Modeling Hospitals’ Adaptive Capacity during a Loss of Infrastructure Services

Resilience in hospitals – their ability to withstand, adapt to, and rapidly recover from disruptive events – is vital to their role as part of national critical infrastructure. This paper presents a model to provide planning guidance to decision makers about how to make hospitals more resilient against possible disruption scenarios. This model represents a hospital’s adaptive capacities that are leveraged to care for patients during loss of infrastructure services (power, water, etc.). The model is an optimization that reallocates and substitutes resources to keep patients in a high care state or allocates resources to allow evacuation if necessary. An illustrative example demonstrates how the model might be used in practice.


INTRODUCTION
Presidential Policy Directive 21 [1] and the U.S. Department of Homeland Security National Infrastructure Protection Plan (NIPP) [2] provide recent examples of federal infrastructure protection policies that call for increasing resilience of the nation's critical infrastructure. Hospitals serve a unique role for communities during disruptive events (e.g., hurricanes, earthquakes, terrorist acts) because hospitals are relied upon to accept and treat casualties while continuing to provide care for existing patients. Thus, interest in the resilience of hospitals -the ability of these systems to withstand, adapt to, and rapidly recover from the effects of a disruptive event -is well deserved.
Under Vugrin et al.'s resilience analysis framework, increasing resilience involves three related capabilities -providing absorptive capacity so that the system can include food, fuel, pharmaceuticals, bottled water, oxygen, and so forth, and support all levels of the hierarchy. Utilities are a special class of resources that include water, electricity, communications, etc. Utilities are specifically differentiated from resources and consumables because the model was designed to address loss of utilities and infrastructures. Table 1 contains a listing of example services, functions, resources, utilities, and consumables.
At the four lowest levels of the hierarchy, there are substitution possibilities. For example, a function may be provided using different resources, and those resources may require varying use of utilities and consumables. The model is designed to allow a user to specify a disruption (e.g., loss of electrical power) at a given time, and trace the adaptations (and associated resource use) as the hospital staff work to maintain appropriate care levels for the various categories of patients. Consumables may be exhausted, triggering other adaptations or an evacuation. If an evacuation is necessary, the model provides guidance on when the evacuation should begin, how many patients of each category should be evacuated and where they should be sent.
We illustrate the manner in which the model handles substitutions and adaptations with a simple example involving ICU patients requiring ventilation. ICU patients require a suite of services (laboratory services, radiology, etc.) that, for the sake of illustration and simplicity, is represented in a single box "ICU Services" (Figure 2). This category of patients would likely be differentiated from another category of ICU patients who do not require ventilation. Under typical conditions, ventilation requires a ventilator, a combination of compressed air and titrated oxygen, and nursing staff to monitor the patient (Figure 2a). Some of these functions may have substitutions available (automatic and manual ventilation, for example). The service will also require resources (e.g., physician and nurse time, vital signs monitoring equipment), utilities (power, water), and consumables (food, oxygen, medical supplies, pharmaceuticals). The loss of line power from the local power utility can cause a series of adaptations and reallocation of resources. When line power is  Dependency diagram progression for ICU patients requiring ventilation during a power outage: (a) under nominal conditions, (b) when utility power fails and backup generator operates properly, (c) for initial generator failure, (d) after batteries are depleted, and (e) after oxygen tanks are depleted. Faded elements with red "X" indicate element is nonfunctional. Blue, green, orange, red, and purple boxes represent service, function, resource, utility, and consumable entities in the hierarchy. initially lost, the model assumes that backup generator power is provided to critical systems, including ventilators or compressors for air delivery. Operation of the generator requires the use of generator fuel (Figure 2b), resulting in a new dependency upon a consumable commodity. In the event that backup generation fails (due to disruption conditions or depletion of generator fuel), the model transitions ventilators from generator power to battery power, resulting in a new dependency on another consumable commodity. Without a mechanism for delivery of compressed air to ventilators, ventilation depends on 100% oxygen from either the main reservoir or portable oxygen tanks (Figure 2c). If the power outage persists beyond battery capacity, manual ventilation is required. This adaptation requires an increase in staff resources (Figure 2d). When oxygen tanks are depleted, ventilation will rely upon ambient air (Figure 2e) potentially resulting in decreased quality of care. It is also possible that utilities and consumables can be substituted for one another (e.g., bottled water can be substituted for water from the water lines). This example illustrates how the model represents the impact of disruptions on hospital operations and how the model works within the patient care hierarchy to represent changes in operations and substitutions among functions, resources, utilities, and consumables. By running numerical experiments that vary according to available consumable levels, availability of backup resources, etc., hospital administrators and medical staff can use the model to assess the impacts of how stocking consumables or having backup resources might affect the ability to avoid an evacuation, to explore how various constraints can affect the system, etc. These analyses can be performed across a wide range of disruption scenarios in which it is assumed a set of infrastructure services is temporarily lost.
Patients are divided into categories, each of which may have different care requirements and, thus, require different services. For example, a trauma patient in critical condition with unstable vital signs or requiring ventilation could define a category of patients. Under nominal conditions, this critical patient (and others in this category) would typically be cared for in the Intensive Care Unit (ICU). When the medical condition of the patient improves such that their vital signs stabilize or ventilation is no longer required, the individual's care requirements would change, and the patient could be categorized as a trauma patient in stable condition. This change in medical status and patient category would likely result in the patient being moved to a step-down intensive care medical or surgical unit where intensive services such as ventilation are not required. Eventually, the patient's condition could further improve, resulting in the patient being re-categorized as a trauma patient in good condition, and moving to a medical or surgical nursing unit. 1

92
Modeling Hospitals' Adaptive Capacity during a Loss of Infrastructure Services Each patient category requires different services or different amounts of specific services. The appropriate set of categories for a particular analysis is defined by the model user. Levels of care allow the model to distinguish among situations in which patients receive normal care (i.e., all services required for that patient category are operating and available), levels of reduced-but-adequate care (e.g., no elective surgery or radiation treatments, but other services are available), or are in a non-sustainable state (i.e., some vital service cannot be provided). The set of reduced-but-adequate care levels may include several subdivisions that can be defined by the model user as appropriate for a specific application. If a total of C care levels are defined (indexed by c = 1, 2, …, C), we adopt the convention that c = 1 is the normal care level and c = C is the non-sustainable state. States c = 2, …, C-1 are varying levels of reduced-butadequate care.
In the context of this model, the term disruption is generally used to indicate either a partial or complete reduction in the availability of one or more utilities. Partial or complete loss of utilities can lead to a partial or complete reduction in the functionality of equipment and or certain hospital operations and services. It should be noted that in its current state, the model is not set up to represent cyclic utility interdependencies and their failures (e.g., electric power generation requires water for cooling, and water distribution requires power for pumping). These interdependencies are often a key concern for infrastructure modeling and analysis. Instead of explicitly representing failure dynamics of the systems that occurs because of the dependencies within the model, the model instead requires that the ultimate outcome of the disruption to the interdependent systems be represented within the disruption scenario specifications (e.g., neither power nor water are available).
Some disruption conditions may necessitate evacuation. Evacuation is represented as a service that requires inputs from functions (e.g., either elevators operating or manual in-building transportation), resources (e.g., ambulance, staff time), utilities (e.g., power for the elevators, if working), and consumables (e.g., bottled oxygen). A shift in operations from shelter-in-place to evacuation requires a dramatic change in the overall mix of consumables, utilities, resources and functions needed, and different constraints may become binding.
Patients may be discharged early or evacuated to another facility to avoid entering the non-sustainable care level. The rate at which evacuation occurs is limited by available staff resources in the hospital, transportation resources for movement to receiving hospitals, and the ability of receiving sites to accept the evacuees. The possibility of discharging patients is also included in the model definition.
The model is an optimization whose objective function reflects the desirability of keeping patients in a high care level by using resources, utilities and consumables to provide functions and services. Over a planning horizon of T time periods, resources and utilities may have reduced availability and stocks of consumables may be exhausted or be replenished. The model substitutes among defined possibilities for producing required functions and services, making the best use of available resources, utilities and consumables according to the objective function. Penalties are associated with patients moving to lower care levels, or having to be evacuated.

Model Notation
To describe the model formulation in detail, we will use the following notations: Decision variables d i (t) discharged patients from category i during period t e il (t) patients in category i evacuated to destination l during period t p ic (t) total in-patients in category i and care level c at the end of period t P i (t) total in-patients in category i at the end of period t r kf (t) usage of resource k for function f in period t r ′ ks (t) usage of resource k for service s in period t r k (t) total usage of resource k in period t u jk (t) usage of utility j for resource k in period t u′ jf (t) usage of utility j for function f in period t ũ js (t) usage of utility j for service s in period t u j (t) total usage of utility j in period t v fs (t) amount of function type f used for service s in period t v f (t) total required amount of function type f in period t w mj (t) usage of consumable m for utility j in period t w′ mk (t) usage of consumable m for resource k in period t w mf (t) usage of consumable m for function f in period t w ms (t) usage of consumable m for service s in period t w m (t) total usage of consumable m in period t W m (t) amount of consumable m remaining at the end of period t x ii′ (t) patients who change from category i to category i' during period t Y s (t) required amount of services of type s in period t Input data a i (t) arrivals of patients in category i during period t B i (t) available capacity for patients in category i during period t D i (t) maximum allowable discharges from category i in period t E l (t) upper bound for evacuating patients to destination location l in period t p ic (0) initial in-patients in category i and care level c at the beginning of the analysis period R k (t) amount of resource k available during period t (in appropriate units) S il available capacity for evacuated patients in category i at destination location l U j (t) amount of utility j available during period t (in appropriate units) W m (0) initial amount of consumable commodity m available Δ m (t) quantity of consumable commodity m delivered in period t Parameters and coefficients g m cost of a unit of consumable commodity m h j cost of a unit of utility j ˘ 9 4 Modeling Hospitals' Adaptive Capacity during a Loss of Infrastructure Services α js units of utility j required to provide one unit of service s β fs units of function f required to provide one unit of service s γ ii′ average rate at which patients change from category i to category i' (as a result of change in medical status) δ mj units of consumable commodity m required to provide one unit of utility j η mk units of consumable commodity m required to provide one unit of resource k λ k cost of a unit of resource k ω mf units of consumable commodity m required to provide one unit of function f φ ms units of consumable commodity m required to provide one unit of service s σ jk units of utility j required to provide one unit of resource k τ jf units of utility j required to provide one unit of function f θ kf units of resource k required to provide one unit of function f ξ ks units of resource k required to provide one unit of service s ρ sic required amount of service s for a patient in category i and care level c (per period) ζ si required amount of service s for evacuating a patient in category i π ic penalty cost for a patient in category i in care level c, with π ic < π ic′ if c < c′ ψ il penalty cost for evacuating a patient in category i to destination l The model formulation reflects changes in system status over time. The beginning of the analysis horizon is defined to be time t = 0. The planning horizon is divided into a set of T discrete periods, each of length h hours, and these periods are indexed by t = 1, …, T. Some variables (e.g., patients in-care or stocks of consumable items) are defined as "snapshots" at specific points in time, while others (e.g., patients evacuated, resources consumed, etc.) reflect activity during the interval corresponding to one of the discrete periods. Thus, t = 1 can refer to either the first time period or the time at the end of that period. With these conventions, all the variables can be defined consistently.

Optimization Model Formulation
The complete model statement is as follows: Modeling Hospitals' Adaptive Capacity during a Loss of Infrastructure Services The model allocates consumables and resources in a way that first attempts to keep all patients in the highest care level possible in all time periods. This is done through the use of penalty coefficients π ic in the objective function. A penalty (ψ il ) is also associated with patients evacuated (e il (t)), so that patients will be sheltered-in-place unless there are insufficient consumables and resources to provide adequate care for them. Cost coefficients (λ k , h j , g m ) are also attached to the usage of consumables, utilities and resources so that the solution allocates only as much as is required in each time period. In any particular model run, it is assumed that the model user has specified these relative costs and penalties in a way that reflects the user's preferences on how n s c ns c ns c tradeoffs are made. As part of an overall analysis, it is likely to be important to explore various combinations of these values to determine how the solution changes as a function of these input parameters, and to use that sensitivity information to guide overall planning decisions. For each patient category and time period, eqn. 2 ensures that all patients are accounted for. Eqn. 3 defines the total in-patient population in each category. The values of p ic (0) are the initial patient populations and are assumed to be a model input.
In some situations, depending on how patient categories are defined, it may be medically reasonable that patients transfer between categories (e.g., as their condition improves). Eqn. 4 allows such patient transfers if average rates, γ ii� , are specified by the model user. Patient discharges, if appropriate in a given situation, can also be included via eqn. 5 and specification of an upper limit on patients eligible to be discharged.
The physical scope of analysis will vary from one model application to another (e.g., a single unit such as an ICU in one case and a collection of units or an entire hospital in another). In general, there will be some physical limit on the number of patients that can be treated in a given category, and eqn. 6 reflects this. Eqn. 7 requires that if a patient is to be evacuated, there must be available capacity at the destination location. In addition, there may be constraints on evacuation to a specific destination during particular time periods. For example, if roads are closed, etc., it may not be possible to use certain destinations, even though they have capacity to accept evacuees. Eqn. 8 reflects that potential limitation of road capacity constraints.
Eqns. 2-8 account for patients and their movements. The patient variables drive consumption of services, functions, resources, utilities and consumables. These constraints take the form of requirement equations and limits, as represented in eqns. 9-23.
Eqn. 9 reflects the required services of type s. The model allows substitutions among elements to meet the requirements at higher levels in the overall hierarchy. For example, different functions can be substituted for the provision of services (e.g., either a ventilator or manual bagging can provide the service of ventilation for a patient). Similarly, different resources may be substitutable in the production of either functions or services. At the lower levels of the hierarchy, a more complex set of substitution possibilities is present among consumables and utilities (e.g., the consumable bottled water can be substituted for the water lines utility). To accommodate the substitution possibilities, it is necessary to have variables that track the allocation of consumables, utilities, functions and resources to the hierarchical elements above them.
It is also necessary to define sets of substitutable elements at various levels, and there may be multiple (mutually exclusive) sets for a given result. For example, power sources are substitutable for functions and services, as are sources of potable water. However, the power sources are not substitutable for the water sources. To manage this, a collection of groups are defined for use in eqns. 10-18: 98 Modeling Hospitals' Adaptive Capacity during a Loss of Infrastructure Services : the n th group of functions that are substitutable for production of service s : the n th group of resources that are substitutable for production of function f : the n th group of resources that are substitutable for production of service s : the n th group of consumables and utilities that are substitutable for production of service s : the n th group of consumables and utilities that are substitutable for production of function f : the n th group of consumables and utilities that are substitutable for production of resource k In eqn. 10, the individual terms in the summation represent how much of the service requirements are met by each of the substitutable functions. For functions that are not substitutable in production of service s, the associated substitution group has only one element and the summation on the left side of eqn. 10 has only one term. The total required amount of function f is expressed in eqn. 11. A parallel structure for resources is reflected in eqn. 12 for service production and eqn. 13 for function production, with eqn. 14 representing total resource requirements and eqn. 15 the limits on available resources.
For consumables and utilities, the sets , , and may contain both consumables and utilities, making it necessary to do the summations over the entries corresponding to each type of element. We define as the set of consumable entries in , and as the set of utility entries in . Definitions of , , and are parallel. The substitution constraints for production of services are written in eqn. 16; eqns. 17 and 18 represent parallel structures for use of consumables and utilities for functions and resources. Total usage of utilities is represented in eqn. 19, and the limitation on available utilities is in eqn. 20.
Consumables can be required for some utilities (e.g., generator fuel for generator power), but the model assumes that consumables used in this way are not substitutable, so eq. 21 represents that use. The total use for each type of consumable is defined by eqn. 22 and eqn. 23 tracks the available stocks of consumables so that usage in each period cannot exceed the amount available (as a result of non-negativity requirements). Many of the model quantities are integers in practice (including patients, for example), but using a linear programming approximation has proven to be quite acceptable in application. This simplifies solution dramatically and makes the model much more usable for interactive experiments. The model has been implemented using LINGO, a commercial software system for optimization applications. Computational time for model execution is modest, with calculations being completed within a few seconds for the following example applications.

AN EXAMPLE OF APPLICATION
To illustrate a potential application of the model, we describe a hypothetical ICU that is subjected to a power disruption. The following discussion is a hypothetical, illustrative analysis that is intended to demonstrate how the model could be used and exercised for planning purposes. Though the results are not intended to represent a specific facility or an actual event, scenario development was motivated by the 2012 Hurricane Sandy hospital evacuations in New York [32][33] and the 2001 evacuation of Memorial Hermann Hospital in Houston [16][17]. These two events are real examples of hospital evacuations that occurred in large part because of losses of power and backup power system failures.
Consider an ICU with capacity for 20 total patients. Patients in this ICU are divided into two categories -those that require ventilation and those that can breathe without mechanical assistance. Initially, there are 6 patients in the unit on ventilators and 10 patients who do not require ventilation. The example focuses on resource substitutions and possible evacuation operations within this ICU after a power failure.
Four care levels are defined for this example: 1) nominal operations, with full services; 2) all services except elective surgery are available; 3) staffing only (i.e., no operating rooms, lab or pharmacy available); and 4) a non-sustainable state in which sufficient resources are not available to provide patient care in a sustainable manner 2 . In addition to within-ICU services, the services represented in the example include operating rooms, laboratory, pharmacy and evacuation. This is obviously not a complete list of services available in a hospital, but it serves well as a small example of the model use.
A set of functions are defined in support of the services, including automatic ventilation, manual ventilation, medical vacuum (mVac), manual suction, sanitation, communications, back-up communications, elevators, and manual in-building transportation. Patient ventilation is normally provided with ventilator equipment, but under conditions of power failure, manual ventilation (nurses or technicians operating a squeeze bag) can substitute for the automatic ventilation equipment. Of course, this requires additional people for each patient. Patients on ventilators also require suction, which is normally provided by vacuum lines running throughout the hospital. However, the vacuum pumps require electricity, so in serious power failure events, manual suction can be substituted. A functioning communication system is necessary for providing adequate patient care, but if power is unavailable, a back-up communication system (battery-powered walkie-talkies, etc.) can be brought into play. In serious power failure events, manual in-building transportation (staff carrying patients down stairwells) can be substituted for elevators that are not functioning. This substitution can be important for evacuation.
Eight resources are defined to support the functions and services in this example. These include ventilators, potable water, air delivery, physicians, nurses, technicians, other staff, and ambulances. Ventilators and air delivery are both required for the 100 Modeling Hospitals' Adaptive Capacity during a Loss of Infrastructure Services automatic ventilation function. Air delivery is normally provided centrally, but in the case of power failure, air tanks can be substituted. The Other Staff category includes a range of non-medical staff who normally provide housekeeping, patient transportation within the hospital, maintenance services, etc. In emergencies, they may be recruited to assist with evacuation of patients, etc. There are three utilities represented for this example: line power, back-up generator power and water lines. The power sources are substitutable, but if line power fails, the operating room service is taken offline, representing a decision that elective procedures are not started under back-up generator power. The operating rooms continue to be available for emergency uses and the back-up power allows procedures that may be in progress at the time of power failure to be completed safely. Water lines are the normal source for the resource potable water, but bottled water (a consumable) can be substituted if the water lines are not functioning.
A total of ten consumables are at the bottom of the model hierarchy: food, nutritional support, generator fuel, medical supplies, bulk oxygen, bottled oxygen, air tanks, bottled water, batteries for the ventilators and batteries for back-up communication equipment. Nutritional support is intended to be a general term for the various formulas and solutions used to nourish ventilator patients who cannot eat normal food. Nutritional support is dispensed by the pharmacy similar to other prescribed medications. The pharmacy typically prepares or dispenses commercially prepared parenteral nutrition solutions to be infused through a vein. They also dispense commercially available enteral formulas that are administered through a tube into the gastrointestinal tract. If the pharmacy becomes inoperable, this may be a limiting commodity for continuing care of critically ill patients. Bulk oxygen is the normal source of oxygen for the ventilators, supplied centrally from a pressurized tank and accessed via a wall fitting in the patient rooms, the operating room, etc. If the central tank cannot be replenished due to a disruption event, pressure drops, eventually necessitating the use of oxygen from bottled sources as long as they are available. Ventilators have battery back-up, but these batteries last a relatively short time (perhaps 2-4 hours). The model starts with some available supply of these consumables, and under normal conditions they are replenished periodically. However, in a disruption event, the replenishment may not be possible, and the ability of the hospital to continue to provide adequate services may be limited by availability of these consumables.
Three numerical experiments are described below. In the first, line power fails for a 12-hour period and back-up generation functions properly. The second experiment represents a more serious event in which line power fails and is not restored within the 36-hour analysis period. Back-up generators also fail 12 hours after the initial power failure, leaving the hospital unit without electrical power for the remainder of the analysis period. The third experiment duplicates the failure conditions of the second, but reflects conditions with increased stocks of a critical consumable and increased staff availability during the power outage.
The Appendix provides the model parameters and substitution information necessary to replicate the model results for the example application.

A 12-Hour Power Failure
The model run is defined to include 18 two-hour periods. A power failure occurs at the end of the first period, lasts for 12 hours (until the end of period 7), when power is restored. In this very simple disruption, patients in both ventilator and non-ventilator categories drop from care level 1 to care level 2 during the outage because the operating room is taken off line for elective procedures (Figure 3). However, other services (e.g., lab and pharmacy) remain available on generator power, and bulk oxygen and air delivery continue, etc. Some generator fuel is consumed that would not otherwise be, but overall the effects are very minor.

Failure of Back-Up Power
In the second experiment, the disruption is more severe; a line power failure at the end of period 1 is followed by a generator failure at the end of period 7 (hour 14). For the remaining 22 hours of the 36-hour analysis period, no electrical power is available. In this case, the adaptations within the ICU are much more complex.

102
Modeling Hospitals' Adaptive Capacity during a Loss of Infrastructure Services   Figure 4 illustrates the effects of the disruptions on ventilator and non-ventilator patients. When the initial power failure occurs at the end of period 1, patients in both categories drop to level 2 care, as in the first experiment. This continues until the generators fail at the end of period 7. The complete loss of electrical power triggers an evacuation beginning in period 8. The ventilator patients are evacuated first, during periods 8-10, and the non-ventilator patients follow over periods 10-15. The rate at which patients can be evacuated is limited by available resources, in this case, availability of the Other Staff resource. Figure 5 shows the demand for this resource in each period during the model run. The availability is set at 15 person-hours per period. This is adequate for normal care (e.g., during period 1) and also for level-2 care during periods 2-7. However, the evacuation starting in period 8 creates additional demand on this resource, particularly since the elevators are out of service and patients must be moved manually down stairwells in the dark to be evacuated. During period 8 in particular, the model must make choices regarding allocation of this scarce resource, between evacuating ventilator patients and continuing to provide services (assisting medical staff, sanitation, etc.) for the remaining patients. Because not enough people are  available to do everything, some ventilator patients briefly slip into a non-sustainable care level during period 8. After some patients are evacuated, there are sufficient staff resources to bring the care level for the remaining patients up to level 3 in period 9, and these remaining ventilator patients are evacuated in period 10. The shortage of Other Staff affects the non-ventilator patients even more dramatically because they must wait longer to be evacuated ( Figure 5). As shown in Figure 4, many of these patients are in a non-sustainable state for multiple periods. In addition to the shortage of staff for the evacuation, the limited availability of batteries for the back-up communication system is also a serious constraint. Figure 6 shows the remaining battery capacity at the end of each period through the analysis. Because the evacuation process increases the demand on the back-up communication system, the available battery capacity is expended rapidly and is insufficient to support all the demands on it, causing some compromise in patient care.

104
Modeling Hospitals' Adaptive Capacity during a Loss of Infrastructure Services  This second experiment shows how an event that causes complete loss of electrical power can trigger patient evacuation, as well as how the adaptation of the hospital can be limited by either staff resources or consumable availability. Several case studies of specific hospital emergencies have highlighted the need to use volunteers and nonmedical staff from the hospital to augment the normal staffing during disruptions [16][17]22], and have also noted the importance of supplies of batteries and other consumables to maintain service during severe events. The findings from this experiment set the stage for a third experiment in which additional people and batteries are assumed to be available.

Effects of Additional Critical Resources Available
The third experiment is based on the same disruption as the second, but with 60% more Other Staff hours available and sufficient back-up communication batteries to last throughout the 36-hour power outage, thus no longer constituting critical limitations. This experiment illustrates a Pareto analysis, in which the next most critical constraint is identified, as well as demonstrating changing patterns of adaptation as different resources become critical. Figure 7 shows the status of patients during this third model run. The complete loss of power at the end of period 7 again triggers an evacuation, but with two important differences from the previous experiment. First, the evacuation is only partial. All of the ventilator patients are evacuated, but most of the non-ventilator patients are not. Secondly, no patients in either category move into a non-sustainable care level during the emergency. With adequate back-up communications and non-medical staff to handle the patient movements during the evacuation, it is possible to maintain at least care level 3 for all patients and 7 of the 10 non-ventilator patients can continue to be cared for within the unit during the emergency.
In this experiment, the limiting resource constraint is the availability of physicians during the evacuation. The availability of physicians is specified as 6 person-hours per period, and Figure 8 shows the demands for physician time during the run. At the time of initial power failure, there is a small decrease in demand for physician time because elective surgeries are cancelled. During periods 8-10, when the evacuation is taking place, all available physician time is in use because additional physician time is required as patients are readied for transport. After the required patients are evacuated, the demand for physician time within the ICU decreases substantially because there are fewer patients present.
Availability of additional staff resources in the "Other Staff" category could likely be accomplished by training people in procedures to be used in the event of an extended power outage, and having those people eligible for call-in during such an event. It does not mean that the ICU needs to be more heavily staffed at all times. Calling in additional staff and stocking batteries sufficient to support back-up communications for at least 36 hours both create some additional resource costs for the hospital. However, in this third experiment, the patient care penalty terms in the model objective function decreased by 94% relative to experiment 2, and the 45 patient-hours in the non-sustainable care level were eliminated completely. It is difficult to put a monetary value on the improvement Infrastructure Services  in patient care level, but the model provides important quantitative results for hospital administrators to use in planning for emergencies. Although many additional experiments are possible, this small set illustrates how the model can be used to identify critical resources, determine required quantities of backup resources, and reflect the ability of a hospital to adapt to changing conditions during an emergency. This analysis tool provides an important new capability for emergency planning in hospitals.

DISCUSSION
The resilience of hospitals is an important aspect of improving overall performance of critical infrastructure systems. Increasing resilience involves three related capabilitiesproviding absorptive capacity so that the system can withstand disruptions, providing adaptive capacity so that services can be provided using alternate resources or processes, and providing restorative capacity so that recovery from a disruptive event can be accomplished quickly and at reasonable cost. The focus of this paper is on adaptive capacity, through which hospitals adjust to the disrupted conditions and seek to continue to provide the highest care level possible for all their patients. Our concern is with planning for maintenance of adequate care for patients already in the hospital at the time of the disruptive event, rather than on the hospital's ability to accept casualties from an external event.
A dynamic optimization model is developed to analyze opportunities for improving resilience within hospitals. The model allocates consumables and resources in a way that attempts to keep all patients in the highest care level possible throughout a disruption and includes evacuation if a disruption scenario warrants it. The model is based on defining a hierarchy of consumables, utilities, resources, functions and services within the hospital, and includes various substitution possibilities that exist so that adaptation by the medical staff within the hospital can be reflected. This allows a careful assessment of the level of resilience under specified conditions, as well as creating a computational laboratory for exploring various ways of improving resilience. A relatively small example focused on an intensive care unit has been used to illustrate some of the model's capabilities and to demonstrate that this approach to resilience analysis can provide an important new capability for hospitals. The example introduces a Pareto analysis in which one can iteratively identify critical limiting factors and solutions for addressing those factors. Use of this type of analysis can be the basis of developing emergency plans. Parameterization and analysis of the model to represent a specific hospital unit and disruption event could suggest guidance on specific actions hospitals could take to become more resilient to future, similar events.

CONCLUSION
Mathematical modeling of resilience is a vital tool for helping managers understand how complex systems for which they are responsible respond to disruptions, adapt their operation, and recover to normal functioning. Models can also be extremely helpful in guiding investments designed to improve system resilience. The model described here is an example of such a tool. A particularly important element of this model is the Infrastructure Services representation of substitution possibilities among resources and consumables as a hospital responds to a disruption of normal infrastructure services and adapts to continue providing the highest care level possible for its patients.
In its current form, the model provides a useful analysis capability for hospital administrators and planners. However, several enhancements are also possible through further research. Hospitals are very complex organizations and may well have adaptability capabilities that we have not yet considered. Such opportunities for model extension can be identified through more and larger application efforts. The example in Section 4 illustrates an analysis mode where limiting constraints are observed and manual adjustments to model input parameters are made to explore further changes to improve system performance. It may well be possible to consider another layer of optimization that would automatically determine the best set of improvements to be made in the system. Optimization over a range of possible scenarios reflecting uncertainty about future disruptions is an important direction for further work. The current model formulation is deterministic and does not explicitly represent sources of uncertainty and the impact they could have on model outputs or conclusions from subsequent analysis. Future research should investigate the impact of these uncertainties. Sources of uncertainty that could be considered include: disruption scenario conditions (e.g., power outage duration), patient information (e.g., number of patients when disruption begins, patient arrivals, rate of transition between patient categories), availability of resources and consumables (e.g., stock levels at time of disruption, timing of restocking for consumables). The current model creates a computational laboratory for testing responses to postulated scenario conditions, and creates a useful step toward optimization under uncertainty about what future scenario conditions might occur. Such an enhancement would make the model considerably more complicated, but is likely to offer entirely new capabilities.
The example application explores how the ICU responds and adapts to the power outage. Future work could consider using the model to estimate the costs of disruptions. Given that the objective function quantifies the cost of the response to the disruption, a comparison of the objective function under nominal and disrupted conditions could be used to estimate the cost of the disruption. Additionally, one could use the model to explore how to improve the hospital's response to a disruption. Representation of proposed improvements (e.g., increase in resource availability, hardening of equipment against failure, decreased transportation times, etc.) could be represented within numerical experiments, and the model could be used to estimate the benefits and costs associated with the proposed improvements. The authors are currently preparing a manuscript demonstrating the model's usefulness for these types of analyses.

APPENDIX. MODEL PARAMETERS A.1. Input Parameter Values
Tables A.1 -A.15 provide the model parameter values listed in Section 3.1 for the first example application experiment in Section 4.1; i.e., line power is lost for time periods 2-7 (6 2-hour time periods). The second experiment (described in Section 4.2) can be run by setting U 1 (t) (amount of line power available) to 0 for time periods 2   through 18 and U 2 (t) (amount of generator power available) to 0 for time periods 8 through 18. The third experiment (described in Section 4.3) can be run by making the same changes as for the second experiment and increasing R 7 (t) (other staff available) by 60% and W 10 (0) (amount of communications batteries available) from 10 to 50 units.

A.2. Substitutions
The model permits a number of substitutions. The following are included in the model runs for the experiments described in Section 4.

�
The resource mechanical ventilators can substitute: o Line power (from their local power provider) with generator power or ventilator batteries. o Bulk oxygen with bottled oxygen. � The resource potable water can substitute line water (from their local water utility) with bottled water. � The resource air delivery can substitute line power with generator power or air tanks. � The function mechanical vacuum (mVac) can substitute line power with generator power. � The function communications can substitute line power with generator power or batteries for communications. � All services can substitute communications with backup communications. � The services operating room, laboratory, and pharmacy can substitute line power with generator power. � The service evacuation can substitute: o Elevators with manual in-building transport. o Automatic ventilation with manual ventilation. o mVac with manual suction. � ICU services including ventilation can substitute: o Automatic ventilation with manual ventilation. o mVac with manual suction.