Interdiction of a Mixed-Integer Linear System

Transcription

1 Interdiction of a Mixed-Integer Linear System Bowen Hua, Ross Badick Department of Eectrica and Computer Engineering, University of Texas at Austin, Austin, TX bhua@utexas.edu, badick@ece.utexas.edu R. Kevin Wood Operations Research Department, Nava Postgraduate Schoo, Monterey, Caifornia 93943, kwood@nps.edu A system-interdiction probem can be modeed as a bieve program in which the upper eve modes interdiction decisions and the ower eve modes system operation. This paper studies MILSIP, a mixed-integer inear system interdiction probem, which assumes binary interdiction decisions and modes system operations through a mixed-integer inear program. To sove arge-scae instances of MILSIP, we appy Benders decomposition to a singe-eve reformuation of MILSIP. We identify significant inear programming subprobems whose feasibiity impies the optimaity of MILSIP. We propose an agorithm that that soves in each iteration: a reaxed master probem, a ower-eve probem, and a significant subprobem. We demonstrate the agorithm s computationa capabiities on a natura gas transmission system with 32 interdictabe components. Numerica tests show that our agorithm soves certain probem instances an order of magnitude faster than an aternative agorithm from the iterature. Subject cassifications: government: defense; miitary: targeting; programming: integer, noninear. Area of review: Miitary and Homeand Security. 1. Introduction A system-interdiction probem is a bieve optimization probem in which a eader and a foower act sequentiay. Interdiction, carried out by the eader (the attacker ), damages or destroys system components to disrupt the system s functionaity. We consider a binary mode of interdiction, that is, a non-interdicted component functions normay and an interdicted component oses its functionaity entirey. The foower (the defender or system operator ) then operates the damaged system by minimizing a system disutiity function. The eader anticipates the rationa response of the foower, 1

2 2 00(0), pp , 0000 INFORMS and chooses a resource-imited interdiction pan that maximizes the foower s minimum achievabe disutiity function vaue. Foowing the convention in the interdiction iterature (Brown et a. 2006), we assume that both the eader and the foower have perfect information. Such a bieve interdiction mode can be viewed as a type of Stackeberg game (von Stackeberg 2011, Chapter 4), specificay, a two-person, two-stage, zero-sum sequentia game. Wood (2011) provides a comprehensive review of bieve interdiction modes. This paper investigates the mixed-integer inear system interdiction probem (MILSIP), a systeminterdiction probem in which a mixed-integer inear program (MILP) defines the system operator s probem. Integer variabes in the ower eve are necessitated by discrete operationa decisions of the foower, for exampe, transmission-ine switching that changes the network topoogy of an eectric power system (Degadio et a. 2010, Zhao and Zeng 2013), or repacement of disabed system components from a spare-parts inventory (Sameron and Wood 2015). Nonconvexity of the operator s mode can aso give rise to a ower-eve integer program. For exampe, a noninear and nonconvex fow-pressure reationship determines the fow in a natura gas pipeine (Osiadacz 1987, pp ). A piecewise inear approximation of the noninear reationship makes the ower-eve probem an MILP (De Wof and Smeers 2000). In fact, this is the mode we study in Section 4. Simper versions of our probem with convex operator s probems have been studied extensivey. Network interdiction probems in which the system under study can be represented by a network-fow mode have received much attention (McMasters and Mustin 1970, Wood 1993, Washburn and Wood 1995). The bieve interdiction mode has aso been appied to systems whose operator s mode can be represented by a more genera inear program (LP). For instance, (a) Sameron et a. (2004a) anayze interdiction of an eectric power system using a inearized power-fow mode to represent system operations (see Wood and Woenberg 2012, pp ); (b) Lim and Smith (2007) consider a muticommodity fow network; and (c) Brown et a. (2006) discuss a number of appications to infrastructure protection. Whie much of the interdiction iterature assumes a convex operator s probem, Sameron et a. (2009) propose a method caed goba Benders decomposition that can sove more genera interdiction probems. Sameron and Wood (2015) appy this method to a power system whose optima

3 00(0), pp , 0000 INFORMS 3 operation is modeed as an MILP. This method invoves a probem-specific task: a penaty vector for the upper-eve discrete variabes must be determined. Athough in some practica cases a penaty vector can be found using the structure of the ower-eve probem, it is difficut in genera to define vaid penaty vectors. 1 We can aso view MILSIP as a bieve program where an embedded ower-eve probem appears in the constraints of an upper-eve program. Many researchers have investigated bieve programs; for exampe, see the reviews of Wen and Hsu (1991), Vicente and Caamai (1994), Dempe (2003), and Coson et a. (2007). If the ower-eve probem were convex, one coud repace this probem by its Karush-Kuhn-Tucker (KKT) conditions to obtain an equivaent singe-eve optimization probem under certain reguarity conditions (Fortuny-Amat and McCar 1981, Dempe and Franke 2016). This reformuation technique has been appied successfuy to interdiction probems with a convex operator s probem (Sameron et a. 2004b, Arroyo and Gaiana 2005, Arroyo 2010). However, standard reformuation techniques that depend on the convexity of the ower-eve probem do not appy to MILSIP because of the ower-eve integer variabes. MILSIP beongs to a specia case of bieve programs, mixed-integer bieve program (MIBP). A few soution methods have been proposed for MIBP. Moore and Bard (1990) and Xu and Wang (2014) consider branch-and-bound agorithms. These agorithms use the high-point probem (Moore and Bard 1990) as the reaxation of MIBP. As Wood (2011) points out, however, reaxations based on the high-point probem are weak for an interdiction probem with its directy conficting objective functions. Gümüş and Foudas (2005) reformuate the mixed-integer inner probem as continuous via its convex-hu representation (Sherai and Adams 1990). However, finding gobay optima soutions to the resuting noninear bieve programming probem remains chaenging. DeNegre (2011) presents a singe-eve reformuation of MIBP using a ower-eve vaue function defined through a parametrization of the ower-eve MILP by the upper-eve variabes. Exact characterization of this vaue function of a ower-eve MILP is difficut in genera, so DeNegre proposes two heuristic methods. Saharidis and Ierapetritou (2008) appy Benders decomposition (Benders 1962) to a type of

4 4 00(0), pp , 0000 INFORMS inear MIBP where a integer variabes are controed by the eader. The subprobem in the proposed method is a nonconvex bieve inear program, which may resut in invaid Benders cuts. Mitsos (2009) investigates noninear MIBPs but assumes the ower-eve equaity constraints to be independent of the upper-eve variabes. More recenty, severa branch-and-cut approaches have been proposed for genera inear MIBPs. These approaches strengthen the high point reaxation by introducing cuts that eiminate bieve-infeasibe soutions, e.g., intersection cuts (Fischetti et a. 2018, 2017), mutiway disjunction cuts (Wang and Xu 2017), and vaue-function-based disjunction cuts (Lozano and Smith 2017). However, they a assume integer coefficients in the ower-eve constraints. In the presence of fractiona coefficients, the bieve-infeasibe incumbent soution may ie right on the hyperpane defined by the cuts, resuting in ineffective cuts. These methods are restrictive because most practica infrastructure systems are described by fractiona parameters. Zeng and An (2014) propose a coumn-and-constraint generation (CCG) agorithm that does not assume integra coefficients, which is appied to an interdiction probem in Zhao and Zeng (2013) and two-stage robust optimization probems in Zeng and Zhao (2013). We wi investigate CCG as an aternative method for soving MILSIP, but we note one feature that may impose a computationa burden: CCG s reaxed master probem not ony adds constraints in each major iteration, but aso adds variabes. The discussion above indicates that MILSIP remain chaenging to sove, especiay in the presence of a arge-scae foower s probem with fractiona coefficients. This paper appies generaized Benders decomposition to a singe-eve reformuation of MILSIP, which decomposes MILSIP into a master probem and an exponentia number of feasibiity subprobems. Most importanty, we identify significant inear programming subprobems whose feasibiity impies the optimaity of MILSIP. We propose an agorithm that iterativey soves a reaxed master probem, a ower-eve probem, and a singe significant subprobem. Our method provides upper and ower bounds on the optima objective function vaue, and is finitey convergent. The remainder of this paper is structured as foows. Section 2 formuates MILSIP, and Section 3 presents the identification of the significant subprobems and our new decomposition agorithm.

5 00(0), pp , 0000 INFORMS 5 Section 4 describes the appication of the proposed method to a natura gas transmission system, and Section 5 presents concusions. Appendix A presents a sma numerica exampe of the decomposition agorithm which the reader may wish to consut after reading Section 3. Appendix B presents the mathematica and agorithmic detais that are required to appy the agorithm to the computationa exampe of Section Mixed Integer Linear System Interdiction Probem This section formuates MILSIP and anayzes its structure Mathematica Formuation We first define the operator s probem. This probem has decision variabes (x, y), where x X Z nx and y R ny +. We assume that the cardinaity of X, denoted X, is finite. We beieve this is a mid assumption since integer variabes are usuay bounded in rea-word probems (Geoffrion 1974). For ater use, we define V as the index set for X, impying that X = {x v : v V} and that V = X. Without oss of generaity, we use a minimization formuation, in which a disutiity function for system operations defines the objective. When no interdiction takes pace, the operator s probem is min x X,y R ny + where c R nx, d R ny, C R ng nx, D R ng ny, and g R ng. {c x + d y : Cx + Dy g}, (1) Now, using binary interdiction variabes z {0, 1} nz, we consider the effect of interdiction. Letting i index interdictabe system components, we et z i = 1 if component i is interdicted, and et z i = 0 otherwise. The vector z in the aggregate defines an interdiction pan. Parametrizing C, D, and g by the interdiction pan z, {x X, y R ny + : C(z)x + D(z)y g(z)}, (2) defines the post-interdiction feasibe region for the system operator. Linear functions C( ) : R nz R ng nx, D( ) : R nz R ng ny, and g( ) : R nz R ng define the parametrization. The base-case vaues are C(0) = C, D(0) = D, and g(0) = g.

6 6 00(0), pp , 0000 INFORMS A inear matrix-vaued function represents the parametrization of each coefficient matrix. Taking C(z) as an exampe, and in the most genera case, the i, j-th entry of C(z) is a inear function C ij (z) = u ijz +C ij (0), where u ij R nz. 2 The function g(z) = g Bz represents the parametrization of vector g, where B R ng nz ; we repace g(z) with g Bz from here on. Given an interdiction pan ẑ, the operator s probem is OpMIP(ẑ): min x X,y R ny + {c x + d y : Bẑ + C(ẑ)x + D(ẑ)y g}. (3) OpMIP(ẑ) aows biinear terms in z and (x, y). The biinear terms account for the consequence of interdiction in a compact fashion. 3 As the fina step in deveoping MILSIP, we mode a eader who makes resource-constrained binary interdiction decisions to maximize the system operator s minimum disutiity. Let Az b denote inear constraints on interdiction pans (e.g., resource imits, ogica constraints), where A R n b nz and b R n b. In the bieve interdiction mode, the upper-eve variabes z represent the eader s decisions, and the ower-eve probem is OpMIP(z). We formuate the bieve interdiction mode as MILSIP: max z Z min x X,y R ny + c x + d y, (4) s.t. Bz + C(z)x + D(z)y g, (5) where Z = {z {0, 1} nz : Az b} (6) Note that constraints (5) appy ony to the inner minimization Properties of MILSIP MILSIP can be viewed as a specia case of a mixed-integer bieve program (MIBP). Soving a genera MIBP can be difficut, because of issues ike the inner probem being unbounded or infeasibe for certain z Z. In addition, the eader may not achieve the optimum (Moore and Bard 1990). These difficuties do not concern us, however, because of the foowing assumption:

7 00(0), pp , 0000 INFORMS 7 Assumption 1. For any z Z, OpMIP(z) has a finite optima soution. This assumption is reasonabe for our gas transmission system mode considered in Section 4 as we as most practica operator s probems because (a) the operator seeks to minimize the sum of operating costs pus the sum of economic penaties for unserved demand, so a feasibe soution aways has a non-negative cost, and (b) even the most severe attack resuts in a feasibe response by the system operator, because the operator aways has the option of curtaiing a demand. Another notabe impication of the structure of MILSIP is that when we fix an interdiction pan z, the probem becomes a singe-eve MILP. This suggests that we might view z as compicating variabes and try to appy Benders decomposition. However, the optima objective function vaue of OpMIP(z) is neither convex nor concave in z (Bair and Jerosow 1977), so Benders decomposition does not appy directy. 3. A Decomposition Agorithm This section proposes a decomposition agorithm to sove arge-scae instances of MILSIP. We begin by adopting a singe-eve reformuation from the iterature. Then, we appy Benders decomposition to the reformuated probem, which decomposes MILSIP into a master probem and an exponentia number of convex subprobems. Among the exponentiay many subprobems, we identify significant subprobems whose feasibiity impies the optimaity of MILSIP. Finay, we deveop an agorithm that soves in each iteration a reaxed master probem, a ower-eve probem, and ony one significant subprobem Singe-Leve Reformuation As in standard Benders decomposition, we introduce a new variabe η R and reformuate MILSIP into this equivaent form: EF1: max z Z,η R η, (7) s.t. η min x X,y R ny + {c x + d y : Bz + C(z)x + D(z)y g}. (8)

8 8 00(0), pp , 0000 INFORMS We then enumerate the integer vectors x X. Using the index set V defined for X, EF1 is equivaent to the foowing (see Aderson et a and Zeng and An 2014): EF2: max z Z,η R η, (9) s.t. η c x v + min y v R ny + {d y v : Bz + C(z)x v + D(z)y v g}, v V. (10) For a given v V, the minimization probem on the right hand side of (10) becomes an LP after fixing the interdiction pan to ẑ: min y v R ny + {d y v : Bẑ + C(ẑ)x v + D(ẑ)y v g}. (11) Assumption 1 impies that LP (11) is never unbounded beow for any v V. Given a specific ẑ, LP (11) may have a finite optima soution or it may be infeasibe. We consider these two cases. First, if LP (11) is feasibe, we can repace it by its dua: max µ v R ng + {µ v(bẑ + C(ẑ)x v g) : D(ẑ) µ v + d 0}, (12) where µ v denotes the dua vector associated with the constraints in (11). Appying this repacement to constraints (10) yieds the foowing set of constraints: η c x v + max µ v R ng + {µ v(bz + C(z)x v g) : D(z) µ v + d 0}, v V. (13) Second, when LP (11) is infeasibe for some ẑ Z and ˆv V, the dua LP (12) can be either unbounded or infeasibe. In the unbounded case, we can sti repace LP (11) by its dua. This is because we can view the right-hand-side vaue of constraint (10) and that of constraint (10) as +. In this case, this constraint is redundant for interdiction pan ẑ, because xˆv cannot correspond to an optima decision for the system operator. When the dua LP (12) is infeasibe, we can no onger make the repacement. We prove that the dua LP (12) can ony be unbounded under Assumption 1. Therefore, we can obtain an equivaent formuation of EF2 by repacing constraints (10) with (13).

9 00(0), pp , 0000 INFORMS 9 Theorem 1. Under Assumption 1, if the prima LP (11) is infeasibe for a given ẑ Z and ˆv V, then the corresponding dua LP (12) can ony be unbounded. Proof. For the given ẑ, Assumption 1 impies that there exists a v V for which the prima LP (11) has an optima soution. By strong duaity, the dua LP (12) is aso feasibe with a finite maximum when for the same v. This impies that the inear system {µ : D(ẑ) µ + d 0} is feasibe, because the feasibe region is independent from the choice of v. Therefore, the dua LP (12) for the given ẑ and ˆv can ony be unbounded above. Consider the foowing singe-eve probem, EF3: max η, (14) z Z, η R, µ ng v R+ s.t. η c x v + µ v(bz + C(z)x v g), v V, (15) D(z) µ v + d 0, v V. (16) Theorem 2. An interdiction pan z is optima for MILSIP if and ony if there exist η R and µ v R ng + for a v V, such that (η, z, µ 1,..., µ V ) is optima for EF3. Proof. We first show the equivaence of EF2 and EF3. Given v V, (η, z) satisfies constraint (13) if and ony if there exists µ v R ng +, such that η c x v + µ v(bz + C(z)x v g) and D(z) µ v + d 0. Therefore, for the same v, the set of vaues for (η, z) that satisfies (13) is identica to the set of vaues for (η, z) that satisfies constraints (15) and (16). Foowing the strong duaity between (11) and (12), the projection of the feasibe region defined by constraints (15) and (16) onto the (η, z)-space is identica to the set of vaues for (η, z) that satisfies (10). Since EF2 and EF3 share the same objective function, and since they define the same feasibe region for (η, z), (η, z ) is an optima soution to EF2 if and ony if there exists µ v R ng + for a v V, such that (η, z, µ 1,..., µ V ) is optima for EF3. Because of the equivaence of MILSIP and EF2, the theorem foows.

10 10 00(0), pp , 0000 INFORMS 3.2. Benders Decomposition and Significant Subprobems Both the number of decision variabes and the number of constraints in EF3 are exponentia in n x. The coumn-and-constraint generation (CCG) agorithm deveoped by Zeng and An (2014), when appied to MILSIP, woud sove a reaxed version of EF3 that incudes ony a subset of constraints (15) and (16). Both the number of variabes and the number of constraints in the reaxed probem grow ineary with the iteration count. Unike the genera-purpose approach of Zeng and An (2014), we expoit the structure of MILSIP, and propose a decomposition agorithm that iterativey soves three optimization probems with a fixed number of variabes. Note that EF3 ends itsef to generaized Benders decomposition; the existence of biinear terms in z and µ requires the generaized approach. See Geoffrion (1972) and Foudas (1995) for a detaied description of generaized Benders decomposition. If we fix ˆη and the interdiction pan ẑ, EF3 separates into V feasibiity subprobems, each differing in the vaue of x v. The feasibiity probem for each v V is the foowing LP FP v (ˆη, ẑ): find µ v R ng +, (17) s.t. ˆη c x v + µ v(bẑ + C(ẑ)x v g), : ϕ Eta v (18) D(ẑ) µ v + d 0, : ϕ D v (19) where dua variabes ϕ Eta v R + and ϕ D v R ny + are dispayed to the right of their corresponding constraints. A naive impementation of Benders invove soving the exponentiay many subprobems. However, the exponentiay many subprobems are not of equa importance. Given ẑ Z, by soving OpMIP(ẑ) to ϵ-optimaity, we can identify a subprobem whose feasibiity impies the optimaity of MILSIP. Suppose we obtain an ϵ-optima soution to OpMIP(ẑ), where ϵ 0. We identify a ϵ-significant feasibiity subprobem based on this soution.

11 00(0), pp , 0000 INFORMS 11 Definition 1. Given ẑ Z, ˆη η, and ϵ 0, FP v (ˆη, ẑ) is ϵ-significant if there exists y R ny + such that (x v, y ) is an ϵ-optima soution to OpMIP(ẑ). An ϵ-significant feasibiity probem has the foowing property: Theorem 3. Given ẑ Z, ˆη η, and ϵ 0, if the ϵ-significant feasibiity probem FP v (ˆη, ẑ) is feasibe, then ẑ is an ϵ-optima soution to MILSIP. Proof. Because FP v (ˆη, ẑ) is ϵ-significant, there exists y R ny + such that (x v, y ) is an ϵ- optima soution to OpMIP(ẑ). Let η ϵ be the objective function vaue of OpMIP(ẑ) evauated at (x v, y ). Since ẑ is a feasibe interdiction pan, η η ˆη, where η is the optima objective vaue of OpMIP(ẑ). By ϵ-optimaity of (x v, y ), we have η ϵ η + ϵ. The optima objective vaue of the prima LP (11) with v = v is aso η ϵ. By strong duaity, the optima objective vaue of the dua LP (12) with v = v is aso η ϵ. Therefore, FP v (ˆη, ẑ) is feasibe ony if ˆη η ϵ. It foows that η η ˆη η ϵ η + ϵ, and that ẑ is an ϵ-optima soution to MILSIP. Theorem 3 has an important agorithmic impication: a Benders feasibiity cut generated from an ϵ-significant feasibiity probem aways cuts off a candidate soution (ˆη, ẑ) if ẑ is not an ϵ-optima interdiction pan. Therefore, compared to an arbitrariy chosen feasibiity probem, an ϵ-significant feasibiity probem can be of more hep for convergence. In practice, obtaining an optima (ϵ = 0) soution might take an exorbitant amount of time because of the NP-hardness of OpMIP(ẑ). We usuay terminate upon finding an ϵ-optima soution with ϵ > 0. Instead of soving a subprobems, we propose an agorithm in which we ony sove an operator s probem to identify an ϵ-significant feasibiity probem, and in which we sove this one feasibiity probem at each iteration and generate a Benders cut. However, the biinear terms in ẑ and µ v in FP v (ˆη, ẑ) make it difficut to define a Benders cut expicity.

12 12 00(0), pp , 0000 INFORMS 3.3. Benders Feasibiity Cuts Once an ϵ-significant subprobem FP v (ˆη, ẑ) is soved, we can generate a Benders feasibiity cut using dua information from that soution. Let ϕ v = (ϕ Eta v, ϕ D v ) Φ v denote the dua vector for FP v (ˆη, ẑ). The Lagrangian function for FP v (ˆη, ẑ) is L v (ˆη, ẑ, µ v, ϕ v ) = ϕ Eta v [ˆη c x v µ v(bẑ + C(ẑ)x v g)] (ϕ D v ) [D(ẑ) µ v + d]. (20) Suppose we sove FP v (ˆη, ẑ) and obtain an optima dua vector ϕ v. A Benders feasibiity cut can be formuated as foows (Geoffrion 1972): 0 min µ v R ng + L v (η, z, µ v, ϕ v). (21) Constraint (21) has an inner optimization probem with respect to µ v that is parametric in (η, z). The Lagrangian we are minimizing has biinear terms in z and µ v. In the presence of such biinear terms, expicit optima objective vaues cannot be determined in genera (Foudas 1995). If we inearize the biinear terms with the big-m method, the feasibe region for µ v wi remain unchanged. Moreover, (η, z) and µ v are now ineary separabe. In this case, a Benders cut can be found expicity as an inequaity constraint inear in η and z (Geoffrion 1972, Foudas 1995), and the master probem is an MILP. It is vita for the tightness and computationa precision of the master probem to define the smaest vaid big-m vaues possibe. The choice of such big-m vaues is probem-specific (see Appendix B for an exampe). Let L v (η, z, µ v, ϕ v ) denote the Lagrangian of the inearized feasibiity probem (LFP). With a sight abuse of notation, we aso use µ v and ϕ v to denote the prima and dua variabes, respectivey, for the inearized probem. Suppose we sove LFP v (ˆη, ẑ) and obtain an optima prima vector µ v and an optima dua vector ϕ v. The Benders feasibiity cut can be expressed as 0 L v (η, z, µ v, ϕ v). (22)

13 00(0), pp , 0000 INFORMS Agorithm We propose an agorithm in which three probems are soved iterativey: (i) a reaxed master probem (RMP), (ii) an operator s probem, and (iii) a ϵ-significant inearized feasibiity probem. A Bieve Benders Decomposition Agorithm for MILSIP (BLBD). Input: An instance of MILSIP, absoute convergence toerance for OpMIP ϵ 0, absoute convergence toerance for MILSIP ϵ ϵ, an upper bound on the objective function vaue (e.g., argest possibe disutiity of the system) η. Output: An ϵ-optima interdiction pan and associated objective vaue. Step 0: η 0 η; η best ; z best 0; k 0. Step 1: k k + 1; Sove the current RMP: max z Z,η R η, s.t. η η k 1, L v j(η, z, µ j v j, ϕ j v j ) 0, j = 1,..., k 1 for (η k, z k ). Step 2: Sove OpMIP(z k ) for ϵ-optima soution (x v k, y k ) with objective vaue η k ; If η k > η best, then η best η k and z best z k ; If η k η best ϵ, then go to Step 4. Step 3: Sove LFP v k(η k, z k ) for (µ k, ϕ k ); v k v k Add a Benders feasibiity cut L v k(η, z, µ k, ϕ k ) 0 to RMP; Go to Step 1. v k v k Step 4: Print The soution is z best, with objective vaue η best ; Print Provabe optimaity gap is η k η best ; Stop.

14 14 00(0), pp , 0000 INFORMS Logica constraints can be added optionay to RMP. A type of ogica constraint, a soutioneimination constraint (SEC), ( ) z i z i z k i 1 0 (23) i:z i k=1 i:z i k=0 i excudes a singe interdiction pan z k from the eader s feasibiity set to prevent repeating suboptima interdiction pans (Brown et a. 2009, Aderson et a. 2011). Since ϵ ϵ, Theorem 3 impies that a Benders cut in BLBD aways cuts off the current soution to RMP, but this Benders cut does not necessariy dominate an SEC. BLBD converges in a finite number of iterations when SECs are present, since the set Z I is finite. Without SECs, given the convexity of the subprobems, Assumption 1, and the finiteness of set X, Theorem 2.5 in Geoffrion (1972) impies finite convergence for any ϵ > Appication to a Natura Gas Transmission System Interdiction Probem To demonstrate the capabiities of BLBD, this section formuates and soves an interdiction mode for a natura gas transmission system Operator s Mode We consider an operator of a natura gas transmission system who wishes to satisfy demand at a set of ocations, each with a guaranteed pressure. The components of the system are natura gas sources, pipeines, and compressor stations. The performance of the system is measured by tota suppy cost pus economic osses resuting from unmet demand. We mode the gas transmission system as a directed graph G = (N, L C) where nodes N represent junctions, suppy points and demand points, arcs L represent pipeines, and arcs C represent compressor stations. For any arc L C, et o() and d() denote that arc s origin node and destination node, respectivey. Our formuation is based on the steady-state gas transmission system mode described by De Wof and Smeers (2000), with modifications to incorporate the effects of interdiction. Indices and sets:

15 00(0), pp , 0000 INFORMS 15 n N L c C nodes of the gas transmission system; natura gas pipeines; compressor stations; m M gas sources; Parameters: h m cost of gas suppy at source m [$/10 6 scm (standard cubic meter)]; q n γ vaue of unserved demand at node n [$/10 6 scm]; pipeine constant; r c maximum compression ratio for station c; A Pipe entry A Pipe n equas 1 if o() = n, 1 if d() = n, and 0 otherwise; A Comp entry A Comp n equas 1 if o() = n, 1 if d() = n, and 0 otherwise; K s m p n p n d n entry K nm equas 1 if gas source m is ocated at node n, and 0 otherwise; maximum gas suppy at source m [10 6 scm/day]; maximum pressure at node n [bar]; minimum pressure at node n [bar]; gas demand at node n [10 6 scm/day]. Decision variabes: f Pipe gas fow through pipeine [10 6 scm/day]; f Comp c d n s m p n gas fow through compressor station c [10 6 scm/day]; served demand at node n [10 6 scm/day]; gas output from source m [10 6 scm/day]; pressure at node n [bar]. Formuation: min h s + q (d d) (24) f Pipe,f Comp,d,s,p s.t. f Pipe f Pipe = γ (p 2 o() p 2 d()), L, (25) r c p o(c) p d(c) p o(c), c C, (26)

16 16 00(0), pp , 0000 INFORMS ] [A Pipe A Comp f Pipe f Comp = Ks d, (27) d d, (28) p p p, (29) s s, (30) f Pipe R L, f Comp R C, d R N +, (31) s R M +, p R N. (32) The objective function (24) sums suppy costs and economic osses resuting from unserved demand over a day. For simpicity, this formuation ignores the gas consumed by gas-powered compressor stations. Typicay, this consumption amounts to ess than 2% of the tota gas suppy entering the system (Martin et a. 2005), and we wi see that this is negigibe in the context of interdiction. Constraints (25) characterize fows in natura gas pipeines. Constant γ is defined through a function of the ength, the diameter and the roughness of the pipeine, aong with the composition of the gas being transported; see Osiadacz (1987, pp ) for more detais. Constraints (26) imit the pressure increase that each compressor station can provide. Constraints (27) represent conservation of fow. Constraints (28) ensure that no served oad exceeds what is demanded. Constraints (29) imit pressure at each node. Constraints (30) imit output from each gas source. Brown et a. (2006) present a bieve mode to anayze the interdiction of a crude-oi pipeine network, but their (pure) network-fow operator s mode cannot account for the range of gas pressures guaranteed to power pants, industria users, and oca distribution companies. Indeed, without fowpressure reationship (25) and aied constructs, a network-fow mode does not competey describe the physics of a gas pipeine network and, as we sha see in computationa tests, a suboptima interdiction pan may resut. We can aso more accuratey mode attacks on compressor stations, which Steinhäuser et a. (2008) identify as security risks.

17 00(0), pp , 0000 INFORMS Piecewise Linearization Constraints (25) make the operator s probem nonconvex. To tacke this nonconvexity, we construct a piecewise inear approximation for each noninear fow-pressure reationship. The resuting operator s probem is an MILP. We first define π n = p 2 n for a n N. Accordingy, π n = p 2 n and π n = p 2. We aso define parameter n τ = max(π o() π d(), π d() π o() ), which denotes the maximum possibe deviation of squared pressure across pipeine. Then, we discretize the functions f Pipe f Pipe using breakpoints ( ˆf i, ˆf i ˆf i ), indexed by i I. Finay, we cast each piecewise inear approximation into the form of a SOS2 constraint (a constraint that incorporate specia ordered sets of Type 2; see Beae and Forrest 1976 for detais). Denoting the SOS2 variabe at breakpoint i for pipeine by α i, the foowing inear constraints approximate constraints (25): 1 α = 1, L, (33) SOS2{α,1,..., α, I }, L, (34) f Pipe = α ˆf, L, (35) α ( ˆf ˆf ) = γ (π o() π d() ), L, (36) where (a) the operator denotes the entrywise product, and where (b) SOS2 constraints (34) aow at most two of the variabes α i to be nonzero for a given and, if two are nonzero, those nonzeros must be consecutive in the ordering i = 1,..., I Interdiction Mode Our mode concerns itsef with interdiction on gas sources, pipeines, and compressor stations, and thus z = (z Pipe, z Src, z Comp ). We assume that the eader is subject to a cardinaity constraint L zpipe + c C zcomp c + m M zsrc m for some Z +. For modeing purposes, we assume that no suppy is avaiabe from an interdicted gas source, and no fow is possibe on an interdicted pipeine. The modeing assumptions regarding compressor stations are more compicated, however.

18 18 00(0), pp , 0000 INFORMS In most gas transmission systems, a compressor station is suppemented with a bypass pipeine (Hier et a. 2016). Depending on whether the bypass pipeine is destroyed, two types of compressorstation interdictions might occur. A minor interdiction woud destroy ony the compressors, but not the bypass pipeine. In this case, we woud have π o(c) = π d(c). On the other hand, a major interdiction woud destroy both the compressor station and the bypass pipeine, competey breaking the connection between o(c) and d(c). For simpicity, we mode ony a minor interdiction of each compressor station because (a) our rea-word test probem (see Fig. 1 beow) ony has two compressor stations, (b) a major interdiction of compressor station (21, 9) can be accompished, in effect and with the same resource consumption, by interdicting two adjacent pipeines, and (c) a rationa attacker woud never interdict compressor station (22, 18), because interdicting one of its adjacent pipeines achieves the effect of a major interdiction and ony requires one unit of resource. The formuation of MILSIP for a gas transmission system is shown beow: max min z Z f Pipe, f Comp, d, s, π, α h s + q (d d) (37) s.t. (27), (28), (33), (34), where f Pipe = α ˆf (1 z Pipe ), L, (38) α ( ˆf ˆf ) γ (π o() π d() ) γ τ z Pipe, L, (39) α ( ˆf ˆf ) γ (π o() π d() ) + γ τ z Pipe, L, (40) π o(c) π d(c), c C, (41) π d(c) π o(c) + (r 2 c 1)π o(c) (1 z Comp c ), c C, (42) π π π, (43) s s (1 z Src ), (44) z {0, 1} L + C + M, f Pipe R L, f Comp R C, d R N +, (45) s R M +, π R N, α R I +, L, (46) Z = {z {0, 1} L + C + M : 1 z }. (47)

19 00(0), pp , 0000 INFORMS 19 We iustrate the new constraints. Constraints (38) buid on constraints (35) and force fow to zero on interdicted pipeines. Constraints (39) and (40) buid on constraints (36) and remove the fowpressure requirement for any interdicted pipeine. Constraints (41) and (42) buid on constraints (26). They force π o(c) = π d(c) when a minor compressor-station interdiction takes pace. After the transformation π n = p 2 n, constraints (29) become constraints (43). Constraints (44) buid on constraints (30) and disabe suppy from interdicted sources. Our interdiction mode evauates the steady-state worst-case disutiity of the system after the surviva of initia transients. We assume that (a) demand can be curtaied in a continuous fashion, and that (b) the operator s probem remains feasibe in any configuration created by interdiction soey by reducing suppy in a continuous fashion at appropriate demand nodes. Extensive testing has shown no vioations of the second assumption. An artifice of our mode is that a connected part of the system with no gas suppy and thus no gas fow can exhibit arbitrary pressures within the imits of constraints (43). This artifice is caused by a ack of pressure reference, and does not affect the interdictor s preference since the disutiity function does not invove pressure Resuts We consider the Begian gas network described by De Wof and Smeers (2000), modeed in a steady state. The gas transmission system comprises 22 nodes, 24 pipeines, 6 sources (a storage faciity is modeed as a natura gas source with specified maximum daiy output), and 2 compressor stations, as shown in Figure 1. Since no reevant data can be found for estimating the vaue of unserved gas demand in the Begian network, we set the vaue of unserved demand at $1/scm, a number roughy 11 times higher than the highest suppy price. In each piecewise inearization of a gas fow equation, we set the number of breakpoints at 31 for each pipeine. The breakpoints are distributed uniformy between the negative and positive fow imits. (See Martin et a for a discussion on choosing the number of breakpoints.) As a resut, the upper eve of the interdiction mode has 32 binary variabes and the ower eve has 720 binary variabes.

20 20 00(0), pp , 0000 INFORMS C C Figure 1 A Begian gas transmission system. This figure is based on data and a schematic diagram in De Wof and Smeers (2000). An arrow connecting two nodes denotes a pipeine or a compressor station; the annotation C then identifies each compressor station. A hoow-headed inward-pointing arrow denotes a source and hoow-headed outward-pointing arrow indicates a demand. Note aso that each directed pipeine and compressor arc indicates the direction of positive fow, but fow in the opposite direction is aowed. We note that as increases, the number of feasibe interdiction pans grows exponentiay. It is impractica to sove this probem by tota enumeration. Therefore, we sove this interdiction mode by BLBD. An appendix describes reformuation and decomposition of the interdiction mode, Benders feasibiity cuts, and the specification of big-m coefficients. We carry out tests on a persona computer with a 2.4 GHz dua-core CPU and 8 GB of RAM. We impement the agorithms in MATLAB, and sove the optimization probems with GUROBI 6.0 (Gurobi Optimization Inc. 2015). We set ϵ = ϵ = 10 for detaied testing, but ater do provide summary resuts for a coarser convergence toerance. We optionay add SECs (23) to BLBD. (The simpe form of the interdiction-resource constraint (47) enabes the use of potentiay stronger SECs as in Brown et a. (2009). We find no computationa benefit in using the potentiay stronger SECs, however, and therefore use SECs (23) or no SECs at a.) For comparison, we sove the same mode with the CCG method (we use the strong-duaity-based reformuation, see Zeng and An 2014), with the same choice of big-m coefficients. We set an absoute convergence toerance of 10 for both the operator s probem and the reaxed master probem in CCG. Tabe 1 presents computationa resuts.

21 00(0), pp , 0000 INFORMS 21 Tabe 1 Resuts with varying cardinaity imits on interdiction Δ Disutiity Optima Interdiction Pan Number of Iterations CPU Time (sec.) BLBD ($ 10 7 BLBD /day) Pipeines Sources CCG CCG w/o SEC w/ SEC w/o SEC w/ SEC (14,15) (3,4) (3,4) 5, (3,4) 1, 2, (5,6) 1, 2, 8, (5,6) 1, 2, 8, 13, Figure 2 Upper and ower bounds on optima objective function vaue versus iteration using BLBD with = 3, ϵ = ϵ = 10, and no SECs. We iustrate a few of the optima interdiction pans. When = 1, pipeine (14,15) is optimay interdicted, because significant demand at nodes 15 and 16 is cut off from suppy. As increases, the optima pan interdicts more sources. A demand is interrupted for 6. An aternative optima soution for = 6, not shown in Tabe 1, simpy interdicts a six sources. We aso note that under a resource constraint on cardinaity, it is disadvantageous for the eader to interdict a compressor station in this particuar system. In fact, when both compressor stations ose their compressors to interdiction and are bypassed, and given that no other components are interdicted, the operator s mode shows a demand curtaiment of scm/day, ony 0.13% of tota demand.

22 22 00(0), pp , 0000 INFORMS MILSIP soves to near optimaity quicky under both BLBD and CCG. Figure 2 shows the convergence of upper and ower bounds using BLBD when = 3. Tabe 1 shows that, compared to BLBD, CCG converges in fewer iterations in a cases. However, when the number of iterations is arge, BLBD requires ess CPU time to converge, as can be seen from the cases with = 5 and = 6. To further demonstrate the computationa performance of BLBD, we consider a restricted interdiction mode that aows ony attacks on pipeines. Tabe 2 Resuts with varying cardinaity imits on pipeine-ony interdiction Δ Disutiity Optima Interdiction Pan Number of Iterations CPU Time (sec.) ($ 10 7 /day) Pipeines BLBD CCG BLBD CCG (14,15) (3,4), (9,10) (3,4), (9,10), (9,10) (3,4), (5,6), (8,21), (8,21) (2,3), (2,3), (5,6), (9,10), (9,10) (2,3), (2,3), (5,6), (9,10), (9,10), (14,15) (2,3), (2,3), (5,6), (9,10), (9,10), (12,13), (13,14) (2,3), (2,3), (5,6), (9,10), (9,10), (4,14), (12,13), (15,14) Tabe 2 shows an optima interdiction pan for each vaue of from one up to eight, at which point a demand goes unmet; we iustrate a few of these cases. When = 2, it is optima to attack both pipeine (3, 4) and one of the parae pipeines (9, 10), specificay, the one with the arger diameter. We note that for this vaue of Δ, an interdiction mode that empoys a (pure) network-fow mode for the gas pipeine system interdicts pipeines (3, 4) and (11, 12), which is suboptima by 4.5%. (If gas pressure constraints are ignored, the interdictor woud appear to gain nothing by interdicting ony one of the parae pipeines (9, 10), as seen in the optima soution.) When 3, mutipe optima soutions exist because interdicting both pipeines between nodes 9 and 10 has the same effect as interdicting both pipeines between nodes 8 and 21. We note that the restricted mode is computationay more difficut for both CCG and BLBD. SECs are omitted because they provide no computationa benefit for this probem. Athough BLBD

23 00(0), pp , 0000 INFORMS 23 requires more iterations to converge, BLBD is an order of magnitude faster than CCG when the tota iteration count becomes arge. Both the number of variabes and the number of constraints in CCG s reaxed master probem grows with the iteration count, and this makes its soution a botteneck for CCG. For exampe, when = 7, CCG s reaxed master probem has constraints and variabes in its ast iteration, and that probem requires seconds to sove. By contrast, ony the number of constraints increases by iteration in BLBD s RMP. RMP has 193 constraints and 33 variabes in its fina iteration and this master probem requires ony 0.59 seconds to sove. When compared with CCG, the computationa time per iteration for BLBD grows more sowy with iteration count. The detaied resuts above use tight absoute convergence toerances (ϵ = ϵ = 10) in order to demonstrate BLBD s capabiities. In practice, coarser convergence toerances might be appropriate for deveoping interdiction pans, so we describe aggregate resuts obtained using ϵ = ϵ = 10 4 ; for simpicity, we do not consider SECs. The resuts summarize as foows: (a) a interdiction-pan soutions are identica to those shown in Tabes 1 and 2; (b) soution times for the test cases from Tabe 1 do not change much for either methods; and (c) BLBD s average soution time for the test cases from Tabe 2 reduces from 76.0 seconds to 30.5 seconds, and from seconds to seconds for CCG. BLBD maintains a speed advantage over CCG, sometimes a substantia advantage, even when using coarser optimaity toerances. 5. Concusions This paper has investigated the mixed-integer inear system interdiction probem (MILSIP), a systeminterdiction probem in which the operator s probem is represented by a mixed-integer inear program. We deveop and demonstrate the BLBD (Bieve Benders Decomposition) agorithm that soves arge-scae instances of MILSIP with a pre-specified optimaity toerance. At each iteration, BLBD soves three optimization probems, each with a fixed number of decision variabes: a reaxed master probem that generates an interdiction pan, a post-interdiction operator s probem, and a subprobem whose feasibiity impies optimaity of MILSIP. Numerica tests show that BLBD soves instances

24 24 00(0), pp , 0000 INFORMS of an interdiction probem on a rea-word natura gas transmission system an order of magnitude faster than an aternative agorithm from the iterature. The proposed agorithmic framework can be further improved. Adding mutipe Benders feasibiity cuts during one iteration may be beneficia. Aso, specia-purpose cuts and fast heuristics that utiize the structure of the system (for exampe, the ones proposed in Sameron and Wood 2015) might be integrated to sove the master probem and the operator s probem more efficienty. We are aso exporing the appication of the proposed agorithm to a wider range of probems, incuding the defender-attacker-defender mode of Aderson et a. (2011).

25 00(0), pp , 0000 INFORMS 25 Appendix A: An Iustrative Exampe of BLBD Consider the foowing inear MIBP: Exampe 1. max z {0,1} 2 min x y, x {0,1},y R + s.t. 4x + y 2z 1 4, (48) 1.6x + y + z A the constraints in this exampe are inear. (Section 4 considers an interdiction probem having biinear terms in both upper- and ower-eve variabes.) The set of possibe vaues for ower-eve integer variabes is X = {ˆx 1, ˆx 2 }, where ˆx 1 = 0 and ˆx 2 = 1. EF3 for this exampe is max η R,z {0,1} 2,µ 1,µ 2 R 2 + η, s.t. η (4µ µ 12 1)ˆx 1 2µ 11 z 1 4µ 11 + µ 12 z 2 1.2µ 12, 1 µ 11 µ 12 0, (49) η (4µ µ 22 1)ˆx 2 2µ 21 z 1 4µ 21 + µ 22 z 2 1.2µ 22, 1 µ 21 µ EF3 decomposes into X = 2 feasibiity probems: for each v {1, 2}, find µ v R 2 +, s.t. η (4µ v1 1.6µ v2 1)ˆx v 2µ v1 z 1 4µ v1 + µ v2 z 2 1.2µ v2, (50) 1 µ v1 µ v2 0. To inearize the biinear terms in z and µ v, we define ξ v1 = µ v1 z 1 and ξ v2 = µ v2 z 2. Adding a singe sack variabe ρ Eta v for the first constraint ensures feasibiity; we minimize this sack variabe. Using a sufficienty

26 26 00(0), pp , 0000 INFORMS arge M > 0, LFP v (ˆη, ẑ) is min over s.t. ρ Eta v, µ v R 2 +, ξ v R 2 +, ρ Eta v R +, ˆη (4µ v1 1.6µ v2 1)ˆx v 2ξ v1 4µ v1 + ξ v2 1.2µ v2 + ρ Eta v, : ϕ Eta v 1 µ v1 µ v2 0, (51) ξ vi Mẑ i, i = 1, 2, : ϕ D1 vi ξ vi µ vi M(1 ẑ i ), i = 1, 2, : ϕ D2 vi ξ vi µ vi, i = 1, 2, for v {1, 2}. The constant M bounds both µ v1 and µ v2 from above for v {1, 2}. Soving (51) yieds the optima objective vaue L v and optima dua variabes ϕ = (ϕ Eta, v The resuting Benders feasibiity cut is 0 L v + ϕ Eta, v (η ˆη) + M 2 i=1, ϕ D1, v, ϕ D2, v ). [ (ϕ D2, vi ϕ D1, vi )(z i ẑ i ) ]. (52) We appy BLBD, without using SECs, to Exampe 1, etting ϵ = 0, η = 0, and M = 100. The constant M is chosen conservativey here for simpicity. Admittedy, big-m constants weaken the LP reaxation of RMP, since they appear in the coefficients of Benders feasibiity cuts. However, upper bounds on decision variabes appear in most agorithms for interdiction probems. Aso, in many rea-word interdiction probems, good upper bounds on µ v can be determined. (See Section 4 for an exampe, and note that for Exampe 1, we can determine by inspection that M = 1 is sufficienty arge.) At the first iteration, we sove RMP max z {0,1} 2,η R η, η 0. The maximizer z can be any vaue in {0, 1} 2, so, aong with η 1 = 0, suppose that the sover returns z 1 = (1, 1). Soving OpMIP((1, 1)) yieds x 1 = 1 and η 1 = η best = 2.8. We then sove the significant feasibiity probem FP 1 (0, (1, 1)), which generates this Benders cut: η + 180(z 1 1).

27 00(0), pp , 0000 INFORMS 27 Since η 1 η best = 2.8, we set k = 2, and sove the augmented RMP max z {0,1} 2,η R η, s.t η + 180(z 1 1), η 0, which again has mutipe optima soutions. Aong with η 2 = 0, suppose that the sover returns z 2 = (0, 1). We sove OpMIP((0, 1)) to obtain x 2 = 1 and η 2 = η best = 1, and then sove FP 1 (0, (0, 1)) to generate the foowing Benders cut: η. Since η 2 η best = 1, we set k = 3, and sove RMP max z {0,1} 2,η R η, s.t η + 180(z 1 1), η, η 0, which yieds η 3 = 1. We have η 3 = η best = 1, so z best = (0, 1) is an optima soution. Appendix B: Reformuation and Decomposition Procedures for A Gas Transmission System This appendix describes detaied reformuation and decomposition procedures for the gas transmission system interdiction probem (37) (46). We first formuate the ower-eve operator s probem OpMIP(ẑ). In creating the singe-eve reformuation for the bieve interdiction mode, one key step is to derive the dua of LP (11), the operator s probem with a its integer variabes fixed. We then formuate this dua LP and the feasibiity probems resuting from the decomposition. Finay, we specify a Benders feasibiity cut as a inear inequaity. See Section 4 for notation used here. B.1. The Operator s Probem For a given interdiction pan ẑ, OpMIP(ẑ) is: min h s + q (d d) (53) f Pipe,f Comp,d,s,π,α s.t. 1 α = 1, L : λ P1 (54) SOS2{α,1,..., α, I }, L (55)

28 28 00(0), pp , 0000 INFORMS f Pipe = α ˆf (1 ẑ Pipe ), L : λ P2 (56) α ( ˆf ˆf ) γ (π o() π d() ) γ τ z Pipe, L : µ P3 (57) α ( ˆf ˆf ) γ (π o() π d() ) + γ τ z Pipe, L : µ P4 (58) π o(c) π d(c), c C : µ C1 c (59) π d(c) π o(c) + (r 2 c 1)π o(c) (1 ẑ Comp c ), c C : µ C2 c (60) ] f [A Pipe Pipe A Comp = Ks d, : λ F (61) f Comp d d, : µ D (62) π π π, : µ L1, µ L2 (63) s s (1 ẑ Src ), : µ S (64) f Pipe R L, f Comp R C, d R N +, (65) s R M +, π R N, α R I +, L. (66) The dua variabes are introduced on the right side of their associated constraints. B.2. Dua Probem of the Operator s Restricted LP We obtain the operator s restricted LP by fixing the ower-eve integer variabes in OpMIP(ẑ). For the interdiction mode considered in Section 4, the ower-eve integer variabes are the binary variabes impicit in the SOS2 constraints (34). These constraints require that, for each pipeine, at most two α i can be nonzero, and that if two are nonzero they must be consecutive in the ordering i = 1,..., I. The impicit binary variabes determine which variabes α i are nonzero. Reca that in the piecewise inearization, the breakpoint i for pipeine is denoted by ( ˆf i, ˆf i ˆf i ). Without oss of generaity, a feasibe f Pipe in OpMIP(ẑ) is a convex combination of the ˆf i vaues at two active breakpoints. The impicit binary variabes choose which two consecutive breakpoints are active in the piecewise inearization. Therefore, once we fix the impicit binary variabes, we fix the active breakpoints. We refer to LP of the form of (11) as the Operator s Restricted LP. When deriving its dua, for ease of exposition, we coect the ˆf i vaues of the first active breakpoint for each pipeine into a vector ˆf I, and coect the ˆf i vaues of the second active breakpoint for each pipeine into vector ˆf II. Let n(m) denote the node where source m is ocated, and et matrix A Comp be identica to A Comp, except that every 1 entry in A Comp

29 00(0), pp , 0000 INFORMS 29 is repaced by 0. With impicit binary variabes fixed, the operator s restricted LP has the form of (11). The dua variabes for this LP are defined in (54) (66). Then, the dua of the Operator s Restricted LP, which has the form of (12), is: max L λ P1 m [ µ S ms m (1 ẑ Src m ) ] (µ P3 + µ P4 )γ τ z Pipe (67) + n ( µ D n d n + µ L1 n π n µ L2 n π n ) + q d, (68) over λ P1, λ P2 R L, µ P3, µ P4 R L +, µ C1, µ C2 R C +, (69) λ F R N, µ D, µ L1, µ L2 R N +, µ S R M + (70) s.t. λ P1 + λ P2 (ẑ Pipe 1) ˆf I + (µ P4 µ P3 ) ˆf I ˆf I 0, (71) λ P1 + λ P2 (ẑ Pipe 1) ˆf II + (µ P4 µ P3 ) ˆf II ˆf II 0, (72) µ L2 µ L1 + A Pipe ((µ P3 µ P4 ) γ) A Comp (µ C2 µ C1 ) (73) A Comp [ µ C2 (r r 1) (1 ẑ Comp ) ] = 0, (74) (A Pipe ) λ F + λ P2 = 0, (75) (A Comp ) λ F = 0, (76) λ F n(m) + µ S m + h m 0, m M (77) q + λ F + µ D 0. (78) B.3. Linearized Feasibiity Probem At each iteration, we sove an ϵ-significant LFP (see Section 3.2) to generate a Benders feasibiity cut of the form of (22). Reca that we inearize biinear terms in interdiction variabes and dua variabes. To this end, we define ξ P2 R L, ξ Pipe = λ P2 z Pipe, L, (79) and simiary ξ P3 R L +, ξ P3 ξ P4 R L +, ξ P4 ξ Comp R C +, ξ Comp ξ Src R M +, ξ Src c m = µ P3 z Pipe, L, (80) = µ P4 z Pipe, L, (81) = µ C2 c z Comp c, c C, (82) = µ S mz Src m, m M. (83)