A Generic State‐Machine Model of System Resilience

ystem resilience means different things to different people and different things across different industries and system contexts.For example, in some contexts, the need is for the system performance to be unaffected after the occurrence of a defined threat event, whereas in others, system impairment or even loss may be acceptable, particularly for severe threats, providing certain constraints, such as system safety, remain uncompromised.When wishing to specify resilience or to describe or analyse the performance and behaviour of a system in response to a threat situation, it is useful to have a conceptual model that can support these activities.In this article, we present a state-based conceptual model of the variety of states that a system may experience when encountering and resolving a resilience-related situation.We contend that it has promise for framing discussion on resilience objectives of a particular system during the design process by imbuing a common understanding of the expected resilience characteristics of the system to all stakeholders.Furthermore, we advocate that during operations the model informs decisions on how best to deal with multiple resilience-related issues, such as an impending threat and an impaired system.A resilient system could pass through a number of states when it encounters a threat event beyond its design limits.The system would start in the nominal operating state and transition to partially functional states and sometimes to completely non-functional states depending on the event and the resilience of the system.If the system can undergo repair, it can also transition back to the nominal state.The transitions between these states are dependent on the type and magnitude of the threat event, the resilience of the system as determined by its design, and the decisions and actions undertaken by its operators, and the conditions including thresholds that trigger transitions.The development of the state-machine model arose from the desire among the authors to capture the essence or definition of what comprises system resilience in a usable way for practice.The model evolved to include the potential of the system to sense and anticipate future threat events whether they be within design limits or otherwise as well as states of impaired functionality and agreed outcome states.Certain engineers may well have different conceptions of what should be included in resilience; adjusting the states and state transitions to suit their preferences easily accommodates this.The adapted state-machine or automata model chosen comes from Aleksander and Hanna (1976) and is attributable to Mealy (1955) because of its simplicity and suitability.A Mealy model is sequential automata that transitions between states and produces outputs based on its current state, the current input, and the state transitions that are available for the current state.In this initial formulation, the model is asynchronous and remains in its current state until it receives a pre-defined state-transition trigger.Upon such an event, the model will undergo the defined state transition and system capability sets to the appropriate pre-defined value.