A comprehensive approach to assess transportation system resilience towards disruptive events. Case study on airside airport systems

.


Introduction
In complex systems like transportation ones, which in turn may be split into several sub-systems, disruptive events of different magnitude and nature may affect any of the sub-system components, at any time, due to technical failures, extreme natural events or external, intentional human acts (Gu et al., 2020;Zhu and Levinson., 2012).Events such as labour conflicts (strikes) and changes in regulations or policies (service restrictions due to environmental or legal constraints) affect planning and management aspects.Finally, economic/political crises or health emergencies, such as the recent case of the Covid-19 outbreak, might affect the demand-side (Hendrickson and Rilett, 2020;Rothengatter et al., 2021;Schaefer et al., 2021).
Due to the complex relationships among their several sub-systems, transportation systems react differently to different types of disruptive events, depending on both type of disruption and system specific features, included the interconnection and complexity of the several (sub-) system elements.If one of the transport components is disrupted, also the related ones are likely to be affected (Yap et al., 2018;Büchel et al., 2020), although impacts can be significantly reduced if the system is designed and operated to respond and adapt to unexpected events (Zhang and Li, 2018).Particularly, a suitable allocation of resources would guarantee acceptable transport operation levels during and after a disruption (McDaniels et al., 2008;Belkoura et al., 2016).
In the above context, resilience has gained growing importance as it includes aspects such as responsiveness, recovery and adaptation (D'Lima and Medda, 2015;Azolin et al., 2020;Ferreira et al., 2017).A holistic approach to resilience that considers interconnections, interdependency, complexity and uncertainty would improve system responses to exogenous or endogenous shocks (Cheng et al., 2021;Linkov et al., 2014).
Resilience investigation in the transportation field is linked to system vulnerability, generally focused on a specific transportation mode (Leobons et al., 2019): rail (Sun et al., 2018), air (Janić, 2015), roads in urban context (Jenelius et al., 2006;Jenelius and Mattsson, 2012), public transport (Cats and Jenelius, 2018), freight (Chen and Miller-Hooks, 2012;Darayi et al., 2017) and maritime (Zavitsas et al., 2018).Many studies consider specific disruption cases, by analysing one type of disturbances.For example, Lu (2018) explores resilience of rail systems when affected by operational failures.Many works focus on climate disasters (Chan and Schofer, 2016), such as floods (Duy et al., 2019), seismic hazards (Trucco et al., 2013;Wu and Chen, 2019), hurricanes (Zhu et al., 2017).Many others analyze a specific catastrophic event.For example, Bruyelle et al. (2014) consider the disruptive event of the terroristic attacks in London in 2005; Comes and Van de Walle (2014) and Mudigonda et al. (2019) address the case of Hurricane Sandy in 2012; Wilkinson et al. (2012) assess vulnerability of the European air transportation network during the Eyjafjallajökull volcano eruption in 2010.
Previous research proposed several methods and measures to estimate both the consequence and the optimal reaction to disruptions, although relationships between causes of disruption, affected elements and system vulnerability and resilience have not been fully explored yet.Therefore, this study wants to contribute to the state of the art by proposing some vulnerability and resilience indices within a more general framework based on an element-by-element approach (Postorino et al., 2019), which allows analysing the effects generated on/by the elements (infrastructural, organizational, technological) interested by disruptive events, which have been grouped into clusters based on the transportation elements primarily affected.The vulnerability index summarizes the system disruption impacts coming from the different elements, while the resilience indexsplit into its absorptive and restorative componentssynthesises the system ability to adsorb disruption effects and recover to standardor nominalconditions.The goal is to explore if and to what extent the vulnerability and resilience of a transportation systemor a significant part of it such as a complex nodechange depending on both type and duration of disruption and system features.
Particularly, the study focuses on the analyses of airport disruptions and its vulnerability and resilience, especially on the airside airport system.An application has then been made by simulating different types of disruption at four airports in EU in order to measure their resilience by using the proposed resilience index.The relationships among the several elements of the airside airport system and the way they affect the system response to disruptive events have been explored and discussed starting from the obtained results.
In what follows, the literature review on transportation vulnerability and resilience is discussed in Section 2, while Section 3 introduces the proposed vulnerability index by considering explicitly the different system elements.In Section 4, a case study is presented in which the vulnerability and resilience of four European airports are evaluated for different disruptions.Finally, Section 5 discusses the results obtained while Section 6 reports some concluding remarks.

Short literature review on transportation system vulnerability and resilience: main concepts and indexes
Over the last decades, the concepts of transportation system vulnerability and resilience have been largely discussed and several definitions have been proposed.Despite an agreed definition is still lacking, some established aspects of both resilience and vulnerability can be identified (Bešinović, 2020;Zhou et al., 2019;Pan et al., 2021), which are useful for measuring them, typically by suitable indexes.The first formalisation of the vulnerability concept for road transport systems is due to Berdica, who defines it as "a susceptibility to incidents that can result in considerable reductions in road network serviceability" (Berdica, 2002), which is considered as reference description also for other transportation systems (Faturechi and Miller-Hooks, 2015).According to some authors, vulnerability is 1) the probability of occurrence of the disruptive event and 2) the consequences caused by the event (Calvert and Snelder, 2018), although such probability is often unidentifiable, given the non-recurrent nature of disruptive events (Jenelius et al., 2006).In the literature most studies focus mainly on the consequences of vulnerability and then on the assessment of the produced impacts, without taking explicitly into account the probability of occurrence of the disturbance (Taylor and D'Este, 2007).
To summarize the vulnerability concept (see also Fig. 1), in standard conditions the system works at its nominal performance level F 0 (Wan et al., 2018;Enjalbert et al., 2011;Dorbritz, 2011), which might vary if a disruption occurs at time t 1 on a given system element.In this case, generally the system performance changes and reaches a minimum level, F min , at time t 2 when the disruption event ends.The system requires an additional time, usually referred to as "recovery time", to return to its original performance level at time t 3 .Vulnerability refers to the overall performance loss (PL) during the period [t 1 -t 3 ] and can be estimated as the dashed area over the curve in Fig. 1a (Malandri et al., 2018;Cats and Jenelius, 2018;Bruneau et al., 2003).
As for resilience, the initial definition of the time necessary to recover after a disruptive event (D'Lima and Medda, 2015) has been further enlarged to include the whole disruption horizon, which includes the phases before, during and after the disruptive event (Francis and Bekera, 2014).In the context of socio-technical systems, the widely accepted definition of resilience is "the intrinsic ability of a system to adjust its functioning prior to, during, or following changes and disturbances, so that it can sustain required operations under both expected and unexpected conditions" (Hollnagel, 2011).Properties of a resilient system are, among the others, redundancy, robustness, resourcefulness and rapidity (Bruneau et al., 2003).Particularly, a resilient system is able to absorb, adapt and recover quickly from disruptive events (Faturechi and Miller-Hooks, 2015;Vugrin et al., 2010) accordingly to the following capabilities (Fig. 1b): (i) Absorptive capability: the system maintains its features and minimizes disruption consequencesit refers to the response phase, when the disruptive event is ongoing and has not been cleared yet (from t 1 to t 2 ).(ii) Restorative capability: the system returns to original performance levels, or to a new state with improved performancesit refers to the recovery phase (from t 2 to t 3 ), from the end of the disruption event until the restoration of undisrupted conditions.(iii) Adaptive capability: the system adapts to changes by reorganizing functions and activitiesit refers to the entire disruption period, including the response and the recovery phases (from t 1 to t 3 ).
The pre-disruption phase in Fig. 1b refers to a learn-and-prepare step, i.e., starting from disruptive events in the past, the system is prepared to face disruption events that could produce similar effects.
Many studies have addressed the resilience problem by qualitative approaches, rather than quantitative ones.In these latter, indices are generally used to emphasize different aspects of system resilience, instead of resilience as a whole (Zhou et al., 2019).In the literature, vulnerability and resilience have been measured based on some performance indicators among which system performance degradation over time (Twumasi-Boakye and Sobanjo, 2018); rapidity of loss and recovery (Nan and Sansavini, 2017;Liao et al., 2018); amount of demand satisfied in post-disruption phase (Chen and Miller-Hooks, 2012;Jin et al., 2014).Among the proposed measures, some main vulnerability indicators refer to connectivity, accessibility, and serviceability depending on the involved aspect (Taylor, 2017;Gu et al., 2020).Connectivity indicators are generally related to the topology of the considered transport system.Several vulnerability measures have been used including clustering coefficient, edge betweenness, closeness or network efficiency (Derrible and Kennedy, 2010;Adjetey-Bahun et al., 2016;Zhang et al., 2018;Mishra et al., 2012;Latora and Marchiori, 2005).Furthermore, the percolation theory has also been used to investigate vulnerability (von Ferber et al., 2012).In some other studies, vulnerability has been measured by accessibility indicators derived from the Hansen integral accessibility index (Taylor et al., 2006).Finally, network vulnerability based on serviceability has been measured by indices generally associated with travel times or costs (Jenelius et al., 2006;Jenelius and Mattsson, 2012;Leng et al., 2018;Leng and Corman, 2020), by distinguishing whether the congestion effects are included or not (Mattsson and Jenelius, 2015).
Resilience metrics based on different response capabilities (absorptive and restorative) and indicators of system operational functionality have been introduced for complex, integrated, and interconnected systems such as transportation systems (Nan and Sansavini, 2017).Basically, these metrics consider resilience as a dynamic property of the system and are based on the same general concept of estimating how a function expressing system performance in loss or recovery phases varies during the time horizon in which a disruption occurs.Among the most widely used metrics, resilience has primarily been quantified as the system performance losstotal or averagefrom the occurrence of disruption (Adams et al., 2012;Baroud et al., 2014), which measures the degradation of system quality over time and refers to its absorptive capability.Some other studies focus on the system restorative capability (D'Lima and Medda, 2015;Hosseini and Barker, 2016), and resilience is evaluated as the "rapidity" of the system recovery (i.e., slope of the curve in the time interval t 2 -t 3 , see Fig. 1).In other research, resilience is computed as a time-dependent ratio of recovery to loss (Liao et al., 2018;Wang et al., 2015).
As for air transportation, both effects at air network or node (airport) levels have been considered.Some studies analyze air network resilience and vulnerability as the change in connectivity (Wei et al., 2013), clustering coefficient (Li et al., 2014), or the size of the largest connected component (Sun et al., 2017).Some studies propose performance-based resilience/vulnerability indexes in terms of passenger inconvenience and delayed or rerouted flights (Lordan et al., 2014;Malandri et al., 2017;Zhou and Chen, 2020).In Faturechi et al. (2014) the resilience of an airport runway-taxiway system is measured as its ability to adaptively allocate airport resources to absorb and resist to disturbances.In Comes et al. (2020), an approach is presented which evaluates airport resilience including the rapid adaptation of the system itself to a new performance level after a disaster.
In the above context, this paper proposes a resilience index defined as the transport system capabilityduring and immediately after the occurrence of a disruptive eventto reduce efficiently both the magnitude and duration of the deviation from targeted operational performance levels.According to this definition, the resilience index includes both the capability to withstand the disruption (absorptive capability) and the efficiency of the recovery phase, i.e., how fast the system can return to the original configuration (restorative capability).Finally, the resilience index has been evaluated in terms of throughput, in line with other studies (Adjetey-Bahun et al., 2016;Zhang andMiller-Hooks, 2015, Trucco et al., 2013), while vulnerability has been estimated by considering only the "consequence" side, without including the probability of occurrence.To obtain suitable measures, which take into account both system components and their relationships, both absorptive and restorative capabilities have been estimated by considering the several components of the involved (sub-)systems.
With respect to resilience indicators in the literature, the proposed index considers two components (absorptive and restorative) simultaneously, while previous studies generally consider only one of them or, in some cases, both, but separately.Moreover, other than incorporating absorptive and restorative capabilities into a single metric, the advantage of the proposed index is that it allows to understand both the prevalence of one resilience component over the other and if the overall system behavior in disrupted conditions is due to a great absorptive capability or on a great ability to recover.This makes the proposed index effective in supporting planning and implementation of actions addressed to mitigate the effects generated by a disruptive event, as discussed in the next sections.

Vulnerability and resilience of complex nodes: airport case
For a suitable resilience measure of a complex node, the contribution and impacts of the different elements that interact among them should be modelled within a general framework.In this section, the resilience index proposed in this study is presented by considering explicitly the potentially impacted elements accordingly to the disruption causes.

The general problem
Let S(X, O, M) be a transportation node.X is the vector representing physical and service characteristics of the several node elements; O is the vector of transport operators that realize the service in S and M is the vector of technical service providers.The elements of O and M refer to the specific features of both transport operators and service providers.For an airport node, X includes airside infrastructures (set of runways, E; set of available parking stands, F), while the elements of O refer to airlines and the elements of M refer to technical service providers such as ground handling and ATC, 1 which deploy both staff resources and equipment to perform their functions.
Let CAP τ be the runway capacity (or maximum throughput capacity) of S in the nth sub-period τ in the reference period T, defined as the expected number of movements (landings and take-offs) that can be performed at the airport runway system during the period τ in T (de Neufville and Odoni, 2003).By referring to Fig. 1, a disruptive event D(t d ), whose duration is undermines the performance of S with respect to standard (or nominal) conditions.Particularly, D(t d ) affects the involved resources (arcs/nodes, transport operators and providers) at different levels.Deviations from the originally planned operations, caused by partial or total unavailability of resources (infrastructural, operational, technological), generate a reduction in capacity and a loss of the system performances, which impact mainly on vehicle/passenger flows and service operations.Both the absorptive and restorative capabilities are related to the loss of capacity LoC D of the transport system during the disruption period t d .LoC D is defined as the difference between the transport system capacity utilization in baseline conditions during t d and the effective capacity utilization in disrupted conditions during the same period.Let CAP τ,D be the system capacity in disrupted conditions.The system restores the original performances after a recovery time t r = [t 2 , t 3 ].The total disruption period t t corresponds to the time interval [t 1 , t 3 ].
Potential disruptions have been grouped in four clusters (C1, C2, C3 C. Malandri et al. and C4), accordingly to some main impacted transportation system operations/infrastructures.Cluster C1 refers to disruptions on arcs and/ or nodes (such as runways/taxiways or aprons), which cause a direct reduction in their capacity (CAP τ = CAP τ,D ) by a percentage P CAP that directly affect infrastructure and services (X) as well as providers of technical services (M) -e.g., ground handling or ATC.Cluster C2 concerns the total unavailability of one or more arcs and/or nodes of the service network, which directly impacts on infrastructures and services (X) and might generate the need to re-route/re-schedule traffic units on alternative routes/facilities.Cluster C3 refers to disruptions involving failure in service operations, which might be due to two main causes: (i) industrial actions, which reduce the number of available workers by a percentage P O or P M for one or more operators O i or for one or more providers of technical services M j ; (ii) failure of technical equipment (e. g., ground radar), which result in lacking services until an alternative resource is available again or until the failure is cleared.Finally, Cluster C4 refers to the complete disruption (temporary closure) of the entire airport for the period t d .In this condition, the capacity CAP τ,D is equal to 0 for each sub-period τ in t d and all the operations are temporary suspended.
Table 1 summarizes the most common causes of disruption for each cluster and the disrupted resources for an airport node.
Vulnerability and resilience of the airside part of an airport node 1 may be estimated by following a three-step procedure (see also Fig. 2).
Step 1 At step 1, transportation system infrastructures, technologies and operations at the airside are modelled in nominal conditions and this is referred to as "baseline scenario".The level of complexity of X (physical and service characteristics) depends on the required details to represent the performed operations, also by considering the specific features of O and M. Service airside operations are split into sequential and interrelated processes, for example processes include approaching, landing and take-off cycle (LTO), turnaround and pushback, taxi-out and take-off (see Section 3.2).
Step 2 At step 2, a "what-if" approach is adopted to model different disruption scenarios, the baseline scenario being known from step 1.A disruptive event modifies the state of one or more of the required resources and generates performance losses in the linked processes that, if not recovered during suitable buffer times, are likely to generate cascading effects/failures on successive operations (disrupted performance).Disruptionsidentified in the respective clusters C1, C2, C3 and C4 -and their effects (see also Table 1) are modelled at resource level, i. e. number of runways, taxiways, stands, ground handling personnel units and ground technical equipment (see section 3.2).
Step 3 At step 3, the vulnerability indicator proposed in Cats and Jenelius (2018); Malandri et al. (2018), is estimated based on variations of a selected KPI for baseline (KPI 0 ) and disrupted conditions: Still referring to Fig. 1b, the absorptive capability refers to the time interval t d = [t 1 , t 2 ], in which the transportation system performance decreases from the nominal level F 0 to a minimum level F min .From an absorptive point of view, the more the ability to process remains unchanged (i.e., the throughput) despite the ongoing disruption, the more the system is resilient.Therefore, the slower the performance decreases, the more the system is resilient.For a given disruption period t t = t d + t r , the absorptive capability R abs is here defined as follows: Eq. ( 2) expresses how quickly the impact produced by the disruption will propagate while it actually takes place, which is inversely related to resilience so that a negative sign is due.The denominator ranges in ]0, 1] and R abs tends to -∞ for t d /(t d +t r ) tending to 0. For a given t t , the greater the duration of the disruption compared to the recovery time is, the more resilient the system is (and vice versa), in other words the time needed to recover is much less than the disruption duration.
As for the restorative capability, it refers to the time interval t r = [t 2 , t 3 ] (Fig. 1b), when system performance increases from the minimum value F min to the initial performance level F 0 .The system resilience (in terms of recovery, R rec ) depends on how quickly it returns to the initial condition, measured by the level of throughput before the disruption occurred.Then, the restorative capability R rec is here defined as: As in Eq. ( 2), the denominator ranges in ]0, 1] and R rec tends to +∞ for t d /(t d +t r ) tending to 0. The denominator in this case expresses the weight of the recovery time t r on the total time of disruption t t .Here the sign is positive, since the ratio expresses the speed at which the system recovers the operating conditions of full functionality starting from the time in which the disruption ends.
The overall resilience RES D is then defined as the algebraic sum of the above introduced components: If RES D is negative, then the overall resilience of the system is low, that is, its ability to recover (restorative capability) is not sufficient to fully compensate for its low capacity to absorb the effects of disruptive events.On the other hand, when RES D is positive the ability to recover system functionality following disruption is greater than any weakness exhibited by the system during its occurrence; it should be noted that this does not mean that the system does not suffer the effects of disruption by showing weakness, but rather that it is able to respond with greater strength and speed in restoring its functionality than the strength and speed with which it lost it.Finally, when the absorptive and restorative capabilities are equivalent, they compensate each other and the overall resilience index is zero, which indicates a neutral balance between damage absorption and recovery, i.e. t d /(t d + t r ) = 0.5 (Fig. 3).
To summarize, such a metric incorporates in a unique indicator: 1) the minimum level of transportation system performance during the entire disrupted period [t 1 -t 3 ]; 2) the performance loss LoC over the same period; 3) the absorptive capability of the system, i.e. the slowness of the performance reduction during the disruption duration [t 1 -t 2 ]; 4) the restorative capability, i.e. the rapidity of recovering the undisturbed functional level F 0 during the recovery time interval [t 2 -t 3 ].Finally, this index allows highlight whether system resilience is primarily attributable to one or the other component.

Airport airside model and processes
The system of runways, taxiways and aprons may be decomposed in nodeswhere operations effectively take placeand arcs, which represent relationships among nodes.Nodes may be grouped in physical ones (e.g., aprons) and virtual ones (e.g., temporal positions in a process).Arcs, characterized by capacity, direction and length are physical (in this case length is the real distance between the two connected nodes) and virtual (in this case length is the time gap between the two connected nodes) accordingly to the nature of nodes.As for aprons, they are physical nodes characterized by a capacity equal to the number of stands, while the activities performed there are represented by virtual nodes and arcs (see also below).When an aircraft arrives at the apron and occupies one stand, the apron available capacity decreases.
Let K S be the set of aircraft k(a,w) expected to land at a given airport, described by S(X, O, M), during T. Each arriving aircraft k(a,w) is operated by airline a (low-cost or full service) and is of type w (narrow or wide body).Arrivals and departures follow the airport flight schedule and each k(a,w) performs the same sequence of activities (approaching, landing, taxi-in, turnaround, pushback, taxi-out and take-off, see Fig. 4).In the following, the same notation k(a,w) -or simply k -will be used to

Modelling landing and taxi-in activities
Let k(a,w) ∈ K S be an aircraft approaching the airport Terminal Manoeuvring Area (TMA) at a time ta k given by: where STA k is the Scheduled Time of Arrival of k(a,w) and t approach is the time required for the approaching phase. 2 t approach is a stochastic variable, mainly depending on aircraft separation standards in the en-route airspace, TMA congestion and strategies adopted by air traffic controllers.While completing the approaching phase, the aircraft is assigned to one of the runways e ∈ E according to potential restrictions regarding runway use and its current operating condition.As for current operating conditions, the runway e is said free if: (i) no other aircraft is using it neither for landing nor for take-off, and (ii) a minimum time has passed from the previous utilization in order to allow aircraft tail-vortices to dissolve according to ICAO separation standards (ICAO, 2007).If runway e is not free, the aircraft will queue following a FIFO rule.
At the end of the landing phase, k(a,w) leaves e and moves along the taxiways towards its assigned stand/apron f ∈ F by using the shortest available path.Stand allocation depends on airline, aircraft type, runway used for landing and, again, potential restrictions.The duration of the taxi-in phase is a random variable depending on the length of the taxiing path (distance between e and f) and the average speed of the aircraft (Wang et al., 2021).

Modelling turnaround operations
Turnaround operations start as the aircraft k has arrived at stand f.They begin when chocks are placed in front of the aircraft wheels at the "on-block time".Several activities i are then performed to handle the aircraft and prepare it for the next departure (Fig. 5).Due to several constraints, turnaround operations are realized in a given order, particularly some of them must be realized sequentially, while some others may be performed simultaneously (Schmidt, 2017).In Fig. 5, the same colour is used to indicate sequential activities.More in details, after chock positioning, passengers disembark begins together with baggage and cargo unloading.At the same time, potable water is replenished and, when completed, waste water servicing can start.Refuelling activities usually begin at the end of passenger disembarkation, as well as cleaning and catering activities.Then, according to schedule, passengers of the following flight board and cargo and baggage are loaded.When all these operations are completed, chocks are removed and the aircraft is ready to move.
Turnaround time is estimated as the time interval between chocks-on and chocks-off and it depends on both the availability of ground handler workers and the duration of each turnaround activity.The latter is assumed to be stochastic (Malandri et al., 2019;Postorino et al., 2020) and described by a probability distribution function (see Appendix A) whose functional forms and parameters are derived from aircraft manuals and previous literature (AIRBUS, 2017;Bevilacqua et al., 2015;Mota et al., 2017) in order to simulate the considered activities as close as possible to operational practice.

Taxi-out and runway line-up and take-off
When turnaround operations are completed, pushback operations start at the aircraft Scheduled Time of Departure (STD k ).Aircraft k is assigned to the available departing runway e and taxies out.Taxi-out time is strongly influenced by airport congestion conditions and if there is a queue of departing aircraft, k will wait for runway clearance following the priority criteria of the ground control.Particularly, priority is always given to landing aircraft, so that if e is used for both landing and take-off operations, waiting time might also be due to other aircraft potentially landing or approaching the TMA during the same time interval.

Vulnerability and resilience estimation
By following Eq.( 1), a suitable vulnerability indicator should measure the airport performance loss during t t , which here may be defined as a function of the number of disrupted flights during t d .In this perspective, in this paper the airport performance under disruption conditions has been expressed in terms of late departures (N L ), diverted (N D ) and cancelled (N C ) flights.Delayed, diverted and cancelled flight generate impacts to different extentscancelled flight generally being the most relevant ones.
As for late departures, a flight k(a,w) is departing late if its Actual Time of Departure, ATD k , is higher than its Scheduled Time of Departure, STD k , by more than 15 min in accordance to ruled standards (Eurocontrol, 2019).The departing delay of k(a,w) is then evaluated as: The total number of late departing flights, N L , is given by the sum of the flights k m (a,w) departing with a delay greater than 15 min during T: Diverted and cancelled flights (N D and N C respectively) are identified based on the following assumptions: 2 This is the phase of commercial flight starting when an aircraft descends below 5,000 feet AGL and ending when the aircraft reaches the runway threshold.
i. if during the approaching phase a flight has to wait for a time greater than t diverted to land, but no slots are available, it is diverted to an alternate airport; ii.if a departing flight experiences a delay higher than t cancelled with respect to its STD k , it is cancelled.
Vulnerability is then defined as the sum of N C , N D and N L , suitably weighted to take into account the different impacts produced by them: The highest the vulnerability value is, the highest the impact on airport performances is.
The weights w (.) represent the substitution rates among the different types of disrupted aircraft, so that υ D may be considered as the equivalent number of cancelled flights.More in detail, the weights refer to generalized costs for delayed (w L ), diverted (w D ) and cancelled (w C ) flights: The costs for delayed flights (w L ) depend on the length of the delay and are quantified using an additive unit cost coefficient g L [€/min]; the costs for diverted and cancelled flights are non-additive costs and are measured by g D and g C [€].
Finally, the proposed resilience index of Eq. ( 4) depends on the Loss of Capacity LoC D , which in the airport context has been characterized as the difference between the throughput rate in standard (or baseline) conditions during the period τ = t d , TR B td , and the throughput rate in disrupted conditions during the same period, TR D td : The aircraft throughput rate, TR τ , during the generic period τ is defined as: where N land,τ and N takeoff,τ are, respectively, the number of landing and departing aircraft during τ and CAP τ is the maximum number of allowable movements in the same period.In nominal conditions, CAP τ is lower than or equal to the denominator; then, TR τ ranges from 0 (no flights during τ) to 1 (full use of the available runway capacity).

Application
The proposed methodology and the vulnerability and resilience indicators have been applied to four different airports (Table 2): Amsterdam-Schiphol (AMS, large hub), Barcelona-El Prat (BCN, hub), Manchester (MAN, large regional airport) and Hamburg-Fuhlsbüttel (HAM, regional airport), with different characteristics (layout, size and infrastructure) but sharing the similar geographical location (Western Europe).For each of the clusters defined in Section 4.1, one disruptive event (cause) has been identified and chosen among those really happened over the last ten years (Table 3).In more detail, with regard to cluster C1, a 7-h radar failure was considered, beginning at 9AM with a capacity loss P CAP = 60%; for cluster C2, the presence of an aircraft on the runway was considered, resulting in the unavailability of the infrastructure resource involved, for a duration of 2 h beginning at 12AM; with regard to cluster C3, a 6-h ground service industrial action beginning at 8AM was assumed, resulting in a reduction in provider resources P M = 40%.Finally, for cluster C4, a complete suspension of operations (total loss of capacity) was imposed due to a massive power failure lasting 3 h beginning at 10AM.
For each disruption scenario, the start time t 1 of the disruptive event, its duration t d , the involved resources and the effects on system performances have been identified.Such data have been retrieved from Eurocontrol (Network Operations Reports -Eurocontrol, 2019, 2020).
The airside model described in Section 4 has been implemented and simulated for each of the four airports by using the agent-based simulation software AnyLogic (www.anylogic.com).The four airport operational systems will be referred to as S AMS , S BCN , S MAN and S HAM .
For each simulation, the schedule refers to the same day (16/10/ 2019) for the considered airports, starting from 3 a.m.Arriving aircraft  are simulated in the airport local airspace immediately before the approaching phase.For each arriving aircraft, the information regarding the aircraft type w (narrow or wide body), the airline a operating the flight and the scheduled times of departure STD are available (source: www.flightradar24.com).
When the simulation reaches the start time of the considered disruption, t 1 , the involved variables change depending on the cluster (see Section 4.1).When the disruption is cleared at time t 2 = t 1 +t d , such variables return to their baseline status.If during the simulation an approaching aircraft has to wait for a time more than t diverted = 45 min to land, the aircraft is diverted to another airport and it is no longer considered in the simulation.In addition, if a flight has a delay higher than t cancelled = 180 min (3 h), it is cancelled and, again, it is no longer considered in the simulation.However, both diverted and cancelled flights contribute to eqs. ( 8)-( 11).Particularly, the coefficients of eqs.( 9)-( 11) estimated by Eurocontrol (2018), which include both monetary (e.g.passenger compensation, luggage delivery, food and accommodation) and non-monetary costs (e.g.crew repositioning, lost demand), have been used: The model has been validated by checking the simulated values with the available data (such as flight schedules, movements/hour, arrivals and departures, taxi-in, taxi-out and turnaround durations, included comparison between simulated delays and historical data).Once developed, verified and validated, simulations have been used to determine vulnerability and resilience indicators in the identified scenarios.Finally, several disruption durations have been considered by varying t d .

Results
In what follows, only average values are reported.In the baseline scenarios, operations proceed according to the schedule and no departure delays occur during the simulation.Then, the disruption scenarios D C1 -D C4 reported in Table 3 have been simulated for the four chosen airports.As expected, for each scenario disruptive events cause departure delays during and after the disruption duration (Table 4), and the maximum delay is generally reached at the end of t d .For each aircraft k, DEL k is computed as in ( 6).The total departure delay during τ, DEL tot,τ is computed as the sum of the departure delays of the flights departing within τ.Similarly, the total departure delay during the period of analysis T, DEL tot,T , is computed as the sum of the departure delays DEL k of all the flights departing within T. Finally, the average delay per flight, DEL, has also been considered.
Vulnerability and resilience values are shown in the last four columns of Table 4 and computed as reported in Section 4.3 (Eqs.( 8) and ( 14)).
The vulnerability and resilience indicators obtained in the several scenarios for the four airports can be analysed at two levels: 1) within each cluster, for each considered airport; 2) for the same airport in the various clusters.
As for vulnerability, the airports with the highest number of movements (AMS and BCN) are generally the most vulnerable and have the highest number of disrupted flights (this is evident, in particular, for clusters C1, C2, and C4).Instead, differences in average delay per flight in the same clusters are less significant.For example, in cluster C4 the average delay for each airport is practically the same, against significant differences in the total number of disrupted flights.
As regards resilience, in Cluster C1 (reduced runway/taxiway/apron capacity), the absorptive and restorative reactions of the four airports appear significantly different: BCN has a low absorptive capability (R abs = − 0.464) but at the same time a marked restorative capability (R rec = 1.082), which results in a good, overall resilience.The same thing cannot be said for AMS, which instead tends to compensate almost exactly absorptive and restorative capabilities, with an overall resilience almost neutral, thus showing a behaviour more similar to HAM, despite the difference in size and characteristics between the two airports.
The situation is more heterogeneous in the case of type C2 disruption (unavailable runway/taxiway/apron), where AMS and HAM show poor overall resilience (<0), due essentially to poor restorative capability, compared to good absorptive resilience.On the other hand, good recovery performance allows BCN and MAN to compensate for lower absorptive ones, and to provide positive overall resilience.
Cluster C3 (on-ground operation issues) shows a substantial trade-off between resilience and absorptive capacity when the disruption involves ground handling operations, regardless of the characteristics of the

Table 4
Results obtained by simulating the disrupted scenarios.involved airports.Finally, cluster C4 (temporary total closure) shows an extremely low absorptive capacity due to the severity of the disruptive event, while the restorative capability (however high on average) is substantially the same for each airport.The resilience and vulnerability values are summarized in Fig. 6. Results show that vulnerability and resilience are not necessarily consistent.For example, in the case of type C1 disruption, the most vulnerable airport (BCN) is also the most resilient and, at the same time, the second most vulnerable airport (AMS) is the less resilient.In fact, BCN, which is very impacted and shows a low absorptive resilience, recovers fast.In this case, the high resilience value can be explained because of the high number of cancelled flights (63).In fact, while cancellations affect strongly the airport vulnerabilitythis is the term with the greatest weighta high number of cancelled flights allows operations to return normal rapidly.On the contrary, AMS, whose vulnerability is not as high as BCN, takes longer to recover because of accumulated congestion due to a lower number of cancellations ( 10) and a high number of delayed aircraft.
Some alternative disruption scenarios have been examined by changing the disruption duration.Disruptions are assumed to start at 8 a.m. for all the scenarios; for cluster C1, different runway capacity reductions have been considered (P CAP equal to 40%, 60% and 80%), referred to as C1(CAP τ,D = 60%), C1(CAP τ,D = 40%) and C1(CAP τ,D = 20%).Fig. 7 depicts vulnerability and resilience trends as a function of the duration of disruption t d .As it can be seen, vulnerability increases more than linearly with t d .
However, the steepness is different depending on the disruption cluster.For clusters C1 and C4 vulnerability shows a steep grown, while in cases C2 and C3 vulnerability grows less than linearly and, even if duration increases, impacts are contained.Results indicate that vulnerability values are higher when reductions in landing and take-off capacities are relevanti.e., scenarios in clusters C4 and C1(CAP τ,D = 60%).Infrastructural problems (C2) do not significantly affect the vulnerability values and, even if the duration of disruption increases, impacts are contained.
As for resilience trends, there are some interesting aspects.For disruptions belonging to cluster C4, airports generally show a more resilient behaviour, with resilience values increasing with t d .For disruptions of types C2 (infrastructural) and C3 (ground operations), values are steady around zero, independently on the duration of the disruption.Negative values are observed only when disruptions durations are relatively short (up to 4 h), indicating a predominance of the absorptive capacity for short disruptive events, which is consistent with the low values of vulnerability observed.Conversely, in all cases resilience is higher for long disruption durations (t d = 14-16 h); when the disruption finishes at the end on the day (between 10 p.m. and midnight) airports are less congested and delays can be more easily reduced, with a consistent predominance of the restorative capability.

Discussion
The results obtained by the case study of the airport airside system paves the way for several comments, with implications for policy and research.

Research implications/main findings
The application of the proposed methodological framework to four different airports to compare their vulnerability and resilience behaviours shows that different transportation sub-systems respond differently to different types of disruptions, but also they may have different responses to the same disruption.
By considering a specific type of disruption, the response depends on the characteristics of the system, including the number of available resources and infrastructure and the system layout.For the presented case study, results show that, within each disruption cluster, airport airside systems behave and react in a different manner.This is evident, for example, by considering resilience results in scenario D C1 and D C4 (disruption at the landing/take-off level and complete closure of the airport), as depicted in Fig. 6.In terms of vulnerability, the two bigger airports AMS and BCN are in general more impacted than smaller ones (MAN and HAM) and this is quite intuitive.In fact, when airports are very busy in terms of aircraft movements, a disruption in the landing and take-off processes affects a larger number of flights and cause a higher total delay.However, by focusing on scenario D C1 , despite AMS is busier than BCN (1,382 simulated movements for the first airport, against 1,009 for the second one), the latter shows a higher value of vulnerability (see Table 4).Although airport vulnerability has been associated to the size of the airport (Lordan et al., 2014), however, the analysis performed here shows that the airport size does not have always a linear relation with vulnerability and resilience, and referring only to size might hidden some other relevant factors.For example, airport vulnerability may be influenced by the system (planned) "utilization" during the period of disruption, and thus on the residual capacity, which is the difference between the airport declared capacity and the scheduled number of movements.The relation between vulnerability and residual capacity emerges from the results of the case study.In fact, BCN operates almost at its runway capacity limit (high scheduled "utilization" during the disruption period, i.e., 95% of the airport capacity, residual capacity of 5%) and is the most vulnerable.Differently, AMS has more residual runway capacity (scheduled airport capacity utilization at 79% during the disruption period, residual capacity of 21%) and results less vulnerable than BCN, so that the spare (or residual) runway capacity could play an important role.Similarly, MAN and HAM are less vulnerable as their capacity utilization is still relatively high during the disruption (54% and 47% respectively).
However, the relation between vulnerability and residual capacity can be observed only for disruptions related to landings and take-offs C. Malandri et al. (scenario D C1 ).By considering infrastructural disruptions (scenario D C2 ), airports still behave differently, however vulnerability is likely to depend on the infrastructural facilities of each airport.Results suggest that vulnerability may depend on the number of aircraft movements per airport runway, during the period of disruption.In fact, the considered airports -AMS, BCN, MAN and HAM in order of decreasing vulnerability -schedule, respectively, almost 100, 80, 64 and 53 aircraft movements within the disruption period.
When turnaround operations are affected (D C3 ), all airports show approximatively the same vulnerability.However, by considering the sizes of the four airports and the number of aircraft to handle, smaller airports (MAN and HAM) are relatively more vulnerable than the others.This may be due to the greater resourcefulness (at the level of on-ground operations) of bigger airports with respect to smaller ones.In fact, ground resources in smaller airports are tightest, even in nominal conditions and they struggle at handling the accumulated congestion.On the contrary, the bigger airports (AMS, BCN) have acceptable responses to the disruption as they have more resources and, when the disruption is cleared and all the operators return available, a higher number of operators is available for managing congestion, thus helping to reduce C. Malandri et al. the impacts of such type of disruptions.Then, smaller airports should focus on turnaround processes and on the opportunity to have some suitable, additional resources to cope with such disturbances.
The results also point out that vulnerability and resilience of a transport system are different depending on the type of disruption event.
Referring to the results of the case study, in general airport systems are more vulnerable when disruptions affect runway capacity (clusters C1 and C4) (as shown by curves in Fig. 7).Conversely, disruptions related to turnaround operations (cluster C3) are less impacting.
Moreover, as the application proved vulnerability depends on the duration of the disruption, resulting in steep vulnerability growth.In fact, when the disruption duration increases, accumulate delays result in serious congestion at the node, the number of cancelled flights is likely to grow and, as a consequence, also the vulnerability value.In fact, the number of cancellations is the factor with the higher weight in vulnerability expressed by Eq. ( 8).The steepness of the curve depends on the ability of the system to allow aircraft to depart despite the limited number of resources.When the curves stay almost constant (for example in case of infrastructural issues, cluster C2), aircraft can depart, as they are delayed but not cancelled: the system in disrupted conditions can be seen as a server processing aircraft with a lower capacity.Differently, when curves grow steep (for example when landing and take-off capacity are reduced significantly, cluster C1) aircraft probably cannot depart and they are cancelled.
The resilience index proposed in this work allows capturing the absorptive and restorative capabilities of transport systems.A resilience value RES D >> 0 indicates a recovery behaviour that is much better than the adsorptive one.In this case, the greater inefficiencies stand during the disruptive event.By considering scenario D C4 , for example, HAM and MAN are more efficient in terms of restorative than absorptive capability, with an overall resilience of 1.1 and 1,2, respectively.Conversely, a negative resilience value is related to inefficiencies during the recovery phase.In this case, knock-on effects propagate on system successive operations, despite the disruption being finished.This situation can be caused, for example, by the absence of buffer times.
Another result emerging from the analysis is that high vulnerability values do not necessarily correspond to low resilient behaviours, and vice-versa.In the literature, often they have been considered with opposite meanings (Seeliger and Turok, 2013).However, while vulnerability focuses on the loss of serviceability and impacts on the system, the resilience concept also includes the ability of the system to recover and absorb, which depends on the characteristics of the systems.For example, accordingly to the adopted indicators, in D C1 BCN is very vulnerable but also very resilient.The high vulnerability comes from the high number of cancellations and relative high costs, as the airport is not able to let some aircraft departures during the disruption.Therefore, during the recovery phase the system does not have to handle the accumulated congestion and queuing aircraft.Finally, transportation system restorative capability may be influenced also by the schedule during the recovery period: if the disruption finishes during an off-peak period, a higher number of resources can be spent for the recovery.

Policy implications
The proposed methodology is helpful for policy makers and operators to identify vulnerable processes in transport systems, depending on the type of disruption, in order to plan suitable actions and policies to enhance their resilience.
From stakeholders' point of view, understanding if some emergency strategies are recommended, wherei.e., on which process/element of the systemefforts and attention should be prioritized, and when actions are more convenient to start is a relevant aspect.Particularly, understanding which process/element of a transport system is influencing its resilient/vulnerable behaviour will help planning different, flexible strategies to respond quickly to disruptions and deploy resources.The clustering adopted in the proposed methodology allows analyzing and planning strategies for a limited number of situations, making preventive analyses affordable.
As for the if domain, a policy should be also "to do nothing" when actions are assumed to be more costly than useful.In this perspective, a preventive analysis may identify those situations where the "to do nothing" strategy should be more convenient.A disruptionand its durationmay be considered acceptable if the expected vulnerability is lower than a prefixed threshold.Also, note that, as pointed out in the previous section, high vulnerability values do not necessarily correspond to low resilient behaviours.When the vulnerability curves grow steeper its values are greater than the fixed threshold, actions will be as effective as they are taken fast because in these cases even one additional hour of disruption makes vulnerability increasing significantly.For example, in the case of the two bigger airports considered in this study -AMS and BCNthe vulnerability value is more than double when the disruption duration passes from 1 to 2 h, and continues to grows significantly for increasing disruption duration.When the vulnerability curves do not grow steeply actions do not need to be started immediately.
Regarding the where point, the clustering allows identifying specific processes, i.e., each disruption cluster corresponds to the malfunctioning of a specific element/process.For example, if a system is highly vulnerable to disruptions of cluster D C2 (infrastructural issues), the infrastructure can be considered as a critical element within the system.By performing a preventive vulnerability analysis, the analyst can identify the vulnerability of the system element(s) for the different disruptions, compare them and draw a priority list based on the values of the vulnerability index.By referring to Fig. 7, for example, bigger airports (AMS and BCN) should focus on landing and take-off processes and related elements (ATC, radar, lighting).Smaller airports (HAM and MAN), instead, should pay attention also to infrastructural elements, for example by monitoring runways pavements conditions.
Concerning when, reaction strategies can be differentiated into pre-, inter-and post-disruption strategies.The first (pre-disruption) strategies consist in preparing the transport system to possible disruptive events, by planning buffer times between successive operations or designing additional resources.Inter-disruption strategies are those deployed when the disruption is in action (interval t 1 -t 2 ).These include efforts for a) clearing the disruption by means of designated personnel and resources or b) trying to maintain operations as well performing as possible.Post disruption strategies are those applied when the disruptive event is finished (interval t 2 -t 3 ), where additional resources should be deployed for managing the recovery process, to return as soon as possible to a baseline state.Fig. 8 provides indications on when it is most appropriate to undertake action to mitigate the effects caused by a disruption, depending on the characteristics of the resilience indicator considered and the prevalence of the system's absorptive or resilience capacity.More in detail, when RES D is high, the absorptive capability is lower than the restorative one.In this case, the recovery process is relatively efficient and efforts should be directed to strength the primary response, within the interval t 1 -t 2 .On the contrary, a low or negative resilience index value comes from a poor restorative capability, thus suitable strategies should focus on the recovery process (in this case, the intervention should be located temporally in the interval t 2 -t 3 ).Finally, as discussed previously, if the vulnerability is below a pre-fixed threshold, the "to do nothing" option may be adopted.

Conclusions
Given the role of transportation in territorial systems, the improvement of resilience and reduction of vulnerability is a primary goal for policy makers and transport operators.This paper presents a comprehensive methodological approach for assessing transportation system vulnerability and resilience by considering the nature of the disruptive event and the features and resources of considered system elements.Disruptions have been grouped into clusters depending on which resource is made unavailable and, consequently, on which transportation system process is primarily affected.The proposed general framework has been specified for the airport airside system, and the methodology has been applied to four European airports and several disruption scenarios as case study.
One of the key findings of this study is that disruption types and characteristics of the system are crucial in evaluating system resilience and vulnerability.In fact, despite the need to provide guidelines for improving transportation system resilience and reducing vulnerability, the results have shown that a generalization is not possible.As the application has shown, the different behaviours depend on the characteristics and traffic schedule of the system, including residual capacity, and available resources.In this perspective, the proposed methodology and indicators allow stakeholders to set their own strategies based on their specific features.Particularly, performing preventive analyses based on the system simulation as proposed here may help in understanding vulnerable processes, and thus to differentiate priorities and strategies to timely and effectively respond and recover from disruptions.
The proposed resilience index combines transportation system restorative and absorptive capabilities and helps understanding whether the transportation system is more affected by the disruptive event during the response phase or when it recovers.The developed resilience metric offers an enhanced perspective on transport system behaviour under the effect of disruptive events by providing insights into system performance in different phases and at the transition points among them.The results obtained by simulating the case study show indeed that a low value of resilience not necessarily corresponds to a high vulnerability and that a preventive joint analysis of both vulnerability and resilience indices should be performed.
A further finding is that there is a relation between the duration of the disruption and the vulnerability, which, in the authors' knowledge, has not been remarked in previous studies.Vulnerability grows in different ways depending on the type of disruption.Particularly, the application shows that vulnerability curves grow steeper for disruptions related to landing and take-off processes and are almost constant for disruptions at infrastructural and on-ground operation levels.However, the steepness is different for the airport considered, with more similarities between airports of similar size (AMS and BCN on the one side, MAN and HAM on the other side).
Although the highlighted results are an improvement with respect to previous literature, the sample of airports analysed in this work is small to provide acceptable statistical information, and some other analyses should be performed by considering a greater number of cases.Moreover, the specification of the disruption-recovery scenarios can be improved by incorporating more detailed and practical factors, specifically adapted to the transport systems element under analysis.For example, the system resilience under network cascading delay effects can be further explored.In any case, it must be emphasized that numerous elements, in addition to operational or topological factors closely related to vulnerability, play a relevant role in assessing resilience.Even if it is difficult to summarize in a single index a complex phenomenon such as the resilience of a transportation system, however the proposed metric is scalable and adaptable to different systems, by adapting the KPIs used to evaluate the LoC to the specific system under analysis.
A further investigation should focus on the sensitivity analysis of the resilience index with respect to the parameter values and distribution functions (see Appendix A) considered in the simulation.Particularly, variations in some simulation parameters might affect the simulation result, such as turnaround time of LCC flights, which is lower on average and is expected to affect the resilience measure.Furthermore, the loss of capacity measure assumes that the transportation network has a fixed capacity in optimal serviceability conditions that cannot be increased.In reality, however, transportation systems often have the ability to adapt and eventually increase their capacity in response to exceptional events.Finally, the loss of capacity measure only considers the immediate effects of a disruption on the transportation network (the t 1 -t 3 period in Fig. 1) and it does not capture the potential long-term impacts of the disruption, such as the loss of market share of a transport service, or the negative effects on stakeholders who are not directly affected by the disruptive event when it takes place.
Further tests concerning other transport systems are expected in order to investigate whether the patterns observed for resilience and vulnerability indicators can be generalized to some extent.Moreover, further analysis is needed to identify how residual capacity affects transport systems resilience and to find the relation between vulnerability and the degree of system utilization, as well as between recovery times and operation characteristics.

Fig. 4 .
Fig. 4. Sequence of activities at the airport airside.
LoC D also ranges in the interval [0,1] -when there is no disruption TR D td = TR B td and LoC D is zero, while for decreasing values of TR B td , LoC D increases and is equal to 1 for TR D td = 0. Resilience RES D is then estimated as: RES D = R abs + R rec = − TR

Fig. 7 .
Fig. 7. Vulnerability and resilience expressed as a function of disruption duration, for different clusters and airports.

Fig. 8 .
Fig. 8. Diagram showing the most appropriate time to put policy actions in place ("when" to act, highlighted by the arrows) in response to a disruptive event according to the combination of resilience, absorptive capacity, and vulnerability indicators.

Table 1
Potential causes of airport disruptions, involved resources and effects.
a Air Traffic Control.1 Note that the steps described in Fig.2may apply to other transportation nodes, like train stations and ports.C.Malandri et al.

Table 2
Main data and figures of the analysed airports.