Towards a Theory of Quantitative Vulnerability Analysis for Engineering Systems

• Quantitative vulnerability analysis lacks a consistent mathematical bridge from generic susceptibility to measurement, with prior studies using divergent treatments.Source: §1 · p. 1
• The triplet (S,L,C) is better treated as vulnerability space V: only specific interpretations of likelihood and consequence make it risk.Source: §1 · p. 2
• Risk and reliability are specific vulnerability perspectives, whereas resilience evaluates how designs, policies, or configurations change performance under disturbance.Source: §1 · p. 2
• Interpretation both reveals and obscures vulnerabilities, so no single perspective captures all and decisions may involve conflicting recommendations and tradeoffs.Source: §1 · p. 2
• The paper reframes risk, reliability, adversarial vulnerability, and safety as distinct perspectives, each arising from different interpretations of V.Source: §1 · p. 2

• Without interpretations, V does not specify how to combine or compare likelihoods or consequences, so it cannot itself define risk measures.Source: §2 · pp. 2–3
• Risk analysis interprets likelihoods as probabilities and consequences as scalar values, yielding the risk perspective (P,G).Source: §2 · p. 3
• P maps scenario likelihoods into normalized probabilities, with standard discrete normalization assigning probability values from L.Source: §2 · p. 3
• G maps each consequence to a real scalar, partially orders states, and scales values from 0 for no consequence to 1 for maximum consequence.Source: §2 · p. 3
• Probability-weighted measures such as expected consequences and CVaR fit the risk perspective, whose risk measures are coherent and convex.Source: §2 · p. 3

3 Reliability as a Perspective on Vulnerability

• Reliability uses probabilities like risk but maps consequences into discrete quality categories, estimating the likelihood of entering failed or undesirable states.Common metrics include mean time to failure and mean time to repair; these depend on likelihoods binned by category, not individual consequence values.Source: §3 · pp. 3–4

3.1.1 Example Vulnerability Space and Measures

• In the three-state example, risk measures expected loss as p1a + p2b, whereas reliability with τ < a measures failure probability as p1 + p2.The reliability measure treats both failure states alike, unlike risk, which retains their distinct consequence values.Source: §3.1.1 · p. 5

3.1.2 Example Decision Context

• In this example, where the entire design space is efficient (Pareto optimal), risk minimization selects design 2 and reliability minimization selects design 1, so both measures cannot be minimized simultaneously.Source: §3.1.2 · p. 5
• For the power-system example, design 1 improves LOLP10 more than EUE, while design 2 does the opposite; this result holds for 0 < τ < 15 MWh.The measures correspond to reliability and risk, respectively.Source: §3.1.2 · p. 5

3.2 Implications

• Risk and reliability impose different analytical burdens: risk focuses on selected likelihoods and measuring consequences, while reliability estimates likelihoods near the τ boundary.Under a reliability perspective, consequences of states far from the boundary may not need evaluation when worse events have equal or greater consequences.Source: §3.2 · p. 6
• The choice of τ or which rare events to include can change optimal designs, so these limits should not be arbitrary.The paper notes that such choices are often ignored in engineering standards and practices.Source: §3.2 · p. 6

4 Adversaries as a Perspective on Vulnerability

• Adversary(V) = (Π, G) interprets likelihoods as possibilities and consequences as natural numbers.Possibility measures use maxitive, idempotent combination and comparison rather than additive probability measures; the possibility distribution requires at least one state to have possibility 1.Source: §4 · p. 7

4.1.1 Example Vulnerability Space and Measures

• Adding a less frequent but more consequential failure state preserves the risk calculation while changing the reliability measure to count only consequences above τ.The example sets a < τ < c, so its initial unreliability measure is p2 + p3.Source: §4.1.1 · p. 7

4.1.2 Example Decision Context

• In the generic example, minimizing V risk selects design 1, minimizing V unreliable selects design 3, and minimizing V adversary selects design 2, so each measure has a separate optimum.For the community-scale power-system example, reliability is measured as LOLP20 with τ = 20, and optimal design changes by measure.Source: §4.1.2 · p. 8
• Risk and adversary analyses both need practical state filters in uncountable state spaces, using likelihood and plausibility thresholds, respectively.For adversary analysis, practical settings often constrain the search to a failure or attack budget N − k.Source: §4.1.2 · pp. 8–9
• Filtering scenarios by α can remove a state from risk analysis without removing it from adversary analysis, leaving adversary recommendations unchanged as measured risk falls.For 0 ≤ α < p2/p0, state s2 is removed from the risk measure but remains in the adversary measure.Source: §4.1.2 · p. 9

4.2 Implications

• Probability-aligned transformations of possibility analysis do not erase the perspectives’ differences: normalization differences can still yield distinct decisions under α-thresholding.Because α is chosen before analysis and practical systems cannot be fully enumerated, that choice can hide divergences in decisions imposed by filtering the state space.Source: §4.2 · p. 9

5 Safety as a Perspective on Vulnerability

• Safety combines possibility-based likelihoods with set-valued consequences that categorize system states as safe or unsafe.The paper represents the generic perspective as (Π, Γ) and, with a limit-state function on τ, as Safety = (Π, Γτ).Source: §5 · p. 10
• Network survivability, N −1 reliability, and reachability using discrete or possibilistic scenario factors are classified as safety measures.The paper argues that survivability and N −1 reliability should be considered safety measures, while reachability using discrete or possibilistic factors is safety rather than reliability.Source: §5 · p. 10

5.2 Safety of the 4-State System

• With the same threshold and possibility derived from probability, both safety and reliability recommend design 3, but their vulnerability values differ.Without a design, V unreliable = 0.05 and V unsafe = 0.06; under design 3, V unreliable = 0.001 and V unsafe = 0.0012.Source: §5.2 · p. 10
• Raising the threshold to represent safety-critical harms shifts safety’s recommendation from design 3, aligned with reliability, to design 2, aligned with adversary analysis.Reliability tends to use smaller thresholds associated with continued operations; safety focuses more on situations involving large harms.Source: §5.2 · pp. 10–11

5.3 5-State Power Grid Vulnerability Space and Decision Context

• In the power-grid example, probability and possibility share the most- and least-likely states but distinguish the ordering of the other states.The possibility ordering can reflect expert judgments about plausibility, while probability differences may reflect event-specific factors such as age or location.Source: §5.3 · p. 11
• In the final example, realistic choices for data values comprising vulnerability measures lead risk, adversary, reliability, and safety to select designs 1, 2, 3, and 4, respectively.Only design 1 achieves minimum risk; only design 2 benefits adversary measures, and only design 4 benefits safety.Source: §5.3 · p. 11

6 Towards a Theoretical Framework for Quantitative Vulnerability Analysis

• The framework organizes representative measures by perspective, but those examples cover only a small subset of measures used in practice.The authors identify resilience theory, interpretation of hybrid measures, and multiobjective integration as implications for further development.Source: §6 · pp. 11–12

6.1 Formal Conceptual Reframing

• System data must be interpreted through a distinct vulnerability perspective before informing decisions; risk, reliability, adversary, and safety should not be conflated.The framework maps data to a perspective and then to decisions, distinguishing (P, G), (P, Γ), (Π, G), and (Π, Γ).Source: §6.1 · p. 12

6.2 Relationships to Engineering System Resilience

• Vulnerability and resilience are distinct, interacting concepts; vulnerability analysis can precede choosing resilience actions, but measures alone are insufficient for engineering decisions.The authors also argue that the same resilience action may or may not be recommended when the analysis perspective changes.Source: §6.2 · p. 14

6.3 Classifying Hybrid Vulnerability Measures and Models

• Hybrid-measure classification remains an open challenge, and the analysis is neither formal nor complete.Value-at-risk-like measures assume full enumeration of state probabilities and consequences, which the authors say is practically infeasible in complex engineering systems; future work should formally classify what decisions hybrid measures inform.Source: §6.3 · pp. 14–15

6.4 Multiobjective Decision Analysis

• The example shows that every feasible design can be Pareto optimal, leaving decisions to tradeoffs that integration across perspectives may not resolve.The authors recommend considering measures from distinct perspectives, while noting that doing so does not necessarily make decisions easier or produce win-win solutions.Source: §6.4 · p. 15

7 Conclusion

• Without a technical basis for distinguishing risk, reliability, adversary, and safety, practitioners may choose a measure they deem appropriate and proceed with decisions under interchangeable labels.The authors connect this looseness to the broad definition of risk not matching its mathematical treatment for decision-making.Source: §7 · p. 15
• Mislabeling an analysis as risk-based can leave designs unchanged in the best case or lead decision-makers to believe they reduced risk when their measures had no impact on system risk.The authors argue that organizations relying on a single perspective should reconsider their efforts to include multiple quantitative perspectives.Source: §7 · p. 15
• The unified framework is presented as a starting point rather than a final approach, intended to stimulate ideas by setting clearer terms for future measures and decision contexts.The authors suggest that these constraints may enable advances in risk science.Source: §7 · p. 15