How Robust is Your System Resilience ?

Robustness and resilience are concepts in systems thinking that have grown in importance and popularity. For many complex social-ecological systems, however, robustness and resilience are difficult to quantify and the connections and trade-offs between them difficult to study. Most studies have either focused on qualitative approaches to discuss their connections or considered only one of them under particular classes of disturbances. In this study, we 10 present an analytical framework to address the linkage between robustness and resilience more systematically. Our analysis is based on a stylized dynamical model that operationalizes a widely used conceptual framework for socialecological systems. The model enables us to rigorously delineate the boundaries of conditions under which the coupled system can be sustained in a long run, define robustness and resilience related to these boundaries, and consequently investigate their connections. The results reveal the tradeoffs between robustness and resilience. They also show how 15 the nature of such tradeoffs varies with the choices of certain policies (e.g., taxation and investment in public infrastructure), internal stresses and external disturbances.


Introduction
The concepts of "resilience" and "robustness" have grown considerably in popularity as desirable properties for a wide range of systems.Terms like "resilient communities" and "robust cities" have been used more frequently in 20 public discourse.Growing with that popularity is some confusion and potential misuse of the terms "robustness" and "resilience" due to imprecision, vagueness, and multiplicity of their definitions.Such lack of consistency and rigor hinders advances in our understanding of the interplay between these two important system properties.
Relatively speaking, robustness has been defined more consistently and rigorously-as it can be linked to a more familiar concept of sensitivity.For example, according to Carlson and Doyle, (2002), robustness in engineering 25 systems refers to the maintenance of system performance either when subjected to external disturbances or internal uncertain parameters.In other words, in robust systems, performance is less sensitive to well-defined disturbances or stresses.
Robustness may very well be a desirable property of a system, but it seems to come with a price.Recent research shows that tuning a system to be robust against certain disturbance regimes almost always reduces system performance 30 and likely increases its vulnerability to other disturbance regimes (Ostrom et al., 2007;Anderies et al., 2007;Bode, 1945;Csete and Doyle, 2002).Now, if resilience is also a desirable property of the same system, does it also come at Earth Syst.Dynam.Discuss., https://doi.org/10.5194/esd-2017-124Manuscript under review for journal Earth Syst.Dynam.Discussion started: 15 January 2018 c Author(s) 2018.CC BY 4.0 License. the expense of performance and robustness?Put it another way, is there a tradeoff among efficiency, robustness, and resilience?Such a tradeoff, if exists, is a crucial consideration for governing and/or managing coupled infrastructure systems1 (CISs).
But resilience, as alluded to above, is trickier to define.According to Holling (1973), resilience refers to the amount of change or disruption required to shift the maintenance of a system along different sets of mutually reinforcing 5 processes and structures.In other words, resilience can be thought of as how far the system is from certain thresholds or boundaries beyond which the system will undergo a regime shift or a quantitative change in system structure or identity.Holling (1996) categorized resilience into two types, engineering resilience, which refers to the ability of a system to return to steady state following a perturbation, and ecological resilience, which refers to the capacity of system to remain in particular stability domain in the face of perturbations.The latter category is used by many 10 researchers to discuss resilience of social ecological systems (or more generally CISs) (Gunderson et al., 1995;Berkes and Folke, 1998;Carpenter et al., 1999aCarpenter et al., , 1999b;;Scheffer et al., 2000;Anderies et al., 2002;Gunderson and Holling, 2002;Berkes et al., 2003;Walker et al., 2004;Carpenter and Brock, 2004;Janssen et al., 2004;Anderies, 2005;Folke et al., 2002;Anderies et al., 2006).The problem is that these CISs are complex and thus identifying thresholds and potential regime shifts associated with those thresholds is often difficult, if not impossible.In many cases, major 15 aspects of resilience in SESs may not be directly observable and must be actualized indirectly via surrogate attributes (Carpenter et al., 2005;Kerner and Thomas, 2014).Recent significant advances have been made toward identifying early-warning signals that indicate for a wide class of systems whether the systems are approaching a critical threshold (Scheffer et al., 2009 and2012).Still, there are gaps in our understanding of how indicators of resilience and robustness will behave in more complex situations.This lack of rigorous metric of resilience makes the investigation 20 into their connections, interplay, and tradeoffs with robustness and performance impossible.
But these knowledge gaps need to be filled if one wishes to make advances in understanding the interplay between social dynamics and planetary boundaries.Given the magnitude of impacts that human activities have on pushing Earth systems toward their planetary boundaries, we need clearer understanding of how social and biophysical factors come together to define the nature of these boundaries.This paper is a step in that direction.In particular, we will 25 build on recent work that mathematically operationalizes the Robustness of SES framework (Anderies et al., 2004) into a formal stylized dynamical model (Muneepeerakul and Anderies, 2017).We will exploit the relative simplicity of the model to rigorously define robustness and resilience of the coupled system.The modeled system will be subject to fluctuations in external drivers, which will affect the well-defined robustness and resilience, thereby enabling us to investigate the interplay and tradeoffs between these important properties, as well as how the nature of the interplay 30 and tradeoffs are affected by policies implemented by social agents.

Methods
Here we analyse a mathematical model developed by Muneepeerakul and Anderies, (2017) by subjecting the coupled system to uncertainty in ecological and social factors.The model captures the essential features of a system in which a group of agents shares infrastructure to produce valued flows.Such a system is the archetype of most, if not all of human sociality: groups produce infrastructure that they cannot produce individually (security, defence, irrigation 5 canals, roads, markets, financial systems, coordination mechanisms, etc.) that significantly increases productivity.
The challenge is maintaining this shared infrastructure (e.g.decaying infrastructure is a major problem in the US at the time of writing (cite report of engineers)).The model allows for mathematical definitions of the boundaries of policy domain that result in a sustainable system in which both human-made and natural infrastructure can be maintained over the long run.Based on these boundaries and uncertainty in the exogenous factors, we define metrics 10 of resilience and robustness associated with each policy choice and investigate the tradeoff between them.The basic model presented by Muneepeerakul and Anderies, (2017) is described in the Appendix, which key variables and parameters are briefly explained below.
Here a policy is defined as a combination of taxation level  and the proportion of tax revenue invested in infrastructure maintenance  that the public infrastructure providers (PIPs) decide to implement in the system.The 15 infrastructure (e.g.canals) enable resource users (RUs) to produce valued goods from a natural resource.The two fluctuating exogenous factors are the replenishment rate of the natural resource  and the wage  that resource users (RUs) would earn from working outside the system-a combination of  and  defines a scenario.There are two boundaries that, once crossed, will cause the system will collapse.The first boundary is called PIP participation constraint (PPC): when the PIPs must invest too much in maintaining the public infrastructure (exceeding the 20 opportunity cost of  ) and/or cannot retain enough revenue for themselves, they will abandon the system for another.
The second boundary is the stability condition of the non-trivial equilibrium point (i.e., the "society" in which both PIPs (e.g. the state) and RUs (e.g.citizens) participate in the system and public infrastructure is sufficiently maintained in a long run).Together, these two boundaries delineate a set of policies (- combinations) that correspond to sustainable outcomes.The resilience metric to be developed below can be thought of as a metric of how far the system 25 is from these boundaries.As the two exogenous factors defining scenarios, namely  and , fluctuate, the two boundaries and thus the resilience metric, too, fluctuate with them.How sensitive the resilience metric is to these fluctuating scenarios is used to define robustness.In the following sections, we define resilience and robustness more formally.

Resilience metric 30
Direct measurement of resilience in SES's is difficult because boundaries and thresholds that separate domains of dynamics for SES's are difficult to identify (Carpenter et al., 2005;Scheffer et al., 2009 and2012).In this stylized model, however, such boundaries can be clearly identified, namely the stability condition (SC) and the PPC.We will now define resilience metrics based on these two boundaries.Here our goal is to develop resilience metrics that can be meaningfully compared to one another.As such, we identify some desired properties that guide the definitions of these resilience metrics.First, they should be zero at their respective boundaries.Second, positive values indicate greater resilience of the system in a desirable state.These first two properties align with how resilience has been measured, i.e., the distance from the boundary of a basin of attraction (e.g., Anderies et al., 2002;S. R. Carpenter et al., 1999).Third, to facilitate the consideration of relative risks associated with different types of regime shifts that 5 the system may be facing, the metrics should be comparable in magnitude.These properties guide us toward the following definitions of the resilience metrics.
We define the resilience of the system against abandonment by PIPs as follows: where  is the net revenue that PIPs collect and  is the opportunity cost that they will earn if they choose to work with another system.Positive values of  indicate that the system is resilient against being abandoned by PIPs, while negative values indicate that the system will eventually collapse due to the PIPs' abandonment.
Numerical analysis of the model indicates that the equilibrium becomes unstable when the following Routh-Horowitz condition is violated:
Following the guideline provided by the three desirable properties above, we rearrange terms in Eq. ( 2) and define the 20 resilience of the system against instability as follows: ( ,  , +  ,  , +  ,  , +  ,  , ) − 1. ( This formulation is parallel to that of the first resilience metric (Eq.1); it possesses the three properties:  of 0 indicates the boundary between stability and instability; positive  means the system at the equilibrium point 25 is stable; and the magnitudes of  are comparable to those of  (see Fig. 1).It is important to note that  is determined from the coupled dynamics of the coupled infrastructure system; this means that it has already integrated the dynamics of infrastructure, resource, and resource users (Eqs.A1, A4 and A5), making it a metric of the system, not of an individual component.
This allows us to meaningfully define the overall system resilience as the minimum between the two resilience metrics, Equation ( 4) implies that  is positive only when the nontrivial equilibrium point (Eq.A6) exists and is stable; otherwise, the system is considered not resilient and denoted by  = 0. Given that the nontrivial equilibrium point exists and is stable, if the system is at a greater risk of being abandoned by the PIPs (and eventually collapsing),  =  ; if the system is at a greater risk of becoming unstable (and eventually collapsing),  =  .Figure 1 illustrates the relationships between  ,  , and  . 5

Robustness of resilience
As discussed earlier, robustness can be thought of as the opposite of sensitivity.One measure of sensitivity is variance.
As such, variance of a given function under specific disturbance regimes can be used to indicate robustness of that 10 function against those disturbance regimes (robustness of what to what).In this case, the system function of interest is the system resilience  .Therefore, we define the "robustness of resilience" by the variance of  under a given disturbance regime (see below)-with lower variance indicating greater robustness.We will use  to denote this variance-based robustness metric.
In this study, we subject the modelled system to uncertainty in one natural factor and one social factor, namely, the 15 natural replenishment rate of the resource , and the payoff that a RU earns from working outside the system .In particular, we assume that  is uniformly distributed over the range [75,125] and  is uniformly distributed over the range [0.75, 1.75].A scenario is defined as a combination of  and .For a given policy (a  −  combination), we calculate  for 10,000 scenarios (i.e., 10,000  −  combinations) (see Fig. 2).Then, from these 10,000 values of the resilience metric,  , we calculate the mean,  , and the standard deviation,  : the mean 20  is then used as the resilience metric of the coupled system with a given policy, and the standard deviation is used as the metric for robustness of resilience (lower variance/standard deviation mean greater robustness).

25
this particular case, the resilience does not change much when  is greater than about 100, but becomes more sensitive to both  and  when  is lower than 100.

3.Results
The surfaces and contours of the system resilience metric,  , and associated with different policies ( − ) over the policy space are shown in Figs.(3a and b), respectively.The policies with sustainable outcomes are located 30 in the middle of the policy space, with  peaking in the center and declining as policies become more extreme in either direction.Our analysis also shows that  is more or less proportional to the fraction of scenarios (- combinations) under which the system with that particular policy (a - combination) results in a sustainable outcome ( > 0).A similar concept has been used in the robust decision making literature (e.g., Groves and Lempert, 2007;Bryant and Lempert, 2010).
The surfaces and contours of the robustness of (or rather, inverse of) resilience,  , associated with different policies over the policy space are shown in Figs.(3c and d), respectively.The  "landscape" is more irregular, with two peaks (low robustness) and one trough (high robustness).The region with high robustness 5 appears to be in the same general areas as the region with high resilience.We explore the interplay between  and  in Fig. 4. Figure 4 shows that there are no perfect policies 10 in the sense that no policies yield both maximum resilience and maximum robustness.Recall that the robustness indicates how sensitive  itself is to external disturbances.The best policies are those along the Pareto frontier in the resilience-robustness space: among this set of Pareto-optimal policies, an increase in resilience is necessarily accompanied by a decrease in robustness, clearly illustrating the tradeoff between robustness and resilience.The Pareto-optimal policies appear to be in two groups: those with high resilience and those with low resilience.Fig. 5 15 illustrates where the Pareto-optimal policies-with relatively high resilience-are located in the policy space.
Figure 4: Resilience-robustness tradeoff.Each point represents,   of the coupled system with a given policy.Pareto-optimal policies are in two groups: those with relatively high resilience (red dots) and those with relatively low resilience (green dots).

Discussion and conclusions
In this paper, we exploit the simplicity of the stylized model to quantitatively define resilience and its robustness of a coupled infrastructure system.The resilience metric developed here is a measure of how far the CIS is from the boundaries beyond which it will collapse.The model affords us with expressions of these boundaries, which clearly

25
show how social and biophysical factors interplay to define these boundaries.With a concrete definition of resilience, resilience itself can be considered as the "of what" in the "robustness of what to what" notion.In particular, we use the standard deviation of the quantitatively defined resilience metric as the metric of robustness (low standard deviation means high robustness).Consequently, this enables us to rigorously investigate the interplay between the two important, but not always well-defined, system properties.A key finding is the fundamental tradeoff between 30 resilience and robustness: there are no perfect policies in governing a CIS, only Pareto-optimal ones.
Importantly, we hope for this work to stimulate further advances in rigorous studies of CISs, a few of which we briefly discuss here.More dimensions can be considered in defining Pareto-optimality. Figure 5 may give an impression that the set of Pareto-optimal policies is confined to a small region in the policy space, which would imply that PIPs do not have that many choices-even in a simple CIS like the one studied.But that would be a wrong impression.In addition to resilience and robustness (as defined here), a policy maker or a social planner may be interested in other types of robustness with different "of what" and "to what" components.She may also be concerned about other system properties, e.g., productivity, user participation, etc.As more dimensions are considered, the set of Paretooptimal policies grow.In the same spirit as that of the work done here, these other dimensions should be defined
This work also lends itself to more rigorous studies of "adaptive governance."In the present study, the governance structure, represented by a policy (a combination of  and ), is fixed.A natural next step is to explore if a policy is allowed to change, how one may improve the resilience and robustness of a CIS and/or alter the nature of their tradeoff.
For example, if  and  are to be functions of other factors, e.g., resource availability and outside incentives, what 10 functional forms should they take to improve the system's resilience and robustness?
In keeping with the theme of "social dynamics and planetary boundaries in Earth system modelling," the results shed light on how social and biophysical factors may interplay to define "boundaries" of a sustainable coupled system.While the modelled system here is admittedly simple, our methodology and results constitutes a step toward quantitatively and meaningfully combining social and biophysical factors into indicators of boundaries of more 15 complex systems.Just as in this work, once those boundaries are clearly defined, calculation and discussion of resilience and robustness can become concrete and go beyond rhetoric and buzzwords.
Author contribution: MH and RM designed the study.MH and RM developed the analysis code and performed the simulations.MH, RM, and JMA wrote the manuscript.
Competing interests: The authors declare that they have no conflict of interest.

Figure 3 :
Figure 3: the mean,  , and the standard deviation,  , of  over entire decision space: (a) Surface of the resilience metric,  ; (b) Contours of  ; (c) Surface of the robustness,  ; (d) Contours of

Figure 3 :
Figure 3: the mean,    , and the standard deviation,    , of   over entire decision space: (a)

Figure 4 :
Figure 4: Resilience-robustness tradeoff.Each point represents,    and    of the coupled system with a given policy.Pareto-optimal policies are in two groups: those with relatively high resilience (red dots) and those with relatively low resilience (green dots). 5

Figure 5 :
Figure 5: Pareto optimal policies with high    in the policy space (- plane), superimposed with    contours (a) and    contours (b).