A multi-criteria framework for critical infrastructure systems resilience

and a guide for defining specific sub-criteria. In this MCF, the side effects, cascading effects and cost-benefit in resilience scenarios are considered indispensable for CISs resilience assessment. The paper also presents an example of the application of the developed guide through two detailed scenarios, one on a single infrastructural system affected by a natural disaster, and the other addressing the interdependence of this infrastructural system and an urban healthcare system. The designed MCF contributes to the operationalisation and comprehensiveness of CISs resilience assessments.


Introduction
Critical Infrastructures (CIs), which provide vital services for people and communities, are those physical and information technology facilities, networks, services, and assets that, if disrupted or destroyed, would have a serious impact on the health, safety, security, or economic wellbeing of citizens or the effective functioning of governments [1].The United Nations Office for Disaster Risk Reduction (UNDRR) [2] emphasises the importance of investment in resilient infrastructure for a better future in the context of increasing extreme weather events and threats.Modern societies are becoming increasingly dependant on interconnected technological systems that could be called critical infrastructure systems (CISs) [3].Resilience in the engineering domain includes technical systems designed by engineers that interact with humans and technology [4].A CIS consists of human or non-human, physical or mental components involving its management [5], as it is formed when, engineered systems and socio-ecological context are integrated [6].These CISs play a fundamental role in delivering Abbreviations: CIs, Critical Infrastructures; CIS(s), Critical Infrastructure System(s); UNDRR, United Nations Office for Disaster Risk Reduction; MCF, multi-criteria framework; C&I, Criteria & Indicators; CBE, consequence-based engineering; PrES, pre-event stage; DES, during event stage; PoES, post-event stage; NEPS, next event preparation stage; BB model, "Behind the Barriers" model; NRR system, Nantes Ring Road system; EMS system, Emergency Medical Service system; F-NRR-PAR, flood -Nantes Ring Road -planning alternative roads; DNRR-EMS-UAR, dysfunction of Nantes Ring Road -Emergency Medical Service -using alternative roads; MCDM, Multi-Criteria Decision Making; MCDA, Multi-Criteria Decision Analysis.commodities that are essential to various functions in urban systems [7].However, the difficulty in commonly defining "resilience" in the field of infrastructure raises the challenges of finding an agreement to assess CISs resilience.Resilience, introduced by Holling in 1973 [8], originally means a persistent ability to absorb change and disturbance and still maintain the same state variables.CISs resilience today still does not have a broadly accepted definition, but it is highly related to engineering or socio-technical science.
Resilience assessments have become key aspects of disasters management.According to Resilience Alliance [9], an efficient resilience assessment could integrate a set of key concepts and provide alternative ways of thinking about and practicing resource management.One of the important objectives of resilience assessment is to support the decision-making process, which in practical cases requires a consideration of various crucial criteria."Resilience" is an inherent but abstract property of a system [10].In an assessment process, criteria are characters or signs that can be used to distinguish an abstract property (such as resilience), in order to make a judgement of appreciation.
Although the approaches built for CISs resilience assessment are diverse and multidisciplinary [11][12][13][14][15][16], most existing assessments of CISs resilience have several common limitations.Firstly, in modern society, a catastrophic event often causes cascading effects while optimisation measures could lead to side effects.The current lack of thinking about spatial and temporal interactions across urban systems prevents designing beneficial actions and suppressing dangerous ones.In addition, the vagueness existing recently in CISs resilience definition makes it difficult to develop generalizable indicators or criteria for resilience assessment.Besides, each CISs disaster event, in real cases, has uniqueness, but few existing criteria are specific enough to correspond to concrete situations aimed by different CISs stakeholders.It results that most resilience assessments for CISs cannot make the 'resilience' concept usefulness at the operational level of risk management.
The operationalisation of CISs resilience could be through a framework of multi-criteria that correspond to the needs of managers in practical operation.Operationalization refers to making a theory have practical and operational significance, transforming a theory into an object of practical value, regarding in the broader sense of 'using' a theory for different purposes [17,18].As a tool for conflict management, multi-criteria evaluation is a very efficient tool to implement a multi/inter-disciplinary approach [19].Scientists have demonstrated the usefulness of multi-criteria assessments in many sustainability options and management problems [20][21][22][23].Therefore, the aim of this article is, based on the definitions of CISs resilience that are potentially useful for practical operation, to develop a multi-criteria framework (MCF), which contributes to defining both general and specific criteria.This objective MCF aims additionally at systems' interdependencies, and the cost, effectiveness, and safety of optimisation actions.
One of the keys of operationalisation refers to the practice application by local managers.Therefore, this study will provide an application example with the participation of an infrastructure management organisation-Direction interdépartementale des routes Ouest (DIRO) in charge of the Ring Road of Nantes City in France.Considering continuous events following a single hazard event, this example consists of two detailed scenarios, one involving Nantes Ring Road (NRR) system affected by flood events and the other involving Nantes Emergency Service (EMS) system affected by the dysfunction of NRR.
The design of the objective MCF presents in Section 3, after an introduction of the objectives, methods and structure of this study in Section 2, which describes: why a MCF is needed to assess CISs resilience; which elements a MCF should contain; and the methods for designing a MCF.Section 4, on a sound theoretical and material basis, describes the process to define criteria, and to develop a guide for defining specific sub-criteria.Section 4 applies this guide to the mentioned example to explain its practical use for defining specific subcriteria.

Why is a multi-criteria needed?
Some review works on CISs resilience assessment [11][12][13][14][15][16] show the different criteria, dimensions, and aspects of focus or assessment methods currently used in scientific studies.However, in the current studies for CIS resilience, there are several common phenomena relating to assessment criteria after a pre-analysis.
Firstly, many resilience assessments do not discuss "criteria", even though their focused dimensions or perspectives, such as capacities, abilities and characteristics, could be further developed and translated to 'criteria'.During assessment processes, a target criterion is the desired direction of selected objective information, i.e. an indicator that is used to monitor the evolution of a specific aspect of the issue dealt with.Without assessment criteria, practical operators and managers have no envisaged positive outcomes of assessment results.Existing CISs resilience assessment studies usually focus on one single or a couple of aspect of CISs resilience, such as performance, function and vulnerability, which are the most frequently presented [12].However, most assessments focus mainly on the functionality of infrastructure from a technical perspective and do not consider disaster management from a socio-organisational perspective, resulting in inadequate results to help overall urban resilience.For instance, only from an efficacy perspective, building a new city in an area without flood risks is one of the most effective ways to prevent flooding.Obviously, from a social, economic, and ecological perspective, it is not a sustainable and cost-effective solution.Being in a complex modern society, CISs managers should keep holistic thinking that balances the various advantages and disadvantages.In particular, much of the research focuses on the abstract capabilities associated with resilience but overlooks the fact that it is vital for every CISs manager to discuss effective actions that can be implemented without excessive cost or negative impact.For example, Øien and Bodsberg [24] highlight four key attributes to assessing the resilience of smart critical infrastructures ("Understand risks", "Anticipate/prepare", "Absorb/withstand", "Respond/recover" and "Adapt/learn"), but this study did not address concrete operational actions.Trucco et al. [25] pre-defined five cycles, four dimensions, four capacities, and two organisational levels for resilience assessments.This study [25] takes into account the efforts of implementing actions, but not considers the negative side and cascading effects caused after a single scenario.The multi-criteria analysis involving actions investigation is therefore necessary for making the assessment applicable in practice by managers, and make it possible to consider different alternatives and the multidimensionality of the real world, to address different realities in the infrastructure assessment [20].Overall, this study aims at a multi-criteria analysis for CISs resilience.One of the prospects of this study is contributing to CISs resilience assessments that could be useful for practical operations.Assessments by Criteria & Indicators (C&I) could rely on a conceptual hierarchical structure, which is originally developed for sustainable forest management (see Fig. 1) [26][27][28][29] In a hierarchical structure, a higher-level "goal" is divided into aspects or themes, which are in turn divided into criteria each with a number of indicators [26].Van Bueren and Blom [27] believe that "the hierarchical framework facilitates the development of consistent and coherent standards that described what should be accomplished and enables an assessment if, or to what extent, accomplishment is realised".The selection criteria adapted to the specific needs of stakeholders play a crucial role in the operational process.An investigation for multi-criteria helps makes the CISs resilience assessment by C&I complete.Assessments consisting of criteria and indicators provide a commonly agreed framework for articulating and defining expectations (including targets), developing management methods, best practices and performance elements, and are then used in monitoring and evaluating progress towards those expectations and targets [30].

What the objective MCF is and how to design it?
To understand what a criterion is, it is important to understand what C&I-based assessments is.Indicators are frequently used for CISs resilience assessments, but 'criteria' and 'indicators' are usually misused [12].Acquiring knowledge like the resilience of CISs, which can be used to make decisions, set policies, requires information systems to transform data into information [31].The methods for transforming from data, to information and knowledge are various, such as estimation, evaluation, assessment, etc. amongst them, assessment is frequently used and defined as a process by which information is obtained relative to some known objective or goal.In addition, during the process, the chosen objective information intended to observe the evolution (and/or status) of targeted knowledge is called "indicator".Thus, the process of indicator-based assessment, targeting an objective or a goal, has two phases [12] (see, Fig. 2): • Goal assessment: a process in which goal values are obtained by usable indicators; • Indicator assessment: a process in which indicator values are obtained by reliable data.
This study, which aims at 'criteria' is situated in the first phase of Fig 2 .In this phase, the "goal" in this study is resilience, while the "aspects" refer to the principles that are essential priorities [29] to overall CIs resilience.An indicator is a sign or signal that shows something exists or is true, or that makes something clear.An indicator is associated with a criterion, while a criterion is associated with a number of indicators.Criteria are characters or signs, which make it possible to distinguish a thing, or a concept, to make a judgement of appreciation.Criteria could be considered as the points to which the objective information provided by indicators can be integrated and where an interpretable assessment crystallises [32].For a C&I-based assessment, aspects are essential and general, while indicators are specific to practical situations.Criteria play a role considered a bridge linking general aspects and specific indicators.In the field of management, there is an ongoing debate about whether criteria should be universally applicable or specific.Nevertheless, if a criteria framework is desired for operational management, it should allow it to be defined and modified by managers and decision-making groups in specific situations.This study therefore believes the necessary to design a multi-criterial framework (MCF) consisting of various criteria and this MCF should have both genericity and specificity.
Developing generalizable criteria for resilience assessment is a current challenge to turn resilience into operational tools, because the existing definitions of resilience are multitude and different [33,34].Thus, the first crucial contents for the objective MCF are general criteria, which could be defined based on some selected significant aspects.
Eurostat [35] emphasises that the important aspect allows the setting up of the definition of the desired evolution of indicators, i.e. the criteria of each indicator.The identification of an important "aspect" is based on an analysis of the assessment target and goal.Maggino [26] believes that an investigation of studied phenomena allows for defining the phenomenon, its domains, and general aspects, even though it is a complex stage requiring the identification and definition of theoretical constructs.This means that an analysis of the definition and phenomena of CISs resilience should be performed firstly, based on which, secondly, an investigation of the essential priorities helps define important aspects.The designing of the objective MCF relies on the results of preparation works involving these two steps (see Fig. 3).Additionally, to overcome the existing limitations mentioned above that produce the difficulty of resilience operationalisation, the used definitions and phenomena of CISs resilience should address a socio-organisational perspective.The general criteria in the objective MCF should be unable to adapt to all  Moreover, the objective MCF should address sub-level specific criteria under each general criterion.Many existing theories or models for CISs resilience assessment only predefine general perspectives or dimensions for resilience assessment [11].Although they are valuable, this study believes that, for making resilience theory become practice, it is necessary to consider the uniqueness of each specific situation.To address resilience operationalisation, governments and practitioners need descriptive support and guidance about operational process [36,37].Rather than predefining criteria for all potential resilience scenarios of CISs, a practical MCF should provide a guide for consulting potential users to define specific sub-criteria, because each user has different concrete situations.Just as teaching a man to fish, rather than simply giving him fish.A guide for defining specific sub-criteria is thus desired for the objective MCF.This guide needs to be detailed and operational, equally combined with available theories for CISs resilience operationalisation.
Overall, in the objective MCF, the criteria linking directly to important 'aspects' are general criteria, while the sub-criteria associating potential indicators are specific.The objectives, structure and prospect of this study are shown in Fig. 3. Indeed, the fact that the definition of CISs has no orthodoxy in its conceptualization and application would make the MCF design difficult.However, this study tries as far as possible to find solutions based on the current highly accepted studies of CISs resilience.

Designing MCF
This section presents the establishment of a MCF for CISs resilience, and is divided into three sub-sections (see Fig. 3): 1 Preparation works that address an analysis of the definition, phenomena and important aspects of CISs resilience. 2 The definition of general criteria that, in this study, are considered applicable to all CISs 3 The development of a guide that helps define specific sub-criteria in terms of each individual case.The definition of the specific subcriteria requires a deep knowledge of each studied case.

Definition and phenomena of CISs resilience
EXCIMAP [38] defines resilience as the ability of a system, community or society exposed to hazards to resist, absorb, accommodate, adapt to, transform and recover from the effects of a hazard in a timely and efficient manner.Vugrin et al. [39] and Vugrin et al. [40] argue that a system's resilience measurement involves two components: systemic impact, which is changed performance following a disruptive event; and total recovery effort, which refers to the number of resources expended following the disruption.Based on these opinions, Yang et al. [41] present a conceptual scenario of resilience (see.Fig. 4), which illustrates a resilience-based phenomenon that "a hazard affects a system", and highlights two conditions under which this phenomenon established: 1) the hazard causes negative consequences in the affected system and its components; 2) the affected system applies the actions to resist, absorb, accommodate, adapt to, transform recover and learn from hazards.
These descriptions for resilience are potentially significant for resilience operationalisation.The "consequence" or "impact" can be linked in detail and specifically to the affected internal components of the infrastructure system in the event of a disaster.The concretization of "action" and "effort" can be further interpreted in terms of costs, benefits, damages, side effects, etc., which have to be taken into account in the practical management of the operation for enhancing effective actions and suppressing dangerous ones.
The term "consequence" could be both positive and negative.Since the definition of resilience emphasises the ability to cope with the negative effects of a hazard, all "consequence" mentioned in this study is negative.Etymologically, resilience comes from the Latin, resilio, resilire, which means a return and the ability to resume.Therefore, this study highlights that only the CISs damaged by hazards and not in a normal state could be the objects of resilience studies.Studies that only focus on the ability to avoid consequences from hazards without the consideration of recovery and adaptation, address resistance, vulnerability, and robustness, not the concept of resilience.Resilient CISs accept and adapt to hazards.The adaptive capacity of CISs resilience, one of the key factors of resilience, could be presented through the level of consequence and the rate of deterioration.In addition, the function of CISs is supported directly or directly by all internal components [5].Shavelson [42] argue that a complete assessment measures the different components of a system.An assessment that regards only the main function or performance is not comprehensive for decision-makers.For example, the physical injury caused by a terrorist attack does not directly reduce the transport service of a rail infrastructure system, but it is a critical criterion for rail managers.However, it is recognised that not every component will have significant effects.In the guide for sub-criteria definition, the steps of how to identify meaningful negative consequences or damage by analysing important components will be presented.
A resilient CIS should have different capabilities and involve actions to improve its capabilities [43], including adaptive capacity.More and more researchers argue that the actions for improving resilience need to be designed for responding to short-term challenges, and meanwhile to long-term strategies [44,45].Thus, the implementing action mentioned in this study refers to all possible operations could be taken for optimising the resilience of CIs, like programmes, strategies, projects, measures or practices for both temporary (at short-term) and permanent preventive (for long-term) management.Irrespective of the moment when the action is implemented, the effect of the action can be reflected both in short term (one single scenario) and in long term (on future scenarios).Many studies [46][47][48] believe that a resilient system should have the ability of learning and improvement from experience.Implementing actions with long-term positive effects makes CISs more resilient in the face of new shocks than they were before.In addition, due to the interaction of internal components, the actions of one CIS potentially bring unexpected side effects on itself [14,[49][50][51].In medicine, a side effect is commonly described as unintended adverse effects.In this study, the side effects described in particular the unintended damage caused to infrastructures by the actions implemented to increase its resilience to disasters.
More and more CISs resilience studies discuss the connections and interdependencies, which are primarily between CISs [52][53][54][55].As CISs are not isolated and may be physically, geographically, cyber and logically dependant and interdependent, every single CIS can be affected by disruptions in other systems through different types of dependency relations [7,56].Moreover, external interdependency of a CIS goes beyond itself and refers to its interactions with all other human-environment components [5,57,58].Human-environment includes physical, atmospheric, biological, social, economic and political components, conditions, and factors that influence the state, condition, and quality of living conditions, employment, and health [59].Spatial and temporal interactions across networks and within CISs or cities, is of paramount concern for the resilience of human-related systems.Some historical events show that catastrophic impacts of CISs origins (disruption, construction, action, etc.) have already occurred on systems beyond the origins themselves [60][61][62][63][64].The trend of interdependency comes from the awareness of the cascading effects due to interconnected urban components in the development community.Increasing hazards require the urban system to cope with potential cascading effects after consequences on CISs [65].Furthermore, from a consequence-based approach, the negative effects caused by used resources and measures should also be taken into account for the analysis of interdependencies [5,66].That is, the damage caused by a catastrophic event to one infrastructures, and the actions implemented on it, can cause secondary serious damages to the externally associated system.A resilient infrastructural system should have the ability to manage multiple equilibriums with other urban systems.
Overall, the phenomena of CISs resilience today should address the potentially cascading effects that could occur on itself or its connected urban components.Whether the effects are inside or outside that infrastructural system, positive or negative, they involve four types of cascading scenarios resulting from the continued evolution of hazard events (Fig. 5, A For an affected CIS, positive effects refer to the effectiveness of implemented actions that optimise this CIS to better face future hazards.The following scenarios, relating to positive effects, are that future hazards affected this optimised CIS.Meanwhile, the implemented action might also harm this CIS, so they become the source of side effects in continuous scenarios.The continuous scenarios concerning effects in this CIS refer to: • Effectiveness of action: the optimisation of target CIS resulting from actions presents in a new resilience scenario, which consists of another hazard arriving after the initial scenario, the improved CIS, the consequence of the new hazard on this CIS, and the actions of the improved CIS (Fig. 5, A.1); • Side effects of action: the implemented action causes side effects on the initially affected CIS.It produces a new resilience scenario, which consists of this action as the source of a side effect, the same CIS Fig. 5. Four types of cascading scenarios resulting from the continued evolution of hazard events, created by authors.
affected initially, and the damage of implemented action to this CIS, and the actions of this CIS (Fig. 5, A.2).
Moreover, the implemented actions are considered the source of cascading effects when they affect the external system.Similarly, the 'consequence' in the initial scenario (in Fig. 5) that leads to more damage, becomes the source of cascading effects in continuous scenarios.The continuous scenarios, concerning the cascading effects in external urban systems, refer to: The 'actions' and 'consequence, which make negative effects in these continuous scenarios (Fig. 5, A.1, A.2, B.1, B.2), plays the same role as the 'hazard' in the initial scenario in Fig. 5.
Consequently, the studied phenomena identified refer to all scenarios illustrated in Fig. 5, which provides four basic types of cascading scenarios resulting from the continued evolution of hazard events.To identify all continuous scenarios resulting from initial scenarios, Event Tree Method (EMT) currently used by recent studies for analysing domino effects could be suggested [67].As shown in Fig. 6, the form of an event tree allows for establishing causal chains from the initiating scenario to the scenarios upon, and each chain of scenarios is represented by a path in the event tree [68].While these successive scenarios can lead to an infinite number of further continuous scenarios, scenarios closer to the original scenario have a higher probability of occurring and are more important.This study thus tends to focus on scenarios at level A, and one of the scenarios at level A will present in Section 4.
Due to the complex interaction between urban systems, in practical terms, it is difficult to distinguish between direct and indirect damages [41].For instance, when flooding occurs, it directly affects road infrastructure and agricultural land.The damage to these two systems in turn affects each other.The investigation of initial and scenario scenarios is conceptual and for interpreting the importance of the consideration on cascading events.

Important aspects of CISs resilience
The conceptual scenario of resilience shown in Fig. 4 presents already two main aspects of resilience, i.e. "consequence" and "action".A MCF for CISs resilience, therefore, needs to provide information about these two aspects.
Many studies [69][70][71][72] believe consequence-driven approaches should be considered as a key to hazard risk management.Based on a paradigm of consequence-based engineering (CBE) created by Abrams Fig. 6.Event tree produced by an initial scenario, adjusted from Zuccaro et al. [67].
[73] aiming at performance-drive assessment, Wen and Ellingwood [74] and Wen et al. [75] refined and detailed uncertainty and vulnerability analysis through the consideration of demand, capacity, repair costs and losses of engineering systems.Furthermore, Ellingwood and Wen [69] apply the CBE for analysing the earthquake risk of buildings and transportation infrastructure.Indeed, in the field of CISs resilience, consequence assessment has been applied in several current studies [76][77][78][79].Kabir et al. [80] and Heinimann and Hatfield [81] argue that, for a society exposed to high-consequence events, such as earthquakes, tsunamis, and floods, a consequence-based decision-making framework needs to be previously proposed for different applications.In addition, potential action analysis helps identify decisions that should be taken to reconcile objectives and constraints in the best possible manner [82].
In the field of risk management, consequence-based and action-based strategies cannot be separated.The aim of implementing actions is to reduce consequences, and consequence assessment can be used for designing actions.Consequences in a given resilience scenario can be used as experience to enhance future actions.In addition, the effectiveness of some actions can be observed by whether the consequences are reduced in future resilience scenarios.Consequence-action-drive assessment is an endless and continuous process.
CISs resilience is always descript through the properties and capabilities of infrastructures or catastrophic event stages.A combined assessment of action and consequences also makes it possible to take account into all capabilities and properties of CISs, as well as all catastrophic event stages.The capabilities of a system could be capacities, characteristics, abilities, resources, and knowledge [83][84][85][86][87]. Catastrophic event stages could be divided into [12] (see Fig. The implementing actions are required content of a CIS, and all actions are implemented for improving or changing the capabilities, properties, or status at event stages of CISs resilience [5,12,43].The ultimate aim of these improvements and changes is to optimise the resilience of CISs and their connected systems.Therefore, differing from the studies that marked the target capabilities, properties, or event stages, this study suggests the 'action' aspect, which allows the objective MCF to involve all these potential targets.

General criteria
The establishment of criteria should be founded on the defined aspects [35], i.e. consequence and action in this study, and on thinking about the factors that should be observed during practice assessment [26].
Concerning the "consequence" aspect, this study considers the negative consequence of all components and suggests the first general criterion, which has been highly used in resilience assessment approaches according to current review works [12,[88][89][90]: "Damage to internal components".All components of a system interact, inter-support, and inter-influence for the existence, function, and development of this system [5].Thus, this criterion consists of numerous parts corresponding to each internal component.The definition of specific sub-criteria of "Damage to internal components" requires the identification of significant damages, in the company of the manager of the specific case.
For the "action" aspect, the definition of general criteria requires a point of view of organisational management [91].The positive or Fig. 7. Stages of resilience scenario, source: Yang et al. [12].negative impact of an action is related to issues of efficiency and safety, which determine the degree of satisfaction of actions [51,92,93].
The consideration of cost-benefit or cost-effectiveness of actions has been discussed in some resilience studies [11,94] concerning action efficiency.These analyses are used to compare the positive or negative, advantages and disadvantages of a potential decision [95].In addition, they are commonly emphasised in decision-making approaches [96][97][98], as they estimate or evaluate the benefits, effectiveness, or profits against the cost of a decision, project, or policy [99].For the resilience assessment, cost-benefit or cost-effectiveness analysis could become one tool that can provide such information about the prioritization of risk management and adaptation options [100].Therefore, two factors are suggested: effectiveness of action referring to actions' positive benefits or profits, and efforts for actions referring to the efforts that need to be paid for action implementation.High cost-benefit means less cost of action with high effectiveness.Therefore, two general criteria are suggested: "Effectiveness of actions", and "Effort for actions".
On the other hand, another criterion "Damage of action" is suggested for assessing the safety and security of implementing actions.The idea of "safety of actions" comes from "drug safety", which heavily focuses on adverse drug reactions.Side effects are defined as any response to a drug that is noxious and unintended, including lack of efficacy [101].The "Damage of action" criterion aims at assessing the negative effects of unintended adverse events resulting from implementing actions in one single CIS.Whether the effects are inside or outside that infrastructure, they could create negative cascading effects on the indirectly affected object (compared with the CIS directly affected by the original hazard).Therefore, the assessment for "Damage of action" could be considered a new resilience assessment of indirectly affected objects.Some costs of actions could have harmful points, which make costs misunderstood as consequences of actions.In this study, costs are needed in the course of implementing actions, consumed by internal components, and are mainly foreseeable, even if the final consumption amounts were not initially foreseen, they should be known and supported by the decision-make.On the other hand, damage from unintended adverse events is not expected and is not intentional.Damage of action is not necessarily linked to internal components and can refer to damage to external systems (Fig. 8).
Even though the defined aspects and general criteria of the designed MCF are not directly involved in the highly discussed capabilities, properties, or event stages mentioned in Section 3.1, the criterion "Effectiveness of actions" could be linked to all of them.All desirable optimisations of a CIS depend on the actions undertaken on it or on its internal components of the system.A CIS that has been artificially constructed cannot be resilient without human-provided actions.The assessment of the effectiveness of actions could therefore be regarded as an assessment of one or more targeted capabilities, properties, or event stages that the implementing actions focus on.The integral combination of these targets is resilience.

A guide for specific sub-criteria definition
As mentioned in Section 2, a practical MCF should provide a guide for consulting potential users to create sub-criteria corresponding to different concrete situations.In this study, the sub-criteria that correspond to the general criterion "damage to internal components" relating to the aspect "consequence", refers to functional, mental, or physical damages of critical components that are considered significant by CIS managers.This means that a sub-criteria is selected based on its significance in practical situations, as not all damage to internal components is of value to the resilience assessment in real cases.Similarly, the actual stakeholders taking into account the significance of the following elements determine the sub-criteria corresponding to the 'action' aspect: • for the general criterion "effectiveness of action": ideal outcomes because of implementing actions; • for the general criterion "effort for action": significant economic, functional, environmental, and resource costs produced by implementing actions; • for the general criterion "damage of action": significant functional, mental or physical damage caused by implementing actions to target CISs or other interconnected systems.
Traditional risk approaches would seek to identify the range of possible scenarios and events [102].To find suitable criteria applicable to the target practical situation, it is necessary to predefine a studying resilience scenario.The pre-mentioned conceptual scenario (see Fig. 4) is also used in this step for helping users define the studied scenario.Four indispensable factors need to be clarified: hazard, affected system, consequence, and action: • The "affected system " is therefore a target CIS; • The "hazard" is one or more potential catastrophes of the target CIS; • The "consequence" refers to the damages caused by the hazard on target CIS; • The "action" could be one or several implementing actions for improving the resilience of the target CIS.
The definition of all sub-criteria depends on the knowledge and information of the studied scenario obtained by each user.The former two refer to the study object of each case and are therefore easier to be identified than the latter two.Therefore, the definition of "affected CIS" and "hazard" is placed first.The method and process of the identification of the significant factors relating to "consequence" and "action" are shown separately in "Form 1 ′′ and "Form 2 ′′ .When a scenario consists of more hazards and actions, it requires taking into account the effect of their superimposition.During the use of forms, infrastructures managers with different competencies work together, exchange and discuss their joint view of all issues for making collective decisions.

"Consequence" aspect
The identification of significant damages is based on the use of 'Form 1 ′ , which is a mission to carry out the specific sub-criteria for the criteria "damages to internal components".According to Yang et al. [5], the internal components of each CIS could be categorised into four main types: human components are categorised as individual or collective, while non-human components are divided into physical structures and non-physical existents.For CISs resilience studies, the last of these could be referred to as the "main function of a target CIS" [5].This leads to the first part of the consequences: "Damage of main functions".As the function of a CIS is based on the function of all components of this CIS, the damage to components' function is one of the essential factors to be considered for CISs' damage.As a result, the second part could be defined as "Functional damage to components.Furthermore, amongst all internal components, physical structures are physical material objects, whose physical damage is common and needs to be assessed additionally.Besides, in considering human injury, the individual human actor has both physical and mental damage, i.e. physical injury and mental injury [103,104].On the other hand, the collective human actor which generally refers to a public or private organisation, unit, or company is a virtual object or concept created for human society.Therefore, only their functional damage should be taken into account.All significant functional, physical, and mental damage could be translated to the sub-criteria for defined scenarios if they are considered related to the assessment goal.

"Action" aspect
For the sub-criteria related to the "action' aspect, not only implementing actions should be identified, the ideal outcome and costs of actions need to be clarified.The process is presented in 'Form 2 ′ .
The choice of implementation actions is various and multidimensional.Recently, some frameworks are created for CIs stakeholders to design implementation actions for improving CISs resilience [47,85,102,105].Among these theories and methods, we highlight the "Behind the Barriers" model (BB model), developed by Barroca and Serre [43], which allows effective and comprehensive development of infrastructural system resilience by considering the interdependencies in various urban scales.BB model argues that the actions for improving capabilities could be described in four dimensions: • A cognitive dimension refers to knowledge, awareness, and the identification of resilience by the persons concerned.Cognitive actions refer to all processes relating to knowledge, thus the  processes of identification, acquisition, and processing of information that is produced by population or managers for risk identification and resilience evaluation.• A functional dimension specific to material objects and technical urban systems forming the territory.Functional actions are implemented by working on reliability (by overprotecting infrastructures), increased redundancy (by finding different pathways or using several action modes for the same service), and riskrelated stock management (by creating temporary or permanent storage facilities close to the place of use).• A correlative dimension that recognizes that service and utilisation form a whole whose different sections are interconnected together.
Correlative actions aim at balancing need and service capacity in the targeted internal infrastructural system.• An organisational dimension that raises the question of the persons involved (public and private players, populations, etc.) and the strategies that contribute to improving resilience.Territorial actions depend on the capacity of the organisation and management beyond infrastructure itself or local conditions, thus designing general measures at larger scales.
The applications of the "Behind the Barriers" model to resilience analysis are wide and various, as it is a multidisciplinary, transversal resilience theory aiming at adaptation capacity [5,10,106,107] The criterion "Effectiveness of action" depends on the content of the action, including its objective, obtained result, and efforts [108].The sub-criteria designed based on the objective of actions show the performance of an action by the information of ideal outcomes of actions corresponding to the objective.The sub-criteria, under the "Effort for action" criterion, refer to the consumption of the measures implemented and has four dimensions: environment, function, economic, and human or material resource.Economic cost and human-material resources are more common.Environmental costs could be described as planned consumption or effects of the factor in an energy-natural system.The energy-natural system includes a natural environment composed of air, water, soil, radiation, land, forest, wildlife, flora and fauna, etc. [109], and materials produced or consumed, such as food, waste, water, etc. [33].Functional costs address the planned functional interruption or reduction of CISs components.The functional costs could refer to the functional unavailability of a component of a CIS.For example, the action of repairing railway tracks necessarily requires the suspension of the use of the railway lines where the repair point is located.In this case, the functional cost of railway track maintenance is the interruption of the function of the relevant railway lines.Functional costs could also involve a reduction in use despite the functionality of the component being available.For instance, in the example just used, the maintenance does not reduce the service capacity of the train station located on the suspended railway line.However, the suspension of the railway line reduces the number of trains in and out of the station, so the functionality of this train station is also reduced.Thus, functional cost refers equally to the service reduction of the train station, not only service capacity reduction.

Damage of action and continuous scenarios
In summary, the sub-criteria, under "Damage to internal components", "Effectiveness of action" and "Effort for action" in a defined scenario, are based on the information obtained about the affected components, their failure modes, the objectives of the selected actions, the costs of the actions, etc. (see Figs. 9 and 10).However, the subcriteria for the "Damage of action" criterion are not discussed in the above sections.The "Damage of action" criterion requires the investigation of continuous resilience scenarios as shown in Fig. 5

(A.2, B.1).
The key is the internal components and external systems that have suffered indirect functional, mental, or physical damage.These cascading damages imply the emergence of new resilience scenarios.The criterion "Damage to internal components" in these two continuous scenarios (Fig. 5, A.2, B.1) is therefore equal to the criterion "Damage of action" in the initial scenario (see Fig. 11).Form 1 in Fig. 9 is also adapted to defining significant damage of action in potential continuous scenarios.
Moreover, continuous scenarios also involve: • the cascading effects of damage that has already occurred (see Fig. 5,  B2); • and the positive effects of actions in the long term (see Fig. 5, A1).
As continuous scenarios are endless, they allow assessing CIS resilience to be continuous over time.Nevertheless, as mentioned in Section 3.1.1,this study tends to focus on the scenarios closer to the original scenario that have a higher probability of occurring and are more important.The resilience assessment of a CIS should rely also on significant scenarios listed in Fig. 5.All continuous scenarios studied in this paper are all based on the conceptual scenario of resilience (see Fig. 4).The components of all studies scenarios are therefore highly similar.Thus, the important aspects, the defined criteria, and the guide designed for the scenario could apply to all scenarios.
This study highlights its prospect that is summarised in Fig. 11: contribution to the development of a hierarchical structure for CISs resilience assessment.

Developed mcf summary
The design of MCF is based on the collected knowledge about CISs resilience, especially investigations of "definition and phenomena" and "important aspects".The general criteria in the designed MCF could be adapted to all CISs, while the specific sub-criteria are applicable only to relevant target scenarios.The guide for defining sub-criteria begins with the definition of scenarios (initial scenarios and continuous scenarios).After that, the identification of significant damages, actions' outcomes, and costs could follow "form 1 ′′ and "form 2 ′′ .The resilience, identified aspects, criteria, and sub-criteria produce a part of a prospective hierarchical structure for CIS resilience assessment.All contents of developed MCF are interconnected because the process of the establishment relies on reliable logical development.
Since the definition of sub-criteria highly corresponds to specific cases, an example is shown in Section 4 for presenting how to use the guide.

Example application of the designed guide
Combining the presentation above for the designed MCF, for each user, defining the 'hazard' and 'affected system' in a predefined initial scenario (like in Fig. 4) is the first essential step.Defining the continuous scenarios relating to the initial one, and repeating the first step (defining the 'hazard' and 'affected system'), are follow-on works.This example targets a specific occurrence, in which Nantes Ring Road (NRR) system is affected by a flood, as an original scenario.Section 4.1 focuses on identifying the sub-criteria related to the initial scenario, while Section 4.2 focuses on one of the possible continuous scenarios because the resilience scenarios are continuous and numerous due to the interconnections between various urban systems and components.The selected continuous scenario fits type B.2 in Fig. 5, and in this example, is defined to be concerning the dysfunction of the NRR system affecting the Emergency Medical System (EMS) in Nantes (see Fig. 12).Section 4.3 presents a discussion about the "Damage of action" criterion in this example without detailed sub-criteria.
With a length of 42 kms, the NRR system has services extending beyond the local level and is attractive in the region and even in the nation [110].However, the section between the "Porte de la Chapelle" and the "Porte de la Beaujoire" is frequently closed due to the flooding of the Gesvres River [111].NRR is selected in terms of its interesting situation for studying cascading effects.The flood hazard in Nantes city causes less direct damage to other urban components except for NRR, in comparison with other cities in southern France.This fact lets this study focus firstly on the consequence of NRR caused by flood, and secondly on the cascading effects caused after the first scenario.The direct and indirect consequences would be difficult to be distinguee if flood hazards affect directly a large number of urban components.The SMUR in Nantes was chosen for its urgent and crucial service, whose delay of one minute minute's delay can cause significant damage to victims.

Nantes ring road in flooding (Initial Scenario)
The initial scenario is called F-NRR-PAR (flood -Nantes Ring Roadplanning alternative roads) in which a flood is defined as the hazard while NRR is defined as the studied system affected by the flood (see Fig. 12).This study uses the research findings of Yang et al. [5] about the identification of internal components of NRR (including the main function of NRR) and their functions (see Appendix 1).Following the process of "from 1 ′′ , a scientific team, involving staff of Cerema Ouest that participates in the management of NRR, identifies 8 significant damages to 6 components (Table 1).
Based on the internal documents of Cerema Ouest and BB theory [43], to increase the resilience of NRR in such situations, stakeholders could develop various actions in considering cognitive, functional, correlative, and organisational dimensions (see Appendix 2).The actions listed in Appendix 2 are intended as a reference only and do not represent all the actions that could be implemented.amongst these actions, the action "Planning Alternative Roads" is frequently applied and is used here to give an example for identifying outcomes and costs of actions.During the closure of the section between the "Porte de la Chapelle" and the "Porte de la Beaujoire", local road management [112] suggests the alternative roads shown in Fig. 13.The implementation of this measure has one principal objective: allowing users using alternative roads.The ideal outcome of implementing the action would be the increased transport function of the alternative roads.The completion of the action relies directly on two relevant internal components, the "Managers" that plan it and the "Individual users" who use it.The material and economic costs are then dominated by their costs.For example, the economic cost of individual users is referred to a study from Cordier [113], in which the average cost of an individual French vehicle is 33.5 cents per km (ignoring tolls and parking, which are linked to particular roads, motorways, tunnels, certain urban roads, etc.).The environmental cost refers to the component that causes harm to the environment during the implementation of the action.For instance, it could be the air or noise pollution from "Vehicles" in this scenario.
Based on all investigations above, the sub-criteria for the studied initial scenario F-NRR-PAR are summarised in Table 2.

Cascading effects on emergency medical system (Continuous Scenario)
The second part of this case study aims at a continuous scenario referring to the cascading effect caused by dysfunction of the inundated NNR system.In the paper by Yang et al. [5], it is shown that the dysfunction of the NRR affects the services of the city's Emergency Medical Service (EMS) system.Then this study takes the EMS system in Nantes as the second affected system to be studied.Furthermore, Yang et al. [5] consider the use of alternative roads (the same as shown in Fig. 13) for ambulances as a measure for EMS to face the closure of NRR.This means that, in the new resilience scenario, the hazard is the "NRR dysfunction", the affected urban system is Nantes EMS (see Fig. 12, part 2).This scenario is called DNRR-EMS-UAR (dysfunction of Nantes Ring Road -Emergency Medical Service -using alternative roads).The  function of all components is listed in Appendix 3.This study tries to apply the designed guide for CISs resilience to the Nantes EMS system, and also to test its suitability for urban socioeconomic systems.In this scenario, the identification of significant damages is based on an interview with an expert having working experience in French ambulance (see Table 3).The action in this scenario is closely similar to the action in the initial scenario, the only elements that have changed are the two internal components that complete the action, which have changed from "Manager" and "Individual users" of NRR to "Ambulance drivers" of Nantes EMS.At the same time, the objective becomes: allowing "Land vectors" to go through alternative roads and rebooting the mission of EMS "emergency medical services to patients", stopped earlier due to the NRR dysfunction.The economic and environmental costs are not significant in this scenario Fig. 13.Suggested alternative roads in flooding events, source: Yang et al. [5].
Z. Yang et al. that focus on citizen healthy.The identification of sub-criteria is based on the designed guide presented in Section 3.3 and the results are summarised in Table 3.

Scenarios involved "Damage of action"
The sub-criteria identified above for both scenarios are only able to assess "Damage to internal components", "Effectiveness of action" and "Effort for action".As mentioned in Fig. 11 the sub-criteria to assess the criterion of "damage of action" must be based on the analysis of the continuous scenarios in relation to the side effects of implemented action.The resilience of CISs is highly correlated with the safety and security of the actions carried out.An action with low safety and security can lead to more serious negative effects on the infrastructural system and even on the other urban systems associated with it.Therefore, the damage assessment of action must be linked to the consequences in continuous scenarios, both on that infrastructural system itself and on other urban systems.
"Damage of action" is easily confused with the costs of actions, as the latter may also be considered as a negative impact of actions.Thus, this study makes it clear that the costs of action refer to the foreseeable negative effects (condition 1), consumed by international components (condition 2) that arise in the course of action implementation (condition 3).Damage of action does not arise during its execution and its development is unpredictable.For exemple, in the continuous scenario of this case, if the implementation of alternative roads continues for years and years, the public would doubt the EMS capacity of Nantes.Even if the Nantes ring road reopen, the trust of the public in the health system would be still impacted.Therefore, the public distrust for EMS, even though it is foreseeable, is not an effort but a side damage because it occurs after the implemented action.For managers, the decision about which action should be implemented, for how long, and the extent of the effort should be based on an assessment of the damage of actions.

Practical applications of the designed guide
The example does not list all the relevant continuous scenarios based on the initial scenario but demonstrates how sub-criteria for one single scenario can be identified based on the developed user guide.The subcriteria definition for the above two scenarios can be used as a reference for other scenarios that have not been analysed.From a theoretical perspective, the case demonstrates that there is an endless occurrence of continuous scenarios and therefore endless resilience assessment and sub-criteria definition.Thus, for practice management, significant scenarios for resilience assessment should be selected based on the Event Tree Method (EMT), and depends on the circumstances of each specific case.
The results of criteria identification could help define optimisation actions for both two analysed systems, the NRR and EMS.For example, according to the identified sub-criteria, additional "Time costs of individual users", DIRO could reduce additional time by some changes of road equipment, like removing speed limits, minimising barriers and eliminating one-way streets.Meanwhile, every ambulance driver could be considered an individual user.The managers of EMS could also reduce additional time by improving ambulance performance or changing transport sectors.However, the two urban systems need to be monitored and assessed through continuous supervision of their internal structure, as well as their connections with other urban systems, in a context of continuous environmental and social change.Sub-criteria for assessing the resilience of urban CISs cannot be set in stone with the challenge of increasing unexpected disasters.For example, each country experienced an unprecedented epidemic disaster in 2020.This context produces a scenario contrary to the example given: the dysfunction of Nantes EMS affects the performance and efficacy of the NRR transport security service [5].The sub-criteria, also relating to NRR and EMS systems, therefore should be re-identified.
Many existing theories or models for CIS resilience assessment are valuable, although they differ in the definitions and perspectives of this study.Nevertheless, this study insists that for resilience theory to become practical, it is necessary to consider not only the costeffectiveness and negative effects of the operation, but also the uniqueness of each case.Just as teaching a man to fish, rather than simply giving him fish.Rather than predefining criteria for all potential resilience scenarios of CISs, the MCF provides a step-by-step guide that helps identify specific sub-criteria based on concrete situations.The methodology, therefore, allows a wide margin of autonomy for managers and policymakers who have the responsibility for building CISs resilience and need support and guidance to operationalize the resilience-building process.MCF includes a continuous multidimensional assessment of positive and negative aspects, which can better help infrastructure managers to make decisions that are more profitable.
At the same time, in the presented example, this study tries to apply this designed guide to the selected socio-economic system, the Nantes EMS system.The results prove the possibility of applying the designed MCF to other urban systems.Some theories or models used in this study, like C&I-based assessment, and cost-benefit/effectiveness, as well as the interpretations for resilience, are universally suitable for a variety of disciplines.Then, it is considerable for the definition of general criteria and sub-criteria in this study whether they can be used in other humanrelated systems.

Prospects, limitations and future works
This study has consistently emphasised that the designed MCF forms part of a hierarchical system for multi-criteria analysis in relation to indicators.The defined general criteria and identifiable specific criteria, in combination with aspects and indicators, can produce a hierarchical  structure for continuous assessment of CISs resilience.On the other hand, how to use the created indicators, identified sub-criteria, and defined criteria to assess CISs resilience is also worth more future work.The available methods for resilience, damage or cost-benefit assessment are various, like scoring, modelling, and could be quantitative, qualitative, or semi-quantitative.For example, Mebarki et al. [114] propose a probabilistic framework for assessing the resilience-related damages to buildings caused by flooding, regarding both infrastructural structural damage and socio-economic damage.Chen and Elise Miller-Hooks [115] present equations for measuring specified recovery costs (budgetary, temporal, and physical) for intermodal freight transports.Chang [116] demonstrates a life cycle cost analysis in considering: planned costs incurred by the lifeline agency, unplanned costs from seismic hazards incurred by the agency, and their associated societal costs.Which existing methods or theories are more appropriate for the designed multi-criteria framework and more suitable for CISs resilience assessment deserves further discussion.In addition, the assessment of each indicator requires a reference that needs to be adapted to the practical case, and not universal.In short, the designed MCF is still in its infancy and it is hoped that more research work will be done in the future to complete it and put it into practice.Furthermore, the hierarchical structure relating to C&I (see Fig. 1) contributes frequently to Multiple-Criteria Decision-making (MCDM), which is particularly in psychological and management research.MCDM, named also Multi-criteria decision analysis (MCDA), is originally a decision-making tool used in environmental sustainability to evaluate a problem by giving an order of preference for multiple alternatives based on several criteria [117].MCDM now become a tool developed for complex multi-criteria problems and participative allowing direct involvement of multiple experts, interest groups, or stakeholders and presentations of demands that are relevant to their interests [118].From a perspective of organisational management, to make the concept of resilience into operational practice, MCDM could be integrated into CIS resilience assessments.Furthermore, the C&I involved in CISs resilience assessment needs to be weighted, as one of the greatest steps of MCDM is the subjectivity of the weighting with dimensions decided by stakeholders [117].For example, the contributions of different damage to total consequence could be identified by weighting the sub-criteria relating to internal components damages.
A sufficient autonomy for users, i.e. infrastructure managers, in defining scenarios and sub-criteria is an advantage of the created MCF.At the same time, however, it can also be interpreted as a weakness.Managers' experience or knowledge may be so limited that they overlook invisible factors.From a holistic perspective, a collaborative multistakeholder exchange can reduce this shortcoming.But, a significant investment of human resources at the same time that may reduce the cost-benefit of collaborative management.Research in the field of management is therefore needed for a better application of the MCF.
Besides, around this study, more topics could be raised for complementing C&I-based resilience assessment.For instance, this study suggests overlaying the effects of more actions for the final decisionmaking process.However, in practical situations, possible actions could be inter-reinforcing or inter-constraining.The method for integrating the interactions of actions in a scenario into the created MCF could be therefore mentioned.Similarly, many infrastructural systems are facing the challenge of multi-hazards.It is also necessary to analyse the interactions or interdependencies of two or more hazards that exist in the same given scenario.

Conclusion
Focusing on the resilience assessment of Critical Infrastructure Systems, this study develops a multi-criteria framework (MCF), consisting of four general criteria, "damage to internal components", "effectiveness of action", "efforts for action", "damage of action", and a guide for defining specific sub-criteria.This study presents also the application of this guide through a specific example based on a road infrastructure system in France.The MCF is designed based on the definition, phenomena, and important aspects of CISs resilience relating to damages and optimisation actions.The designed MCF is adapted to all types of CISs and continuously changing situations as it takes into account the fact that the development of events is uninterrupted and that requires the assessment of resilience to be continuous.The results of the resilience assessments with the multi-criteria defined through MCF could help CISs managers during decision-making process, as it is a multiplecriteria approach developed for allowing consideration of various interests of stakeholders.Overall, the designed MCF, therefore, makes it possible to define multi valuable criteria for practical operation in CISs disaster management.

Appendix 2
Designed actions based on BB model, created by authors.

Fig. 2 .
Fig. 2. Position of the target criteria in the indicator-based resilience assessment approach, and in the hierarchical structure in MCA, adjusted by authors, source: Yang et al. [12].
Cascading effects of action: the implemented action negatively affects external urban systems.It produces a new resilience scenario, which consists of this action as the source of a cascading effect, an indirectly affected CIS or urban system, their consequence and action (Fig 5, B.1). • Cascading effects of consequence: the consequence of initially affected CIS cause cascading effects on external urban systems.It produces a new resilience scenario, which consists of the consequence as the source of a cascading effect, an indirectly affected CIS or urban system, and similarly, their consequence and action (Fig. 5, B.2).
7): • Pre-event stage (PrES): from the occurrence of a hazard to the beginning degradation of the function of CISs, • During-event stage (DES): from the beginning of the degradation to the maximum degradation of the function of CISs, • Post-event stage (PoES): from the maximum degradation of the function of CISs to the function returning to the level of the pre-event stage or recovering to an ideal state, structure, or property (but still lower than the original state), and • Next event preparation stage (NEPS): from the function returning to the level of the pre-event stage to the occurrence of the next shock on CISs.This stage emphasises the ability to learn and improve from experience.The actions made in this stage refer to the scenario relating to actions' effectiveness in the long-term (Fig 5. A.1).

Fig. 8 .
Fig. 8. General criteria relating to a single scenario, created by authors.

Fig. 10 .
Fig. 10.Form 2 for defining sub-criteria of "Effectiveness of action" and "Effort for action", created by authors.

Fig. 12 .
Fig. 12.Initial and continuous scenarios of presented example, created by authors.

Table 1
Significant damages for the defined initial scenario F-NRR-PAR, created by authors.

Table 2
Sub-criteria for the studied initial scenario F-NRR-PAR, created by authors.

Table 3
Sub-criteria for the defined continuous scenario DNRR-EMS-UAR, created by authors.