Integration of Critical Infrastructure and Societal Consequence Models: Impact on Swedish Power System Mitigation Decisions

Critical infrastructures provide society with services essential to its functioning, and extensive disruptions give rise to large societal consequences. Risk and vulnerability analyses of critical infrastructures generally focus narrowly on the infrastructure of interest and describe the consequences as nonsupplied commodities or the cost of unsupplied commodities; they rarely holistically consider the larger impact with respect to higher‐order consequences for the society. From a societal perspective, this narrow focus may lead to severe underestimation of the negative effects of infrastructure disruptions. To explore this theory, an integrated modeling approach, combining models of critical infrastructures and economic input–output models, is proposed and applied in a case study. In the case study, a representative model of the Swedish power transmission system and a regionalized economic input–output model are utilized. This enables exploration of how a narrow infrastructure or a more holistic societal consequence perspective affects vulnerability‐related mitigation decisions regarding critical infrastructures. Two decision contexts related to prioritization of different vulnerability‐reducing measures are considered—identifying critical components and adding system components to increase robustness. It is concluded that higher‐order societal consequences due to power supply disruptions can be up to twice as large as first‐order consequences, which in turn has a significant effect on the identification of which critical components are to be protected or strengthened and a smaller effect on the ranking of improvement measures in terms of adding system components to increase system redundancy.


INTRODUCTION
Critical infrastructures provide services that are vital for the functioning of modern society. Today, the public relies on having access to services such as fresh water, heating of houses, telecommunications, healthcare, and emergency response. Large disruptions could lead to life-threatening situations and large economic losses (McDaniels, Chang, Peterson, Mikawoz, & Reed, 2007). In the past decades, many events have occurred where critical infrastructure failures have either directly resulted in or contributed to the overall negative consequences, e.g., the Canadian ice storm of 1998 (Chang, McDaniels, Mikawoz, & Peterson, 2006), the WTC attack of 2001 (Mendonça & Wallace, 2006), Hurricane Katrina in 2005 (Leavitt, 2006), Hurricane Sandy in 2012 (Comes & Van De Walle, 2014), and the power blackouts in India in 2012 (Romero, 2012). These events have revealed the need to holistically analyze potential and previously unforeseen events that can affect critical infrastructures in order to reduce risk and vulnerabilities. An important part of such analyses is the estimation of the consequences of potentially large-scale infrastructure disruptions. However, as society is getting increasingly complex with increasing interdependencies between infrastructures and societal functions (Johansson, Hassel, Cedergren, Svegrup, & Arvidsson, 2015;Olsen, Kruke, & Hovden, 2007), it is getting increasingly difficult to holistically estimate the consequences that may arise.
Risk and vulnerability analyses of critical infrastructures tend to focus rather narrowly on a single system of interest and describe the negative consequences as nonsupplied services (e.g., water, heat, power) or the cost of nonsupplied services. Rarely are, interdependencies between the infrastructures and society's dependence upon these infrastructures addressed. The narrow focus is often appropriate to describe consequences from the point of view of an infrastructure system operator, and infrastructure regulation is, at the moment, often also geared toward that end. However, when seeing from a societal perspective, this is not necessarily an appropriate way of measuring consequences since they can potentially be severely underestimated. Generally, there is a lack of approaches that take higher-order societal consequences of infrastructure disruptions into account, as pointed out by, e.g., Greenberg, Lowrie, Mayer, and Altiok (2011) and Kelly (2015). They further highlight the need for integrating physical models of critical infrastructures and models that capture the societal consequences that arise due to infrastructure disruptions.
Many recent studies in the scientific literature have aimed at estimating higher-order societal consequences of infrastructure disruptions, and most often economical input-output models are used-see, e.g., , Rose, Benavides, Chang, Szczesniak, and Dongsoon (1997), and Santos and Haimes (2004)-but other economic models-see, e.g., Prager, Wei, and Rose (2017) and Rose, Oladosu, and Liao (2007)-which utilize the general equilibrium model are also used. There have also been studies demonstrating how these models can be used to support decisions regarding riskreducing measures-see, e.g., Crowther and Haimes (2005), Resurreccion and Santos (2012), and Thekdi and Santos (2016). Furthermore, there are also some studies aimed at integrating physical models with societal consequence models-see, e.g., Li, Barker, and Sansavini (2015) and Pant, Barker, Grant, and Landers (2011)-and also some studies demonstrating how these integrated models could be used to support risk-related decisions-e.g., Thacker, Kelly, Pant, and Hall (2018) and Kelly et al. (2016). However, none of these studies have systematically evaluated whether it is of importance to account for societal consequences when making decisions regarding infrastructure improvements. Often, it is assumed that by including an economic input-output model to estimate societal consequences, better guidance when prioritizing between improvements is achieved.
The main contribution of this article is twofold. Firstly, to analyze whether and to what extent vulnerability-related decisions regarding critical infrastructures are affected when taking either an infrastructure or a more holistic societal consequence perspective. This is done through a case study in Sweden. Secondly, to present a general approach that integrates models of technical critical infrastructures with an economic input-output model. A further contribution is that we also critically discuss the limitations of the different models used towards this end, which is rarely addressed in the scientific literature concerning critical infrastructure-oriented analyses utilizing economic input-output models. The purpose is not to further develop the underlying models, but rather to present a way of integrating and discussing the applicability and feasibility of the integrated modeling approach.
The article is partially based on previous conference publications by the authors (Johansson, Svegrup, & Hassel, 2014a, 2014b, but here it is considerably extended in terms of decision contexts and more in-depth analyses and discussions of the applicability and validity of the approach. The remainder of the article is structured as follows: Section 2 presents and discusses the general integrated modeling approach, Sections 3 and 4 demonstrate the proposed approach in a case study with a representative model of the Swedish electric transmission system interlinked with an input-output model populated with Swedish national and regional economic input-output accounts where two specific decision contexts related to vulnerability-reducing measures are consideredidentifying critical components and adding system components. Finally, the results, underlying assumptions, and implications of the findings are discussed (Section 5) and conclusions are drawn (Section 6).

PROPOSED INTEGRATED APPROACH
Here we present and discuss the requirements that we see need to be fulfilled and the modeling choices that need to be considered in order to develop an integrated modeling approach. This discussion is geared toward our aim that the proposed modeling approach should be able to support real-life decisions concerning critical infrastructure improvements. An integrated modeling approach should include (1) a model that describes the physical behavior of the infrastructure (or interdependent infrastructures) and the loss of infrastructure services when strained, (2) a model that describes the consequences for society due to loss of infrastructure services, and (3) a way of integrating these models. An overview of the proposed modeling approach is given in Fig. 1.
Many approaches exist for modeling critical infrastructures and for capturing the societal consequences of infrastructure disruptions; see, e.g., Ouyang (2014) for a comprehensive review. It should be noted that this modeling approach aims to be generic and applicable for different critical infrastructures-either a single infrastructure or several interdependent infrastructures. For specific applications, more detailed modeling choices have to be made depending on, for example, the type of infrastructure, dependencies sought to account for, and the time perspective of the analysis. We do not aim to provide answers to all the challenges associated with applying the approach; some are instead highlighted as in need of further research.
In order to guide infrastructure mitigation decisions, the overarching requirements of the integrated model are that it (1) can describe the physical behavior of the infrastructure(s) at a system level due to component failures at the asset level, (2) can capture interdependencies and the impact on societal sectors and societal functions, (3) is applicable for, from an infrastructure modeling perspective, a medium-to long-term time perspective (hours to month-long disruptions), and (4) provides consequence estimations of high precision and in metrics that are accepted by the infrastructure owner(s) and societal actors.

Proposed Infrastructure Consequence Model
The infrastructure model(s) should firstly be able to describe the physical infrastructures with relatively high fidelity so that the results can be confidently used to support real-life decisions. It is also important that an appropriate tradeoff is made between fidelity and simulation time to be able to support comprehensive risk and vulnerability analyses. Secondly, given the interdependent nature of today's critical infrastructure, the approach should be able to capture interdependencies between infrastructures. Thirdly, it should be able to estimate the direct consequences at the system level that can arise due to failures at the component-asset level, since most infrastructure improvements are made at this level (e.g., adding, protecting, or strengthening components).
The approach advocated for here that meets the requirements specified above has been proposed by two of the authors (Johansson & Hassel, 2010) and has previously been applied to case studies of, e.g., interdependencies between the Swedish national railway and the power transmission system from a vulnerability perspective (Johansson et al., 2011;. In this approach, the infrastructure model consists of a structural network-based part that describes the components of the system and how they are connected, and a functional part that describes the effects of failures in the system and the consequences that arise. Since studies have shown that simplified topological models can provide results that are inaccurate and unreliable-see, e.g., LaRocca, Johansson, Hassel, and Guikema (2015)-it is argued here that either network-based models capturing the most salient functional properties or engineering-based models are needed in order to ensure sufficient fidelity. Both structural strains (e.g., removal of system components) and functional strains (e.g., increased or decreased loading or supply) can be analyzed with this modeling approach. The approach is further applicable for modeling different types of technical infrastructures, can capture interdependencies between them, and offers the opportunity to select functional models that suit both the specific infrastructures and the objectives of a specific study.

Proposed Societal Consequence Model
Modeling approaches for describing the societal consequences due to infrastructure disruptions can be divided into two main categories-those that only estimate the direct societal consequences and those that also try to estimate the indirect societal consequences due to interdependencies (Linares & Rey, 2013). One of the most commonly used approaches from the first category is to estimate the cost of nonsupplied infrastructure services through willingness to pay/accept studies (Kjolle, Samdal, Singh, & Kvitastein, 2008). The most commonly used approaches of the second category are the economic-theorybased approaches. The approaches approximate, in most cases, the societal consequences with economic consequences, such as the Leontief input-output (I-O) model (Leontief, 1966) and its extensions (Miller & Blair, 2009) and applications (Hallegatte, 2008;Okuyama & Santos, 2014;Rose & Wei, 2013;Thacker et al., 2018), including the inoperability input-output model (IIM) (Barker & Santos, 2010;Leung, Haimes, & Santos, 2007;Santos & Haimes, 2004;Setola, De Porcellinis, & Sforna, 2009), and the computable general equilibrium model (Prager et al., 2017;Rose, 1995;Rose, Sue Wing, Wei, & Wein, 2016;Zhang & Peeta, 2011). IIM is a standard I-O model where normalization (by introducing inoperability) is performed in the beginning of the analyses rather than at the end, as would have been the case if using a standard model (Dietzenbacher & Miller, 2015). Apart from the economic-theory-based approaches, there are some approaches that are based on expert judgments to capture the effects of interdependencies between infrastructures and societal functions, e.g., Johansson, Hassel, and Svegrup (2016) and Chang, McDaniels, Fox, Dhariwal, and Longstaff (2014).
To estimate the societal consequences, the use of an input-output model populated with economical input-output data is advocated here. I-O models can be used for approximating societal consequences of disruptions, including the effects of interdependencies on both a national and regional level, and are very computationally efficient. National economic data as approximations for physical interdependencies between sectors are advocated for since they are systematically gathered by national bodies, publicly available, and widely used in the research literature, the latter enabling comparative studies. The alternative to using economic data would be to collect actual information of physical interdependencies between all societal sectors, which would present its own set of challenges, e.g., it could be prohibitively time consuming and associated with confidentiality issues. I-O models assume that equilibrium is achieved and are therefore primarily valid for analyses of longer disturbances and disruptions, in the order of a year (Donaghy, Balta-Ozkan, & Hewings, 2007;Okuyama, Hewings, & Sonis, 2004). When studying large-scale infrastructure disruptions, such as the Auckland power outage in 1998 (Newlove, Stern, & Svedin, 2000) or the northeast America power outage in 2003 (Anderson, Santos, & Haimes, 2007), these typically last for days up to a month or so, a time perspective that can be considered rather short from an economical I-O point of view. However, we argue that this model can still provide a good enough estimate of the economic consequences that  (Miller & Blair, 2009) (Leung et al., 2007) is the Ghosh output coefficient matrix, c is the final demand, z is the value added, A * is the interdependency matrix, q is the inoperability vector, c * is the disruption vector for final demand, and z * is the disruption vector for value added.
arise, which is also pointed out by Okuyama and Santos (2014), who claim that using a macroeconomic model to assess economic consequences of disasters can "quickly provide a ballpark estimate of the system-wide impact for recovery plan and finance and/or to evaluate disaster countermeasures in the pre-event period" (p. 1). Hence, in relation to the presented case study, the results from a macroeconomic input-output model can be considered good enough for investigating possible impacts on critical infrastructure mitigation decisions while also accounting for societal consequences. The implications of using a macroeconomic model in this setting are further discussed in Section 5. The original Leontief I-O model is a demanddriven model, i.e., the model describes backward stream linkages. Ghosh (1958) developed a supplydriven model that describes forward stream linkages, which has been adapted for several applications, though there has been a debate about the validity of the model (Oosterhaven, 1988(Oosterhaven, , 2012. The formulations of the demand-driven Leontief I-O model and the supply-driven Ghosh model are shown in Table I, where the formulation of the demand-and supply-driven IIM is also given, for comparative reasons, as it is later used as a way of integrating the models. For a complete description and derivation of the demand-driven IIM, see, e.g., , and for the supply-driven IIM, see, e.g., Leung et al. (2007). When applying an I-O model for a specific study, there are several different choices to be made with respect to, e.g., the objectives of the study, the study area (type of infrastructure and geographic area), and the time perspectives under consideration. The use of a demand-or supply-driven model is, for example, related to the studied infrastructure and whether the consequences appear mostly upstream or downstream. There also exist suggestions for combining demand-and supply-driven models, hence adding the upstream consequences to the downstream consequences (Oosterhaven, 1988;Rose & Wei, 2013). Other modeling choices are, e.g., whether a regional or national model should be used or whether international trade should be included in the analysis.

Proposed Integration of the Models
When integrating the model of the physical infrastructure with the economical input-output model, the information between these models needs to be translated and exchanged. A truly integrated approach requires that the results from the infrastructure consequence model and the societal consequence model be exchanged and influence each other in a recursive manner (Fig. 1). To integrate the models, an approach is required, firstly, to convert direct infrastructure consequences of a disruption for the economic infrastructure sector and, secondly, to convert the results from the societal consequence model back into infrastructure consequences. The output from infrastructure models is often expressed in terms of nonsupplied service (e.g., electricity, water, and gas), which normally can be recalculated as a fraction of nonsupplied services for the infrastructure as a whole with the use of a valid baseline. The input for a standard input-output model is expressed in terms of monetary changes in either the final demand (demand-driven model) or changes in the value added (supply-driven model) for a sector that cannot be directly derived from the infrastructure model.
There are several suggested ways of how this integration can be done in practice. Kelly et al. (2016) present a study linking a network-based model of the power system with a supply-side input-output model through a value of lost load method for estimating the impacts for the U.K. economy. Pant et al. (2011) present an integration of a system model of a port (used to simulate commodity arrival and unloading) with a regionalized economic IIM, where disruptions resulting in a change in the amount of arrivals and departures of commodities at the port affect the exports and imports of the regions having commerce through the port. Li et al. (2015) present a study interlinking a model of the Swiss power transmission system and a demand-side economical inoperability input-output model using two different inputs to the IIM model-(1) the direct effect of the electric power production (estimated by the power system model) and (2) the direct effect caused by reduced workforce productivity. Garvey, Pinto, and Santos (2014) propose an interlinked model of a functional dependency network model and a demand-side inoperability input-output model applied on a fictional electric power system feeding a large metropolitan area. When interlinking the models, the resulting loss in the functional dependency network in terms of percentage of maximum possible effectiveness is equated as inoperability loss for the IIM. Rose et al. (1997) link engineering analyses of regional electricity disruptions in Memphis, Tennessee, with an extended input-output model to estimate direct and indirect consequences. They use information on estimated electricity outages (based on network reliability and electricity availability analyses) together with information on each sector's resilience capacity (based on, e.g., adaptability characteristics) to estimate the direct impacts on sectors, and an extended input-output analysis is then used to estimate the indirect consequences.
Here we advocate using the normalization strategy utilized in the IIM approach in order to integrate the infrastructure model with the economical input-output model. In the IIM, the normalization of monetary values is performed at the beginning of the analysis rather than at the end, which would be the case if using the standard I-O model. Hence, it is possible to utilize the IIM concept of inoperability to derive economic fractional loss for one or several sectors. By expressing both infrastructure loss and economic-sector loss in terms of fractions, it is hence possible to integrate the two models. The fraction of services not supplied by one or several interdependent infrastructures is hence equated with demand-side or supply-side inoperability for the corresponding sector(s) in the IIM.
The output from the economic model can further be expressed in terms of either inoperability or economic loss. If the infrastructure sector(s) is directly or indirectly dependent on the services provided by itself (e.g., the electricity sector can be dependent on power supply or the electricity sector can be dependent on other sectors that are dependent on power supply), this might cause even larger disruptions than the initial disruption for the infrastructure(s). If this is the case, it should be accounted for and the infrastructure model should be run again, causing a chain of iterations until the results have converged.

CASE STUDY-DEMONSTRATING THE INTEGRATED MODELING APPROACH
Here we apply the presented modeling approach on a single national critical infrastructure, the Swedish national power transmission system, and demonstrate how different economic sectors depend on the supply of electricity. The section is structured around the three parts of the integrated modeling approach. For all three models, initial analyses are done separately to present the models and describe the characteristics of each modeled system.

Infrastructure Consequence Model
The national power transmission system is argued to be one of most critical technical infrastructures in Sweden . For the infrastructure model, the topological model describes how the components of the system are interconnected and the functional model, chosen here, is an engineering-based DC load flow model (hence only active power flow is considered) that is commonly employed in power system analyses. The DC load flow model captures how the power system behaves under strains (i.e., for different system configurations) with a relatively high fidelity and offers a good tradeoff between fidelity and simulation time (LaRocca et al., 2015); the latter is of importance since the objective of the case study is to explore a multitude of large-scale disruptions using a full-scale model of a real-life infrastructure.
Matpower (Zimmerman, Murillo-Sanchez, & Thomas, 2011) is used to calculate the DC optimal power flow given any configuration of the system. The optimal power flow algorithm dispatches generators or curtails loads to meet the power flow equilibrium balance with cost as the optimization function subject to the constraints of available generation and capacity of power lines. Each generator is ascribed with a small positive second-order polynomial cost function and each load with a large negative second-order polynomial cost function. The objective hence becomes to dispatch as much load as possible given the system constraints. The optimal power flow is calculated for an original system configuration before straining the system and for each new system configuration after the removal (a) Overview of the power transmission system in Sweden; each region has a number ranging from 1 to 21 (south to north) and the color of each region is a linear gray scale normalization of the region's yearly GRP, ranging from 15 billion SEK (region 6) to 950 billion SEK (region 15). (b) Infrastructure consequence at a national level given the number of removed power lines-average value for the 5,000 iterations (black line), one standard deviation (dotted lines), and maximum/minimum consequences found (gray lines). (c) Infrastructure consequence for each region given the fraction of removed power lines in the power system, indicated with a gray scale (white [0%] to black [100%] power supply reduction), with markers for 10% (circle), 20% (square), and 30% (triangle) power supply reduction; power supply to region 6 is not represented in the model, hence no results.
of one or several components. The functional model can be used for static equilibrium analysis with respect to variations in generation, transmission, and demand (i.e., for adequacy-related analyses, as carried out here) but does not capture short-term dynamical aspects such as frequency variations and voltage collapses. This is a suitable functional model as the aim is to analyze more long-term effects, such as components being out of function for hours to days or weeks, rather than short-term effects, such as voltage collapses and cascading failures (operating in the range of milliseconds to hours). The infrastructure model is a slightly simplified but representative model of the Swedish electric transmission system ( Fig. 2(a)), which has been derived from publicly available data. The total available generation capacity from the 71 generators is 29,940 MW, distributed among 63 stations. Total loading is 15,000 MW, distributed among 46 stations. The generation capacity and loading is configured in accordance with the pre-event situation of the September 23 blackout in Sweden in 2003 (Larsson & Ek, 2004). Only this single loading condition is considered in this case study, which corresponds to 56% of the maximum experienced load in the system during the last decade, i.e., it does not represent a particularly stressed system. It should be noted that for more comprehensive evaluations, it is important that different loading conditions be addressed. By assessing different loading conditions, more nuanced insights into which components are deemed most critical, and under which circumstances, can be achieved.
In addition, there are 24 transmission stations without load or generation, giving a total of 119 stations (there are 14 stations with both load and generation). In total, there are 186 power lines connecting the different stations. Each load point in the system has been matched to one of the 21 geographical regions (counties) in Sweden ( Fig. 2(a)). This enables calculations of the amount of power supply reduction for the system as a whole and for each region for a given system configuration. In the representative model, the two highest voltage levels in the Swedish transmission system are represented-400 and 220 kV-i.e., the lower voltage levels of the power system-50-132 kV subtransmission and 0.4-20 kV distribution systems-are not part of the system model. The subtransmission system may in effect connect different stations at the transmission level of different regions. Hence, the regional consequences of failures in the system might be overestimated, since the load in a region could, to some extent, be supplied through the lower voltage levels of the power system. Furthermore, the power system connection to region 6 ( Fig. 2(a)) is through an HVDC link and is not included in the model (hence, it is later assumed that region 6 is always supplied in the integrated model).
In order to give an overall understanding of the power system behavior when exposed to strains, an initial vulnerability analysis is presented here. Applying strains to the system can be done in various ways, e.g., changing the power demand or the available generation, or removing different types of system elements. The model allows for different consequence measures, such as power not supplied, available gen-eration capacity, or number of system components out of operation. Here we limit the analyses to strains consisting of randomly removed power lines, and the consequence is measured as the amount of power not supplied given the specific system state (i.e., one or several power lines being out of operation) for each scenario. One iteration consists of randomly removing one to up to all power lines (186 scenarios in total) and calculating power not supplied for the system as a whole for each incremental step. In total, 5,000 iterations were simulated, giving a total of 930,000 analyzed scenarios. The number of iterations was chosen to give a representative number of failure scenarios within a feasible simulation time. By analyzing the removal of one to up to all power lines, an overview of how the system reacts to small (more likely) to extreme strains (less likely) is attained. It should be noted that the simultaneous failure of all power lines in real-life events should be seen as highly unlikely (a historical event that has led to a significant amount of simultaneous power line outages at the transmission level is, e.g., the North American ice storm event in January 1998, and is merely included here to give a full spectrum of system responses to strains).
The results from the initial analysis are presented in Fig. 2(b). The direct consequence at the national level for any given number of removed power lines varies greatly with respect to minimum and maximum consequences, while the overall variance is moderate ( Fig. 2(b)). The maximum is 12,667 MW, which is less than the total load of the system of 15,000 MW since it is assumed that generators and load belonging to the same transmission station can survive as an island. Fig. 2(b) also has an inset plot of N-1 to N-20 scenarios; this set of scenarios is used in Section 4.2 (decision context 2). For each scenario, the infrastructure consequences for the 21 regions are also calculated. Based on this, the mean fraction of removed power lines giving rise to a certain percentage of power supply reduction for a region is analyzed (Fig. 2(c)). In Fig. 2(c), it is clear that vulnerability, in terms of the mean fraction of removed power lines for a given power supply reduction, varies greatly for different regions. For example, for region 8, on average, only about 18% of the power lines have to be removed to give a power supply reduction of 10%. For region 10, on average, about 55% of the power lines have to be removed to give a power supply reduction of 10%. Given the results in Figs. 2(b) and 2(c), it can be concluded that the power system is generally rather robust towards a smaller number of power line failures.

Societal Consequence Model
The input-output modeling approach can be used for both national and regional analyses. In this case study, both a national analysis of Sweden and a regional analysis of each of the 21 regions in Sweden ( Fig. 2(a)) are conducted. For each region, the national coefficient interdependency matrix A or B (Table I) can be modified to a regional matrix by using location quotients. Location quotients are indicators of how well industries' production capacity satisfies the regional demand. The location quotient used here is the cross-country locations quotient (CILQ), which takes into account the relative size between interacting sectors through the use of employment data (Flegg, Webber, & Elliott, 1995). Empirical tests have shown that location quotients based on employment data can be used with sufficient accuracy instead of performing time-consuming and expensive surveys (Brucker, Hastings, & Latham, 1990). For each region, the CILQ value of each interaction is multiplied with the national coefficient in the interdependency matrix. No interregional feedback was taken into account, i.e., it is a closed regional analysis (Lahr & Dietzenbacher, 2001). The implications of this are further discussed in Section 5.
The input data used in this case study were provided by the SCB (Statistics Sweden) and are valid for the year of 2008. The original Swedish I-O data consist of 59 sectors. In this case study, sectors without production and consumption in Sweden were removed (six sectors), and the sector for electricity, gas, steam, and hot water was divided into two sectors-one for electricity and one for gas, steam, and hot water-by using additional data provided by SCB. The reason for this division was to more accurately model the consequences of a disruption in the electricity sector, which is further elaborated on in Section 3.3. In most economic I-O analyses, the effects of import and export are excluded Jung, Santos, & Haimes, 2009). This might be an appropriate assumption when considering large economies, such as the United States, but for smaller economies, such as Sweden, which heavily depends on import and export, this assumption is not appropriate. For some sectors, the imported quantity of the main commodity can be several times larger than the domestically produced quantity. Hence, a temporary disturbance in importing or exporting would significantly affect domestic production. The importance of including international trade in I-O analyses has been addressed in, e.g., Miller and Blair (2009). One method for including international trade is through the use of gross trade economy (GTE) instead of gross domestic product (GDP) when calculating the coefficient matrix (A or B in Table I). GTE is defined as GDP plus import (Jung et al., 2009). Here a similar approach is used where import and export are included as separate sectors when calculating the coefficient matrix (A or B in Table I), i.e., GTE is used instead of GDP when calculating the coefficient matrix. The main advantage of this approach is that it becomes possible to explicitly study the effect of disruptions on import and export. The final number of sectors then becomes 56.
In order to give an understanding of the I-O model, and to discuss and motivate the choice of using a demand-driven or supply-driven I-O model, an initial vulnerability analysis is presented here. Analyzing a 10% disruption in the electricity sector by using both the supply-driven and demand-driven I-O models reveal that the largest consequences are estimated by the supply-driven model ( Fig. 3(a)). The total consequences for a 10% supply-side disruption of the electricity sector sum up to about 38 MSEK/day (not including the consequences for the electricity sector) and close to 13 MSEK/day for a demand-side disruption (for comparison, a 100% power sector disruption would sum up to 380 MSEK/day and 130 MSEK/day, respectively, as the model is linear). This result makes sense since the modern society is highly dependent on power supply, and more so than the electricity sector is dependent on society, i.e., the greatest impacts of power system disruptions normally are on the supply-side of the economy (Kelly, 2015). Although, as briefly mentioned in Section 2.2, the plausibility of the supply-driven I-O model has been widely debated with mixed comments, i.e., both critical and supporting (de Mesnard, 2009;Dietzenbacher, 1997;Ghosh, 1958;Oosterhaven, 1988Oosterhaven, , 2012, there are many authors who utilize and advocate the use of a supply-driven I-O model, see, e.g., de Mesnard (2009), Dietzenbacher and Hoen (2006), Guerra and Sancho (2011), and Kelly et al. (2016). For empirical applications of the supply-driven I-O model, see, e.g., Giarratani (1976), who applied a supply-driven I-O model to study the impacts of restrictions on energy sectors, Davis and Salkin (1984), who studied the economic impacts from reductions in the supply of water, and Kelly et al. (2016), who used a supply-side input-output model for estimating impacts on the U.K. economy with respect to a cyber attack on the Fig. 3. (a) Each sector's demand-and supply-side consequences for a 10% disruption of the electricity sector; (b) first-and higher-order supply-side economic losses for a 10% disruption of the electricity sector in each region; (c) societal consequences of a 10% power supply reduction (dark gray) and 100MW power supply reduction (light gray), for each region.
power system. Other empirical applications studying economic consequences on the supply side include Rose et al. (2016), who studied the economic impacts on the supply side with respect to a Californian tsunami using a general equilibrium model. Kelly (2015) thoroughly discusses assumptions and shortcomings of input-output modeling and argues for the use of a supply-driven model when modeling infrastructure failures, since the impacts of these normally occur on the supply side of the economy. He also notes that a supply-driven model is particularly useful for supply-constrained economies with monopolistic behavior, which can be considered fulfilled in this case study since the electricity sector and its output can be considered monopolistic as it is not easy to find alternatives in the short run (Giarratani, 1976). Based on empirical applications, Park (2007Park ( , 2008 further suggests that when using a supply-driven model, only short disruptions and small regions that are largely dependent on import should be considered, both of which can be considered fulfilled in this case study since a shortage in electricity can be expected to last for a relatively short period of time (from an economic I-O perspective) and Sweden is, as previously mentioned, very dependent on import. Therefore, the supply-driven model is advocated here as the most appropriate to use. Furthermore, Fig. 3(a) also reveals that relatively large consequences arise in the export and import sectors, which strengthens the assumption that international trade should be included in the model.
The economic loss for each region for a 10% supply-side disruption, divided into first-order consequences (for sectors that are directly dependent on the electricity sector) and higher-order consequences (those that arise due to the higher-order interdependencies between these sectors and other sectors, including feedback effects), is presented in Fig. 3(b). The results clearly reveal that higher-order effects constitute a significant part of the total consequences for most regions and the higher-order effects are not necessarily proportional to the direct effects. The three regions where the highest consequences arise are regions 1, 7, and 15, which is not surprising since these are the largest regions economically (Fig. 3(b)). Fig. 3(c) presents the societal consequences that arise due to a 10% disruption of the total power supply (dark gray) or a 100 MW disruption of the power supply (light gray) for each region. The results in Fig. 3(c) reveal that a 10% disruption would have very different societal consequences depending on which region is affected (varies by about a factor of 20). This is mainly due to the varying economical size of the regions in terms of their gross regional product (GRP) (cf. Fig. 2(a)), and to some degree due to the different regions having varying economic dependence on power supply. The results for the 100 MW disruption reveal that the magnitude of the societal consequences also varies greatly (about a factor of 7). In some regions, such as region 8, the economic dependence on power supply is very strong, i.e., the region is very sensitive to power supply reductions, whereas in other regions, such as region 16, the economic dependence on power supply is less.

Interlinked Model
In this case study, the results from the infrastructure consequence model are used as input to the societal consequence model, but we have not included a feedback from the societal consequence model to the infrastructure consequence model. Hence, the model can be considered interlinked rather than integrated. For the infrastructure (power transmission system), strains (failure of physical components), time perspectives (days to a weeklong disruptions), and context (Sweden) under consideration there exists no realistic way where economic disruptions in the societal sectors give rise to additional strains for the infrastructure. However, for other types of infrastructures, strains, time perspectives, or contexts, it can be more important to incorporate feedback loops and truly integrate the models. For example, if the power system in Sweden would have been strongly dependent on gas (e.g., if a large part of the electricity generation would rely on gas), then a disruption in the electricity sector that affects the gas sector would probably eventually create feedback consequences for the power system.
In order to obtain an interlinked model of the power system model (Section 3.1) and the inputoutput model (Section 3.2), the power supply reduction must be translated into a supply-side disruption to the electricity sector. Here this is done by estimating the fraction of power not supplied for each region and for the nation as a whole given a specific failure scenario in accordance with Equation (1): where SR is the fraction of power not supplied for a region or for the national level, P reduction is the amount of unsupplied power, and P total is the total load. SR is then translated into a disruption for the electricity sector in the I-O model by using the IIM normalization strategy by introducing inoperability. Hence, it is assumed that the fraction of power supply reduction corresponds to an equal disruption of the electricity sector. This assumption is further discussed in Section 5. The result from an analysis utilizing the interlinked model is presented in Fig. 4(a). The power system failure scenarios from the initial power system analysis (i.e., the 930,000 scenarios as presented Section 3.1) are compared to the total economic loss derived from the regional I-O model (Section 3.2). For each scenario, both the infrastructure consequences in terms of power not supplied (MW) and the societal consequences in terms of MSEK/day was calculated. If the societal consequences of power supply disruptions had been perfectly proportional to the infrastructure consequences, a specific power supply reduction (MW) would correspond to a given societal consequence (MSEK/day). However, Fig. 4(a) reveals a rather large variation around the linear regression line, especially for smaller infrastructure consequences. Hence, depending on which regions in Sweden are affected by a power supply reduction of a certain size, the societal consequences may differ considerably. robustness of power supply (x-axis), as a fraction of removed power lines for a 10% power supply reduction, and economic dependence on power supply (y-axis), as percentage of economic loss, for each region; the size of the marker (diameter) depicts total economic production for a region, the largest being 5,283 MSEK/day (region 15) and the smallest being 262 MSEK/day (region 18). Fig. 4(b) provides information about the robustness of the electric power supply for each region (here robustness can be seen as the antonym to vulnerability) as the fraction of power lines that need to be removed on average for a 10% power supply reduction (cf. Fig. 2(c)), and the sensitivity of a region to power supply reductions as the fraction of economic loss given a 10% power supply reduction (cf. Fig. 3(c)). From a societal perspective, regions in the upper left corner should be the main focus for vulnerability-reducing measures since they have both high vulnerability of power supply and high economic dependence on power supply.
From these results, it can be concluded that the societal consequences can differ considerably from the infrastructure consequences. However, it is not only of interest to what extent negative consequences of infrastructure disruptions might be underestimated when the societal consequences are not included but also to what extent infrastructure mitigation decisions are affected and whether societal consequences are considered or not. This will be further explored in the next section.

CASE STUDY-IMPACT ON MITIGATION DECISIONS
When making decisions regarding infrastructure improvements, there are several decision inputs that need to be considered, e.g., how effective different alternatives will be, how feasible different alternatives are, and what are the costs to implement them. When making improvements to infrastructures with the aim of reducing vulnerabilities, two common strategies are either to try to identify the critical parts of the infrastructure system and implement measures to protect the most critical ones or to build a more robust system by adding redundancies to strengthen the overall system. In this case study, in order to limit the scope, we have chosen to only study the vulnerability-reducing effectiveness of different measures. This approach, for example, allows for evaluating whether some minimum requirements of vulnerability reduction can be met by implementing the measures. Further, we argue that the results from an analysis as presented here are one fundamental decision input that can be complemented with, e.g., economic considerations in order to evaluate the most cost-effective vulnerability-reducing measures, see, e.g., Thacker et al. (2018). Here two decision contexts are considered-identifying critical system components to protect  and adding system components to increase system redundancy (Cadini, Zio, & Petrescu, 2010). Reactive measures, such as taking action after a failure has occurred to, for example, avoid cascading failures within the system (Zio, Golea, & Sansavini, 2012), to restore system functionality (Lee et al., 2007), or measures aimed at reducing economic dependence on power supply in a region are not considered.
Applying the presented approach also allows for contrasting the effectiveness of the vulnerabilityreducing measures from both an infrastructure and societal perspective in order to discuss the potential importance of including the wider societal consequences for infrastructure-oriented decisions.
Vulnerability is an emerging concept for the analysis of critical infrastructures and used as a complement to more traditional risk-and reliabilityoriented approaches.
For an overview, see, e.g., Murray, Matisziw, and Grubesuc (2008) and Kröger and Zio (2011), and for applications to interdependent critical infrastructures, see, e.g., Apostolakis and Lemon (2005) and Johansson et al. (2011). Here vulnerability is seen as the magnitude of the negative consequences that arise given that a system is exposed to strains (for a more thorough discussion of the concept of vulnerability in a critical infrastructure context, see, e.g., Johansson, Hassel, & Zio, 2013;Zio, 2016). In a traditional risk and reliability analysis approach, both consequences and probabilities are explicitly accounted for. However, probabilities or frequencies of the threats and hazards that can affect the system can, in some cases, be difficult to estimate and be associated with a high degree of uncertainty, e.g., due to lack of knowledge and empirical data or due to inaccurate assumptions. Critical infrastructures are systems generally associated with a high degree of complexity, and exhaustively identifying all relevant threats and hazards that can affect the infrastructure and estimating probabilities of these can be difficult (Aven & Renn, 2009;Zio, 2009), e.g., there may be some unknown failure mechanisms that can be very hard to foresee (Möller & Hansson, 2008;Sarewitz, Pielke, & Keykhah, 2003). In such situations, a vulnerability analysis approach can prove useful since its aim is to systematically and comprehensively find the weaknesses in the system and estimate the consequences that arise due to various types of strains. By using a vulnerability analysis approach, in contrast to risk-or reliability-oriented approaches, a system can be designed according to principles such as robustness and resilience (Aven & Renn, 2009; and measures that address events with low probabilities but with very high consequences can be identified and implemented. Furthermore, since our focus is to study whether taking an infrastructure or societal perspective will affect vulnerability-oriented decisions, it is argued that our conclusions are likely to be valid also for risk-or reliability-oriented decisions. For a more in-depth discussion of how a vulnerability perspective relates to a risk or reliability perspective, see .

Decision Context 1-Identifying Critical Components
The first decision context concerns identifying weaknesses in the system where vulnerabilityreducing measures should be implemented. A key input for this decision is the identification and ranking of critical components or sets of components. Here criticality is seen as the vulnerability of the system to failures in a component or set of components in a system-see, e.g., Jönsson, Johansson, and Johansson (2008) and Crucitti, Latora, and Marchiori (2005). By identifying weaknesses in the system, vulnerability-reducing measures for these weaknesses can be implemented. Based on the criticality of the components or sets of components of the studied system, prioritizations of which components to, e.g., protect or add redundancies for can be achieved. In this decision context, one (N-1), two (N-2), and three (N-3) simultaneous power line failures are analyzed. All possible sets of component failures are systematically evaluated, i.e., for N-1 failures 186 scenarios, for N-2 failures 17,205 (186 × 185/2) scenarios, and for N-3 failures 1,055,240 (186 × 185/2 × 184/3) scenarios are evaluated. The criticality of each component (or set of components) is given by the magnitude of the consequences that arise if it (they) fails. The components (or sets of components) are then ranked according to infrastructure consequences and the societal consequences that arise. Failure sets with zero consequences are removed from the ranking and failure sets with the same criticality value (i.e., give rise to the same consequences) are considered tied and given their averaged rank.
In Fig. 5, the rankings of the analyzed N-2 and N-3 failure sets, from both the infrastructure and the societal perspective, are revealed. In addition, their rank deviations are given, which is the difference between rank based on infrastructure consequences and rank based on societal consequences. N-1 resulted in only five scenarios with consequences and is therefore not shown in Fig. 5 (but presented in Table II). The Swedish power system is designed to be able to withstand single component failures (the N-1 criterion). However, as we are using a representative and slightly simplified model, where, e.g., possible double-circuit configurations have  been modeled as single-circuit configurations, the N-1 analysis presented here results in five scenarios with consequences. Some failure sets share the same ranking, i.e., they overlap each other, which results in fewer visual data points than the total possible (e.g., 17,205 for N-2). The failure sets are divided into three groups-those with zero or a very small difference between the rankings (±5% of the maximum ranking), those with a high positive rank deviation, and those with a high negative rank deviation. A significant part of the failure sets results in a rather large rank deviation. Several of these failure sets also correspond to high consequence scenarios. It is, to some extent, expected that high infrastructure consequences should give high societal consequences; however, there are failure sets that give high infrastructure consequences but rather low societal consequences and vice versa. The existence of these types of failure sets is very interesting since, e.g., the decision of which components to protect will differ significantly depending on which perspective is taken. Spearman's rank correlation coefficient gives a summary measure of the correspondence between the two rankings. For N-2 it is -0.0648 and for N-3 it is -0.0302. These statistically significant correlation coefficients (the p-value for N-2 is 0.0483 and for N-3, 9.6141 × 10 -19 ) and the results in Fig. 5 all suggest a rather large difference between the N-2 and N-3 rankings. It is also of interest to study the top ranked set of components in more detail. For example, if the objective is to implement mitigation measures for the top 10 most critical sets of components, it does not matter whether the lower ranked sets differ in ranking; it is only of interest whether the top 10 differ in ranking. Table II (N-1), Tables III and IV (N-2), and Tables V and VI (N-3) contain the top 10 ranked sets of components from the two perspectives. Only five N-1 failure sets gave rise to negative consequences. If component {125} fails, the infrastructure consequence would be rather large (593 MW) and ranked no. 1 from an infrastructure perspective, since it is supplying a region with high consumptions of electricity. However, it would only rank no. 4 (out of 5) from a societal perspective with rather small societal consequences (12.9 MSEK/day), since it is supplying an economically small region (16) with low economic dependence on power supply. On the contrary, if component {165} fails, the infrastructure consequences would be rather low (230 MW) and ranked no. 4 from this perspective, since it is supplying a region with low consumption of electricity. But since it is supplying power to an economically large region with a high economic dependence on power supply (region 1), the societal consequence is rather large (19.4 MSEK/day) and ranked no. 2 from this perspective. A similar pattern can also be seen for N-2 and N-3 in Tables III-VI. The sets of components that are ranked high from an infrastructure perspective and ranked low from a societal perspective are all supplying economically smaller regions with relatively high consumption of electricity and with low economic dependence on power supply. The sets of components that are ranked high from a societal perspective and ranked low from an infrastructure perspective are all supplying economically larger regions with high economic dependence on power supply but with relatively low consumption of electricity (foremost regions 1, 7, and 15). The thresholds seen in Tables III-VI are due to several tied sets of components (sets of components that result in the same consequences) and the next ranked set of components, as averaged ranking is used. For example, in Table III Table II. However, there are some failure sets that include none of these, i.e., it is the failure of two individually noncritical components that leads to large negative consequences when they fail simultaneously-e.g., for N-2 in Table III, the failure set {121, 126}, which is ranked no. 2 from an infrastructure perspective and no. 197 from a societal perspective. The results presented for decision context 1 in Fig. 5 and Tables II-VI reveal that it clearly differs which components are ranked most critical if viewed from an infrastructure or societal perspective, both when considering all components and when only considering the top 10 ranked components.

Decision Context 2-Adding System Components
The second decision context concerns adding power lines to reduce the overall system vulnerability by increasing the redundancy. Twelve improvement measures are here proposed and evaluated (Fig. 6). Four of these were identified based on "Perspektivplan 2025" (SVK, 2013), which is a strategic document published by the Swedish Transmission System Operator (TSO). In this document, 27 planned improvements are described, of which four were deemed relevant here since they concern adding power lines. In addition, eight other potential improvements were defined by the authors based on the electrical and geographical characteristics of the Swedish transmission system, e.g., by strengthening radially fed load points or strengthening the transmission between areas with high production and areas with high load (in the Swedish transmission system, the production of electricity is mainly located in the north and the load is mainly located in the south of Sweden). For example, three of these improvements directly address some of the most critical components identified in decision context 1 (line {54}, {146}, and {165}) by adding additional power lines to the load points that these lines are supplying.
The vulnerability for each of the 13 systems (original system and 12 improved systems) is evaluated by simulating component failures in the systems and evaluating their performance. The type of failures considered consists of randomly removing power lines of different orders of magnitude and evaluating the consequences that arise in terms of the amount of power not supplied. One iteration consists of randomly removing one (N-1) up to 20 (N-20) power lines and calculating power not supplied for each incremental step. N-1 up to N-20 were chosen to include both smaller and larger magnitudes of strains. Smaller strains, such as an N-3 scenario, can be caused, for example, if one line is out due to maintenance reasons, one line is erroneously manually disconnected by a human operator, and one line is disconnected due to a hidden failure in a relay (e.g., triggered by the changing network configuration and flow of power). The larger strains, such as N-20 scenarios, can be caused by, e.g., weather-related events (e.g., ice storms as exemplified in Section 3.1), which can cause widespread component failures, which do not necessarily need to be in close spatial proximity. Another example of events that are of particular concern nowadays, and that can cause substantial damages to national infrastructures, are antagonistic attacks where, e.g., a terrorist or a foreign power is seeking to cause large-scale infrastructure disruptions. These attacks can either be physical or cyber related, and hence the damaged or disconnected components can be entirely without any geographical, structural, or power flow correlation. These types of attacks are further very hard to foresee, making a case for taking a vulnerability-oriented analysis perspective.
As in all types of simulations with random samples, it is important that an acceptable convergence of the measure of interest be reached. Here the coefficient of variation is used as convergence criteria (Billinton & Li, 1994): where α is the coefficient of variation andX is a vector containing the average consequence for all iterations in either MW or MSEK/day. The 5,000 iterations used for the initial analysis of the power system (Section 3.1) resulted in a coefficient of variation for the average infrastructure consequence (MW) of 1.9% and 2.1% for the average societal consequence (MSEK/day) for N-1 to N-20. Acceptable variation differs with the objective of the analysis, e.g., commonly used values for an acceptable variation of reliability indices in power systems analyses are, for example, 6% (Billinton & Sankarakrishnan, 1995) and 5% (Pinheiro, Dornellas, Schilling, Melo, & Mello, 1998). Here we want to compare only relatively minor system improvements, hence a rather small coefficient of variation is sought. To achieve a lower variation, another 45,000 iterations were analyzed, resulting in a total of 50,000 iterations. This sample size gave a coefficient of variation for the average infrastructure consequence of 0.6% and for the average societal consequence of 0.7% for N-1 to N-20, which was deemed as sufficiently low. In order to make decisions about which improvement measures to implement, it is essential to estimate the effectiveness of the measure, E(M i ), i.e., to what extent the improvement reduces the overall system vulnerability. The metric used here to operationalize vulnerability is, as previously mentioned, the average negative consequences,C, given that the system is exposed to a strain of a certain type and size. The effectiveness of an improvement measure is then defined as the fractional reduction of the average negative consequences for the original system compared to the improved system given a particular strain, S: whereC 0 is the average negative consequences for the original system andC M i is the average negative consequences given that the measure M i has been implemented. The unit of C will depend on whether the decision is based on infrastructure consequences (MW) or societal consequences (MSEK/day). However, as E is dimensionless, the infrastructure and societal perspective can be easily compared. A summary of the results for improvement measures M1 to M12 is shown in Table VII. Many of the scenarios are associated with zero or low consequences since the 75th percentile values are close to the mean values. As such it can be concluded that, on average, the system is quite robust for the studied magnitude of strains (N-1 to N-20). The maximum consequences found are roughly in the order of 2-3 times higher than the 99th percentile values, indicating a heavy tail distribution of the consequences. From Table VII, it is clear that the ranking of which improvement measure to regard most effective clearly differs if viewed from an infrastructure or societal perspective. However, both perspectives agree on which measures are ranked the top four: M8, M5, M6, and M10. Furthermore, from an infrastructure perspective, M8 has the largest improvement while from a societal perspective, M6 dominates. One reason behind this result is the different societal consequences that arise for a given power supply reduction (Fig. 3(c)). M6 is mainly strengthening the supply to the economically second largest region 7 and M8 is strengthening the supply to the considerably economically smaller region 19. The societal consequences for region 7 are roughly a factor of four times higher compared to region 19 for a power outage of 100 MW, leading to a higher societal vulnerability Soc. Inf.

Soc.
Orig. reduction for M6 compared to M8 (Fig. 3(c)). On the other hand, M8 has a higher infrastructure vulnerability reduction compared to M6. Measures M1 to M4 are those planned by the TSO, where all except M4 are ranked low (show no significant improvement) in comparison to the measures suggested by the authors. Measures M1 to M3 are, however, planned in accordance with expected production increases (mostly wind power) and not with the main purpose of strengthening the overall robustness of the power system. Measure M4, however, is planned with the aim of improving the robustness of the power supply to southern Sweden, an improvement whose effectiveness is supported by the results presented here.
It can be concluded from Table VII that there is a relatively large difference when it comes to the effectiveness of the measures from the two perspectives, though the ordinal rankings are, to some extent, congruent. It is of interest whether this conclusion is also valid for smaller strain sizes, since N-20 is a rather large magnitude of strain (20 lines corresponds to more than 10% of all power lines). The effectiveness of the 12 vulnerability-reducing measures is shown in Fig. 7 in terms of their overall effectiveness for different strain sizes-(a) N-1 to N-20, (b) N-5, (c) N-10, and (d) N-15. Studying the differences between the measures more closely for different strain sizes (Figs. 7(b)-7(d)) reveals that their absolute effectiveness differs, but overall the ranking of the measures is, to some extent, congruent. The measure with the highest overall societal vulnerability reduction (25%) is M6. This measure has a larger reduction, relative to the other measures, for smaller strain sizes (N-5) compared to larger strain sizes (N-10 and N-15). This measure strengthens a normally radially fed supply point in the power system situated in a region (region 7) with high GRP and relatively high economic dependence on power supply (cf. Fig. 3(c)), which hence significantly improves the robustness of the power system, especially for smaller strain sizes. Measure 8, which has the highest overall infrastructure vulnerability reduction, is also strengthening a normally radially fed supply point (in region 19). Table VII and Fig. 7 reveal that some of the measures result in a very small improvement (e.g., M2 and M9) and some measures even result in degradation (e.g., M1, M3, and M12), though the difference from the original system is very small. Fig. 8 presents the normalized mean value of the infrastructure and societal consequences (percentage of respective maximum consequences for a 100% disruption of the electric power sector for a day) and the associated standard error of the mean for the original system and the 12 improved systems. For several of the improved systems, the standard error of the mean overlaps with the standard error of the original system, which suggests that no significant improvement compared to the original system can be seen for these system improvements. When taking an infrastructure perspective, no significant improvement can be seen for system improvements M1 to M4 and M12. When taking a societal perspective, no significant improvement can be seen for system improvements M1 to M3, M9, and M12. Fig. 8 also reveals that the consequences of the analyzed disruption scenarios are around twice as high from a societal perspective (between 1.3% and 1.9% of maximum consequences) compared to an infrastructure perspective (between 0.66% and 0.82% of the maximum potential consequences); hence, the consequences from a societal perspective can be twice as high as the infrastructure consequences.
The results presented in Fig. 7 and Table VII reveal that the ranking of which improvement measure to consider as the most effective clearly differs if viewed from an infrastructure or a societal perspective, even when considering the smaller or larger strains. However, both perspectives agree on which measures are ranked the top four, even though the internal ranking among these top four differs depending on whether an infrastructure or a societal perspective is taken.

DISCUSSION
In this article, we have proposed an approach for integrating models of critical infrastructures (including interdependent infrastructures), to capture direct consequences of infrastructure failures, and economical input-output models, to capture societal consequences of infrastructure disruptions. The approach was applied in a case study of the Swedish national electric transmission system together with an I-O model populated with national and regional economic data with the aim to analyze how vulnerability-oriented mitigation decisions might be affected if an infrastructure or societal perspective is taken. The results revealed that disruptions in the power system can lead to very high societal consequences that are not directly proportional to the direct consequences for the initially disrupted infrastructure, making a case for the necessity of the proposed approach. The results also highlighted the importance of accounting for societal consequences of decisions concerning (1) identification of critical components to protect and (2) addition of system components to increase system robustness.
The models used in the case study have some limitations that should be highlighted. One of the limitations of the power system model is the resolution of the model, where only the transmission system is included and not subtransmission systems and lower voltage levels. Each region's power consumption is based on the load points' location with respect to regional geographical borders; however, in the real system, there are also subtransmission systems that support the supply of electricity to the regions (i.e., they may interconnect transmission stations in two regions and support power transfer between these stations). This is likely to have an effect on the estimated power supply reduction for a region in the analyzed scenarios. For decision context 1, the criticality of the different failure sets might be overestimated as some of the lost load in a given scenario could have, in reality, been avoided by power supply through the subtransmission system from neighboring regions. For decision context 2, this is likely to affect the absolute effectiveness of each of the 12 measures, and in particular of those that aim to strengthen a station that is only radially connected. Furthermore, the physical model used here is suitable for static equilibrium analysis with respect to generation, transmission, and demand (adequacy related) with the aim to capture longerterm effects (days to weeks). Hence, if the intention is to capture short-term effects (such as voltage collapses), care should be taken to include cascading effects and the transient dynamics in the physical model of the power system. However, the infrastructure consequence model used is argued to match the time perspective valid for the societal consequence model, which is also an important consideration.
There are also several limitations and assumptions related to the use of I-O models to estimate societal consequences, which are also noted, e.g., by Kelly (2015). When applying an economic I-O model, it is assumed that the level of economic dependency between various sectors is the same as the level of physical dependency. Using economic I-O data as an approximation of physical interdependencies is often the only option since there is a lack of systematic and comprehensive data on actual physical interdependencies and it is time consuming to collect such information and would also likely be subject to confidentiality issues. This is an area that deserves further research. Furthermore, when using I-O models, it is assumed that the interactions between sectors are at a state of equilibrium. From an economical perspective, this normally requires a time perspective of at least one year. In this case study, the time perspectives considered were days-up to month-long disruptions, which from an economical viewpoint can be considered too short. However, I-O models can still provide us with a good estimate of the economic consequences, which can be considered good enough for this particular study where the aim is not to further develop the economic model but the interlinking or integration of it with an infrastructure model in order to be able to study possible impacts on critical infrastructure mitigation decisions. Okuyama and Santos (2014) claim that using a macroeconomic model to assess the economic consequences of disasters is still valuable (even though there have been critiques and some assumptions are questionable) and Rose (2004) argues that input-output analysis is still "well-suited to examining how damage in some sectors can ripple through the economy" despite its limitations and assumptions. Further, Anderson et al. (2007) found that an IIM analysis of the northeast U.S. blackout (an up to four-day-long blackout in parts of the United States) produced results similar to other published consequence estimates, which strengthens the choice of using this macroeconomic model for shorter time periods than a year. To use a dynamic (or sequential model) would likely provide more exact results; however, more information about, e.g., inventory would then be needed, which is not readily available. The direct and indirect economic consequences will likely be overestimated in the present study by using a linear I-O model and by not including the effect of, e.g., inventories and other resilience strategies for reducing the economic impact of the loss of electricity Rose, 1997;Rose et al., 1997, 2007. Rose et al. (2007 showed, in a case study of the economic impact of a complete electricity outage for Los Angeles County, that different resilience strategies could lower the economic consequences by as much as 86%. Further, they found that the implicit multiplier between direct and indirect economic consequences is in the order of 1.2 using a general equilibrium approach in contrast to being in the order of 2.5 using a linear I-O model (as used here). Hence, the absolute consequences estimated in the two decision contexts are likely overestimated in relation to the consequences that would arise during real power outages. However, the ranking of the components in decision context 1 and the ranking of the measures in decision context 2 are not likely to be affected as they are relative, assuming that no major regional differences in resilience factors exist. In future research, this should further be explored together with the effect of different resilience-enhancing strategies, as they can have a significant effect on damping the overall economic consequences.
Several challenges related to the presented integrated modeling approach need to be addressed in future research. For example, to further develop and improve the economic model with respect to, e.g., input/production inventory, disequilibrium properties, and other properties that are important for analyses covering shorter periods than one year. There are several examples in the research literature for how this could be done (Donaghy et al., 2007;Okuyama et al., 2004;Santos, Yu, Pagsuyoin, & Tan, 2014). Another modeling choice in the case study was the choice of using a supply-driven model, discussed and contrasted against a demand-driven model. Most similar studies (e.g., Li et al., 2015) use a demanddriven model, but, as previously discussed, most consequences of electricity disruptions arise downstream rather than upstream; hence, a supply-driven model is argued to be more suitable. This choice is supported by, e.g., Kelly (2015), but we would welcome further academic discussion on this topic. Furthermore, a closed regional model was used here, which does not capture interregional dependencies. Hence, the estimated total consequences from a power supply reduction for a region are likely underestimated. There have been just a few studies investigating the importance of including interregional linkages when estimating economic consequences of disasters-see, e.g., Okuyama, Hewings, and Sonis (1999)-that found in a study of the Great Hanshin Earthquake of 1995 that the estimated interregional impacts could exceed the intraregional impacts. Using an interregional I-O model, which is discussed in Miller and Blair (2009) and Okuyama et al. (2004), and applied in Pant et al. (2011), can potentially capture cascading effects between regions; however, the current lack of appropriate interregional dependency data for our case study is a major obstacle. These interregional issues related to economic I-O models in a critical infrastructure setting are important to address in future research. Furthermore, an I-O model is not capable of capturing all the wider economic impacts of disasters and does not, for example, consider reconstruction programs related to reconstructing buildings and infrastructure, causing positive backward economic consequences. See Oosterhaven (2015Oosterhaven ( , 2017 for a more thorough discussion. There are also some assumptions related to the integration of the infrastructure consequence model and the societal consequence model that should be highlighted. One concerns the input data used for the two models. For the power system model, the data for the system are valid for the year 2003, and the data used for the input-output model are valid for the year 2008. However, the Swedish power system at the transmission level did not change significantly between 2003 and 2008. Hence, the two data sets can be assumed to match each other relatively well. If the modeling approach were to be used for front-line actual decision and policy making, both data sets would need to be updated to reflect the current situation. Another assumption that may affect the results is that the fraction of power supply reduction from the power system model gives an equal disruption of the whole electricity sector for the IIM analysis. As not all of the economic dependence on the electricity sector is related to the commodity electricity (though a significant part-close to 85%), it is expected that the societal consequences may, to some lesser degree, be overestimated. Further research should address the relation between infrastructure commodity disruptions and economic sector disruptions.
Although the above limitations and assumptions will, to some extent, affect the numerical values of the results, it is not likely that the overall conclusions for the two decision contexts would be affected. The results support the overall thesis that the decision of which measures to implement depends on whether an infrastructure or societal perspective is taken, particularly when identifying critical components. To extend the research, it would be interesting to evaluate whether other models for accounting for societal consequences of infrastructure disruption would also support this thesis, for example, by using a general equilibrium model (Rose, 1995) or flow-based models capturing interdependencies between societal functions (Johansson et al., 2016).
It should also be noted that although certain decision alternatives are recommended when taking a societal perspective, this might not be the best alternative from the perspective of an infrastructure owner who might have other interests, perspectives, and budgetary constraints. Hence, from a governmental perspective, there are arguments for setting up incentives to encourage infrastructure owners to account for societal consequences when making decisions that go beyond the direct economic consequences that normally are accounted for in current legislations. The current Swedish power system regulations do, however, to some extent take a more societal perspective, though not in the scope suggested here. It should further be noted that aspects other than the effectiveness of a measure have an impact on the final decision of which mitigations to implement, the most obvious ones being the feasibility and cost of the measure. However, to limit the scope of the analyses, other decision inputs have not been considered since the purpose of this article is not to find the optimal decision but rather to see whether mitigation decisions will be affected when a societal perspective or an infrastructure perspective is taken.
The case study in this article focused on the electric transmission system in Sweden, but the ideas, approaches, and conclusions presented should be developed by carrying out research with respect to other critical infrastructures. We limited the analyses of mitigation measures for the critical infrastructure itself, though the approach also provides scope for exploring mitigation strategies to reduce society's dependence upon the services the infrastructures deliver. Lastly, although this article has been vulnerability oriented, the proposed integrated modeling approach is also applicable as a part of other types of analyses where more holistic consequence assessments are required, e.g., for risk and resilience analyses, which would be a highly interesting area for future research.

CONCLUSION
In the article, a generic approach for integrating models of critical infrastructures, to capture the direct consequences of infrastructure failures, and economic input-output models, to capture the societal consequences that arise due to infrastructure disruptions, was proposed. It is concluded that by integrating the two models, inherent critical infrastructure vulnerabilities at the component level can directly be related to the widespread consequences that may arise in society-information that is of great importance for making mitigation decisions, e.g., regarding how to strengthen an infrastructure or interdependent infrastructures. Furthermore, we have analyzed the benefit of the proposed approach when making vulnerability-related mitigation decisions regarding critical infrastructures by applying it to a Swedish case study of the electric transmission system and society´s dependence on the services it delivers. It is concluded that the consequences that arise in society due to power supply disruptions can be twice as high as the infrastructure consequences, and hence it is important to take a societal perspective when analyzing power system vulnerability reducing measures. This is especially important when identifying which critical components to protect or strengthen and, to a lesser extent, when ranking improvement measures in terms of adding system components to increase overall system robustness. The importance of accounting for societal consequences when evaluating power system improvements hence varies depending on the decision context but could be of high importance if under budgetary constraintse.g., if only a limited number of improvements can be implemented, or when deciding the order of which measures to implement at what time, given that large-scale infrastructure improvement projects tend to operate in the time horizon of decades.