Keywords

1 Introduction

Resilience of critical infrastructures is a complex problem area. Gaming-simulation can help us to understand this area. Building a simulation game involves many design choices. Depending on which choices are made, consciously or unconsciously, very different simulations or simulation-games can be created for studying the same problem. It is important to build simulation-games of good quality and to understand how crucial design choices impact simulation-game design and simulation-game outcomes. In the literature study presented in this article we have identified and analyzed two simulation models and four simulation games that each attacked this challenge in a different way. Lessons learnt in the analysis have already influenced our own design process where we create a simulation-game for critical infrastructure resilience, focusing on cascading effects of payment system disruptions for the food, fuel and transport system. The analysis can also inspire other practitioners and researchers to reflect on the impact of their design choices. The aim of this study is not to advocate certain design choices, but rather to show what alternatives there are, and how they differ in their impact on the nature and outcomes of a simulation-game.

2 Background

2.1 Critical Infrastructures

Societies rely on well-functioning critical infrastructures such as Energy, Information and Communication technology, Water supply, Food and Agriculture, Healthcare, Financial systems, Transportation systems, Public Order and Safety, Chemical Industry, Nuclear Industry, Commerce, Critical Manufacturing, and so on [1]. When one or more critical infrastructures break down or provide only limited service, large numbers of citizens, companies or government agencies can be severely affected [2, 3]. Breakdowns can be caused by internal factors (human or technical failure), external factors (nature catastrophes, terror attacks) or by failures of other infrastructures as there are many dependencies between critical infrastructures [3]. Energy and Information technology or Telecommunications are well-known event-originating infrastructures that generate cascading effects in many other infrastructures, as has been shown in different types of analyses [3].

Resilience of interdependent infrastructures increasingly depends on collaborative responses from actors with diverse backgrounds that may not be familiar with cascade effects into areas beyond and outside the own organisation or sector [4]. There is limited empirical evidence of cascading effects across many infrastructures, which makes it hard to foresee which interactions may occur across sectors [2, 3]. Risk analysis, business continuity management and crisis management training are often performed within the context of a single organisation or sector, and are seldom addressing the holistic analysis of multiple infrastructures [3].

2.2 Resilience

Studies such as [5, 6] have made efforts to review literature and describe what the term ‘resilience’ can refer to: bouncing back to a previous state, or bouncing forward to a new state, or both; absorbing variety and preserve functioning, or recovering from damage, or both; and being proactive and anticipating, or being reactive (when recovering during and after events), or both. The variety of interpretations of resilience that have been identified makes it difficult to operationalize resilience into measurable indicators [5]. The Systemic Resilience (SyRes) model was developed as a step towards better metrics and a more comprehensive understanding for determining the resilience of a system in crisis management [5]. Most systems in society, such as the payment system, depend on several other systems managed by different actors to function properly. Therefore, resilience must not only be approached with a systems perspective from researchers trying to understand them, but also from practitioners faced with the task of managing/controlling a complex system. A systems perspective demands deep knowledge about the system components and their interdependencies that ideally should have been acquired before a disruption takes place so that quick action for compensating for and controlling system dynamics is possible. As disruptions often demand simultaneous response by several actors, there is a risk that these responses counteract each other. A simulation-game that is created with the intention of strengthening resilience must reflect the complexity and interdependencies of a real world system. At the same time, the simulation-game must provide well-structured and accessible feedback to allow the participants in the simulation-game to explore the consequences of different actions of themselves and others, as well as to understand the consequences of not acting.

2.3 Design Choices in Gaming-Simulation

Gaming-simulation is defined as a specific form of simulation. Simulation in general aims at designing a model of a system in a complex problem area in other to be able to experiment with the model. Deeper insight in the behavior of the system is created by evaluating various operating strategies against each other in one ore multiple scenarios. Gaming-simulation differs from other forms of simulation in that it incorporates roles to be played by participants and game administrators, implying that people and their (goal-directed) interactions become part of the simulation. In addition to role descriptions and interaction formats, simulation-games can also include a physical simulation model (a board game, a mock-up, a computer simulation, or any other representation of a physical reality) which the game participants need to interact with. It is important to understand that both the changes and impacts of changes to the physical simulation model in the simulation-game and the interaction between the participants (often negotiation processes about what to change and how to interpret changes in the physical simulation model) are part of the simulation-game and object of study [7]. Gaming-simulation is especially relevant when the “how and why” of the interaction processes between the participants are of interest and when these interactions cannot easily be incorporated in computer simulation models. In addition, it creates a deeper learning opportunity, as simulation-game participants literally are active participants in the simulation, rather than passive observers of a computer simulation.

To design a high quality simulation-game, many design choices have to be taken into account, which often are not self-evident, but rather involve tricky cost-benefit analyses ending up with a dilemma (is the benefit worth the extra cost?). Examples of such design choices are for example [8, 9]: defining a limited number of research or learning objectives, defining the number and content of roles, defining the scope of the modelled situation/problem, guaranteeing the validity of the simulation, defining rules and constraints, defining the load (difficulty), choosing the location/environment where the game will be played, selecting the type of participants to be invited, design of qualitative and quantitative data collection during the game, degree of realism of the scenario, degree of complexity of the game (often phrased as modelling internal complexity of the system to be modelled, but creating external simplicity, i.e. an easy to understand and easy to play game for the participants), degree of competition, degree of dynamics, macro cycle (preparation, playing, debriefing, follow-up), micro-cycle (number of playing rounds) and real-time or symbolic-time.

3 Method: Identify and Analyze Existing (Gaming-)Simulations

The literature study started with a broad search in databases like EBSCO, Emerald, Google Scholar, IEEE, ScienceDirect, Springer and Wiley. Search terms included: critical infrastructure, simulation, gaming, gaming-simulation, payment, banking, food, fuel, energy, transport. Search results were narrowed down in several steps by reading abstracts and parts of the articles. Identified studies were rated as more attractive the more they resembled our envisioned project i.e.: when they used computer simulations as part of multiple actor games; when their problem area covered multiple critical infrastructures; when design choices and their impacts were discussed extensively; and when the included critical infrastructures covered finance, food, energy and/or transport. Table 1 below gives an overview of the two simulation models and the four simulation-games that were selected for in depth analysis.

Table 1. Overview of simulations and simulation-games analyzed
Full size table

SIPG [10, 11] is interesting as it explicitly deals with the interaction between multiple critical infrastructures that should be managed in concert, and because it involves different player roles that interact with a computer simulation model. The CI-dependencies model [12, 13] and the ASFF-model [14] are included because they both are complex simulation models that analyze interactions between many critical infrastructures. Although they do not include a gaming approach, their simulation models can be compared to the computer simulation of our envisioned simulation- game. CIPRTrainer [15] and Seaport [16] are simulation-games like SIPG [10, 11], but are less focused on interaction between critical infrastructures. They acknowledge that interaction between multiple infrastructures exists, but their actual game design is mainly focused on managing disruptions in one single infrastructure. SimportMV2 [17, 18] is not addressing critical infrastructures at all, but is interesting because their game-design strongly resembles our envisioned design, especially with respect to that 88 teams have played the same scenario and the game designers have analyzed how satisfying results can be obtained with rather different strategies. These 6 (gaming)-simulations were analyzed in detail by studying [10,11,12,13,14,15,16,17,18]. The analysis aimed at creating overview of important design choices and at revealing the motivations and the reflections of the authors/designers why these design choices were important and how they influenced the nature/quality of the gaming-simulation.

4 Design Choices and Their Implications

4.1 What Is the Learning Goal: System Understanding, Collaboration, or Both?

The six analyzed (gaming-)simulations differ with respect to what their main learning goal is. For some [12, 14, 17] the main purpose is to understand complex system behavior, for others it is training the participants [15, 16] and for one it is studying different forms of team collaboration [11]. Game design shall always aim at obtaining the learning goals in the most effective way. As such, [12, 14, 17] put much emphasis on realism of the scenario, whereas [16] chooses a fictive scenario to put focus on the collaboration process. Also, [11, 16] ponder much about how to limit communication between team members (to press participants being communication-effective when they have the opportunity). Sometimes multiple learning goals such as creating system understanding and training the participants can go hand in hand [15]. But when design choices favor one goal and inhibit the other, it is important for the game designer to know what the primary purpose of the gaming-simulation is.

4.2 Validity, Fidelity, Realism, Time Scale and Complexity of the Scenario

Many designers of the analyzed simulation-games discuss the challenge of getting hold of real data to increase the realism of the simulation-game [11, 12, 14, 15, 17]. As little is known about how critical infrastructures interact, and especially how they interact in case of single or multiple severe disruptions, there is little real data to compare the simulation results with. Therefore validation by experts is often used. In [14, 17] it is argued that the focus should be on mirroring “general system behavior and dynamics” rather than representing reality in detail, which means, as nicely phrased in [17], that there is a need for realistic data rather than real data. Combining real and fictive data can be preferable when real data is sensitive from a security perspective [15]. At the other hand (gaming-)simulation should not become too abstract and lose relevance from the perspective of learning complex system behavior [12, 14]. The current state of critical infrastructure models is criticized by [12, 14] for not opening the black box, limiting the analysis to too few infrastructures, focusing too much on single or short term disruptions, and not being able to analyze more long term and downstream risks. To create models that can analyze interaction between infrastructures as well as the behavior of each specific infrastructure in detail, some argue for High Level Architectures (HLA) so already existing single-sector models can easily be included [11, 15]. Validation does not only matter for representing infrastructure behavior, but can also relate to how to operationalize the notion of resilience [15, 16]. When clear metrics for resilience are lacking it is hard for game designers to value performance and to direct learning. Finally, the analyzed simulations differ extremely in time scale. Some simulate 30 years [17], 30–60 years [11] or 150 years [14], while others simulate a scenario of only several hours or days [12, 15, 16]. Clearly, such choices can make a huge difference for the nature and outcomes of the learning experience, i.e. what impacts of disruptions are observed.

4.3 Number of Player Roles and Rules for Communication Between Them

All (gaming-)simulations acknowledge conflicting interests of different societal actors, but some put the need for addressing individual goals versus common goals, information sharing and negotiation more in focus as the main learning goal. Some games put players in isolated roles and limit communication possibilities [11, 16]. Others put players in collaboration teams where individual members need to monitor different goals, but where communication is free and the fact that you are a team rather than separate individuals through its structure promotes collaboration [15, 17].

4.4 Action Options, Re-Play Ability and Performance Feedback While Playing

Interaction between simulation model and players differs greatly. Some show only final outcomes [11, 12], some allow for choosing actions at fixed points from two alternatives [16], whereas some allow for continuous interaction with the simulation and have multiple choice alternatives [15, 17]. Too many options may hamper playability and learning [17], but too few options may harm realism and thus relevance of what is learnt [15]. A final interesting feature is the ability to play again, try out different scenarios and experience the consequences. Some do not allow this [17], some repeat the same work process, but each time with a new scenario [16] and some allow for unlimited re-play [11, 15]. In [15] re-play is a key element: different explored avenues are stored clearly to support the players in their learning.

5 Discussion

5.1 Lesson Learned for the Specific Case of Our Payment Disruptions Game

Learning Goals, Player Roles and Communication Rules:

Our payment disruption game will focus stronger on system understanding and less on overcoming collaboration and information sharing challenges. Collaboration in crisis is a general problem that can be trained in many ways. The focus will be on how participants can help each other when they are cooperative, rather than learning to overcome hinders for collaboration. Still, awareness for collaboration will be raised as a by-effect, as participants will have uneven information and information sharing will be necessary to meet the overall goals. Therefore players will be grouped as crisis management teams (as in [17]), where members have to monitor different interests, but are not operating as isolated individuals. Communication will be unlimited.

Realism and Time Scale:

Almost all designers in the analyzed studies struggled with balancing detailed realism versus a generally applicable, cost effective and understandable game design. It reminded us to put major attention to this early in the project. Our ambition is to design a scenario that pictures “big and smaller cities surrounded by rural area, recognizable in many parts of Sweden”, without going into exactly mirroring a specific city or region. Regarding time scale our project will not only aim on short term scenarios (different types of problems under several days or several weeks), but look for at least one “multiple years scenario”.

Replay-Ability, Action Options and Performance Feedback:

Identification of vital actions and crucial performance indicators is ongoing. Our intention is to include an option for players to “invent actions not prepared for by the simulation designers”, which will be evaluated by the game facilitators instantly and translated into impact on key variables in the simulation. Repeating the same steps in different scenarios [16] and free pause and re-play options [15] are very attractive from a pedagogical perspective. Such options have inspired us to consider a broader set of alternative game-session designs, besides only playing a single scenario once from start to end.

5.2 General Insights for Gaming-Simulations for Critical Infrastructures

As little is understood yet about critical infrastructure system behavior and interactions between infrastructures under stress, validity of our models should be a major concern. Interesting research avenues are for example: How can models be validated when they focus on seldom occurring crisis escalations or far away futures?; comparing different levels of realism and opening the black box: when are gaming-simulations too abstract and when do they become unplayable as players get lost in details?; how can the many definitions of resilience be operationalized in clear measures?; and finally, should we aim for one combined resilience measure that encapsulates different forms of resilience, or do we need multiple resilience measures picturing that resilience can be obtained in different ways?

6 Conclusions

A literature review of existing simulations and simulation-games that aim at understanding or training critical infrastructure resilience has revealed four groups of important design choices: (1) the chosen learning goal (system understanding or collaboration training), (2) realism and time scale of the scenario, (3) design of player roles and communication rules, (4) number of action alternatives, re-play ability and richness of performance feedback while playing.

The analysis informs our own process of designing a gaming-simulation for cascading effects payment disruptions for the food, fuel and transport system by reminding us of well-known issues (learning goals, degree of realism, choice of player roles) and by highlighting some new issues (time scale of scenario, re-play abilities). Identified challenges for the field of critical infrastructure simulation in general are: (1) models are often too abstract and not opening the black box sufficiently, (2) scenarios often limit themselves to single short term disruptions and do more seldom study slowly moving stressors over long time periods, and/or multiple interacting disruptions, (3) resilience is not specifically defined and thus it is hard for simulation-game designers to operationalize resilience in simple metrics.