km ij c g←p km + i∈V P N j∈V GN y p←g ij d km ji c p←g km ≤ c ci + B ci (3.28) k∈E P N (1 -u k ) ≤ K att .
(3.29)

Constraints (3.26) and (3.27) ensure that, if an interdependency link is already present, the corresponding binary variable is equal to 1. The presence of a preexisting interdependency link is defined by the binary parameters y g←p ij and y p←g ij , that are equal to 1 if the corresponding link is already existing, and equal to 0 otherwise. As enforced by Constraint (3.28), the cost of allocating the redundant interdependency links should not exceed the budget B ci . The cost of the existing coupling interface is given by c ci , computed as in (3.30):

c ci = i∈V GN j∈V P N y g←p ij d km ij c g←p km + i∈V P N j∈V GN y p←g ij d km ji c p←g km .
(3.30)

Including the term c ci in (3.28) allows considering only the newly allocated interdependency links within the budget limitation. Constraint (3.29) controls the maximum number of power lines that can be targeted and failed by the attacker.

. Results

The model is solved with a NC&CG algorithm and it is applied to the IPGNs in Figure 3.1. It is assumed that a Euclidean coupling interface is already present within the IPGNs. The model is tested for values K att from 1 to 5, and monetary budgets B ci from $100 to $400. The results are shown in Figure 3.10 and Table 3 As it can be clearly seen, the allocation of redundant interdependency links considerably improves the worst-case combined performance of the IPGNs. For example, for the case K att =5, the worst-case combined performances with the original Euclidean coupling interface are equal to 0.308, while the optimal allocation of redundancies with a budget B ci =$400 leads to worst-case combined performance equal to 0.619, corresponding to an increase of 101.21%.

B ci K att = 1 K att = 2 K att = 3 K att = 4 K att =
In order to better understand the potential in terms of resilience enhancement of an optimal allocation of redundant interdependency links, the results in Figure 3.10 are compared to the results of a random allocation strategy, shown in Figure 3.11. For each combination of K att and B ci , 50 experiments with a random allocation strategy (more details in Appendix A of Paper V) are performed. The results Additional results with degree-based and betweenness-based pre-existing coupling interfaces are available in Paper V [START_REF] Bellè | Resilience enhancement by optimal allocation of redundant interdependency links in interdependent critical infrastructures[END_REF].

B ci K att = 1 K att = 2 K att = 3 K att = 4 K att = 5

. Computational performance

Multi-level robust optimization problems are generally hard to solve, and often present an NP-hard complexity [START_REF] Zeng | Solving two-stage robust optimization problems using a column-and-constraint generation method[END_REF]. The NC&CG algorithm is a powerful framework to solve efficiently the class of problems addressed in Paper III, Paper IV, and Paper V.

The case studies used in this work present small-medium sizes; consequently, the computational cost is affordable. For example, Table 3.5 contains the computational cost in seconds for the optimization in Paper III, previously shown in Figure 3.6. As it can be clearly seen, the computational time is not prohibitive, as the most computationally-expensive optimization (B ci =$1000, K att =5) requires less than 3 minutes. However, for larger case studies and infrastructures, the computational time required for solving the optimization might increase considerably due to the higher number of binary variables involved. Nevertheless, as it was already highlighted in Paper III, Paper IV, and Paper V, the optimization of coupling interface topologies is a problem that is meant to be solved during design phases, and high computational costs are usually not a problematic issue. Moreover, the computational complexity of the model can be reduced by limiting the number of binary variables within the optimization problem, e.g. by limiting the number of possible coupling interfaces for the outer defender.

. Conclusion

In this chapter, some details of the work contained within Paper III, Paper IV, and Paper V are presented. The core of the chapter is to present the proposed approach, based on multilevel mathematical programming, for the optimization of coupling interface topology and design, where the term coupling interface denotes the ensemble of interdependency links connecting two or more interdependent CIs.

The approach proposed in Paper III is based on the traditional defenderattacker-defender approach, and it demonstrates the potential of optimized coupling interfaces in terms of improvement of combined performance under the worst feasible failure scenarios. This approach is extended in Paper IV with a distributionally robust approach that includes ambiguous probability distributions of the set of feasible failure scenarios within the optimization framework. In addition, in Paper V, the efficacy of redundant interdependency links is investigated.

In this works, the objective functions represent the combined performance of the interdependent CIs. From a modeling perspective, it is like to assume that the interdependent CIs are operated with a centralized approach. In reality, interdependent CIs can also be operated with a decentralized approach by independent operators. In the next chapter, a preliminary approach for joint decision-making in interdependent CIs with independent operators that can display different behaviours is proposed.

-Joint decision-making with independent operators

. Introduction

Interdependent CIs are often operated by individual and independent entities, rather than a centralized unique operator. In the previous chapter, the focus of the proposed optimization approaches is to maximize the combined performance of the interdependent CIs. The objective functions of single infrastructures are aggregated within one single objective function through a scalarization approach, assigning a weight to each CI according to its importance (see Equation (3.1)). As the objective is to maximize their combined performance, the independent operators display a behaviour which can be categorized as centralized and collaborative, as the maximization of one CI performance is not detrimental (actually, it is often beneficial) to the performance of the other CI. For example, considering the IPGNs used in Paper III, Paper IV, and Paper V, the maximization of the power supply within the power network is beneficial to the performance of the gas network, as more electricity is available for the gas network itself. Similarly, the optimization of the gas supply is beneficial to the power network, as more gas is available for the gas-fired power plants.

Centralized approaches based on combined performance optimization have been used extensively in the existing literature, especially in the framework of resilience assessment and optimization. In fact, these models are useful to simulate the behaviour of operators in situations of disruption, when their priority is to maximize the combined performance of their CIs in order to minimize the negative impact of disruption on the general population. For example, centralized operator models have been used to enhance the resilience of interdependent CIs by optimizing protection plans and resource allocation [34], [START_REF] Ouyang | A mathematical framework to optimize resilience of interdependent critical infrastructure systems under spatially localized attacks[END_REF], [START_REF] Kong | Optimizing the resilience of interdependent infrastructures to regional natural hazards with combined improvement measures[END_REF] and by optimizing the joint restoration of disrupted interdependent CIs [START_REF] Lee | Restoration of services in interdependent infrastructure systems: a network flows approach[END_REF], [START_REF] Ouyang | Resilience assessment of interdependent infrastructure systems: with a focus on joint restoration modeling and analysis[END_REF], [START_REF] Almoghathawi | Resilience-driven restoration model for interdependent infrastructure networks[END_REF]. In the aforementioned works, the operators are centralized, as they can control simultaneously the ensemble of interdependent infrastructures in order to optimize an objective function, which is usually a weighted sum of the performance of each individual infrastructure.

Another class of models for independent operators consists of decentralized approaches, where operators aim at minimizing their own individual performance (usually a cost function). Decentralized models are generally useful for modeling the behaviour of operators under normal conditions. In the context of interdependent CIs, independent operators often interact by selling and purchasing their respective goods, services, and commodities within a market-based environment. For example, in the case of IPGNs, the independent operators interact by selling and purchasing gas and electricity. In this case, the behaviour of independent operators is decentralized and competitive, as each of them aims at "selling high" and "purchasing low". The purpose of each operator is usually to optimize its own performance (usually its own cost function), and the interaction between different operators is often modeled through game-theoretic approaches. As highlighted in [START_REF] Bellè | Vulnerability analysis of interdependent energy infrastructures with centralized and decentralized operator models[END_REF], decentralized models have been used, for example, in the optimization of the expansion planning of interdependent power and gas networks [START_REF] Rad | Joint electricity generation and transmission expansion planning under integrated gas and power system[END_REF]- [START_REF] Qiu | Multi-stage flexible expansion co-planning under uncertainties in a combined electricity and gas market[END_REF], the optimization of urban energy networks [START_REF] Jing | Multi-objective optimization of a neighborhood-level urban energy network: considering game-theory inspired multi-benefit allocation constraints[END_REF], the modeling of the security-constrained operations of integrated wind and hydrogen systems [START_REF] Mirzaei | Stochastic security-constrained operation of wind and hydrogen energy storage systems integrated with price-based demand response[END_REF] and the risk assessment of interdependent power and heat networks [START_REF] Wang | Risk assessment of integrated electricity and heat system with independent energy operators based on stackelberg game[END_REF].

In summary, the actions of independent operators of interdependent CIs can be modeled with two approaches:

• centralized models: the actions of operators are taken in a centralized and collaborative way, in order to optimize the combined performance of the interdependent CIs. These models are often used while assessing and enhancing the resilience of interdependent CIs under conditions of disruption;

• decentralized models: each operator acts independently in order to optimize its own performance, and the interaction between different operators is usually modeled through game-theoretic approaches. These models are often used to assess and optimize the operators behaviours under normal conditions.

These two classes of models describe two different behaviours of independent operators. When performing joint decision-making, such as the design of a coupling interface between interdependent CIs, planners should take into account the possibility for the independent operators to display different behaviours, namely decentralized under normal conditions and centralized under conditions of disruption. In the previous chapter, coupling interface topologies are optimized with a centralized approach in order to maximize the resilience, in terms of survivability, of interdependent CIs. However, the optimal coupling interface identified with a centralized operator model might be suboptimal under normal conditions, where operators might display a decentralized behaviour (and vice versa). The research question of this chapter is, thus:

• How to design a coupling interface y which guarantees high-quality performance in interdependent CIs both in the case of centralized and decentralized behaviour of the independent operators?

. Case study

In this chapter, the case study of interdependent power and heat networks (IPHNs) proposed in [START_REF] Wang | Risk assessment of integrated electricity and heat system with independent energy operators based on stackelberg game[END_REF] is utilized. The power network and the heat network are shown in Figures 4.1 and 4.2. The power network is based on the topology of the IEEE 33-bus system [START_REF] Baran | Network reconfiguration in distribution systems for loss reduction and load balancing[END_REF], and it is composed of 33 power buses connected by 32 power lines. The requested power demand in each node ranges from 0 to 0.121 MW, and the total requested power demand is 3.655 MW. The power network network is provided with a generator with a production capacity equal to 3.5 MW in node 1, and four generators with a production capacity equal to 0.5 MW in nodes 7, 15, 23, and 29. The power flow capacity of each line is 3.5 MW. The heat network is based on the topology of the district heat network of Barry Island [START_REF] Liu | Combined analysis of electricity and heat networks[END_REF], and it is composed of 32 heat nodes connected by 32 pipelines. The requested heat demand in each node ranges from 0 to 0.145 MW, with a total requested heat demand equal to 2.164 MW. The heat production is ensured by four boilers, in nodes 1, 20, 31, 32, each with a capacity equal to 0.8 MW. Nodes 1, 31, and 32 are provided with electric boilers, supplied by nodes 5, 14, and 28 of the power network, respectively. Node 20 is provided with a gas boiler, which is assumed to have a reliable supply of gas.

. Operational models

. Centralized operational model

In a centralized operational model, similarly to Paper III, Paper IV, and Paper V, the interdependent CIs are operated in a centralized way, aiming at optimizing their combined performance. In this chapter, instead of maximizing the residual performance, the focus is on the minimization of loss of performance 9 . The two approaches are equivalent in terms of solution optimality, but the minimization is better suited for the proposed approach in Section 4.5, as it is merged with a cost minimization problem (more details in the next sections). Assuming that both the power network and the heat network are modeled with a linear maximal flow approach, for a fixed coupling interface y * and fixed failure scenario u * , the centralized operational model takes the form of Equation (4.1) subject to (4.2)-(4.7):

min p,d,f w P N d P N i∈V P N d i + w HN d HN i∈V HN d i (4.1) 0 ≤ p i ≤ p i , ∀i ∈ V P N ∪ V HN (4.2) 0 ≤ d i ≤ d i , ∀i ∈ V P N ∪ V HN (4.
3)

p i = η j∈V P N y h←p * ij d h←p ij , ∀i ∈ V eb HN (4.4) -u * k f k ≤ f k ≤ u * k f k , ∀k ∈ E P N ∪ E HN (4.5) p i -(d i -d i )- j∈V eb HN y h←p * ji d h←p ji + k | D(k)=i f k - k | O(k)=i f k = 0, ∀i ∈ V P N (4.6) p i -(d i -d i ) + k | D(k)=i f k - k | O(k)=i f k = 0, ∀i ∈ V HN (4.7)
where d i represents the load shedding (power or heat) in each node, p i represents the power or heat production in each node, f k represents the power flow in each line or the heat flow in each pipeline, and d h←p ij represents the power demand of node i ∈ V eb HN supplied by node j ∈ V P N , where V eb HN ⊆ V HN is the subset of nodes in the heat network containing an electric boiler. Similarly to the previous chapter, y h←p * ij and u * k define the presence of interdependency links and the binary functional state of edges, respectively. The objective function in (4.1) represents the weighted sum of the total load shedding of power and heat, where w P N and w HN are the weights of the power network and the heat network. The production level and the load shedding in each node are subject to Constraints (4.2) and (4.3). Moreover, the heat production in each node with an electric boiler depends on the amount of power received from the power network, as shown in Constraint (4.4), where η is the power-to-heat conversion ratio, here assumed to be equal to 0.8. The flow in each line or pipeline is subject to Constraint (4.5). The net balance in each node is enforced by Constraint (4.6) in the power network, and by Constraint (4.7) in the heat network.

The solution of this model leads to the minimization of combined loss of performance, in terms of shedding of power and heat demand.

. Decentralized operational model

The decentralized model is based on the game-theoretic approach proposed in [START_REF] Wang | Risk assessment of integrated electricity and heat system with independent energy operators based on stackelberg game[END_REF]. Power and heat operators act independently, aiming at minimizing their own cost function, and they interact through the purchase of electricity by heat operators in order to produce heat in the electric boilers. As the operators are competing in a market-based environment (power operators aim at selling electricity at a high price, heat operators aim at purchasing it at a low price), the price of electricity and the power demand of the heat network are defined through a game-theoretic approach.

For a fixed coupling interface y * and fixed failure scenario u * , the power network is modeled as Equation (4.8) subject to (4.9)-(4.13):

min p,d,f i∈V P N γ power i p i + i∈V P N α power i d i - i∈V P N j∈V eb HN ε i d h←p ji (4.8) 0 ≤ p i ≤ p i , ∀i ∈ V P N (4.9) 0 ≤ d i ≤ d i , ∀i ∈ V P N (4.10) -u * k f k ≤ f k ≤ u * k f k , ∀k ∈ E P N (4.11) p i -(d i -d i )- j∈V eb HN y h←p * ji d h←p ji + k | D(k)=i f k - k | O(k)=i f k = 0, ∀i ∈ V P N (4.12) ε min ≤ ε i ≤ ε max , ∀i ∈ V P N (4.13)
The objective function is composed of three terms:

• the production cost of electricity, where γ power i defines the cost of producing 1 unit of power in each node i;

• the penalty cost of demand not supplied, where α power i defines the penalty cost of shedding 1 unit of power in each node i;

• the profit of selling electricity to the heat network, where ε i defines the selling price of 1 unit of power in each node i.

Constraints (4.9)-(4.12) are equivalent to Constraints (4.2)-(4.3) and (4.5)-(4.6) of the centralized approach. The nodal price of electricity ε i is bounded between a minimum and maximum value, as enforced by Constraint (4.13).

Similarly, the heat network is modeled as Equation (4.14) subject to (4.15)-

(4.19). min p,d,f i∈V gb HN γ heat i p i + i∈V HN α heat i d i + i∈V eb HN j∈V P N ε j d h←p ij (4.14) 0 ≤ p i ≤ p i , ∀i ∈ V HN (4. 15
)
p i = η j∈V P N y h←p * ij d h←p ij , ∀i ∈ V HN (4.16) 0 ≤ d i ≤ d i , ∀i ∈ V HN (4.17) -u * k f k ≤ f k ≤ u * k f k , ∀k ∈ E HN (4.18) p i -(d i -d i ) + k | D(k)=i f k - k | O(k)=i f k = 0, ∀i ∈ V HN (4.19)
The objective function is composed of three terms, respectively:

• the production cost of heat in the gas boilers, where γ heat i defines the cost of producing 1 unit of heat in each node with a gas boiler i, and V gb HN ⊆ V HN is the subset of nodes containing a gas boiler;

• the penalty cost of demand not supplied, where α heat i defines the penalty cost of shedding 1 unit of heat in each node i;

• the cost of purchasing electricity from the power network for the electric boilers, where ε i defines the selling price of 1 unit of power in each node i ∈ V P N .

Constraints As it can be clearly seen, the two problems are interconnected by the prices of electricity ε i , which are variables of the power network model and constant coefficients of the heat network model, and the power demands of the heat network d h←p ij , which are variables of the heat network model and constant coefficients of the power network model. In particular, power and heat operators are in competition for the price of the electricity, as the power operators aim at selling the electricity at a high price to maximize their profit, and the heat operators aim at purchasing it at a low price in order to minimize their costs. This interaction can be modeled through a game-theoretic approach, which allows to identify the equilibrium solutions for electricity prices ε i and power demands of the heat network d h←p ij .

In Paper VI, similarly to [START_REF] Wang | Risk assessment of integrated electricity and heat system with independent energy operators based on stackelberg game[END_REF], the interaction between power and heat operators is modeled with the assumptions of a Stackelberg game. In order to solve this problem, the two optimization models, in Equations (4.8)-(4.13) and Equations (4.14)-(4.19), need to be merged within one single problem. Under the assumption of a Stackelberg game, in which the power operators take their actions before the heat operators, i.e. the power operators are the leader and the heat operators the follower, the two problems can be merged using the Karush-Kuhn-Tucker (KKT) conditions of the heat network.

The single-level Stackelberg game between power and heat operators can be formulated as the objective function in (4.8), subject to (4.9)-(4.13), (4.15)-(4.19), which correspond to the primal feasibility of the KKT conditions of the heat network problem, and the other KKT conditions of the heat network problem, shown in Equations (4.23)-(4.25). For the sake of simplicity, the details and the full formulation of the KKT conditions are reported in Appendix B of this dissertation, and here only the compact matrix form is reported.

The compact matrix formulation of the heat network problem corresponds to Equations (4.20) subject to (4.21) and (4.22):

min h b T h (4.20) R in h -q in ≤ 0 (4.21)
R eq hq eq = 0

∇c T h + λ∇R in h + µ∇R eq h = 0 (4.23) λ(R in h -q in ) = 0 (4.24) λ ≥ 0 (4.25)
The solution of this optimization problem leads to the minimization of the individual equilibrium costs in IPHNs under the assumption of a Stackelberg game.

. Preliminary results

In Paper VI, some preliminary results for assessing the difference between centralized and decentralized operational models are presented. The IPHNs presented in Section 4.2 are used, and a vulnerability analysis, accounting for combinations of 1, 2, and 3 failed power lines, is performed. Each combination of 1, 2, and 3 failed power lines is tested, and the results are evaluated in terms of fraction of power and heat shedding and operational costs using the centralized and decentralized operational models. The cases with 1, 2, and 3 failed lines are referred to as M P N -1, M P N -2, and M P N -3. For the centralized model, costs are computed using the equilibrium prices ε i identified by the decentralized model under the same failure scenario.

In Figure 4.3, the results in terms of average fraction of combined shedding are shown, while in Figure 4.4, the results in terms of average combined cost are shown. In both the figures, the results are assessed in terms of average values for the three cases (M P N -1, M P N -2, and M P N -3) and using both the centralized and decentralized models. Without indulging into details (the reader is referred to Paper VI), it can be clearly seen how the results, in terms of shedding and cost, considerably differ when using a centralized or a decentralized model. This is a clear indication that: i) the energy commodities, in this case power and heat, are dispatched differently in centralized and decentralized operational models, and ii) optimal joint decisions, such as the design of a coupling interface, might considerably differ if taken with centralized or decentralized models.

In Figure 4.3, it can be clearly seen how the centralized model leads to lower levels of average combined shedding. This result is somehow expected, as the objective function of the centralized model is the combined power and heat shedding. In Figure 4.4, it can be clearly noticed how the decentralized model leads to lower average combined costs for the case M P N -2 and M P N -3. However, for the case M P N -1, the centralized model leads to a slightly lower cost. This is because the decentralized approach aims at minimizing the equilibrium individual cost of each infrastructure operator, rather than the combined cost. Consequently, it is possible for the centralized approach to lead to lower average combined cost. However, the individual solutions are far from the equilibrium optimality of the decentralized model. For more details, the reader is referred to Figures 456of Paper VI, where it can be clearly seen that the centralized model leads to solutions far from the optimal equilibrium of the decentralized model.

. Proposed modeling framework

In order to propose a decision-making framework which accounts for the behaviours of independent operators in interdependent CIs, it is necessary to build

M PN 1 M PN 2 M PN 3
Number of contingencies an operational model that prioritizes individual costs under normal conditions, and combined performance in situations of disruptions.

For the sake of clarity, a qualitative case study is built upon the IPHNs proposed in Paper VI and [START_REF] Wang | Risk assessment of integrated electricity and heat system with independent energy operators based on stackelberg game[END_REF]. Let us assume that a new heat network needs to be constructed. As it is provided with electric boilers, it must be coupled with a pre-existing power network. Consistently with the previous chapter, the decision to optimize is the topology of the coupling interface y between IPHNs.

A distributionally robust approach is used, and decision-makers seek to allocate the coupling interface between IPHNs accounting for an ambiguity set S containing all the probability distribution on a σ-field of the set of feasible failure scenarios A. Similarly to Paper III-V, only failures of a limited number K att of power lines are considered, and the sets A and S are defined as in Equations (4.26) and (4.27).

A = u {0, 1} M P N , ||1 M P N -u|| 1 ≤ K att (4.26) S = P ∈ P(A) : 0 ≤ E P [1 M P N -u] ≤ π max . (4.27)
Contrary to Paper IV and Chapter 3, the probability mass allocated to the normal scenario (every line is functional) is not enforced to be 0 10 . In other words, the ambiguity set S denotes the set of multinomial distributions which define the probability of the system to be in a specific state, including the normal scenario. In Paper IV, the ambiguity set M denotes the set of conditional multinomial distributions which define the probability of the system to be in a specific failure state, excluding the normal scenario. In this case, the upper bounds π max of the set S are not subject to the conditions of the upper bounds of the set M (see Paper IV for more details).

The proposed DRO approach consists of Equation (4.28) subject to (4.29)-(4.30):

min y∈{0,1} Nc max P∈S E P [Q(y, ξ)] (4.28) j∈V P N y h←p ij ≤ 1, ∀i ∈ V HN (4.29) i∈V HN j∈V P N y h←p ij d km ij c h←p km ≤ B ci (4.30)
Constraint (4.29) denotes the "single-dependency" assumption, enforcing each node in the heat network to be dependent on a maximum of one node of the power network, while Constraint (4.30) states that the allocation cost of the coupling interface should not exceed the available monetary budget B ci .

Differently from Paper III-V, the purpose of the decision-makers is to identify a coupling interface topology that minimizes the expectation of a recourse function Q(y, ξ) under the worst probability distribution within the ambiguity set M.

The next step is to define a recourse function Q(y, ξ) which accounts for: i) decentralized cost minimization under normal conditions, and ii) centralized minimization of loss of combined performance under conditions of disruption. In other words, it is necessary to build a recourse function that integrates the centralized and decentralized approach previously proposed.

NB: As at the moment of the redaction of this dissertation no final nor preliminary result is available, the final formulation of the following operational model might considerably differ from the one here proposed. In fact, the remaining of this chapter is presented as a proposal of extension of the work already contained within this thesis.

The proposed centralized and decentralized models can be easily integrated using a binary variable w r that defines normal conditions and conditions of disruption (w r =1 under conditions of disruption, w r =0 under normal conditions). For the sake of simplicity, the objective functions previously used are expressed as F cnt , F dcn P N , and F dcn HN , as defined in Equations (4.31), (4.32), and (4.33):

F cnt = w P N d P N i∈V P N d i + w HN d HN i∈V HN d i (4.31)
F dcn P N = i∈V P N γ power i p i + i∈V P N α power i d i - i∈V P N j∈V HN ε i d h←p ji (4.32) F dcn HN = i∈V gb HN γ heat i p i + i∈V HN α heat i d i + i∈V HN j∈V P N ε j d h←p ij (4.33)
For a given coupling interface y * and failure scenario u * , the proposed operational model Q(y, ξ) consists of Equation (1w r )

F dcn P N + w r F cnt (4.34) (1 -w r ) ∇F dcn HN + λ∇R in h + µ∇R eq h = 0 (4.35) (1 -w r )λ(R in h -q in ) = 0 (4.36) w n ≤ k∈E P N u k M P N (4.37) w r ≤ M P N - k∈E P N u k (4.38) w r + w n = 1 (4.39)
The objective function in (4.34) is composed of two terms:

• the first term consists of the objective function of the power network in the decentralized approach, and it is accounted for under normal conditions (w r =0);

• the second term consists of the objective function of the IPHNs in the centralized approach, and it is accounted for under conditions of disruption (w r =1).

Constraints (4.2)-(4.7) and Constraint (4.13) represent the primal constraints of power and heat network. Constraints (4.35) and (4.36) define the stationarity and complementary slackness of the KKT conditions of the decentralized heat network model, and they are accounted for only under normal conditions thanks to the factor (1-w r ). Constraints (4.37)-(4.39) ensures that w r =0 under normal conditions, and w r =1 under conditions of disruption (when there is at least one failure).

The advantage of this model is to identify a coupling interface topology that performs well under normal conditions, where the operators display a decentralized behaviour, and in situations of disruption, where the operators display a centralized behaviour. The normal scenario is optimized using a decentralized model, while all the feasible failure scenarios are optimized with a centralized model. The weight assigned to each scenario corresponds to its probability mass in the corresponding multinomial distribution. The DRO formulation allows to tune the problem towards more risk-neutral or risk-averse solutions.

. Proposed solution strategy

The DRO model in Equations (4.28)-(4.30) must be recast into a tractable equivalent formulation. The first step is to reformulate the recourse function in order to eliminate the nonlinear terms. Three types of nonlinearities are present: multiplication between binary variables, multiplication between binary and continuous variables, and multiplication between continuous variables.

The multiplications between binary variables can be easily linearized by introducing new binary variables and additional constraints. For example, the multiplication between two binary variables x and y can be replaced by the binary variable The multiplications between binary and continuous variables can be easily linearized by introducing new continuous variables and additional constraints, following the "Big-M" method. For example, the multiplication between a binary variables x and a continuous variable a can be replaced by the continuous variable c and Constraints (4.43)-(4.45):

c ≤ a (4.43) c ≤ M x (4.44) c ≥ a -(1 -x)M (4.45)
where M represents a very large number.

The multiplications between continuous variables, in general, can not be linearized without introducing an approximation and, thus, an error. However, in this case, it is possible to obtain an exact linear reformulation. The first terms involving multiplication between binary variables are the products between primal continuous variables h and dual variables λ in the complementary slackness constraints in (4.36). Given the nature of the complementary slackness, these constraints can be linearized by introducing a binary variable and applying a "Big-M" approach [START_REF] Wang | Risk assessment of integrated electricity and heat system with independent energy operators based on stackelberg game[END_REF], [START_REF] Fortuny-Amat | A representation and economic interpretation of a two-level programming problem[END_REF]. Complementary slackness constraints present the general form in (4.46):

λ(a -a) = 0 (4.46)
where a is a continuous primal variable, a is a primal parameter, and λ a continuous dual variable, and they can be replaced by Constraints (4.47) and (4.48):

λ -xM ≤ 0 (4.47) a -a -(1 -x)M ≤ 0 (4.48)
where x is a binary variable and M a very large number.

The second term containing multiplications between continuous variables is the last term of F dcn P N in the objective function (4.34), which contains the product of variables ε i and d h←p ji . As this product is also present in the term F dcn HN in (4.33), it is possible to exploit the strong duality property of the problem in (4.14)-(4.19) to find the equivalent linear reformulation in (4.49), which can be used to replace the nonlinear term in (4.34), as suggested in [START_REF] Wang | Risk assessment of integrated electricity and heat system with independent energy operators based on stackelberg game[END_REF]. The full formulation of (4. 49) is shown in Appendix C of this dissertation.

i∈V P N j∈V HN ε i d h←p ji = q T in λ + q T eq µ - i∈V gb HN γ heat i p i - i∈V HN α heat i d i (4.49)
By applying these linearizations, the operational model present a linear formulation. The new linearized recourse function is referred to as L(y, ξ). The DRO problem can be formulated as Equation The second step is to reformulate the new DRO model in (4.50) into an equivalent tractable reformulation, similarly to Paper IV and [START_REF] Babaei | Distributionally robust distribution network configuration under random contingency[END_REF].

For a fixed coupling interface y * , the inner maximization in τ

+ k∈E P N ζ k π max k (4.54) τ + k∈E P N ζ k 1 -u (i) k -L(y, ξ) ≥ 0, ∀u (i) ∈ A (4.55)
where τ is the dual variable of Constraint (4.52) and ζ k are the dual variables of Constraints (4.53). As (4.54) is a minimization, the optimal value τ of the dual variable τ is equivalent to Equation (4.56):

τ = max u (i) ∈A    L(y, ξ) - k∈E P N ζ k 1 -u (i) k    (4.56)
By substituting (4.56) in (4.54), and merging the resulting formulation with the outer level in (4.50), one can obtain Equation (4.57):

min y∈{0,1} Nc ζ≥0 max u (i) ∈A L(y, ξ) - k∈E P N ζ k 1 -u (i) k + π max k . (4.57)
By expanding the recourse function L(y, ξ) with its explicit form, the formulation presents a min-max-min structure which can be solved efficiently by a NC&CG approach, with an algorithm similar to Figure 3

. Conclusion

In this chapter, a proposal for a decision-making framework in interdependent CIs with independent operators is presented. The proposed approach accounts for decentralized cost optimization under normal conditions and centralized performance optimization under conditions of disruption. The rationale behind this modeling choice is that, under normal conditions, operators interact in a marketbased environment by selling and purchasing goods, services and commodities, and they display a decentralized and competitive behaviour. However, under conditions of disruption, the priority might shift towards centralized performance optimization, in order to limit the negative consequences of disruption to the general population; in this case, operators display a centralized and collaborative behaviour.

The proposed approach accounts for the probability of the interdependent CIs to be in a specific state (normal or failure) with a distributionally robust approach. The application of a DRO approach allows to tune the conservativeness of the model towards more risk-neutral (stochastic) or risk-averse (robust) solutions. The choice of these CIs is due to the industrial partners involved within this thesis. From the exploratory literature review, three main research gaps are identified:

-Conclusion

• the coupling interface between railway and power networks is often modeled not sufficiently in detail, as traction networks are overlooked in most of the existing papers;

• the effect of cascading failure in power networks on the vulnerability of the dependent railway networks is treated rarely and approximately;

• feedback effects of failures in railway networks on the cascading failure dynamics of power networks are not evaluated in the existing literature.

In Paper I, these drawbacks are addressed by introducing the modeling of traction networks to act as an interface between railway and power networks, and by proposing a flow-based cascading failure model for IRPNs. The results in Paper I highlight that:

• it is essential to include traction networks within the modeling framework, as they define how failures and disruption propagate between networks;

• cascading failures within power networks can considerbaly increase the magnitude of cascading effect from power networks to railway networks;

• failures within railway networks can impact the cascading failures dynamic of power networks.

. Prospective work

A possible extension of the work of Chapter 2 is the development of a more precise and comprehensive model for the vulnerability analysis of IRPNs which accounts for different configurations of traction networks, using the preliminary model in Paper II as a starting point. The topic of vulnerability of IRPNs represents a major subject for the years to come. Due to climate changes, our systems of CIs, including railway and power networks, are undergoing profound changes. In fact, rail transport, when electrified, represents an environmentally friendly means of transportation, and many countries are channeling massive investments in this direction. In addition, power networks are undergoing a profound restyling in order to decarbonize the energy sector. Given these changes, developing tools and methodologies for the vulnerability analysis of IRPNs is essential to guarantee their resilience.

Another promising direction for the vulnerability analysis of IRPNs is to exploit the mathematical approach developed in Chapter 3 to optimize the coupling interfaces between power, traction, and railway networks. This approach is of particular relevance for urban areas, where large networks of CIs are located in a relatively small area, giving the possibility of designing and allocating various coupling interface topologies.

. Design and optimization of coupling interface topology

. Contributions

In Chapter 3, based on the work contained in Paper III-V, the problem of designing and optimizing the topology of coupling interfaces in interdependent CIs is addressed. In the exploratory literature review, it is highlighted how this problem is acknowledged by scholars and researchers but not treated in detail. In this dissertation, contrary to the heuristics approaches available in the existing literature, a mathematical programming approach is proposed, and interdependent power and gas networks (IPGNs) are selected as representative case study.

In Paper III, a defender-attacker-defender (DAD) approach for the optimization of coupling interface topology is proposed. The results highlight the considerable potential of coupling interface optimization in terms of resilience enhancement against worst-case scenarios. To the best of our knowledge, this paper also represents the first mathematical programming approach for the optimization of coupling interfaces in interdependent CIs.

In Paper IV, a more general model, based on distributionally robust optimization (DRO), is proposed. Contrary to the DAD model, the DRO approach allows to include probability of failure scenarios within the optimization model, and the conservativeness of the solution can be tuned by decision-makers towards more robust or stochastic solutions. The results show that the DRO approach displays good properties in terms of robustness and modeling of the attitude towards risk of decision-makers.

The proposed approach is further extended with Paper V, in which a DAD model for the optimal allocation of redundant interdependency links in existing coupling interfaces is proposed. The results confirm the potential of redundant interdependency links in terms of resilience enhancement of interdependent CIs.

The proposed models rely on a centralized operational model for the IPGNs, which is valid under the assumption of optimizing under conditions of disruption. However, under normal conditions, interdependent CIs are often operated with a decentralized approach. These classes of operational model reflect the different behaviours of independent operators, which can change according to the state of the CIs. This consideration leads to the work presented in Chapter 4.

. Prospective work

The models proposed in Paper III, Paper IV, and Paper V are complementary, and they could potentially be merged within one single optimization framework that allows to design and retrofit coupling interfaces while accounting for i) ambiguous probability of failure scenarios, ii) attitude towards risk of decision makers, iii) existing coupling interfaces, iv) possibility of allocating redundant interdependency links.

An interesting extension of this work is to test the potential, in terms of resilience enhancement, of the optimization of coupling interface topologies using a real case study. This would allow to validate the proposed models as an effective tool for decision-making in a real-world context.

Another possible extension of this work is the inclusion within the analysis and the optimization of nonlinear emerging behaviours of interdependent networks, such as cascading failures within and between networks. These phenomena happen in reality, and the optimization of coupling interface topologies might help increasing the robustness of interdependent CIs against them.

. Joint decision-making with independent operators

. Contributions

In Chapter 4, based on the work contained in Paper VI, a proposal for a decisionmaking framework which accounts for the behaviour of independent operators in different situations is presented. Two classes of behaviour are identified:

• centralized : the independent operators collaborate in order to optimize their combined performance. This behaviour is usually displayed under conditions of disruption;

• decentralized : each operator aims at optimizing its own performance (usually a cost), and their interaction can be modeled through game-theoretic approaches. This behaviour is usually displayed under normal conditions.

Preliminary results in Chapter 4, using interdependent power and heat networks as illustrative case study, demonstrate that centralized and decentralized operational models lead to different results. Consequently, optimal joint decisions, such as the optimal topology of coupling interfaces, might differ if taken with a centralized or decentralized model.

A proposal for a distributionally robust approach for joint decision-making in interdependent CIs with independent operators is presented. The proposed model is able to account for decentralized behaviours under normal conditions, and centralized behaviours under conditions of disruption. A tractable reformulation and a solution strategy are also presented.

. Prospective work

The work contained in Chapter 4 can be extended by performing some results in order to demonstrate the validity of the proposed approach.

The proposed approach is developed using a decentralized model based on the Stackelberg game assumptions. However, independent operators might display different types of decentralized behaviours (e.g. Cournot game). An interesting direction of this work would be to include within the optimization framework the possibility of having multiple decentralized behaviours, according to the specific CIs to optimize. In addition, the effect of different governmental policies, incentives, and penalties on the behaviours of independent operators could also be taken into account within this approach.

A -Nested Column&Constraint Generation algorithm

A.1 . Overview

The extended compact matrix form of the DAD model for the optimal coupling of IPGNs can be expressed as Equation (A.1) subject to Constraints (A.2)-(A.6):

max h ′ ,δ ′ ∈{0,1} N d y∈{0,1} Nc min u∈{0,1} M P N max h,δ∈{0,1} N d b T h (A.1)
Py ≤ g (A.
2)

Rh ′ ≤ q -Hy -Wδ ′ -y T Dδ ′ (A.3) b T h ′ ≥ 1 (A.4) k∈E P N (1 -u k ) ≤ K att (A.5)
Rh ≤ q -Tu -Hy -Wδy T Dδ.

(A.6)
This problem can be solved efficiently by a Nested Column&Constraint Generation (NC&CG) algorithm [START_REF] Yuan | Optimal power grid protection through a defender-attacker-defender model[END_REF], [START_REF] Zeng | Solving two-stage robust optimization problems using a column-and-constraint generation method[END_REF]. The algorithm consists in splitting the problem into an inner and outer layer. Each layer is divided into a master problem and a subproblem, which exchange primal binary variables and provide lower and upper bounds which converge to the optimal solution in finite steps [START_REF] Yuan | Optimal power grid protection through a defender-attacker-defender model[END_REF].

A.2 . Inner layer

For a fixed coupling interface y * , the bilevel middle-inner problem in (A.1) identifies the optimal attack plan u, i.e. the worst failure scenario within the set of feasible failure scenarios A, defined as in (A.7):

A = u {0, 1} M P N , ||1 M P N -u|| 1 ≤ K att . (A.7)
The middle-inner problem takes the form of Equation (A.8) subject to Constraints (A.5)-(A.6). min

u∈{0,1} M P N max h,δ∈{0,1} N d b T h (A.8)
with fixed outer binary variables y * . As the inner problem contains the binary variables δ, it is not possible to merge the inner and middle problems using duality theory. Let us fix the middle binary variables u and the inner binary variables δ, reducing the problem to a pure LP problem. By taking its dual form, with dual variables λ, it possible to write the middle-inner problem as its equivalent form in Equation (A.9) subject to (A.5), and (A.10):

min u∈{0,1} M P N max δ∈{0,1} N d min λ≥0 (q -Tu -Hy * -Wδ -y * T Dδ) T λ (A.9) R T λ ≤ b. (A.10)
The problem in (A.9) subject to (A.5) and (A.10) is equivalent to the problem in (A.11) subject to (A.5), (A.10), and (A.12):

min ρ,u∈{0,1} M P N ρ (A.11) ρ ≥ max δ∈{0,1} N d min λ≥0 (q -Tu -Hy * -Wδ -y * T Dδ) T λ. (A.12)
As the vector δ contains N d =N P N +N GN binary variables, the possible combinations of δ variables are finite (precisely 2 N d ), and they are contained within the set D. Constraint (A.12) can, thus, be rewritten as in Equation (A.13):

ρ ≥ (q -Tu -Hy * -Wδ * (i) -y * T Dδ * (i) ) T λ (i) , ∀δ * (i) ∈ D. (A.13)
The maximization term in (A.12) can be replaced by an enumeration over the set D of δ variables, while the minimization term can simply be removed as it does not affect the optimal value of Equation (A.11). Solving (A.11) subject to (A.5), (A.10), and (A.13) is possible in theory, and it would lead to identify the optimal attack plan u. However, this problem presents often a very large scale due to the enumeration over the set D, and it is, thus, often unfeasible in practice. The C&CG approach solves this problem by relying on a limited number of combinations of δ variables. By decomposing the problem in (A.11), subject to (A.5), (A.10), and (A.13), into a master-subproblem form, it is possible to iteratively reconstruct the set D and converge asymptotically to the optimal solution. The following steps are employed:

1. Set i = 0, lower bound LB in = 0, upper bound U B in = ∞, and D part = ∅ 2. Solve the inner master problem in Equations (A.14)-(A.17). Obtain an optimal solution ρ (i) and optimal attack plan u (i) . Update LB in = ρ (i) .

min ρ,λ (i) ≥0 u∈{0,1} M P N ρ (A.14) subject to: ρ ≥ (q -Tu -Hy * -Wδ * (i) -y * T Dδ * (i) ) T λ (i) , ∀δ * (i) ∈ D part (A.15) R T λ (i) ≤ b, ∀δ * (i) ∈ D part (A.16) k∈E P N (1 -u k ) ≤ K att (A.17)
3. Solve the inner subproblem in Equations (A.18)-(A. 19) with u (i) =u * . Obtain an optimal solution b T h (i) and δ

(i) . Set U B in = min(U B in , b T h (i) ). max h,δ∈{0,1} N d b T h (A.18) subject to : Rh ≤ q -Tu * -Hy * -Wδ -y * T Dδ (A.19) 4. If (U B in -LB in )/LB in < 10 -5 , u (i)
represents the optimal attack plan and the algorithm is terminated. Otherwise, set

D part = D part ∪ δ (i)
, update i ← i + 1, and return to step 2.

A.3 . Outer layer

The bilevel outer-middle problem identifies the optimal coupling interface topology, and it can be solved, similarly to the inner layer, by decomposing the problem into a master-subproblem form. The problem in Equations (A.1)-(A.6) can be rewritten as Equation (A.20) subject to (A.2)-(A.6) and (A.21):

max η,h ′ δ ′ ∈{0,1} N d y∈{0,1} Nc η (A.20) η ≤ min u∈{0,1} M P N max h,δ∈{0,1} N d b T h (A.21)
By enumeration of the set of feasible failure scenarios A, Constraint (A.21) can be replaced by Constraint (A.22):

η ≤ b T h (i) , ∀u * (i) ∈ A (A.22)
The problem can be solved by employing the following steps:

1. Set i = 0, lower bound LB out = 0, upper bound U B out = ∞, and A part =∅ 2. Solve the outer master problem in Equations (A.23)-(A.28). Obtain an optimal solution η (i) and optimal coupling interface y

(i) . Update U B out =min(U B out , η (i) ) max η,h ′ ,h (i) δ ′ ∈{0,1} N d δ (i) ∈{0,1} N d y∈{0,1} Nc η (A.23) η ≤ b T h (i) , ∀ u * (i) ∈ A part
min p,d,f i∈V gb HN γ heat i p i + i∈V HN α heat i d i + i∈V HN j∈V P N ε j d h←p ij (B.1) 0 ≤ p i ≤ p i , ∀i ∈ V HN : λ 1 i , λ 2 i (B.
2)

p i = η j∈V HN y h←p * ij d h←p ij , ∀i ∈ V HN : µ 1 i (B.3) 0 ≤ d i ≤ d i , ∀i ∈ V HN : λ 3 i , λ 4 i (B.4) -u * k f k ≤ f k ≤ u * k f k , ∀k ∈ E HN : λ 5 k , λ 6 k (B.5) p i -(d i -d i ) + k | D(k)=i f k - k | O(k)=i f k = 0, ∀i ∈ V HN : µ 2 i (B.6)
where λ and µ are the vectors containing the corresponding dual variables.

The corresponding Karush-Kuhn-Tucker (KKT) conditions (stationarity, primal feasibility, dual feasibility, complementary slackness) are shown in Equations (B.7)-(B.17). Equations (B.18)-(B.29) contain the linearized form of the complementary slackness, where M represents a "Big-M" constant [START_REF] Fortuny-Amat | A representation and economic interpretation of a two-level programming problem[END_REF]. The terms u * k are omitted as, in this case, the failure of heat pipelines is not considered, and the terms u * k are always equal to 1.

Stationarity γ i -λ 1 i + λ 2 i + µ 1 i + µ 2 i = 0, ∀i ∈ V HN (B.7) α i -λ 3 i + λ 4 i + µ 2 i = 0, ∀i ∈ V HN (B.8) -λ 5 k + λ 6 k + µ 2 D(k) -µ 2 O(k) = 0, ∀k ∈ E HN (B.9) ε j -y h←p ij µ 1 i = 0, ∀i ∈ V HN , ∀j ∈ V P N (B.10)
Primal feasibility

Equations (B.2)-(B.6)
Dual feasibility

λ 1 i , λ 2 i , λ 3 i , λ 4 i , λ 5 i , λ 6 i ≥ 0, ∀i ∈ V HN (B.11) Complementary slackness -λ 1 i p i = 0, ∀i ∈ V HN (B.12)
λ 2 i (p i -p i ) = 0, ∀i ∈ V HN (B.13) -λ 3 i d i = 0, ∀i ∈ V HN (B.14)
λ 4 i d i -d i = 0, ∀i ∈ V HN (B.15) λ 5 k -f k -f k = 0, ∀k ∈ E HN (B.16) λ 6 k f k -f k = 0, ∀k ∈ E HN (B.17)
Linearized complementary slackness

λ 1 i -x 1 i M ≤ 0, ∀i ∈ V HN (B.18) p i -(1 -x 1 i )M ≤ 0, ∀i ∈ V HN (B.19) λ 2 i -x 2 i M ≤ 0, ∀i ∈ V HN (B.20) p i -p i -(1 -x 2 i )M ≤ 0, ∀i ∈ V HN (B.21)
λ 3 i -x 3 i M ≤ 0, ∀i ∈ V HN (B.22) d i -(1 -x 3 i )M ≤ 0, ∀i ∈ V HN (B.23) λ 4 i -x 4 i M ≤ 0, ∀i ∈ V HN (B.24) d i -d i -(1 -x 4 i )M ≤ 0, ∀i ∈ V HN (B.25) λ 5 k -x 5 k M ≤ 0, ∀k ∈ E HN (B.26) f k + f k -(1 -x 5 k )M ≤ 0, ∀k ∈ E HN (B.27) λ 6 k -x 6 k M ≤ 0, ∀k ∈ E HN (B.28) f k -f k -(1 -x 6 k )M ≤ 0, ∀k ∈ E HN (B.29)

C -Linearization of nonlinear terms with strong duality equivalence

As suggested in [START_REF] Wang | Risk assessment of integrated electricity and heat system with independent energy operators based on stackelberg game[END_REF], thanks to the strong duality property of the problem in (4.14)-(4. 19), the equivalence in Equation (C.1), between the decentralized objective function of the heat network and its dual objective function, is satisfied:

i∈V gb HN γ heat i p i + i∈V HN α heat i d i + i∈V P N j∈V HN ε i d h←p ji = q T in λ + q T eq µ = - i∈V HN λ 2 i p i - i∈V HN λ 4 i d i - k∈E HN λ 6 k f k - k∈E HN λ 7 k f k - i∈V HN µ 2 i d i . (C.1)
This equivalence can be used to linearize the terms ε i d h←p ji in F dcn P N by substitution.

Appended papers

Paper I A. Bellè

Motivation

Critical infrastructures, such as transportation, healthcare, energy systems, water supply systems and telecommunication networks, are large-scale systems that provide essential goods and services for society. Their malfunctioning and failure can heavily affect the safety and the socio-economic stability of a population. Developing highly reliable infrastructures is, thus, an important issue. Lately, due to the increasing degree of interconnection and interdependency, infrastructures have transformed from isolated individual systems to highly interconnected systems-of-systems. This evolution, while leading to improvements of performance, has introduced new failure modes and threats [1]. Critical infrastructures are often analyzed in terms of their vulnerability to different types and magnitudes of disrupting events. Vulnerability analysis is defined in [2] as the process of ''systematically and comprehensively identifying the possible states a system can be put into, due to specific strains, and estimating the negative consequences associated with them''. This analysis has proved to be useful in design and prevention stages, as it gives an overview of how a system responds to different disruptive situations.

Transportation systems, railway networks in particular, are acknowledged as one of the most important infrastructures. It is recognized that railway systems are dependent on several internal and * Corresponding author. E-mail address: andrea.belle@centralesupelec.fr (A. Bellè). external subsystems and infrastructures [3]. The dependency of railway networks on external power systems is of particular relevance, as these systems supply the electricity necessary for a proper functioning. In case of a disruptive event in a power grid, this strong dependency can lead to considerable negative consequences on the dependent railway systems. In fact, power outages and blackouts have been observed to be an important cause of railway networks disruption. For example, in the UK in August 2019, issues within the power grid led to major disruption of the railway system [4,5]. It is clear that railway operators should be aware of power network-induced risks [6].

Vulnerability analysis of railway networks dependent on external power networks has been the focus of various studies. These existing works, although recognizing the importance of the power systems for the railway networks functionality, do not model in details the interconnection between these two systems. In addition, the effect of cascading failures in power networks and their repercussions on railway networks are often treated approximately or overlooked. We refer to cascading failures as the process of failure propagation within and between different systems. Cascading failures have often been observed in power networks. These failures have the potential to cause major disruption in power networks, as well as within the dependent systems, such as railway networks. Neglecting the cascading failures analysis within a vulnerability assessment of interdependent railway and power https://doi.org/ power networks which accounts for a realistic modeling of the interface between railway and power systems and flow-based characterization of cascading failures in power networks, including their consequences in railway networks. In addition, we aim at estimating the effect of failures within railway networks on the vulnerability and cascading failures dynamics of power networks.

Related work

Power and railway networks are a traditional example of interdependent critical infrastructures. In fact, railway networks are often electrified and dependent on external power networks in terms of electricity supply. In general, two networks A and B are interdependent if the functionality of one depends on the state/output of the other one. Interdependencies are unidirectional (often simply referred to as dependencies) if network A depends on network B but not vice versa; otherwise, if networks A and B are mutually dependent on each other, the interdependencies are bidirectional (or simply referred to as interdependencies) [7,8]. The nature and the features of interdependencies have been an important subject of research since the early 2000s, and various classifications are available in the existing literature. One the most used classification is the one proposed in [7], where the authors divide interdependencies into four categories: physical, when the state of one system is dependent on the material output of another system; cyber, when the state of one system is dependent on the information transmitted through another system; geographic, when different systems share the same location and their state can be modified by an environmental event; and logical, if the interdependency is not physical, cyber, or geographic. Within this framework, the unidirectional interdependency from power to railway networks can be defined as physical. Alternative classifications of interdependencies, which focus on different aspects, are available in the existing literature, such as in [8][9][10].

As critical infrastructures represent the backbone of essential societal functions, ensuring their resilience is an important issue. The resilience of a system is defined as ''its ability to withstand stressors, adapt, and rapidly recover from disruptions'' [11]. Resilience is generally defined as the combination of three phases: the disturbance progress, which describes how fast and severe are the damages to the system, the post-disturbance degraded state, which describes how extensive in time the damages are, and the restoration, which describes the system restoration [12]. Lately, the resilience of interdependent critical infrastructures has gained particular interest from researchers, and many works have addressed this topic in recent years (e.g. [13][14][15][16]). The first phase of resilience is strictly correlated with the concept of vulnerability, which can be defined as ''degree of loss or damage to a system when exposed to a strain of a given type and magnitude'' [2]. Analyzing systems in terms of their vulnerability is essential to assess their exposure to external strains and stresses, and it is an important dimension of systems resilience.

Both railway and power networks have been extensively analyzed in terms of vulnerability. For example, the vulnerability of railway networks has been assessed in terms of different performance indicators, such as topological metrics [17][18][19] and flow-based metrics [20,21], and different disruption scenarios, such as random and targeted failures [22,23] or natural hazards [24,25]. For more references, the reader is referred to [26,27], where the authors discuss the concepts of vulnerability and resilience in transportation networks from a research perspective, including a comprehensive literature review.

Similarly, power networks have been analyzed in several works, in terms of different disruption scenarios, such as random failures [28][29][30], natural hazards [31] and intentional attacks [32][33][34], and different functional models and metrics, such as network-based models [28,30,35] and flow-based models [28,29]. For more details, the reader is referred to the comprehensive literature review in [36].

The risk and the resilience of interdependent systems have been the subject of various recent studies [37][38][39][40], also with a focus on vulnerability analysis (e.g. [41][42][43][44]).

However, only a few existing works discussed the vulnerability of interdependent railway and power networks. In [45], the authors propose a network-based approach for modeling the vulnerability analysis of a network-of-networks using as an example interdependent transportation, power and telecommunications networks, and including a network-based cascading failures model for the power network. This work relies on these interdependent critical infrastructures to propose an approach for vulnerability analysis of networks-of-networks. A similar approach, also including a network-based cascading failures model for the power network, is proposed in [46] and in [47], where the authors consider a fictitious railway network, based on the topology of the Italian high-voltage grid, connected to the power and telecommunications networks, and they analyze its vulnerability taking into account safety margins and uncertainties. In [48], a modeling framework for the vulnerability analysis of a railway system dependent on electrical and telecommunications networks is proposed, including critical components and locations analysis. A similar approach is also proposed in [2], where the dependency of the railway network on the external power network is addressed but without considering the structure of the external power network. These two last works provide a general framework for the vulnerability analysis of interdependent critical infrastructures. In [49], the authors propose a similar approach, also including the topology of the power grid within the analysis. In [3], a mathematical framework for modeling the vulnerability analysis of a railway network considering its subsystems is presented; this study accounts for the dependency between electricity and transportation, but without considering the external power grid. In [50,51], the resilience of railway networks is studied, also accounting for the dependency on the power subsystems. In [52], the combined effects of an external event (e.g. flooding) on both the infrastructures were considered and analyzed.

These works present some common drawbacks:

• With the exception of [2,48], the structure of the interface (or interconnection) between the interdependent railway and power networks is oversimplified, and the traction power substations that act as an interface between external power networks and railway tracks are overlooked.

• The cascading failures within power networks and their consequences within railway networks are considered only in [45][46][47]. However, in these works, the cascading failures are modeled with a network-based approach [53,54], and this includes some disadvantages: (i) network-based approaches do not include the modeling of power flows, and they represent a computationallycheap surrogate model unable to capture the physical features of power flows (ii) network-based and power flow-based models, under specific conditions, exhibit comparable behaviors at global scale but they are inconsistent at local scale [55]. This makes network-based model unsuitable to describe realistically interdependent systems, as the failures propagation between systems is driven by the local topology of the interdependencies.

• The effect of failure in the railway network on the power network is not addressed. In other words, only the dependent behavior is analyzed, and how failures in railway networks affect the power redistribution and the cascading failures dynamics within power networks is not considered.

It is clear that interdependent railway and power networks deserve a more detailed analysis, with a focus on a more realistic consideration of the interconnection interface and cascading failures dynamics, in order to shed some light on the mutual risks of these interconnected systems.

Contribution

In this work, we propose an approach for the modeling and vulnerability analysis of interdependent railway and power networks, which includes the modeling of the interface between the external power network and the railway network, here referred to as the traction power network, and the evaluation of cascading failures within and between networks. We model the cascading failures using a flow-based approach based on the traditional ORNL-PSerc-Alaska (OPA) model [56,57]. However, we adapt it in order to account for the effect of failures in the railway network on the cascading failures dynamics of the external power network.

In summary, the contributions of this work are the following:

• We propose a modeling approach for the vulnerability analysis of interdependent railway and power networks which accounts for a realistic coupling interface between railway and external power systems and the flow-based characterization of cascading failures within and between the infrastructures.

• We propose a performance indicator for the railway network, called track power performance TPP, which accounts for binary functional states and continuous degraded performance due to lack of electricity supply.

• We propose an approach which accounts for the effect of failures within the railway network on the cascading failures dynamics of the external power network.

• We evaluate the effect of cascading failures within and between networks analyzing the negative consequences on the railway and the external power network.

The rest of this work is structured as follows: in Section 2, the proposed modeling framework is presented; in Section 3, the illustrative test systems utilized in this work are described; in Section 4, the results are presented and discussed; in Section 5, final remarks and conclusions are given.

Modeling framework

In this section, the modeling and simulation framework is described. Each subsection describes a particular feature of the model:

• Section 2.1 describes the modeling of the topological features of railway tracks and stations (called in the paper railway network), railway traction power substations (called in the paper traction power network) and external power grid (called in the paper external power network) using network theory.

• Section 2.2 shows how to model the topological and functional features of the interdependencies between the three networks.

• Section 2.3 describes how to model and simulate initiating events as removals of elements of networks.

• Section 2.4 describes the modeling of cascading failures, i.e., failure propagation within and between networks.

• Section 2.5 describes how the analysis, in terms of performance indicators and simulation, is performed.

Network-based model for interdependent railway and power systems

Network science is often used to describe the topology of both railway and power networks, thanks to its capacity to describe complex topologies and interactions with simple mathematical artifacts such as nodes and edges. A network is defined by a graph 𝐆 = (𝐕, 𝐄), with 𝐕 = {𝑣 1 , 𝑣 2 , … , 𝑣 𝑁 } representing the set of 𝑁 nodes (or vertices) and 𝐄 = {𝑒 1 , 𝑒 2 , … , 𝑒 𝑀 } the set of 𝑀 edges. Each edge 𝑘 is also defined by a tuple 𝑒 𝑘 = (𝑣 𝑖 , 𝑣 𝑗 ), which indicates the two nodes 𝑣 𝑖 and 𝑣 𝑗 connected by edge 𝑘. In this work, we identify three separate networks: the railway network, defined by the subscript 𝑟, the traction power network, defined by the subscript 𝑡, and the external power network, defined by the subscript 𝑝.

In the railway network 𝐆 𝐫 = (𝐕 𝐫 , 𝐄 𝐫 ), nodes represent stations and edges represent railway tracks. Each railway edge represents a direct bi-directional physical connection between two stations.

In the traction power network 𝐆 𝐭 = (𝐕 𝐭 , 𝐄 𝐭 = ∅), nodes represent railway power traction substations. In this work, we assume that each substation is in electrical isolation, and the set of edges is just an empty set. However, for some configurations of electrified railway systems, such as DC-electrified systems, substations are connected with each other. This situation is not considered in this work, but it can be modeled with an appropriate set of edges 𝐄 𝐭 .

In the external power network 𝐆 𝐩 = (𝐕 𝐩 , 𝐄 𝐩 ), nodes represent electrical buses and edges represent transmission lines. Each electrical bus can contain power production or consumption units, here referred to as generators and loads. These elements are defined by the set of generators 𝐠 𝐩 = {𝑔 1 , 𝑔 2 , … , 𝑔 𝑁 𝑔 } and the set of loads 𝐥 𝐩 = {𝑙 1 , 𝑙 2 , … , 𝑙 𝑁 𝑙 }.

Interdependencies 2.2.1. Topological

Electrified railway systems are dependent on external power networks, such as transmission and distribution networks, for the electricity supply. Rolling stocks are usually supplied by the catenary, a dedicated power line which runs parallel to the railway track. Along each railway track, the catenary is divided into sections, each of them supplied by a dedicated traction power substation, which is supplied by the external power network (distribution or transmission network). Each substation also regulates the voltage level before feeding the catenary (e.g. 25 kV for AC railway systems or 1.5 kV for DC railway systems, typically). However, in this study, we do not model this feature.

The traction power network thus depends on the external power network in terms of electricity supply. Specifically, we assume that each substation in the traction power network is dependent on the geographically-closest node in the external power network. We denote this relationship with the interdependency edge 𝑒 𝑖←𝑗 𝑡←𝑝 = (𝑣 𝑡,𝑖 , 𝑣 𝑝,𝑗 ), indicating that the node 𝑖 in the traction power network is dependent on the node 𝑗 in the external power network.

The traction power network is usually directly connected to the railway catenary to supply electricity to the rolling stocks. The railway network thus depends on the traction power network in terms of electricity supply. Specifically, we assume that each railway track 𝑖 depends on a set of traction substations 𝐕 𝑟,𝑖 𝐭 ⊆ 𝐕 𝐭 , that are responsible for the electricity supply of that specific railway track. We denote this relationship with the set of interdependency edges 𝐄 𝑖←𝑗 𝑟←𝑡 = (𝑒 𝑟,𝑖 , 𝐕 𝐫,𝐢 𝐭 ), indicating that edge 𝑖 in the railway network is dependent on the nodes within the subset 𝐕 𝐫,𝐢 𝐭 ⊆ 𝐕 𝐭 of the traction power network. We assume that the substations in 𝐕 𝐫,𝐢 𝐭 are located equidistantly along the railway track. The first and the last substation, denoted as 𝑣 𝑟,𝑖 𝑡,𝑣 𝑟,𝑗 and 𝑣 𝑟,𝑖 𝑡,𝑣 𝑟,𝑘 , are located within the railway stations 𝑗 and 𝑘 delimiting the railway track 𝑖, and they are also responsible for the electricity supply of the stations.

Functional

The external power network is modeled using a traditional DC power flow model (details in Section 2.4 and Appendix A). Each node represents a bus, and it can contain multiple generators, characterized by power generation 𝑃 𝑔,𝑖 and generation capacity 𝑃 𝑚𝑎𝑥 𝑔,𝑖 , and multiple loads, characterized by supplied power demand 𝑃 𝑙,𝑖 and requested power demand 𝑃 𝑚𝑎𝑥 𝑙,𝑖 . Loads can represent the power demand of the traction substations (and thus of the railway network) or general consumers (households, industries, etc.). The loads which represent traction substations are defined by the subset 𝐥 𝐬𝐮𝐛 𝐩 ∈ 𝐥 𝐩 , while the loads which represent general consumers are defined by the subset 𝐥 𝐛𝐚𝐬𝐞 𝐩 ∈ 𝐥 𝐩 . Each edge represents a line, characterized by power flow 𝐹 𝑖 and flow capacity 𝐹 𝑚𝑎𝑥 𝑖 . The traction power network is dependent on the external power network in terms of electricity supply. We assume that each substation 𝑖 is dependent on the geographically-closest bus of the external power network, which contains a load 𝑗, denoted as 𝑙 𝑡,𝑖 𝑗 ∈ 𝐥 𝐬𝐮𝐛 𝐩 , with requested power demand 𝑃 𝑚𝑎𝑥 𝑙 𝑡,𝑖 𝑗 , which represents the power demand of the traction substation 𝑖. Each substation 𝑖 is characterized by two indicators: the state 𝑆 𝑡,𝑖 , which indicates if the station is functional or not, and the load shedding ratio 𝑅 𝑡,𝑖 , which defines the fraction of the requested power demand which is supplied to the substation. Both these values are dependent on the power supplied to the corresponding load 𝑙 𝑡,𝑖 𝑗 within the external power network. The value 𝑅 𝑡,𝑖 defines, as shown in Eq. ( 1), the ratio between the supplied and requested power demand in the corresponding load in the external power network.

𝑅 𝑡,𝑖 = 𝑃 𝑙 𝑡,𝑖 𝑗 𝑃 𝑚𝑎𝑥 𝑙 𝑡,𝑖 𝑗 . ( 1
)
A. Bellè et al.

The ratio 𝑅 𝑡,𝑖 defines the fraction of requested demand which is supplied, and it also defines the functional state 𝑆 𝑡,𝑖 (1 if functional, 0 otherwise) of the substation 𝑖, according to a predefined threshold 𝑇 𝑡←𝑝 = [0, 1] and Eq. (2).

𝑆 𝑡,𝑖 = ⎧ ⎪ ⎨ ⎪ ⎩ 1, if 𝑅 𝑡,𝑖 ≥ 𝑇 𝑡←𝑝 and 0 < 𝑇 𝑡←𝑝 ≤ 1 0, if 𝑅 𝑡,𝑖 < 𝑇 𝑡←𝑝 and 0 < 𝑇 𝑡←𝑝 ≤ 1 0, if 𝑅 𝑡,𝑖 = 𝑇 𝑡←𝑝 and 𝑇 𝑡←𝑝 = 0 (2)
When 𝑇 𝑡←𝑝 = 1, it represents a ''zero-tolerance'' situation, where a substation is functional only as long as the entire requested power demand is satisfied. When 𝑇 𝑡←𝑝 = 0, it represents the opposite situation, where a substation is functional as long as some electricity is provided. The case 0 < 𝑇 𝑡←𝑝 < 1 represents situations in-between, where a substation is considered functional as long as at least a specific fraction of the requested power demand is satisfied.

The railway network functionality depends on the traction power network. As explained in the previous section, each railway track 𝑖 depends on a subset 𝐕 𝐫,𝐢 𝐭 ⊆ 𝐕 𝐭 of traction substations. Each railway track 𝑖 is defined by its functional state 𝑆 𝑟,𝑖 and its track power performance 𝑇 𝑃 𝑃 𝑖 . We assume that each railway 𝑖 is functional only if all the substations in 𝐕 𝐫,𝐢 𝐭 are functional, as defined in Eq. ( 3):

𝑆 𝑟,𝑖 = ∏ 𝑗∈𝐕 𝐫,𝐢 𝐭 𝑆 𝑡,𝑗 (3)
In fact, we assume that if one substation is not functional, the corresponding section of the railway track is not supplied with the necessary electricity, thus interrupting the continuity of the railway track. The track power performance 𝑇 𝑃 𝑃 𝑖 of each railway track 𝑖 is dependent on the state 𝑆 𝑟,𝑖 and the ratio 𝑅 𝑡,𝑗 of each substation 𝑗 within the subset 𝐕 𝐫,𝐢 𝐭 , as defined in Eq. ( 4):

𝑇 𝑃 𝑃 𝑖 = 𝑆 𝑟,𝑖 𝑁 𝐕 𝐫,𝐢 𝐭 ∑ 𝑗∈𝐕 𝐫,𝐢 𝐭 𝑅 𝑡,𝑗 (4)
where 𝑁 𝐕 𝐫,𝐢

𝐭

is the number of substations within the subset 𝐕 𝐫,𝐢 𝐭 . As it can be clearly seen in Eq. ( 4), the 𝑇 𝑃 𝑃 𝑖 of each railway track 𝑖 is equal to the ratio between total supplied and requested power demand within the substations in 𝐕 𝐫,𝐢 𝐭 if the track is functional, or 0 otherwise. This performance indicator allows to describe the binary state of the track (functional/not functional), as well as the degraded performance due to lack of electricity supply.

In this study, we account also for the impact of failures in the railway network on the external power network. We assume that for any failed railway track 𝑖, the corresponding traction substations in 𝐕 𝐫,𝐢 𝐭 do not absorb electricity from the external power network. Therefore, for each substation 𝑗 in 𝐕 𝐫,𝐢 𝐭 , the corresponding load 𝑙 𝑡,𝑖 𝑗 in the external power network has a reduced requested power demand 𝑃 𝑚𝑎𝑥 ′ 𝑙 𝑡,𝑖 𝑗 . Specifically, we assume that, if the substation is located within a railway station, the requested power demand is reduced; otherwise, the requested power demand is 0. This behavior can impact the power redistribution and the cascading failures dynamics of the external power network. More details are available in Section 2.4.

Modeling initiating events

Initiating events represent single and multiple failures which might affect a system during normal operation or external strains. Vulnerability analysis investigates the system's response to different initiating events, often modeled as removals of an increasing fraction of components from the network [2,3]. The set of components to be removed is defined as 𝐍 𝐟 = {𝑛 𝑓 ,1 , 𝑛 𝑓 ,2 , … , 𝑛 𝑓 ,𝑁 𝑓 𝑎𝑖𝑙 }. In this work, we assume that only edges within the external power network can be removed from the network, and the number of components 𝑁 𝑓 𝑎𝑖𝑙 which constitute the set 𝐍 𝐟 depends on the fraction 𝑓 according to Eq. ( 5):

𝑁 𝑓 𝑎𝑖𝑙 = ⌊𝑓 ⋅ 𝑀 𝑝 ⌋ (5)
where 𝑀 𝑝 is the number of edges in the external power network and ⌊⋅⌋ is the floor function, which returns the greatest integer less than or equal to the argument of the function. When an edge fails, it is simply removed from the network. The fraction 𝑓 can be interpreted as the magnitude of the initiating event. The elements selection of the set 𝐍 𝐟 depends on the type of initiating event. In this work, we consider only random removals as removal strategies for initiating events. Other strategies, such as spatially-localized and targeted removals, are not considered in this work. Random removals represent a wide range of initiating events (human errors, structural defects, random sabotages, etc.), and they are useful for understanding the robustness of a network under different magnitude of strains which might impact multiple locations of the network. Given the set of network edges 𝐄 𝐩 , we assume that each edge, has the same probability 𝑝 𝑖𝑒 of being selected as part of the initiating event and removed, computed according to Eq. ( 6):

𝑝 𝑖𝑒 = 1 𝑀 𝑝 . ( 6
)
The component selection is made according to Eq. ( 7):

𝑝 𝑖𝑒 ⋅ (𝑖 -1) ≤ 𝑟 < 𝑝 𝑖𝑒 ⋅ 𝑖 ( 7
)
where 0 < 𝑟 < 1 is a random number and 𝑖 is the index of the edge 𝑒 𝑖 which satisfies the above relationship, and the procedure shown in the following steps:

1. Set 𝐍 𝐟 = ∅ and compute 𝑁 𝑓 𝑎𝑖𝑙 according to Eq. ( 5).

2. Generate a random number 0 < 𝑟 < 1.

3. Identify edge 𝑒 𝑖 which satisfies Eq. ( 7). 4. If 𝑒 𝑖 is not in 𝐍 𝐟 , add 𝑒 𝑖 to 𝐍 𝐟 and go to step 5; otherwise, return to step 2. 5. If 𝐍 𝐟 contains 𝑁 𝑓 𝑎𝑖𝑙 elements, stop the selection; otherwise, return to step 2.

Modeling cascading failures

Failures and subsequent removals of failed elements can trigger a cascading failures process, which is defined as a ''kind of failure in a system comprising interconnected parts, in which the failure of a part can trigger the failure of successive parts'' [58]. When failures propagate within different infrastructures, it is also referred to as cascading effect, and it is often characterized by an increasing severity of damages [59]. In this work, we thus refer as cascading failures to the process of failure propagation within and between networks, triggered by an initiating event. Simulating cascading failures is an iterative simulation process. At each step, the network topology is updated, as failed components are removed. The general procedure for cascading failures simulation in single or interdependent networks includes the following steps:

1. Initialize network 𝐆 = (𝐕, 𝐄). 2. Initialize initiating event 𝐍 𝐟 . 3. Remove failed elements. 4. Update network topology. 5. Check conditions for cascading failures. 6. If there is any new failure, return to step 3; otherwise, stop the simulation.

Cascading failures have been extensively analyzed for power networks, as several approaches are available in the existing literature [60]. However, these models often focus solely on power networks, without considering interdependencies with other infrastructures. These models are not suited for evaluating the effect of the interdependencies on the cascading failures dynamics, and they allow to analyze only the effect of failures in the power network on other systems. For example, this is the approach taken in [45][46][47], where the cascading failures simulation in the power network is decoupled from the vulnerability analysis of the railway network and follows this general steps: • Select initiating event.

• Run a complete cascading failures simulation with the external power network.

• From the output of the cascading failures simulation, compute the negative consequences on the railway network.

In this work, we propose a flow-based cascading failures model, based on the traditional ORNL-PSerc-Alaska (OPA) model [56,57] (see Appendix B for details), which accounts for the impact of failures in the railway network on the cascading failures dynamics of the external power network. The flowchart of the algorithm is shown in Fig. 1.

The algorithm comprises eight iterative steps, and it is based on the assumption that, when a railway track fails, the corresponding traction substations stop requesting electricity from the external power network. This impacts the requested power demand of the corresponding loads in the external power network, affecting thus the cascading failures dynamics of the external power network. After the selection of the edges to remove as initiating event (as explained in Section 2.3), the cascading failures algorithm initializes the networks and the empty sets 𝐍 𝐝𝐢𝐫 𝐅 and 𝐍 𝐢𝐧𝐝 𝐅 in Step 1, and removes the failed edges from the networks in Step 2.

In Step 3, the power supplied to each load of the external power network is computed with a DC Optimal Power Flow (DC-OPF), an optimization procedure shown in Eqs. ( 8)- (12):

min 𝐏 𝐠 ,𝐏 𝐥 𝑁 𝑔 ∑ 𝑖=1 𝑃 𝑔,𝑖 -𝑊 𝑁 𝑙 ∑ 𝑗=1 |𝑃 𝑙,𝑗 | (8)
subject to:

𝑁 𝑔 ∑ 𝑖=1 𝑃 𝑔,𝑖 - 𝑁 𝑙 ∑ 𝑗=1 |𝑃 𝑙,𝑗 | = 0 (9) 0 ≤ 𝑃 𝑔,𝑖 ≤ 𝑃 𝑚𝑎𝑥 𝑔,𝑖 (10)
-𝑃 𝑚𝑎𝑥 𝑙,𝑗 ≤ 𝑃 𝑙,𝑗 ≤ 0 (11)

-𝐹 𝑚𝑎𝑥 𝑘 ≤ 𝐹 𝑘 ≤ 𝐹 𝑚𝑎𝑥 𝑘 . ( 12
)
The objective function in (8) represents the cost to minimize, while Eqs. ( 9)-( 12) represent the constraints. The first term of Eq. ( 8) represents the power production cost, which is assigned a unitary value per unit of power 𝑃 𝑔,𝑖 produced in each generator 𝑖. The second term represents the negative cost associated to the power 𝑃 𝑙,𝑖 supplied at each load 𝑖. The penalty constant 𝑊 , here assumed to be equal to 100, ensures the minimization of load shedding when possible. Constraint (9) describes the power balance between power produced and consumed. Constraints (10) and ( 11) represent the ranges of power generation and supplied power demand, respectively. Constraint (12) represents the limit for lines power flow. The computation of the power flow is subjected to the DC power flow assumption (see Appendix A).

After the computation of the power supplied to each load in the external power network, in Step 4 we check for failed substations in the traction power network, using the relations defined in Eqs. ( 1) and (2).

If new failed substations are present, the algorithm proceeds with Step 5, where we check for failed railway tracks, according to Eq. ( 3 . In these substations, as they might supply multiple railway tracks, the requested power demand is simply reduced according to Eq. ( 13):

𝑃 𝑚𝑎𝑥 ′ 𝑙 𝑡,𝑘 𝑗 = 𝑃 𝑚𝑎𝑥 𝑙 𝑡,𝑘 𝑗 ⋅ ∑ 𝑖∈𝐄 𝐯 𝐫,𝐰 𝐫 𝑆 𝑟,𝑖 𝑑(𝑣 𝑟,𝑤 ) (13)
where 𝐄

𝐯 𝐫,𝐰 𝐫

⊆ 𝐄 𝐫 is the subset of railway tracks connected to station 𝑣 𝑟,𝑤 , 𝑆 𝑟,𝑖 is the state of the railway track 𝑖 and 𝑑(𝑣 𝑟,𝑤 ) is the degree of station 𝑣 𝑟,𝑤 (number of edges connected to node 𝑣 𝑟,𝑤 ).

Following this procedure, we proceed with Step 7, where we check for overloaded lines, similarly to Step 8. As in the traditional OPA model, a line 𝑘 is considered overloaded when its power flow 𝐹 𝑘 is within 1% of the maximum capacity of the line 𝐹 𝑚𝑎𝑥 𝑘 . An overloaded line is assumed to trip, and thus fail, with probability 𝑝 𝑜𝑙 . In this work, aiming for a conservative worst-case analysis, we assume 𝑝 𝑜𝑙 = 1 [55]. The state of transmission line 𝑘 is thus defined by Eq. ( 14):

𝑆 𝑝,𝑘 = ⎧ ⎪ ⎨ ⎪ ⎩ 1, if 𝐹 𝑘 𝐹 𝑚𝑎𝑥 𝑘 < 0.99 0, otherwise (14)
where 𝑆 𝑝,𝑘 is the state of line 𝑘. From Step 7, the algorithm returns to Step 2, where the new failed components are removed from the networks. New failed components comprises railway tracks 𝑖 with at least one failed substation within the set 𝐕 𝐫,𝐢 𝐭 and overloaded power lines (if any). From Step 8, the algorithm returns to Step 2 if overloaded lines are present; otherwise, it is stopped.

Vulnerability metrics and analysis

Vulnerability analysis aims at estimating the negative consequences which arise in a system given an imposed strain [29]. Mathematically, the negative consequences on a system can be defined as the relative change of a specific performance indicator after a disruptive event, and the vulnerability 𝑉 can be generally expressed as in Eq. ( 15):

𝑉 = 𝑃 𝐼 -𝑃 𝐼 ′ 𝑃 𝐼 ( 15
)
where PI and PI ′ represent respectively the performance indicator before and after the disruptive event.

In order to compute an average vulnerability index, multiple iterations are needed, because different fractions of removals and different combinations of components in 𝐍 𝐟 leads to different vulnerability values. Average values V and 95% confidence intervals 𝐶𝐼 95 for each fraction of removals are computed respectively with Eqs. ( 16) and ( 17):

V = ∑𝑁 𝑒𝑥𝑝 𝑖=1 𝑉 𝑖 𝑁 𝑒𝑥𝑝 ( 16
)
𝐶𝐼 95 = V ± 𝑍 ⋅ σ √ 𝑁 𝑒𝑥𝑝 ( 17
)
where 𝑁 𝑒𝑥𝑝 is the number of experiments per fraction of removals, 𝑍 is the 95% confidence interval constant, equal to 1.96, and σ is the estimated standard deviation. The algorithm for computing the vulnerability indexes for each fraction of removals is shown in Fig. 2.

After the initialization of the iteration counter 𝑐 = 0 in Step 1 and the initiating event in Step 2 (as explained in Section 2.3), the algorithm runs the cascading failures simulation explained in Section 2.4 (corresponding to the algorithm in Fig. 1). From the outputs of the cascading failures simulation, in Step 4 we compute the vulnerability indexes 𝑉 𝑖 and store them. In Step 5, we increase the iteration counter by 1, and in Step 6 we check if it is equal to the maximum number of iterations 𝑁 𝑒𝑥𝑝 . If 𝑐 = 𝑁 𝑒𝑥𝑝 , in Step 7, we compute the average vulnerability indexes and the standard deviations with Eqs. ( 16) and ( 17) and we stop the algorithm; otherwise, the algorithm returns to Step 2. This procedure must be performed for every fraction of removals.

The performance indicator is selected according to the type of system under analysis. For the railway network, we rely on two performance indicators: the accessibility 𝐴 𝑟 and the railway power performance 𝑅𝑃 𝑃 . The accessibility is defined in Eq. ( 18):

𝐴 𝑟 = 1 𝑁 𝑟 𝑁 𝑟 ∑ 𝑖=1 𝑛 𝑖 𝑎 𝑁 𝑟 -1 (18)
where 𝑁 𝑟 is the total number of stations and 𝑛 𝑖 𝑎 is number of stations accessible from the station 𝑖. It can be interpreted as the average fraction of stations accessible from (or connected to) each other [20].

The railway power performance 𝑅𝑃 𝑃 is defined in Eq. ( 19):

𝑅𝑃 𝑃 = 1 𝑀 𝑟 𝑀 𝑟 ∑ 𝑖=1 𝑇 𝑃 𝑃 𝑖 ( 19
)
where 𝑀 𝑟 is the number of railway tracks and 𝑇 𝑃 𝑃 𝑖 is the track power performance of railway track 𝑖, defined in Section 2.2.2. This indicator represents the average performance of the railway network tracks, where the performance of each track is equal to the average ratio 𝑅 𝑡,𝑖 of the supporting substation in 𝐕 𝐫,𝐢 𝐭 if the track is functional, or 0 if the track is not functional. This formulation allows to take into account binary states (functional/not functional), as well as degraded performance due to partial power supply.

For the power network, we utilize as performance indicator the Demand Not Supplied (DNS) and the Fraction of Demand Not Supplied (FDNS), shown in Eqs. ( 20) and (21). 𝐩 is the subset of loads representing traction substations directly failed during the cascading failures simulation, as explained in the previous section. We do not account for the loads corresponding to traction substations indirectly failed. In fact, these substations are failed due to failures of other substations, and the power not supplied in these substations is not accounted for in the computation of 𝐷𝑁𝑆 and 𝐹 𝐷𝑁𝑆.

𝐷𝑁𝑆 = ∑ 𝑖∈𝐥 𝐛𝐚𝐬𝐞 𝐩 𝑃 𝑚𝑎𝑥 𝑙,𝑖 + ∑ 𝑖∈𝐥 𝐍 𝐝𝐢𝐫 𝐅 𝐩 𝑃 𝑚𝑎𝑥 𝑙,𝑖 - ∑ 𝑖∈𝐥 𝐛𝐚𝐬𝐞 𝐩 𝑃 ′ 𝑙,𝑖 - ∑ 𝑖∈𝐥 𝐍 𝐝𝐢𝐫 𝐅 𝐩 𝑃 ′ 𝑙,𝑖

Illustrative test systems

The developed model is applied to investigate the vulnerability of an electrified railway network. For this, a simplified version of a British high-speed railway system, based on a proposition made in [START_REF] Lee | Restoration of services in interdependent infrastructure systems: a network flows approach[END_REF], is considered. The system comprises a railway network powered by an external power network through a traction power network. The railway network consists of 16 stations connected by 21 railways. The external power network is based on the Great Britain reduced power network [62], which represents a high-voltage transmission system (it originally represents a 400/275 kV system). It consists of 29 electrical buses, containing 29 base loads (one in each bus), representing the power demand of general consumers (households, industries, etc.), 85 loads corresponding to the traction substations and 66 generators. Buses are connected by 99 lines, most of them in redundant double circuit configuration. We assume the maximum power generation capacity of the external power network to be slightly higher than the requested power demand, respectively 20.59 GW and 20 GW. The generator power capacities range from 0.003 GW to 1.958 GW. The base load power demands range from 0.033 GW to 2.724 GW. The capacities of transmission lines range from 0.046 GW to 2.471 GW. In nominal conditions, with all the elements functional, the loading percentage of lines in the external power network ranges from 1.22% to 67.82%, with an average value of 21.66%. For other electrical parameters of the external power network, please refer to the data available in [62].

The railway and external power networks are coupled by the traction power network, which consists in 85 substations, in electrical isolation, distributed equidistantly (on average one every 35 km) along the corresponding railway tracks. The requested power demand for each substation (and thus the requested power demand of each corresponding load in the external power network) is assumed to be 200 MW if the substation is located within a railway station, or 12 MW otherwise. The total requested power demand of the traction power network (and thus of the railway network) is 4028 MW, which corresponds to 20% of the total requested power demand of the external power network. We define this fraction as the coupling strength between the railway and the external power network. In this work, we do not perform a sensitivity analysis on the coupling strength, but it might be an interesting input for future works. As mentioned before, it is assumed that the electricity is supplied to each substation from the closest electrical bus within the external power network, which represents the power demand of the corresponding station, as denoted by the set of interdependency edges 𝐄 𝐭←𝐩 . The geographical and network-based representations of the networks are shown in Figs. 3 and4, respectively.

As initiating events, we remove fractions of edges from the external power network. The fraction of removals ranges from 0% to 100%, with steps of 10%. These removals can represent a wide range of disruptive events which might cause multiple failures of power transmission lines: intentional random sabotages, hidden failures due to defective relays, natural events (e.g. extreme storms and/or winds), random failures (e.g. falling trees), human mistakes (e.g. incorrect maintenance), or other events. We analyze the effect in terms of vulnerability of the railway network and external power network for three different tolerance threshold 𝑇 𝑡←𝑝 values (0.0, 0.5, 1.0).

The vulnerability of the railway network is assessed in terms of accessibility 𝐴 𝑟 and railway power performance 𝑅𝑃 𝑃 . In order to highlight the importance of cascading failures analysis, the vulnerability of railway networks is assessed with and without cascading failures simulation within the external power network. The analysis without cascading failures in external power networks is performed with the algorithm is Fig. 1 and by setting the tripping probability of overloaded lines 𝑝 𝑜𝑙 to 0. The vulnerability of the external power network is performed only considering cascading failures within the analysis. The vulnerability of the external power network is assessed in terms of demand not supplied 𝐷𝑁𝑆 and fraction of demand not supplied 𝐹 𝐷𝑁𝑆.

For every fraction of removals, we compute average vulnerability indexes and standard deviations using a number of experiments 𝑁 𝑒𝑥𝑝 equal to 1000, as it allows to obtain 95% confidence intervals small enough to perform a detailed and consistent analysis.

Finally, the external power network is implemented within Pandapower [63] and the power flow computations are performed using the PowerModels.jl API of Pandapower [64].

Results and discussion

The impact on the railway network

The impact of random removals of edges from the external power network on the railway network is assessed by the average loss of accessibility 𝐴 𝑟 and average loss of railway power performance 𝑅𝑃 𝑃 for three 𝑇 𝑡←𝑝 values (0.0, 0.5 and 1.0). The results with and without cascading failures simulation within the external power network, denoted respectively as (C) and (NC), and corresponding to failure probabilities for overloaded lines of 𝑝 𝑜𝑙 = 1 and 𝑝 𝑜𝑙 = 0, respectively, are presented in Figs. 5 and6.

As it can be clearly seen, the impact on the railway network follows different patterns for different 𝑇 𝑡←𝑝 values. Intuitively, the lower is the threshold 𝑇 𝑡←𝑝 , the less vulnerable is the railway network, as it is more tolerant to lack of electricity supply. Moreover, as expected, cascading failures considerably increase the impact of removals in the power network on the railway network. These considerations are valid for both the topological accessibility 𝐴 𝑟 and the railway power performance 𝑅𝑃 𝑃 . A direct measure of the disruption is the area below the vulnerability curves in Figs. 5 and6. For comparison, the values of the areas below the curves for 𝑇 𝑡←𝑝 = 0.5 and 𝑇 𝑡←𝑝 = 0.0 are computed and normalized with the area below the curve for 𝑇 𝑡←𝑝 = 1.0 with cascading failures, for both 𝐴 𝑟 in Fig. 5 and 𝑅𝑃 𝑃 in Fig. 6. The results for 𝐴 𝑟 and 𝑅𝑃 𝑃 are shown in Tables 1 and2, respectively.

From the results in Figs. 5 and6 and Tables 1 and2, we can draw two general considerations:

• The severity of disruption increases with the increase of the threshold 𝑇 𝑡←𝑝 .

• The inclusion of cascading failures within the analysis increases the severity of disruption within the railway network. These considerations are intuitive and in line with the expected results. However, it is important to quantify and discuss the difference in results within the two performance indicators when using different 𝑇 𝑡←𝑝 values and considering/excluding cascading failures within the analysis.

As it can be clearly seen in Figs. 5 and6 and Tables 1 and2, higher tolerance thresholds 𝑇 𝑡←𝑝 increase the vulnerability of the railway network. For example, in the case of accessibility 𝐴 𝑟 , the area below the continuous blue curve in Fig. 5, which corresponds to the case 𝑇 𝑡←𝑝 = 0.0 with cascading failures, is a fraction 0.29 of the continuous red curve within the same figure, which corresponds to the case 𝑇 𝑡←𝑝 = 1.0 with cascading failures. This is due to the fact that, with low 𝑇 𝑡←𝑝 values within the substations of the traction power network, the railway network is more tolerant to the lack of electricity and the negative impact of disruption within the external power network on the railway network is less pronounced.

However, we can notice some differences when comparing the results for the accessibility 𝐴 𝑟 in Fig. 5 and the railway power performance 𝑅𝑃 𝑃 in Fig. 6. Firstly, the red curves (𝑇 𝑡←𝑝 = 1.0) and the green curves (𝑇 𝑡←𝑝 = 0.5) for 𝐴 𝑟 in Fig. 5 have higher values if compared to the same curves for 𝑅𝑃 𝑃 in Fig. 6. Secondly, the blue curves (𝑇 𝑡←𝑝 = 0.0) are higher for 𝑅𝑃 𝑃 , except for a total removal of edges in the external power network (fraction of removal 1.0). As a result, the railway network is more vulnerable in terms of accessibility 𝐴 𝑟 than railway power performance 𝑅𝑃 𝑃 for high threshold values (𝑇 𝑡←𝑝 ≥ 0.5); on the contrary, for low threshold values (e.g. 𝑇 𝑡←𝑝 = 0.0), the railway network is more vulnerable in terms of 𝑅𝑃 𝑃 .

These behaviors are caused by the intrinsic differences within the two performance indicators. Firstly, the accessibility is binary-based (railway tracks are either functional or not), while the railway power performance is hybrid binary-continuous (it accounts for functional state and degraded performance). As a result, for 𝑇 𝑡←𝑝 = 0.0, the railway network is more vulnerable in terms of 𝑅𝑃 𝑃 . In fact, with 𝑇 𝑡←𝑝 = 0.0, the railway network is more tolerant in terms of lack of electricity supply and the number of not functional railway tracks is smaller if compared to higher 𝑇 𝑡←𝑝 values. However, functional railways can have degraded performance: this is captured by 𝑅𝑃 𝑃 but not by 𝐴 𝑟 . As a result, for low 𝑇 𝑡←𝑝 , the losses in terms 𝑅𝑃 𝑃 are higher than the losses in terms of 𝐴 𝑟 .

Secondly, the failures of railways can be more impactful in terms of 𝐴 𝑟 than 𝑅𝑃 𝑃 . In fact, failed railway tracks might impact the accessibility from/to several railway stations, leading to considerable losses in terms of 𝐴 𝑟 . As a result, for high threshold values (e.g. 𝑇 𝑡←𝑝 ≥ 0.5), the railway network is more vulnerable in terms of 𝐴 𝑟 , as the number of failed railway tracks is higher than 𝑇 𝑡←𝑝 = 0.0.

Both the performance indicators are strongly affected by the cascading failures. In fact, it is clearly visible in Figs. 5 and6 that cascading failures lead to more negative consequences in terms of losses. The difference between considering or excluding cascading failures from the analysis can be quantified with Tables 1 and2. In fact, by comparing the normalized areas for the curves with and without cascading failures for the same 𝑇 𝑡←𝑝 , it can be seen how the cascading failures lead to greater disruption, in the order of magnitude of 10%-20% of additional losses, depending on the case.

In conclusion, failures in the power network can lead to considerable disruption within the railway network due to lack of electricity. We modeled the tolerance to lack of electricity of the railway network using the parameter 𝑇 𝑡←𝑝 . Intuitively, the more tolerant is the railway network, and the smaller is the disruption. In addition, we show that cascading failures can considerably increase the negative consequences on the railway network. We quantified the cascading failures effect with the normalized areas in Tables 1 and2, and we conclude that cascading failures should be included within the vulnerability analysis for a realistic estimation of possible negative consequences on the railway network.

The impact on the power network

The dependency of the railway network on the external power network can affect the behavior of the external power network itself. In fact, as railway tracks fail, the corresponding traction substations stop absorbing power, leading to a reduction of the requested power demand within the external power network. This can impact the power redistribution and the cascading failures dynamics.

As in the previous case, a specific fraction of edges (from 0% to 100%, with steps of 10%), is randomly removed from the external power network. Through the model described in the previous section, the impact on the external power network is assessed in terms of MW of Demand Not Supplied (𝐷𝑁𝑆), shown in Fig. 7, and Fraction of Demand Not Supplied (𝐹 𝐷𝑁𝑆), shown in Fig. 8. The results are compared with the ones of a traditional OPA model (see Appendix B), which does not account for the effect of railway track failures on the external power network and the cascading failures dynamics.

The key indicator to analyze is the 𝐷𝑁𝑆, which provides the information on the quantity of requested power demand, in absolute value, which is not satisfied. The results are shown in Fig. 7. Two main considerations can be drawn:

• The application of a traditional OPA model leads to higher results in terms of DNS, as it can be clearly seen by comparing the black curve in Fig. 7 to the other ones.

• The effect of different 𝑇 𝑡←𝑝 values is not straightforward like in the previous case.

The results in terms of demand not supplied are higher when we use the traditional OPA model. We quantify the difference using the area under the curves in Fig. 7, normalized using the area under the

Table 3

Vulnerability curve areas for the external power network 𝐷𝑁𝑆, normalized with area under the curve corresponding to the traditional OPA model. black curve, corresponding to the traditional OPA case. As it can be clearly seen in Table 3, the areas under the 𝑇 𝑡←𝑝 curve corresponding to our model are smaller than the area under the traditional OPA curve. This trend can be characterized as clear evidence of antifragility in interdependent railway and power networks, where ''fragility is related to how a system suffers from the variability of its environment beyond a certain preset threshold [...], while antifragility refers to when it benefits from this variability'' [65]. In our case, we can extend this definition to a system-of-systems framework, and we can generalize this behavior with the following statement: given a system-of-systems of interdependent infrastructures, sharing a unidirectional interdependency of the type supplier-consumer, stressors, strains or disruptions in the consumer system can decrease the vulnerability of the supplier system, as the margin between supply generation capacity and total consumer demand increases. However, regarding the different 𝑇 𝑡←𝑝 values, the behaviors are different and less intuitive than the previous case (impact on railway network), where higher 𝑇 𝑡←𝑝 corresponds to higher vulnerability.

The three 𝑇 𝑡←𝑝 curves follows different patterns. The blue curve, corresponding to 𝑇 𝑡←𝑝 = 0.0, presents always values lower or equal to the black curve, corresponding to the traditional OPA case. For fraction of removals lower than 0.7, it presents 𝐷𝑁𝑆 values higher than the other 𝑇 𝑡←𝑝 curves.

The green curve, corresponding to 𝑇 𝑡←𝑝 = 0.5, presents the lowest 𝐷𝑁𝑆 values when compared to the other curves. This is also clearly visible in Table 3, where the curve 𝑇 𝑡←𝑝 = 0.5 has the smallest normalized area.

The red curve, corresponding to 𝑇 𝑡←𝑝 = 1.0, presents 𝐷𝑁𝑆 values lower than the traditional OPA and 𝑇 𝑡←𝑝 = 0.0 for fraction of removals lower than 0.7; for higher fractions, it is coincident with the traditional OPA curve.

These patterns are highly dependent on the failure modes of the traction substations: direct and indirect (defined in Section 2.4). Substations which fail directly due to lack of electricity tend to increase the 𝐷𝑁𝑆 to values closer to a traditional OPA model; substations which fail indirectly tend to decrease the 𝐷𝑁𝑆 to values lower than a traditional OPA model. The fractions of functional and directly/indirectly failed substations play a key role in determining the patterns in Fig. 7. The average fractions of functional and directly/indirectly failed substations for different 𝑇 𝑡←𝑝 values and fractions of removals are shown in Fig. 9.

For 𝑇 𝑡←𝑝 = 0.0, the total fraction of failed substations increases slowly and, except for a fraction of removals equal to 1.0, it is always lower than the fraction of functional substations. This explains why for low fractions of removals the 𝐷𝑁𝑆 values are similar to a traditional OPA model. In addition, the fraction of indirectly failed substations increases faster than the fraction of directly failed substations. This explains why for high fractions of removals the traditional OPA tends to lead to larger disruption. For 𝑇 𝑡←𝑝 = 0.5, the patterns are similar to 𝑇 𝑡←𝑝 = 0.0 but with a faster rate. The increase of fractions of failed substations, as well as the decrease of the fraction of functional substations, occurs faster with the increase of the removals if compared to 𝑇 𝑡←𝑝 = 0.0. This explains the pattern in Fig. 7. As the number of indirectly failed substations increases sharply, the requested power demand in the external power network decreases. In addition, the fraction of indirectly failed substations is always higher than the directly failed ones (except for fraction of removals equal to 1), and this contributes to decrease the 𝐷𝑁𝑆, since the power not supplied to indirectly failed substations is not taken into account.

For 𝑇 𝑡←𝑝 = 1.0, the fraction of directly failed substations is always greater or equal to the fraction of indirectly failed substations, and they increase at a faster rate than the previous cases. As a consequence, for fractions of removals greater than 0.5, the 𝐷𝑁𝑆 for 𝑇 𝑡←𝑝 = 1.0 and for the traditional OPA model are coincident.

While in the case of 𝐷𝑁𝑆 the traditional OPA curve is always greater or equal to the 𝑇 𝑡←𝑝 curves, the situation is different for the case of 𝐹 𝐷𝑁𝑆. As it is visible in Fig. 8, the 𝑇 𝑡←𝑝 curves can be higher than the traditional OPA curve. We can appreciate the correlation with the fractions of functional/failed substations in Fig. 9. For 𝑇 𝑡←𝑝 = 0.0 and 𝑇 𝑡←𝑝 = 0.5, we can notice a perfect correlation between the 𝐹 𝐷𝑁𝑆 and the fractions of directly/indirectly failed substations. In fact, the 𝑇 𝑡←𝑝 curves in Fig. 8 are greater than the traditional OPA curve for a fraction of removals equal to 1; similarly, in Fig. 9, the fraction of directly failed substations is higher than the fraction of indirectly failed substations only for a fraction of removals equal to 1.0, for both 𝑇 𝑡←𝑝 = 0.0 and 𝑇 𝑡←𝑝 = 0.5. For 𝑇 𝑡←𝑝 = 1.0, the correlation is not perfect, as the 𝑇 𝑡←𝑝 curve in Fig. 8 is higher than the traditional OPA curve for fraction of removals greater or equal to 0.7, while in Fig. 9 the fraction of directly failed substations is strictly higher (without overlapping of confidence intervals) for fraction of removals greater or equal to 0.5. This discrepancy is due to the fact that the fraction of directly/indirectly failed substations is not the only factor to take into consideration. In fact, also the fraction of functional substations, which specific substations are failed/functional and the load shedding within the base loads in the external power network can affect the final outcome of the analysis.

It is also useful to compare the normalized area under the curves in Fig. 8. The results, normalized with the traditional OPA curve, are shown in Table 4. As it can be clearly seen, the areas for the curves corresponding to 𝑇 𝑡←𝑝 = 0.0 and 𝑇 𝑡←𝑝 = 0.5 are smaller than the area below the traditional OPA model, while the area under the curve for 𝑇 𝑡←𝑝 = 1.0 is slightly greater. This confirms that, depending on the 𝑇 𝑡←𝑝 value, including the impact of the railway network on the external power network might impact positively or negatively the vulnerability in terms of 𝐹 𝐷𝑁𝑆.

We can conclude that failures in the railway network can affect the vulnerability of the external power network. In terms of 𝐷𝑁𝑆, including the impact of failures in the railway network on the external power network within the analysis reduces the vulnerability of the external power network, as the 𝑇 𝑡←𝑝 curves in Fig. 7 are always smaller or equal than the traditional OPA curve. In terms of 𝐹 𝐷𝑁𝑆, including the impact of failures in the railway network on the external power network might increase or reduce the vulnerability of the external A. Bellè et al. power network, depending on the value of 𝑇 𝑡←𝑝 and the fraction of removals.

In conclusion, we show that, in order to estimate precisely the vulnerability of the external power network, it is important to include the impact of failures in the railway network on the external power network, as the outcome of the analysis might differ.

Conclusion

In this work, we have proposed an approach for modeling and vulnerability analysis of interdependent railway-power networks which includes: (i) modeling of the interface between the external power network and the railway network through the traction power network, (ii) modeling of cascading failures dynamics within and between networks, (iii) evaluation of interdependent behaviors within the vulnerability analysis of railway and external power network. Our analysis showed that:

• The effect of cascading failures within the external power network on the railway network should be taken into account while performing a vulnerability analysis. In fact, estimations of the consequences on the railway network based on load shedding analysis which does not account for cascading failures (𝑝 𝑜𝑙 = 0) can lead to underestimated negative outcomes.

• It is important to include the effect of failures within the railway network on the external power network, as it might considerably change the vulnerability values of the external power network. To the best of our knowledge, this was never evaluated in previous works.

In this work, we used an illustrative case-study based on British systems. However, the initial assumptions are flexible, and the approach can be used to analyze a wide range of situations. External power networks can describe transmission or distribution systems at various voltages. Traction power networks can describe substations in electrical isolation (e.g. for AC electrified railway systems) or connected between each other (e.g. for DC electrified railway systems). Railway networks can describe different rail-based transportation means (metro, regional trains or high-speed systems).

We analyzed the vulnerability of our case-study using random removals of edges from the external power network as initiating events. However, other disruption scenarios, such as targeted removals or spatially-localized removals, can be easily analyzed. In addition, the vulnerability of each system can be analyzed with different performance indicators.

From a perspective of protecting the system, an integrated analysis accounting for interdependent behaviors between railway and external power networks is important in order to estimate correctly the vulnerabilities of the systems and plan adequate preventive measures and resource allocation. This is particularly relevant for the railway network, as the inclusion of cascading failures within the analysis can lead to considerably greater negative consequences. Railway operators should consider this while planning preventive measures, such as emergency generators allocation or maintenance scheduling, or resilience-driven design solutions, such as allocation of redundancies with the traction and external power network.

We can then conclude that vulnerability analysis of interdependent railway and power networks should include an evaluation on the possible effects of cascading failures. While the dependency is unidirectional (the railway network depends on the external power network, but not vice versa), the modeling and the analysis should be bidirectional, accounting for the effect of failures within the railway network on the cascading failures dynamics within the external power network.

CRediT authorship contribution statement

Declaration of competing interest

The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper.

Appendix A. DC power flow model

Active and reactive power injections at bus 𝑖 are defined, in the AC power flow model, respectively by Eqs. (A.1) and (A.2):

𝑃 𝑖 = 𝑉 𝑖 𝑁 ∑ 𝑗=1 𝑉 𝑗 (𝐺 𝑖𝑗 cos 𝛿 𝑖𝑗 + 𝐵 𝑖𝑗 sin 𝛿 𝑖𝑗 ) (A.1)
𝑄 𝑖 = 𝑉 𝑖 𝑁 ∑ 𝑗=1 𝑉 𝑗 (𝐺 𝑖𝑗 sin 𝛿 𝑖𝑗 -𝐵 𝑖𝑗 cos 𝛿 𝑖𝑗 ) (A.2)
where 𝑃 𝑖 and 𝑄 𝑖 are the active and reactive power injections at bus 𝑖, 𝑉 𝑖 the voltage magnitude, 𝛿 𝑖𝑗 = 𝛿 𝑖 -𝛿 𝑗 the voltage angle difference between buses 𝑖 and 𝑗, 𝐺 𝑖𝑗 and 𝐵 𝑖𝑗 respectively the real and imaginary part of admittance matrix elements and 𝑁 the number of buses. This formulation is non-linear, and it is usually solved by applying Gauss-Seidel or Newton-Raphson method, resulting in computationally expensive simulations. The DC power flow model represents an approximation of the aforementioned AC power flow model. It consists in a linearization of the power flow equations, and it is based on three main assumptions:

1. The electrical resistance of each line 𝑖 is negligible.

𝑟 𝑖 ≈ 0 (A.3) 2.
The voltage magnitude at each bus 𝑖 are equal to 1.

|𝑉 𝑖 | = 1 (A.4)
3. The voltage angle difference between two buses 𝑖 and 𝑗, connected by the same line, is small. The trigonometric terms can thus be linearized:

sin 𝛿 𝑖𝑗 ≈ 𝛿 𝑖 -𝛿 𝑗 (A.5) cos 𝛿 𝑖𝑗 ≈ 1. (A.6)
Given these assumptions, the active power injection at bus 𝑖 and the power flow in line 𝑘 between bus 𝑖 and 𝑗 are expressed in Eqs. (A.7) and (A.8):

𝑃 𝑖 = 𝑁 ∑ 𝑗=1 𝐵 𝑖𝑗 (𝛿 𝑖 -𝛿 𝑗 ) (A.7) 𝐹 𝑘 = 𝛿 𝑖 -𝛿 𝑗 𝑥 𝑘 (A.8)
where 𝑥 𝑘 is the reactance of line 𝑘. The DC power flow model can be expressed also in matrix form as following:

δ = 𝐁 𝐍 -1 ⋅ 𝐏 𝐍 (A.9) 𝐅 𝐥 = 𝐁 𝐝 ⋅ 𝐀 ⋅ δ (A.10)
where 𝐁 𝐍 is the admittance matrix with resistance equal to 0, δ is the bus voltage angle vector, 𝐵 𝑑 is the diagonal line susceptance matrix and 𝐴 is the line incidence matrix. For more details on derivation and application of the DC power flow model, the reader is referred to specialized literature [66][67][68]68,69].

Paper II

A. Bellè One of the major limitations of the existing modeling approaches is that the fundamental assumptions are often over-simplified, failing to fully capture the reality of the interconnection between railway and power networks. More specifically, available studies often neglect the modeling of the traction power network, which in reality plays a key role in linking the external power grid and the railway system. In fact, this subsystem is accounted for only in Johansson and Hassel (2010); Johansson et al. (2011).

A second drawback of the existing literature is that the evaluation of cascading failures in power networks and their impact on the railway network is often neglected ( With this work, we propose a new approach for interdependent railway and power networks which includes the modeling of traction power networks and cascading failures in power networks. The major contributions are:

• A realistic model of interdependent railway electrical networks, which takes into account the traction power network, is proposed. • The impact of load shedding in the external and traction power network on the performance of interdependent railway and power networks is investigated.

The focus of the study is the vulnerability analysis of the railway network given different initiating disruptive event in the external power network. The remaining part of this work is structured as follows: in section 2, the modeling framework is presented; in section 3, the case-study is described; in section 4, some preliminary results are presented; in section 5, final insights and developments are given.

Modeling and analysis framework

The purpose of this work is to model the impact of disturbances and disruption in external power networks, including cascading failures scenarios, to railway networks. For this, traction power networks are introduced in order to act as a bridge between external power and railway networks. The modeling and analysis framework comprises three main steps:

• Compute the negative consequences in the external power network after an initiating disruptive event and cascading failures (if any). • Use the output from the previous step as an input for the traction power network and compute the negative consequences, including cascading failures (if any). • Use the output from the previous step to compute performance-based vulnerability of traction power network and railway network.

In the next subsections, we address the main modeling features necessary to perform the aforementioned steps, including network-based topological modeling, modeling of electrical quantities of power networks, cascading failures within and between networks and performance-based vulnerability index.

Network-based topological modeling

Network science is often used to describe the topology of critical infrastructures. A network is defined by a graph G = (V, E), with V = {v 1 , v 2 , ..., v N } representing the set of N nodes (or vertices) and E = {e 1 , e 2 , ..., e M } the set of M edges. Each edge k is also defined by a tuple e k = (v i , v j ), which indicates the two nodes v i and v j connected by edge k. In this work, we identify three separate networks: the railway network, defined by the subscript R, the external power network, defined by the subscript E, and the traction power network, defined by the subscript T .

In the railway network G R = (V R , E R ), nodes represent stations and edges represent railway tracks. Each railway edge represents a direct bi-directional physical connection between two stations.

In the external power network G E = (V E , E E ), nodes represent electrical buses and edges represent transmission lines. Each electrical bus can contain power production or consumption units, here referred as generators and loads. These elements are defined by the set of generators N E,G and the set of loads N E,L .

In the traction power network G T = (V T , E T ), nodes represent electrical substations and edges represent distribution lines. Each substation contains a power production unit, which represent the available power extracted from the external power network, and a consumption unit, representing the power demand of the substation. These elements are defined by the set of generators N T,G and the set of loads N T,L . The power production units, rather than representing real power production, they correspond to the available power extracted by each substation from the external power network.

Interdependencies

In most situations, the traction power network is directly connected to the external power network. However, to overcome lack of data and decrease the structural complexity of the model, we decouple and treat the two networks separately. The traction power network thus depends on the external power network in terms of electricity supply. Specifically, we assume that each substation in the traction power network is dependent on the geographically-closest load node in the external power network. We denote this relationship with interdependency edges e i←j T ←E = (v T,i , v E,j ), indicating that node i in the traction power network is dependent on node j in the external power network.

The traction power network is usually directly connected to the railway catenary to supply electricity to the rolling stocks. The railway network thus depends on the traction power network in terms of electricity supply. Specifically, we assume that each railway track i depends on a set of substation V r,i T ⊆ V T , that are responsible of the electricity supply of that specific railway track. In Figure 1, this relationship is graphically represented with edges between the two nodes delimiting railway track i in the railway network and the nodes of the traction power network belonging to V r,i T .

Modeling of electrical flows

External and traction power networks are characterized by electrical quantities and parameters. In this work, we rely on the DC power flow model, and the main quantities to consider are power generation capacity and power demand, for generators and loads, and power flow capacity for lines. We assume that each generator and load i are characterized by a maximum generation capacity and demand P max G,i (positive power) and P max L,i (negative power), and each line i is characterized by a maximum flow capacity F max l,i . The flow in each line i is computed using the DC power flow model assumption, according to Equation (1):

F l,i = B i Δθ i (1)
where B i is the susceptance of line i and Δθ i is the phase angle difference between the two nodes defining line i. For more details, the reader is referred to specialize literature (Van den Bergh et al. (2014); Li (2014)). 2013)). The model aims at simulating the behaviour of the power grid after an initiating disruptive event, considering electrical quantities and operator actions. After the initialization of the power network and the initiating disruptive event, the model comprises the following steps:

(1) Remove failed elements from the network. If a node is failed, remove also the connected components (generators, loads, lines). ( 2) Perform a DC optimal power flow (DC-OPF).

(3) Check if there is any overloaded failed lines:

if yes, go back to step 1; otherwise, stop the simulation and compute load shedding.

Firstly, at step 1 failed lines and nodes, along with the connected components, are removed from the network.

Secondly, a DC-OPF is performed in order to simulate operator actions. The cost to minimize is shown in Equation ( 2), and it is subjected to constraints in Equations ( 3)- (6).

min P G ,P L N G i=1 P G,i -W N L j=1 |P L,j | (2)
N G i=1 P G,i - N L j=1 |P L,j | = 0 (3) 0 ≤ P G,i ≤ P max G,i (4)
P max L,j ≤ P L,j ≤ 0 (5)

-F max l,k ≤ F l,k ≤ F max l,k (6)
The first term of Equation (2) represents the power production cost, which is assigned a unitary value per unit of power P G,i produced in each generator i. The second term represents the negative cost associated to the power P L,i supplied at each load i.

The penalty constant W , here assumed to be equal to 100, ensure the minimization of load shedding when possible. Equations ( 3)-( 6) represent the optimization constraints. The constraint in Equation (3) represents the power balance of generation and demand in the power network, which must be always equal to 0. Equations ( 4) and ( 5) represents possible ranges of power of each generator and load. The constraint in Equation ( 6) represents the maximum power flow in each transmission line. The power flow in each line F l is computed using the DC power flow model. Thirdly, the power network is checked for additional failures due to overloaded lines. A line is considered overloaded if its flow is within 1% of its maximum capacity. When a line is overloaded, it fails (or trips) with a probability p (in this study, we assume p=1). If there is any additional failure, the simulation goes back to step 1 for a new iteration; otherwise the simulation is stopped and the new level of production P G,i for each generator and demand P L,i for each load is given as output.

All the power flow computations are performed using Pandapower (Thurner et

From external to traction power network

The traction power network receives electricity from the external power network. This means that disruption in the external power network can decrease the power available to the traction power network. As explained in section 2.2, each substation i is dependent on the load node j in the external power network as expressed by the interdependency edge e i←j T ←E . In general, the load j represents the power consumption of multiple users (residential, industrial, etc.) in a given area, including the substation i. If due to a disruptive event (with or without cascading failures), the power supplied at load j is not sufficient to satisfy entirely its power demand, substation i can be negatively impacted. To model this, we distinguish two separate scenarios, called the no-priority scenario and the priority scenario.

In the first one, substation i has no priority over the other users supplied by load j, and the maximum power available at substation j, defined as P max T,G,i , is computed according to Equation ( 7):

P max T,G,i = P max T,G,i • P E,L,i P E,L,i (7)
where P max T,G,i is the nominal maximum power available at substation i. It should be noted that the power available at the substation is modeled as a generator capacity, since the two power networks are decoupled. The physical meaning of Equation ( 7) is that the fraction of nominal power available at substation i is equal to the fraction of nominal power demand supplied to load j.

In the second one, we assume the substation i has the priority over the other users supplied by load j. This means that, as long as there is enough power supplied at load j, avoiding load shedding in substation i is prioritized. The power available P max T,G,i is thus computed according to equation ( 8):

P max T,G,i = P max T,G,i , if P E,L,i ≥ A j , P max T,G,i • B j , otherwise, (8)
where A j represents the sum of the nominal power available at each substation dependent on load j and B j is the ratio between the power supplied at load j and A j . These two parameters are expressed in Equations ( 9) and ( 10):

A j = N j T →E k=1, k∈V j T→E P max T,G,k (9)
B j = P E,L,i A j ( 10
)
where V j T→E represents the set of N j T →E substations dependent on load j.

Modeling of vulnerability index

The vulnerability index V can be generalized as the relative change of a system's performance indicator after a disruptive event. In this work, we consider, for external and traction power network, the fractional load shedding as vulnerability index, expressed as in Equation (11):

LS = 1 - N L i=1 P L,i N L i=1 P L,i (11)
where P L,i represents the power supplied to load i after the cascading failures and P L,i represents the actual power demand of load i. The load shedding LS represents the fraction of power demand not satisfied.

For the railway network, we consider a vulnerability index, defined as ΔΦ, which accounts for the impact of load shedding in the traction power network, as expressed in Equation ( 12):

ΔΦ = 1- 1 M R M R i=1 ⎛ ⎝ N R,i T j=1 P T,L,j P T,L,j N R,i T k=1 S R,k N R,i T ⎞ ⎠ (12)
where M R is the number of edges in the railway network, N R,i T is the number of substation in the subset V i R←T (number of substations supplying railway i) and S R,k is the binary state of substation k (1 if functional, 0 if failed), computed according to Equation (13):

S R,k = ⎧ ⎨ ⎩ 1, if P T,L,k P T,L,k > 0, 0, otherwise. ( 13
)
The physical meaning is that the drop of performance in each railway is equal to the average load shedding in the substations which supply the electricity to the railway, when the substations are functional. If at least one of the substations is failed, the drop of performance is total, because the railway is interrupted. In this work, we consider a substation functional as long as it receives some electricity.

Case-study

The external power network is based on the French 400 kV transmission power network [START_REF] Fang | Optimization of cascade-resilient electrical infrastructures and its validation by power flow modeling[END_REF]). It contains 171 electrical buses, connected by 220 transmission lines. Each bus contains either a generator, with positive electrical power (power production), or a load, with negative electrical power (power demand). There are 26 generator nodes, with powers ranging from 1.4 GW to 8.1 GW, and 145 load nodes, with powers ranging from 0.151 GW to 1.331 GW in absolute value. The maximum power production capacity and the total power demand are 85 GW and 84.988 GW, respectively. Each transmission line is assumed to have a maximum flow capacity equal to 7 GW.

The railway network, shown in blue in The railway and the external power network are connected through the traction power network. Due to lack of data, we define a set of assumptions in order to build a realistic traction power network. Firstly, we design the traction power network topology starting from the railway network. Specifically, for each railway i connecting stations j and k, we assume that:

• For each station j in the railway network, a substation j is present in the traction power network at the same geographical location. • Between each substation j and k (corresponding to stations j and k connected by railway i in the railway network), there is a number of additional substations N add sub,i proportional to the length of railway i according to Equation ( 14):

N add sub,i = ⎧ ⎪ ⎨ ⎪ ⎩ lt i dsub , if N add sub,i ≥ 1, 1, otherwise, (14)
where lt i is the length of railway i in km, dsub is the average distance between two consecutive substations, here assumed to be 60 km, and • defines the closest integer number. These substations are located equidistantly along the trajectory of railway i and connected consecutively.

The resulting traction power network, shown in green in Figure 1, is composed by 424 nodes, representing the substations, connected by 452 edges, representing distribution lines. These elements are connected to replicate the shape of the railway network, as clearly visible in Figure 1.

Secondly, we define the electrical parameters of the traction power network. As it was explained in section 2.1, each substation contains a load, which represents the power demand of the substation itself, and a generator, which represents the maximum power available from the external power network. In this work, we assume the power demand of each load P T,L,i in the traction power network to be dependent on a base demand and the degree of the substation, according to Equation (15):

P T,L,i = P max T,L,i = PT,L,i • k(i) (15)
where PT,L,i is the base demand, here assumed to be 5 MW, and k(i) is the degree (number of connected edges) of substation i. Moreover, we assume that each substation has a maximum power extraction capacity from the external power network equal to its own power demand multiplied by a safety coefficient. This feature is modeled as the maximum capacity of the substation generator P max T,G,i , according to Equation ( 16):

P max T,G,i = P T,L,i • (1 + α G ) (16)
where α G is the safety coefficient, here assumed to be 0.5. With these assumptions, we obtain a total power demand of 4520 MW, with load powers ranging from 5 to 30 MW, and maximum extraction capacity (or generation capacity) of 6780 MW, with generator powers ranging from 7.5 to 45 MW. The power flow capacity of each distribution line F max T,L,i is assumed to be equal to the base power demand PT,L,i .

We study the impact of single bus failures in the external power network on the traction power network and railway network, in terms of load shedding LS T and loss of performance ΔΦ. The main steps of the simulation-based approach are shown in Figure 2.

Results

The results in terms of load shedding LS T in the traction power network and loss of performance ΔΦ in the railway network, in both priority and no-priority scenario, are shown in Figure 3 and4, respectively. In both the figures, the x-axis represents the index of bus removed in the external power network as initiating event (from bus 1 to bus 171). Blue squares represent the no-priority scenario, while red stars represent the priority scenario. Green circles represent the total load shedding LS E in the external power network.

The first consideration to highlight is that, as it is clearly visible in both the figures, the priority scenario leads to a considerably lower negative impact in terms of load shedding in the traction power network and loss of performance in the railway network. This situation is summarized in Table 1. The average load shedding LS T in the Fig. 3. Load shedding in external power network (green circles), in traction power network with nopriority (blue squares), in traction power network with priority (red stars) for single bus failures in the external power network as initiating event.

Fig. 4. Load shedding in external power network (green circles), loss of performance in railway network with no-priority (blue squares), loss of performance in railway network with priority (red stars) for single bus failures in the external power network as initiating event.

Table 1. Average load shedding and loss of performance in traction power network and railway network with 95% confidence interval.

LS T LS T ΔΦ ΔΦ

No-priority Priority No-priority Priority 2.5% 0.7% 2.8% 0.9% ± 0.3% ± 0.2% ± 0.4% ± 0.3% traction power network with the no-priority scenario is 2.5% with 95% confidence interval equal to 2.2%-2.8%, while in the priority scenario LS T is equal to 0.7%, with 95% confidence interval equal to 0.5%-0.9%. The same consideration can be drawn for the average loss of performance in the railway network ΔΦ, which presents an average value of 2.8% with 95% confidence interval equal to 2.4%-3.2% in the no-priority scenario, and an average value of 0.9% with 95% confidence interval equal to 0.6%-1.2% in the priority scenario. This behaviour can be highlighted also by comparing results from individual initiating events. The five most critical bus failures in the external power network in terms of load shedding in the traction power network and loss of performance in the railway network are shown in Table 2 and 3, respectively. With the exception of the most critical bus failure (bus 77 for LS T and ΔΦ, for both no-priority and priority scenario), we can observe that the results for the no-priority scenario are considerably higher. For example, for LS T , the second most critical failure in the no-priority scenario (bus 134) leads to a load shedding of 11%, while the second most critical failure in the priority scenario (bus 62) leads to a load shedding of just 6.1%. The same considerations can be drawn for the loss of performance in the railway network. These results highlight the importance to prioritize the power supply to critical infrastructures, such as railway traction network, in case of emergency situations. Another important aspect to highlight is the strong correlation between the three networks (external power, traction power and and railway), since the load shedding in the external power network is the primary cause of load shedding in the traction power network which can lead to loss of performance in the railway network. Despite this, it is clear that the location of the initiating event and the spatial dynamics of cascading failures play an important role. This aspect is noticeable in the case where load shedding in the external power network and in the traction power network are considerably different. For example, it is interesting to notice how the failure of bus 82 as initiating event constitutes the worst-case scenario for the external power network, leading to a load shedding LS E of 21% (see Table 4), while in the traction power network it leads to a load shedding of just 3.8% in the no-priority scenario and 1.4% in the priority scenario. This behaviour indicates that the topological features are a key aspect in terms of negative consequences of cascading failures within and between networks.

A similar consideration can be deduced from the difference in results of LS T and ΔΦ. Despite the fact that the computations of the two values are strongly correlated, as it is clear from Equations ( 11) and ( 12), the losses of performance in the railway network are tendentially higher than the corresponding load sheddings in the traction power network. This is clearly due to the assumption on the substation states expressed in Equation ( 13). However, we can notice that in some cases the difference is negligible or not present, while in other cases can be considerable, up to a few percentage points. This is again an indication of the importance of the topology, because location of failures and/or load shedding can have a strong impact on the possible negative consequences in the dependent networks.

Conclusion

In this work we have proposed a modeling framework for interdependent railway and power networks which accounts for an integrated evaluation of realistic interconnections, introducing traction power networks to act as a bridge, and cascading failures scenarios. The model has been used to study the impact of two different assumptions on the electricity supply priority from the external power network to the traction power network. Preliminary results have shown, as expected, that the priority scenario leads to considerably lower disruption.

Analysis on individual initiating events have shown that vulnerability index in single systems are not always correlated in terms of magnitude. For example, the worst-case scenario for the external power network leads to limited negative consequences in the dependent networks (traction power network and railway network). This behaviour indicates that the topology of the interconnections between interdependent networks plays a crucial role when performing an integrated vulnerability analysis.

Further developments of this work include a more comprehensive sensitivity analysis on the starting assumptions and the comparison, in terms of vulnerability, of different traction power network's configurations. Base requested power demand of node i in the power or gas network

d m 3 j
Requested gas demand of node j in the gas network

d M W j
Requested power demand of node j in the gas network Binary variable that indicates if a physical link from node j ∈ V GN to node i ∈ V P N exists 1. Introduction

d

Motivation

Critical infrastructures (CIs), such as power networks or transportation systems, are complex systems which supply goods, services, and commodities to people [1], [2]. Failures and disruption within CIs can lead to severe socioeconomic stress in a society [3], and ensuring their resilience against a large variety of disruptive events is an important issue [4], [5]. Moreover, CIs are increasingly interdependent on each other. This increasing degree of interdependency brings advantages in terms of functionality and efficiency, but often leads to new vulnerabilities and risks of cascading effect between interdependent infrastructures [6].

Coupling interfaces play a key role in characterizing the resilience of interdependent CIs [7], [8]. The coupling interface characterizes how the interdependent CIs are coupled together; in other words, it characterizes how the interdependent CIs are connected and what are the components in each CI that are dependent on the other CI. When CIs are modeled as networks [9], the coupling interface simply denotes the allocation of interdependency links, as shown in Figure 1. In most of the existing literature on interdependent CIs, coupling interfaces are treated as a known parameter, and no optimization nor analysis is performed. Limited works try to optimize the design of the coupling interface (e.g. [7] or [8]); however, they rely on heuristic methods based on network science metrics, which do not guarantee optimal solutions nor high quality designs of coupling interface.

In this work, we propose a resilience-based mathematical framework, based on the defenderattacker-defender (DAD) model [10]- [13], for the optimal design of coupling interfaces in interdependent CIs. The DAD approach allows to identify solutions, in this case a coupling interface design, which are robust against the worst realization of uncertain scenarios, in this case failure scenarios.

In general, the motivations of this work are the following:

• research: the design of coupling interfaces between interdependent CIs has not been addressed comprehensively in the existing literature, and to the best of our knowledge, no mathemat-ical programming approach has been proposed. As the coupling interface is a key factor of interdependent CIs and their resilience, optimizing its design is an important issue;

• application: due to the importance of coupling interface design, decision-makers and planners should be provided with the means and tools to evaluate and optimize the allocation of interdependency links between interdependent CIs.

As illustrative case-study, we rely on interdependent power and gas networks (IPGNs), similarly to [14], where gas networks need electricity for the functionality of their equipment (valves, pumps, compressors, etc.), and power networks need a gas supply to produce electricity in gas-fired power plants.

Related work

In the next sections we review the main works related to resilience enhancement in CIs, and design and optimization of coupling interfaces between interdependent CIs.

Resilience enhancement in critical infrastructures

The purpose of this section is to explain the main concepts in the context of resilience enhancement and give a general overview in order to better contextualize and position this work.

As critical infrastructures represent the backbone of essential societal functions, ensuring their resilience is a fundamental task [2]. The resilience of a system is defined as "its ability to withstand stressors, adapt, and rapidly recover from disruptions" [15]. Resilience refers to the behaviour of a system in disruptive conditions, it is generally represented with a resilience curve, as in Figure 2, and it is defined as the combination of three phases [2], [16]:

• the disturbance phase, which describes the speed and the severity of the disruption; this phase is strictly connected to the concepts of survivability and vulnerability 1 ;

• the degraded phase, which describes the temporal extension of the disruption after the disturbance phase, and it is linked to the emergency preparedness;

• the restoration phase, which describes the operations of restoration and repair.

The resilience of a system can be measured using different approaches, and various metrics are available in the existing literature [20]. A renowned approach is called ΦΛEΠ (pronounced "FLEP") [16], and it consists of the computation of four different metrics:

1 Survivability is defined in [17] as "the capability of a system to fulfill its mission in a timely manner in the presence of attacks, failures, or accidents", and it can be interpreted as the residual performance after the disturbance phase. Vulnerability is defined in [18] as "degree of loss or damage to a system when exposed to a strain of a given type and magnitude", and it can be interpreted as the drop of performance due to the disturbance phase. • Φ: it defines the rate of performance drop during the disturbance phase. Using Figure 2 as a reference, where p(t) defines a performance indicator at time t, it can be computed as the difference in performance before and after the disruptive event divided by the duration of the event, as in Equation ( 1):

Φ = p(t e ) -p(t d ) t d -t e ; (1)
• Λ: it defines the magnitude of the drop in performance. This metric corresponds to the concept of vulnerability, and it strictly correlated with the survivability. It can be computed as the difference in performance before and after the disruptive event, as in Equation in (2)

Λ = p(t e ) -p(t d ); (2)
• E: it defines the temporal extension of the degraded phase, and it can be computed as in ( 3):

E = t r -t d ; (3)
• Π: it defines the rate of recovery, and it can be computed as the difference in performance at the beginning and at the end of the recovery phase, divided by the duration of the recovery, as in Equation in (4):

Φ = p(t f ) -p(t r ) t f -t r . ( 4
)
Enhancing the resilience of systems and infrastructures by optimizing design, preventive measures and resource allocation (e.g. transmission and/or generation expansion, protection of components, allocation of recovery resources, reliable network design, etc.), is one of the most important tasks and a major topic in the field of critical infrastructures. Within this context, several works are available, and they can be distinguished according to different characteristics: i) which resilience phase is optimized; ii) which type of infrastructures is optimized; iii) which type of optimization model is used.

The optimization of critical infrastructures resilience can focus on one or multiple phases: for example, in [11] and [21], the resilience of power networks is enhanced by focusing separately on the optimization of protection against the disturbance phase and recovery phase, respectively; on the contrary, in [13] and [22], the resilience of interdependent CIs is enhanced by simultaneously optimizing both the disturbance phase and recovery phase.

An important feature that distinguishes the different works is which type of infrastructure is optimized, in terms of resilience. Several authors focus on resilience of single infrastructures, such as power networks [23] or water networks [24]. However, many other authors focus on the integrated optimization of resilience of multiple interdependent CIs, such as power and gas networks [25] or power and water networks [26], accounting for their mutual interdependencies when optimizing their resilience by preventive measures and resource allocation. The type of infrastructure under consideration is a key factor, as each infrastructure is characterized by specific operational models and interdependencies on other systems.

Another important difference within the existing works is the type of optimization model used for the resilience enhancement, which strongly impacts the quality and the nature of the solution.

Many authors apply multi-level approaches, such as the DAD model [27], to enhance CIs resilience.

These approaches offer robust solutions, and usually affordable computational cost. Some authors also include uncertainty using a stochastic optimization approach [28], in order to enhance the resilience expectation against a known probability distribution of uncertain parameters. Moreover, heuristics approach are also used [29], in order to derive high-quality solutions with operational models which can not be solved by traditional mathematical programming approaches.

It should be highlighted than in the aforementioned works the resilience of CIs is enhanced by optimizing different preventive measures and resource allocations, such as construction of new components (generation/expansion planning), protection of components or repair scheduling. However, the coupling interface, despite being a key parameter, is not optimized. As it is explained in the next section, only a limited number of works accounts for different coupling interface designs between interdependent CIs.

Design and optimization of coupling interface

When the state/functionality of one infrastructure depends on the state/functionality of another one, a relationship of interdependency exists. Interdependencies are unidirectional when one infras-tructure depends on another one, but not vice versa; otherwise, they are bidirectional [30], [31]. As interdependencies have been a subject of research since the early 2000s [2], different classifications exist in the literature [30]- [33]. One of the most used classifications is the one proposed in [30],

where four categories are identified:

• physical, when one CI depends on another one through a physical flow (energy, goods, etc.);

• cyber, when one CI depends on another one through a flow of data and information;

• geographic, when elements of different infrastructures share the same location and they can be modified by a change in the environment conditions;

• logical, when a relationship which is not physical, cyber, or geographic exist.

CIs are often modeled with a network science approach [9], and the interdependencies are represented as links between components (nodes and/or edges) belonging to different infrastructures [34]. We refer to the ensemble of interdependency links as coupling interface. Its topology, i.e.

where the interdependency links are present, plays a key role in terms of failure propagation between different infrastructures. Interdependency topology and design have been addressed in the field of interdependent networks, where various works focus on evaluating coupling interfaces and their impact on failure propagation [35], [36], and how coupling interfaces, if properly allocated, can increase the robustness of interdependent networks [37]- [39]. These works, despite representing a solid theoretical framework, mainly rely on percolation theory, and they fail to capture the details and the complex dynamics of real-world infrastructures.

Despite the critical role of coupling interfaces, in the existing literature they are often considered as a given parameter, and they are not analyzed nor optimized.

In some works, different network metric-based coupling strategies are tested on different interdependent CIs, such as power and water networks [40] or power and telecommunication networks [41]- [43]. In these works, the impact of different topologies is evaluated, and they demonstrate the importance of considering the coupling interface design problem within realistic CIs. However, these network-based heuristic approaches do not guarantee optimal solutions. Similar network metrics-based approaches are also proposed in [7] and [8]. In [7], the authors propose an approach for designing coupling interfaces between urban CIs in order to increase their robustness against external attacks. The proposed strategy for designing the coupling interface is based on multiple network metrics (node degree, betweenness, clustering coefficient and Euclidean distance). In [8], the authors propose a similar approach, also accounting for physical features of the CIs, such as levels of supply and demand. However, these works still rely on network metrics as an heuristics. Consequently, they do not guarantee optimal solutions and the quality of the identified coupling interface designs depends on the case-study considered. Moreover, these approaches are tailor-made and are not readily generalizable to other case-studies, as one specific heuristic strategy might perform well in some networks and poorly for other systems.

Contribution

In this work, a novel optimization-based approach for designing coupling interfaces between interdependent CIs is proposed. Our model ensures that coupling interface topologies are optimized in order to maximize the worst-case realization of combined performed of the interdependent infrastructures under random failures. The proposed approach is based on the DAD model, a threestage sequential game which allows to identify robust defense strategies and/or resource allocation against a defined set of feasible attack scenarios. To demonstrate the validity of our approach, interdependent power and gas networks (IPGNs) are used as illustrative case-study.

The contributions of this papers can be summarized as follows:

• We developed a novel resilience-based optimization approach, which can be directly applied to design or retrofit new or existent coupling interfaces between interdependent CIs.

• We developed an approach for the optimization of coupling interface design that is generalizable for any case-study by selecting the appropriate operational model for the interdependent CIs.

• We demonstrated that our approach outperforms network metrics-based coupling interface strategies available in the existing literature.

The rest of this paper is organized as follows: in Section 2, the problem formulation is detailed;

in Section 3, the solution strategy is explained; in Section 4, the illustrative case-study is detailed;

in Section 5, results and discussion are presented; in Section 6, conclusive remarks and possible future developments are detailed.

Optimization problem formulation

Modeling framework

In this work, each infrastructure is modeled using a network flow-based approach [9], [44], where a network is a mathematical construct described by a graph G = (V, E). The set V contains N nodes, connected by L edges, contained within the set E. Each edge k is directed and has an origin node O(k) and a destination node D(k). In line with a flow-based approach, we assume that commodities goods, and services are produced and consumed within nodes and distributed through edges. Each node i has a production capacity p i and a requested demand d i , while each edge k has a flow capacity f k .

In this work, we focus on the combined performance P C of the interdependent CIs [14], defined as in (5):

P C = h∈H w h d h i∈V h d i (5)
where the subscripts H denotes the set of interdependent CIs, w h represents the weight of infrastructure h when computing the combined performance, d h is the total requested demand of goods, services, or commodities in infrastructure h, and d i is the supplied demand of goods, services, or commodities in each node i of infrastructure h.

Considering the resilience framework described in Section 1.2.1, the combined performance in conditions of disruption represents the concept of survivability of the interdependent CIs, complementary to the concept of vulnerability and to the Λ metric of the ΦΛEΠ approach. In this work, we do not consider the restoration phase, as it is characterized by deep uncertainties and it should be optimized case-by-case according to the specific disruption and failure scenarios [21].

As illustrative case-study, we consider interdependent power and gas networks (IPGNs), which are mutually interdependent on each other with physical interdependencies. In fact, equipment in the gas network, such as valves, compressors, or pumps, needs a constant power supply; power networks, if gas-fired power plants are present, need a constant supply of gas. The combined performance of the IPGNs can be defined as in Equation ( 6):

P C,IP GN s = w P N d P N i∈VP N d i + w GN d GN i∈VGN d i ( 6
)
where the subscripts P N and GN denote the power network and gas network, respectively, w P N and w GN represent the weight of power network and gas network when computing the combined performance2 , d P N and d GN are the total requested demand of power and gas, and d i is the supplied power or gas in each node of the networks. The combined performance P C ranges from 0, when no power and gas demand is supplied, to 1, when 100% of the requested demand of power and gas is supplied.

In the power network, nodes represent buses, while edges represent power lines; in the gas network, nodes represent hubs, while edges represent gas pipelines. The power network operations are simulated with a DC power flow model, while the gas network operations are simulated with a linear maximal flow model, which is a suitable approximation of flow-based infrastructures [14],

[45]- [47].

Several works analyze critical infrastructures in the context of specific types of hazards, like intentional attacks [46], spatially-localized attacks [48] and extreme natural events [14], [49]. In this work, we adopt an approach based on the maximum number of contingencies [27], [50]. For simplicity, but without loss of generality, we assume that only transmission lines (edges) in the power network can be attacked and failed. By considering the simultaneous failures of transmission lines, the present model is agnostic about the source of disruption, providing a rapid and objective way of calculating the consequence of damage to any set of components.

In this work, the following assumptions are considered:

• a single demand scenario is considered, i.e. the expected forecast of requested power and gas demand [27];

• each node in the gas network needs to receive a power supply from the power network in order to run equipment;

• each node in the power network with some production capacity is assumed to contain a gas-fired power plant and needs to receive a gas supply from the gas network;

• each node in the power network can be dependent on one, and only one node in the gas network, and vice versa;

• allocating the coupling interface has a cost that depends on the geographical distance between the two nodes connected by the interdependency link;

• the operators are perfectly aware of the status of the components within the power network and gas network [27].

The purpose of the proposed model is to design a coupling interface between IPGNs that ensures satisfactory combined performance in normal conditions (no failures) and conditions of disruption.

Defender-attacker-defender approach

The problem takes the form of a trilevel DAD optimization model, a formulation often used in the framework of optimization of defense strategies and resources in CIs (e.g. [10], [14], [27]). It is useful to imagine the problem as a three-players game: the inner defender aims at maximizing the combined performance of the IPGNs through the operational variables of the two systems; the middle attacker aims at minimizing the combined performance choosing the most disruptive attack plan; the outer defender aims at maximizing the combined performance of the IPGNs by designing a robust coupling interface that also ensures satisfactory performance in normal conditions (no failures). The full formulation is shown in ( 7)-( 43):

max p ′ ,d ′ ,f ′ ,θ ′ ,δ ′ y g←p ∈{0,1} N C y p←g ∈{0,1} N C min u∈{0,1} L P N max p,d,f ,θ,δ w P N d P N i∈VP N d i + w GN d GN i∈VGN d i -γ     i∈VGN j∈VP N y g←p ij d km ij c g←p km + i∈VP N j∈VGN y p←g ij d km ji c p←g km     (7)
subject to:

First level j∈VP N y g←p ij ≤ 1, ∀i ∈ V GN (8) j∈VGN y p←g ij ≤ 1, ∀i ∈ V P N (9) i∈VGN j∈VP N y g←p ij d km ij c g←p km + i∈VP N j∈VGN y p←g ij d km ji c p←g km ≤ B ci (10)
w P N d P N i∈VP N d i + w GN d GN i∈VGN d i ≥ 1 (11) 0 ≤ p ′ i ≤ p i , ∀i ∈ V T OT (12) 0 ≤ d ′ i ≤ d b i + j∈VGN y g←p ji d M W j , ∀i ∈ V P N (13) 0 ≤ d ′ i ≤ d b i + j∈VP N y p←g ji d m 3 j , ∀i ∈ V GN ( 14
) -f k ≤ f ′ k ≤ f k , ∀k ∈ E T OT ( 15
)
x k f ′ k -(θ ′ O(k) -θ ′ D(k) ) = 0, ∀k ∈ E P N ( 16
)
p ′ i -d ′ i + k|D(k)=i f ′ k - k|O(k)=i f ′ k = 0, ∀i ∈ V T OT ( 17
)
d i -δ p ′ i d b i + j∈VGN y g←p ji d M W j ≥ 0, ∀i ∈ V P N ( 18
)
d ′ i -δ g ′ i d b i + j∈VP N y p←g ji d m 3 j ≥ 0, ∀i ∈ V GN ( 19
)
p ′ i -p i j∈VGN y p←g ij δ g ′ j ≤ 0, ∀i ∈ V P N ( 20
)
p ′ i -p i j∈VP N y g←p ij δ p ′ j ≤ 0, ∀i ∈ V GN ( 21
)
d ′ i -   d b i + j∈VP N y p←g ji d m 3 j   j∈VP N y g←p ij δ p j ≤ 0, ∀i ∈ V GN (22)
-

k|O(k=i) j∈VP N y g←p ij δ p ′ i f k ≤ f ′ k ≤ k|O(k=i) j∈VP N y g←p ij δ p ′ i f k , ∀k ∈ E GN (23)
-

k|D(k=i) j∈VP N y g←p ij δ p ′ i f k ≤ f ′ k ≤ k|D(k=i) j∈VP N y g←p ij δ p ′ i f k , ∀k ∈ E GN (24)
y g←p ji ∈ {0, 1}, y p←g ij ∈ {0, 1}, ∀i ∈ V P N , ∀j ∈ V GN ( 25
)
δ p ′ i ∈ {0, 1}, δ g ′ j ∈ {0, 1}, ∀i ∈ V P N , ∀j ∈ V GN (26)
Second level

k∈EP N (1 -u k ) ≤ K att ( 27
)
u k ∈ {0, 1}, ∀k ∈ E P N (28) Third level 0 ≤ p i ≤ p i , ∀i ∈ V T OT (29) 0 ≤ d i ≤ d b i + j∈VGN y g←p ji d M W j , ∀i ∈ V P N (30) 0 ≤ d i ≤ d b i + j∈VP N y p←g ji d m 3 j , ∀i ∈ V GN (31) -u k f k ≤ f k ≤ u k f k , ∀k ∈ E P N (32) -f k ≤ f k ≤ f k , ∀k ∈ E GN ( 33
)
x k f k -θ O(k) -θ D(k) u k = 0, ∀k ∈ E P N ( 34
)
p i -d i + k|D(k)=i f k - k|O(k)=i f k = 0, ∀i ∈ V T OT ( 35
)
d i -δ p i d b i + j∈VGN y g←p ji d M W j ≥ 0, ∀i ∈ V P N ( 36
)
d i -δ g i d b i + j∈VP N y p←g ji d m 3 j ≥ 0, ∀i ∈ V GN (37)
p i -p i j∈VGN y p←g ij δ g j ≤ 0, ∀i ∈ V P N ( 38
)
p i -p i j∈VP N y g←p ij δ p j ≤ 0, ∀i ∈ V GN ( 39
)
d i -   d b i + j∈VP N y p←g ji d m 3 j   j∈VP N y g←p ij δ p j ≤ 0, ∀i ∈ V GN (40)
-

k|O(k=i) j∈VP N y g←p ij δ p i f k ≤ f k ≤ k|O(k=i) j∈VP N y g←p ij δ p i f k , ∀k ∈ E GN (41)
-

k|D(k=i) j∈VP N y g←p ij δ p i f k ≤ f k ≤ k|D(k=i) j∈VP N y g←p ij δ p i f k , ∀k ∈ E GN ( 42
)
δ p i ∈ {0, 1}, δ g j ∈ {0, 1}, ∀i ∈ V P N , ∀j ∈ V GN . (43)
Equation ( 7) is the objective function of the trilevel optimization problem, and it contains three terms. The first two terms correspond to the combined performance P C , previously shown in Equation (6). By including P C in the objective function, we can identify a coupling interface that maximizes the combined performance of the IPGNs in the worst failure scenario; in other words, we can identify the coupling interface that maximizes the survivability of the IPGNs (or minimizes the Λ resilience metric) of the IPGNs in the worst failure scenario. The power and gas supplied to each node i are defined by the variables d i , while the total requested demand of power and gas, denoted as d P N and d GN , are constant parameters computed as in ( 44) and ( 45), respectively.

d P N = i∈VP N d b i + j∈VGN d M W j ( 44
)
d GN = i∈VGN d b i + j∈VP N d m 3 j ( 45
)
In these equations, the constant d b i denotes the baseline requested demand of power or gas in each node, and it represents the consumption of various private and public consumers. The constant d M W j denotes the requested power demand of node j ∈ V GN , while the constant d m 3 j denotes the requested gas demand of node j ∈ V P N .

The third term of the objective function ensures that, if more than one optimal coupling interface exists, the one with the lowest allocation cost is chosen. The terms within the parentheses define the cost of allocating a specific coupling interface. The binary variable y g←p ij =1 if an interdependency link from node j ∈ V P N to node i ∈ V GN is allocated, and y g←p ij =0 otherwise. Similarly, the binary variable y p←g ij =1 if an interdependency link from node j ∈ V GN to node i ∈ V P N is allocated, and y p←g ij =0 otherwise. The constant d km ij denotes the distance in kilometer between node i ∈ V GN and node j ∈ V P N , while the constants c g←p km and c p←g km denote the cost per kilometer of allocating an interdependency link from the power network to the gas network, and from the gas network to the power network, respectively. The terms within the parentheses are multiplied by a factor γ, which represents a very small number. This factor ensures that the priority within the optimization is given to the combined performance P C . Equations ( 8)-( 26) denote the constraints of the first optimization level, corresponding to the outer defender. This agent allocates the coupling interface in a way such that: i) the available monetary budget B ci is respected, as shown in Constraint (10), and ii) in normal conditions (no failures), it is possible to supply the whole requested demand of power and gas (P C =1). Consistently with the existing literature, we assume that each node in the gas network can be dependent on, and connected through an interdependency link to, only one node in the power network, and vice versa. We refer to this as the single-dependency assumption, and it is enforced by Constraints (8) and (9). The coupling interface, as previously explained, is allocated through the binary variables y g←p ij and y p←g ij , contained within the vectors y g←p and y p←g with dimension N C = N P N × N GN .

The coupling interface must be allocated in order to guarantee that, in normal conditions, the requested demand of power and gas is fully satisfied, as enforced by Constraint (11). This condition depends on the first-level operational variables, contained within the vectors p ′ , d ′ , f ′ , θ ′ , δ ′ , which represent production levels, supply demands, flows, phase angles, and interdependency links status, respectively 3 . Equations ( 12)-( 26) contain the operational constraints of the first level. For both networks, the production level of power or gas p ′ i in each node i is limited by the production capacity p i , as enforced in Constraint (12). Similarly, as shown in Constraints ( 13) and ( 14), the supplied demand of power or gas d ′ i in each node i is limited by the requested demand. As it is shown on the right side of ( 13), the requested power demand of node i ∈ V P N is given by the sum of the baseline requested power demand d b i and all the requested power demands d M W j of the nodes j ∈ V GN which depend on the node i ∈ V P N for the electricity supply (y g←p ji =1). Similarly, as it is shown on the right side of ( 14), the requested gas demand of node i ∈ V GN is given by the sum of the baseline requested gas demand d b i and all the requested gas demands d m 3 j of the nodes j ∈ V P N which depend on the node i ∈ V GN for the gas supply (y p←g ji =1).

The flow of power and gas f ′ k in each edge k is limited, in absolute value, by the flow capacity f k , as shown in Constraint (15). Moreover, in each line of the power network, the power flow is subject to the DC power flow assumption, enforced by Constraint (16), where x k represents the reactance of line k, and θ ′ O(k) and θ ′ D(k) are the phase angles in the origin and destination node of line k, respectively.

The net nodal balance of power and gas in each node is ensured by Constraint (17).

The operations of the IPGNs depends on the status of the interdependency links. Similarly to other existing works (e.g. [14]), we assume a binary functional status for the interdependency links (1 if functional, 0 if not functional). We assume that the binary functional status of each interdependency link starting from node i ∈ V P N is expressed by the binary variable δ p ′ i ; similarly, the binary functional status of each interdependency link starting from node i ∈ V GN is expressed by the binary variable δ g ′ i . Each interdependency link starting from node i ∈ V P N is functional (δ p ′ i =1) only if the requested power demand in i is fully satisfied, as enforced in Constraint (18). The rationale behind this assumption is that, if some electricity is not supplied to i, the dependent nodes within the gas network might not receive the necessary electricity. As shown in Constraint (19), the same assumption is taken for the interdependency link starting from the gas network, with a similar rationale: each interdependency link starting from node i ∈ V GN is functional (δ g ′ i =1) only if the requested gas demand in i is fully satisfied. These assumption are consistent with the existing literature (e.g. [14]). However, different assumptions which are not included in this work, such as multi-discrete or continuous status for the interdependency links, can be implemented by appropriate changes of the variables δ ′ .

We assume that the electricity in the power network is produced by gas-fired power plants, and in each node i ∈ V P N it is possible to produce power only if a functional interdependency link with

a node j ∈ V GN is present (y p←g ij =1 and δ g ′ j =1
). This condition is enforced by Constraint (20). We assume that gas in the gas network can be extracted (produced) and supplied only if there is enough electricity. Therefore, in each node i ∈ V GN it is possible to produce and supply gas only if a functional interdependency link with a node j ∈ V P N is present (y g←p ij =1 and δ p ′ j =1). These conditions are enforced by Constraints ( 21) and (22). Moreover, we assume that gas can flow in a pipe k only if both the origin and destination nodes present a functional interdependency link with a node j ∈ V P N , as enforced by Constraints ( 23) and (24). Equations ( 27) and ( 28) denote the constraints of the second level of the optimization problem, corresponding to the attacker. This agent decides which lines of the power network to target and fail through the binary variables u k , contained within the vector u. Each variable u k takes the value 0 if line k is targeted and failed, and value 1 otherwise. The attacker can target and fail a maximum number K att of lines in the power network, as shown in Constraint (27).

Equations ( 29)-( 43) contain the operational constraints of the third level, corresponding to the inner defender. This agent aims at maximizing the combined performance of the IPGNs through the operational variables of the third level, contained within the vectors p, d, f , θ, δ.

Constraints ( 29)-( 43) are equivalent to the previously-explained Constraints ( 8)- (26). However, in the third level, we also account for the failures of power lines through the inclusion of binary variables u k in Constraints (32) and (34). Constraint (32) ensures that the power flow in a failed power line is 0. Constraints (34) ensures that the DC power flow assumption is maintained in functional power lines and disregarded in failed power lines. Constraint (34) contains quadratic terms due to the multiplication of the binary variable u k with the continuous variables f k and θ i .

These quadratic terms can be linearized with a "Big-M" approach, as shown in Appendix A. The other constraints in ( 29)-( 43) are equivalent to the ones in ( 8)- (26).

For simplicity, we can express the optimization problem in ( 7)-( 43) with the compact matrix formulation in ( 46)- (51).

max h ′ ,δ ′ y g←p ∈{0,1} N C y p←g ∈{0,1} N C min u∈{0,1} L P N max h,δ b T h + c T y ( 46
)
subject to:

Py ≤ g (47) b T h ′ ≥ 1 (48) R ′ h ′ ≤ q ′ -H ′ y -W ′ δ ′ -y T D ′ δ ′ ( 49
)
Ku ≤ a (50)

Rh ≤ q -Tu -Hy -Wδ -y T Dδ. ( 51
)
The vectors h ′ and h contain the continuous variables of the first and third level, respectively.

The other variable vectors, y, δ ′ , and δ, contain binary variables (vector y contains vectors y g←p and y p←g ). The vectors b and c contains the objective function coefficients, while the vectors g, a and q contain constraint parameters. The matrices P, R ′ , H ′ , W ′ , D ′ , K, R, H, W, and D contain constraint coefficients with suitable dimensions.

Equation ( 46) corresponds to Equation ( 7); Equation ( 47) corresponds to Equations ( 8)-( 10);

Equation (48) corresponds to Equation (11); Equation (49) corresponds to Equations ( 12)-( 26); Equation (50) corresponds to Equations ( 27)- (28); Equation (51) corresponds to Equations ( 29)- (43).

The optimal objective value of the trilevel optimization is the maximized combined performance of the IPGNs in the worst scenario within the set of feasible failure scenarios. An important output of the optimization problem is the optimal coupling interface design y.

Solution strategy

Linearization

As the problem in ( 46)-( 51) (or equivalently ( 7)-( 43)) contains several nonlinear terms, the first step of our solution strategy involves a reformulation into an equivalent linear form. In particular, the nonlinear terms arise from the multiplications of binary variables y ′ and δ ′ in (49), and y and δ in (51). Products of binary variables can be easily linearized by introducing new binary variables and additional constraints. Generally, the product of two binary variables a and b is also a binary variable, here called c, subject to Constraints ( 52)-( 54):

c ≤ a (52) c ≤ b (53) c ≥ a + b -1. ( 54
)
The multiplications of y ′ and δ ′ in (49), and y and δ in (51), can then be linearized by introducing binary variables z and r and additional constraints of the type in ( 52)- (54). The variables z are introduced to linearize the multiplication between two binary variables, while the variables r are introduced to linearize the multiplication between three binary variables. Constraint (49) can then be replaced by Constraints ( 55) and ( 56), while Constraint (51) can then be replaced by Constraints ( 57) and ( 58):

R ′ h ′ ≤ q ′ -H ′ y -W ′ δ ′ -S ′ z ′ -V ′ r ′ (55)
Q ′ z ′ + F ′ r ′ ≤ t ′ -L ′ y -J ′ δ ′ (56)
Rh ≤ q -Tu -Hy -Wδ -Sz -Vr (57)

Qz + Fr ≤ t -Ly -Jδ (58)
where Equations ( 56) and ( 58) corresponds to the additional constraints of the type in ( 52)-( 54).

The linear compact matrix formulation corresponds to Equation (46) subject to ( 47)-( 48), (

-(58).

Nested Column&Constraint Generation algorithm

The presence of the binary variables δ in the third stage makes it impossible to merge the second and third stage into a single minimization problem relying on the dual formulation. Therefore, we adopt a cutting plane strategy, called Nested Column&Constraint Generation (NC&CG) algorithm.

It represents an exact method, with proven convergence to the global optimum, for solving multilevel mixed-integer linear programming with recourse problems [51], [52].

Figure 3 details the flowchart with the main steps of the NC&CG algorithm. In order to adopt this strategy, the original trilevel max-min-max problem is transformed into a max-min-max-max problem, by separating binary and continuous variables in the original third stage [14]. The new fourth stage contains only continuous variables, and it is then a pure LP problem. The formulation is then transformed into a max-min-max-min through a dual reformulation of the last stage. In this form, the problem can be solved using a NC&CG algorithm, identifying an outer and inner layer which exchange primal variables in form of parameters until the convergence to the global optimum is reached.

For a more detailed explanation of the C&CG algorithm, the reader is referred to [51], [52] for a theoretical framework and [14], [27], [50] for applications.

Inner layer

The inner layer consists in solving the second and third level (min-max) in ( 46) with a fixed coupling interface y * . The output of the model is the worst-case realization of the combined performance and the associated optimal attack plan u. With fixed binary variables (coupling interface y * , interdependency variables δ * and attack plan u * ), the inner-most maximization in (46) and the relative constraints take the form in ( 59)-( 60):

max h b T h + c T y * (59)
subject to :

Rh ≤ q -Tu * -Hy * -Wδ * -y * T Dδ * (60)
The problem in ( 59)-( 60) is a pure LP, and thus the introduction of variables z and r is not necessary.

Thanks to its linear nature, strong duality holds and it can be transformed into its dual form in ( 61)-( 62):

min λ (q -Tu * -Hy * -Wδ * -y * T Dδ * ) T λ (61)
subject to:

R T λ = b (62)
As the variables δ are binary, the number of possible combinations that they can take is equal to 2 N δ , where N δ =N P N +N GN is the number of binary variables δ. We denote as D the set containing all the possible combinations of binary variables δ. The C&CG approach exploits the observation that only a partial subset D part ⊆ D is essential to compute the optimal solution. The bilevel min-max formulation can be solved by iteratively reconstructing the partial set D part by following these steps:

1. Set j = 0, lower bound LB in = 0, upper bound U B in = ∞, and D part = ∅ 2. Solve the inner master problem in Equations ( 63)- (66). Obtain an optimal solution ρ (j) and optimal attack plan u (j) . Update

LB in = ρ (j) + c T y * . min ρ,u,λ ρ (63)
subject to:

ρ ≥ (q -Tu -Hy * -Wδ * (j) -y * T Dδ * (j) ) T λ (j) , ∀δ * (j) ∈ D part (64)
R T λ (j) = b, ∀δ * (j) ∈ D part ( 65
) k∈EP N (1 -u k ) ≤ K att (66)
3. Solve the inner subproblem in Equations ( 67)-( 68) with u (j) =u * . Obtain an optimal solution b T h (j) and δ

(j) . Set U B in = min(U B in , b T h (j) + c T y * ). max h,δ b T h (67)
subject to :

Rh ≤ q -Tu * -Hy * -Wδ -y * T Dδ (68) 4. If (U B in -LB in )/U B in < 10 -5 , u (j)
represents the optimal attack and the algorithm can be terminated. Otherwise, D part = D part ∪ δ (j) . Set j ← j + 1 and return to step 2.

The optimal attack plan, or, in other words, the feasible combination of variables u which minimizes the combined performance for a fixed coupling interface y * , and the optimal value of the objective function represent the main outputs of the algorithm.

Outer layer

Similarly, the outer layer is solved by employing a partial set of attack scenarios A part ⊆ A.

The outer layer solves a bilevel max-min problem, and the minimization is solved by the inner layer algorithm.

The outer layer is solved by employing the following steps:

1. Set j = 0, lower bound LB out = 0, upper bound U B out = ∞, and A part = ∅ 2. Solve the outer master problem in Equations ( 69)- [START_REF] Trivedi | Chapter 7 -stochastic modeling techniques for secure and survivable systems[END_REF]. Obtain an optimal solution η (j) + c T y (j) and optimal coupling interface y (j) . Update U B out =min(U B out , η

(j) + c T y (j) ) max η,h (j) h ′ ,δ ′ y∈{0,1} η + c T y (69) η ≤ b T h (j) , ∀ u * (j) ∈ A part (70)
Py ≤ g (71)
b

T h ′ ≥ 1 (72) R ′ h ′ ≤ q ′ -H ′ y -W ′ δ ′ -S ′ z ′ -V ′ r ′ (73)
Q ′ z ′ + F ′ r ′ ≤ t ′ -L ′ y -J ′ δ ′ (74)
Rh (j) ≤ q -Tu * (j) -Hy -Wδ (j) -Sz (j) -Vr (j) , ∀ u * (j) ∈ A part (75)

Qz (j) + Fr (j) ≤ t -Ly -Jδ (j) . (76)
3. Solve the outer subproblem using the inner layer in the previous subsection with y (j) =y * .

Obtain an optimal solution b T h (j) + c T y * and an optimal attack plan u (j) . Set LB out = b T h (j) + c T y * .

4. If (U B out -LB out )/U B out < 10 -5 , y (j) is the optimal coupling interface and the algorithm is terminated. Otherwise, A part = A part ∪ u (j) , set j ← j + 1 and return to step 2.

The outputsof the algorithm are the optimal combined performance in the worst-case failure scenario and the related optimal coupling interface ys.

Illustrative case-study

As illustrative case-study, a power network based on the IEEE 14-bus system [53] and a gas network based on the IEEE 9-bus system [54] are considered. As shown in Figure 4, the IPGNs are allocated within a 300×300 km area. The importance of each infrastructure is given by their weights, w P N and w GN , both equal to 0.5. Node 1 in the power network is chosen as the reference bus. Other parameter values are summarized in Appendix B. We test our model for values of K att ranging from 1 to 5. We choose a representative interdependency cost-per-kilometer of 1 $/km, for both c g←p km and c p←g km . We assume budget values B ci ranging from $900 to $1500 for the installment of coupling interfaces. We also consider a budget of $823, which corresponds to the cost of the minimumdistance coupling interface, where each node in one infrastructure is dependent, if necessary, on the geographically-closest node of the other infrastructure 4 . We compare the results obtained by our model with the results obtained with network metrics-based coupling interfaces, which are identified based on different combinations of node degree (D) and betweenness (B). We distinguish four coupling interfaces using the different network metrics and the terms assortative (subscript ast) and disassortative (subscript dst). In network science, the assortativity (disassortativity) is a property that describes the tendency of the nodes of a network to be connected to nodes which are similar (different) regarding some specific properties [55]. For example, it can refer to the tendency of high degree nodes to be attached to other high degree nodes. Additionally, we identify a geographical location-based coupling interface, referred to as Euclidean. The five different network metrics-based interfaces used in this work are characterized by the following features:

• Euclidean: each node in the power network (or gas network) is dependent on the geographically closest node in the gas network (or power network). • DD ast : the node with the k th highest degree in the power network (or gas network) is dependent on the node with the k th highest degree in the gas network (or power network).

Power network Gas network

• DD dst : the node with the k th highest degree in the power network (or gas network) is dependent on the node with the k th lowest degree in the gas network (or power network).

• BB ast :the node with the k th highest betweenness in the power network (or gas network) is dependent on the node with the k th highest betweenness in the gas network (or power network).

• BB dst : the node with the k th highest betweenness in the power network (or gas network) is dependent on the node with the k th lowest betweenness in the gas network (or power network).

The cost associated with each network metrics-based coupling interface is reported in Table 1.

Interface Cost

Euclidean

$823

DD ast $1518 DD dst $2098 BB ast $1943 BB dst $2126
The optimization problem is implemented with Gurobi 9.1 [56] on a desktop PC with a 3.20

GHz CPU and 32 GB RAM.

Results and discussion

Combined performance

The results for the network metrics-based coupling interfaces are shown in Figure 5, while the results for the optimal coupling interfaces obtained by our approach with different budget B ci are shown in Figure 6. The x-axis shows the maximum number of lines in the power network which can be attacked and failed; the y-axis shows the correspondent worst-case realization of the combined performance.

As it can be clearly seen in Figure 5, the DD ast coupling interface performs quite poorly, reaching a worst-case combined performance value of 0 for K att =4. The BB ast coupling interface performs well for values K att ≤4. The DD dst and BB dst coupling interfaces perform similarly for values K att ≤3. For K att =4, the DD dst interface performs better, while for K att =5, the BB dst interface performs better.

The Euclidean coupling interface leads to the better performance overall: for K att =3, K att =4 and K att =5, the Euclidean coupling interface leads worst-case combined performance of 0.703, 0.523 and 0.307. It is outperformed only by the BB ast coupling interface for K att =1.

These results clearly show how different coupling interfaces lead to different worst-case combined performance. In this case, the Euclidean coupling interface performs better than the other network metrics-based coupling interfaces. However, these results should not be generalized, as the performance of each network metrics-based coupling interface is strongly case-dependent. For example, if we change the geographical disposition of the nodes of the IPGNs, the Euclidean coupling interface would be different and, thus, the results would differ. Similar considerations are valid for the other network metrics-based coupling interfaces. Worst-case combined performance The optimal coupling interfaces, identified with the proposed optimization model, outperform the network metrics-based coupling patterns in terms of worst-case combined performance, as it can be clearly seen in Figure 6. The minimum budget which ensures the feasibility of the model is $823, which corresponds to the cost of the Euclidean coupling interface (see Table 1). For a budget lower than $823 it is not possible to allocate all the necessary interdependencies and to ensure satisfactory performance in normal conditions, and the optimization problem is, thus, unfeasible.

B ci = $823 B ci = $900 B ci = $1000 B ci = $1100 B ci = $1200 B ci = $1300 B ci = $1400 B ci = $1500
The results for B ci =$823 (blue triangles in Figure 6) are equivalent to the results of the Euclidean coupling interface (blue triangles in Figure 5).

As it can be clearly seen, for values of B ci greater than $823, the traditional interfaces are outperformed by the optimal coupling interfaces identified by the proposed approach. For example, with B ci =$900 and K att =3, K att =4 and K att =5, the worst-case combined performance are, respectively, 0.766, 0.644 and 0.514, while with B ci =$1000 and K att =3, K att =4 and K att =5, the worst-case combined performance are 0.894, 0.763 and 0.601, respectively. These results are considerably higher than the previously explained Euclidean interface (0.703, 0.523 and 0.307, respectively).

The worst-case combined performance improves with the increasing of the budget B ci . For example, with B ci =$1500 and K att =3, K att =4 and K att =5, the worst-case combined performance are 0.930, 0.906 and 0.860, respectively. For values of B ci greater than $1500, the results do not improve. The case B ci =$1500 (pink triangles in Figure 6) leads to the best possible results for this case-study.

It is also of interest to compare optimal coupling interface designs for different B ci and K att .

In Figure 7, the optimal coupling interfaces for B ci =$900 and B ci =$1000 with K att =2 are shown.

With B ci =$900 and K att =2, the optimal value of the combined performance is 0.791, while with B ci =$1000 and K att =2, the optimal value of the combined performance is 0.953. These values corresponds to an increase of combined performance of 20.5% for an increase of budget of 11.1%.

As we can notice in Figure 7, two interdependency links from the gas network to the power network (red squares) change when passing from B ci =$900 to B ci =$1000, as it is also highlighted in Table 2. Moreover, three interdependency links from the power network to the gas network (blue squares) change when passing from B ci =$900 to B ci =$1000, as it is also highlighted in Table 3.

Table 2: Reallocation of interdependency links from the gas network to the power network (gas supply) when passing from B ci =$900 to B ci =$1000, with Katt=2. As it can be clearly seen, the reallocation of some of the interdependency links leads a considerable increase of worst-case combined performance. Moreover, it is interesting to notice that, with B ci =$1000, nodes 1, 4, and 5 of the gas network are dependent on nodes 1, 6, and 6 of the power network, respectively, and both these nodes of the power network contain a gas-fired power plant, i.e. they have some power production capacity (see Table B.5 in Appendix B). Intuitively, as in this work only failures of lines are considered, it is more convenient for nodes of the gas network to Table 3: Reallocation of interdependency links from the power network to the gas network (electricity supply) when passing from B ci =$900 to B ci =$1000, with Katt=2. Optimal coupling interface cost be dependent on nodes in the power network with some production capacity, and vice versa.

Budget Node 6 ∈ V PN Node 8 ∈ V PN $900 Node 8 ∈ V GN Node 6 ∈ V GN $1000 Node 9 ∈ V GN Node 7 ∈ V GN
Budget Node 1 ∈ V GN Node 4 ∈ V GN Node 5 ∈ V GN $900 Node 12 ∈ V P N Node 11 ∈ V P N Node 14 ∈ V P N $1000 Node 1 ∈ V P N Node 6 ∈ V P N Node 6 ∈ V P N
B ci = $823 B ci = $900 B ci = $1000 B ci = $1100 B ci = $1200 B ci = $1300 B ci = $1400 B ci = $1500

Coupling interface cost

In Figure 8, the results in terms of allocation cost of optimal coupling interfaces for different monetary budgets and maximum failed lines are shown. As it can be clearly seen, the network metrics-based coupling interfaces are outperformed also in terms of cost (with the exception of the Euclidean coupling interface). The cost of the network metrics-based coupling interfaces are shown in Table 1.

It is also useful to compare the increase in combined performance with the increase of cost.

For example, for the case K att =3, passing from B ci =$823 to B ci =$1000 (21.5% of budget increase) leads to an increase of 27.2% in worst-case combined performance (from 0.703 to 0.894). The cost of the optimal coupling interface with a budget B ci =$1000 is 977.3$, corresponding to an increase of • the proposed model should be used for designing or retrofitting coupling interfaces, and in preliminary design phases, the computational time do not represent a critical factor;

B ci K att =1 K att =2 K att =3 K att =4 K att =5 $823 1.
• the computational complexity of the optimization problem can be reduced by limiting the number of binary variables of the problem. For example, the feasible allocation of interdependency links can be limited to nodes which are geographically close to each other.

Conclusion

CIs are essential for any advanced society, and ensuring their resilience against failures and disruption is of the utmost importance. As coupling interfaces between interdependent CIs are a key factor for maintaining high levels of resilience, optimizing their design is an important issue.

In this work, we proposed a mathematical programming approach for the resilience-based optimization of coupling interfaces between interdependent CIs that, compared to traditional network metrics-based solutions, is more generalizable and leads to better performances.

In fact, using interdependent power and gas networks as case-study, we showed how optimal coupling strategies, obtained by the proposed approach, clearly outperform traditional coupling strategies based on network metrics. In addition, the proposed approach can be easily adapted to other combinations of interdependent CIs by updating the operational model used in the optimization procedure.

In the proposed case-study, only failures of power lines are considered. However, alternative disruption scenarios, such as failure of nodes or gas pipelines, can be easily included with a similar

Node index p

i [m 3 ] d i [m 3 ] d MW i [MW]

Line index Boundaries

(i, j) f k [m 3 ] 1 (1, 2) 15 2 (1, 5) 10 3 (2, 3) 10 4 (2, 4) 15 5 (2, 5) 10 6 (3, 4) 10 7 (4, 5) 15 8 (4, 7) 10 9 (4, 9) 10
A data-driven distributionally robust approach for the optimal coupling of interdependent critical infrastructures under random failures 1. Introduction

Motivation

Critical infrastructures (CIs), such as energy systems, transportation and telecommunications networks, are large and complex man-made systems which support vital societal functions and represent a driving force in the socioeconomic development (Z. [START_REF] Guo | Exploring systemic risks in systems-of-systems within a multiobjective decision framework[END_REF]. In fact, many essential services and commodities, such as electricity, public transportation, water and gas supply or telecommunications, are provided by CIs (Ouyang, 2014). Consequently, failures and disruptive events within CIs, such as intentional sabotages, extreme natural hazards or random failures, can cause disruption and considerable negative consequences within a society. For example, the blackout which affected Italy on 28 September 2003 caused over 10 hours of power outages for more than 50 millions people [START_REF] Corsi | General blackout in italy sunday september 28[END_REF]). Thus, a risk-oriented analysis and optimization within these critical systems is an essential task [START_REF] Bier | Risk analysis beyond vulnerability and resilience-characterizing the defensibility of critical systems[END_REF].

CIs are not stand-alone isolated systems, but they are interconnected with, and interdependent on, each other in terms of functionality, reliability and performance (Rinaldi et al., 2001). While Among the various factors and parameters that can affect the resilience of interdependent systems, network science has demonstrated that the topology of the ensemble of interdependencies, here referred to as coupling interface, can strongly affect the failure propagation between different systems [START_REF] Parshani | Interdependent networks: Reducing the coupling strength leads to a change from a first to second order percolation transition[END_REF]. However, designing (or retrofitting) the topology of coupling interfaces of interdependent CIs has been investigated by very few studies.

Coupling interfaces should be designed to ensure the robustness of interdependent systems against different failure and disruption scenarios. As failure scenarios can considerably vary in terms of cause, magnitude and frequency of occurrence, optimizing coupling interfaces lies within the framework of optimization under uncertainty. In our previous work (Bellè et al., 2021), we proposed a framework to optimize the coupling interface design against the worst-case scenario within a set of feasible failure scenarios, exploiting the traditional defender-attacker-defender model. While this approach provides robust solutions, it might suffer from overconservativeness. In this paper, we propose a data-driven distributionally robust approach for the optimal coupling of interdependent critical infrastructures under random failure scenarios. Our proposed model has the advantage of allowing to tune the conservativeness of the solution with specific parameters, in order to better reflect the attitude towards risk of the decision maker. Moreover, our model gives the possibility to exploit historical data on failures and contingencies for an informed decision making. Rueda & Calle, 2017). These strategies represent only a heuristic approach and, although they provide meaningful insights, they do not ensure solution optimality.

In [START_REF] Winkler | Interface network models for complex urban infrastructure systems[END_REF], the authors propose a more sophisticated heuristic model for designing optimal coupling interfaces between complex urban infrastructure systems against external attacks. The coupling interface is based on traditional network metrics, such as node degree, betweenness, clustering coefficient and Euclidean distance. Interface design between power, gas and water networks is given as an illustrative example. A similar approach is presented in (Ouyang & Dueñas-Osorio, 2011), where the authors propose a network metrics-based heuristic method to optimize coupling interfaces against cascading failures and different external attacks scenarios, also accounting for physical features of the different nodes (e.g. supply or demand nodes). However, these approaches still rely on network metrics-based heuristics, and they do not guarantee global optimality of solutions.

In our previous work (Bellè et al., 2021), we proposed a mathematical framework for the optimal coupling of interdependent CIs based on the defender-attacker-defender model [START_REF] Brown | Analyzing the vulnerability of critical infrastructure to attack and planning defenses[END_REF].

This model ensures a coupling interface design which is robust against the worst-case realization of the uncertainty, represented by a set of feasible failure scenarios. While this model represents the first mathematical programming approach for the optimal coupling of interdependent CIs, it does not include probabilistic information on the different feasible failure scenarios considered within the optimization. Consequently, the solutions might result overconservative, and the control of the decision-maker over the conservativeness of the model is limited to the size of the uncertainty set, i.e.

the set of feasible failure scenarios. To the best of our knowledge, an optimization under uncertainty approach for optimizing the coupling interface of interdependent CIs under random failures, which avoids the the risk of overconservativeness, is missing. An approach based on distributionally robust optimization might be able to offer more control over the level of conservativeness and to leverage historical data for encoding probabilistic information within the decision-making.

Distributionally robust optimization in CIs

When dealing with optimization under uncertainty, different approaches are available. In robust optimization (RO), it is assumed that the decision-maker has no knowledge on the uncertainty distribution of the parameters, except for the support sets. The decision-maker thus seeks to optimize the solution against the worst uncertainty realization. RO represents the most risk-averse class of optimization under uncertainty, and it leads to solutions which are often highly conservative.

In stochastic optimization (SO), it is assumed that the decision maker has perfect distributional knowledge of the uncertainty. The goal is, thus, to identify a solution that optimizes the expectation of the objective function. SO represents a risk-neutral class of optimization under uncertainty.

In reality, it is often not possible to obtain full information on the uncertainty probability distribution. However, partial probabilistic knowledge of the uncertainty distribution is often available.

While it is often insufficient for deriving a probability distribution with high confidence, this partial information can be exploited with a robust stochastic approach that protects the decision-maker from the ambiguity of the available distributional knowledge (Rahimian & Mehrotra, 2019). This approach is called distributionally robust optimization (DRO), and it is based on the assumption that the real distribution of uncertainty is unknown, but it is contained within an ambiguity set, where the available probabilistic information is encoded. In this framework, the decision-maker seeks to identify a solution that optimizes the expectation of the objective function under the worst distribution within the ambiguity set. The risk-aversion of DRO lies between RO and SO, and it can be tuned by modifying the size of the ambiguity set to correspond to one or the other.

The applications of DRO have seen an increased interest in several research domains. For These existing works are a clear indication of the validity of DRO approaches with moment-based ambiguity sets within the context of protection of CIs. It is also clear that DRO approaches, in the context of critical infrastructures, have remained confined within the power systems applications, and no application in the general field of protection of interdependent CIs seems to exist.

Contribution

We propose a novel data-driven DRO model for the optimal design of coupling interfaces between interdependent CIs under random failures. The proposed approach ensures the robustness of the coupling interface in terms of worst expectation of combined performed of the interdependent infrastructures under disruption conditions. The proposed approach is based on a moment-based ambiguity set, built upon a synthetic contingency data set. Using as an illustrative case-study interdependent power and gas networks (IPGNs), our model ensures a coupling interface design which maximizes the expected combined performance of the IPGNs under the worst distribution within the ambiguity set.

The contributions of this papers can be summarized as follows:

• We propose a novel data-driven DRO-based model for the optimal coupling of interdependent CIs, which can be directly applied in real-world situations such as: (i) design of the coupling interface between new CIs, (ii) design of the coupling interface between new and existing CIs, (iii) retrofitting, analysis and evaluation of existing coupling interfaces.

• We show how to build a data-driven moment-based ambiguity set using a synthetic contingency data set, generated ad hoc to recreate realistic historical data of failure scenarios.

• We develop a reliable and efficient solution approach based on the Nested Column&Constraint Generation (NC&CG) algorithm.

• Using IPGNs as a case-study, we show the validity of our approach comparing the optimal coupling interface designs with a traditional euclidean coupling strategy based on geographical vicinity.

• We perform a sensitivity analysis on various parameters, demonstrating the validity of our approach over a spectrum of parametric assumptions.

The rest of this work is organized as follows: in Section 2, the problem is formulated; in Section 3, the solution procedure is detailed; in Section 4, the case-study is presented in details; in Section 5, the main results are reported and discussed; in Section 6, some final remarks are given.

Problem formulation

Modeling framework

Critical infrastructures are interdependent if the state of one system depends on the state/output of another one. Relationships of various nature can exist between elements of different infrastructures, and the interdependencies can be divided into four categories: physical, when the state of one system is dependent on the material output of another system; cyber, when the state of one system is dependent on the information transmitted through another system; geographic, when different systems share the same location and their state can be modified by an environmental event; and logical, if the interdependency is not physical, cyber, or geographic (Rinaldi et al., 2001).

We model each infrastructure using a network flow-based approach (Ouyang, 2014). A network is a mathematical construct described by a graph G = (V, E), where V is the set of N nodes and E is the set of M edges. Each edge k is directed, and it is defined by a tuple (i, j), where i and j represent, respectively, the origin node O(k) and destination node D(k) of the corresponding edge.

We assume that each node i is characterized by a production capacity p i (e.g. power or gas flow production) and a requested demand d i (e.g. power or gas flow demand). Similarly, each edge k is defined by a maximum flow capacity f k .

In the context of J interdependent infrastructures, the focus of our analysis is the combined performance P C (Fang & Zio, 2019), generally defined as in (1):

P C = j∈J w j i∈Vj d i i∈Vj d i (1)
where w j represents the weight of infrastructure j, V j represents the set of nodes in infrastructure j and d i represents the demand supplied at node i. This equation represents the fraction of requested demand that is satisfied within the interdependent CIs.

In this work, we consider interdependent power and gas networks (IPGNs), which are mutually interdependent on each other with physical interdependencies: equipment in the gas network needs to be supplied with electricity, while gas-fired power plants needs a gas flow supply.

One could imagine the problem of designing the coupling interface as a traditional reliable network design problem (e.g. [START_REF] Bhuiyan | A stochastic programming model with endogenous and exogenous uncertainty for reliable network design under random disruption[END_REF]. In the reliable network design problem, a decision maker seeks to allocate the links between nodes in order to design a network which satisfies some given conditions in terms of performance and robustness against failures. In the coupling interface design problem, we seek to allocate interdependency links between nodes of different networks in order to guarantee satisfying performance in nominal conditions and robustness in conditions of disruption.

Given a power network and a gas network, we want to identify the coupling interface design which maximizes their combined performance in feasible disruption conditions. The expectation of the combined performance is computed with respect to a set of feasible failure scenarios. Each failure scenario is represented by an ambiguous probability, as defined by the ambiguity set.

In this work, we consider within the set of feasible failure scenarios only contingencies of edges of the power network, which represent power transmission lines.

Networks operational model

The power network is operated with a traditional DC power flow model, while the gas network is operated with a maximal flow model, which is a suitable linear approximation for any flow-based system or infrastructure (

subject to:

0 ≤ p i ≤ p i , ∀i ∈ V T OT (3) 0 ≤ d i ≤ d b i + j∈VGN y 1 ji d M W j , ∀i ∈ V P N (4) 0 ≤ d i ≤ d b i + j∈VP N y 2 ji d m 3 j , ∀i ∈ V GN (5) -f k ≤ f k ≤ f k , ∀k ∈ E GN (6) -u k f k ≤ f k ≤ u k f k , ∀k ∈ E P N (7)
p i -d i + D(k)=i f k - O(k)=i f k = 0, ∀i ∈ V T OT (8)
x k f k -θ O(k) -θ D(k) ≥ -M k (1 -u k ), ∀k ∈ E P N (9)
x k f k -θ O(k) -θ D(k) ≤ M k (1 -u k ), ∀k ∈ E P N (10)
d i -δ P N i d b i + j∈VGN y 1 ji d M W j ≥ 0, ∀i ∈ V P N (11)
d i -δ GN i d b i + j∈VP N y 2 ji d m 3 j ≥ 0, ∀i ∈ V GN ( 12
)
p i -p i j∈VGN y 2 ij δ GN j ≤ 0, ∀i ∈ V P N ( 13
)
p i -p i j∈VP N y 1 ij δ P N j ≤ 0, ∀i ∈ V GN (14)
d i -d b i j∈VP N y 1 ij δ P N j - j∈VP N y 2 ji d m 3 j j∈VP N y 1 ij δ P N j ≤ 0, ∀i ∈ V GN (15)
-

i=O(k) j∈VP N y 1 ij δ P N i f k ≤ f k ≤ i=O(k) j∈VP N y 1 ij δ P N i f k , ∀k ∈ E GN (16)
-

i=D(k) j∈VP N y 1 ij δ P N i f k ≤ f k ≤ i=D(k) j∈VP N y 1 ij δ P N i f k , ∀k ∈ E GN (17)
δ P N i , δ GN i ∈ {0, 1}, θ j free, ∀i ∈ V T OT , ∀j ∈ V P N (18)
The term h={p, d, f , θ} represents the continuous operational variables of the optimization, where p, d, f and θ are, respectively, production levels and supplied demands of power/gas in each node, power/gas flows in each edge and phase angles of the nodes in the power network. The term δ represents the binary operational variables of the model, describing the functional states (1 if functional, 0 otherwise) of the interdependency links between the IPGNs. The term y={y 1 ij , y 2 ij } represents binary variables which define the coupling interface design. They do not appear below the maximization in (2), as they are not variables of the operational model. The term y 1 ji =1 if the node j ∈ V GN is dependent on the node i ∈ V P N and y 1 ji =0 otherwise. Similarly, the term y 2 ji =1 if the node j ∈ V P N is dependent on the node i ∈ V GN and y 2 ji =0 otherwise. As it will be clear in the next section, they are decision variables of the outer stage of the distributionally robust model. The terms u k represents the failure variables of the power transmission lines. The variable u k =0 if line k is failed, and u k =1 otherwise. Similarly to the variables y, the variables u do not appear below ( 2), but they are present in the ambiguity set and they will be explained in the next section. The objective function in (2) represents the combined performance of the IPGNs in terms of fraction of requested demand of electricity and gas which is supplied. The subscripts P N and GN denote the power network and the gas network, respectively. The subscript T OT denotes the union of power and gas networks elements (e.g. V T OT = V P N ∪ V GN ). The variable d i represents the supplied demand of power/gas in the node i, while the terms d max P N and d max GN represent the total requested demand of power and gas in the power and gas network, respectively. Contrary to Equation (1), we define the requested demand in terms of networks rather than single nodes; this is because the requested demand in each node is not a constant parameter, but it depends on the coupling interface, defined by the variables y={y 1 ij , y 2 ij }. The importance of each infrastructure when computing the combined performance is given by the weights w P N and w GN . The constraints are shown in (3)- (18). Constraint (3) states that the production level of power/gas p i in each node is bounded between 0 and the node production capacity p i . The supplied demand of power/gas d i in each node is bounded between 0 and the requested demand, as enforced by Constraints (4)- (5).

Contrary to traditional approaches, the requested demand in each node is not a fixed parameter but it depends on the coupling interface, as shown in ( 4) and (5). The requested demand in each node i, either in the power or gas network, is composed of two terms:

• The term d b i is the base requested demand, which represents various consumers of electricity/gas (households, industries, etc.). represent, respectively, the electricity demand of node j ∈ V GN and the gas flow demand of node j ∈ V P N . We recall that the term y 1 ji has value 1 if the node j ∈ V GN is dependent on the node i ∈ V P N and 0 otherwise. Similarly, the term y 2 ji has value 1 if the node j ∈ V P N is dependent on the node i ∈ V GN and 0 otherwise. Constraints (6) and Constraint (7) describes, respectively, the constraint on the flow of gas and power in each edge, which is bounded, in absolute value, by the flow capacity f k . Since in this study we consider random contingencies of power transmission lines, the variable u k =0 when the edge k is failed and u k =1 otherwise. The net balance between generation, demand and flow in each node is guaranteed by Constraint (8). The DC power flow assumption within the power network is enforced by Constraints ( 9)- (10).

The functional state of each interdependency link is described in (11) and (12). Each interdependency link from the node i ∈ V P N to the nodes j ∈ V GN is functional if the variable δ P N i is equal to 1; otherwise, δ P N i =0 and the all the nodes in V GN that are depending on node i are not functional. We assume, as shown in (11), that each variable δ P N i can take the value 1 only when the requested demand in the node i is fully supplied (Fang & Zio, 2019). The same assumption is applied for the gas network and the corresponding variables δ GN i , as shown in (12).

The production level p i in each node depends on the coupling interface. We assume that the production p i in each node ranges between 0 and the production capacity p i if there is one functional interdependency, and 0 otherwise. For example, as shown in (13), the production p i in the node i ∈ V P N ranges between 0 and p i if there is one interdependency link from a node j ∈ V GN in the gas network (y 2 ij =1) properly functional (δ GN j =1); otherwise, p i takes the value 0. The rationale behind this assumption is that, in this work, each node in V P N with a production capacity higher than 0 is assumed to contain a gas-fired power plant. The same assumption is applied for the gas network and the corresponding interdependency link from the power network, as shown in (14). In addition, we assume that, in the gas network, supplied demands and flows in the pipes are also dependent on the interdependency from the power network. As shown in (15), the supplied demand d i in the node i ∈ V GN ranges between 0 and the requested demand if there is one interdependency from a node j ∈ V P N in the power network (y 1 ij =1) properly functional (δ P N j =1); otherwise, d i takes the value 0. The rationale behind these assumptions is that each node in V GN needs electricity to run various equipment, such as pumps, valves or compressors. Lastly, we assume that the absolute value of the flow f k in each pipe k ∈ E GN ranges between 0 and the maximum flow capacity f k only if both the origin and destination node of k, respectively O(k) and D(k), have a functional interdependency from the power network, as expressed in ( 16) and (17); otherwise, f k takes the value 0.

For clarity, we can express the model in ( 2)-( 18) with its compact matrix formulation, shown in ( 19)- (20):

max h,δ b T h (19)
subject to:

Rh ≤ q -Tu -Hy -Wδ -y T Dδ ( 20
)
where h is the vector containing the continuous variables, u, y and δ are vector containing the binary variables, b is the vector containing the parameters of the objective function, R, T, H, W and D are matrices containing the constraints parameters and q is the vector containing the constraints constants.

Due to the multiplication between y and δ variables in Constraints ( 11)-( 17), the formulation presents nonlinear terms. However, they can be linearized by introducing new binary variables, contained within the vectors z and r, and new parameters matrices V and S, and Constraints (20) can be replaced by (21).

Rh ≤ q -Tu -Hy -Wδ -Sz -Vr (21)

Distributionally robust formulation

We formulate a distributionally robust problem for the optimal coupling interface of IPGNs under random failures, as it is shown in ( 22)-( 27):

max h 0 ,δ 0 y∈{0,1} min P∈M E P [Q(y, ξ)] (22)
subject to:

j∈VP N y 1 ij ≤ 1, ∀i ∈ V GN ( 23
) j∈VGN y 2 ij ≤ 1, ∀i ∈ V P N ( 24
) i∈VGN j∈VP N y 1 ij d km ij c 1 km + i∈VP N j∈VGN y 2 ij d km ij c 2 km ≤ B c (25) R 0 h 0 ≤ q 0 -H 0 y -W 0 δ 0 -y T D 0 δ 0 (26)
b T h 0 ≥ 1 (27) and with the recourse function Q(y, ξ) representing the operational model of the IPGNs, previously shown in (19) and (21).

In the first stage, a coupling interface between the IPGNs is allocated through the binary variables y={y 1 ij , y 2 ij }, with the aim of maximizing the expected combined performance of the IPGNs in disrupted conditions. The variable y 1 ij equals to 1 if the node i ∈ V GN is coupled to and dependent on the node j ∈ V P N , and 0 otherwise; similarly, the binary variable y 2 ij equals to 1 if the node i ∈ V P N is coupled to and dependent on the node j ∈ V GN , and 0 otherwise. We assume that each node in the gas network that needs electricity is dependent on one and only one node in the power network, as shown in constraint (23); similarly, each node in the power network that requires gas flow supply is dependent on one and only one node in the gas network, as shown in constraint (24). Coupling two nodes has a cost per kilometer, and the total cost of the allocated interdependencies is bounded by the available monetary budget B c . This is expressed in Constraint (25), where d km ij is the distance in km between nodes i and j and the terms c 1 km and c 2 km are, respectively, the cost per km of placing a coupling link from the power to the gas network and from the gas to the power network.

The coupling interface must be allocated in a way such that, in nominal conditions (no components failed), the requested demands of electricity and gas are fully satisfied. This condition is enforced by Constraint (27), which depends on the operational constraints of the IPGNs, expressed in Constraint (26). The variables h 0 ={p 0 , d 0 , f 0 , θ 0 } and δ 0 are the operational variables of the first stage. Constraint (26) does not contain u variables because every line is considered as functional.

In the second stage, the probability distribution of feasible failure scenarios is chosen in order to minimize the expected combined performance of the IPGNs. The set of feasible failure scenarios A is defined in terms of maximum number of failed components K. In this work, we assume that only edges in the power network can fail. Each failure scenario k is defined by an M P N -dimensional vector u k , where the i th component defines the functional state (0 if failed, 1 if functional) of the power transmission line i. The set of feasible failure scenarios can be defined as in Equation ( 28):

A = u|u ∈ 2 MP N , ||u|| 1 ≥ M P N -K (28)
where M P N is the number of edges in the power network. Given the condition that one of the scenarios in A occurred (or, in other words, at least one edge failed), the conditional probability of each scenario k ∈ A to have occurred is defined as φ k . The scenarios are mutually exclusive and their probability distribution is defined by a multinomial distribution P that respects the condition in (29):

k∈A φ k = 1. ( 29
)
As it can be clearly seen from the formulation in (22), the distribution P of the scenario occurrence probabilities φ k is a variable of the optimization problem. In particular, the distribution P is chosen among a family of distributions defined by the ambiguity set M. This set contains all the the multinomial distributions that can describe the conditional occurrence probability of the feasible failure scenarios and respect some given conditions. Depending on the conditions which are enforced, different ambiguity set can be defined. In this work, we rely on a traditional moment-based ambiguity set, shown in Equation (30), that enforces the conditional marginal failure probability of each line i ∈ E P N to be between 0 and an upper bound π max i :

M = {P ∈ P(A) : 0 ≤ E P [1 -u] ≤ π max } (30)
where P(A) defines the set of all probability distributions on a σ-algebra of A and π max is the vector containing the upper bounds of the marginal failure probabilities of each power transmission line. We refer to conditional marginal failure probability of each line because we assume that at least one line is failed. In other words, given the condition that at least one line is failed, the conditional marginal failure probability denotes the probability of each line to be failed.

The goal of the model is to identify the coupling interface design that maximizes the expected combined performance of the IPGNs in disrupted conditions (at least one line failed) under the worst multinomial distribution within the ambiguity set.

Solution procedure

Our strategy involves a problem reformulation into a form which can be recast and solved through a Nested Column&Constraint Generation (NC&CG) algorithm. This tractable reformulation is shown in Proposition 1, and its proof is available in Appendix A.

Proposition 1. The problem in ( 22)-( 27) is equivalent to the problem in (31) subject to (21), ( 23)-( 27) and (32).

max h 0 ,δ 0 y∈{0,1} β≥0 min u∈{0,1} max h,δ b T h + i∈EP N β i (1 -u i -π max i ) ( 31
) k∈EP N (1 -u k ) ≤ K (32)
where (32) defines the set of feasible failure scenarios A.

The formulation in Proposition 1 is a trilevel mixed-integer linear programming (MILP) problem, presenting a structure that can be solved by a NC&CG approach. The formulation in (31) must be expanded into a max-min-max-max problem, by separating the binary and continuous variables in the last stage. Subsequently, the problem must be split into an outer and inner layer, that must be solved separately and iteratively. For simplicity, in the following explanation, we rely on the compact matrix formulation. The flowchart of the NC&CG algorithm is shown Figure 1.

Inner layer

The inner layer consists in the solution of the middle lower-level problem (min-max) in (31) with fixed y * and β * variables. The output of the model is an optimal failure scenario u, which will be passed to the outer layer. For a fixed coupling interface y * , fixed variables β * , fixed interdependency variables δ * and fixed failure scenario u * , the compact form of the lower-level maximization in (31) and the relative constraints are shown in ( 33)-( 34):

max h b T h (33)
subject to :

Rh ≤ q -Tu * -Hy * -Wδ * -y * T Dδ * (34)
and plus the constant

i∈EP N β * i (1 -u * i -π max i
). Its dual form is expressed in ( 35)-( 36):

min λ (q -Tu * -Hy * -Wδ * -y * T Dδ * ) T λ (35)
subject to:

R T λ = b (36)
and plus the constant

i∈EP N β * i (1 -u * i -π max i ).
As the interdependency variables δ are binary, the set of possible interdependency functional states D is finite. Following the classic C&CG approach, we can leverage on a partial set D part ⊆ D of interdependency variables combinations to identify efficiently the exact optimal solution. This is achieved employing the following steps:

1. Set j = 0, upper bound U B inr = ∞, lower bound LB inr = 0 and D part = ∅ 2. Solve the inner master problem in Equations ( 37)- (40). Obtain an optimal solution ρ (j) and u (j) . Update LB inr = ρ (j)

+ i∈EP N β * i (1 -π max i ). min ρ,u,λ ρ (37)
subject to:

ρ ≥ (q -Tu -Hy * -Wδ * (j)y * T Dδ * (j) ) T λ (j) - R T λ (j) = b, ∀δ * (j) ∈ D part (39) k∈EP

i∈EP N β * i u i , ∀δ * (j) ∈ D part (38
N (1 -u k ) ≤ K (40)
3. Solve the inner subproblem in Equations ( 41)-( 42) with u (j) =u * . Obtain an optimal solution b T h (j) and δ (j) . Set

U B inr = min U B inr , b T h (j) + i∈EP N β * i (1 -u * i -π max i ) . max h,δ b T h (41)
subject to :

Rh ≤ q -Tu * -Hy * -Wδ -y * T Dδ (42)
4. If (U B inr -LB inr )/U B inr < 10 -5 , the current solution u (j) corresponds to the optimal attack plan, the optimal objective value H inr (y * , β * ) = U B inr ≈ LB inr and the algorithm can be terminated. Otherwise, D part = D part ∪ δ (j) . Set j ← j + 1 and return to step 2.

This algorithm corresponds to the inner layer in Figure 1. Its output is the optimal failure scenario u that is passed to the outer layer, and the optimal objective value H inr (y * , β * ).

Outer layer

The upper-level problem can be solved in a similar way, by employing a partial set of feasible failure scenarios A part ⊆ A. While the inner layer solves a bi-level min-max problem, the outer layer solves a bi-level max-min problem, where the minimization represents the outer subproblem, and it is solved by the inner layer in the previous section.

To be consistent with the probability framework introduced, the outer master problem should be solved with a partial set A part that does not contain the scenario with no failed lines, defined as u ∅ . Otherwise, it would be numerically possible to assign some probability mass to the scenario u ∅ , violating the condition that at least one line has failed. This is in contrast with our definition of conditional occurence probability, where the condition is that at least one edge of the power network has failed. However, solving the model without the scenario u ∅ introduces some infeasibility problem within the optimization, particularly in the outer master problem in ( 45)-( 50). An example of this situation, including an explanation on why the the scenario u ∅ has not been removed from the set A since the beginning, is available in the Supplementary Material.

Proposition 2. For the problem in (45)-( 50) to be feasible with a partial set A part that does not contain the scenario u ∅ with no failed lines, the two following necessary conditions should be respected:

1. the sum of π max i in (30) must be at least 1, as shown in (43):

i∈EP N π max i ≥ 1; (43)
2. the partial set A part must contain enough scenarios to ensure that the linear system in (44), with φ k as variables, has at least one solution:

                   k∈Apart φ k = 1 k∈Apart(1) φ k ≤ π max 1 . . . k∈Apart(MP N ) φ k ≤ π max MP N ( 44
)
where A part (i) ⊆ A part is the subset containing all the scenarios where line i is failed and M P N is the number of lines within the power network.

Proof The proofs of the two conditions mentioned above are straightforward:

1. the condition in (43) implies that the probability that at least one line is failed is 1. If the sum in (43) was lower than 1, it would automatically imply that, in order to respect the condition in (29), some probability mass is assigned to the scenario u ∅ with no failed lines; Similar to the inner layer, the outer layer is solved with a C&CG algorithm with the following steps:

1. Set j = 0, upper bound U B otr = ∞, lower bound LB otr = 0 and A part = ∅ and A ∅ part = {u ∅ }, where u ∅ is the scenario where every line is functional.

2. Solve the outer master problem in Equations ( 45)- (50). If it is not feasible, solve it using

A ∅
part . Obtain an optimal solution η (j) , y (j) and β (j) . Update U B otr =min(U B otr , η (j) ). max η,h (j) .β≥0 h 0 ,δ 0 y∈{0,1} η (45)

η ≤ b T h (j) + i∈EP N β i (1 -u * (j) i -π max i ), ∀ u * (j) ∈ A part (46)
Py ≤ g (47)

R 0 h 0 ≤ q 0 -H 0 y -W 0 δ 0 -S 0 z 0 -V 0 r 0 (48) b T h 0 ≥ 1 (49)
Rh (j) ≤ q -Tu * (j) -Hy -Wδ (j) -Sz (j) -Vr (j) , ∀ u * (j) ∈ A part (50) where P and g are the coefficient matrix and the parameter vector of constraints in ( 23)-( 25).

3. Solve the outer subproblem using the inner C&CG algorithm explained in the previous subsection with y (j) =y * and β (j) =β * . Obtain an optimal attack plan u (j) . Update LB otr = H inr (y * , β * ).

4. If (U B otr -LB otr )/U B otr < 10 -5 and the master problem was solved with the partial set A part , the current solution y (j) corresponds to the optimal coupling interface and the algorithm can be terminated. Otherwise, A part = A part ∪ u (j) and A ∅ part = A ∅ part ∪ u (j) . Set j ← j + 1 and return to step 2.

The output represents the optimal coupling interface which maximizes the expected combined performance of the IPGNs under the worst multinomial distribution of random failures within the ambiguity set M. The optimal objective value represents the expected combined performance in disrupted conditions.

Illustrative case study

As an illustrative example, we consider a power network with a topology based on the IEEE 14-bus system, and a gas network with a topology based on the IEEE 9-bus system. We assume that the two infrastructures are placed within a 300×300 km 2 geographical area, as shown in Figure 2. Each infrastructure is assumed to have an equal weight, i.e. w P N =0.5 and w GN =0.5. This value represents the importance of each infrastructure when computing the combined performance. Other parameter values are available in the Supplementary Material.

For the baseline case, we consider a maximum number of failed edges K=3 and a monetary budget B c =1100$. Sensitivity analysis on these parameters are also performed. We choose a representative interdependency cost-per-kilometer of 1 $/km, for both c 1 km and c 2 km . Finally, all the computations are implemented in the Python API of Gurobi 9.1 (Gurobi Optimization, 2021) and performed on a desktop PC with a 3.20 GHz CPU and 32 GB RAM.

Synthetic data set and ambiguity set

The ambiguity set can be defined with a data-driven approach, starting from historical data on contingencies. In this illustrative case study, we generate synthetic contingencies historical data from assumed line failure rates. The following assumptions are taken for generating the data set:

• each line is characterized by an independent failure rate λ i . For simplicity, we do not consider any correlations, and each line fails independently. The failure rates utilized in this work are shown in the Supplementary Material;

• we consider daily resolution, simulating 30 years of contingency scenarios;

• each line, when failed, is assumed to be repaired immediately;

• we compute the arrival times T i (failures) of each line using Equation (51):

T i = - ln(s) λ i ( 51
)
where s is a random number between 0 and 1.

We obtain a synthetic data set of 252 contingencies, including 245 scenarios N -1, 2 scenarios N -2 and 1 scenario N -3. From these data, we generate the upper bounds π max for the ambiguity set with the following steps. Firstly, we compute the estimated conditional marginal failure probability πi of each line i with Equation ( 52): πi = k∈A(i)

x k N s (52)
where A(i) ⊆ A is the subset which contains all the failure scenarios in which line i is failed, x k is the number of times that scenario k has occurred, and N s is the total number of contingency scenarios occurred. Secondly, we compute the associated 95% confidence intervals for the conditional marginal failure probability of each line i using Equation ( 53):

CI 95 i = Z πi (1 -πi ) N s ( 53
)
where Z is the 95% confidence interval constant, equal to 1.96.

From the values πi and CI 95 i , and aiming for a conservative solution, we rely on the upper bound of the conditional marginal failure probability π max i of each line i, computed using Equation ( 54):

π max i = πi + CI 95 i . (54)
The obtained π max values are shown in Table 1 and they are directly used within the definition of ambiguity set in (30).

Baseline case

We solve the distributionally robust optimal coupling with a maximum number of failed edges K=3 and a monetary budget B ci =1100$. We evaluate the dependence of the results on the size of the ambiguity set by changing the upper bounds of the conditional marginal failure probability π max . The results of the optimal coupling interface, in terms of worst expected performance in disrupted conditions, are compared with the ones of a coupling interface based on euclidean distance, where each node in one infrastructure is coupled with the geographically-closest node in the other infrastructure. This result is obtained simply setting the monetary budget B c =822.76$, corresponding to the minimum budget for the optimization to be feasible (or, in other words, the budget corresponding to the euclidean coupling interface). We also evaluate the worst-case performance associated with the optimal coupling interface and the set of feasible failure scenarios.

The worst-case scenario can be easily identified by enumeration or solving the model in (55) subject to ( 21) and (32), also solvable by a C&CG approach.

min u∈{0,1} max h,δ b T h (y * ). ( 55
)
where y * is a fixed coupling interface.

The results are shown in Figure 3. In the x-axis, we plot different upper bounds π max , starting from the values in Table 1 and multiplying them by factors from 2 to 6. The last point in the x-axis corresponds to the case where the upper bound of each conditional marginal failure probability π max i is equal to 1. In the y-axis, we can see the performance levels in disrupted conditions, in terms of fraction of requested electricity and gas demand which is supplied. Four curves are shown: the blue curves represent the worst expected performance associated to the optimal and euclidean coupling interfaces, computed by the distributionally robust optimization model; the red curves represent the worst-case scenario associated to the optimal and euclidean coupling interfaces. As it can be clearly seen in Figure 3, the euclidean coupling interface is outperformed by the optimal coupling interface. Firstly, the worst expected performance are significantly higher in the optimal case. For example, using the upper bounds in Table 1, the optimal case leads to worst expected performance of 0.983, while the euclidean case, for the same upper bounds, to worst expected performance of 0.901. As it is graphically evident, this difference increases as the upper bounds π max increases.

Secondly, the associated worst-case performance is also significantly better in the optimal case. For example, using the upper bounds in Table 1, the optimal case leads to an associated worst-case performance of 0.902, while the euclidean case, for the same upper bounds, leads to an associated worst-case performance of 0.703. This is a clear indication of: i) the importance of the coupling interface in ensuring the robustness of interdependent critical infrastructures under random failures, and ii) a distributionally robust approach seems to lead to satisfying results both in terms of worst expected performance and associated worst-case performance.

Increasing the upper bounds π max , by multiplying them by factors from 2 to 6, increases the conservativeness of the solution. In fact, as it can be clearly seen, the worst expected performance decreases, while the worst-case performance increases. This is because increasing the upper bounds makes the worst probability distribution more disruptive. 1, multiplied by factors from 2 to 6. In the last point, the upper bounds π max are simply a vector of ones. In the y-axis, we can see the combined performance of the IPGNs. The red curve denotes the worst expected combined performance, while the blue curve denotes the associated worst-case combined performance.

1, we can notice that worst expected performance and worst-case performance are equivalent. This is because this case corresponds to the situation where the probability mass is entirely allocated to the worst-case scenario. In other words, the worst-case scenario has a conditional occurrence probability equal to 1, while the other feasible scenarios have a conditional occurrence probability equal to 0. This case also corresponds to the solution that can be identified with a classic defenderattacker-defender framework, as it shown for example in the model in (56):

max h 0 ,δ 0 y∈{0,1} min u∈{0,1} max h,δ b T h (56)
subject to ( 21), ( 23)-( 27) and ( 32) (Bellè et al., 2021).

The effect of the available monetary budget B c

The effect of different monetary budget B c is evaluated for upper bounds π max equal to the ones in Table 1 and maximum number of failed edges K=3. The results are shown in Figure 4.

Firstly, we notice the presence of an unfeasibility region, highlighted with a grey shadowed area, for budgets lower than 822.76$. As it was also mentioned in the previous section, this value is the minimum budget B c that guarantees to respect Constraints ( 23)- (27), and it corresponds to the cost of the euclidean coupling interface. In other words, it is the "minimum cost" coupling interface, where each node is coupled with the geographically-closest node of the other infrastructure. Secondly, we notice that, as it was expected, the results in terms of worst expected performance and associated worst-case performance improve as the monetary budget increases, because of the larger choice of coupling interface designs that is possible to implement. The improvement of results is particularly pronounced for lower budgets. For example, passing from 822.76$ to 900$, which represents a budget increase of 9.39%, leads to improvements of worst expected performance from 0.901 to 0.949, and worst-case performance from 0.703 to 0.722. These values corresponds to improvements of 5.26% and 2.74%, respectively. Increasing the budget from 900$ to 1100$, which represents an increase of 22.22%, leads to improvements of worst expected performance (from 0.949 to 0.983) and worst-case performance (from 0.722 to 0.902) of 3.63% and 24.98%, respectively.

Further increasing the budget leads to only marginal improvements of performance.

The effect of the set of feasible failure scenarios

The size of the set of feasible failure scenarios is given by the parameter K, as it shown in Equation (28). This parameter, together with the upper bounds of the conditional marginal failure probability π max , reflects the decision-maker's attitude towards risk, as high K values denote a more conservative approach (and vice versa). We evaluate the effect of different K values, using the upper bounds π max in Table 1 and a monetary budget B c =1100$. The results are shown in Figure 5.

As it can be clearly seen, the expected performance do not decline considerably considerably as K increases. This is an indication of the validity of the DRO approach. However, it must be highlight that the results depends on the size of ambiguity set. If the ambiguity set was larger,

Combined performance

Worst expected performance Worst-case performance more probability mass could be allocated on the more disruptive scenarios which lead to lower performance, strongly impacting the results.

We can also notice that the associated worst-case performance, corresponding to the red curve in Figure 5, declines much faster than the expected performance. This is an indication that, with the current ambiguity set, it is not possible to allocate considerable probability mass on the most disruptive scenarios.

Computational performance

The computational performance for the cases presented in Sections 5.1, 5. For the baseline case presented in Section 5.1, the computational cost is highly affordable in every case.

For the sensitivity analysis of the monetary budget B c presented in Section 5.2, the computational cost is generally higher, reaching a maximum of 2385.2 seconds in the case B ci = 900$. For the sensitivity analysis of the parameter K presented in Section 5.3, the computational cost increases as the parameter K increases. This is because more scenarios are included within the analysis, making the optimization more computationally-demanding.

For larger case studies, the computational time might increase considerably, due to the large number of binary variables involved. However, an increased computational cost does not represent an insurmountable problem, for the two following reasons: i) this model is tailored to be utilized during design phases, and long computational times do not pose particular problems, and ii) the complexity of the model can be reduced limiting the feasible number of coupling interfaces according to geographical and physical constraints. For example, one can assume that only nodes within a specific distance range can be coupled together; this would limit the number of y variables involved, thus reducing the complexity and computational cost of the model.

Conclusion

In this paper, we have proposed a novel distributionally robust approach for the optimal coupling of interdependent critical infrastructures, using an illustrative case study representing interdependent power and gas networks. The proposed approach clearly outperforms traditional euclidean coupling strategies based on nodes geographical vicinity, leading to better results in terms of expected performance and worst-case performance under random failures.

In summary, the contributions of this paper are:

• The development of a novel approach, based on distributionally robust optimization, for the design of coupling interfaces between interdependent CIs.

Paper V

A. Bellè, Z. Zeng, M. Sango, and A. Barros, "Resilience enhancement by optimal allocation of redundant interdependency links in interdependent critical infrastructures," Reliability Engineering & System Safety, to be submitted, 2022. The design and the topology of coupling interfaces heavily impacts the resilience of interdependent CIs [3]- [5], and optimizing the topology of coupling interfaces is a fundamental task. In fact, failures and disruption within one CI can propagate to other coupled CIs through the coupling interfaces. In the context of interdependent CIs, the concept of coupling interface optimization was introduced in [4] and [5]. In [4], the authors propose an heuristic approach, based on network metrics such as node distance, degree, and betweenness, to couple interdependent CIs in order to reduce failure propagation. A similar approach, which also accounts for the physical properties of the infrastructures, is proposed in [5]. In both these works, the coupling interface between CIs is acknowledged as one of the key factors for the resilience of CIs. However, as these strategies are based on network metrics, they represent an heuristic approach, which is hardly generalizable and does not ensure the optimality of solutions [3].

In our previous work, we proposed a mathematical programming approach, based on the defender-attacker-defender (DAD) model, to enhance the resilience of interdependent CIs by optimizing the design of their coupling interface [3]. In this work, we maintained the "singledependency" assumption 1 , which states that each node can be dependent on one, and only node of the other infrastructure. This assumption is often used in the existing literature [6]- [11]. However, in reality, a node can be dependent on multiple nodes of another infrastructure, as it is taken into account in [4] and [5].

In this paper, we propose a mathematical programming approach, based on the DAD model, to allocate redundant interdependency links in interdependent CIs in order to enhance their resilience.

Similarly to [3], we focus on enhancing the resilience of interdependent CIs in terms of combined survivability against random failures. The concept of survivability can be defined as "the capability of a system to fulfill its mission in a timely manner in the presence of attacks, failures, or accidents" [12], and it can be interpreted as the residual performance of interdependent CIs after a failure scenario [3]. Survivability is complementary to the concept of vulnerability, defined as the "degree of loss or damage to a system when exposed to a strain of a given type and magnitude" [13]. In other words, we seek to allocate the redundancies in order to maximize the residual performance of interdependent CIs after failures and disruptive events.

The motivations of this work are the following:

• redundancy allocation is a traditional reliability optimization problem [14]. From a research perspective, it is interesting to extend this concept to interdependent CIs and their coupling interfaces. Moreover, redundancies have already been identified to be an effective measure for enhancing the resilience of CIs [15], and investigating their potential, in terms of resilience enhancement, within interdependent CIs is of the utmost importance;

• allocating redundancies in order to retrofit existing coupling interfaces can be an effective measure to enhance the resilience of interdependent CIs [5]: planners and decision-makers should, thus, be provided with the necessary modeling tools to optimize the redundancy allocation.

This paper is presented as an extension of the work published in [3]. For more details on the relevant existing work on coupling interfaces and and their connection to resilience, the reader is 1 The "single-dependency" assumption limits each node of one CI to be dependent on maximum another node belonging to a different CI. In other words, each node can be the receiving end of maximum one interdependency link. However, it is still possible for each node to supply multiple components of a different system. For example, assuming the case of power and gas networks, the "single-dependency" assumption defines that each gas-fired power plant is dependent on one, and only one gas node of the gas network; however, each gas node can supply electricity to multiple gas-fired power plants.

referred to Section 1 of [3].

Problem formulation

Modeling framework

We consider the case of interdependent power and networks (IPGNs). Particularly, we consider a power network P N , containing gas-fired power plants supplied by a gas network GN , which requires electricity from the power network in order to maintain the functionality of valves, compressors, and pumps in each node.

Each network is described by a graph G = (V, E), with V the set of N nodes and E the set of M edges. Each edge k is directed, and it is defined by an origin node O(k) and a destination node

D(k).
The power network is defined by the graph G P N = (V P N , E P N ), where V P N is the set of N P N nodes and E P N is the set of M P N edges. Each node i represents an electrical bus, with power production capacity p i and requested power demand d i . Each edge k represents a power transmission line, characterized by flow capacity f k . The operation of the power network are modeled with a traditional DC power flow model.

The gas network is defined by the graph G GN = (V GN , E GN ), where V GN is the set of N GN nodes and E GN is the set of M GN edges. Each node i represents a gas hub, with gas production capacity p i and requested gas demand d i . Each edge k represents a gas pipeline, characterized by flow capacity f k . The operations of the gas network are modeled with a linear maximum flow model.

The focus of our analysis is the combined performance P C of the IPGNs, defined as in (1):

P C = w P N d P N i∈VP N d i + w GN d GN i∈VGN d i (1)
where w P N and w GN represent the weight of power network and gas network when computing the combined performance. The combined performance represent the fraction of requested demand of power and gas which is possible to supply. The terms d P N and d GN represent the total requested demand of power and gas, respectively, and they are computed as in ( 2) and (3):

d P N = i∈VP N d b i + j∈VGN d M W j (2)
d GN = i∈VGN d b i + j∈VP N d m 3 j . (3)
The term d b i denotes the baseline requested demand (households, industries, general consumers, etc.) of power or gas in each node i. The term d M W j denotes the requested power demand of node j ∈ V GN . The term d m 3 j denotes the requested gas demand of node j ∈ V P N . The term d i represents the supplied demand of power or gas in each node i.

Operational model of interdependent railway and power networks

The power network operations are modeled using a DC power flow model, while the gas network is modeled with a linear maximum flow model. For the operational model of the IPGNs, the following assumptions are considered:

• nodes in the power network with power production capacity p i > 0 contain a gas-fired power plant, and they can be supplied (and, thus, be dependent on) multiple nodes in the gas network. However, it is assumed that each node in the power network is supplied by only one node in the gas network at a time, i.e. only one interdependency link is active and the other ones are in stand-by;

• nodes in the gas network needs to receive electricity for the proper functionality of various equipment, and they can be supplied (and, thus, be dependent on) multiple nodes in the power network. However, it is assumed that each node in the gas network is supplied by only one node in the power network at a time, i.e. only one interdependency link is active and the other ones are in stand-by.

The operational model of IPGNs is described by the optimization in Equation ( 4), subject to Constraints (5)-( 21

): max p,d,f ,θ δ p ∈{0,1} N P N δ g ∈{0,1} N GN µ g←p ∈{0,1} Nc µ p←g ∈{0,1} Nc w P N d P N i∈VP N d i + w GN d GN i∈VGN d i (4)
subject to:

0 ≤ p i ≤ p i , ∀i ∈ V P N ∪ V GN (5) 0 ≤ d i ≤ d b i + j∈VGN µ g←p ji d M W j , ∀i ∈ V P N (6) 0 ≤ d i ≤ d b i + j∈VP N µ p←g ji d m 3 j , ∀i ∈ V GN (7) -u k f k ≤ f k ≤ u k f k , ∀k ∈ E P N ∪ E GN (8) u k x k f k -(θ O(k) -θ D(k) ) = 0, ∀k ∈ E P N (9)
p i -d i + k|D(k)=i f k - k|O(k)=i f k = 0, ∀i ∈ V P N ∪ V GN (10)
d i -δ p i d b i + j∈VGN µ g←p ji d M W j ≥ 0, ∀i ∈ V P N (11)
d i -δ g i d b i + j∈VP N µ p←g ji d m 3 j ≥ 0, ∀i ∈ V GN (12)
p i -p i j∈VGN µ p←g ij δ g j ≤ 0, ∀i ∈ V P N (13)
p i -p i j∈VP N µ g←p ij δ p j ≤ 0, ∀i ∈ V GN (14)
d i -   d b i + j∈VP N µ p←g ji d m 3 j   j∈VP N µ g←p ij δ p j ≤ 0, ∀i ∈ V GN (15)
-

k|O(k)=i j∈VP N µ g←p ij δ p i f k ≤ f k ≤ k|O(k)=i j∈VP N µ g←p ij δ p i f k , ∀k ∈ E GN (16)
-

k|D(k)=i j∈VP N µ g←p ij δ p i f k ≤ f k ≤ k|D(k)=i j∈VP N µ g←p ij δ p i f k , ∀k ∈ E GN (17)
µ g←p ij ≤ y g←p ij , ∀i ∈ V GN , ∀j ∈ V P N (18)
µ p←g ij ≤ y p←g ij , ∀i ∈ V P N , ∀j ∈ V GN ( 19
) j∈VP N µ g←p ij = 1, ∀i ∈ V GN ( 20
) j∈VGN µ p←g ij = 1, ∀i ∈ V P N (21)
The vectors p, d, f , and θ contain the continuous variables of the problem. The variables p i define the production of power or gas in each node, d i defines the supplied demand of power or gas in each node, the variables f k define the flow of power or gas in each edge, and the variablesθ i define the phase angle in each node of the power network. The vectors δ p , δ g , µ g←p , and µ p←g contain shown in Constraint (19). We assume that each node is supplied by only one node of the other infrastructure at a time, as shown in Constraints ( 20) and (21). In other words, if a node i presents multiple interdependency links from the other infrastructure, only one of these links is considered to be active, while the other ones are assumed to be in a stand-by state.

The problem in ( 4)-( 21) is dependent on the coupling interface topology, defined by the binary variables y g←p ij and y p←g ij , contained within the vectors y g←p and y p←g , and the functional states of power lines and gas pipelines, defined by the binary variables u k , contained within the the vector u. The problem in ( 4)-( 21) can be represented as a recourse function Q(y g←p , y p←g , u).

For the sake of simplicity, the problem in ( 4)-( 21) can be represented with the compact matrix formulation in ( 22)-( 23):

max h,δ,µ b T h (22)
subject to:

Rh ≤ q -Tu -Hy -Wδ -Xµ -µ T Dδ. ( 23
)
where the vector h contains the continuous variables, the vector δ contains the binary variables δ p and δ g , the vector µ contains the binary variables µ g←p and µ p←g , the vectors b contains the objective function coefficients, the matrices R, T, H, W, X and D contain the constraints coefficients, and the vector q contains the constraints parameters.

Defender-attacker-defender model

The problem of allocating the redundant interdependency links is modeled as a DAD optimization problem. The inner defender corresponds to the maximization presented in the previous section, which represents the operational model of the IPGNs. The middle attacker aims at minimizing the combined performance of the IPGNs by targeting and failing some components, and it is a representation of various causes of disruption (terrorists, hackers, extreme weather events, etc.).

The outer defender is interpreted as a centralized planner who allocates the redundant interdependency links, aiming at maximizing the combined performance of the IPGNs under the worst-case failure scenario. Within this work, the following assumptions are considered:

• a coupling interface is already existing, and the outer defender seeks to allocate redundant interdependency links between the power network and the gas network;

• allocating redundant interdependency links has a cost which depends on the distance between the two nodes connected by the interdependency link;

• the middle attacker can target and destroy a maximum number of components, and only power lines in the power network can be targeted.

Solution strategy

Similarly to our previous work [3], the DAD optimization problem can be solved efficiently by implementing a Nested Column&Constraint Generation (NC&CG) algorithm [16], [17]. For simplicity, in the following explanation, we rely on the compact matrix formulation of the operational model in ( 22)-( 23). If we fix the binary variables in ( 22)-( 23), the optimization problem is a pure LP problem, and its dual formulation can be expressed as in ( 30)-( 31)

max λ≥0 q -Tu * -Hy * -Wδ * -Xµ * -µ * T Dδ * T λ (30)
subject to:

R T λ = b (31)
where the vector λ contains the dual variables.

Inner layer

With a fixed coupling interface y * , the middle inner-level problem (min-max) allows to identify the worst-case combined performance and the related optimal attack plan. This problem can be solved by following these steps:

1. Set j = 0, lower bound LB in = 0, upper bound U B in = ∞, and D part = ∅ 2. Solve the inner master problem in Equations ( 32)- (35). Obtain an optimal solution ρ (j) and optimal attack plan u (j) . Update LB in = ρ (j) . min ρ,u,λ ρ

subject to:

ρ ≥ q -Tu -Hy * -Wδ * (j) -Xµ * (j)µ * (j)T Dδ * (j) T λ (j) , ∀δ * (j) , µ * (j) ∈ D part (33)

R T λ (j) = b, ∀δ * (j) , µ * (j) ∈ D part ( 34
) k∈EP N (1 -u k ) ≤ K att (35)
3. Solve the inner subproblem in Equations ( 36)-( 37) with u (j) =u * . Obtain an optimal solution b T h (j) , δ j) , and µ

(j) . Set U B in = min(U B in , b T h (j) ). max h,δ,µ b T h (36)
subject to :

Rh ≤ q -Tu * -Hy * -Wδ -Xµ -µ T Dδ (37)
4. If (U B in -LB in )/U B in < 10 -5 , u (j) represents the optimal attack and the algorithm can be terminated. Otherwise, D part = D part ∪ δ (j) ∪ µ (j) . Set j ← j + 1 and return to step 2.

Outer layer

The outer layer is solved by following these steps:

1. Set j = 0, lower bound LB out = 0, upper bound U B out = ∞, and A part = ∅ 2. Solve the outer master problem in Equations ( 38)- (41). Obtain an optimal solution η (j) , and optimal coupling interface y

(j) . Update U B out =min(U B out , η (j) ) max η,y η (38) η ≤ b T h (j) , ∀ u * (j) ∈ A part (39)
Py ≤ g (40)

Rh (j) ≤ q -Tu * (j) -Hy -Wδ (j) -Xµ (j) -µ (j)T Dδ (j) , ∀ u * (j) ∈ A part (41)
where Constraint (40) is the matrix compact form of Constraints ( 25)-( 27).

3. Solve the outer subproblem using the inner layer algorithm with y (j) =y * . Obtain an optimal solution ρ (j) and an optimal attack plan u (j) . Set LB out = ρ (j) .

4. If (U B out -LB out )/U B out < 10 -5 , y (j) is the optimal coupling interface and the algorithm is terminated. Otherwise, A part = A part ∪ u (j) , set j ← j + 1 and return to step 2.

Case-study

We applied our proposed DAD problem to the IPGNs used in [3]. This case-study consists of a power network, containing five gas-fired power plant, supplied by a gas network, which needs electricity from the power network. The power network is built upon the topology of the IEEE 14-bus system [18], while for the gas network the topology of the IEEE 9-bus system is used [19].

The geographical position of the IPGNs is shown in Figure 2. For more details on the case-study, the reader is referred to [3].

We assume that the power and gas network are already coupled with an existing coupling interface. Three different existing coupling interface designs, based on network metrics, are tested:

• distance-based coupling interface (also referred to as Euclidean coupling interface [3]): each node in the gas network presents an interdependency link coming from the closest node in the power network. Each node in the power network containing a gas-fired power plant presents an interdependency link coming from the closest node in the gas network; Power network Gas network • degree-based coupling interface: the node with the k th highest degree in the gas network presents an interdependency link coming from the node with the k th highest degree in the power network. The node with the k th highest degree containing a gas-fired power plant in the power network presents an interdependency link coming from the node with the k th highest degree in the gas network;

• betweenness-based coupling interface: the node with the k th highest betweenness in the gas network presents an interdependency link coming from the node with the k th highest betweenness in the power network. The node with the k th highest betweenness containing a gas-fired power plant in the power network presents an interdependency link coming from the node with the k th highest betweenness in the gas network.

The optimal allocation of redundant interdependency links is investigated with K att from 1 to 5. Four different budgets B ci are used: $100,$200, $300, and $400. The allocation costs c g←p km and c p←g km are 1 $/km. The NC&CG algorithm is solved using Gurobi [20] with an i7-8700@3.20GHz processor and 32 GB RAM.

Results and discussion

The results of the optimal allocation of redundant interdependency links in the distance-based, degree-based, and betweenness-based coupling interface are shown in Figures 3,5, and 7, and Tables 1,2, and 3, respectively. For comparison, the results of the optimal allocation are compared to the results obtained with a random allocation strategy, shown in Figures 4,6 By graphically comparing Figures 3,5, and 7 with Figures 4,6, and 8, we can immediately notice how the optimal allocation of redundant interdependency links clearly outperforms the random allocation strategy, even accounting for the upper bound of the 95% confidence interval. For the distance-based coupling interface, as shown in Figure 3 and Table 1, the relative increase of combined performance from the original coupling interface reaches a percentage equal to 101.21%

for the case K att = 5 and B ci = $400, passing from 0.308 to 0.619. Moreover, as shown in Figure 4, the random allocation strategy does not lead to good results if compared to the optimal allocation, even accounting for the confindence intervals. For example, for the case K att = 5 and B ci = $400, the random allocation strategy leads to combined performance equal to 0.338 ± 0.070. For the degree-based coupling interface, as shown in Figure 5 and Table 2, the relative increases of combined performance are even greater than the previous case. For example, for the case K att = 3 and B ci = $400, the increase of combined performance from the original coupling interface is 347.55% (from 0.204 to 0.913). Moreover, in the original coupling interface, with K att = 4 and K att = 5, the worst-case combined performance are equal to 0, and the allocation of redundant interdependency links allows to considerably improve the worst-case combined performance. For example, for the case K att = 5 and B ci = $400, we can achieve worst-case combined performance equal to 0.641. The results of the random allocation strategy, shown in Figure 6, are considerably lower if compared to the optimal allocation strategy, even considering the confidence intervals. For the betweenness-based coupling interface, as shown in Figure 7 and Table 3, the relative increases of combined performance are similar to the previous case. For example, for the case K att = 4 and B ci = $400, the increase of combined performance from the original coupling interface is 311.27% (from 0.204 to 0.839). Moreover, similarly to the previous case, in the original coupling interface, with K att = 5, the worst-case combined performance are equal to 0, and the allocation of redundant interdependency links allows to considerably improve the worst-case combined performance. For example, for the case K att = 5 and B ci = $400, we can achieve worst-case combined performance equal to 0.730. The results of the random allocation strategy in Figure 8 are again considerably lower if compared to the optimal allocation strategy, even considering the confidence intervals.

Regarding the computational cost of the proposed approach, we refer to the considerations already mentioned in [3], which we briefly recall here:

• in this work, the computational time is acceptable, as for each combination of K att and B ci , the computational time is less than 10 minutes;

• for larger case-studies, the computational time might increase considerably. However, this fact does not represent an problematic issue, as in design problems long computational times are generally not an obstacle;

• the computational cost of the problem can be reduced by limiting the number of binary variables (e.g. limiting the choice of links which is possible to allocate).

Conclusion

In this work, we presented a mathematical programming approach for the optimal allocation of redundant interdependency links in interdependent CIs. A DAD model is used, in order to maximize the combined performance of the interdependent CIs under the worst-case failure scenario. Using

IPGNs as illustrative case-study, the results have demonstrated the great potential, in terms of resilience enhancement, of allocating redundancies within the coupling interface of interdependent CIs. Further developments of this work include different operational model of the IPGNs.

Paper VI

A. Bellè, Z. Zeng, and A. Barros, "Vulnerability analysis of interdependent energy infrastructures with centralized and decentralized operator models," Proceedings of the 32nd European Safety and Reliability Conference, accepted, 2022.

Introduction

Energy infrastructures (EIs) consist of different systems and technologies, such as power networks, gas networks and heat networks. These infrastructures are often interconnected to, and interdependent on each other. For example, heat networks are often dependent on power networks for the production of heat through electric boilers, and on gas networks for the production of heat through gas boilers (Wang et al., 2020). Similarly, power networks can be dependent on gas networks for the production of electricity in gas-fired power plants, and gas networks need electricity from power networks for running pumps, compressors, valves and other equipment (Fang and Zio, 2019). These infrastructures are essential for maintaining vital societal functions, and analyzing their be-haviours in different conditions and ensuring their resilience against disruptive events are key tasks. Despite being interdependent on each other, energy infrastructures are often operated by separate and independent operators. When performing analysis and optimization of energy infrastructures, the behaviour of independent operators should be taken into account. The actions of energy operators are often modeled as the optimization of a function that can represent cost, profit, or dispatch of energy commodities. In the existing literature, the behaviour of independent EIs operators is usually modeled using two different approaches: centralized and decentralized.

In centralized approaches, a unique centralized operator controls the operations of the interdependent EIs, dispatching the corresponding energy In decentralized models, operators are considered to be independent, and they interact within a market-based environment. For example, operators of interdependent power and gas networks interact by purchasing from and selling to each other energy commodities. The purpose of each operator is usually to optimize their own profit or cost, and the interaction between multiple operators is often modeled through game-theoretic approaches. For example, decentralized models have been considered for the expansion planning of interdependent power and gas networks [START_REF] Rad | Joint electricity generation and transmission expansion planning under integrated gas and power system[END_REF][START_REF] Conejo | Operations and long-term expansion planning of natural-gas and power systems: A market perspective[END_REF][START_REF] Qiu | Multi-stage flexible expansion co-planning under uncertainties in a combined electricity and gas market[END_REF], the optimization of urban energy networks [START_REF] Jing | Multi-objective optimization of a neighborhood-level urban energy network: Considering game-theory inspired multi-benefit allocation constraints[END_REF], security-constrained operations of integrated wind and hydrogen systems [START_REF] Mirzaei | Stochastic security-constrained operation of wind and hydrogen energy storage systems integrated with price-based demand response[END_REF] and the risk assessment of interdependent power and heat networks (Wang et al., 2020).

In general, centralized and decentralized approaches lead to different results, but they are both useful in terms of modeling and decision-making.

Centralized models are often used for modeling resilience assessment and enhancement, and decision-making in conditions of disruption. In fact, in conditions of large disruption, independent operators might fully collaborate in a centralized way in order to minimize negative consequences on the general population. In this case, the action of energy operators are usually modeled as the weighted sum of performance metrics of each individual infrastructure.

Decentralized models are useful to model normal conditions, where energy operators behave independently in a market-based environment, in order to optimize their own profit or cost. In this case, the action of energy operators are usually modeled through game-theoretic approaches.

Decision-makers should take these considerations into account. For example, when performing some joint decision-making, such as a joint transmission and/or generation expansion, decision-makers should consider that operators might display decentralized behaviours in normal conditions, by interacting through prices and demands of energy commodities, and centralized behaviours in conditions of disruption, by aiming at maximizing their combined performance.

In this preliminary work, we investigate the impact of decentralized and centralized models by performing a vulnerability analysis of interdependent power and heat networks.

The rest of the paper is organized as follows: in Section 2, the problem formulation is presented; in Section 3, the illustrative numerical example is presented; in Section 4, the preliminary results are shown and briefly analyzed; in Section 5, some preliminary conclusions and future directions are detailed.

Problem formulation

We consider the case-study of interdependent power and heat networks (IPHNs) proposed in Wang et al. (2020). Particularly, we consider a power network P N which supplies electricity to a heat network HN . The heat network is equipped with electric boilers, which need a power supply from the power network, and gas boilers. In this work, gas boilers are assumed to have a reliable gas supply.

Each infrastructure is modeled with a network- The operations of both power and heat network are modeled with a linear maximal flow approach. The models of both the networks consist of the minimization of an objective function g, which depends on the specific operator model (centralized or decentralized), as shown in (1).

min p,d,f g(p, d, f ) (1)
The specific objective functions are detailed in the next sections. The power network is subject to Constraints (2)- (5).

0 ≤ p i ≤ p i , ∀i ∈ V P N
(2) Constraints ( 2) and (3) defines the limit of power production and shedding in each node. The terms p i and d i are the production capacity and the power requested demand in each node, respectively. Constraint (4) bounds the flow of power in each line k, in absolute value, within its capacity f k , if the line is functional (u * k =1). If the line is failed (u * k =0), the flow is enforced to be 0. Constraint (5) ensures that the net power balance in each node is 0. The term d h←p j,i represent the power, supplied to node i ∈ V P N , necessary to produce heat in the electric boiler of node j ∈ V HN (which, thus, depends on node i ∈ V P N ).

0 ≤ d i ≤ d i ∀i ∈ V P N (3)
-u * k f k ≤ f k ≤ u * k f k , ∀k ∈ E P N (4)
The heat network is subject to Constraints ( 6)-(10):

0 ≤ p i ≤ p i , ∀i ∈ V HN (6) 0 ≤ d i ≤ d i ∀i ∈ V HN (7) -u * k f k ≤ f k ≤ u * k f k , ∀k ∈ E HN (8)
p i -(d i -d i ) + k|D(k)=i f k - - k|O(k)=i f k = 0, ∀i ∈ V P N (9)
p i = ηd h←p i,j , ∀i ∈ V HN , j ∈ V P N (10) Constraints ( 6)-( 9), similarly to Constraints (2)-( 5) of the power network, represent limits of heat production and shedding, heat flow, and heat nodal balance. Moreover, if node i ∈ V HN , dependent on node j ∈ V P N , is provided with an electric boiler, its heat production p i is equal to the power supply d h←p i,j

multiplied by the power-to-heat conversion efficiency η, as shown in Constraint (10). We assume that each node in the heat network equipped with an electric boiler is dependent on one node of the power network for the electricity supply.

Load shedding model

For the centralized model, we consider an approach which aims at minimizing the combined load shedding of power and heat. We refer to this model as the load shedding (LS) model. It simply consists of the objective function in (11) (11) subject to Constraints (2)- (10). The terms d P N and d HN represent the total requested demand of power and gas, respectively. As it is clearly visible, the single objective functions for power and heat network (minimization of fractions of power and heat shedding, respectively) are simply aggregated within a single linear programming model. With this model, the two independent operators act in a centralized way in order to minimize the combined fraction of power and heat shedding. Bellè et al.

Game-theoretic cost model

For the decentralized model, we rely on the game-theoretic approach proposed by Wang et al. (2020). We refer to this model as the gametheoretic cost (GT C) model. In this case, operators aims at minimizing their own costs, and they interact by selling and purchasing electricity. In fact, heat operators need to purchase electricity from the power network in order to produce heat in the electric boilers. The operators display a competitive behaviour: power operators aim at selling their electricity at a high price, while the heat operators aim at purchasing it at a low price. In this case, the cost-based objective functions of power and heat network can not be directly aggregated, but they need to be treated with a game-theoretic approach.

The model of the power network consists of the objective function in (12) subject to (2)-( 5) and (13):

β min ≤ β i ≤ β max , ∀i ∈ V P N (13) The cost function consists of three terms:

• the power production cost, where γ power i is the cost per unit of power production in each node i; • the penalty cost associated with power load shedding, where α power i is the penalty per unit of power associated to power load shedding in each node i;

• the profit associated to selling electricity to the heat network, where β i is the selling price per unit of power produced in each node i.

The electricity selling price is a variable which is bounded between a minimum and maximum value, as shown in Constraint (13).

Similarly, the cost model of the heat network consists of the objective function in (14) subject to ( 6)- (10).

The cost function in consists of three terms, respectively:

• the power production cost in gas boilers, where γ heat i is the cost per unit of heat in each node i;

• the cost associated with heat load shedding, where α heat i is the penalty per unit of heat associated to heat load shedding in each node i;

• the cost associated to purchasing electricity from the power network, where β i is the selling price per MW of power, which is seen as a constant by the model.

The two problems are interconnected through the electricity demand of electric boilers in the heat network, given by the terms d h←p j,i , and the electricity prices β i .

Power and heat operators are competing for the electricity prices: power operators aim at increasing prices β i in order to maximize their profit, while heat operators aim at decreasing the electricity price for minimizing their operational costs. If the price is too high, the heat operators will not purchase electricity; if the price is too low, the power operators will reach a sub-optimal solution in terms of cost minimization. This situation can be modeled using game-theory. In this paper, we assume that the power network operators "move" first by setting the price of electricity, and, subsequently, the heat network operator adjust the electricity demands d h←p j,i . This situation leads to a Stackelberg game between the power and heat network operators. Under this assumption, as proposed in Wang et al. (2020), the two optimization problems can be recast into a single one by replacing the model of the heat network with its Karush-Kuhn-Tucker (KKT) conditions. For simplicity, we rely directly on a compact matrix formulation. For more details on the single-level reformulation The single-level Stackelberg game between power and heat operators can, thus, be formulated as the objective function in (15), subject to ( 13) and ( 16)- (20).

min h c T h ( 15
)
subject to:

R in h -b in ≤ 0 (16)
R eq hb eq = 0 (17

)
∇c T h + λ∇R in h + µ∇R eq h = 0 (18)

λ(R in h -b in ) = 0 (19)
λ ≥ 0

Equation ( 15) represents the objective function in (12). Constraints (16) and (17) represents the primary constraints of power and heat networks, previously shown in Equations ( 2)- (10). Constraints ( 18)-(20) represents stationarity conditions, complementary slackness, and nonnegativity of the KKT conditions of the heat network model (Equation ( 14) subject to Constraints (6) (10)).

The term h represents the continuous primary variables p, d and f , while λ and µ represent the dual variables of inequality and equality constraints of the heat network, respectively. The vector c contains the coefficients of the objective function, while the matrices R in and R eq contain the coefficients of inequality and equality constraints of both power and heat networks. The vectors b in and b eq contain the constraints parameters.

The solution of this optimization problem leads to the minimized equilibrium costs for power and heat networks under the assumption of a Stackelberg game.

Numerical example

The case study is built upon the one proposed in Wang et al. (2020). The reader is referred to Figure 5 of Wang et al. (2020) for a graphical visualization. We assume that the heat network is composed by 32 nodes connected of 32 edges [START_REF] Liu | Combined analysis of electricity and heat networks[END_REF]. Each node is characterized by a requested demand of heat supply that ranges from 0 to 0.145 MW, for a total demand of 2.164 MW. The heat network is provided with one 1 gas boiler and 3 electric boilers, each of them with a production capacity of 0.8 MW. Each edge has a flow capacity of 1 MW.

The three electric boilers need electricity, and they are supplied by three nodes of the power network, composed of 33 nodes and 32 edges ( [START_REF] Baran | Network reconfiguration in distribution systems for loss reduction and load balancing[END_REF]. Each node is characterized by a requested power demand, ranging from 0 to 0.121 MW, for a total demand of 3.655 MW. The power network is equipped with a generator with capacity of 3.5 MW, and four additional generators with a capacity of 0.5 MW. Each edge has a power flow capacity of 3.5 MW.

The electricity price boundaries are set as β min =$200 and β max =$1000. The penalty values α power i and α heat i for each node are set between β min and β max . The power and heat production cost γ power i and γ heat i are set to $50. The powerto-heat efficiency η is set to 0.8.

We perform a preliminary vulnerability analysis by solving the LS model and the GT C model for every possible combinations of N -1, N -2, and N -3 line contingencies in the power network. The results are evaluated for both the models in terms of average power and heat load shedding and average cost. The cost in the LS model is computed using the equilibrium electricity prices β i identified by the GT C model under the same contingency scenario.

This illustrative case-study represents a numerical example to analyze the results of the two models and draw some preliminary considerations.

The computations are implemented in Gurobi 9.1 Gurobi Optimization (2021) and performed on a laptop with a 2.60 GHz CPU and 16 GB RAM. Bellè et al.

Preliminary results

The results in normal conditions (no failed lines), in terms of load shedding and cost, are shown in Tables 1 and2 . We can immediately notice how the two models lead to different results, even in normal conditions. In terms of shedding, the LS model, as expected, leads to no load shedding of power or heat. However, the GT C model leads to a fraction of heat shedding equal to 0.186. A reduction of the heat shedding fraction would imply an electricity purchase with a price above the equilibrium price and, thus, an increase of cost. In addition, the LS model leads to a lower average cost. In fact, the heat operators, aiming at minimizing their load shedding, purchase more electricity from the power network. This contributes to increase the cost of the heat network and decrease the cost of the power network. However, despite the average cost being lower, these values do not represent an equilibrium solution.

The results of the preliminary vulnerability analysis are shown in Figures 123456. The bar plots denotes the average values of load shedding fraction and cost for both models and N -1, N -2, and N -3 power line contingencies.

The results in terms of load shedding for the combined networks, the power network, and heat network are shown in Figures 1,2, and 3. As it was expected, in Figure 1, we can notice that the LS model leads to lower level of average combined load shedding in all the three contingency scenarios evaluated. However, as it can be seen in Figures 2, and3, the same consideration is not valid for the individual load shedding in power and heat networks. In fact, the GT C model leads to fraction of load shedding lower than the LS model in the power network, and considerably higher than the LS model in the heat network. However, overall, the GT C model leads to higher levels of combined load shedding. The results in terms of cost for the combined networks, the power network, and heat network are shown in Figures 4,5, and 6, respectively. Firstly, looking at the total cost of power and heat network in Figure 4, we notice that for the cases N -2, and N -3, the GT C model leads to lower average costs; however, for the case N -1, the LS model leads to a slightly lower average cost (the difference is small, less than $1). For understanding this behaviour, the individual costs of power and heat network, in Figures 5 and6, need to be analyzed. In fact, if we look at the power network cost in Figure 5, we can notice for the case N -1 the LS model leads to a considerably lower cost. However, if we look at the heat network cost in Figure 6, we see that the LS model leads to a higher cost. These are the results of the minimization of load shedding: in fact, the heat operators, when modeled with the LS model, aiming at minimizing the heat load shedding, purchase more electricity that they would with the priceaware GT C model. As a consequence, the power network sells more electricity, which is purchased by the heat network. In conclusion, in terms of cost, similarly to the case in Tables 1 and2, the LS model leads to solutions far from the optimal equilibrium of the GT C model.

Conclusion

With these preliminary results, we show how centralized and decentralized models lead to different results, in terms of cost and shedding, both in normal and disrupted situations. operators of different infrastructures, and they are useful in disrupted conditions, when the objective, rather than minimizing a cost, is to restore the infrastructures functionality as rapidly as possible.

In conclusion, centralized and decentralized models lead to different solutions in terms of energy dispatch, as they are based on different ob-A distributionally robust approach for the optimal protection of power networks with endogenous uncertainty Andrea Bellè * Yi-Ping Fang * Zhiguo Zeng * Anne Barros *

INTRODUCTION

Power networks are among the most important infrastructures for any society, as they provide private and public customers with electricity. Failures and disruption within power networks can lead to considerable negative consequences (Garcia Tapia et al., 2019). The protection of power networks components, i.e., to reinforce them and make them invulnerable to external attacks and hazards, is an effective measure to decrease the vulnerability of power networks and increase the performance in disruptive conditions [START_REF] Yuan | Optimal power grid protection through a defender-attacker-defender model[END_REF]. Due to technical and economical constraints, often, only a limited number of components can be protected. The set of components to protect, which constitutes the protection plan, must then be optimized.

Various works have proposed frameworks for the optimization of protection plans, relying on the traditional defender-attacker-defender (DAD) model, adaptive robust optimization and distributionally robust optimization.

In the DAD framework, the decision maker seeks to identify the optimal protection plan against the worst-case scenario within a set of feasible failure/attack scenarios (in this work, the words failure/failed and attack/attacked are used interchangeably). For example, in Ouyang (2017), the author exploits a DAD approach to identify the optimal protection plan against spatially-localized attacks in interdependent power and water networks; similarly, in Ouyang and Fang (2017) and [START_REF] Yuan | Optimal power grid protection through a defender-attacker-defender model[END_REF], the authors provide the optimal protection plan for a power network against attacks and failures.

When the decision maker has information on the failure probability of specific components, an adaptive robust approach can be used. For example, in Fang and Zio (2019), the optimal protection plan for interdependent power and gas networks against typhoons is computed with an adaptive robust approach, accounting for the fragility curves of the power network components and the confidence level of the decision maker.

If distributional information on the failure probability of components is available, a distributionally robust approach can also be applied. For example, in Zhang et al.

(2020), the optimal protection plan is identified with a distributionally robust approach, where the probability distribution of feasible failure scenarios is ambiguous. Within this framework, the probability of each scenario is unknown and ambiguous, and contained within an ambiguity set in which moment information of the probability distribution are encoded. A similar approach is applied in Bagheri and Zhao (2019), where the optimal protection plan is identified with a distributionally robust approach under a Nk security criterion.

Distributionally robust approaches have recently attracted the attention of several researchers, thanks to their ability to protect decision maker from the ambiguity which often affects the probability distribution of failure/attack scenarios (Rahimian and Mehrotra, 2019). Within the framework of power network optimization, various recent works have applied distributionally robust approaches. For example, in Babaei et al. (2020), the authors propose a DRO approach for the optimal power network configura-tion under random failures. In Zhao and Jiang (2017), a contingency-constrained unit commitment model is proposed using DRO. In Alvarado et al. (2018), a transmission expansion planning with distributionally robust security is proposed.

In general, in a distributionally robust framework, a decision maker seeks to identify the decision plan z which is robust against the worst probability distribution in the ambiguity set. However, first-stage decisions z can also affect the probability distributions contained within the ambiguity set, which is then dependent on z (decisiondependent ambiguity set). We refer to this situation as distributionally robust optimization with endogenous uncertainty. The reader is referred to Luo When a distributionally robust approach, such as that in Zhang et al. (2020) and Bagheri and Zhao (2019), is used for the optimal protection plan of a power network, the ambiguous distribution is related to the occurrence probability of the feasible failure/attack scenarios. When we protect an element, such as a transmission line, its failure probability is reduced. Consequently, the occurrence probability of each scenario that implies the failure of a protected line changes. Thus, the ambiguity set is decisiondependent, as it can be modified by the protection plan.

To the best of our knowledge, optimal protection plans of power networks with a distributionally robust approach which accounts for this endogenous uncertainty through a decision-dependent ambiguity set have not been investigated.

In this work, we propose a distributionally robust framework for identifying optimal protection plans in power networks with endogenous uncertainty. In our preliminary results, we highlight the difference in results between the cases with and without endogenous uncertainty.

PROBLEM FORMULATION

Power network modeling

A network is a mathematical construct described by a graph G = (V, E), with the set V containing N nodes and the set E containing M edges. Each edge k is directed, and it is defined by an origin node O(k) and a destination node D(k). Each node i is characterized by a production capacity p i and a requested demand d i , while each edge k is defined by a flow capacity f k (Bellè et al., 2021).

Power networks are usually modeled using power flow models, such as the DC optimal power flow (Fang and Sansavini, 2017). For the sake of simplicity, in this work, the power network is modeled using a linear maximal flow model, which is an approximation for flow-based infrastructures [START_REF] González | The interdependent network design problem for optimal infrastructure system restoration[END_REF]. The purpose of power network operators is to maximize the performance of the power network. The performance is expressed in terms of fraction of requested power demand which is supplied, as shown in Equation (1): max p,d,f

i∈V d i i∈V d i (1)
where d i and d i represents the supplied and requested power demand at bus i, respectively. The optimization in (1) is subject to the constraints of the maximal flow model, shown in Equations ( 2)-( 6):

0 ≤ p i ≤ p i , ∀i ∈ V (2) 0 ≤ d i ≤ d i , ∀i ∈ V (3)
f k ≥ -f k ((z k ) + u k (1 -z k )), ∀k ∈ E (4)
f k ≤ f k ((z k ) + u k (1 -z k )), ∀k ∈ E (5)
p i -d i + D(k)=i f k - O(k)=i f k = 0, ∀i ∈ V (6)
Constraint (2) bounds the power production in each node p i between 0 and the maximum production capacity p i . Similarly, the supplied power demand d i is bounded between 0 and the requested demand d i , as shown in Constraint (3).

Constraints (4) and ( 5) limit the flow in each line, in absolute value, to the maximum capacity f k . The term ((z k ) + u k (1z k )) governs the functionality of line k.

If a line k is protected, the variable z k = 1 and the line is considered to be invulnerable, similarly to other works in the existing literature, e.g. Ouyang and Fang (2017); otherwise, the variable z k = 0. If a line is attacked (in this work, the word attacked and failed are used interchangeably), the variable u k = 0; otherwise, the variable u k = 1. In this way, if line k is unprotected (z k = 0) and attacked/failed (u k = 0), its flow f k is forced to be 0; otherwise, the flow f k is bounded between -f k and f k . We highlight that the binary variables z k and u k do not appear under the maximization in Equation (1). This is because these are variables of the full DRO formulation. More details are available in the following subsections.

Constraint (6) ensures that the net power balance in each node is equal to 0.

For the sake of clarity, we can express the optimization problem in (1)-( 6) with its compact matrix formulation, shown in Equations ( 7)-( 8)

max h b T h (7)
subject to: Rh ≤ q -Tu -Hzz T Du (8) where h = { p, d, f } are the continuous variables, z and u are the binary variables, b is the vector with the objective function coefficients, R, T, H, and D are the matrices with the constraints coefficients, and q is the vector with the constraints constants. Equation (7) represents Equation (1), while Constraint (8) represents Constraints (2)-(6).

Ambiguity set without endogenous uncertainty

In this work, the uncertainty represents the conditional occurrence probability of the feasible failure scenarios contained in the set of feasible failure scenarios F, where the condition is that at least one component has failed. We assume that only edges can fail and we rely on a set of feasible attack/failure scenarios based on the maximum number of attacked/failed edges K att . The set F is then defined as in Equation ( 9):

F = {u | {0, 1} M , ||u|| 1 ≥ M -K att } (9)
where K att is the maximum number of lines that can fail and u is a vector containing the functional state of each line. The k th element of u is u k = 1 if line k functional, and u k = 0 if it is attacked/failed. Assuming that the scenarios in F are mutually exclusive, and given the condition that at least one of the lines is attacked/failed, the conditional probability of each scenario to have occurred is defined by a multinomial distribution.

In a DRO approach, the probability distribution of the uncertainty is unknown and ambiguous, and it is contained within an ambiguity set D, which contains all the distribution that can describe the uncertainty and respect some given conditions. Similarly to other existing works, such as Babaei et al. (2020), we rely on a moment-based ambiguity set which restricts the marginal probability of each line k to be attacked/failed between 0 and an upper bound π max k . The ambiguity set without endogenous uncertainty is defined in Equation ( 10): D = {P ∈ P(F) : 0 ≤ E P [1u] ≤ π max } (10) where P(F) defines the set of all probability distributions on a σ-algebra of F, and π max is the vector containing the upper bounds of the conditional marginal failure probabilities of each power transmission line. We highlight that the upper bounds π max can be estimated from historical data and reliability analysis (Babaei et al., 2020).

Ambiguity set with endogenous uncertainty

When we protect a power line, we assume that it becomes invulnerable. As a consequence, we can assume that the conditional marginal failure probability of each protected line is 0. The protection plan can, thus, modify the ambiguity set and it represents a source of endogenous uncertainty. The decision-dependent ambiguity set D(z) is defined as in Equation ( 11): D = {P ∈ P(F) : 0 ≤ E P [1u] ≤ π max (z)} (11) where the decision-dependent upper bounds are defined as in Equation ( 12):

π max (z) = M (1 -z) T π max T M -K def ( 12
)
where M is the number of edges, z is a vector containing the protection plan (z k = 1 if line k is protected, z k = 0 otherwise) and K def is the parameter, set by the decisionmaker, that defines the number of protected lines. The term M/(M -K def ) is a scaling factor for each upper bound π max k . In fact, if line k is protected, all the scenarios implying line k to be failed can not occur, and the conditional probability of the other scenarios increase. Consequently, the upper bounds π max need to be increased.

DRO formulations

We define two DRO formulations, one without endogenous uncertainty, and one with endogenous uncertainty, where the ambiguity set is dependent on the protection plan z.

The DRO without endogenous uncertainty corresponds to Equation (13): max

z min P∈D E P [Q(z, ξ)] (13)
subject to (10) and ( 14):

k∈E z k = K def (14)
and where the recourse function Q(z, ξ) corresponds to the optimization in (7) subject to (8).

The DRO model with endogenous uncertainty is defined as in (15): max z min P∈D(z)

E P [Q(z, ξ)] (15)
subject to (11) and (14).

In both the formulations, a decision maker seeks to identify the optimal protection plan z that maximizes the expected performance of the power network in disrupted conditions. The expected performance are computed considering the worst multinomial distribution contained in the ambiguity set D or D(z). In this work, we investigate the impact of considering the endogenous uncertainty within the optimization of the protection plan.

SOLUTION PROCEDURE

Reformulation

We recast the problem into a tractable form, based on the reformulation presented in Babaei et al. (2020), and we solve it with a column and constraint generation (C&CG) approach [START_REF] Zeng | Solving two-stage robust optimization problems using a column-and-constraint generation method[END_REF]. For simplicity, we derive the reformulation only for the case with endogenous uncertainty. The reformulation for the case without endogenous uncertainty can be derive in a similar way.

For a fixed protection plan z * , the inner stage of ( 13) is equivalent to Equation ( 16) subject to (17) and (18):

min P F Q(z, ξ)dP (16)
F dP = 1 ( 17)

F (1 -u k )dP ≤ π max k (z k ), ∀k ∈ E ( 18
)
where π max k (z k ) is the k th element of π max (z), defined as in (19):

π max k (z k ) = M (1 -z k )π max k M -K def . (19)
Formulation( 16)-( 18) is convex in P and it satisfies Slater's conditions. The dual form of the inner level of ( 13) is shown in (20):

max α,β≥0 -α - k∈E β k π max k (z k ) (20)
subject to:

α + k∈E β k (1 -u (i) k ) ≥ -Q(z, ξ) ∀u (i) ∈ F (21)
and where α and β are the dual variables. The optimal value -α corresponds to (22):

-α = min

u (i) ∈F Q(z, ξ) + k∈E β k (1 -u (i) k ). ( 22
)
By substituting (22) in (20) and explicitly expressing Q(z, ξ), we obtain the reformulation in (23):

max β≥0 min u∈{0,1} max h b T h + k∈E β k (1 -u k -π max k (z k )) (23)
subject to ( 8) and ( 24):

k∈E u k ≥ M -K att ( 24
)
where Constraint (24) defines the condition on the maximum failed lines K att as denoted in the set F in Equation (9). For a fixed failure scenario u * and fixed dual variables β * , the inner level of ( 23) is an LP problem. By taking its dual form and merging it with the outer and middle levels of ( 23) and the outer level of (15), we obtain the bilevel formulation in (25): max z,β min λ,u (q -Tu -Hzz T Du) T λ (25)

+ k∈E P N β k (1 -u k -π max k (z k ))
subject to ( 14), ( 24) and ( 26):

R T λ = b (26) where λ represents the dual variables of (8). For simplicity, we report directly the compact matrix formulation. In this form, the problem can be recast and solved directly with a C&CG algorithm.

The reformulation for the case without endogenous uncertainty is obtained by simply substituting the decisiondependent upper bounds π max (z) with the upper bounds π max .

Column&Constraint Generation algorithm

We report the main steps of the C&CG approach for the case with endogenous uncertainty. The main steps for the case without endogenous uncertainty can be derived by substituting the decision-dependent upper bounds π max (z) with the upper bounds π max .

The C&CG algorithm is a traditional cutting-plane strategy. It involves the split of the original problem into a master problem and a subproblem which iteratively exchange binary decision variables. The optimal solution is found by following these steps:

(1) Set i = 0, upper bound U B = ∞, lower bound LB = 0 and F part = ∅. (2) Solve the master problem in Equations ( 27)- (29).

Obtain an optimal solution ρ (i) , optimal variables β (i) , and an optimal protection plan z (i) . Update U B=min U B, ρ (i) . max ρ,z,h,β ρ

subject to ( 14), ( 28) and ( 29): :

ρ ≤ b T h (i) + k∈E P N β k (1 -u * (i) k -π max k (z k )) (28)
Rh (i) ≤ q -Tu * (i) -Hzz T Du * (i) (29) where Constraints ( 28) and ( 29) are defined ∀u * (i) ∈ F part . (3) Solve the subproblem in Equations (30) with z (i) =z * and β (i) =β * . Obtain an optimal solution and an optimal attack plan u (i) . Update the lower bound LB. min λ,u∈{0,1}

(q -Tu -Hz *z * T Du) T λ (30)

+ k∈E P N β * k (1 -u k -π max k (z k ))
subject to (24) and ( 26). ( 4) If (U B -LB)/U B < 10 -4 , the current solution z (i) corresponds to the optimal protection plan and the algorithm can be terminated. Otherwise, F part = F part ∪ u (i) . Set i ← i + 1 and return to step 2.

NUMERICAL EXAMPLE

We perform a numerical experiment using an illustrative case study based on the topology of the IEEE 14-bus system [START_REF] Iyambo | Transient stability analysis of the ieee 14-bus electric power system[END_REF], shown in Figure 1. The power network is, thus, composed of 14 buses connected by 20 transmission lines. Each bus presents a requested power demand of 14 MW. Buses 1, 2, 3, 6, and 8 present a production capacity of 40 MW. The flow capacity of each line is 22 MW.

For each upper bound π max k , we assume a value of 0.2. We compute the optimal protection plan with and without endogenous uncertainty for values of K def and K att ranging from 1 to 4.

All the computations are performed on a desktop PC with a 3.20 GHz CPU and 32 GB RAM using the Python API of Gurobi 9.1 (Gurobi Optimization, LLC, 2021).

The results for different combinations of K def and K att are shown in Figure 2. From these preliminary results, some important considerations can be drawn.

As it was expected, the expected performance in both the cases -with and without endogenous uncertaintyincreases as K def increases and K att decreases.

In addition, we can notice that the expected performance with endogenous uncertainty is always lower than (or equal to) the expected performance without endogenous uncertainty. Moreover, the difference between the two cases increases as K def and K att increase. In fact, the maximum difference is reached for the case with K def = 4 and K att = 4, where the expected performance with and without endogenous uncertainty take a value of 0.8061 and 0.8374, respectively. In fact, as expected, changing the probability space from which the multinomial distribution is chosen has an impact on the expected performance in disrupted conditions.

Most importantly, we compare the optimal protection plans identified with and without considering the endogenous uncertainty. As it can be seen in Figure 2, in 9 out of the 16 combinations of K def and K att investigated, the protection plans for the two uncertainty cases are different (blue vertical lines). Moreover, the optimal protection plans identified without endogenous uncertainty are not guaranteed to be optimal when considering endogenous uncertainty. For example, with K def = 4 and K att = 4, an optimal solution for the case without endogenous uncertainty consists in protecting the lines with indices 2, 9, 10, and 14. This protection plan is suboptimal for the case with endogenous uncertainty, as it leads to expected performance of 0.8035, instead of 0.8061, which is attainable, for example, by protecting the lines with indices 2, 6, 9, and 13. In this specific case, the suboptimality leads to limited negative consequences in terms of expected performance in disrupted conditions with endogenous uncertainty. However, the negative impact of suboptimal solutions is strongly dependent on the case-study considered, and a thorough sensitivity analysis on size and parameters of the case-study should be performed. It should also be highlighted that common optimal solutions, for the cases with and without endogenous uncertainty, can exist.

Including the endogenous uncertainty within the optimization problem has also an impact on the computational performance. In fact, the computational time when including the endogenous uncertainty increases considerably.

For example, with K def = 4 and K att = 4, the case without endogenous uncertainty leads to a computational time of 3.2 seconds, while for the case with endogenous uncertainty the computational time is 218.7 seconds.

CONCLUSION

In this work, we proposed a distributionally robust approach with endogenous uncertainty for the protection plan of power networks. Preliminary results have highlighted the importance of including the endogenous uncertainty in optimal protection planning. We showed how including endogenous uncertainty through decisiondependent ambiguity sets impacts the expected performance and the optimal protection plan decision.

Further extensions of this work include: i) a more comprehensive sensitivity analysis of the DRO parameters, such as upper bounds π max , parameters K def and K att , and scaling factor for the decision-dependent upper bounds, ii) a thorough comparison between the optimal protection plans identified with and without endogenous uncertainty, in order to quantify their difference in terms of expected performance in the two different probability spaces (with and without endogenous uncertainty), and iii) a detailed analysis of the computational performance of the optimization problem.

3. 1

 1 Cost of network metrics-based coupling interfaces. . . . . . . . . . . . . . . . . . . . . . . 3.2 Scenarios within the set A for the power network in Figure 3.7 and corresponding performance. 3.3 Upper bounds π max k for each power line k. . . . . . . . . . . . . . . . . . . . . . . . . . . 3.4 Results of the optimal allocation of redundant interdependency links in terms of worst-case combined performance and relative increase in percentage from the original case.

  Figure based on Paper I [14]. . . . . . . . . . . . . . . . . . . . . . 1.3 Traditional resilience curve with resilience phases. . . . . . . . . . . . . . . . . . . . . . . 2.1 Proposed cascading failure algorithm for IRPNs. Figure from Paper I [14]. . . . . . . . . . 2.2 Geographical representation of the British IRPNs, based on Figure 3 of Paper I [14]. . . . . 2.3 Network-of-networks representation of the British IRPNs, based on Figure 4 of Paper I [14]. 2.4 Average loss of accessibility in the railway network due to different fractions of edges removed in the power network. Figure from Paper I [14]. . . . . . . . . . . . . . . . . . . . . . . . 2.5 Average FDNS in the power network due to different fractions of edges removed in the power network. Figure from Paper I [14]. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.6 Network-of-networks configuration of the French IRPNs, based on Figure 1 of Paper II [78]. 2.7 Fraction of demand not supplied F DN S in the power network and traction network. Figure based on the results of Paper II [78]. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.1 Geographical representation of the IPGNs. Figure from Paper IV [79]. . . . . . . . . . . . 3.2 Illustrative IPGNs. The dashed lines represent the interdependency links, i.e. the coupling interface of the IPGNs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.3 Illustrative IPGNs with modified coupling interface. . . . . . . . . . . . . . . . . . . . . . 3.4 General flowchart of the Nested Column&Constraint Generation algorithm. Picture based on Paper III, Paper IV, and Paper V [10], [79], [80]. . . . . . . . . . . . . . . . . . . . . . 3.5 Combined performance in the worst-case feasible failure scenario with network metrics-based coupling strategies. Figure from Paper III [10]. It should be highlighted that, since multiple Euclidean coupling interfaces exist, for each value K att , the plot represents the best performing Euclidean coupling interface. . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.6 Combined performance in the worst-case feasible failure scenario with optimal coupling strategies. Figure from Paper III [10]. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.7 Toy model of a power network. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.8 Results of the distributionally robust optimal coupling of IPGNs. Revised version of Figure 3 of Paper IV [79]. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.9 Representative IPGNs with redundant interdependency links. . . . . . . . . . . . . . . . . 3.10 Results of the optimal allocation of redundant interdependency links in terms of worst-case combined performance, with different values of K att and B ci . Figure from Paper V [80]. .

vii 3 .

 3 11 Average results of the random strategy allocation of redundant interdependency links in terms of worst-case combined performance, with different values of K att and B ci . Figure from Paper V [80]. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.1 Power network of the IPHNs. Figure based on [138]. . . . . . . . . . . . . . . . . . . . . . 4.2 Heat network of the IPHNs. Figure based on [138]. . . . . . . . . . . . . . . . . . . . . . 4.3 Average combined shedding in the IPHNs with different operator models and number of failed power lines. Figure adapted from Paper VI [132]. . . . . . . . . . . . . . . . . . . . 4.4 Average combined cost in the IPHNs with different operator models and number of failed power lines. Figure adapted from Paper VI [132]. . . . . . . . . . . . . . . . . . . . . . .

Figure 1 . 1 :

 11 Figure 1.1: Example of interdependent networks. The two networks, in red and blue, consist of nodes connected by edges. Nodes belonging to different networks are connected by dashed black edges, also referred to as interdependency links, that represent relationships of interdependency. Figure from Paper III [10].

Figure 1 . 2 :

 12 Figure 1.2: Example of CIs represented as networks. In red, the Great Britain reduced power transmission network [41] is shown. In blue, the proposition for a new highspeed British railway network made in [42] is shown. Figure based on Paper I [14].

  Figure 1.2: Example of CIs represented as networks. In red, the Great Britain reduced power transmission network [41] is shown. In blue, the proposition for a new highspeed British railway network made in [42] is shown. Figure based on Paper I [14].

Figure 1 . 3 :

 13 Figure 1.3: Traditional resilience curve with resilience phases.

2 .

 2 remove failed components and go to Step 3; 3. run DC-OPF in Equations (2.2)-(2.8) and go to Step 4; 4. check the loading fraction f k /f k for each line k. If f k /f k ≥0.99, line k fails with probability p ol ∈ [0, 1]. Go to Step 5; 5. if at least one line failed at Step 4, return to Step 2; otherwise, the algorithm is terminated.

Figure 2 . 1 :

 21 Figure 2.1: Proposed cascading failure algorithm for IRPNs. Figure from Paper I [14].

Figure 2 . 2 :

 22 Figure 2.2: Geographical representation of the British IRPNs, based on Figure 3 of Paper I [14].

Figure 2 . 3 :

 23 Figure 2.3: Network-of-networks representation of the British IRPNs, based on Figure 4 of Paper I [14].

21

 21

Figure 2 . 4 :

 24 Figure 2.4: Average loss of accessibility in the railway network due to different fractions of edges removed in the power network. Figure from Paper I [14].

Figure 2 . 5 :

 25 Figure 2.5: Average FDNS in the power network due to different fractions of edges removed in the power network. Figure from Paper I [14].

Figure 2 . 6 :

 26 Figure 2.6: Network-of-networks configuration of the French IRPNs, based on Figure 1 of Paper II [78].

Figure 2 . 7 :

 27 Figure 2.7: Fraction of demand not supplied F DN S in the power network and traction network. Figure based on the results of Paper II [78].

Figure 3 . 1 :

 31 Figure 3.1: Geographical representation of the IPGNs. Figure from Paper IV [79].

Figure 3 . 2 :

 32 Figure 3.2: Illustrative IPGNs. The dashed lines represent the interdependency links, i.e. the coupling interface of the IPGNs.

Figure 3 . 3 :

 33 Figure 3.3: Illustrative IPGNs with modified coupling interface.

Figure 3 . 4 :

 34 Figure 3.4: General flowchart of the Nested Column&Constraint Generation algorithm. Picture based on Paper III, Paper IV, and Paper V [10], [79], [80].

Figure 3 . 6 :

 36 Figure 3.6: Combined performance in the worst-case feasible failure scenario with optimal coupling strategies. Figure from Paper III [10].

Figure 3 . 7 :

 37 Figure 3.7: Toy model of a power network.

Figure 3

 3

22 )

 22 subject to (3.7)-(3.11) and (3.23):

  22), subject to (3.7)-(3.11) and (3.23), is equivalent to the problem in (3.24) subject to (3.7)-(3.12):

Figure 3 . 8 :

 38 Figure 3.8: Results of the distributionally robust optimal coupling of IPGNs. Revised version of Figure 3 of Paper IV [79].

Figure 3 . 9 :

 39 Figure 3.9: Representative IPGNs with redundant interdependency links.

( 3 . 25 )

 325 subject to Equations (3.26)-(3.29): max y∈{0,1} Nc min u∈{0,1} M P N Q r (y, ξ) (3.25)

  .

  4.

Figure 3 . 10 :

 310 Figure 3.10: Results of the optimal allocation of redundant interdependency links in terms of worst-case combined performance, with different values of K att and B ci .

Figure

  Figure from Paper V [80].

Figure 3 . 11 :

 311 Figure 3.11: Average results of the random strategy allocation of redundant interdependency links in terms of worst-case combined performance, with different values of K att and B ci . Figure from Paper V [80].

Figure 4 . 1 :

 41 Figure 4.1: Power network of the IPHNs. Figure based on [138].

Figure 4 . 2 :

 42 Figure 4.2: Heat network of the IPHNs. Figure based on [138].

( 4 .

 4 15)-(4.19) are equivalent to Constraints (4.2)-(4.5) and (4.7) of the centralized approach.

( 4 . 22 )

 422 where (4.21) and (4.22) represent the inequality and equality constraints, previously shown in Constraints (4.15)-(4.19), and they correspond to the primal feasibility of the KKT conditions. With λ and µ being the vectors of dual variables of Constraints (4.21) and (4.22), the other KKT conditions (stationarity, complementary slackness, and dual feasibility) are shown in Equations (4.23)-(4.25), respectively:

Figure 4 . 3 :

 43 Figure 4.3: Average combined shedding in the IPHNs with different operator models and number of failed power lines. Figure adapted from Paper VI [132].

Figure 4 . 4 :

 44 Figure 4.4: Average combined cost in the IPHNs with different operator models and number of failed power lines. Figure adapted from Paper VI [132].

( 4 . 34 )

 434 subject to (4.2)-(4.7), (4.13), and

zz

  and Constraints (4.40)-(4.42) [10]: ≥ x + y -1.

  (4.50) subject to (4.2)-(4.7), (4.13), (4.35)-(4.39) and all the additional linearization constraints in the forms in Equations (4.40)-(4.42), (4.43)-(4.45), and (4.47)-(4.48). min y∈{0,1} Nc max P∈S E P [L(y, ξ)](4.50)

( 1 -( 4 . 53 )

 1453 (4.50) is equivalent to the problem in (4.51) subject to (4.52)-(4.53): u k )dP ≤ π max k , ∀k ∈ E P N : ζ k . The problem in (4.51)-(4.53) is convex in P, and since Slater's conditions are satisfied, strong duality holds. The dual formulation of (4.51)-(4.53) is shown in Equation (4.54)-(4.55): min τ,ζ≥0

  .4 in the previous chapter. The full formulation of the linearized tractable equivalent formulation of the DRO model consists of Equation (4.57) subject to (4.2)-(4.7), (4.13), (4.35)-(4.39) and all the additional linearization constraints in the forms in Equations (4.40)-(4.42), (4.43)-(4.45), and (4.47)-(4.48).

5. 1 .

 1 Vulnerability of railway and power networks 5.1.1 . Contributions In Chapter 2, based on the work contained in Paper I and Paper II, the vulnerability of interdependent railway and power networks (IRPNs) is investigated.

(A. 24 )

 24 Py ≤ g (A.25) B -Karush-Kuhn-Tucker conditions of the decentralized heat network model The decentralized operational model of the heat network corresponds to Equation (B.1) subject to Constraints (B.2)-(B.6):

103

 103

Fig. 1 .

 1 Fig. 1. Flowchart of the cascading failures algorithm for interdependent railway and power networks.

  ); otherwise, it proceeds with Step 8, where we check for overloaded lines. In Step 5, if a railway track 𝑖 is failed, each substation 𝑗 in 𝐕 𝐫,𝐢 𝐭 is added to the set 𝐍 𝐝𝐢𝐫 𝐟 if 𝑆 𝑡,𝑗 = 0, or to 𝐍 𝐢𝐧𝐝 𝐟 if 𝑆 𝑡,𝑗 = 1. If 𝑆 𝑡,𝑗 = 0, it means the substation 𝑗 has failed directly (superscript 𝑑𝑖𝑟) due to lack of electricity from the external power network; if 𝑆 𝑡,𝑗 = 1, it means the substation 𝑗 has failed indirectly (superscript 𝑖𝑛𝑑) due to the direct failure of another substation 𝑘 within the same subset 𝐕 𝐫,𝐢𝐭 . These two sets will be used to evaluate the vulnerability of the external power network (more details in Section 2.5).The algorithm proceeds with Step 6, where the requested power demand in each load in the external power network corresponding to a substation in the traction power network is adjusted, taking into account the failures of railway tracks. For every failed railway track 𝑖, the new requested power demand 𝑃 𝑚𝑎𝑥 ′ 𝑙 𝑡,𝑘 𝑗 for each load 𝑗 corresponding to a substation 𝑘 within the subset 𝐕 𝐫,𝐢 𝐭 is set to 0, with the exception of the substations corresponding to the railway stations 𝑤 and 𝑞 delimiting the railway track, 𝑣 𝑟,𝑖 𝑡,𝑣 𝑟,𝑤 and 𝑣 𝑟,𝑖 𝑡,𝑣 𝑟,𝑞

A

  .Bellè et al.

Fig. 2 .

 2 Fig. 2. Flowchart of the vulnerability analysis algorithm for each fraction of removals.

  represents the baseline requested power demand in each load, 𝑃 ′ 𝑙,𝑖 represents the supplied power demand in each load after cascading failures simulation, 𝐥 𝐛𝐚𝐬𝐞 𝐩 is the subset of base loads (loads which does not represent any traction substations), and 𝐥

A

  .Bellè et al.

Fig. 3 .

 3 Fig. 3. Geographical representation of the railway network (blue), the traction power network (green) and external power network (red).

Fig. 4 .

 4 Fig. 4. Network-based representation of the railway network (blue), the traction power network (green) and external power network (red).

A

  .Bellè et al.

Fig. 5 .

 5 Fig. 5. Impact of removals in the power network on the railway network in terms of average loss of 𝐴 𝑟 for 𝑇 𝑡←𝑝 equal to 0.0, 0.5 and 1.0. The results are evaluated including cascading failures within the external power network in the analysis (𝑝 𝑜𝑙 = 1), denoted as (C) in the legend, and not including them (𝑝 𝑜𝑙 = 0), denoted as (NC) in the legend. 95% confidence intervals are shown.

Fig. 6 .

 6 Fig.6. Impact of removals in the power network on the railway network in terms of average loss of 𝑅𝑃 𝑃 for 𝑇 𝑡←𝑝 equal to 0.0, 0.5 and 1.0. The results are evaluated including cascading failures within the external power network in the analysis (𝑝 𝑜𝑙 = 1), denoted as (C) in the legend, and not including them, (𝑝 𝑜𝑙 = 0), denoted as (NC) in the legend. 95% confidence intervals are shown.

A

  .Bellè et al.

Fig. 7 .

 7 Fig. 7. Megawatts of demand not supplied within the external power network for different values of 𝑇 𝑡←𝑝 and a traditional OPA model. 95% confidence intervals are shown.

Fig. 8 .

 8 Fig. 8. Fraction of demand not supplied within the external power network for different values of 𝑇 𝑡←𝑝 and a traditional OPA model. 95% confidence intervals are shown.

A

  .Bellè et al.

Fig. 9 .

 9 Fig. 9. Fraction of substations functional and directly/indirectly failed. 95% confidence intervals are shown.

Andrea Bellè :

 Bellè Conceptualization, Methodology, Software, Formal analysis, Writing -original draft, Writing -review & editing, Visualization. Zhiguo Zeng: Writing -review & editing, Supervision. Carole Duval: Writing -review & editing. Marc Sango: Writing -review & editing. Anne Barros: Writing -review & editing, Supervision, Project administration.

  Johansson and Hassel (2010); Johansson et al. (2011); Pant et al. (2016)) or simplified with a network-based approach (Zhang et al. (2014); Zio and Sansavini (2010, 2011)).

Fig. 1 .

 1 Fig. 1. Interdependent railway network (blue), traction power network (green) and external power network (red).

2. 4 .

 4 Modeling of cascading failures 2.4.1. Power network External and traction power network are subjected to cascading failures, and different approaches are available (see Guo et al. (2017)). In this work, we rely on the traditional ORNL-PSerc-Alaska (OPA) model, based on DC power flow equations and linear optimization (Dobson et al. (2001); Carreras et al. (

Fig- ure 1 ,

 1 is based on the French high-speed railway systems, called Train à Grande Vitesse or TGV (SNCF (2014)). It is composed by 185 nodes, representing stations, connected by 214 edges, representing railway tracks.

Fig. 2 .

 2 Fig. 2. Flowchart of simulation algorithm. EPN indicates the external power network, TPN indicates the traction power network.

E

  GN Set of edges in the gas network E P N Set of edges in the power network V GN Set of nodes in the gas network V P N Set of nodes in the power network Parameters and coefficients θ Maximum value of phase angle d b i

Figure 1 :

 1 Figure 1: Network representation of two interdependent infrastructures. In evidence, we can notice the two structural components of networks (nodes and edges) and their connection (interdependency links). The ensemble of interdependency links is referred to as coupling interface.

Figure 2 :

 2 Figure2: Qualitative representation of a resilience curve and the related phases[16],[19]

Figure 3 :

 3 Figure 3: Flowchart of the NC&CG algorithm [14], [27].

Figure 4 :

 4 Figure 4: Interdependent power and gas networks.

Figure 5 :

 5 Figure 5: Worst-case combined performance for different network metrics-based coupling interface and values Katt.

Figure 6 :

 6 Figure 6: Worst-case combined performance for optimized coupling interface with different budgets B ci and values Katt.

Figure 7 :

 7 Figure 7: Example of two optimal solutions for B ci =$900 and B ci =$1000 with Katt=2. Blue squares represent links from the power network to the gas network (electricity supply); red squares represent links from the gas network to the power network (gas supply); green squares represent links in both the directions; grey squares represent the absence of links.

Figure 8 :

 8 Figure 8: Cost of optimal coupling interfaces for different budgets B ci and values Katt.

Table B. 8 :

 8 Boundaries and maximum flow capacity for each line in the gas network.

  these interdependencies increase the operational performance and efficiency of CIs, they often lead to an increased vulnerability(Buldyrev et al., 2010). Interdependent networks and systems are intrinsically more fragile than isolated systems, as a failure within one infrastructure can spread within other infrastructures and cause multi-sectoral disruption(Buldyrev et al., 2010; Lee II et al., 2007; Vespignani, 2010). Ensuring and optimizing the resilience of interdependent CIs are important issues, and they are the main focus of various existing works (e.g. Alkhaleel et al., 2022; Fang and Zio, 2019; Ouyang, 2017; Ouyang and Fang, 2017).

1. 2 . Related work 1 . 2 . 1 .

 2121 Design of coupling interfaceDespite coupling interfaces playing a key role in the failure propagation between different infrastructures, their design and optimization have been seldomly treated within the existing literature.In fact, in most of the existing works on interdependent CIs, the coupling interface is given and fixed, and no sensitivity analysis of different designs is performed.The concept of interdependencies topology is typical of network science, and in particular of interdependent networks. In this field, several works analyze the impact of different coupling interfaces on the failure propagation between different types of networks. In fact, it has been shown that the design of coupling interfaces modifies the failure propagation between interdependent networks[START_REF] Fu | Interdependent networks: Vulnerability analysis and strategies to limit cascading failure[END_REF][START_REF] Parshani | Interdependent networks: Reducing the coupling strength leads to a change from a first to second order percolation transition[END_REF]. Moreover, a proper coupling interface design can reduce the vulnerability and increase the robustness of interdependent networks (Chattopadhyay et al., 2017; X.[START_REF] Wang | Improving robustness of interdependent networks by a new coupling strategy[END_REF][START_REF] Yagan | Optimal allocation of interconnecting links in cyber-physical systems: Interdependence, cascading failures, and robustness[END_REF]. These works represent the theoretical background that justifies the study of coupling interfaces between CIs. However, the models in these works are mainly based on percolation theory, which fails to detail the complexity of realworld infrastructures. Thus, they can not be directly applied for real-world decision-making. Some scholars leveraged on network metrics-based coupling strategies to assess the impact of different coupling interfaces in interdependent CIs, such as power and water networks (S.[START_REF] Wang | Vulnerability analysis of interdependent infrastructure systems: A methodological framework[END_REF] or power and telecommunication networks[START_REF] Chen | Robustness of interdependent power grids and communication networks: A complex network perspective[END_REF] H. Guo et al., 2019;

  example, it has been applied in traditional operational research problems, such as the shortest path problem (Z.Wang et al., 2020), the capacitated facility location problem(Saif & Delage, 2021) or continuous games[START_REF] Liu | Distributionally robust equilibrium for continuous games: Nash and stackelberg models[END_REF]. Moreover, DRO has been used for real-world applications, such as retrofitting planning of transportation networks(Doan, 2021), planning of energy and reserve dispatch[START_REF] Arrigo | Wasserstein distributionally robust chance-constrained optimization for energy and reserve dispatch: An exact and physically-bounded formulation[END_REF] or elective surgery scheduling[START_REF] Shehadeh | A distributionally robust optimization approach for stochastic elective surgery scheduling with limited intensive care unit capacity[END_REF]. However, the applications within the context of protection of CIs remain sparse and limited, and mostly confined within power systems applications. Ambiguity sets can be defined using different methods, and they can be grouped within two main families: moment-based and discrepancy-based ambiguity sets. In this work, we rely on a moment-based ambiguity set, often applied within the context of power networks. For example, moment-based distributionally robust models under random contingency are applied to: configure distribution networks(Babaei et al., 2020), assess the reliability of a transmission network hardening plan(Bagheri & Zhao, 2019), define a contingency-constrained unit commitment model(Zhao & Jiang, 2017), drive the formation of microgrids for service restoration[START_REF] Cai | Distributionally robust microgrid formation approach for service restoration under random contingency[END_REF], plan transmission expansion with distributed energy resources(Alvarado et al., 2018), perform a multidisaster resilience enhancement of distribution networks(Zhang et al., 2020) and plan spinning reserve in power networks[START_REF] Li | A distributionally robust model for reserve optimization considering contingency probability uncertainty[END_REF].

•and j∈VP N y 2 ji d m 3 j

 3 The second terms, j∈VGN y 1 ji d in(5), represent the electricity/gas demand of all the nodes of the other infrastructures dependent on the node i. The terms d

Figure 1 :

 1 Figure 1: Flowchart of the Nested Column&Constraint Generation algorithm.

2 .

 2 the system in(44) represents the conditions enforced by the ambiguity set, and it corresponds to Constraints (A.3) and (A.4) in Appendix A. The variables φ k represent the probability of each scenario k ∈ A part . The system can have 0, 1 or infinite solutions. In case it has no solutions, it means that the probability mass can not be allocated such to respect the momentbased probabilistic conditions enforced by the ambiguity set.

Figure 2 :

 2 Figure 2: Geographical allocation of the interdependent power and gas network.

Figure 4 :

 4 Figure 4: Results of the distributionally robust optimal coupling of IPGNs for different monetary budget values.

Figure 5 :

 5 Figure 5: Results of the distributionally robust optimal coupling of IPGNs for different monetary budget values.

  2 and 5.3 are shown in Tables 2, 3 and 4, respectively.

203 1 .

 1 IntroductionCritical infrastructures (CIs), such as energy systems, transportation networks, and telecommunications systems, are often tightly coupled, and they are mutually interdependent with complex relationships of interdependencies[1]. CIs are often modeled with a network-based approach[2], where infrastructures are modeled as networks, connected by links that represent the different interdependencies. A qualitative representation of two interdependent CIs, modeled with a network-based approach, is shown in Figure1. Components of CIs are represented as nodes, while their connections, physical and nonphysical, are represented as edges. Components belonging to different can be dependent on each other, and be coupled by interdependency links. The ensemble of interdependency links, which defines how two CIs are coupled, is often referred to as coupling interface [3]-[5].

Figure 1 :

 1 Figure 1: Network representation of two interdependent infrastructures. In evidence, we can notice the two structural components of networks (nodes and edges) and their connection (interdependency links). The ensemble of interdependency links is referred to as coupling interface.Figure and caption from [3].

  Figure and caption from [3].

Figure 2 :

 2 Figure 2: Interdependent power and gas networks. Figure from [3].

  , and 8. The random allocation strategy is described by the algorithm in Appendix A. For each combination of budget B ci and failed lines K att , 50 simulations of random allocation of redundant interdependency links are performed. The results in Figures 4, 6, and 8 represents the average values and their 95% confidence intervals in the distance-based, degree-based, and betweenness-based coupling interface, respectively.

  combined performance Distance-based coupling interface Original B ci = $100 B ci = $200 B ci = $300 B ci = $400

Figure 3 :

 3 Figure 3: Results of the optimal allocation of redundant interdependency links with a pre-existing distance-based (Euclidean) coupling interface.

  B ci = $200 B ci = $300 B ci = $400

Figure 4 :

 4 Figure 4: Results of the random allocation of redundant interdependency links with a pre-existing distance-based (Euclidean) coupling interface.

  B ci = $200 B ci = $300 B ci = $400

Figure 5 :

 5 Figure 5: Results of the optimal allocation of redundant interdependency links with a pre-existing degree-based coupling interface.

  coupling interface Original B ci = $100 B ci = $200 B ci = $300 B ci = $400

Figure 6 :

 6 Figure 6: Results of the random allocation of redundant interdependency links with a pre-existing degree-based coupling interface.

Figure 7 :

 7 Figure 7: Results of the optimal allocation of redundant interdependency links with a pre-existing betweenness-based coupling interface.

  B ci = $200 B ci = $300 B ci = $400

Figure 8 :

 8 Figure 8: Results of the random allocation of redundant interdependency links with a pre-existing betweenness-based coupling interface.

p

  i -(d id i )f k = 0, ∀i ∈ V P N(5)

June 13 ,

 13 2022 11:12 RPS ESREL Proceedings/Edited Book: Trim Size: 221mm x 173mm output Vulnerability analysis of interdependent energy infrastructures 5 of the Stackelberg game, the reader is referred to Wang et al. (2020).

June 13 ,

 13 2022 11:12 RPS ESREL Proceedings/Edited Book: Trim Size: 221mm x 173mm output 6

Fig. 1 .

 1 Fig. 1. Average load shedding in the IPHNs.

Fig. 2 .

 2 Fig. 2. Average load shedding in the power network.

June 13 , 7 Fig. 3 .

 1373 Fig. 3. Average load shedding in the heat network.

  Decentralized models, like the one proposed in Wang et al. (2020), imply a market-based competition between the operators of different infrastructures, and they are useful for modeling normal situations, when operators aim at minimizing their costs. Centralized models imply a collaborative behaviour between

Fig. 4 .

 4 Fig. 4. Average cost in the IPHNs.

Fig. 5 .

 5 Fig. 5. Average cost in the power network.

Fig. 6 .

 6 Fig. 6. Average cost in the heat network.

  and Mehrotra (2020) and Noyan et al. (2018) for a theoretical framework, Doan (2022) for an application to retrofitting of transportation networks after natural disasters, and Noyan et al. (2021) for a unified modeling framework and an illustrative application to machine scheduling and humanitarian logistics.

Fig. 1 .

 1 Fig. 1. Topology of the IEEE 14-bus system.

Fig. 2 .

 2 Fig. 2. Expected performance with and without considering endogenous uncertainty within the ambiguity set for different combinations of K def and K att . The blue vertical lines indicate different optimal protection plans between the cases with and without endogenous uncertainty and the same values of K def and K att . Each plot in Figure 2 represents the results for different values K def , which denote how many lines are protected. The x-axis in each plot represents the K att values, which denote the maximum number of lines which are attacked/failed. The y-axis represents the expected performance of the power network. The expected performance is computed considering the worst distribution in the ambiguity set without endogenous uncertainty D (red curves), and the decision-dependent ambiguity set with endogenous uncertainty D(z) (black curves).

  Table from Paper V [80]. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.5 Computational time in seconds of the NC&CG algorithm. Table from Paper III [10]. . . . . List of Figures 1.1 Example of interdependent networks. The two networks, in red and blue, consist of nodes connected by edges. Nodes belonging to different networks are connected by dashed black edges, also referred to as interdependency links, that represent relationships of interdependency. Figure from Paper III [10]. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.2 Example of CIs represented as networks.

v

  The geographical and network-based representations of this illustrative case study are shown in Figures 2.2 and 2.3, respectively.

  Five network metrics-based strategies, based on Euclidean distance, node

		Start
		Initialize outer layer
		Solve outer layer master problem
		Outer master
		binary variables
		Solve outer layer subproblem
	INNER
	LAYER	Initialize inner layer
		Solve inner layer master problem
		Inner master
		binary variables
		Solve inner layer subproblem
		Opt. gap < 10 -5 ?	NO
		Inner sub binary
			variables
		YES
		End inner layer
			Inner master
			binary variables
		Opt. gap < 10 -5 ?	NO
		YES
		Stop

Table 3 .

 3 1: Cost of network metrics-based coupling interfaces.

Table 3 . 2 :

 32 Scenarios within the set A for the power network in

Table 3 .

 3

	3: Upper bounds π max k	for each power line k.
	Line π max k	Line π max k
	1	0.064	11	0.136
	2	0.012	12	0.037
	3	0.089	13	0.037
	4	0.037	14	0.131
	5	0.164	15	0.089
	6	0.012	16	0.159
	7	0.084	17	0.053
	8	0.043	18	0.117
	9	0.031	19	0.019
	10	0.089	20	0.108

Table 3 . 4 :

 34 Results of the optimal allocation of redundant interdependency links in terms of worst-case combined performance and relative increase in percentage from the original case. Table from Paper V[START_REF] Bellè | Resilience enhancement by optimal allocation of redundant interdependency links in interdependent critical infrastructures[END_REF].

Table 3 .

 3 5: Computational time in seconds of the NC&CG algorithm. Table from Paper III [10].

  , Z. Zeng, C. Duval, M. Sango, and A. Barros, "Modeling and vulnerability analysis of interdependent railway and power networks : Application to British test systems," Reliability Engineering & System Safety, t. 217, p. 108091, 2022. Paper II A. Bellè, Z. Zeng, M. Sango, and A. Barros, "Towards a Realistic Topological and Functional Modeling for Vulnerability Analysis of Interdependent Railway and Power Networks," Proceedings of the 31st European Safety and Reliability Conference, 2021. Paper III A. Bellè, A. F. Abdin, Z. Zeng, Y.-P. Fang, and A. Barros, "A resiliencebased framework for the optimal coupling of interdependent critical infrastructures," Reliability Engineering & System Safety, under review, 2022.Paper IV A. Bellè, A. F. Abdin, Y.-P. Fang, Z. Zeng, and A. Barros, "A datadriven distributionally robust approach for the optimal coupling of interdependent critical infrastructures," European Journal of Operational Research, under revision after first peer-review, 2022. Paper V A. Bellè, Z. Zeng, M. Sango, and A. Barros, "Resilience enhancement by optimal allocation of redundant interdependency links in interdependent critical infrastructures," Reliability Engineering & System Safety, to be submitted, 2022.Paper VI A. Bellè, Z. Zeng, and A. Barros, "Vulnerability analysis of interdependent energy infrastructures with centralized and decentralized operator models," Proceedings of the 32nd European Safety and Reliability Conference, accepted, 2022.Paper VII A. Bellè, Y.-P. Fang, Z. Zeng, and A. Barros, "A distributionally robust approach for the optimal protection of power networks with endogenous uncertainty," Proceedings of the 18th IFAC Workshop on Control Application of Optimization, accepted, 2022.

	Paper I
	A. Bellè, Z. Zeng, C. Duval, M. Sango, and A. Barros, "Mod-
	eling and vulnerability analysis of interdependent railway and
	power networks : Application to British test systems," Reliabil-
	ity Engineering & System Safety, t. 217, p. 108091, 2022.

  10.1016/j.ress.2021.108091 Received 27 April 2021; Received in revised form 19 August 2021; Accepted 21 September 2021 A. Bellè et al.

	List of Symbols	Cascading failures
	Railway network 𝐄 𝐫 Set of edges in railway network 𝐆 𝐫 Graph representing the railway network 𝐕 𝐫 Set of nodes in railway network 𝑒 𝑟,𝑖 Edge 𝑖 in railway network, representing railway segment 𝑖 Number of edges in railway network 𝑀 𝑟 𝑁 𝑟 Number of nodes in railway network 𝑣 𝑟,𝑖 Node 𝑖 in the railway network, representing station 𝑖	𝐄 ′ 𝐅 𝐆 ′ 𝐍 𝐝𝐢𝐫 𝐅 𝐍 𝐢𝐧𝐝 𝐅 𝐏 𝐠 ′ 𝐏 𝐠 𝐏 𝐥 ′ 𝐏 𝐥 𝐕 ′	Set of edges after a disruptive event Set of line power flows Graph after a disruptive event Set containing the substations failed directly Set containing the substations failed indirectly Set of nominal generator power Set of nominal generator power after a disruptive event Set of nominal load power Set of nominal load power after a disruptive event Set of nodes after a disruptive event
	External power network 𝐄 𝐩 Set of edges in external power network 𝐆 𝐩 Graph representing the external power network 𝐠 𝐩 Set of generators in external power network 𝐥 𝐛𝐚𝐬𝐞 𝐩 Subset of loads in external power network supply-ing general consumers 𝐥 𝐬𝐮𝐛 𝐩 Subset of loads in external power network supply-ing traction substations 𝐥 𝐩 Set of loads in external power network 𝐕 𝐩 Set of nodes in external power network 𝑒 𝑝,𝑖 Edge 𝑖 in external power network, representing transmission line 𝑖	𝐹 𝑖 𝐹 𝑚𝑎𝑥 𝑖 𝑃 𝑔,𝑖 𝑃 𝑚𝑎𝑥 𝑔,𝑖 𝑃 𝑙,𝑖 𝑃 𝑚𝑎𝑥 𝑙,𝑖 𝑅 𝑡,𝑖 𝑆 𝑝,𝑖 𝑆 𝑟,𝑖 𝑆 𝑡,𝑖 𝑇 𝑡←𝑝 𝑊	Power flow at line 𝑖 Power flow capacity at line 𝑖 Nominal power of generator 𝑖 Maximum power of generator 𝑖 Supplied power demand of load 𝑖 Requested power demand of load 𝑖 Load shedding ratio of substation 𝑖 Binary functional state of transmission line 𝑖 Binary functional state of railway track 𝑖 Binary functional state of substation 𝑖 Tolerance threshold for substation load shedding Load penalty constant
	Generator 𝑖 in external power network Load 𝑖 in external power network Number of edges in external power network Number of generators in external power network Number of loads in external power network Number of nodes in external power network Node 𝑖 in the external power network, representing electrical bus 𝑖 Traction power network 𝑔 𝑖 𝑙 𝑖 𝑀 𝑝 𝑁 𝑔 𝑁 𝑙 𝑁 𝑝 𝑣 𝑝,𝑖 𝐆 𝐭 Graph representing the traction power network 𝐕 𝐭 Set of nodes in traction power network 𝑁 𝑡 Number of nodes in traction power network 𝑣 𝑡,𝑖 Node 𝑖 in the traction power network, representing substation 𝑖	Simulation V 𝜎 𝐴 𝑟 𝐶𝐼 95 𝐷𝑁𝑆 𝐹 𝐷𝑁𝑆 𝑛 𝑖 𝑎 𝑁 𝑒𝑥𝑝 𝑃 𝐼 𝑅𝑃 𝑃 𝑇 𝑃 𝑃 𝑖 𝑉 𝑍	Average vulnerability index Standard deviation estimation Accessibility of railway network 95% confidence intervals Demand Not Supplied in megawatts Fraction of Demand Not Supplied Number of stations accessible from station 𝑖 Number of Monte Carlo simulations performance indicator Railway Power Performance Traction Power Performance of railway track 𝑖 Vulnerability index Confidence intervals constant
	Interdependency
	𝐄 𝑖←𝑗 𝑟←𝑡 𝐕 𝐫,𝐢 𝐭 𝑒 𝑖←𝑗 𝑡←𝑝	Set of interdependency edges between railway track 𝑖 and subset of substations 𝐕 𝐫,𝐢 𝐭 Subset of substations supplying the railway track 𝑖 Interdependency edge between substation 𝑖 and electrical bus 𝑗 with load 𝑘
	Initiating event
	𝐍 𝐟	Set of components to remove in the initiating event
	𝑓	Fraction of components to remove in the initiating event
	𝑁 𝑓 𝑎𝑖𝑙	Number of elements to remove in the initiating event
	𝑝 𝑖𝑒	Probability of being selected for a removal for each component

networks could potentially lead to a significant underestimation of the risks. With this work, we aim at complementing the available literature with a modeling approach for interdependent railway and

Table 1

 1 Vulnerability curve areas for the accessibility 𝐴 𝑟 .

	𝑇 𝑡←𝑝	Curve (NC) area	Curve (C) area
	0.0	0.21	0.29
	0.5	0.59	0.78
	1.0	0.90	1.0

Table 2

 2 Vulnerability curve areas for the railway power performance 𝑅𝑃 𝑃 .

	𝑇 𝑡←𝑝	Curve (NC) area	Curve (C) area
	0.0	0.33	0.44
	0.5	0.57	0.73
	1.0	0.89	1.0

Table 4

 4 Vulnerability curve areas for the external power network 𝐹 𝐷𝑁𝑆, normalized with area under the curve corresponding to the traditional OPA model.

	𝑇 𝑡←𝑝	Area
	0.0	0.99
	0.5	0.93
	1.0	1.01
	OPA	1.0

  al. (2018)) and PowerModels.jl (Coffrin et al. (2018)).

Table 2 .

 2 Five most critical components for traction power network (no-priority and priority scenario).

	Bus index	LS T	Bus index	LS T
	No-priority	No-priority	Priority	Priority
	78	14.6%	78	14.6%
	135	11.0%	62	6.1%
	63	8.5%	63	6.1%
	111	7.5%	107	5.6%
	167	6.6%	111	4.4%

Table 3 .

 3 Five most critical components for railway network (no-priority and priority scenario).

	Bus index	ΔΦ	Bus index	ΔΦ
	No-priority	No-priority	Priority	Priority
	78	16.2%	78	16.2%
	135	12.6%	62	7.0%
	63	9.5%	63	7.0%
	55	8.2%	107	6.1%
	111	7.7%	135	5.1%
	Table 4. Five most critical compo-nents for external power network.
	Bus index	LS E
	83		21.0%
	138		19.0%
	45		18.3%
	39		17.9%
	38		17.9%

Table 1 :

 1 Cost of network metrics-based coupling interfaces. For simplicity, the costs are rounded by excess.

Table 4 :

 4 Computational time in seconds of the NC&CG algorithm.

Table B .

 B 6: Boundaries, maximum flow capacity and reactance for each line in the power network.

	Line index Boundaries (i, j) f k [MW] x k [pu]
	1	(1, 2)	30	0.05917
	2	(1, 5)	30	0.22304
	3	(2, 3)	30	0.19797
	4	(2, 4)	30	0.17632
	5	(2, 5)	30	0.17388

  Table B.7: Production capacity and base requested demand for each node in the gas network.

				.55618
	10	(5, 6)	30	0.24202
	11	(6, 11)	30	0.1989
	12	(6, 12)	30	0.25581
	13	(6, 13)	30	0.13027
	14	(7, 8)	30	0.17615
	15	(7, 9)	30	0.11001
	16	(9, 10)	30	0.0845
	17	(9, 14)	30	0.27038
	18	(10, 11)	30	0.19207
	19	(12, 13)	30	0.19988
	20	(13, 14)	30	0.34802

Table 1 :

 1 Upper bounds π max for each power transmission line i.

	Line π max i	Line π max i
	1	0.064	11	0.136
	2	0.012	12	0.037
	3	0.089	13	0.037
	4	0.037	14	0.131
	5	0.164	15	0.089
	6	0.012	16	0.159
	7	0.084	17	0.053
	8	0.043	18	0.117
	9	0.031	19	0.019
	10	0.089	20	0.108
	5. Results

  If we set the upper bounds π max equal to max 2 max 3 max 4 max 5 max 6 max max = 1 Figure 3: Results of the distributionally robust optimal coupling of IPGNs. In the x-axis we can see the upper bounds of the ambiguity set, defined in Table

	1.00
	0.72 0.76 0.80 0.84 0.88 0.92 0.96 Combined performance	Optimal -worst expected performance Optimal -worst-case performance Euclidean -worst expected performance Euclidean -worst-case performance
	0.68
		Upper bounds ambiguity set

Table 2 :

 2 Computational cost in seconds and number of outer iterations of the NC&CG algorithm for different upper bounds π max .Boundsπ max 2π max 3π max 4π max 5π max 6π max π max =1

	Time [s]	405.3	747.3	85.8	31.3	19.1	36.3	38.6
	Outer iter.	29	36	18	13	10	12	8

Table 3 :

 3 Computational cost in seconds and number of outer iterations of the NC&CG algorithm for different monetary budgets Bc.

	Budget [$] 822.76	900	1100 1300 1500 1700
	Time [s]	260.5	2385.2 405.3 435.9 342.9 203.5
	Outer iter.	27	30	29	26	24	20

Table 4 :

 4 Computational cost in seconds and number of outer iterations of the NC&CG algorithm for different maximum number of failed edges K.

	K	1	2	3	4	5
	Time [s]	6.1 260.4 405.3 3556.9 5276.6
	Outer iter.	6	17	29	39	42

Table 1 :

 1 Results in terms of worst-case combined performance and relative increase from the original case for the distance-based (Euclidean) coupling interface.

	B ci	K att =1	K att =2	K att =3	K att =4	K att =5
	Original	0.940	0.770	0.670	0.523	0.308
	$100	0.997 (+6.04%)	0.785 (+1.93%)	0.708 (+5.74%)	0.558 (+6.71%)	0.364 (+18.43%)
	$200	1.0 (+6.33%)	0.879 (+14.03%)	0.819 (+22.33%)	0.670 (+28.13%)	0.514 (+67.04%)
	$300	1.0 (+6.33%)	0.953 (+23.74%)	0.894 (+33.49%)	0.699 (+33.77%)	0.577 (+87.33%)
	$400	1.0 (+6.33%)	0.953 (+23.74%)	0.911 (+35.98%)	0.722 (+38.12%)	0.619 (+101.21%)

Table 2 :

 2 Results in terms of worst-case combined performance and relative increase from the original case for the degree-based coupling interface.

	B ci	K att =1	K att =2	K att =3	K att =4 K att =5
	Original	0.941	0.679	0.204	0.0	0.0
	$100	1.0 (+6.27%)	0.790 (+16.35%)	0.687 (+236.76%)	0.644 -	0.282 -
	$200	1.0 (+6.27%)	0.953 (+40.35%)	0.744 (+264.71%)	0.663 -	0.600 -
	$300	1.0 (+6.27%)	0.953 (+40.35%)	0.893 (+337.75%)	0.744 -	0.619 -
	$400	1.0 (+6.27%)	0.953 (+40.35%)	0.913 (+347.55%)	0.839 -	0.641 -

Table 3 :

 3 Results in terms of worst-case combined performance and relative increase from the original case for the betweenness-based coupling interface.

	B ci	K att =1	K att =2	K att =3	K att =4	K att =5
	Original	0.983	0.679	0.572	0.204	0.0
	$100	1.0 (+1.73%)	0.948 (+39.62%)	0.712 (+24.48%)	0.587 (+187.75%)	0.282 -
	$200	1.0 (+1.73%)	0.953 (+40.35%)	0.894 (+56.29%)	0.679 (+232.84%)	0.547 -
	$300	1.0 (+1.73%)	0.953 (+40.35%)	0.912 (+59.44%)	0.784 (+284.31%)	0.640 -
	$400	(+1.73%) 1.0	(+40.35%) 0.953	(+61.19%) 0.922	(+311.27%) 0.839	0.730

  Proceedings of the 32nd European Safety and Reliability Conference. Edited by Maria Chiara Leva, Edoardo Patelli, Luca Podofillini and Simon Wilson Copyright © 2022 by ESREL2022 Organizers. Published by Research Publishing, Singapore

	June 13, 2022 11:12 RPS ESREL Proceedings/Edited Book: Trim Size: 221mm x 173mm	output
	2	Bellè et al.
	commodities in order to maximize profit and/or
	supplied energy, or minimize cost and/or energy
	not supplied. Centralized models have been often
	applied in the context of resilience assessment
	and optimization. For example, centralized oper-
	ator models have been used to optimize the re-
	silience of interdependent infrastructures via com-
	bined improvements (Kong et al., 2021), for the
	resilience enhancement of interdependent power
	and gas networks against natural hazards with a
	robust approach (Fang and Zio, 2019), and for the
	resilience enhancement of interdependent power
	and water networks under spatially-localized at-
	tacks (Ouyang, 2017). Centralized operator mod-
	els have also been used for optimizing the joint
	restoration of disrupted interdependent infrastruc-
	tures (Almoghathawi et al., 2019; Ouyang and
	Wang, 2015; Lee II et al., 2007). In the afore-
	mentioned works, the operators are centralized, as
	they can control simultaneously the ensemble of
	interdependent infrastructures in order to optimize
	an objective function, which is usually a weighted
	sum of the performance or cost of each individual
	infrastructure.
	ISBN: 981-973-0000-00-0 :: doi: 10.3850/981-973-0000-00-0 output	1

  :

	min p,d,f	i∈V P N	d i d P N	+	i∈V HN	d i d HN

Table 1 .

 1 Load shedding in normal conditions with LS model and GT C model.

	Model	LS PN	LS HN	Average LS
	LS	0.00	0.00	0.00
	GT C	0.00	0.186	0.093

Table 2 .

 2 Costs in normal conditions with LS model and GT C model.

	Model	Cost PN	Cost HN	Average cost
	LS	-345.80$	653.80$	154.00$
	GT C	-189.83$	591.01$	200.59$

The catenary is a dedicated power line, parallel to railway tracks, which supplies rolling stocks with electricity.

In order to maintain notations, nomenclature, and formulations consistent throughout this dissertation, they might differ from the ones proposed in the appended papers. However, notations, nomenclature, and formulations proposed in this thesis are equivalent (or at least similar) to the ones in the appended papers, and they do not alter the message conveyed by the original works.

An accurate analysis of the features and the characteristics of these buses is out of the scope of this work; however, it is important to highlight that their topological positions within the interdependent networks play a key role in determining their criticality in case of failure.

For simplicity, the cubic terms present in the operational model of Papers III and IV are assumed to be contained within the last term y T Dδ of Equation (3.3).

The budget B ci =$823 corresponds to the cost of Euclidean coupling interfaces in Table 3.1.

Risk-averse stochastic approaches also exist. In this case, a probabilistic risk measure, like Conditional Value-at-Risk (CVaR), is often optimized[START_REF] Rockafellar | Optimization of conditional value-at-risk[END_REF].

The word conditional refers to the condition that at least one line is in a failure state.

The problems of maximizing residual performance and minimizing performance loss are equivalent.

In Paper IV, the coupling interface is optimized in order to maximize the performance under conditions of disruption. Here, normal conditions are also taken into account, using the decentralized approach, and the normal scenario should be assigned some probability mass.

The results in Paper I are obtained by assuming a traction network with substations in electrical isolation. As traction networks are identified as an important factor in the modeling of IRPNs, a more general approach, with the possibility of modeling different traction network configurations, is a natural development of Paper I.In Paper II, a preliminary proposal of a model that accounts for different configurations of traction networks is presented. The preliminary results suggest that the topology of the coupling interface between different networks might play a key role in terms of resilience and disruption propagation in interdependent CIs, and this consideration leads to the topic treated in Chapter 3.

Proceedings of the 31st European Safety and Reliability Conference Edited by Bruno Castanier, Marko Cepin, David Bigaud, and Christophe Berenguer Copyright c ESREL 2021.Published by Research Publishing, Singapore. ISBN: 978-981-18-2016-8; doi:10.3850/978-981-18-2016-8 356-cd

It should be noted that w P N + w GN = 1.

The superscript ′ denotes the operational variables of the first level.

The cost of this coupling interface, referred to as Euclidean coupling interface, is, precisely, $822.763752. For the sake of simplicity, in this work, it is approximated to $823.

Acknowledgments

Without them, this Ph.D. thesis would not be the same.

Acknowledgement

The authors thank Dr. Yiping Fang for providing the data of the external power network. This work is funded by the Chair on Risk and Resilience of Complex Systems (CentraleSupélec, EDF, SNCF, Orange).

The work contained in this thesis was performed

Rh ′ ≤ q -Hy -Wδ ′y T Dδ ′ (A.27) Rh (i) ≤ q -Tu * (i) -Hy -Wδ (i)y T Dδ (i) , ∀u * (i) ∈ A. (A. 28) 3. Solve the outer subproblem using the inner layer in the previous subsection with y (i) =y * . Obtain an optimal solution ρ (i) and an optimal attack plan u (i) . Set LB out = ρ (i) .

4. If (U B out -LB out )/LB out < 10 -5 , y (i) is the optimal coupling interface and the algorithm is terminated. Otherwise, set A part = A part ∪ u (i) , update i ← i + 1, and return to step 2.

A. Bellè et

Appendix B. OPA model

The OPA model [56,57] is a flow-based model for cascading failures simulation in power networks. It comprises a slow dynamics, which accounts for the increasing in power demand over time, and a fast dynamics, which accounts for initiating events and proper cascading failures. In our work, we are interested in the fast dynamics. The flowchart of the algorithm is shown in Fig. B.10, and it comprises four iterative steps:

1. The power network is initialized. 2. The failed components, such as edges or nodes, are removed from the power network. 3. The optimal power flow is computed with a DC Optimal Power Flow, previously shown in Eqs. ( 8)- (12). 4. Check for overloaded lines (lines with a power flow within 1% of the maximum flow capacity). An overloaded line fails with probability 𝑝 𝑜𝑙 . If there is at least one failed line, return to Step 2; otherwise, stop the algorithm.

Paper III

A. Bellè, A. F. Abdin, Z. Zeng, Y.-P. Fang, and A. Barros, "A mathematical framework for the optimal coupling of interdependent critical infrastructures," Reliability Engineering & System Safety, under review, 2022.

cost of 18.8% from the Euclidean coupling interface. In this case, the relative increase of combined performance is greater than the relative increase of cost. However, as it can be graphically seen in Figures 6 and8, for higher values of K att and B ci , the relative increase of cost is higher than the increase in performance. For example, for the case K att =5, when passing from B ci =$1400 to B ci =$1500, the increase of budget is 7.1%, and the increase of actual cost is 2.8% (from $1369.40

to $1408.40); however, the increase of combined performance is only 0.93% (from 0.852 to 0.860).

For the case previously analyzed in Figure 7 and Table 3, an increase of 11.1% in the budget (from $900 to $1000) leads to an increase of 20.5% in combined performance (from 0.791 to 0.953).

The actual costs of the two optimal solutions, for B ci =$900 and B ci =$1000 with K att =2, are $854.1 and $977.3, respectively, corresponding to an increase of 14.4% in cost when passing from B ci =$900 to B ci =$1000 with K att =2.

Validation

The last term in the objective function in (7) numerically pushes the optimization problem to identify the cheapest solution among the coupling interfaces that maximizes the combined performance of the IPGNs. In order to identify correctly this solution, the order of magnitude of the factor γ should be set properly, accounting for the order of magnitude of the combined performance, the monetary budget, and the optimality gap within the NC&CG algorithm. Within this paper, a value of γ=10 -5 is used. The results are then validated by solving the optimization problem only accounting for the combined performance (γ=0), and by setting the monetary budget B ci slightly below the actual cost of the optimal coupling interface, and verify that the optimal combined performance are lower.

For example, for the case B ci =$1000 and K att =2, the optimal coupling interface has a cost of $977.3 and leads to combined performance of 0.953. We can verify that the cheapest optimal solution is identified correctly by setting γ=0 and solving for a budget B ci =$977. Solving the problem with a budget B ci =$977 leads to combined performance of 0.950, lower than the optimal combined performance of 0.953. This is an indication the correct cheapest optimal solution is identified correctly.

Computational performance

The computational time in seconds of the NC&CG algorithm is shown in Table 4. In this study, the computational cost is acceptable, as the longest instance of the NC&CG algorithm occurs for B ci =$1000 and K att =5, and it takes 176.26 seconds.

The illustrative case-study in this work presents a small-medium size, and the computational cost might increase considerably if larger networks are considered. However, this do not represent an issue: approach using additional binary variables.

The computational cost is affordable in this work. In general, in this kind of optimization problems, aimed at being used during design phases, the computational time does not represent a key factor.

Further improvements of this work includes the possibility of allocating redundant interdependency links within the coupling interface and the evaluation of occurrence probability of each failure scenario.

Appendix A. Linearization of DC power flow constraint Constraint (34) can be linearized by replacing it with the equivalent Constraints (A.1) and (A.2):

where M k is the "Big-M" constants, computed as in (A.3) as suggested in [50]:

where θ is the maximum difference of two phase angles at two connected buses, here assumed π/2. • The development of a reliable and efficient solution procedure based on the Nested Col-umn&Constraint Generation algorithm.

Appendix B. IPGNs parameters

• The application of the proposed framework on a case study to demonstrate the validity of the proposed approach.

The proposed case study is based on interdependent power and gas networks, modeled using a DC power flow model and a maximum flow model, respectively. However, the proposed approach can be applied to any combination of interdependent critical infrastructures, simply adapting the operational model in Section 2.2.

The conservativeness of the model can be tuned adjusting the size of the feasible attacks set, with variations of maximum number of lines attacked and failed, as well as tuning the parameters of the ambiguity set. The model can be easily adapted to different disruption scenarios, for example including failure of nodes.

Our solution strategy leads to acceptable computational times in this work. However, the computational cost might increase considerably for larger case-studies. Nevertheless, it does not represent a particular issue, since this approach aims at being used during design or retrofitting phases.

Appendix A. Proof of proposition 1

For a fixed coupling interface, the inner problem in (A.1) can be rewritten as (A.2)-(A.4) by substituting the expectation with an integral over the set of feasible failure scenarios A and introducing constraints (A.3) and (A.4).

min

subject to:

As it is easy to verify that for the problem in (A.2)-(A.4) Slater's conditions are satisfied, strong duality holds and the problem can be recast into its dual form, shown in (A.5)-(A.6), where α and β i are the dual variables of constraints (A.3) and (A.4), respectively:

subject to:

Constraint in (A.6) can be rewritten as in (A.7):

Noting that (A.5) is a maximization problem, it can be observed from Constraint (A.7) that the optimal value -α is given by (A.8):

The reformulation of -α must be inserted in (A.5). Formulating explicitly Q(y, ξ) and merging the problem with the first stage maximization in ( 22) complete the proof.

the binary variable of the optimization problem. The dimension N c is equal to N P N × N GN . The binary variables δ p i define the functional state (1 if functional, 0 otherwise) of the interdependency links starting from the node i ∈ V P N and going to the gas network. Similarly, the binary variables δ g i define the functional state of the interdependency links starting from the node i ∈ V GN and going to the power network. The variable µ g←p ij is equal to 1 when node i ∈ V GN is supplied by node j ∈ V P N , and 0 otherwise. Similarly, the variable µ p←g ij is equal to 1 when node i ∈ V P N is supplied by node j ∈ V GN , and 0 otherwise.

The objective function in (4) represents the combined performance of the IPGNs in terms of fraction of requested demand of power and gas which is supplied. In each node of the IPGNs, the production of power or gas p i is limited by a production capacity p i , as shown in Constraint (5).

Similarly the supplied demand of power or gas d i is limited by the requested demand, as shown in Constraints ( 6) and ( 7). The total requested demand of power in each node i ∈ V P N is composed of a baseline requested demand d b i , and the sum of the power demands d

M W j

of all nodes j ∈ V GN which are supplied by node i ∈ V P N (µ g←p ji =1). Similarly, the total requested demand of gas in each node i ∈ V GN is composed of a baseline requested demand d b i , and the sum of the gas demands d m 3 j of all nodes j ∈ V P N which are supplied by node i ∈ V GN (µ p←g ji =1). The flow of power in each line k ∈ V P N and the flow of gas in each pipeline k ∈ V GN are limited by the flow capacity f k if the line/pipeline k is functional (u k =1), and forced to be 0 if the line/pipeline is failed (u k =0), as shown in Constraint (8). The DC power flow assumption for the power network is enforced in Constraint (9). The net nodal balance of power and gas in each node is enforced by Constraint (10).

Each interdependency links from the node i ∈ V P N to the gas network is functional (δ p i =1) only if the requested power demand in node i is fully supplied (Constraint (11)). Similarly, each interdependency links from the node i ∈ V GN to the power network is functional (δ g i =1) only if the requested gas demand in node i is fully supplied (Constraint (12)). The production of power in each node i ∈ V P N is possible only if it supplied by a node j ∈ V GN (µ p←g ij =1) with a functional interdependency link (δ g j =1), as shown in Constraint (13). Similarly, as shown in Constraints ( 14) and ( 15), the production and the supply of gas in each node i ∈ V GN is possible only if it supplied by a node j ∈ V P N (µ g←p ij =1) with a functional interdependency link (δ p j =1). Moreover, as shown in Constraints ( 16) and (17), it is possible to flow gas in each pipeline k ∈ E GN only if both the origin and destination nodes of k are supplied by a node j ∈ V P N (µ g←p ij =1) with a functional interdependency link (δ p j =1). Each node i ∈ V GN can be supplied by node j ∈ V P N (µ g←p ij =1) only if an interdependency link from j to i is present (y g←p ij =1), as shown in Constraint (18). Each node i ∈ V P N can be supplied by node j ∈ V GN (µ p←g ij =1) only if an interdependency link from j to i is present (y p←g ij =1), as

The trilevel DAD formulation takes the form shown in (24): max

subject to ( 5)-( 21) and ( 25)-( 28):

Constraints ( 25) and ( 26) ensure that any previously-existing coupling interface is considered within the optimization. The binary parameter y g←p ij defines if an interdependency link from node Constraint (27) enforces the cost of the allocated redundant interdependency link to be less or equal the available monetary budget B ci . The parameter d km ij defines the distance in kilometer between nodes i ∈ V GN and j ∈ V P N . The parameters c g←p km and c p←g km are the cost-per-kilometer of allocating an interdependency link. The parameter c ci represents the cost of the existing coupling interface, computed as in (29):

With the term c ci included, only the newly allocated interdependency links are considered within the budget limitation.

Constraint (28) enforces the number of power lines targeted and failed by the attacker to be lower or equal the parameter K att . Each binary variable u k =0 if line k is targeted and failed, and

The solution of the DAD model leads to the identification of the most robust allocation of redundant interdependency links. In other words, the outer defender allocates the redundancies in order to maximize the combined performance of the IPGNs in the worst-case attack scenario that can be carried out by the attacker. Initialize random nodes i ∈ V GN and j ∈ V P N

6:

if y g←p ij =0 then: if cost ≤ B ci then: else if r=1 then 13:

Initialize random nodes i ∈ V P N and j ∈ V GN 14:

if y p←g ij =0 then: if cost ≤ B ci then: jective functions and assumptions. However, both these classes of models are useful, as they represent operators behaviours in different situations. When performing optimization and analysis of interdependent EIs, these behaviours in different situations should be taken into account. Further developments of this work will investigate the possibility of a decision-making framework for interdependent EIs which account for decentralized operators behaviours in normal conditions and centralized behaviours in conditions of disruption.

Paper VII

A. Bellè, Y.-P. Fang, Z. Zeng, and A. Barros, "A distributionally robust approach for the optimal protection of power networks with endogenous uncertainty," Proceedings of the 18th IFAC Workshop on Control Application of Optimization, accepted, 2022.

237