In our scenario the system is assumed to describe a network that distributes some utility following flow conservation analogous to Kirchoff's current law; examples of systems following such constrains are not only power grids, but also the flows of fluids in distribution networks like water, gas, oil (at least at stationarity). As a further simplification, we will consider a single node to be the source of the commodity distributed on the network and we will not consider any constrain on the amount of flow that can be transported by any link; hence, connectivity among a sink and a source in enough to have the sink served. In our scenario, all the nodes (except the source) are considered to be potential sinks. Hence, to serve as many nodes as possible, connectivity must be maximized.

A further assumption is that at each instant of time, the topology of the network distributing the commodity is a tree (the active tree); in fact, such a structure meets the infrastructures' managers needs – i.e., to measure (for billing purposes) in an easy and precise way how much of a given quantity is served to any single node of the network. In networks – like drinking water – where such assumption is not strictly true, very few loops (i.e. low meshedness) are present [15].

To model active trees, we start from an underlying network topology and build up a spanning tree. The set of all possible redundant links is exactly the set of links in the network not belonging to the spanning tree. In order to allow for recovery, we also consider the presence of dormant backup links – i.e., a set of links that can be switched on – as in the case urban of low-voltage distribution power grids.

While commodities can be transported only via active links, in order to implement our self-healing strategy we assume that nodes are able to communicate by means of a suitable distributed interaction protocol only with the set of neighbouring nodes, i.e. the ones connected either via active or via dormant links. According to our procedure, when either a node or a link failure occurs, all the nodes that cannot be served – i.e. there is no path to the source – disconnect from the active tree. Afterwards, unserved nodes try to reconnect to the active tree by waking up (activating) through the protocol some of their dormant backup links. Such a process reconstructs a new active-tree that can restore totally or partially the connectivity, i.e. heals the system. A more formal description of the self-healing procedure and of the simulation protocols are provided in the Methods section.

A natural metric to quantify the success of such a procedure is the fraction of served nodes (). In order to identify the system's properties that are able to maximize the we study the effects of varying the fraction of backup links (redundancy) according to different underlying connectivity patterns with respect to multiple random failures.

In order to stress the peculiarities of different network structures, we generate class of graphs with different connectivity patterns (see Methods). We start our investigation by focusing on the underlying topology which often resembles the actual situation of infrastructural networks – i.e. nodes disposed over a planar square grid (). Then, we stress the role of the underlying networks' connectivity patterns by using the scale-free () topology generated according to Barabasi-Albert [16] and the small-world () topology generated according to Watts and Strogatz[17]. All the initial network structures are generated by using the IGRAPH library [18].

To generate the random spanning trees associated to each kind of network structures, we use the flat sampling algorithm of Wilson [19]. We take such spanning trees as the initial configuration of our model distribution networks. The links not belonging to the spanning trees form the set of the possible backup links of our system; among such links, we choose a random fraction of dormant links that can be used to heal the system. We then simulate the occurrence of uncorrelated multiple failures by deleting at random links of the initial active tree. Notice that link failures are the most general ones, as a node failure is equivalent to the simultaneous failure of all its links.

The source node – i.e, the root of the oriented active tree – is chosen at random within all the nodes of the underlying network. The only exception is the case of the networks where we use, according to the preferential attachment principle, the natural choice of having the node with the highest number of neighbours (the central hub) as the source.

Our self-healing algorithm is a routing protocol (see Methods) whose goal is to reconstruct the maximum spanning tree connected to the source after that a failure has occurred; in doing so, we use both the survived links of and the dormant links ; fig. 1 illustrates such procedure. After the recovery, we calculate the fraction of nodes connected to the source after the recovery.

In order to test the performances of our healing algorithm to failures in terms of the service provided after the active tree restoration, we simulate the model for increasing number of failures. Recalling that each failure causes a cascade – i.e, each node of sub-tree served by the broken link is unserved – we investigate the role of redundancy on different topologies.

We start our study by addressing planar square grid () networks since they are the most similar to the real physical networked infrastructures. In the first scenario, we generate spanning trees on a square grids; fig. 2(a) shows the variation of the restored respect to the number of failures for different redundancies s. For square grids, we do not observe any relevance of the redundancy on the ; this means that a very small fraction backup links (, i.e. ) already suffice to attain the maximum resilience.

The situation is completely different when the underlying topology is a scale-free network generated through the Barabasi-Albert model [16]. A widely diffused property of real networks is that the connectivity pattern follows a scale-free power-law distribution [1], [20], [21]. This feature has been found to be a consequence of the so called preferential attachment – i.e networks expand continuously through the addition of new vertices which attach preferentially to already well connected nodes. Although technological networks do not show power law degree distributions due to economic and spatial constraints[22], we choose to investigate networks for their marked robustness upon random failures [23]. For networks, it is natural to choose the node with the highest degree (the hub) as the source. The quality of service restored by our self-healing algorithm on networks is shown in fig. 2(b). As expected, we find that networks can easily recover connectivity to all the nodes even for low redundancies. Such error tolerance comes at a high price of being extremely vulnerable to node targeted attacks: isolating the hub disconnects the whole system. High error tolerance and targeted attack vulnerability are indeed generic properties of networks [24].

We then consider the case of small-world () networks generated according the Watts-Strogatz rewiring procedure [17]. In the case of technological networks, small-world networks are important since they highlight the effects of introducing long-range links in a planar topology. Starting from an initial graph (planar square grids in our case), we rewire with a probability a link with a randomly selected node; in this way we can interpolate from the case of networks () to the case of a random graph (). As in the case of simple percolation [25], the rewiring procedure introduces some long range links – i.e., between distant nodes on the square grid) that improve the robustness to random failures.

In order to understand the role of the connectivity pattern we study our model on different networks with different rewiring probabilities. In fig. 2(c) we show the performances of our self-healing strategy with respect to an increasing number of failures. We see that a higher rewiring probability increases the number of served nodes after the restoration through the backup network; such a peculiarity shows up even if the clustering within neighbouring nodes (normally associated to a local robustness against failures) decreases; therefore long range links increase the possibility of the network staying connected even after multiple failures.

Finally, we compare in fig. 3 the effectiveness of the self-healing protocol across different strategies. Notice that while distribution grids based on the topology are the more robust, they should be disregarded when considering the case of technological networks since economic and geometric constraints make networks unfeasible on planar topologies.

We consider an abstract model of a physical networked infrastructure described by the quadruple . Here are nodes of the network, is the source node, is the set of active links among the nodes and denotes the set of dormant links that can be activated in order to heal system failures by re-connecting nodes. A node is considered to be served if it is connected to a source through a path of active links; all the nodes in are initially connected to the source via a spanning tree. As the basic metric for any quality of service assessment, we consider the fraction of served nodes counting the number of nodes in the active graph – i.e connected to .

More formally, in the initial configuration, the graph is an instance of the set of all the random spanning tree of the underlying graph . Thus, before the failures has (active) nodes and links among them. The set of backup edges is taken form the remaining edges of the underlying graph , i.e. and . The fraction measures the redundancy of .

We then consider the occurrence of multiple link failures. A -failure is a subset of links chosen at random. The system right after a failure is described by the forest and by the set of dormant links available for the healing. A healing protocol is any algorithm that, by activating (waking up) a subset of dormant edges, finds a maximal tree of containing the source . If is spanning, then the system has fully recovered.

For the robustness of the algorithm, we will assume that nodes have only a local knowledge of the networks – i.e., only about the state (active, dormant or failed) of their incoming links. To build the maximal connected tree, nodes communicate with their neighbors via a suitable distributed protocol allowing fault nodes to join the active network by activating dormant edges. In other words, nodes are endowed only with the minimal requirements of routing needed to reconstruct a spanning tree [34]. In this paper, we have applied the following simple distributed algorithm to implement self-healing:

    initial configuration

    failed links

    unserved nodes

   repeat

      for all do

         choose a random neighbor connected to through any edge of

      for all do

         if then

   until

   return

By definition, the nodes in are the set of served nodes . Notice that the state still describes a network infrastructure; therefore, we can in general describe the state of the system at time by the quadruple and the sequence of time failures between time and by . A general representation of such a process can be given in terms of time varying graph [35].

We analyse the response of the system to -failures. To study the effects of different topologies, we perform simulations on different grids (fig.4 – upper panel).

Classically, engineered systems (especially in the power industry) are built robust, i.e. they can survive to the single failure of any of their components. While checking robustness corresponds to checking all the possible single failures, checking the robustness requires to consider cases. Therefore, checking the robustness is infeasible even for modest values of due to the combinatorial explosion of the number of possible cases. Thus, we choose to assess on probabilistic ground whether a system would be able to sustain failures by a Monte Carlo investigation of the space of possible failures.

Service operators are interested in maintaining their service level agreements (contracts) with their customers; to such an aim, customers must in first pace remain connected to the services. Therefore, we calculate the average fraction of served customers after the occurrence and the healing of random failures. To do so, we choose at random different links on the service tree and delete them; after that, we apply the self healing procedure; finally, we calculate the as the fraction of nodes connected to the source. We average such procedure over several network realizations until the relative error of the average is small enough (less than ). As an example, for a grid of nodes, we must typically average over sets of random failures to attain the desired accuracy. Moreover, to average out the different characteristics of the initial configurations, we repeat the procedure over different independently generated initial configurations.

To generate a random spanning tree associated to a graph (fig.4 – lower panel), we apply the exact algorithm of Wilson [19] that samples uniformly the elements of . Such spanning trees are taken as the initial configurations for our model distribution networks. The links of the graph that do not belong to the initial configuration form the set of the possible backup links of our system; of such links, only a subset (the dormant links) can be used to heal the system. The fraction of such dormant links characterizes the redundancy of the system: for there are no links in and any failure splits the tree, while for any of the links of can be used to recompose the system.

Notice that in our case it would be more correct to speak about resilience, since we don't consider whether the system is robust to failures (i.e. whether it still functioning after failures), but if it can recover from failures.