Working with “living” models:
Emergent methodological contributions from modeling for
critical infrastructure protection
Brian W. Bush ' Stephen H. Conrad Sharon M. DeLand
brian_bush@ nrel.gov shconra@ sandia.gov smdelan@ sandia.gov
Ignacio J. Martinez-Moyano Dennis R. Powell Aldo A. Zagonel
imartinez@ anl.gov drpowell@ lanl.gov aazagon@ sandia.gov
Acknowledgment
This work was a product of the Critical Infrastructure Protection Decision Support System
(CIPDSS) Project, a tightly integrated research effort by Argonne National Laboratory,’ Los
Alamos National Laboratory,* and Sandia National Laboratories.* The CIPDSS Project is
sponsored by the Science & Technology Directorate of the Department of Homeland Security.
SAND Number: 2008-3892C
' The authors are listed in alphabetical order.
? This manuscript has been created in part by U-Chicago Argonne, LLC, Operator of Argonne National Laboratory
(“Argonne”). Argonne, a U.S. Department of Energy Office of Science laboratory, is operated under
Contract No. DE-AC02-06CH11357. The U.S. Government retains for itself, and others acting on its behalf, a
paid-up nonexclusive, irrevocable worldwide license in said article to reproduce, prepare derivative works, distribute
copies to the public, and perform publicly and display publicly, by or on behalf of the Government.
> Los Alamos National Laboratory, an affirmative action/equal opportunity employer, is operated by the University
of California for the U.S. Department of Energy under Contract W-7405-ENG-36. By acceptance of this article, the
publisher recognizes that the U.S. Government retains a nonexclusive, royalty-free license to publish or reproduce
the published form of this contribution, or to allow others to do so, for U.S. Government purposes. Los Alamos
National Laboratory requests that the publisher identify this article as work performed under the auspices of the
U.S. Department of Energy. Los Alamos National Laboratory strongly supports academic freedom and a
researcher’s right to publish; as an institution, however, the Laboratory does not endorse the viewpoint of a
publication or guarantee its technical correctness.
* Sandia is a multiprogram laboratory operated by Sandia Corporation, a Lockheed Martin Company, for the
USS. States Department of Energy’s National Nuclear Security Administration under
Contract No. DE-AC04-94AL85000.
Working with “Living” Models
Working with “living” models:
Emergent methodological contributions from modeling
for critical infrastructure protection
Abstract
Critical infrastructures are increasingly automated and interdependent, subject to possibly
cascading vulnerabilities due to equipment failures, natural disasters, and terrorist attacks. The
government seeks to ensure that disruptions are infrequent, brief, manageable, and cause the
least harm possible. The system dynamics (SD) approach is particularly promising as a way to
understand these complex systems, interactions, and issues. Problems in critical infrastructure
protection are being investigated with a collection of SD models developed expressly for these
concerns, including agriculture models. This paper discusses the technical and social modeling
context that makes this SD modeling effort seem uncommon. It involves a modular approach, a
model-reassembling technology, a formal process for testing and evaluation, and a social
process for managing the development and use of “living” models.
Keywords: “Living” models, critical infrastructure protection, agriculture modeling
SAND Number: 2008-3892C
Working with “Living” Models
Introduction
This work is part of a larger effort to use system dynamics (SD) modeling to study critical
infrastructures and their interdependencies in order to identify vulnerabilities and mitigate
disruptions caused by equipment failures, human errors, natural disasters, diseases, and terrorist
attacks. The technical and social modeling context includes a modular approach for building and
maintaining the models. Modules can be developed, in coordination but independently, by
different modelers at different sites. A technology specially developed for this work quickly
assembles the modules to create an executable composite model. This ongoing, multimodeler,
multiproblem, modular approach to working with “living” models calls for special considerations
of the social processes for managing the development and use of models.
Critical infrastructure protection (CIP)
It is the policy of the United States to assure the continuity and viability of critical infrastructures
and guard against operational disruptions. This effort protects the people, economy, human and
government services, and national security. It also ensures that disruptions are infrequent, of
minimal duration, manageable, and cause the least harm possible. This policy was established
prior to the events of September 11, 2001 (PDD-63, 1998), and it enjoys bipartisan support
(EO/CIP, 2001).
The term “critical infrastructure” means systems and assets so vital that their incapacity
or destruction would have a significant debilitating impact on national security, the economy,
public health and safety, or any combination of those aspects of U.S. life (USA PATRIOT,
2001). An open and technologically complex society includes a wide array of critical
infrastructures. Many of them have historically been physically and logically separate systems
that had little interdependence. As a result of advances in information technology and the
necessity of improved efficiency, however, these infrastructures have become increasingly
automated and interdependent. These same advances have created new and possibly cascading
vulnerabilities (Rinaldi et al., 2001).
Critical infrastructures have also become potential terrorist targets. Such nontraditional
attacks on infrastructure and information systems may significantly undermine the country.
Thus, the Homeland Security Act (HSA, 2002) formed the U.S. Department of Homeland
Security (DHS) to, among other things, leverage the nation’s scientific and technological
capabilities in order to address homeland security vulnerabilities and possible threats. It charged
the Department with the responsibility of evaluating vulnerabilities and ensuring that steps are
implemented to protect the high-risk elements of critical infrastructures, including agriculture,
banking and finance, chemical and defense industries, energy, food and water, health and
emergency services, postal and shipping services, transportation, and telecommunications.
A key research center involved in this effort is the National Infrastructure Simulation and
Analysis Center (NISAC). NISAC is a repository for several large-scale, high-resolution
simulation systems.” Related to this effort is the Critical Infrastructure Protection Decision
* http://www.sandia.gov/nisac/
SAND Number: 2008-3892C 1
Working with “Living” Models
Support System (CIPDSS) Project. CIPDSS has the charter to model all critical infrastructures,
key asset categories, and infrastructure interdependencies. In addition, CIPDSS was created to
provide fast, order-of-magnitude assessments of the potential impacts that could result from
disruptions (Bush et al., 2005). NISAC uses SD as one of several modeling capabilities (see
Ellison et al. 2007; Kelic et al. 2007). CIPDSS used SD predominantly to analyze a variety of
threat scenarios, including the introduction of infectious diseases (Powell et al., 2005), loss of
multiple telecommunications assets (LeClaire and O’Reilly, 2005), and accidental release of
toxic industrial chemicals (Samsa et al., 2007), among others.
Computer modeling and simulation technology is a cost-effective means to explore CIP
options; it enables uncertainty quantification and sensitivity analysis and provides a test bed for
evaluating the effectiveness of alternative prevention, response, and recovery actions before their
actual implementation. This technology is crucial, since additional security should enable, and
not unnecessarily burden, the operations of critical infrastructures. The latter would undermine
the overall economic security of the United States in a global economy. Such multisector,
multiscenario models also support decisions regarding tradeoffs between protective investments
in the various critical infrastructure sectors, given the overall budget limitations for such
investments. A holistic and coordinated modeling perspective is considered critical in the White
House Directive on Critical Infrastructure Identification, Prioritization and Protection (HSPD-7,
2003).
With respect to the agriculture infrastructure, HSPD-9 (2004) mandates sector
vulnerability assessments to defend the agriculture and food systems against terrorist attacks,
major disasters, and other emergencies. CIPDSS agricultural analyses have addressed responses
to disruptions of considerable magnitude in the beef and dairy economies (BSE Report, 2003;
Conrad, 2004) and the impacts that have resulted from the introduction of windborne soybean
rust in the United States following Hurricane Katrina (Soybean Rust Reports, 2005; Zagonel
et al., 2005; DeLand et al., 2005). In assessing the sustainability of this research program,
particularly in using the SD approach, it is important to consider the special nature of the
modeling context involved in these efforts.
Technical and social modeling context
To our knowledge, modeling practice seldom resembles the CIP efforts just discussed. We know
of a few exceptions: the Limits to Growth studies (Meadows et al., 1972, 1992), Pugh-Roberts
Associates’ work in business strategy and project dynamics (e.g., Lyneis, 1980; Stephens et al.,
2005), and Forrester’s National Model (Forrester, 1989). All of these appear to draw on “living”
models, meaning models that can be reused, whether refined to revisit the same issues with more
confidence or adapted to address new questions. They tend to be large modeling projects
involving multiple modelers. This work must be effectively coordinated, properly documented,
systematically tested, and objectively evaluated for validity. Ideally, it is supported by
technology that facilitates and enables reuse of, refinements to, and links between models. Such
work must use a social process for modeling that is conducive to creating an efficient
multimodeler development environment. The CIPDSS development effort also faced a
geographically dispersed task force with some degree of turnover. Furthermore, models
SAND Number: 2008-3892C 2
Working with “Living” Models
developed under CIPDSS focus on one infrastructure at a time, and scenario analyses involve
multiple interacting infrastructures.
Two hypothetical situations illustrate this need in general:
= Firm A is working on a large model on a tight schedule. The senior modeler has
developed a small proof-of-concept model to test the dynamic hypothesis. The larger
conceptual model contains several sectors with feedbacks existing between sectors, as
specified in a subsystem diagram. Previous work done by the firm contains core pieces of
weathered formulation that will be useful in building this new model. The proof-of-
concept model contains, in high-level form, all of the basic elements of the subsystems
and important feedback. To make fast progress and meet the project deadline, junior
modelers have been assigned to formulate the subsystems and conduct some preliminary
tests to make sure that they function as expected. In 3 days, the modeling team will
reconvene to combine the sector models, at which point more tests will be done with the
whole model. It is likely that further subsystem development will ensue, and new
merging will be required. All of the development and testing need to be done quickly to
meet the deliverable.
= Firm B had a very successful experience using a large model to address a common
problem for a particular type of business. As a result of its success, several companies
involved in this economic activity became interested in using this model to look at similar
issues, but by drawing on their specific data. Careful inspection has revealed that the
adaptation of the original model to different businesses will require more work than
simply parameterization and calibration of a generic model. The variation across
businesses in their practices, at least for some sectors of the model, is sufficient to justify
a relatively different conceptualization and formulation of the subsystems. In the first
effort, an experienced, articulate modeler interacted with all of the important
stakeholders. She was able to obtain lots of good information from them and get
everyone really excited about the project. Now she needs to bring a group of newly hired
junior modelers up to speed to handle the volume of work required to tailor the model to
different clients.
What technologies and modeling approaches should be used to enable these firms to proceed
quickly and effectively? In both cases, the objective is to make the best use of the firm’s staff
expertise and institutional knowledge while efficiently meeting the deliverables and building
client confidence. If modular modeling is to be supported, what form should the models and
documentation take to facilitate the understanding of, refinements to, and reuse of existing
models? If work on large projects under severe time constraints is required, how can model
pieces readily be assembled into a whole model and then taken apart again? The experience,
strengths, and weaknesses of the modelers will vary, yet model building, testing, and
documentation should be consistent and clear across model subsystems and over the lifespan of
the modeling efforts. This result will require a large degree of coordination and some uniformity
in practice.
SAND Number: 2008-3892C 3
Working with “Living” Models
Little has been said about the technologies and social processes involved in effectively
managing modeling projects spanning years of cumulative research and drawing upon living
models. Lyneis’s recent presentation (2006) on “Managing Large SD Modeling Projects” is one
exception. On the basis of the Pugh-Roberts Associates (now PA Consulting) experience, he
draws upon a number of valuable lessons:
= The typical project involves a modeling team and spans at least several months.
= Problems are “fuzzy,” often with no clear reference mode of behavior; this aspect
presents challenges to determining model boundary.
= Clients expect to be presented with a compelling case based on a robust and accurate
model. They worry about the bottom line. Building the clients’ confidence usually
requires educating them in SD and the roles of models.
= Managing the project itself and the project team is difficult. The fuzzy scope makes
allocating and controlling resources critical.
Lyneis warns of three important risks: modeling “the system” rather than a problem, losing the
client, and overrunning the budget. He suggests these actions for a successful modeling team:
= Avoid simply adding modelers in order to “charge ahead” and meet the schedule.
= Avoid modeling “systems” (constructing large, detailed models with little impact);
instead, build problem-focused models.
= Balance the need for the right process (modeling involving the clients, usually with small,
insight-based models) and the right products (detailed, calibrated models that have a
compelling logic).
= Carefully allocate work, manage schedule pressures and overtime, obtain information and
data in a timely fashion, and minimize rework.
He adds that important, high-stake problems are found at the top levels of organizations.
Detailed, complex models are needed to address these problems. These models employ a
significant amount of data and require extensive analysis and testing. The downside of large
models is the risk of the “black-box” syndrome for those not involved in building the model. The
models are also expensive. It is more difficult for the modelers to understand model behaviors.
There is greater chance of undiscovered errors. In order to avoid these pitfalls, Pugh Roberts
developed a four-phased approach. It begins with a conceptual model, and then builds into a
small, insight-based computer model. This is later developed into a detailed, calibrated model.
The last phase involves implementation of model-based recommendations (see Lyneis, 1999).
Drawing upon their experience in software development, Thompson and Bush (2005)
proposed the technological basis for modular program development for SD modeling. The
technology would apply concepts such as scope definition, modularity, encapsulation, and
modeling standards to create protocols that would support living models, promote reuse of
formulations, and enable distributed development of models (Alexander, 1977; Gamma et al.,
1995; Holzner, 2006). The primary problem to be solved was that of variable identification and
use in different models. To address this problem, we proposed and adopted a set of shared
modeling conventions and standards that would support merging a set of files into a single file
that could subsequently be simulated.
SAND Number: 2008-3892C 4
Working with “Living” Models
Here we discuss the tools and processes that we developed to enable us to find solutions
to the problems we confronted in our CIP efforts. Our experience is organized around four main
points:
A standards-based modular approach to modeling and documenting,
A model-assembling technology for merging modules,
A formal process to test and evaluate the models and generate confidence, and
A social process to support modular development.
& us re
The agriculture infrastructure
Background
We built an agriculture model to explore the propagating effects of large-scale disruptive events,
such as animal and plant diseases. The initial version of the model contained three
interconnected sectors — beef, dairy, and corn (Conrad, 2004). These three commodities are
tightly coupled; almost 60 percent of the corn produced is used as animal feed. Together, they
account for nearly 40 percent of the U.S. agricultural economy (see Figure 1).
<Figure_1_about_here>
This work built upon Meadow’s (1970) “hogs” model of commodity production cycles. The
basic feedback structure, including interactions between the three commodities, is shown in
Figure 2.
<Figure_2_about_here>
The prices of these commodities form the center of a pair of negative feedback loops that
eliminate imbalances between demand and supply, thereby promoting efficient allocation of
resources. These commodities are interdependent because corn is produced for animal feed, and
the price of feed influences decisions regarding beef and dairy production rates, which, in turn,
alter the corn consumption rate and influence corn prices. However, oscillations result from
bounded decision making and producer delays in capacity acquisition.
We used the model to look at the effects of a pair of scenarios involving bovine
spongiform encephalopathy (BSE) and foot-and-mouth disease (FMD) to assess the implications
of containment and eradication policies. The simulations of a short-term decrease in demand for
beef due to the BSE outbreak showed long-term repercussions in the beef and corn markets. Per
Figure 3, in the case of the less dangerous but more contagious FMD disease, the simulations
showed that “exempting” cow-and-calf operations from the existing depopulation policy would
help stabilize beef prices, beef sales, and beef cattle populations without significantly increasing
the risk of contagion.° Cow-and-calf operations are at the head of the supply chain for beef. The
° Cow-and-calf operations tend to be relatively isolated and far less prone to contagion than other operations further
along the aging chain, which are far more exposed to unfamiliar animals in transportation, trading farms, feedlots,
SAND Number: 2008-3892C 5
Working with “Living” Models
impact to the beef economy can be minimized, and normalcy reestablished more quickly, to the
extent that we can shield these operations from disruptions.
<Figure_3_about_here>
Model testing and evaluation
The initial model was examined extensively. The tests performed were conducted by both
external and internal reviewers (Rasmussen and Becker, 2004; Agriculture Model Report, 2004),
and followed SD guidelines for confidence building and model refinement (Forrester and Senge,
1980; Sterman, 2000).
Original beef production module
The critical delays in capacity acquisition result primarily from the production processes inherent
in each of the commodities. For corn, this process involves planting, harvesting, storing, selling,
and distributing. Also, corn is a seasonal crop, planted in the spring and harvested in the fall,
with year-long dependencies on boundedly rational decisions that involve multiple factors
(e.g., expected demand, carrying inventory, subsidies and price), resulting in an aggregate
desired harvest, which is then subject to weather conditions and crop diseases. Similarly, in the
production of beef and milk, there are aging processes associated with breeding and growing the
cattle. Aging chains are used to capture the demographic structure of a population, its changes
through time, and its responses to disruptive events. The original beef production module used
the aging chain represented in Figure 4 (see also supplemental file “N-Ag-Bf-Pr-Original.mdl”).’
<Figure_4 about_here>
Related and ongoing applications
The production module for the beef commodity was revised with marginal additional effort and
is captured in file “N-Ag-Bf-Pr.mdl.” Both the original and the revised modules are operational
and can be used interchangeably with the rest of the modules.*
By expanding and refining the original modules, we can explore a variety of agricultural
disruptions, such as a sudden change in demand for agricultural products, a food contamination
incident, use of commodity crops for energy production, significant crop losses due to disease or
drought, loss of exports (e.g., that experienced by the United States when BSE was detected in
Washington State), and widespread animal disease (e.g., bird flu), and many other threat
and packing plants. Underlying the notion of exempting cow-and-calf operations from the existing depopulation
policy is the idea of making these operations a policy priority through temporary insulation and special sanitary
measures, in an attempt to avoid stamping out of the disease by depopulation in these maternities.
’ The reader may ignore, for now, the variable prefixes and color coding used in the diagram. They serve to inform
the model assembling process, as is discussed later in the paper (see also Thompson and Bush, 2005; Powell et al.,
2006).
* The supplemental file “Beef Model.mdI” includes all of the beef modules (but not dairy or corn).
SAND Number: 2008-3892C 6
Working with “Living” Models
scenarios. Preliminary model analysis using a single-disruption scenario has shown promise in
helping government agencies formulate improved policies for responding to major disruptive
events.
Emergent methodological contributions
The agriculture model has five sectors per commodity: production, inventory, market,
willingness to supply, and willingness to demand. The aging chain used as an illustration is the
stock-and-flow structure of the beef production sector. A full disclosure of the beef model
unfolds into six components, one for each sector and one for the commodity as a whole (see
supplemental file). For three commodities, there are 19 components (six per commodity plus one
for the interactions among them); for six there are at least 37 components.
Agriculture is one of many critical infrastructures. The Congressional Research Service
states that the meaning of critical infrastructures in the public policy context has been evolving
and is still open to debate (CRS, 2004). Table 1 illustrates how this number changed from six
infrastructures in 1983 to more than 20 today.
<Table_1_about_here>
On the basis of present experience and a conservative assumption that the average infrastructure
can be represented with 10 sectors, it would take a minimum of 200+ sectors to capture all of the
critical infrastructures. Moreover, for different purposes and problems, more than one sector
representation may be needed for the same infrastructure component. Consequently, to be
efficient, modeling teams must consider guidelines carefully to determine the breadth and depth
requirements for SD infrastructure models (Becker et al., 2004).
According to the National Infrastructure Protection Plan (NIPP, 2006), properly
maintaining useful models, databases, simulations, and other tools involves long-term support,
coordination, and resource commitments. A modular approach to developing, documenting, and
testing models seems a reasonable strategy for effective use of resources.
Modular approach to standardized modeling and documentation
Modular approaches to system design and development are well established in software and
systems engineering. In SD, from a technical perspective, a modular approach allows the
modeler to formulate small, testable modules. Thoughtful delineation of module interfaces
allows modules to be “extended” or interchanged to provide an appropriate level of abstraction
for different analyses.
We have illustrated what a module would look like and how expansions and refinements
can be used. We feel that two other elements are useful to complement this documentation. The
first is a summary that captures core information about a given module (illustrated in
Appendix 1). The second is a subsystem diagram to show how this module relates to other
modules or models (illustrated in Appendix 2).
SAND Number: 2008-3892C Na
Working with “Living” Models
Model-assembling technology for merging modules
In order to use either one of the two modules with other modules and/or models, we need a
model-assembling technology. Ideally, SD modeling environments (e.g., Vensim™) would
enable models to be merged without cumbersome cutting and pasting. But since this is not the
case, a “Conductor” tool was developed to achieve this result for the CIPDSS Project models.
For the tool to work, the models must meet certain standards and follow certain conventions. The
variables in the model must be linked to their specific modules; the tool performs and checks the
links, relying on the standardized variable naming conventions (the prefixes preceding the
variable names in the diagrams). The color conventions capture such things as variables that are
exchanged between modules. For example, the red “desired breeding stock” variable is imported
from the Willingness to Supply Module, whereas the blue “slaughtering beef cattle” variable is
exported to the Inventory Module. There have been several iterations in the development of the
Conductor. At the Nijmegen Conference, Powell et al. (2006) demonstrated an earlier version.
Decomposing large problems into interacting modules is a powerful software
development paradigm. As applied to SD modeling, we believe it can make a significant
contribution, particularly in the context of living models. The many benefits of a modular
approach to modeling include improved maintainability of formulations and documentation,
possibility of asynchronous model progress, and the use of shared protocols that tend to induce
best practices and sustain model quality.
Modular testing and evaluation — accumulating confidence
A related effort is underway to reorganize the tests to build confidence in SD models (Zagonel
and Corbet, 2006). The idea is to produce a testing framework that specifies tests targeted to the
variety of model purposes (e.g., understanding vs. forecasting) and serve as a guide to
documenting model tests and refinements. Currently we document model testing using Sterman’s
(2000) classification. See Table 2 for an example.
<Table_2_about_here>
Items unmarked have not been done, a situation that points to nonapplicability or opportunities
for further testing and refinement. The presence of more checked items does not imply
acceptable levels of confidence in the module; however, in relative terms, they serve as a proxy
for the accumulation of confidence across modules.
Social process to support modular development
An integral element of modular model development is a social process in which modelers,
project leaders, and other stakeholders must communicate on the standards “contract” as well as
on module boundaries, testing, documentation, version control, etc. The Conductor tool requires
a contract with the modelers in the form of a set of modeling standards that are complete and
comprehensive to enable merging. However, the Conductor does not specify the standards — the
SAND Number: 2008-3892C 8
Working with “Living” Models
modelers do. This task was a challenge for the CIDPSS team. The technical staff across
participating sites had to agree on a common set of standards.’
Another aspect of social process in modular development is the identification of modules,
module boundaries, and interfaces. The modularity expressed in the Agricultural model
described in this paper is but one form of module partitioning. Other domains in the critical
infrastructure models have different module partitions. We believe it would be beneficial to
establish a common rationale for module creation.
The general philosophy is to define a domain (e.g., agriculture) and then describe the
pertinent subdomains (e.g., beef, dairy, corn, soybeans, hogs, broilers). Each subdomain is
formed by a number of modules. The domain is essentially defined by the performance of the
subdomains, although it may include unique information and can be represented as a module that
primarily links the subdomain models. Within a module, the system is described as an SD model,
but where information that must be found in another module is required is identified as an
interface variable for incoming information. This variable is defined exactly as the variable name
in the other module and given a default value, enabling the module to run in standalone mode.
The Conductor, when merging the modules, connects the local variable to the variable
defined in the other module so that dynamic values are available to the module at run time. The
variables in the model that are meant to be used in other modules are specially designated as
export variables and denoted in the diagrams with a specific color. Conductor enforces the
defined standards for import and export variables, which gives rise to the social process carried
out among modelers to communicate their “public interface” for the module. A modeler working
on a different module can still access non-import/export variables, but the practice is discouraged
to promote encapsulation. Clearly, a substantial discussion among the model builders must occur
for them to create preliminary interface definitions and subsequently maintain interactions to
assure that the information needs of other modules are met.
In conclusion
The use of a modular approach to modeling and documentation, coupled with a model-
assembling technology for merging modules, can help manage the volume and quality of the
models developed to investigate problems and threats in critical infrastructure protection. This
technology addressed a call for a coordinated effort to build knowledge as analyses based on SD
models accumulate over time. The four novelties discussed in this paper were not trivial to
implement and adopt, but they seemed to be essential if a long-term consequential research
° A common objection was that namespace prefixes were cumbersome to use and interfered with the readability of
the model. Several expressed the opinion that modules, by their nature, tended to “break up” the flow of feedback
loops that traversed domains and interfered with the understandability of the whole system. Thus, our use of
subsystem diagrams resulted. More insidious were the feelings that a group of modelers desired to impose
(unreasonable) standards while unwilling to consider or accept standards devised by another group. The social
aspects associated with just establishing the standards contract require time and careful, reflective discussion and
should not be underestimated. We feel that the airing of our modeling styles and differences was mutually
beneficial, although it was strenuous.
SAND Number: 2008-3892C 9
Working with “Living” Models
agenda using SD modeling is to be fruitful in protecting critical infrastructures. These
innovations addressed a challenging technical and social modeling context. With them, we hoped
to facilitate the use of existing resources and expedite refinements and expansions to models as
new problems arise for investigation. We intended to enable modeling work to progress in
parallel at both the subsystem and whole-model levels, aided by tools that bring together, as
often as necessary, these two levels of development and analysis. Ideally, both model
development and testing can progress and be documented by employing these innovations in
ways that are conducive to an efficiency- and quality-driven modeling effort.
References
Agriculture Model Report. December 2004. “Model testing and refinement of the CIPDSS
Agriculture Model.” Critical Infrastructure Protection Decision Support System Project.
Sandia National Laboratories.
Alexander C. 1977. A Pattern Language: Towns, Buildings, Construction. Oxford University
Press, USA.
Becker N, Bettencourt L, Buehring W, Beyeler W, Brown T, Bush B, Conrad S, Dauelsberg L,
DeLand S, Joslyn C, Kaplan P, LeClaire R, Loose V, North M, Powell D, Rasmussen S,
Saeger K, Samsa M, Thompson DR, Whitfield R, Witkowski M. 2004. “Guidelines for
determining CIPDSS infrastructure model depth and breadth requirements.”
Report LA-UR-04-5324. Los Alamos National Laboratory.
BSE Report. December 2003. “Analysis of the impact of Mad Cow Disease outbreak in
Washington State.” Critical Infrastructure Protection Decision Support System Project.
Sandia National Laboratories.
Bush BW, Dauelsberg LR, LeClaire RJ, Powell DR, DeLand SM, Sansa ME. 2005S. “Critical
Infrastructure Protection Decision Support System (CIPDSS) Project overview.”
Proceedings of the 23" International Conference of the System Dynamics Society.
Boston, Massachusetts (July 17-21).
http://www.systemdynamics.org/conferences/2005/proceed/papers/LECLA332.pdf
Conrad SH. 2004. “The dynamics of agricultural commodities and their responses to disruptions
of considerable magnitude.” Proceedings of the 22" International Conference of the
System Dynamics Society. Oxford, England (July 23-27).
http://www.systemdynamics.org/conferences/2004/SDS_2004/PAPERS/352CONRA.pdf
http://www.systemdynamics.org/conferences/2004/SDS_2004/SUP_MAT/ -
Supplemental file: 352.mdl
CRS. 2004. “Critical infrastructure and key assets: definition and identification.” Congressional
Research Service Report for Congress RL32631.
http://www. fas.org/sgp/crs/RL32631.pdf
SAND Number: 2008-3892C 10
Working with “Living” Models
DeLand SM, Kaplan PG, Conrad SH, Zagonel AA. 2005. “A holistic approach to understanding
the soybean rust issue.” 1‘ National Soybean Rust Symposium. Nashville, Tennessee
(November 15-16).
http://www.plantmanagementnetwork.org/infocenter/topic/soybeanrust/symposium/poste
rs/52.pdf
Ellison J, Kelic A, Corbet TF. 2007. “Is a natural gas strategic reserve for the U.S. necessary? A
system dynamics approach.” Submitted to the 25" International Conference of the
System Dynamics Society. Boston, Massachusetts (July 29-August 2).
http://www.systemdynamics.org/conferences/soon.htm
EO/CIP. 2001. The White House Executive Order on Critical Infrastructure Protection
(October 16).
http://www.whitehouse.gov/news/releases/2001/10/20011016-12.html
Forrester JW. 1989. “The system dynamics national model: macrobehavior from
microstructure.” In Milling PM, Zahn EOK (Eds.). Computer-Based Management of
Complex Systems: International System Dynamics Conference. Berlin: Springer-Verlag.
Forrester JW, Senge PM. 1980. “Tests for building confidence in system dynamics models.” In
Legasto Jr. AA, Forrester JW, Lyneis JM (Eds.). System Dynamics. TIMS Studies in the
Management Sciences 14: 209-228. New York: North-Holland.
Gamma E, Helm R, Johnson R, Vlissides J. 1995. Design Patterns: Elements of Reusable
Object-Oriented Software. Reading, Massachusetts: Addison-Wesley.
Holzner S. 2006. Design Patterns for Dummies. For Dummies.
HSA. 2002. The Homeland Security Act, Public Law 107-296 (November 25).
http://www.dhs.gov/xlibrary/assets/hr_ 5005 enr.pdf
HSPD-7. 2003. The White House Directive on Critical Infrastructure Identification,
Prioritization, and Protection (December 17).
http://www.whitehouse.gov/omb/memoranda/fy04/m-04-15.pdf
HSPD-9. 2004. The White House Directive on Defense of United States Agriculture and Food
(January 30).
http://www.whitehouse.gov/news/releases/2004/02/20040203-2.html
Kelic A, Mathews E, Beyeler W. 2007. “Telecommunications operations resiliency: labor
shortages and the voice network.” Submitted to the 25" International Conference of the
System Dynamics Society. Boston, Massachusetts (July 29—August 2).
http://www.systemdynamics.org/conferences/soon.htm
LeClaire RJ, O’Reilly G. 2005. “Leveraging a high fidelity switched network model to inform a
SD model of the telecommunications infrastructure.” Proceedings of the 23"
SAND Number: 2008-3892C 11
Working with “Living” Models
International Conference of the System Dynamics Society. Boston, Massachusetts
(July 17-21).
http://www.systemdynamics.org/conferences/2005/proceed/papers/LECLA308.pdf
Lyneis JM. 1980. Corporate Planning and Policy Design. Cambridge, Massachusetts:
Productivity Press.
Lyneis JM. 1999. “System dynamics for business strategy: a phased approach.” System
Dynamics Review 15(1):37—70.
Lyneis JM. 2006. “Managing large system dynamics modeling projects: lessons from consulting
practice.” Presentation made at Argonne National Laboratory (November 16).
Meadows DL. 1970. Dynamics of Commodity Production Cycles. Waltham, Massachusetts:
Pegasus Communications.
Meadows DH, Meadows DL, Randers J. 1992. Beyond the Limits: Confronting Global Collapse,
Envisioning a Sustainable Future. Post Mill, Vermont: Chelsea Green.
Meadows DH, Meadows DL, Randers J, Behrens IIT WW. 1972. The Limits to Growth: A Report
for the Club of Rome’s Project on the Predicament of Mankind. New York: Universe
Books.
NIPP. 2006. The National Infrastructure Protection Plan.
http://www.dhs.gov/xlibrary/assets/NIPP_Plan.pdf
PDD-63. 1998. The White House Presidential Decision Directive/NSC-63 on Critical
Infrastructure Protection (May 22).
http://www. fas.org/irp/offdocs/pdd/pdd-63.htm
Powell DR, Fair J, LeClaire RJ, Moore LM, Thompson DR. 2005. “Sensitivity analysis of an
infectious disease model.” Proceedings of the 23" International Conference of the
System Dynamics Society. Boston, Massachusetts (July 17-21).
http://www.systemdynamics.org/conferences/2005/proceed/papers/LECLA330.pdf
Powell DR, Thompson DR, Martinez-Moyano IJ. 2006. “Workshop on the development of large
system dynamics projects.” Proceedings of the 24" International Conference of the
System Dynamics Society. Nijmegen, The Netherlands (July 23-27).
http://www.systemdynamics.org/conferences/2006/proceed/papers/POWEL256.pdf
Rasmussen S, Becker N. June 2004. “Initial stability and sensitivity studies of the CIPDSS
agricultural sector models.” Los Alamos National Laboratory.
Rinaldi SM, Peerenboom JP, Kelly TK. December 2001. “Identifying, understanding, and
analyzing critical infrastructure interdependencies. IEEE Control Systems Magazine:
11-25.
SAND Number: 2008-3892C 12
Working with “Living” Models
Samsa ME, Powell DR, LeClaire R, Chang Y, Klare P, Martinez-Moyano IJ, Folga S, DeLand S.
January 2007. “CIPDSS chemical threat capabilities case study: summary report.”
LA-UR-07-2382. Los Alamos National Laboratory.
Soybean Rust Reports. 2005. Critical Infrastructure Protection Decision Support System
(CIPDSS) Project. Sandia National Laboratories.
- “Risk-based implications of the presence of soybean rust in the continental United
States” (April 18)
- “Toward a systems understanding of the issues and consequences associated with the
occurrence of soybean rust within the continental United States” (June 6)
- “High-level conclusions and recommendations associated with the occurrence of
soybean rust within the continental United States” (September 21)
Stephens CA, Graham AK, Lyneis JM. 2005. “System dynamics modeling in the legal arena:
meeting the challenges of expert witness admissibility.” System Dynamics Review 21(2):
95-122.
Sterman JD. 2000. Business Dynamics: System Thinking and Modeling for a Complex World.
Boston, Massachusetts: The McGraw-Hill Companies, Inc.
Thompson DR, Bush BW. 2005. “Group development software for Vensim®.” Proceedings of
the 23 International Conference of the System Dynamics Society. Boston, Massachusetts
(July 17-21).
http://www.systemdynamics.org/conferences/2005/proceed/papers/LECLA437.pdf
USA PATRIOT. 2001. Uniting and Strengthening America by Providing Appropriate Tools
Required to Intercept and Obstruct Terrorism Act, Public Law 107-56 (October 26)
http://frwebgate.access.gpo.gov/cgi-bin/getdoc.cgi?dbname=107_ cong public laws&doc
id=f:publ056.107.pdf
Zagonel AA, Conrad SH, Kaplan PG. 2005. “Modeling the impact of loss in U.S. soybean
production resulting from soy rust disease.” Proceedings of the 23" International
Conference of the System Dynamics Society. Boston, Massachusetts (July 17-21).
http://www.systemdynamics.org/conferences/2005/proceed/papers/ZAGON419.pdf
Zagonel AA, Corbet TF. 2006. “Levels of confidence in system dynamics modeling: a pragmatic
approach to assessment of dynamic models.” Proceedings of the 24" International
Conference of the System Dynamics Society. Nijmegen, The Netherlands (July 23-27).
http://www.systemdynamics.org/conferences/2006/proceed/papers/ZAGON374.pdf
SAND Number: 2008-3892C 13
Working with “Living” Models
$950
200
3150
Value of cash receipts ($ billion)
Totals
livestock and poultry: $82.8 billion
crops: $109.4 billion
300
s ¢
se ra es & r Ss & sf & &
a) $ eo rl
F &
Commodity
Source: Agriculture Fact Book 1998, U.S. Department of Agriculture.
Communications, November 1998, pp. 43-44.
Figure 1.
Values of the top 10 agricultural commodities in the United States, 1996
SAND Number: 2008-3892C
Office
of
Working with “Living” Models
(| Beef! tito >
Beef avila Geant
Com Inventory Sf]
Beef Price
Bolts Caa yy Feed
Production one Consumption.
Dairy Inventory,
|
‘Com Price’ |
Daity Dai
. ary
Ke Production che Consumption
Hog and My | we
ity
Production Dairy Price
(not modeled)
Figure 2.
Basic feedback structure of the three-commodity model
SAND Number: 2008-3892C
N.Ag.Bf.Pr: Depopulated beef cattle
20M
10M
Working with “Living” Models
N.Ag.B£Mk: Unsubsidized beef price
951.40
0 24 48 72 «(«96~—«:120«144- 168192
‘Time (Month)
"N.AgBEPr: Depopulated beef cattle" : Exemption policy
"N.AgBEPr: Depopulated beef cat Base run
N.Ag.Bf.In: Beef sales
216
240
0 24 48 72 96 120 144 168 192 216 240
‘Time (Month)
"N.AgBEMk: Unsubsidized beet price”: Exemption policy
"N.AgBEMk: Unsubsidized beef price”: Base run
N.Ag.Bf.Pr: Total beef cattle
3.5M 100M
3.125 M =" 95M Ay
- a 7 LIN |
2 275M || 2 oom
2375M | eM
om LV
aM 80M
0 24 48 72 96 120 144 168 192 216 240
Time (Month)
"N.Ag.Bf.In: Beef sales" : Exemption policy
"N.Ag.Bf In: Beef sales" : Base run
Figures 3A, 3B, 3C, and 3D
More efficient management of FMD through exemption of cow-and-calf operations from existing depopulation policy’®
' The base run entails the depopulation of all animals within a certain radius of the manifestation of the disease. The exemption policy run is of the same
0 24 48 72 96 120 144 168 192 216 240
‘Time (Month)
"N.AgBEPr: Total beef cattle" : Exemption policy
"N.AgBEPr: Total beef cattle" : Base run
magnitude (about 10 million animals); however it excludes cow-and-calf operations.
SAND Number: 2008-3892C
16
N.Ag.BEPr: This View N.Ag.Bf.Pr; A: Beef Aging Chain
N.Ag.BEPr:
depop beef calves N.Ag.BEPr: ‘N.Ag.BEPr: N.Ag.BEPr:
daalicen depop beef calves depop stockers litssamrtmsestle
<N.Ag.Bf.Pr: depopulating <N.Ag.BEPr: <N.Ag.Bf-Pr: <N.Ag.Bf.Pr: depopulating
beef calves in uterus> depopulating beef calves> depopulating stockers> prime cattle>
NAg-BEPr: calf NAg.BEPr: NAg-BEPr: NEAR HG th
gestation time time to wean foraging period on feedlots>
N.Ag.Bf-Pr: beef N.Ag.Bf.Pr: beef \ N.Ag.Bf.Pr: \
oi) calves in uterus calves Q ‘) stockers "prime cattle
N.Ag.BEPr: beef NABBEPE N.Ag.BEPr: N.Ag.BEPr: : NAgBEPr
calf breeding becteating weaning beef calves fattening beef cattle \\_saughtering beef cattle
N.Ag.BF-Pr: reducing
NAg.BEPr: beef N.Ag.BE-Pr: getting
beef cattle breed stock
cattle fertility beef cattle breed stock
N.Ag.BEPr: beef |
<N.Ag.Bf.Pr: beef calves> e
cattle breed stock
<N.Ag.BEPr: stockers>
<N.Ag.BE.Pr: depopulating
beef cattle breed stock>
dairy cattle> N.Ag.BEPr:
depop beef cattle
breed stock
Figure 4.
The aging chain of the beef sector in the original beef production module
SAND Number: 2008-3892C 17
Critical Infrastructure and Key Assets Over Time
U.S. Government Reports and Executive Orders
CBO NCPWI E.0. 13010 PDD-63 E.0. 13228 NSHS NSPP HSPD-7
intrasiructare (1983) (1988) (1996) (1998) (2001) (2002) (2003) (2003)
Transportation x X x x x x x X
Water supply waste water 4 x x x x Xx x x
treatment
Education x
Public health x X X X X
Prisons x
Industrial capacity x
Waste services x
Telecommunications x x x x x x
Energy x X x xi x x
Banking and finance x x x x x
Emergency services x x x x x
Government continuity x x x x
Tnformation systems x x x x x
Nuclear facilities 4
Special events x
Agriculture food supply x x x x
Defense industrial base x x x
Chemical industry x x x
Postal / shipping services x x X
‘Monuments and icons x x
Key industry / tech. sites x
Large gathering sites x
Table 1.
“Critical Infrastructures” Meaning (CRS, 2004)
SAND Number: 2008-3892C
18
Tests for Assessment of Dynamic Models (Sterman, 2000, Chapter 21)
Boundary adequacy
Structure assessment
Dimensional
consistency
Parameter assessment
a 222
e242
Extreme conditions
Integration error
Behavior reproduction
Behavior anomaly
\
Family member
Surprise behavior
Sensitivity analysis
System improvement
(\) Denotes categories of tests performed
Table 2.
Tests performed to the Beef Production Module
SAND Number: 2008-3892C
Appendix |
Module Summary
Name of module:
Brief description of module:
NAgBEPr
Production
Aging chain of the beef cattle. The main input to this module is the desired
breeding stock. The main output is the number of cows being slaughtered
per time period. The amount of time on feedlots depends upon price gains
due to weight gain, and feedlot costs per time period. The depopulating
scenario depletes from the animal stocks
Imported variables: (red &bold
Exported variables (blue & bold)
NAgBF Desired Breeding Stock
NAgBFPr: Slaughicring Beef Cattle
Metrics (bold &punple
(
Policy/scenario sliders
NAgBEPr: Depopulated Beef Caltie
NAgBEPr: Total Beef Cattle
Data: (grey & italic)
Type: Observations:
N.Ag.B.Pr: Average Beef Calving Interval
N.Ag.B.Pr: Beef Calving Percentage
N.Ag.B.Pr: Time to Wean
N.Ag.B.Pr: Foraging Period
N.Ag.B.Pr: Breeding Stock Adjustment Delay
N.Ag.B.Pr: Breeding Duration
N.Ag.B.Pr: Initial Breeding Stock
N.Ag.B.Pr: Beef Calf Mortality
N.Ag.B.Pr: Beef Heifer Mortality
N.Ag.B.Pr: Beef Cattle Mortality
National-data
N.Ag.B.Pr: Fraction of Male Births
N.Ag.B.Pr: Calf Gestation Time
Constant
Observations/questions/issues/problems/suggestions for refinements and changes:
SAND Number: 2008-3892C
20
Appendix 2
Module Subsystem Diagram
This is the subsystem diagram that displays the interconnections between the beef modules (and the dairy and corn models)
<NAgDrDe:
Dairy consumers>
View N.Ag.Bf; 01: Beef Subsystem Diagram
SAND Number: 2008-3892C 21
