Designing Cost-Effective Reliable Networks from a Risk Analysis Perspective: A Case Study for a Hospital Campus

Received July 3, 2019, accepted August 5, 2019, date of publication August 26, 2019, date of current version September 9, 2019. Digital Object Identifier 10.1109/ACCESS.2019.2937449 Designing Cost-Effective Reliable Networks From a Risk Analysis Perspective: A Case Study for a Hospital Campus ANTONIO ESTEPA , RAFAEL ESTEPA, GERMAN MADINABEITIA, AND JUAN VOZMEDIANO Department of Telematics Engineering, University of Seville, 41092 Seville, Spain Corresponding author: Antonio Estepa ([email protected]) ABSTRACT The unavailability of information and communication services due to network-related incidents may have a significant impact on large organizations. Network incidents can hence be viewed as a risk for organizations whose consequences are not accounted for by traditional network design problems. In this work, we address the problem of designing a reliable wired network from a risk analysis perspective. We propose a novel methodology for the quantitative assessment of the risk associated with network-related incidents in a hospital campus. We then define an optimization problem to find the topology that minimizes the network cost plus the expected loss over time attributable to the unavailability of corporate services to staff affected by network incidents. A case study illustrates our methodology and its benefits. Using available public information, we design the topology of a campus network for a large hospital where the cost of labor exceeds 200 Me/year. The solution to our optimization problem is found through well-known genetic algorithms and provides a topology where network nodes with a higher impact on productivity exhibit higher reliability. As a consequence, the topology obtained reduces more than 95% (+392 000e) the expected annual lost profits when compared to common reduced-cost topologies such as the minimum-cost ring or the non-reliable minimum-cost tree, showing that investment in risk reduction pays off. Our contribution may be used by engineers to (re)design cost-effective reliable networks or by hospital managers to support decisions on updating present infrastructure based on risk reduction. INDEX TERMS Network topology design, reliability, risk analysis. I. INTRODUCTION Wired data networks are critical enablers of Information and Communication Technology (ICT) services, which in turn bring financial benefits to organizations in the form of productivity improvement or competitive differentiation [1]. Hospitals have become critically dependent on ICT services as they support most of their business processes despite their clinical (e.g., patient management, electronic medical records, pharmacy, etc.), managerial (e.g., human resources, payrolls, supply management, inventory, etc.), or strategic (e.g., providing information support for long-term planning) nature [2]. The adoption of these services has facilitated managerial outcomes such as improving the quality of patient care [3] but primarily, reducing operational costs [4], [5]. As such, degraded or disrupted ICT services The associate editor coordinating the review of this article and approving it for publication was Haider Abbas. have a substantial impact on people, processes, and business goals [6], [7]. At a physical level, a wired data network is made up of nodes (e.g., packet switches) interconnected by communication links. These assets are exposed to threats such as natural disasters, power outages, accidental damage, cyberattacks, etc. When threats materialize, network service is degraded and ICT services may become unavailable to some users, impacting operational performance, which represents a risk for the organization. Figure 1illustrates an example data network where hospital workers access ICT services delivered from a local or remote data center accessible through a central network node (root). If the link between nodes 1 and 2 suffered accidental damage, users attached to nodes 2 and 3 would lose network connectivity and therefore, access to ICT services. While some activities may remain unaffected, some others would revert to slower, manual procedures. After recovery, the affected information systems VOLUME 7, 2019 This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see http://creativecommons.org/licenses/by/4.0/ 120411 A. Estepa et al.: Designing Cost-Effective Reliable Networks From a Risk Analysis Perspective: Case Study for a Hospital Campus FIGURE 1. Example of data network topology and the use of ICT services. would have to be checked and updated for the sake of consistency [8]. This overall process would likely result in a degraded quality of patient care and operational struggle, not to mention reputation and economic costs. A countermeasure to reduce degradation in the previous example is to create alternative paths in the network topology by adding extra links. For example, a link between nodes 0 and 3 in Figure 1would create a ring topology that would withstand the failure of one link as switches can autonomously re-arrange packet forwarding at the link-layer. Thus, the new link added to the baseline topology can be viewed as a countermeasure that reduces the risk of staff unable to do their job at full capacity and its associated impact. However, implementing this countermeasure also implies cost and it is unclear as to whether such an investment would pay off. This work addresses the challenge of finding the topology with the most profitable redundancy (viewed as an investment). However, as commonly considered in the field of cybersecurity, the return of investment does not translate to increased revenues but rather loss prevention (i.e. reduction of risk). The design of reliable networks is a mature topic in engineering [9]. Given a set of nodes, the reliable network design problem either finds the minimum cost topology subject to a reliability constraint [10] or the most reliable topology subject to a cost constraint [11]. Unfortunately, reliability is typically expressed in terms of the probability that network nodes are fully interconnected (e.g., 0.994) which is not as meaningful for an organization as the impact of the unavailability of ICT services on business processes. In this paper, we propose a methodology for designing a reliable wired data network in the context of a hospital campus. Given a set of nodes with known location and some basic information from the organization, we provide a method for estimating per node loss expectancy attributable to users unable to access ICT services due to loss of network connectivity. This information is then used to obtain the most profitable topology with minimum investment. A case study will apply this methodology to the design of the data network of a large hospital campus in Seville (Spain), showing the benefits of our proposal compared to traditional generic methods. The novelty and originality of this work are: •We frame network design into the field of risk analysis. •We develop a simple but efficient model of the impact of network downtime in productivity for the healthcare environment. •We provide a network design methodology that optimizes the return of the investment. The contributions of this paper can be used for planning the data network of new hospitals or for upgrading/extending current networks. Note that the scope of this paper is restricted to the wired network, excluding other systems such as wireless networks, or software protocols implemented at network nodes which can also impact connectivity. The remainder of this paper is organized as follows. Section II provides an overview of related works. Section III defines the optimization problem, which is based on the reliability and loss expectancy models defined in Section IV. Section Vbriefly introduces the heuristic method used to find solutions. A case study is presented in Section VI and the results obtained in Section VII. Finally, Section VIII concludes the paper. II. RELATED WORKS The role of ICT in healthcare has been comprehensively addressed in [12], where more than 300 papers from both technological and medical fields are reviewed. Aceto et al. use a 3-layer model to dissect scientific literature. At the bottom layer, wired and wireless networks and other technologies such as smart devices form the ICT pillars. The middle layer comprises ICT paradigms such as cloud computing or IoT, and the third layer includes current ICT-based healthcare paradigms such as e-health, mobile health, or ubiquitous 120412 VOLUME 7, 2019 A. Estepa et al.: Designing Cost-Effective Reliable Networks From a Risk Analysis Perspective: Case Study for a Hospital Campus health. Today, most of the research interest is focused on the top two layers, and from the bottom layer, only wireless networks have received some attention for providing ad-hoc infrastructure for emergencies [13], bringing clinical information to the point of care [14], or collecting clinical data from remote patients for e-health applications [15], [16]. Despite being a critical part of ICT pillars, literature specifically targeted to the design of wired networks in healthcare environments is both scarce and outdated [17]–[19]. As such, it is implicitly assumed to be a subject that can either be successfully addressed with proprietary knowledge or sufficiently covered by generic problems defined in the scientific literature. A. RELIABLE NETWORK DESIGN PROBLEMS Many network design problems have been addressed in literature over several decades [20]–[22], but the design of reliable networks is rooted in the Reliable Network Design (RND) problem [23], [24]. Given a set of nodes, this optimization problem typically finds the set of links that either minimizes the cost of building a network subject to reliability (i.e. the probability that the graph is still connected even if some of the edges fail) [10], [25], [26], or maximizes reliability subject to cost. A good example can be found in [11], where the authors design a reliable campus-wide network interconnecting 11 nodes (which represent buildings at Gazi University) and compare the performance of various metaheuristics in finding optimal solutions. Solutions are presented comparing the network topology cost versus its associated reliability. However, in our context, three main objections can be made: (i) the reliability model used is all-terminal (i.e. probability that all nodes are interconnected) whereas in a centralized local area network such as the one illustrated in Figure 1, the access to ICT services depends on the availability of a physical path to the root node (two-terminal reliability [27]); (ii) the impact of network incidents (which is more meaningful than a simple probability) is ignored; (iii) in the optimization problem all nodes are assumed to be equally important for the organization whereas in practice the consequences of node failure may be different depending on users affected as shown in the previous section. To the best of our knowledge, only the Productivity-Aware RND problem [28] envisages the impact of network incidents in terms of economic cost but unfortunately, it does not specify how to model such impact. B. IMPACT OF NETWORK DOWNTIME IN HOSPITALS Health ICT outages and its implications have been studied in [29], where 116 hospital incident reports in China have been examined. The top three factors that caused outages were software malfunction, hardware malfunction, and loss of network connectivity. The time of the day where incidents occurred was predominantly in the morning shift. The patient care areas most affected were outpatient, billing, and pharmacy: the entire hospital was affected in eight cases. The negative outcomes included patient care affected (e.g., risks, canceled visits, etc.) but also financial losses (35 cases) in the form of lawsuits, monetary compensations, and opportunity costs associated with patient care services during ICT outage. None of the incident reports provided an explicit estimation of the magnitude of the financial losses. Cost of communication inefficiencies has also been explored in [30]. The authors point out that outages in communication services are a common cause of wasted time for physicians and nurses, increasing the stay for inpatients. Their survey indicates that physicians and nurses waste 2% and 8% of their shift time respectively, accounting for estimated losses of up to $4 million annually for a typical 500-bed hospital in the U.S. In [31], the author finds that for every minute an Electronic Health Record (EHR) application is down, the average physician spends 2.15 minutes to perform the required task manually, plus the time required to update the computer system after recovery. Nurses also spend additional time in performing tasks. This does not take into account the cost of improper or erroneous diagnosis and prescriptions due to outdated information in the EHR but provides a lower bound on network outage costs. In general, assessing the economic impact of ICT in healthcare is a difficult task which requires methods to account for the economic return of the investment [32], such as costeffectiveness analysis, cost-benefit analysis, and cost-utility analysis [33]. However, econometric methods address the output of using ICT and not its relation with the network infrastructure that supports ICT services. From our review of literature one can conclude that while it is proven that network incidents result in time wasted by staff, its translation to economic cost usable into a network design problem has never been addressed before. This is not a trivial task and should be organization specific. However, we believe that a basic but effective model can be applied to healthcare organizations enabling the design of their data networks based on risk reduction. III. PROBLEM STATEMENT As introduced earlier, the value of a data network can be observed from a risk analysis perspective: nodes and communication links are assets vulnerable to threats such as accidental breakage, power failure, etc. that materialize with a certain probability causing degradation in the asset (i.e. disconnection of some network nodes resulting in outage of ICT services for affected users). The risk associated with a wired data network can then be calculated through the classical formula: Risk =P×I(1) where Pstands for the frequency of occurrence of the threat, and Iaccounts for estimation of the impact for the organization which can be quantified in terms of lost profits as a result of time wasted by affected staff. In our context, each possible network topology with alternative paths to the root node can be seen as a countermeasure for risk mitigation. Clearly, a full-mesh topology exhibits higher resilience to accidental failures than a tree-like VOLUME 7, 2019 120413 A. Estepa et al.: Designing Cost-Effective Reliable Networks From a Risk Analysis Perspective: Case Study for a Hospital Campus topology. However, it also requires higher investment (i.e. capital expenditure or CAPEX). Thus, the question at hand is: which topology is the best investment? A. BENEFITS OF INVESTMENTS IN COUNTERMEASURES In the field of cybersecurity, investment in countermeasures is not expected to return revenues but loss prevention.1The following definitions are typically applied in risk analysis: •Single Loss Expectancy (SLE): is the expected amount of money that is lost during a single incident. It is difficult to estimate and it should include at least direct loss costs and indirect costs associated with fallout of the data breach. •Annual Loss Expectancy (ALE)=SLE ×ARO, where ARO stands for Annual Rate of Occurrence (i.e. probability of having an incident in one year). This is equivalent to risk. •Modified Annual Loss Expectancy (mALE) is similar to ALE but includes (i.e. subtracts) the loss prevented by the implemented countermeasure. This is equivalent to residual risk after implementing the countermeasure. Therefore, the Annual Loss Prevention (ALP) attributable to a countermeasure can be expressed as ALP = ALE −mALE. The benefit of investing in a countermeasure can be evaluated through the Net Present Value (NPV). The NPV compares anticipated benefits and cost over time, discounting investment and cost over time to the present value. It can be defined as: NPV (T)= −CAPEX + T X i=1 ALPi−Ci (1 +k)i(2) where CAPEX is the cost of building the network topology, Tis the period over which the investment is evaluated, Ciis the annual cost, and kis the annual discount rate. It seems evident that any countermeasure should meet NPV >0 to be eligible. Let xbe a network topology with redundant paths to the root node which can be used as a potential countermeasure in our context. Then, the most profitable network topology over the period Tis the xthat maximizes NPV (x,T): max NPV (x,T)=max −CAPEX(x) + T X i=1 ALE −mALEi(x)−Ci (1 +k)i!(3) For the remainder of this paper, we assume that: •A physical topology does not require operation expenditure (i.e. Ci=0 in Equation 3). •mALE is constant over the Tyears under consideration (i.e. mALEi=mALE,∀iin in Equation 3). 1This is equivalent to opportunity cost, or alternative cost in microeconomic theory (i.e. the most valuable choice). •ALE (i.e. annual loss expectancy before the countermeasure) does not depend on x Then, the condition expressed in Equation 3is equivalent to: min  CAPEX(x)+mALE(x) T X j=1 1 (1 +k)j (4) Let us define the modified loss expectancy after Tyears, mLE(x,T) as: mLE(x,T)=mALE(x) T X j=1 1 (1 +k)j(5) Then, the most beneficial topology xafter Tyears is the one that minimizes the sum of the cost of building the network plus its associated modified loss expectancy: min (CAPEX(x)+mLE(x,T))(6) B. MATHEMATICAL FORMULATION OF THE OPTIMIZATION PROBLEM A communication network can be modeled by a probabilistic graph G=(N,L,pn,pl) in which Nand Lare the set of nodes and communication links respectively, pnis the reliability of the nodes (i.e. probability that it is operational) and plis the reliability of communication links per length unit. Let us define CAPEX of a network xas: CAPEX(x)= |N| X i=1 |N|−1 X j=1 cijxij (7) where xij ∈ {0,1}is a boolean variable that indicates whether (i,j) link exists or not, and cij is the cost of (i,j) link. Note that although cost can be further modeled using the link’s length and type such as in [11], we assume that cost information is given. Furthermore, in a topology re-design cij should be 0 for those communication links that already exist. This would also allow one to verify that the cost of the countermeasure is less than the expected return (i.e. mLE >CAPEX). Then, taking xij as the decision variable, the optimization problem that finds the most beneficial topology after Tyears of network operation can be formulated as: Minimize xij   |N| X i=1 |N|−1 X j=1 cijxij +mLE(x,T) (8) The problem assumptions are: •Networks have bidirectional links and therefore are modeled by graphs with nondirected links. It is further assumed that the graph is connected and has no parallel (i.e., redundant) edges. •The location and number of nodes are known. •Each cij,pn,pl,kand Tare fixed and known. •Failures are assumed to be independent and components can only take one of two states, operational or failed. 120414 VOLUME 7, 2019 A. Estepa et al.: Designing Cost-Effective Reliable Networks From a Risk Analysis Perspective: Case Study for a Hospital Campus •A root node ∈Ninterconnect servers (either local or remote) to the network. This node is assumed to be perfectly reliable. This assumption is based on the fact that data centers are typically well conditioned and secured. Furthermore, if the root node fails, ICT services become unavailable to all users. As such, the topology of the network becomes irrelevant as no risk reduction can be achieved through topology design. Finally, bandwidth in the network is assumed to be sufficient for the ICT services provided. This is justified in today’s switched Ethernet thanks to high-speed links (1-10 Gbps) and available techniques for traffic segregation and prioritization. IV. MODELING THE MODIFIED LOSS EXPECTANCY To fit into the optimization problem, mLE(x,T) has to be apportioned among the nodes of the network. This can be mathematically formulated as: mLE(x,T)= T X j=1 mALE(x) (1 +k)j= T X j=1 24×365 (1 +k)j· |N|−1 X i=1 0i(x)Si (9) where 0i(x) is the probability that node iis disconnected from the root node; Sirepresents the expected hourly loss due to the unavailability of network service to users attached to node i. Both factors can be modeled as follows. A. MODELING 0i(x) 0i(x) accounts for the probability of having no valid path from node ito the root node (two-terminal reliability model). Assuming that both links and nodes can simultaneously fail up to a maximum number (e.g., up to LFlinks and NFnodes), 0ican be calculated using the law of total probability (with the simultaneity of failures as mutually exclusive events) as: 0i(x)= LF X l=1 zilδl+ NF X n=1 winγn− LF X l=1 NF X n=1 zilwinδlγn(10) where zil is the conditional probability of service outage for node igiven that llinks have failed simultaneously, δlis the probability that llinks fail simultaneously, win is the conditional probability of service outage for node igiven that nnodes have failed simultaneously and γnis the probability that nnodes fail simultaneously. Further details for the computation of zil and win can be found in [28]. For example, let Gin Figure 2be the graph representing a specific network topology with 4 nodes (node 0 is root) and 6 links. Let’s suppose that up to two nodes and links can simultaneously fail and that the probability node failure is 0.001, and the probability (per meter) of link failure is 10−6. For the sake of simplicity, let’s assume that all links exhibit the same length of 100 m. Then, the following values would be obtained: •probability of simultaneous link failure: –single link: δ1=6 1·10−4·(1 −10−4)5≃6·10−4 –two links: δ2=6 2·10−4·2·(1−10−4)4≃1.5·10−7 FIGURE 2. Example network G(full mesh topology). •probability of service outage as a result of link failures: (note that each node has three links) –when only one link fails: z11 =z21 =z31 =0. –when two links fail: z12 =z22 =z32 =0 •probability of simultaneous node failure: –single node: γ1=3 1·10−3·(1−10−3)2≃3·10−3 –two nodes: γ2=3 2·10−3·2·(1−10−3)≃3·10−6 •probability of service outage as a result of node failures: –when only one node fails: w11 =w21 =w31 =1/3 –when two nodes fail: w12 =w22 =w32 =2/3 Substituting the previous probabilities into Equation 10 we obtain: 01(x)=02(x)=03(x)=0.001, and the average network reliability would be 0.999. Multiplying 0i(x) by 8 760 hours (24 ×365), we obtain an expected annual downtime of 8.759 hours for each node. B. MODELING THE EXPECTED HOURLY LOSS Si As stated earlier, losses from network incidents are of many types, including injuries, personal claims, reputation, etc. However, in this work, only the deterioration of productivity will be accounted for. Our approach is based on the idea that workers need extra time to complete tasks when ICT services become unavailable. Then, assuming that salaries are somehow related to productivity, the expected loss related to a network incident can be modeled by a portion of labor cost according to the degradation of performance as a consequence of ICT services unavailability. Fine-grained modeling of productivity in a hospital can be challenging by itself, not to mention decomposing it into nodes of a network. Note, however, that our goal is not to model how ICT impacts on productivity, but simply to weigh each node of the network according to a rough estimation of how much would be lost if the node was down (i.e. risk). Furthermore, we seek a coarse-grain model simple and generic enough to be valid for most hospital environments. To assess the risk of each node of the network, we consider a dependency model such as the one illustrated in Figure 3. Its main elements and assumptions are: •Nodes (set N): a network node enables access to ICT services through attached terminals. Node iservice is down with probability 0iwhen there is no valid path from node ito the root node. The number of terminals attached to each node and their potential users are known. The root node has no users attached. VOLUME 7, 2019 120415 A. Estepa et al.: Designing Cost-Effective Reliable Networks From a Risk Analysis Perspective: Case Study for a Hospital Campus FIGURE 3. Model of dependency between nodes, ICT services, and users. •ICT Services: enhance users productivity and depend on network service. All ICT services are assumed to be accessible from any network node. •Users: each user accesses ICT services through a terminal attached to a network node. As such, users can be apportioned among network nodes accordingly. Each user has a category (i.e. role) and belongs to one organizational unit. •Roles: reflect the capabilities of a worker and determine salary.2Users are categorized into roles (see [34] for an exhaustive list). For our purposes, coarse-grained categorization is preferable. Let R= {1,2, ..R}be the set of roles under consideration. •Units: a unit is defined as the context in which ICT services are being used. For example, a unit could be a cost center group [35] (e.g., operating room), a cost center (e.g., operating room 1), a service-line [36] (e.g., orthopedics) or a department [37] (e.g., general surgery). The designer has to define units based on the organizational structure, available information, and space use. It is assumed that network nodes can be shared by multiple units. Let U= {1,2, ..U}be the set of organizational units under consideration. To apportion expected loss among network nodes using our dependency model, we propose a methodology inspired in the risk management process defined in NIST 800-39 [38] with the following steps: 1) Framing. This step establishes the context and provides a common perspective of the organization and ICT services in place. It takes inputs from both 2Although we are aware that this assumption is not accurate, it suffices for our needs (we consider average values) and simplifies the model. managerial and technical levels and produces the information used in subsequent steps. The output of this step is the specification of: •set R: roles under consideration. •set U: units under consideration. •set P= {pjk ,j∈R,k∈U}: users by role and unit. •set L= {lj,j∈R}: hourly labor cost by role. 2) Impact assessment. This step quantifies the expected loss when ICT services are down. We assume that staff with the same role and unit use the same set of ICT services. The expected loss is determined as follows: a) Define a set of levels of dependency that represent extra time needed to compensate for ICT disruption (including updating the information systems after recovery). For example, a level of 0.5 (medium) means that 50% of extra time is needed by a worker to do her job when ICT services are down. We assume that extra time directly translates to extra labor cost. b) Estimate the level of IT dependency for each unit and role using the scale previously defined. c) Determine the hourly extra labor cost attributable to ICT outage for each role and unit using the previous estimation and the labor cost by role from L. The output of step 2 is: •set E= {ejk ,j∈R,k∈U}with the hourly loss attributable to ICT outage for each role and unit under consideration. 3) Distribution of users among network nodes. Specify units using each node. For each of such units, specify how many users from each role are attached to the node. Let us define the boolean variable αijk be 1 if a user from role jand unit kis attached to node iand 0 otherwise. The output of this step is: •set O= {oijk ,∀i∈N, αijk =1}. Where oijk is the number of users from pjk that are wired to node i. 4) Calculate Si. The expected loss rate associated with node ican be readily calculated by adding, for each unit using the node, the number of users from each role (from step 3) multiplied by their corresponding hourly loss (from step 2). Si=X j∈RX k∈U ejk oijk (11) Let us illustrate the procedure with a simplified example that uses the network topology from Figure 2. •output of step 1: –set of roles: R= {practicist(r1),nurse(r2),technician(r3)}. –set of units: U= {outpatient(u1),radiology(u2),surgey(u3)}. 120416 VOLUME 7, 2019 A. Estepa et al.: Designing Cost-Effective Reliable Networks From a Risk Analysis Perspective: Case Study for a Hospital Campus TABLE 1. Hourly expected loss per role and unit (set E). TABLE 2. Distribution of users among network nodes (set O). –set of users by role and unit: P= {24(r1u1),4(r1u2),4(r1u3),26(r2u1), 6(r2u2),8(r2u3),8(r3u1),3(r3u2),2(r3u3)} –cost of labor: L= {100 e/h(l1),60 e/h(l2),50 e/h(l3)}. •output of step 2: –levels of dependency: 0 (null), 0.25 (low), 0.5 (medium), 1 (high). –hourly expected loss per role and unit (set Erepresented as Table 1for better readability). •output of step 3: –distribution of users among network nodes (set O represented as Table 2for better readability). •Step 4: Calculus of Si. The expected hourly loss rate for each node (but the root) is calculated according to Equation 11 using the output of steps 2 and 3 as: S1=1 215 e/h S2=690 e/h S3=520 e/h Now we have all terms in Equation 9(recall from previous section that 0i=0.001 and nodes were expected to be down 8.759 hour/year). Therefore, the expected loss from network outages after T=10 years with an annual discount rate of 2% (k=0.02) would be: mLE(x,T)= 10 X j=1 8.759 ·1 215 +8.759 ·690 +8.759 ·520 (1 +0.02)j =190 795 e V. SOLUTION SEARCH METHOD The solution to the optimization problem formulated in Section III-B requires finding the set of links that meet Equation 8. Therefore, the number of potential solutions increases with the number of nodes as 2|N|(|N|−1)/2(see a complexity analysis in [27]). For this reason, exhaustive search (i.e. evaluating all potential topologies) is not usually feasible as Nincreases and heuristic search methods are commonly used as a general way to find a (semi) optimal solution. FIGURE 4. Main steps followed by our genetic algorithm. Genetic Algorithms (GAs) were introduced in [39] and have demonstrated considerable success in providing good solutions to reliable network design problems as shown in [40]. Other metaheuristics, including particle swarms optimization, artificial immune system, and simulated annealing, can be used instead of or in hybridization with GAs. However, we opt for using well-known GAs for the sake of simplicity since: (a) their performance and quality of solutions in similar problems is already proven; (b) this work is not focused on the metaheuristic performance. The performance of GAs can be improved by developing problem-specific heuristics in their operators. In this paper, we use the operations and heuristics proposed in [28] which are summarized here for the sake of completeness. Figure 4 shows the steps followed by our GA. The operators used are: •Initial Population and Population Size. Each individual is a topology x. We create |N|different individuals prone to be fit instead of random. To do so, we first create one individual with the lowest possible cost by solving the minimum spanning tree problem [41]. Then, we create |N| − 1 individuals that are the cheapest trees that differ from the first individual in only two links. •Selection. We use proportional reproduction, ranking individuals by the fitness function defined in Eq. 8cor- rected by a control parameter f(x)=xη, η < 1 to avoid preferential parents selection, which could result in premature sub-optimal solutions. •Crossover. The crossover operator combines characteristics of two parents to create two new individuals. We define a uniform-type crossover operation between parents Aand Band descendants aand bas follows: each descendant is formed by selecting alternative pairs of links from each parent (e.g., a inherits from A links from nodes 0,1,3,4,7,8... and from B, links from nodes 2,3,5,6...) •Mutation. The mutation operator adds randomness to the population. We develop an exchange-type mutation for each descendant, where for each pair of nodes VOLUME 7, 2019 120417 A. Estepa et al.: Designing Cost-Effective Reliable Networks From a Risk Analysis Perspective: Case Study for a Hospital Campus FIGURE 5. Nodes to be interconnected at hospital premises. (i,j), xij is switched with probability Pm. Since topologies should be connected by definition, we eliminate new individuals not meeting this constraint after the crossover or mutation. We have checked that the percentage of new individuals born at each generation who do not meet this constraint is always below 1%. •Fitness Evaluation. The fitness evaluation is based on the objective function in Eq. 8. The time complexity of this evaluation is O|L|2|N|2log2(|L|). •Population replacement. The entire population by the |N|better individuals from the present generation, including the newly descendants. The algorithm finishes (exit criteria) when a new individual with lower fitness value can not be found after a certain number of generations. A study of the complexity and convergence speed of this algorithm can be found in [28]. VI. CASE STUDY: THE VIRGEN DEL ROCIO HOSPITAL In this section, we apply our methodology to design the campus network of a large hospital. In order to make it replicable, we only use public information available at the time of writing such as the hospital’s annual report [42], the hospital’s IT Department report [43], or the regional health service annual report [44]. Managers with more detailed and accurate information will likely achieve better results. Figure 5illustrates the hospital campus and its main buildings. Our goal is to find the best set of links that interconnect the nodes (i.e. buildings) in Figure 5(campus-wide WAN network design) according to the optimization problem from Equation 8. It is assumed that the local area network topology within each building is predetermined by infrastructure design. A. INTRODUCTION TO THE HOSPITAL ENVIRONMENT The Virgen del Rocío hospital campus is located in Seville, Spain. It comprises 12 main buildings over an extension of 230 000 m2, serving a population of nearly 600 000 inhabitants (inpatients, outpatients and emergencies). It counts with 54 operating rooms, 1 291 beds, and more than 5 000 workers categorized as physicians or nurses, plus 2 000+non-clinical workers. From its annual budget of 516 Me(2016), nearly 253 Mecorrespond to labor cost. Its IT Department coordinates services, including [45]: •A data center with a server farm capable of dealing with more than 600 concurrent users for locally hosted services. •Support and maintenance for applications, printers, servers, databases, firewalls, and website. •The wired data network, composed of some 160 Ethernet switches, interconnecting more than 7 000 users, 3 000 client computers and 100 servers. It also provides access to the Internet and external ICT services. The regional health service claims that the following corporate services are running in all regional public hospitals: •Electronic Health Record (EHR) system. This software includes specialized modules for appointment and referral management, hospital outpatients, hospitalization, medical tests, emergency management, and electronic prescription [46], [47]. •Imaging Diagnostic System (IDS) •Radiological Information System (RIS) •Picture Achieving and Communication System (PACS) Other systems reported [48], [49] but not included in the previous list are: Hospital Pharmacy Management, Human Resources Information, Hospital Accounting Information, Strategic Management Information, Voice over IP, kitchen management, band printing for patient identification, chronic patient management, inter-hospital information system, intranets, etc. It is expected that these systems are managed and hosted by the IT department. In summary, several ICT services (either locally or remotely hosted) support business processes on campus, and hundreds of users depend on the wired data network to have access to them. B. NETWORK NODES As shown in Figure 5, the campus comprises 12 buildings (notice that node 0 is the root node). For our design, network nodes are placed at buildings’ centroid as shown in Figure 5. Table 3shows the set of nodes Nwith a brief description of each node and the shortest distance between them. This distance will be used to estimate the cost of each link in the optimization problem. C. HOURLY EXPECTED LOSS PER NODE (Si) Using the methodology provided in Section IV-B, the following outputs are produced: 1) Framing. Human resources are classified in [42] as: high-management, medical practitioners, nursery, management and services, and residents. The number of workers and labor cost for each category are also provided. Based on this information, we have defined the roles (set R) shown in Table 4where we also 120418 VOLUME 7, 2019 A. Estepa et al.: Designing Cost-Effective Reliable Networks From a Risk Analysis Perspective: Case Study for a Hospital Campus TABLE 3. List of network nodes and shortest distance. TABLE 4. Personnel categories and labor costs. show the hourly salary per role (set L), and the number of workers that belong to each role despite their unit (pj=Pk∈Upjk ) The first role includes not only physicians but also high-management, residents and pharmacists. In general, any highly qualified (e.g., master’s or doctoral degree or equivalent) position. The second role includes both nurses and nurse’s aides. The third role includes healthcare support workers such as ancillaries, clinical support staff, therapy assistants, etc. and domestic-related personnel (e.g., cook, housekeepers, maintenance). Finally, the last role includes only administrative personnel (i.e. clerks, receptionists, secretaries). The estimated cost of labor shown in the third column of Table 4is aligned with the information available in the annual report, adding up to ≈210M e/year (only regular hours). This represents about 136 000 e/hour. Regarding the units to be considered, the hospital annual report unveils three different organizational schemes: •Five clinical areas: hospitalization, surgery, emergencies, out-patients, and obstetrics. •Forty clinical management units (e.g., allergy, pathological anatomy, ophthalmology, intensive care, pediatric intensive care, general surgery, pediatric surgery, pharmacy, labs, internal medicine, etc..). In [50] one can find further information about each unit such as personnel and categories, resources, budget, and activity performance metrics in the areas of hospitalization, surgery, and out-patient. •Thirty-five service lines (e.g., critically burned, rare neuromuscular illnesses, rare cancers, etc..). TABLE 5. Units considered. For the purpose of network design, we define a simple combination of clinical areas, some clinical units, and other non-clinical departments as shown in Table 5. Various iterations were necessary to sort-out a definite list of units. For example, administration was first suggested as a unit, but after studying available information we realized that it was a role that all units had. Precisely, available information influenced our final choice (e.g., clinical units activity, and resources are broken down by areas similar to u1−u4in [50]). 2) Impact assessment. We define the same levels of ICT dependency as in our previous example: 0 (null), 0.25 (low), 0.5 (medium), 1 (high). Table 6shows the estimated hourly loss for each role and unit under consideration (set E). Basic knowledge of the activity and typical ICT services used by each unit is required to make an accurate judgment. For example, administrative work is likely to be more impaired than those services based on manual work (e.g., cleaning, transporting patients), or that a physician will be more impaired by lack of ICT services during an out-patient visit than during a surgery procedure. Documents such as disaster recovery plans can provide useful information about the impact of outages, manual procedures, etc. 3) Distribution of users among network nodes. Although this step is straightforward with the proper information, this is not the type of information publicly available. We have undergone a careful examination of each clinical unit listed in [50], its resources, personnel, and activity. The main assumptions made are: •A 5% rate of absenteeism has been considered as stated in [42]. VOLUME 7, 2019 120419